scap-security-guide May 2014

scap-security-guide@lists.fedorahosted.org

31 participants
60 discussions

Start a nNew thread

Interesting RH specific discussion on OpenSCAP
by Andrew Gilmore 22 May '14

22 May '14

https://access.redhat.com/site/discussions/666153 And yes, CIS shows up almost immediately.

1 0

[PATCH 3/3] [RHEL/6] Fix couple of XML syntax errors in files: * src/input/profiles/nist-CL-IL-AL.xml * RHEL/6/input/auxiliary/nist_support.xml
by Jan Lieskovsky 22 May '14

22 May '14

1 0

[PATCH 2/3] [RHEL/6] Fix "Invalid OVAL definition referenced by XCCDF Rule: root_path_no_dot" ../utils/verify-references.py warning message
by Jan Lieskovsky 22 May '14

22 May '14

1 0

probe_file taking forever (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 22 May '14

22 May '14

Classification: UNCLASSIFIED Caveats: NONE Using the version of OpenSCAP shipped with RHEL6, and the mostly-latest git content (as of 12 May), checks involving probe_file seem to be taking a lot longer. Select output of ps faxw below, with the names changed to protect the non-compliant: 19431 ? S 0:00 \_ /usr/bin/oscap xccdf eval --profile stig-rhel6-server-upstream --results hostname.example.com_scap_el6.xml --report hostname.example.com_scap_el6.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml 19445 ? Sl 0:00 \_ /usr/libexec/openscap/probe_system_info 19450 ? Sl 0:00 \_ /usr/libexec/openscap/probe_system_info 19455 ? Sl 0:00 \_ /usr/libexec/openscap/probe_family 19460 ? Sl 0:01 \_ /usr/libexec/openscap/probe_rpmverifyfile 19647 ? Sl 0:00 \_ /usr/libexec/openscap/probe_system_info 19653 ? Sl 0:00 \_ /usr/libexec/openscap/probe_family 19658 ? Sl 0:01 \_ /usr/libexec/openscap/probe_rpmverifyfile 20459 ? Sl 0:00 \_ /usr/libexec/openscap/probe_partition 20468 ? Sl 0:00 \_ /usr/libexec/openscap/probe_rpminfo 20476 ? Sl 0:00 \_ /usr/libexec/openscap/probe_textfilecontent54 20496 ? Sl 1:44 \_ /usr/libexec/openscap/probe_rpmverifyfile 62754 ? Sl 0:00 \_ /usr/libexec/openscap/probe_runlevel 62765 ? Sl 9553:55 \_ /usr/libexec/openscap/probe_file I started the scans on ~50 systems yesterday, and only half of them have finished (seems to be the ones with very few files). It sits on the first of these checks for quite a while, then moves on to sitting on the second one (see in the output, which I redirect to text files): Title Ensure No World-Writable Files Exist Rule world_writeable_files Ident CCE-26910-0 Result fail Title Ensure All Files Are Owned by a User Rule no_files_unowned_by_user Ident CCE-27032-2 Scans used to complete a lot more quickly (as in, minutes), so I'm not sure what happened. I didn't catch any messages over the past few days about this; sorry if I missed them, but I'm (naturally) mid-inspection, which is what these are for... It looks like the *17 release hasn't made it into EPEL yet, or I might try that; there are enough improvements since the 0.1-16 release that I don't want to go back that far. -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support Classification: UNCLASSIFIED Caveats: NONE

2 2

[PATCH] exclude /sys from search in world_writeable_files
by Paul Tittle (Contractor) 22 May '14

22 May '14

--- ...ile_permissions_unauthorized_world_writable.xml | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml index c3d4c8a..b6624c4 100644 --- a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml +++ b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml @@ -23,8 +23,10 @@ <unix:path operation="equals">/</unix:path> <unix:filename operation="pattern match">^.*$</unix:filename> <filter action="include">state_file_permissions_unauthorized_world_write</filter> +  <filter action="exclude">state_file_permissions_unauthorized_world_write_exclude_special_selinux_files</filter> <filter action="exclude">state_file_permissions_unauthorized_world_write_exclude_proc</filter> + <filter action="exclude">state_file_permissions_unauthorized_world_write_exclude_sys</filter> </unix:file_object> <unix:file_state id="state_file_permissions_unauthorized_world_write" version="1"> <unix:type operation="equals">regular</unix:type> @@ -36,4 +38,7 @@ <unix:file_state id="state_file_permissions_unauthorized_world_write_exclude_proc" version="1"> <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath> </unix:file_state> + <unix:file_state id="state_file_permissions_unauthorized_world_write_exclude_sys" version="1"> + <unix:filepath operation="pattern match">^/sys/.*$</unix:filepath> + </unix:file_state> </def-group> -- 1.7.1

