scap-security-guide August 2012

scap-security-guide@lists.fedorahosted.org

18 participants
49 discussions

results validation
by Peter Vrabec 13 Sep '12

13 Sep '12

Hi all, I have found that If I validate OVAL results by schematron rules: $ oscap oval validate-xml --results --schematron rhel6-oval-scap-security-guide.xml.result.xml I get two types of errors: oval:scap-security-guide:tst:960 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:959 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:811 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:787 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:786 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:359 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:267 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:221 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:tst:1085 - No state should be referenced when check_existence has a value of 'none_exist'. oval:scap-security-guide:var:2663 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2655 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2651 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2649 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2648 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2644 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2636 - inconsistent datatype between the variable and an associated var_ref oval:scap-security-guide:var:2629 - inconsistent datatype between the variable and an associated var_ref Peter.

2 3

[PATCH] Minor regexp correction in wireless_disable_drivers.xml
by Willem Bos 11 Sep '12

11 Sep '12

Hi All, The missing '^' in the regexp makes oscap 0.8.0 (from the RHEL6 repo) scan the whole filesystem. Credits to Gary Gapinsky for the quick fix. Jeffrey suggested replacing the check by a version that would advice disabling the driver in /etc/modules.conf (see the 'oscap hangs on wireless_disable_drivers.xml' thread). I'm not familiar with a robust way to determine the presence of such a NIC without using specialized utilities that might not be installed on the system. I did a `grep net/wireless /lib/modules/$(uname -r)/modules.dep` to see if all wireless drivers maybe shared a common dependency but this is not the case. Also, I queried the device using udevadm for attributes unique to wireless cards but could not see anything obvious : udevadm info --path=/sys/class/net/wlan0 --attribute-walk looking at device '/devices/pci0000:00/0000:00:1c.1/0000:02:00.0/bcma0:0/net/wlan0': KERNEL=="wlan0" SUBSYSTEM=="net" DRIVER=="" ATTR{addr_assign_type}=="0" ATTR{addr_len}=="6" ATTR{dev_id}=="0x0" ATTR{ifalias}=="" ATTR{iflink}=="2" ATTR{ifindex}=="2" ATTR{type}=="1" ATTR{link_mode}=="1" ATTR{address}=="b8:8d:12:08:14:ea" ATTR{broadcast}=="ff:ff:ff:ff:ff:ff" ATTR{carrier}=="1" ATTR{dormant}=="0" ATTR{operstate}=="up" ATTR{mtu}=="1500" ATTR{flags}=="0x1003" ATTR{tx_queue_len}=="1000" ATTR{netdev_group}=="0" udevadm info --path=/sys/class/net/eth0 --attribute-walk looking at device '/devices/pci0000:00/0000:00:15.0/0000:03:00.0/net/eth0': KERNEL=="eth0" SUBSYSTEM=="net" DRIVER=="" ATTR{addr_assign_type}=="0" ATTR{addr_len}=="6" ATTR{dev_id}=="0x0" ATTR{ifalias}=="" ATTR{iflink}=="2" ATTR{ifindex}=="2" ATTR{features}=="0x118ba9" ATTR{type}=="1" ATTR{link_mode}=="0" ATTR{address}=="00:50:56:b5:00:12" ATTR{broadcast}=="ff:ff:ff:ff:ff:ff" ATTR{carrier}=="1" ATTR{speed}=="10000" ATTR{duplex}=="full" ATTR{dormant}=="0" ATTR{operstate}=="unknown" ATTR{mtu}=="1500" ATTR{flags}=="0x1003" ATTR{tx_queue_len}=="1000" If anyone can give me a suggestion I'd be happy to spend more time on it. Regards, Willem. --- RHEL6/input/checks/wireless_disable_drivers.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/checks/wireless_disable_drivers.xml b/RHEL6/input/checks/wireless_disable_drivers.xml index 9760f7c..129b308 100644 --- a/RHEL6/input/checks/wireless_disable_drivers.xml +++ b/RHEL6/input/checks/wireless_disable_drivers.xml @@ -21,7 +21,7 @@ </unix:file_test> <unix:file_object comment="all local files" id="object_wireless_disable_drivers" version="1"> - <unix:path operation="pattern match">/lib/modules/.*/kernel/drivers/net/wireless</unix:path> + <unix:path operation="pattern match">^/lib/modules/.*/kernel/drivers/net/wireless</unix:path> <unix:filename operation="pattern match">.*</unix:filename> </unix:file_object> </def-group> -- 1.7.1

2 2

/etc/shadow and gshadow mode 0400 or 0?
by Kenneth Stailey 05 Sep '12

05 Sep '12

Hi, RHEL5 ships with /etc/shadow and gshadow set to mode 0400 while RHEL 6 uses mode 0 for those two files. CCE-3932-1 and CCE-4130-1 require mode 0400. Changing RHEL 6 to use 0400 causes CCE-14931 (verify files against RPM database) to flag /etc/shadow and gshadow as modified. Is it better to change /etc/shadow and gshadow to 0400 or use the mode 0 that the files are distributed from Red Hat with? Thanks

