[PATCH] [shared] When checking /etc/passwd file for presence of non-root usernames having UID 0 consider also case where hashed passwords can be stored directly in /etc/passwd file. [Fedora] Use shared version of the 'UID 0 Belongs Only To Root' check.

Shawn Wells shawn at redhat.com
Mon Mar 3 17:55:47 UTC 2014


On 3/3/14, 9:52 AM, Jan Lieskovsky wrote:
> Another change pointed out by Tomas Heinrich originally to be
> intended against USGCB content, but it's applicable against SSG
> content too, thus this post.
>
> When checking /etc/passwd it's still possible (though hopefully
> not so likely these days) administrators would keep the hashed password
> versions in /etc/passwd file directly (probably like a temporary
> output / result of pwunconv utility run?) instead of storing them
> in /etc/shadow file (like recommended by another rule).
>
> Current / existing OVAL check implementation expects (allows) only one character
> ('x') to be present at the second column of /etc/passwd (where password
> entries are intended to be stored).
>
> But in case, /etc/passwd contains direct hashed password entries, the
> current implementation succeeds for non-root users having UID 0 (IOW
> succeeds for cases when there are more users with UID 0), even when
> it should fail.
>
> The proposed change modifies the particular regular expression to allow /
> accept also cases where password is longer than just one character, thus
> changes the original (regex) form from:
>
>    ^(?!root:)[^:]*:[^:]:0
>
> to:
>
>    ^(?!root:)[^:]*:[^:]*:0
>
> Besides this change it modifies the reading of the related comments (they
> to be more appropriate).
>
> Also uses this opportunity to use the shared/ OVAL check version for
> this rule also for Fedora content (tested on Fedora).
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-shared-When-checking-etc-passwd-file-for-presence-of.patch
>
>
>  From e61d055801e14865e4565ac64f68ac849b9f2c70 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Mon, 3 Mar 2014 15:26:17 +0100
> Subject: [PATCH] [shared] When checking /etc/passwd file for presence of
>   non-root usernames having UID 0 consider also case where hashed passwords can
>   be stored directly in /etc/passwd file.
>
> [Fedora] Use shared version of the 'UID 0 Belongs Only To Root' check.
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   .../input/checks/accounts_no_uid_except_zero.xml   | 23 +---------------------
>   shared/oval/accounts_no_uid_except_zero.xml        |  8 +++++---
>   2 files changed, 6 insertions(+), 25 deletions(-)
>   mode change 100644 => 120000 Fedora/input/checks/accounts_no_uid_except_zero.xml
>
> diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml b/Fedora/input/checks/accounts_no_uid_except_zero.xml
> deleted file mode 100644
> index 731ffee..0000000
> --- a/Fedora/input/checks/accounts_no_uid_except_zero.xml
> +++ /dev/null
> @@ -1,22 +0,0 @@
> -<def-group>
> -  <definition class="compliance" id="accounts_no_uid_except_zero" version="1">
> -    <metadata>
> -      <title>UID 0 Belongs Only To Root</title>
> -      <affected family="unix">
> -        <platform>Fedora 19</platform>
> -      </affected>
> -      <description>Only the root account should be assigned a user id of 0.</description>
> -    </metadata>
> -    <criteria>
> -      <criterion comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" test_ref="test_accounts_no_uid_except_root" />
> -    </criteria>
> -  </definition>
> -  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" id="test_accounts_no_uid_except_root" version="1">
> -    <ind:object object_ref="object_accounts_no_uid_except_root" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="object_accounts_no_uid_except_root" version="1">
> -    <ind:filepath>/etc/passwd</ind:filepath>
> -    <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]:0</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -</def-group>
> diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml b/Fedora/input/checks/accounts_no_uid_except_zero.xml
> new file mode 120000
> index 0000000..0cb08ba
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_no_uid_except_zero.xml
> @@ -0,0 +1 @@
> +../../../shared/oval/accounts_no_uid_except_zero.xml
> \ No newline at end of file
> diff --git a/shared/oval/accounts_no_uid_except_zero.xml b/shared/oval/accounts_no_uid_except_zero.xml
> index 024f052..6e06ab9 100644
> --- a/shared/oval/accounts_no_uid_except_zero.xml
> +++ b/shared/oval/accounts_no_uid_except_zero.xml
> @@ -5,20 +5,22 @@
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>           <platform>Red Hat Enterprise Linux 7</platform>
> +        <platform>Fedora 20</platform>
>         </affected>
>         <description>Only the root account should be assigned a user id of 0.</description>
>         <reference source="MED" ref_id="20130807" ref_url="test_attestation" />
> +      <!-- Fedora 20: <reference source="JL" ref_id="20140303" ref_url="test_attestation" /> -->
>       </metadata>
>       <criteria>
> -      <criterion comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" test_ref="test_accounts_no_uid_except_root" />
> +      <criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="test_accounts_no_uid_except_root" />
>       </criteria>
>     </definition>
> -  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" id="test_accounts_no_uid_except_root" version="1">
> +  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="test_accounts_no_uid_except_root" version="1">
>       <ind:object object_ref="object_accounts_no_uid_except_root" />
>     </ind:textfilecontent54_test>
>     <ind:textfilecontent54_object id="object_accounts_no_uid_except_root" version="1">
>       <ind:filepath>/etc/passwd</ind:filepath>
> -    <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]:0</ind:pattern>
> +    <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
>       <ind:instance datatype="int">1</ind:instance>
>     </ind:textfilecontent54_object>
>   </def-group>
> -- 1.8.3.1

ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140303/54254e85/attachment.html>


More information about the scap-security-guide mailing list