[PATCH] [RHEL/6, RHEL/7, shared] Replace rsyslog_files_permissions OVAL unknown test stub with actual check implementation (UNCLASSIFIED)
Jan Lieskovsky
jlieskov at redhat.com
Fri Jun 20 13:41:42 UTC 2014
Hi Ray,
----- Original Message -----
> From: "Ray V CTR USARMY ARL Shaw (US)" <ray.v.shaw.ctr at mail.mil>
> To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
> Sent: Friday, June 20, 2014 2:57:55 PM
> Subject: RE: [PATCH] [RHEL/6, RHEL/7, shared] Replace rsyslog_files_permissions OVAL unknown test stub with actual
> check implementation (UNCLASSIFIED)
>
> Classification: UNCLASSIFIED
> Caveats: NONE
>
> Should it also search /etc/rsyslog.d/*.conf? It's possible that additional
> files could be specified there.
Right, good catch. Not just /etc/rsyslog.d/*.conf, but whatever file / directory path
(possibly) specified after $IncludeConfig directive (under assumption it's not
commented out):
http://www.rsyslog.com/doc/rsconf1_includeconfig.html
Will come with another patch.
>
> [There are a couple of rules I've been wanting to add this to, but have
> unfortunately not been able to make time at work.]
That's another good point (check rules that might be recursively nesting settings
/ another config files for their proper work. Will review the current content for
cases like this).
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> --
> Ray Shaw (Contractor, STG)
> Army Research Laboratory
> CIO, Unix Support
>
>
> > -----Original Message-----
> > From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-
> > security-guide-bounces at lists.fedorahosted.org] On Behalf Of Jan
> > Lieskovsky
> > Sent: Friday, June 20, 2014 5:51 AM
> > To: SCAP Security Guide
> > Subject: [PATCH] [RHEL/6, RHEL/7, shared] Replace
> > rsyslog_files_permissions OVAL unknown test stub with actual check
> > implementation
> >
> >
> > The proposed patch replaces rsyslog_files_permissions OVAL unknown test
> > stub with actual check implementation.
> >
> > The check:
> > * first searches /etc/rsyslog.conf for (uncommented) presence of
> > /var/log/*
> > log files paths and stores these paths into list,
> > * then selects just file objects (from all the system ones) having path
> > matching
> > some of the selected ones,
> > * lastly compares (via file object state) if the permissions are 0600
> > or stronger.
> >
> > The change has been tested on both, RHEL-6 & RHEL-7 & seems to work
> > properly (=> update the test_attestations, created links & moved the
> > test to shared within the patch proposal too).
> >
> > Please review.
> >
> > Thank you && Regards, Jan.
> > --
> > Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> Classification: UNCLASSIFIED
> Caveats: NONE
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
More information about the scap-security-guide
mailing list