[PATCH] [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation.

Jan Lieskovsky jlieskov at redhat.com
Mon Jun 2 11:01:49 UTC 2014


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Saturday, May 31, 2014 4:27:04 AM
> Subject: Re: [PATCH] [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files	=> ensure_logrotate_activated
> transition. Replace	ensure_logrotate_activated	unknown test stub with actual OVAL check implementation.
> 
> 
> On 5/30/14, 5:09 AM, Jan Lieskovsky wrote:
> 
> 
> 
> The change:
>   [1]
>   https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=d2f99b0bd6dab889c5e023cf4df90df8bab8bc33
>   attempted to replace "logrotate_rotate_all_files" OVAL check with
>   "ensure_logrotate_activated" OVAL check,
> but failed (to do so in all locations):
> 
>   scap-security-guide]$ grep -rHn "logrotate_rotate_all_files" *
>   RHEL/6/input/system/logging.xml:377:<oval id="logrotate_rotate_all_files"
>   />
>   RHEL/7/input/system/logging.xml:377:<oval id="logrotate_rotate_all_files"
>   />
> 
> resulting into the following new 'make validate' / verify-input-references.py
> error message to appear:
>   Invalid OVAL definition referenced by XCCDF Rule:
>   ensure_logrotate_activated
> 
> Fix that by referencing the new OVAL check name in
> RHEL/{6,7}/input/system/logging.xml files too.
> 
> Besides that the original RHEL/6/input/checks/ensure_logrotate_activated.xml
> OVAL check was implemented just
> as unknown OVAL test stub. Replace that stub definition with actual
> implementation based on guide.html content,
> move it to shared, and create links for RHEL/6 and RHEL/7.
> 
> The proposal has been tested on RHEL/6 & RHEL/7 - rpm package builds
> properly, make validate warning
> disappeared & the check seems to be working properly on both of the products.
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> 0001-RHEL-6-RHEL-7-shared-Finish-logrotate_rotate_all_fil.patch
> From de1beb4d9137c24fd4e603b1a9e23c8d5eabc2cd Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Fri, 30 May 2014 10:56:04
> +0200
> Subject: [PATCH] [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files
> =>
>  ensure_logrotate_activated transition.                          Replace
>  ensure_logrotate_activated unknown test stub with actual OVAL check
>                 implementation.
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  RHEL/6/input/checks/ensure_logrotate_activated.xml | 21 +---------
>  RHEL/6/input/system/logging.xml                    |  2 +-
>  RHEL/7/input/checks/ensure_logrotate_activated.xml |  1 +
>  RHEL/7/input/system/logging.xml                    |  2 +-
>  shared/oval/ensure_logrotate_activated.xml         | 46
>  ++++++++++++++++++++++
>  5 files changed, 50 insertions(+), 22 deletions(-)
>  mode change 100644 => 120000
>  RHEL/6/input/checks/ensure_logrotate_activated.xml
>  create mode 120000 RHEL/7/input/checks/ensure_logrotate_activated.xml
>  create mode 100644 shared/oval/ensure_logrotate_activated.xml
> 
> diff --git a/RHEL/6/input/checks/ensure_logrotate_activated.xml
> b/RHEL/6/input/checks/ensure_logrotate_activated.xml
> deleted file mode 100644
> index aca539b..0000000
> --- a/RHEL/6/input/checks/ensure_logrotate_activated.xml
> +++ /dev/null
> @@ -1,20 +0,0 @@
> -<def-group>
> -  <definition class="compliance"
> -  id="ensure_logrotate_activated" version="1">
> -    <metadata>
> -      <title>Ensure All Logs are Rotated by logrotate</title>
> -      <affected family="unix">
> -        <platform>Red Hat Enterprise Linux 6</platform>
> -      </affected>
> -      <description>The logrotate (syslog rotater) service should be
> -      enabled.</description>
> -    </metadata>
> -    <criteria>
> -      <criterion comment="Find each file in /etc/syslog.conf in
> /etc/logrotate.d/syslog"
> -      test_ref="test_20154" />
> -    </criteria>
> -  </definition>
> -  <ind:unknown_test check="all"
> -  comment="use extended content to evaluated this test"
> -  id="test_20154" version="1" />
> -</def-group>
> diff --git a/RHEL/6/input/checks/ensure_logrotate_activated.xml
> b/RHEL/6/input/checks/ensure_logrotate_activated.xml
> new file mode 120000
> index 0000000..1916c40
> --- /dev/null
> +++ b/RHEL/6/input/checks/ensure_logrotate_activated.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/ensure_logrotate_activated.xml
> \ No newline at end of file
> diff --git a/RHEL/6/input/system/logging.xml
> b/RHEL/6/input/system/logging.xml
> index 82455d6..c7fc389 100644
> --- a/RHEL/6/input/system/logging.xml
> +++ b/RHEL/6/input/system/logging.xml
> @@ -374,7 +374,7 @@ If logrotate is configured properly, output should
> include references to
>  <tt>/etc/cron.daily</tt>.
>  </ocil>
>  <ident cce="27014-0" />
> -<oval id="logrotate_rotate_all_files" />
> +<oval id="ensure_logrotate_activated" />
>  <ref nist="AU-9" disa="366" />
>  </Rule>
>  </Group>
> diff --git a/RHEL/7/input/checks/ensure_logrotate_activated.xml
> b/RHEL/7/input/checks/ensure_logrotate_activated.xml
> new file mode 120000
> index 0000000..1916c40
> --- /dev/null
> +++ b/RHEL/7/input/checks/ensure_logrotate_activated.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/ensure_logrotate_activated.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/system/logging.xml
> b/RHEL/7/input/system/logging.xml
> index 36c2fb0..993d214 100644
> --- a/RHEL/7/input/system/logging.xml
> +++ b/RHEL/7/input/system/logging.xml
> @@ -374,7 +374,7 @@ If logrotate is configured properly, output should
> include references to
>  <tt>/etc/cron.daily</tt>.
>  </ocil>
>  <ident cce="RHEL7-CCE-TBD" />
> -<oval id="logrotate_rotate_all_files" />
> +<oval id="ensure_logrotate_activated" />
>  <ref nist="AU-9" disa="366" />
>  </Rule>
>  </Group>
> diff --git a/shared/oval/ensure_logrotate_activated.xml
> b/shared/oval/ensure_logrotate_activated.xml
> new file mode 100644
> index 0000000..c82b3a3
> --- /dev/null
> +++ b/shared/oval/ensure_logrotate_activated.xml
> @@ -0,0 +1,46 @@
> +<def-group>
> +  <definition class="compliance" id="ensure_logrotate_activated"
> version="1">
> +    <metadata>
> +      <title>Ensure the logrotate utility performs the automatic rotation of
> log files on daily basis</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +        <platform>Red Hat Enterprise Linux 7</platform>
> +      </affected>
> +      <description>
> +      The frequency of automatic log files rotation performed by the
> logrotate utility should be configured to run daily
> +      </description>
> +      <reference source="JL" ref_id="20140530" ref_url="test_attestation" />
> +    </metadata>
> +    <criteria comment="/etc/logrotate.conf contains daily setting or
> /etc/cron.daily/logrotate file exists" operator="OR">
> +      <criterion comment="Check if daily is set in /etc/logrotate.conf"
> +      test_ref="test_logrotate_conf_daily_setting" />
> +      <criterion comment="Check if /etc/cron.daily/logrotate file exists
> (and calls logrotate)"
> +      test_ref="test_cron_daily_logrotate_existence" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> +  comment="Tests the presence of daily setting in /etc/logrotate.conf file"
> +  id="test_logrotate_conf_daily_setting" version="1">
> +    <ind:object object_ref="obj_logrotate_conf_daily_setting" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="obj_logrotate_conf_daily_setting"
> version="1">
> +    <ind:filepath>/etc/logrotate.conf</ind:filepath>
> +    <ind:pattern operation="pattern match">^[\s]*daily[\s]*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> 

