On 08/13/2013 07:29 PM, Kurt Seifried wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/13/2013 05:24 PM, Maura Dailey wrote:
On 08/13/2013 07:18 PM, Kurt Seifried wrote: On 08/13/2013 03:08
PM, Maura Dailey wrote:
On 08/13/2013 03:36 PM, Shawn Wells wrote:
On 8/13/13 3:25 PM, Maura Dailey wrote:
How do you think we should handle file owner and group
permission checks on rsyslog files? Should we look for a
predetermined list of files (trying to search for *.log
is insufficient, since at the very least,
/var/log/messages, /var/log/secure, and /var/log/maillog
would get passed over)? Or should we try ninja regex to
parse rsyslog.conf?
I'm torn. The 'right way' would be regex ninja. However
that's hard, and has resulted in nothing getting done.
Personally I'd rather have *something* hard coded, then
evolve into ninja regex.
With that said.... your regex-foo is strong and perhaps you
could hack this out in 15min... ;)
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
LOL, no, my regex is not that great. I played around with it this
morning and got as far as the following check, but I can't
even imagine how to handle rsyslog.conf's templating. If we
have a consensus, perhaps the best strategy is just to delete
both rsyslog log permissions checks. I can submit a patch
that will do that pretty quickly.
- Maura Dailey
Not to be a Debbie Downer but you forgot:
/etc/rsyslog.d/*
e.g.: /etc/rsyslog.d/spice-vdagentd.conf :
# A template to for higher precision timestamps + severity logging
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
%syslogtag%
%syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent"
/var/log/spice-vdagent.log;SpiceTmpl
Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't
there. The point is that the check I wrote in my last email isn't
complete. I'm voting for deleting both the rsyslog permission
checks.
- Maura Dailey
You can download the rpms and check their file listing/scripts for
/etc/rsyslog* and whatnot content if you do want to find all instances
of what Red Hat ships there.
I *could*, but that's hundreds of packages, which may or may not be
installed on any given system. It also doesn't include packages that
might be available through EPEL or configuration files that people code
by hand. The real problem is detecting and resolving templating. If that
hard problem is solved, any number of files in rsyslog.d could be
vacuumed up. I don't think I'm the one to do it, since I'm about at the
limit of my regex skills, and I'm skeptical that OVAL is up to the
challenge either. (The rsyslog package doesn't include the file you
referred to, according to rpm -ql. We don't run spice agent on our
computers, which is no doubt why we don't have it.)
- Maura Dailey
_______________________________________________ scap-security-guide
mailing list [email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJSCsFZAAoJEBYNRVNeJnmTrUUP/2wxg6GKKoUqVApYlS7UYK0n
Fii05fhxbOqJ2Ugn5lwx1pLRsY0PCiM/VupQkzVYcNMUZAF3G2FE9TtzRBhs0qH4
0+2SJmLDp7Dn57Lyrc3LF865iPfYgv2fUJWEbMwT8W3G8l0QnhEGYqMGtaOV8C8O
yIf699yQIZ6gebaoy05DYSs/WN44RO1bGmInKBm77JZno8rrU3rjoj7fHBPWDDWv
aasRMY4M2PRz9GnHIhHu9Y2IKOUCJnbdjCnd74yz4Q1Cedp27QMFCNuXtLwpsejZ
JW9XRe+5lakRu0LVEgZcPUS4PUReVI6gd3tKx4lUoJxA2baFkiHhXop8oROcqlEn
NfoCtld5TR3UBvCUTUyR91IkTAMXyIGyHxKSzUOTuuKuSMX1SasR97rwtbOz9jEC
xkT9fdepbjI6OFPRcOCv1Y3m64+ZUbnLKBMoNosmdZC9wkJXQ5jvoHhl9fBpWRl0
GGxD7ekGwhlO3HLfov+d2Heyvp2LsbgqjhTbJImERPHvq0BXZixesjpmVvZljyho
6RfjT3XH7F9VyCJE5XPULQtv7ZX+m/7fJtmTRzYcGmkjlKhsHPH9WiDZZj64eXMT
JTAm50Yl+99/hIp+2CwYApLcCVi2dpT7qo8kBPiP27oDoXS2cyM8FQu40aZ/2dpV
47ww9He6G5rH0T1JP0DX
=OEgw
-----END PGP SIGNATURE-----
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