3 3

SCAP & STIG Workshop Basebox
by Greg Elin 22 May '14

22 May '14

Shawn, Is there a publicly available Virtual Machine for SCAP & STIG Workshop available? I was reading the workbook pdf online and would love to go through the training self-directed, if that is possible. Thanks. Greg Elin

3 2

[PATCH] exclude proc/selinux files from world_writeable_files
by Paul Tittle (Contractor) 21 May '14

21 May '14

The following commit in openscap causes proc to be considered a 'local' filesystem. --- commit a9d98d697d85cb7f26c615543276e042c9749af0 Author: Tomas Heinrich <theinric(a)redhat.com> Date: Tue Nov 12 11:01:21 2013 +0100 OVAL: change the algo used to distinguish 'local' and 'remote' fs With 'local', fts now descends into /proc and /sys, among others, which were previously excluded. This can cause performance issues. --- The 'world_writeable_files' test will fail if a world-writeable regular file is found. So we must mask out /proc files with a filter. I did a `find / -perm -002 -type f` and also found some 'special' files in /selinux that are world-writeable and type f, so a filter has been added for those too. --- ...ile_permissions_unauthorized_world_writable.xml | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml index 599ad98..c3d4c8a 100644 --- a/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml +++ b/RHEL/6/input/checks/file_permissions_unauthorized_world_writable.xml @@ -23,9 +23,17 @@ <unix:path operation="equals">/</unix:path> <unix:filename operation="pattern match">^.*$</unix:filename> <filter action="include">state_file_permissions_unauthorized_world_write</filter> + <filter action="exclude">state_file_permissions_unauthorized_world_write_exclude_special_selinux_files</filter> + <filter action="exclude">state_file_permissions_unauthorized_world_write_exclude_proc</filter> </unix:file_object> <unix:file_state id="state_file_permissions_unauthorized_world_write" version="1"> <unix:type operation="equals">regular</unix:type> <unix:owrite datatype="boolean">true</unix:owrite> </unix:file_state> + <unix:file_state id="state_file_permissions_unauthorized_world_write_exclude_special_selinux_files" version="1"> + <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath> + </unix:file_state> + <unix:file_state id="state_file_permissions_unauthorized_world_write_exclude_proc" version="1"> + <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath> + </unix:file_state> </def-group> -- 1.7.1

2 2

[PATCH] typo in audit_rules_file_deletion_events description
by Paul Tittle (Contractor) 20 May '14

20 May '14

--- RHEL/6/input/system/auditing.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml index 3ac27e6..4b0af89 100644 --- a/RHEL/6/input/system/auditing.xml +++ b/RHEL/6/input/system/auditing.xml @@ -1206,7 +1206,7 @@ loss.</rationale> deletion events for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system: -<pre>-a always,exit -F arch=ARCH S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete</pre> +<pre>-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete</pre> </description> <ocil> <audit-syscall-check-macro syscall="unlink" /> -- 1.7.1

2 2

[PATCH 1/2] fixed typo in target file for disable_users_coredumps
by Paul Tittle (Contractor) 20 May '14

20 May '14

--- RHEL/6/input/checks/disable_users_coredumps.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL/6/input/checks/disable_users_coredumps.xml b/RHEL/6/input/checks/disable_users_coredumps.xml index 3cfb7b4..b35ce64 100644 --- a/RHEL/6/input/checks/disable_users_coredumps.xml +++ b/RHEL/6/input/checks/disable_users_coredumps.xml @@ -23,7 +23,7 @@ <ind:subexpression operation="equals">0</ind:subexpression> </ind:textfilecontent54_state> <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1"> - <ind:filepath>/etc/security/limites.conf</ind:filepath> + <ind:filepath>/etc/security/limits.conf</ind:filepath> <ind:pattern operation="pattern match">^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> -- 1.7.1

3 8

testing mail bounces -- sorry for spam -- 1016 est
by Shawn Wells 20 May '14

20 May '14

-- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2014