-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/13/2013 05:24 PM, Maura Dailey wrote: > On 08/13/2013 07:18 PM, Kurt Seifried wrote: On 08/13/2013 03:08 > PM, Maura Dailey wrote: >>>> On 08/13/2013 03:36 PM, Shawn Wells wrote: >>>>> On 8/13/13 3:25 PM, Maura Dailey wrote: >>>>>> How do you think we should handle file owner and group >>>>>> permission checks on rsyslog files? Should we look for a >>>>>> predetermined list of files (trying to search for *.log >>>>>> is insufficient, since at the very least, >>>>>> /var/log/messages, /var/log/secure, and /var/log/maillog >>>>>> would get passed over)? Or should we try ninja regex to >>>>>> parse rsyslog.conf? >>>>> I'm torn. The 'right way' would be regex ninja. However >>>>> that's hard, and has resulted in nothing getting done. >>>>> Personally I'd rather have *something* hard coded, then >>>>> evolve into ninja regex. >>>>> >>>>> With that said.... your regex-foo is strong and perhaps you >>>>> could hack this out in 15min... ;) >>>>> _______________________________________________ >>>>> scap-security-guide mailing list >>>>> [email protected] >>>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >>>> >>>>> LOL, no, my regex is not that great. I played around with it this >>>> morning and got as far as the following check, but I can't >>>> even imagine how to handle rsyslog.conf's templating. If we >>>> have a consensus, perhaps the best strategy is just to delete >>>> both rsyslog log permissions checks. I can submit a patch >>>> that will do that pretty quickly. >>>> >>>> - Maura Dailey >>>> > Not to be a Debbie Downer but you forgot: > > /etc/rsyslog.d/* > > e.g.: /etc/rsyslog.d/spice-vdagentd.conf : > > # A template to for higher precision timestamps + severity logging > $template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% > %syslogtag% > %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" > > :programname, startswith, "spice-vdagent" > /var/log/spice-vdagent.log;SpiceTmpl > > >> Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't >> there. The point is that the check I wrote in my last email isn't >> complete. I'm voting for deleting both the rsyslog permission >> checks. > >> - Maura Dailey
You can download the rpms and check their file listing/scripts for /etc/rsyslog* and whatnot content if you do want to find all instances of what Red Hat ships there. > _______________________________________________ scap-security-guide > mailing list [email protected] > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide - -- > Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJSCsFZAAoJEBYNRVNeJnmTrUUP/2wxg6GKKoUqVApYlS7UYK0n Fii05fhxbOqJ2Ugn5lwx1pLRsY0PCiM/VupQkzVYcNMUZAF3G2FE9TtzRBhs0qH4 0+2SJmLDp7Dn57Lyrc3LF865iPfYgv2fUJWEbMwT8W3G8l0QnhEGYqMGtaOV8C8O yIf699yQIZ6gebaoy05DYSs/WN44RO1bGmInKBm77JZno8rrU3rjoj7fHBPWDDWv aasRMY4M2PRz9GnHIhHu9Y2IKOUCJnbdjCnd74yz4Q1Cedp27QMFCNuXtLwpsejZ JW9XRe+5lakRu0LVEgZcPUS4PUReVI6gd3tKx4lUoJxA2baFkiHhXop8oROcqlEn NfoCtld5TR3UBvCUTUyR91IkTAMXyIGyHxKSzUOTuuKuSMX1SasR97rwtbOz9jEC xkT9fdepbjI6OFPRcOCv1Y3m64+ZUbnLKBMoNosmdZC9wkJXQ5jvoHhl9fBpWRl0 GGxD7ekGwhlO3HLfov+d2Heyvp2LsbgqjhTbJImERPHvq0BXZixesjpmVvZljyho 6RfjT3XH7F9VyCJE5XPULQtv7ZX+m/7fJtmTRzYcGmkjlKhsHPH9WiDZZj64eXMT JTAm50Yl+99/hIp+2CwYApLcCVi2dpT7qo8kBPiP27oDoXS2cyM8FQu40aZ/2dpV 47ww9He6G5rH0T1JP0DX =OEgw -----END PGP SIGNATURE----- _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
