-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/14/2013 09:26 AM, Maura Dailey wrote:
> I *could*, but that's hundreds of packages, which may or may not
> be installed on any given system. It also doesn't include packages
> that might be available through EPEL or configuration files that
> people code by hand. The real problem is detecting and resolving
> templating. If that hard problem is solved, any number of files in
> rsyslog.d could be vacuumed up. I don't think I'm the one to do it,
> since I'm about at the limit of my regex skills, and I'm skeptical
> that OVAL is up to the challenge either. (The rsyslog package
> doesn't include the file you referred to, according to rpm -ql. We
> don't run spice agent on our computers, which is no doubt why we
> don't have it.)
>
> - Maura Dailey
It's only 3.5 gigs for the base RPMS, here's the results, first block
is files included, second set is part of the scripts that talk to
/var/log (just grep'ed), note many of these are dirs and would have
files created within them:
389-ds-base-1.2.11.15-11.el6.x86_64.rpm.list:/var/log/dirsrv
aide-0.14-3.el6_2.2.x86_64.rpm.list:/var/log/aide
amanda-2.6.1p2-8.el6.i686.rpm.list:/var/log/amanda
amanda-2.6.1p2-8.el6.x86_64.rpm.list:/var/log/amanda
audit-2.2-2.el6.x86_64.rpm.list:/var/log/audit
bacula-common-5.0.0-12.el6.x86_64.rpm.list:/var/log/bacula
bind-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/log/named.log
bind-chroot-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/named/chroot/var/log
cman-3.0.12.1-49.el6.x86_64.rpm.list:/var/log/cluster
conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman
conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman.old
ConsoleKit-0.4.1-3.el6.x86_64.rpm.list:/var/log/ConsoleKit
corosync-1.4.1-15.el6.x86_64.rpm.list:/var/log/cluster
cups-1.4.2-48.el6_3.3.x86_64.rpm.list:/var/log/cups
dracut-004-303.el6.noarch.rpm.list:/var/log/dracut.log
efax-0.9a-8.el6.x86_64.rpm.list:/var/log/fax
filesystem-2.4.30-3.el6.x86_64.rpm.list:/var/log
freeipmi-0.7.16-3.el6.i686.rpm.list:/var/log/ipmiconsole
freeipmi-0.7.16-3.el6.x86_64.rpm.list:/var/log/ipmiconsole
freeipmi-bmc-watchdog-0.7.16-3.el6.x86_64.rpm.list:/var/log/freeipmi
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radacct
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radius.log
freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radutmp
gdm-2.30.4-39.el6.x86_64.rpm.list:/var/log/gdm
hplip-3.12.4-4.el6.x86_64.rpm.list:/var/log/hp
httpd-2.2.15-26.el6.x86_64.rpm.list:/var/log/httpd
initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/wtmp
iptraf-3.0.1-14.el6.x86_64.rpm.list:/var/log/iptraf
isdn4k-utils-3.2-75.el6.i686.rpm.list:/var/log/vbox
isdn4k-utils-3.2-75.el6.x86_64.rpm.list:/var/log/vbox
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/lxc
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/qemu
libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/uml
luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci
luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci/luci.log
mailman-2.1.12-18.el6.x86_64.rpm.list:/var/log/mailman
mysql-server-5.1.66-2.el6_3.x86_64.rpm.list:/var/log/mysqld.log
ntp-4.2.4p8-3.el6.x86_64.rpm.list:/var/log/ntpstats
pam-1.1.1-13.el6.i686.rpm.list:/var/log/tallylog
pam-1.1.1-13.el6.x86_64.rpm.list:/var/log/tallylog
piranha-0.8.6-2.el6.x86_64.rpm.list:/var/log/piranha
pm-utils-1.2.5-10.el6.x86_64.rpm.list:/var/log/pm-suspend.log
ppp-2.4.5-5.el6.x86_64.rpm.list:/var/log/ppp
prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink
prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink/prelink.log
quagga-0.99.15-7.el6_3.2.x86_64.rpm.list:/var/log/quagga
samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba
samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba/old
samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba
samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba/old
samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba
samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba/old
sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail
sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail/statistics
setroubleshoot-server-3.0.47-6.el6.x86_64.rpm.list:/var/log/setroubleshoot
setup-2.8.14-20.el6.noarch.rpm.list:/var/log/lastlog
squid-3.1.10-16.el6.x86_64.rpm.list:/var/log/squid
sssd-1.9.2-82.el6.x86_64.rpm.list:/var/log/sssd
subscription-manager-1.1.23-1.el6.x86_64.rpm.list:/var/log/rhsm
sysstat-9.0.4-20.el6.x86_64.rpm.list:/var/log/sa
systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server
systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server/log
tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6
tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6/catalina.out
tuned-0.2.19-11.el6.noarch.rpm.list:/var/log/tuned
