On 08/13/2013 07:18 PM, Kurt Seifried wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/13/2013 03:08 PM, Maura Dailey wrote:
On 08/13/2013 03:36 PM, Shawn Wells wrote:
On 8/13/13 3:25 PM, Maura Dailey wrote:
How do you think we should handle file owner and group
permission checks on rsyslog files? Should we look for a
predetermined list of files (trying to search for *.log is
insufficient, since at the very least, /var/log/messages,
/var/log/secure, and /var/log/maillog would get passed over)?
Or should we try ninja regex to parse rsyslog.conf?
I'm torn. The 'right way' would be regex ninja. However that's
hard, and has resulted in nothing getting done. Personally I'd
rather have *something* hard coded, then evolve into ninja
regex.
With that said.... your regex-foo is strong and perhaps you could
hack this out in 15min... ;)
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
LOL, no, my regex is not that great. I played around with it this
morning and got as far as the following check, but I can't even
imagine how to handle rsyslog.conf's templating. If we have a
consensus, perhaps the best strategy is just to delete both rsyslog
log permissions checks. I can submit a patch that will do that
pretty quickly.
- Maura Dailey
Not to be a Debbie Downer but you forgot:
/etc/rsyslog.d/*
e.g.: /etc/rsyslog.d/spice-vdagentd.conf :
# A template to for higher precision timestamps + severity logging
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
%syslogtag%
%syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent"
/var/log/spice-vdagent.log;SpiceTmpl
Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't there.
The point is that the check I wrote in my last email isn't complete. I'm
voting for deleting both the rsyslog permission checks.
- Maura Dailey
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJSCr7RAAoJEBYNRVNeJnmTSaoP+wfXA2BWYMpK37FFjqrk8nWF
4aBVyENJc5TscauFwkREN757bxTqZFsQiLVY0lSz1vkNElXKVCodLGb/48xrAG8c
dsErzFNIC30O73RSrodJPIjG+oRNRtr01XEJQ4gyEz4huJBvZ8c7O6JByf/WQtX3
lrT2zA/jRtxgp2OfETYwJxu4cKCrV3WcoLEnyYKDJ30coiM7dVPNXTaud/Bf5DvR
73r7JzwEZQJ5W4Le2IyqZYAFRK6rw4zmMjTcONl7nzG3hzBftu6pVQF6os/kaAMC
LZIlXPNi7aWOLYFjRq7wPIXfmEiV4M+r6LIL1Pf17sohAUbKMROk5yhHkX0Hl4bs
2rBZxXwY7G4Qhp/psETdmqbQkM3O3Ic8ywnATFYggkZqJNIXzXMStDO9tT0rMTba
dBBL3swug5g7j1j5r15gkpfmMrT7xc7VpMLywBNdlLv4nMLcnqxJIB25F1JR7eF9
d7HRt88qfGU0SJ2sUjfxJtLgsFeZw/queRp1ebPq/X8f+tzcTI9BKQUodaXXDwny
w032wvdSANNk3MNlGNGzwXrsmZV73FeM+y+m+m8rycCk/IymPJ3ak9O8GCBHzBwk
/iPQSeL0vaLTw9r0UmVKCIPQdfm5h+IY2CAilpMmtRk6bjBZ7UcL85aMqDjHxSj9
FcCYT5DK8We9cEx0uXg6
=xJ8s
-----END PGP SIGNATURE-----
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
