[PATCH] [RHEL/6, RHEL/7, shared] Replace rsyslog_files_permissions OVAL unknown test stub with actual check implementation (UNCLASSIFIED)
Shaw, Ray V CTR USARMY ARL (US)
ray.v.shaw.ctr at mail.mil
Fri Jun 20 12:57:55 UTC 2014
Classification: UNCLASSIFIED
Caveats: NONE
Should it also search /etc/rsyslog.d/*.conf? It's possible that additional
files could be specified there.
[There are a couple of rules I've been wanting to add this to, but have
unfortunately not been able to make time at work.]
--
Ray Shaw (Contractor, STG)
Army Research Laboratory
CIO, Unix Support
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-
> security-guide-bounces at lists.fedorahosted.org] On Behalf Of Jan
> Lieskovsky
> Sent: Friday, June 20, 2014 5:51 AM
> To: SCAP Security Guide
> Subject: [PATCH] [RHEL/6, RHEL/7, shared] Replace
> rsyslog_files_permissions OVAL unknown test stub with actual check
> implementation
>
>
> The proposed patch replaces rsyslog_files_permissions OVAL unknown test
> stub with actual check implementation.
>
> The check:
> * first searches /etc/rsyslog.conf for (uncommented) presence of
> /var/log/*
> log files paths and stores these paths into list,
> * then selects just file objects (from all the system ones) having path
> matching
> some of the selected ones,
> * lastly compares (via file object state) if the permissions are 0600
> or stronger.
>
> The change has been tested on both, RHEL-6 & RHEL-7 & seems to work
> properly (=> update the test_attestations, created links & moved the
> test to shared within the patch proposal too).
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
Classification: UNCLASSIFIED
Caveats: NONE
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5621 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140620/c18bb9f0/attachment.bin>
More information about the scap-security-guide
mailing list