-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/13/2013 03:08 PM, Maura Dailey wrote: > On 08/13/2013 03:36 PM, Shawn Wells wrote: >> On 8/13/13 3:25 PM, Maura Dailey wrote: >>> How do you think we should handle file owner and group >>> permission checks on rsyslog files? Should we look for a >>> predetermined list of files (trying to search for *.log is >>> insufficient, since at the very least, /var/log/messages, >>> /var/log/secure, and /var/log/maillog would get passed over)? >>> Or should we try ninja regex to parse rsyslog.conf? >> I'm torn. The 'right way' would be regex ninja. However that's >> hard, and has resulted in nothing getting done. Personally I'd >> rather have *something* hard coded, then evolve into ninja >> regex. >> >> With that said.... your regex-foo is strong and perhaps you could >> hack this out in 15min... ;) >> _______________________________________________ >> scap-security-guide mailing list >> [email protected] >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > >> > LOL, no, my regex is not that great. I played around with it this > morning and got as far as the following check, but I can't even > imagine how to handle rsyslog.conf's templating. If we have a > consensus, perhaps the best strategy is just to delete both rsyslog > log permissions checks. I can submit a patch that will do that > pretty quickly. > > - Maura Dailey >
Not to be a Debbie Downer but you forgot: /etc/rsyslog.d/* e.g.: /etc/rsyslog.d/spice-vdagentd.conf : # A template to for higher precision timestamps + severity logging $template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" :programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJSCr7RAAoJEBYNRVNeJnmTSaoP+wfXA2BWYMpK37FFjqrk8nWF 4aBVyENJc5TscauFwkREN757bxTqZFsQiLVY0lSz1vkNElXKVCodLGb/48xrAG8c dsErzFNIC30O73RSrodJPIjG+oRNRtr01XEJQ4gyEz4huJBvZ8c7O6JByf/WQtX3 lrT2zA/jRtxgp2OfETYwJxu4cKCrV3WcoLEnyYKDJ30coiM7dVPNXTaud/Bf5DvR 73r7JzwEZQJ5W4Le2IyqZYAFRK6rw4zmMjTcONl7nzG3hzBftu6pVQF6os/kaAMC LZIlXPNi7aWOLYFjRq7wPIXfmEiV4M+r6LIL1Pf17sohAUbKMROk5yhHkX0Hl4bs 2rBZxXwY7G4Qhp/psETdmqbQkM3O3Ic8ywnATFYggkZqJNIXzXMStDO9tT0rMTba dBBL3swug5g7j1j5r15gkpfmMrT7xc7VpMLywBNdlLv4nMLcnqxJIB25F1JR7eF9 d7HRt88qfGU0SJ2sUjfxJtLgsFeZw/queRp1ebPq/X8f+tzcTI9BKQUodaXXDwny w032wvdSANNk3MNlGNGzwXrsmZV73FeM+y+m+m8rycCk/IymPJ3ak9O8GCBHzBwk /iPQSeL0vaLTw9r0UmVKCIPQdfm5h+IY2CAilpMmtRk6bjBZ7UcL85aMqDjHxSj9 FcCYT5DK8We9cEx0uXg6 =xJ8s -----END PGP SIGNATURE----- _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
