Remaining false positives

Shawn Wells shawn at redhat.com
Thu Jan 23 05:32:26 UTC 2014


On 1/15/14, 2:38 PM, Andrew Gilmore wrote:
>
> 1) mountopt_noexec_on_removable_partitions exits with error, when
> there are no removable partitions configured in fstab
> 2) file_ownership_library_dirs complains about an /usr/libexec suid
> abrt file
I receive the following which causes failures:
<unix-sys:filepath>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</unix-sys:filepath>

Specifically, because it's owned by UID 173:
<unix-sys:group_id datatype="int">173</unix-sys:group_id>
<unix-sys:user_id datatype="int">173</unix-sys:user_id>

$ ll /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
-rwsr-xr-x. 1 abrt abrt 5792 Aug 13 12:10 
/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache

So, I chown to root and rescan:
[shawn at SSG-RHEL6 checks]$ sudo chown root 
/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
[sudo] password for shawn:
[shawn at SSG-RHEL6 checks]$ ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsvMGoUH.xml
Writing results to : /tmp/file_ownership_library_dirsvMGoUH.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.

If anyone is feeling ambitious, file a bug with Red Hat Customer Service 
(customerservice at redhat.com) to tell the ABRT to clean up their file 
perms ;) Feel free to CC me.

The original failure against abrt seems legitimate though, given 
incorrect UID.

> 3) no_files_unowned_by_* are still broken and looking for any files in /

Acking Rodney's patch, should be fixed shortly.




> 4) enable_execshield and sysctl_kernel_randomize_va_space are failing,
> although sysctl shows correct results
Note these checks for runtime and static configuration settings. Ensure 
both are properly set. Able to pass on my local system:

[root at SSG-RHEL6 checks]# ./testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldpSQjvh.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldpSQjvh.xml-results
Definition oval:scap-security-guide.testing:def:113: true
Evaluation done.
[root at SSG-RHEL6 checks]# vim sysctl_kernel_exec_shield.xml
[root at SSG-RHEL6 checks]# vim sysctl_kernel_randomize_va_space.xml
[root at SSG-RHEL6 checks]# ./testcheck.py sysctl_kernel_randomize_va_space.xml
Evaluating with OVAL tempfile : 
/tmp/sysctl_kernel_randomize_va_spaceuhATnO.xml
Writing results to : /tmp/sysctl_kernel_randomize_va_spaceuhATnO.xml-results
Definition oval:scap-security-guide.testing:def:119: true
Evaluation done.




> 5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev
> directories

Known issue :(


> 6) enable_gdm_login_banner didn't get the gconf mandatory check fixed,
> although all the rest did (YAY!)

Hmm, you're right. You've patched a few things before.... patches welcome ;)

> 7) sysctl_ipv6_default_accept_redirects and service_ip6tables_enabled
> fail when ipv6 has been disabled via modprobe.d entries

Like Rodney pointed out...

https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=6a271a5df50529dc0ee4800dfce0933114c4677b


> 8) install_openswan is obsoleted by libreswan

Currently working offline. Can you open a ticket on this to ensure it 
doesn't get lost?


> 9) audit_file_access does not check for open_by_handle_at, and fails
> when the audit rules lines do not contain exactly the content specified.

What rule are you using to meet the requirement?

>
> I was very glad to see almost all of the sysctl and gconf false
> positives fixed!
>
Thanks for the feedback!


More information about the scap-security-guide mailing list