<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<code>How's this?<br>
<br>
I haven't submitted a check for the file permissions check yet,
because I need to discuss the fact that EFI's grub.conf is going
to be 700, not 600. A side effect of VFAT, I suppose.<br>
</code><code><br>
- Maura Dailey<br>
<br>
</code><code>Signed-off-by: Maura Dailey
<a class="moz-txt-link-rfc2396E" href="mailto:maura@eclipse.ncsc.mil"><maura@eclipse.ncsc.mil></a></code><code><br>
</code><code>---</code><code><br>
</code><code> RHEL6/input/checks/file_group_owner_grub_conf.xml |
20 +++++++++++++++-----</code><code><br>
</code><code> RHEL6/input/checks/file_user_owner_grub_conf.xml |
20 +++++++++++++++-----</code><code><br>
</code><code> 2 files changed, 30 insertions(+), 10 deletions(-)</code><code><br>
</code><code><br>
</code><code>diff --git
a/RHEL6/input/checks/file_group_owner_grub_conf.xml
b/RHEL6/input/checks/file_group_owner_grub_conf.xml</code><code><br>
</code><code>index 3fc076a..6d54f69 100644</code><code><br>
</code><code>--- a/RHEL6/input/checks/file_group_owner_grub_conf.xml</code><code><br>
</code><code>+++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml</code><code><br>
</code><code>@@ -1,14 +1,16 @@</code><code><br>
</code><code> <def-group></code><code><br>
</code><code> <definition class="compliance"
id="file_group_owner_grub_conf" version="1"></code><code><br>
</code><code> <metadata></code><code><br>
</code><code>- <title>File /boot/grub/grub.conf Owned By
root Group </title></code><code><br>
</code><code>+ <title>File grub.conf Owned By root Group
</title></code><code><br>
</code><code> <affected family="unix"></code><code><br>
</code><code> <platform>Red Hat Enterprise Linux
6</platform></code><code><br>
</code><code> </affected></code><code><br>
</code><code>- <description>The /boot/grub/grub.conf file
should be owned by the root group.</description></code><code><br>
</code><code>+ <description>The grub.conf file should be
owned by the root group. By default, this file is located at
/boot/grub/grub.conf or, for EFI systems, at
/boot/efi/EFI/redhat/grub.conf</description></code><code><br>
</code><code>+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" /></code><code><br>
</code><code> </metadata></code><code><br>
</code><code>- <criteria></code><code><br>
</code><code>+ <criteria operator="OR"></code><code><br>
</code><code> <criterion
test_ref="test_file_group_owner_grub_conf" /></code><code><br>
</code><code>+ <criterion
test_ref="test_file_group_owner_efi_grub_conf" /></code><code><br>
</code><code> </criteria></code><code><br>
</code><code> </definition></code><code><br>
</code><code> </code><code><br>
</code><code>@@ -17,9 +19,17 @@</code><code><br>
</code><code> <unix:state
state_ref="state_file_group_owner_grub_conf" /></code><code><br>
</code><code> </unix:file_test></code><code><br>
</code><code> </code><code><br>
</code><code>+ <unix:file_test check="all"
check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_group_owner_efi_grub_conf" version="1"></code><code><br>
</code><code>+ <unix:object
object_ref="object_file_group_owner_efi_grub_conf" /></code><code><br>
</code><code>+ <unix:state
state_ref="state_file_group_owner_grub_conf" /></code><code><br>
</code><code>+ </unix:file_test></code><code><br>
</code><code>+</code><code><br>
</code><code> <unix:file_object comment="/boot/grub/grub.conf"
id="object_file_group_owner_grub_conf" version="1"></code><code><br>
</code><code>- <unix:path>/boot/grub</unix:path></code><code><br>
</code><code>-
<unix:filename>grub.conf</unix:filename></code><code><br>
</code><code>+
<unix:filepath>/boot/grub/grub.conf</unix:filepath></code><code><br>
</code><code>+ </unix:file_object></code><code><br>
</code><code>+</code><code><br>
</code><code>+ <unix:file_object
comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_group_owner_efi_grub_conf" version="1"></code><code><br>
</code><code>+
<unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath></code><code><br>
</code><code> </unix:file_object></code><code><br>
</code><code> </code><code><br>
</code><code> <unix:file_state
id="state_file_group_owner_grub_conf" version="1"></code><code><br>
</code><code>diff --git
a/RHEL6/input/checks/file_user_owner_grub_conf.xml
b/RHEL6/input/checks/file_user_owner_grub_conf.xml</code><code><br>
</code><code>index 53d5e2f..0a3df12 100644</code><code><br>
</code><code>--- a/RHEL6/input/checks/file_user_owner_grub_conf.xml</code><code><br>
</code><code>+++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml</code><code><br>
</code><code>@@ -1,14 +1,16 @@</code><code><br>
</code><code> <def-group></code><code><br>
</code><code> <definition class="compliance"
id="file_user_owner_grub_conf" version="1"></code><code><br>
</code><code> <metadata></code><code><br>
</code><code>- <title>File /boot/grub/grub.conf Owned By
root User</title></code><code><br>
</code><code>+ <title>File grub.conf Owned By root
User</title></code><code><br>
</code><code> <affected family="unix"></code><code><br>
</code><code> <platform>Red Hat Enterprise Linux
6</platform></code><code><br>
</code><code> </affected></code><code><br>
</code><code>- <description>The /boot/grub/grub.conf file
should be owned by the root user.</description></code><code><br>
</code><code>+ <description>The grub.conf file should be
owned by the root user. By default, this file is located at
/boot/grub/grub.conf or, for EFI systems, at
/boot/efi/EFI/redhat/grub.conf</description></code><code><br>
</code><code>+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" /></code><code><br>
</code><code> </metadata></code><code><br>
</code><code>- <criteria></code><code><br>
</code><code>+ <criteria operator="OR"></code><code><br>
</code><code> <criterion
test_ref="test_file_user_owner_grub_conf" /></code><code><br>
</code><code>+ <criterion
test_ref="test_file_user_owner_efi_grub_conf" /></code><code><br>
</code><code> </criteria></code><code><br>
</code><code> </definition></code><code><br>
</code><code> </code><code><br>
</code><code>@@ -17,9 +19,17 @@</code><code><br>
</code><code> <unix:state
state_ref="state_file_user_owner_grub_conf" /></code><code><br>
</code><code> </unix:file_test></code><code><br>
</code><code> </code><code><br>
</code><code>+ <unix:file_test check="all"
check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_user_owner_efi_grub_conf" version="1"></code><code><br>
</code><code>+ <unix:object
object_ref="object_file_user_owner_efi_grub_conf" /></code><code><br>
</code><code>+ <unix:state
state_ref="state_file_user_owner_grub_conf" /></code><code><br>
</code><code>+ </unix:file_test></code><code><br>
</code><code>+</code><code><br>
</code><code> <unix:file_object comment="/boot/grub/grub.conf"
id="object_file_user_owner_grub_conf" version="1"></code><code><br>
</code><code>- <unix:path>/boot/grub</unix:path></code><code><br>
</code><code>-
<unix:filename>grub.conf</unix:filename></code><code><br>
</code><code>+
<unix:filepath>/boot/grub/grub.conf</unix:filepath></code><code><br>
</code><code>+ </unix:file_object></code><code><br>
</code><code>+</code><code><br>
</code><code>+ <unix:file_object
comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_user_owner_efi_grub_conf" version="1"></code><code><br>
</code><code>+
<unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath></code><code><br>
</code><code> </unix:file_object></code><code><br>
</code><code> </code><code><br>
</code><code> <unix:file_state
id="state_file_user_owner_grub_conf" version="1"></code><code><br>
</code><code>-- </code><code><br>
</code><code>1.7.1</code><code><br>
</code>
</body>
</html>