util-linux-ng-2.17.2-12.9.el6.i686.rpm.list:/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.list:/var/log/lastlog
ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts:if [ -f
/var/log/ConsoleKit/history ]; then
ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts: chmod a+r
/var/log/ConsoleKit/history
gdm-2.30.4-39.el6.x86_64.rpm.scripts: -e 's@^LogDir=/var/log/gdm@#&@' \
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:touch /var/log/wtmp
/var/run/utmp /var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chown root:utmp
/var/log/wtmp /var/run/utmp /var/log/btmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 664 /var/log/wtmp
/var/run/utmp
initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 600 /var/log/btmp
mysql-server-5.1.66-2.el6_3.x86_64.rpm.scripts:/bin/touch
/var/log/mysqld.log
openwsman-server-2.2.3-8.el6.i686.rpm.scripts:rm -f /var/log/wsmand.log
openwsman-server-2.2.3-8.el6.x86_64.rpm.scripts:rm -f /var/log/wsmand.log
pam-1.1.1-13.el6.i686.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then
pam-1.1.1-13.el6.i686.rpm.scripts: install -m 600 /dev/null
/var/log/tallylog
pam-1.1.1-13.el6.x86_64.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then
pam-1.1.1-13.el6.x86_64.rpm.scripts: install -m 600 /dev/null
/var/log/tallylog
rsyslog-5.8.10-6.el6.x86_64.rpm.scripts:for n in
/var/log/{messages,secure,maillog,spooler}
selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts:restorecon -R
/root /var/log /var/run 2> /dev/null
selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts:
restorecon -R /root /var/log /var/run 2> /dev/null;
selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon -R
/root /var/log /var/run 2> /dev/null
selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon
- -R /root /var/log /var/run 2> /dev/null;
selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts:);
restorecon -R /root /var/log /var/run 2> /dev/null
selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts:
restorecon -R /root /var/log /var/run 2> /dev/null;
squid-3.1.10-16.el6.x86_64.rpm.scripts:for i in /var/log/squid
/var/spool/squid ; do
squid-3.1.10-16.el6.x86_64.rpm.scripts: rm -f /var/log/squid/*
sysstat-9.0.4-20.el6.x86_64.rpm.scripts: rm -f /var/log/sa/*
systemtap-server-1.8-7.el6.x86_64.rpm.scripts:test -e
/var/log/stap-server/log || {
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: touch
/var/log/stap-server/log
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chmod 664
/var/log/stap-server/log
systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chown
stap-server:stap-server /var/log/stap-server/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:# only for minimal
buildroots without /var/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:[ -d /var/log ] ||
/bin/mkdir -p /var/log
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/touch /var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chown root:root
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chmod 0644
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: SECXT=$(
/usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null )
util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: /usr/bin/chcon
"$SECXT" /var/log/lastlog >/dev/null 2>&1 || :
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:# only for minimal
buildroots without /var/log
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:[ -d /var/log ] ||
/bin/mkdir -p /var/log
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/touch
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chown root:root
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chmod 0644
/var/log/lastlog
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: SECXT=$(
/usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null )
util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: /usr/bin/chcon
"$SECXT" /var/log/lastlog >/dev/null 2>&1 || :
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAEBAgAGBQJSC9nxAAoJEBYNRVNeJnmTfv0P/3U65GKVzyKNQ0cyGgpAcfSm
qlv6kxKmz0opqQ7YSAx7Nq0dY7N7/5CvU7MlMOZ4uZrLtvEPJp0FJlfRuj0Kjc3h
rbCK3oJEcNOK9Ib/cptoi2q8ZXXb3dlHkq229dtxIFCGVfkqQPPdicp2I63dWl0t
voVLqSudlcr18YgW/nCLfCJoAphAM5SDp+P6xyqpVvhcvTShAqmDADS4rGs++Mnf
pS0kKT//R8Daw5RRlbc3snEILcdLuuHHAuEjM8fcgpX4G+8Z6X7dF7Y3m7Sk3iLt
v85uITiOfiC8uwmyRRK8/N41D6jRsy0MYy1aLUk6IlBGyCkmrqkNISgqebdn3Een
pdqyNP0PqrNdUpTWnmxaHpxONzMqHp3dRhOsuNgOP5t3qii+kQHHGFnPKw7B+uhW
URtpca1hcgkYl1jrcOvwN3W1BHaSXK64gDYVURd1DRXkdDJP+4mGChCBb9w4C2a8
WigiOOLp1EKOESScJsKDltYkL6SrSbWs9oipnkyWzuRs0RrvtBxmrqHrb/r66Dnl
jfkrq7H0OvZdvIg3X2rovyxLYM+iTI/yWQfOuvuXkmZqSvVYKh0L95Hf+ByQLQej
cqVo0UOh2kwJWNN5O5bvxGJVCLTa4WWwpA83mNZ65C5VddfqPyUm2a5Y7u4bKQ+2
xKqufw7kc91+ndu+c4wM
=5vTG
-----END PGP SIGNATURE-----
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
