On 08/13/2013 03:36 PM, Shawn Wells wrote:
On 8/13/13 3:25 PM, Maura Dailey wrote:
How do you think we should handle file owner and group permission
checks on rsyslog files? Should we look for a predetermined list of
files (trying to search for *.log is insufficient, since at the very
least, /var/log/messages, /var/log/secure, and /var/log/maillog would
get passed over)? Or should we try ninja regex to parse rsyslog.conf?
I'm torn. The 'right way' would be regex ninja. However that's hard,
and has resulted in nothing getting done. Personally I'd rather have
*something* hard coded, then evolve into ninja regex.
With that said.... your regex-foo is strong and perhaps you could hack
this out in 15min... ;)
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
LOL, no, my regex is not that great. I played around with it this
morning and got as far as the following check, but I can't even imagine
how to handle rsyslog.conf's templating. If we have a consensus, perhaps
the best strategy is just to delete both rsyslog log permissions checks.
I can submit a patch that will do that pretty quickly.
- Maura Dailey
<def-group>
<definition class="compliance" id="rsyslog_files_groupownership"
version="1">
<metadata>
<title>Confirm Existence and Permissions of System Log Files</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>All syslog log files should be owned by the
appropriate group.</description>
</metadata>
<criteria>
<criterion comment="Check if group root owns all syslog log
files" test_ref="test_rsyslog_files_groupownership" />
</criteria>
</definition>
<ind:textfilecontent54_object comment="Find all /var/log files in
rsyslog.conf" id="rsyslog_files" version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
<ind:pattern operation="pattern
match">^.*(\/var\/log\/.*)$</ind:pattern>
<ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<local_variable comment="Build list of log files" datatype="string"
id="var_rsyslog_files_groupownership" version="1" >
<object_component item_field="subexpression"
object_ref="rsyslog_files" />
</local_variable>
<unix:file_state id="state_rsyslog_files_groupownership" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="Examine permissions of list of log files"
id="object_rsyslog_files_groupownership" version="1">
<unix:filepath var_ref="var_rsyslog_files_groupownership"
var_check="only one" />
</unix:file_object>
<unix:file_test check="all" check_existence="all_exist"
id="test_rsyslog_files_groupownership" version="1" comment="Test to see
if files in /var/log mentioned by rsyslog.conf have the correct group">
<unix:object object_ref="object_rsyslog_files_groupownership" />
<unix:state state_ref="state_rsyslog_files_groupownership" />
</unix:file_test>
</def-group>
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
