scap-security-guide September 2018

scap-security-guide@lists.fedorahosted.org

12 participants
12 discussions

Re: Suggesting adding hidepid=2 on /proc to the SSG
by Immo Niemela 06 Sep '18

06 Sep '18

Hi All, Personally I would like to have hidepid=2 _by_default_. If problems arise then people could choose a different profile or tailor the profile to suit them better. There should be sufficient documentation on that. This way people might start realising there need to be changes to software they are maintaining or developing. Regards, Immo Niemela -- Sent from yet another mobile device. Please excuse my brevity.

1 0

Updating audit rules for container platforms
by Shawn Wells 04 Sep '18

04 Sep '18

Received an interesting question from a colleague today. The various STIG requirements have full paths for auditing, e.g. for /usr/bin/chage: https://rhel7stig.readthedocs.io/en/latest/medium.html#v-72155-all-uses-of-… Which call for an audit rule similar to: > -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F > auid!=4294967295 -k privileged-passwd However, on a container platform (e.g. OpenShift), the root user on nodes can execute chage in its own /usr/bin/ as well as within all the containers /var/lib/docker/<UUID>/bin/chage. What's the best way to capture this in OVAL rules? Was thinking updating the regex on path to include the full-path (/usr/bin/chage|/var/lib/docker/*/bin/chage).... but not sure if that's a standard path that would work for non-OpenShift platforms. +cc Jeff Pullen who asked the question. Jeff... note this is a *public* mailing list ;)

5 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2018