Thanks, Shawn. Good catch.

> Is there configuration precedence in the logrotate.conf file?

The last one will be used. logrotate will read its config from the start:
  [1] https://fedorahosted.org/logrotate/browser/trunk/config.c#L584

and each of:
* hourly:  https://fedorahosted.org/logrotate/browser/trunk/config.c#L996
* daily:   https://fedorahosted.org/logrotate/browser/trunk/config.c#L998
* weekly:  https://fedorahosted.org/logrotate/browser/trunk/config.c#L1003
* monthly: https://fedorahosted.org/logrotate/browser/trunk/config.c#L1001
* yearly:  https://fedorahosted.org/logrotate/browser/trunk/config.c#L1005

options will reset the value of newlog->criterium flag (which can have values
as listed in:  https://fedorahosted.org/logrotate/browser/trunk/logrotate.h#L36 ).

Yet logrotate will repeat this scenario for each of the files present in /etc/logrotate.d/
directory (+1 times for default /etc/logrotate.conf itself):
  https://fedorahosted.org/logrotate/browser/trunk/config.c#L472

> e.g. if you
> have "daily" followed immediately by "weekly," which will the logrotate use?

Testing a patched local RHEL-6 logrotate RPM instance revealed the latter one will be used.

> Should we ensure that daily exists, and the other options do not?

Yes, based on the above, the new patch version should ensure the 'daily' setting
is present / being used as the last (from newlog->criterium flag enum ones) option
in the logrotate.conf file.

I will come with new patch version proposal.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> I tried looking through the manpage and google with no avail.
> 
> 
> 
> 
> 
> 
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> +  comment="Tests the existence of /etc/cron.daily/logrotate file (and verify
> it actually calls logrotate utility)"
> +  id="test_cron_daily_logrotate_existence" version="1">
> +    <ind:object object_ref="obj_cron_daily_logrotate_existence" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="obj_cron_daily_logrotate_existence"
> version="1">
> +    <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
> +    <ind:pattern operation="pattern
> match">^[\s]*/usr/sbin/logrotate[\s]*/etc/logrotate.conf(?:.*)$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> --
> 1.8.3.1
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list