<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Just an aside, I did some poking around, and it is possible to
eliminate directories from the search. I looked at the USGCB stuffs
and here's what I put together for file_permissions_unowned.xml in
OVAL to eliminate /proc. I can do the same for the group id version.
To add more exclusions, add an '|' after proc, and type in another
directory path. It doesn't seem to care if you escape the forward
slashes, but I left that in just in case the behavior changes later.<br>
<br>
If anyone does figure out how to query PAM or nslcd/nscd for network
user ids, I think you can add it as an extra filter option to the
file_permissions_unowned_object.<br>
<br>
Please note, I have not gotten a single failure with this check
against /proc. I get thousands of failures on my workstation, since
I have large git repositories checked out to directories owned by my
network account on the root hard drive.<br>
<br>
<code><def-group></code><code><br>
</code><code> <definition class="compliance"
id="file_permissions_unowned" version="1"></code><code><br>
</code><code> <metadata></code><code><br>
</code><code> <title>Find files unowned by a
user</title></code><code><br>
</code><code> <affected family="unix"></code><code><br>
</code><code> <platform>Red Hat Enterprise Linux
6</platform></code><code><br>
</code><code> </affected></code><code><br>
</code><code> <description>All files should be owned by a
user</description></code><code><br>
</code><code> </metadata></code><code><br>
</code><code> <criteria></code><code><br>
</code><code> <criterion comment="Check all files and make
sure they are owned by a user"
test_ref="file_permissions_unowned_test" /></code><code><br>
</code><code> </criteria></code><code><br>
</code><code> </definition></code><code><br>
</code><code><br>
</code><code> <unix:file_state
id="file_permissions_unowned_userid_list_match" version="1"></code><code><br>
</code><code> <unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int"
/></code><code><br>
</code><code> </unix:file_state></code><code><br>
</code><code><br>
</code><code> <local_variable
id="file_permissions_unowned_userid_list" comment="List of valid
user ids" datatype="int" version="1"></code><code><br>
</code><code> <object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" /></code><code><br>
</code><code> </local_variable></code><code><br>
</code><code><br>
</code><code> <ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object" version="1"></code><code><br>
</code><code>
<ind:filepath>/etc/passwd</ind:filepath></code><code><br>
</code><code> <ind:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern></code><code><br>
</code><code> <ind:instance operation="greater than or equal"
datatype="int">1</ind:instance></code><code><br>
</code><code> </ind:textfilecontent54_object></code><code><br>
</code><code><br>
</code><code> <unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1"></code><code><br>
</code><code> <unix:behaviors recurse="symlinks and
directories" recurse_direction="down" recurse_file_system="local"
/></code><code><br>
</code><code> <unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath></code><code><br>
</code><code> <filter
action="exclude">file_permissions_unowned_userid_list_match</filter></code><code><br>
</code><code> </unix:file_object></code><code><br>
</code><code><br>
</code><code> <unix:file_test check="all"
check_existence="none_exist" comment="Check user ids on all files
on the system" id="file_permissions_unowned_test" version="1"></code><code><br>
</code><code> <unix:object
object_ref="file_permissions_unowned_object" /></code><code><br>
</code><code> </unix:file_test></code><code><br>
</code><code></def-group></code><br>
<br>
- Maura Dailey<br>
</body>
</html>