[PATCH] exclude proc/selinux files from world_writeable_files

Paul Tittle (Contractor) ptittle at cmf.nrl.navy.mil
Wed May 21 12:17:04 UTC 2014


On 5/21/14 5:47 AM, Jan Lieskovsky wrote:
> ----- Original Message -----
>> From: "Paul Tittle" <ptittle at cmf.nrl.navy.mil>
>> To: scap-security-guide at lists.fedorahosted.org
>> Sent: Tuesday, May 20, 2014 9:24:44 PM
>> Subject: [PATCH] exclude proc/selinux files from world_writeable_files
>>
>> The following commit in openscap causes proc to be considered a 'local'
>> filesystem.
>> ---
>> commit a9d98d697d85cb7f26c615543276e042c9749af0
>> Author: Tomas Heinrich <theinric at redhat.com>
>> Date:   Tue Nov 12 11:01:21 2013 +0100
>>
>>      OVAL: change the algo used to distinguish 'local' and 'remote' fs
>>
>>      With 'local', fts now descends into /proc and /sys, among others,
>>      which were previously excluded. This can cause performance issues.
>> ---
>>
>> The 'world_writeable_files' test will fail if a world-writeable
>> regular file is found. So we must mask out /proc files with a filter.
>> I did a `find / -perm -002 -type f` and also found some 'special' files
>> in /selinux that are world-writeable and type f, so a filter has been
>> added for those too.
> Just to explicitly see the performance difference / gain / improvement
> for that rule.
>
> Unpatched:
> ----------
> # time oscap oval eval --id oval:ssg:def:1086 ssg-rhel6-oval.xml
> Definition oval:ssg:def:1086: false
> Evaluation done.
>
> real    0m14.138s
> user    0m7.327s
> sys     0m2.590s
>
> Patched:
> --------
> # time oscap oval eval --id oval:ssg:def:1086 ssg-rhel6-oval-patched.xml
> Definition oval:ssg:def:1086: true
> Evaluation done.
>
> real    0m8.038s
> user    0m6.783s
> sys     0m1.232s
>
> => ACK, thank you for the patch.
>
> Btw. (IMHO) another good candidate for exclusion is /sys filesystem due the reasons
> outlined below:
> * it should be considered as dump of kernel data structures, their attributes (& linkage
>    between them) to userspace (from https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) =>
>
>    as such there shouldn't be reason / need why even administrator should want to update file
>    permissions on the files under that subdirectory (if the permissions should be changed, it's
>    bug of the package / kernel module creating that file, and it should be reported)
>
> * change of permissions (even when performed as root) from user-space holds only till the
>    next reboot (if not implemented via the particular module directly) => even the fix would
>    be only temporary
>
> * last, but not least, /sys contains lot of symlink loops, which by themselves might cause the
>    scanner to enter such infinite loop => IMHO I would propose /sys filesystem to be excluded from
>    scan too (just margin note).
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
>
>> ---
>>   ...ile_permissions_unauthorized_world_writable.xml |    8 ++++++++
>>   1 files changed, 8 insertions(+), 0 deletions(-)
>>
>> diff --git
>> a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml
>> b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml
>> index 599ad98..c3d4c8a 100644
>> --- a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml
>> +++ b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml
>> @@ -23,9 +23,17 @@
>>       <unix:path operation="equals">/</unix:path>
>>       <unix:filename operation="pattern match">^.*$</unix:filename>
>>       <filter
>>       action="include">state_file_permissions_unauthorized_world_write</filter>
>> +    <filter
>> action="exclude">state_file_permissions_unauthorized_world_write_exclude_special_selinux_files</filter>
>> +    <filter
>> action="exclude">state_file_permissions_unauthorized_world_write_exclude_proc</filter>
>>     </unix:file_object>
>>     <unix:file_state id="state_file_permissions_unauthorized_world_write"
>>     version="1">
>>       <unix:type operation="equals">regular</unix:type>
>>       <unix:owrite datatype="boolean">true</unix:owrite>
>>     </unix:file_state>
>> +  <unix:file_state
>> id="state_file_permissions_unauthorized_world_write_exclude_special_selinux_files"
>> version="1">
>> +    <unix:filepath operation="pattern
>> match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
>> +  </unix:file_state>
>> +  <unix:file_state
>> id="state_file_permissions_unauthorized_world_write_exclude_proc"
>> version="1">
>> +    <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath>
>> +  </unix:file_state>
>>   </def-group>
>> --
>> 1.7.1
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Thanks for ack, Jan. Pushed.


More information about the scap-security-guide mailing list