6 9

[PATCH] Fix paths and requires in spec file.
by Spencer R. Shimko 04 Sep '12

04 Sep '12

The spec file was dropping things in /usr/local. Shift it to /usr/share/doc/scap-security-guide-<version>. Update Requires and BuildRequires based on perusal of apps leveraged during build. Signed-off-by: Spencer Shimko <sshimko(a)tresys.com> --- scap-security-guide.spec | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 55e22a5..0867fb1 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -12,8 +12,8 @@ BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildArch: %{arch} -BuildRequires: /bin/rm, /bin/mkdir, /bin/cp -Requires: /bin/bash, /bin/date, /usr/bin/oscap +BuildRequires: coreutils, libxslt, expat, python +Requires: coreutils, openscap %description The scap-security-guide project provides security configuration guidance in @@ -28,13 +28,12 @@ requirements and specific implementation guidance. %build cd RHEL6 && make dist - %install rm -rf $RPM_BUILD_ROOT #make install DESTDIR=$RPM_BUILD_ROOT -mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/ +mkdir -p $RPM_BUILD_ROOT/%{_usr}/share/doc/%{name}-%{version}/ -cp -r RHEL6/dist/* $RPM_BUILD_ROOT/usr/local/%{name}/ +cp -r RHEL6/dist/* $RPM_BUILD_ROOT/%{_usr}/share/doc/%{name}-%{version}/ %clean @@ -43,10 +42,14 @@ rm -rf $RPM_BUILD_ROOT %files %defattr(0644,root,root,0755) -%attr(0755,root,root) /usr/local/scap-security-guide/ +%attr(0755,root,root) %{_usr}/share/doc/%{name}-%{version}/ %changelog +* Tue Aug 28 2012 Spencer Shimko <sshimko(a)tresys.com> 1.0-4 +- Move away from using /usr/local for installation dir. +- Fix BuildRequires and Requires. + * Wed Jul 3 2012 Jeffrey Blank <blank(a)eclipse.ncsc.mil> 1.0-3 - Modified install section, made description more concise. -- 1.7.1

4 7

[PATCH 7/7] General prose updates to Permissions/Partitions section
by Shawn Wells 04 Sep '12

04 Sep '12

3 4

content validation
by Gary Gapinski 03 Sep '12

03 Sep '12

I did a quick check of the generated content against the SCAP Content Validation Tool <http://scap.nist.gov/revision/1.1/index.html#validation>. I first created CPE definition and OVAL documents (available when needed; I can check into the project after I grok proper commit conduct). These are unfortunately required for conformance with SP 800-126. I then noticed that the OVAL ids are not in OVAL format, so further validation attempts will have to await assignment of OVAL-conformant identifiers. Also noticed: xsi:schemaLocation attributes in XCCDF and OVAL documents should cite "canonical" URIs for desired schema documents rather than document-relative citations they do currently, e.g., xsi:schemaLocation=" http://oval.mitre.org/XMLSchema/oval-common-5 http://oval.mitre.org/language/version5.8/ovaldefinition/complete/oval-comm… http://oval.mitre.org/XMLSchema/oval-definitions-5 http://oval.mitre.org/language/version5.8/ovaldefinition/complete/oval-defi… http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/version5.8/ovaldefinition/complete/independe… http://oval.mitre.org/XMLSchema/oval-definitions-5#linux http://oval.mitre.org/language/version5.8/ovaldefinition/complete/linux-def… http://oval.mitre.org/XMLSchema/oval-definitions-5#unix http://oval.mitre.org/language/version5.8/ovaldefinition/complete/unix-defi…"> As such, the documents cannot be validated using the supplied xsi:schemaLocation attributes. For those who cannot use direct web references, XML Catalog (examples also available) can be used to employ local copies in lieu of direct references. And, an OVAL version (presumably 5.8 or later) should be selected.

3 5

[PATCH] RHEL6/Makefile target shorthand2xccdf requires target shorthand-guide to be complete
by Kenneth Stailey 31 Aug '12

31 Aug '12

To test: cd RHEL6 make clean make shorthand2xccdf This will fail because the required prerequisite tasks were not run. Fix: --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -11,7 +11,7 @@ shorthand-guide: xsltproc -o $(OUT)/rhel6-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml -shorthand2xccdf: +shorthand2xccdf: shorthand-guide xsltproc -o $(OUT)/rhel6-xccdf-noprofiles.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-addprofiles.xslt $(OUT)/rhel6-xccdf-noprofiles.xml xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o $(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/rhel6-xccdf.xml

2 4

[PATCH] /etc/gshadow perms test check /etc/shadow user instead
by Kenneth Stailey 31 Aug '12

31 Aug '12

--- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -118,7 +118,7 @@ correctly.</description> <rationale>The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.</rationale> <ident cce="3932-1" /> -<oval id="file_owner_etc_shadow" /> +<oval id="file_permissions_etc_gshadow" /> <ref nist="AC-3, CM-6"/> </Rule>

2 2

[PATCH 6/7] General prose update to Permissions section
by Shawn Wells 31 Aug '12

31 Aug '12

3 2

[PATCH 5/7] Updated Software Integrity prose
by Shawn Wells 31 Aug '12

31 Aug '12

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2012