-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 08/14/2013 09:26 AM, Maura Dailey wrote:
I *could*, but that's hundreds of packages, which may or may not be installed on any given system. It also doesn't include packages that might be available through EPEL or configuration files that people code by hand. The real problem is detecting and resolving templating. If that hard problem is solved, any number of files in rsyslog.d could be vacuumed up. I don't think I'm the one to do it, since I'm about at the limit of my regex skills, and I'm skeptical that OVAL is up to the challenge either. (The rsyslog package doesn't include the file you referred to, according to rpm -ql. We don't run spice agent on our computers, which is no doubt why we don't have it.)
- Maura Dailey
It's only 3.5 gigs for the base RPMS, here's the results, first block is files included, second set is part of the scripts that talk to /var/log (just grep'ed), note many of these are dirs and would have files created within them:
389-ds-base-1.2.11.15-11.el6.x86_64.rpm.list:/var/log/dirsrv aide-0.14-3.el6_2.2.x86_64.rpm.list:/var/log/aide amanda-2.6.1p2-8.el6.i686.rpm.list:/var/log/amanda amanda-2.6.1p2-8.el6.x86_64.rpm.list:/var/log/amanda audit-2.2-2.el6.x86_64.rpm.list:/var/log/audit bacula-common-5.0.0-12.el6.x86_64.rpm.list:/var/log/bacula bind-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/log/named.log bind-chroot-9.8.2-0.17.rc1.el6.x86_64.rpm.list:/var/named/chroot/var/log cman-3.0.12.1-49.el6.x86_64.rpm.list:/var/log/cluster conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman conman-0.2.5-2.4.el6.x86_64.rpm.list:/var/log/conman.old ConsoleKit-0.4.1-3.el6.x86_64.rpm.list:/var/log/ConsoleKit corosync-1.4.1-15.el6.x86_64.rpm.list:/var/log/cluster cups-1.4.2-48.el6_3.3.x86_64.rpm.list:/var/log/cups dracut-004-303.el6.noarch.rpm.list:/var/log/dracut.log efax-0.9a-8.el6.x86_64.rpm.list:/var/log/fax filesystem-2.4.30-3.el6.x86_64.rpm.list:/var/log freeipmi-0.7.16-3.el6.i686.rpm.list:/var/log/ipmiconsole freeipmi-0.7.16-3.el6.x86_64.rpm.list:/var/log/ipmiconsole freeipmi-bmc-watchdog-0.7.16-3.el6.x86_64.rpm.list:/var/log/freeipmi freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radacct freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radius.log freeradius-2.1.12-4.el6_3.x86_64.rpm.list:/var/log/radius/radutmp gdm-2.30.4-39.el6.x86_64.rpm.list:/var/log/gdm hplip-3.12.4-4.el6.x86_64.rpm.list:/var/log/hp httpd-2.2.15-26.el6.x86_64.rpm.list:/var/log/httpd initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/btmp initscripts-9.03.38-1.el6.x86_64.rpm.list:/var/log/wtmp iptraf-3.0.1-14.el6.x86_64.rpm.list:/var/log/iptraf isdn4k-utils-3.2-75.el6.i686.rpm.list:/var/log/vbox isdn4k-utils-3.2-75.el6.x86_64.rpm.list:/var/log/vbox libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/lxc libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/qemu libvirt-0.10.2-18.el6.x86_64.rpm.list:/var/log/libvirt/uml luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci luci-0.26.0-37.el6.x86_64.rpm.list:/var/log/luci/luci.log mailman-2.1.12-18.el6.x86_64.rpm.list:/var/log/mailman mysql-server-5.1.66-2.el6_3.x86_64.rpm.list:/var/log/mysqld.log ntp-4.2.4p8-3.el6.x86_64.rpm.list:/var/log/ntpstats pam-1.1.1-13.el6.i686.rpm.list:/var/log/tallylog pam-1.1.1-13.el6.x86_64.rpm.list:/var/log/tallylog piranha-0.8.6-2.el6.x86_64.rpm.list:/var/log/piranha pm-utils-1.2.5-10.el6.x86_64.rpm.list:/var/log/pm-suspend.log ppp-2.4.5-5.el6.x86_64.rpm.list:/var/log/ppp prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink prelink-0.4.6-3.el6.x86_64.rpm.list:/var/log/prelink/prelink.log quagga-0.99.15-7.el6_3.2.x86_64.rpm.list:/var/log/quagga samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba samba4-common-4.0.0-55.el6.rc4.x86_64.rpm.list:/var/log/samba/old samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba samba-common-3.6.9-151.el6.i686.rpm.list:/var/log/samba/old samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba samba-common-3.6.9-151.el6.x86_64.rpm.list:/var/log/samba/old sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail sendmail-8.14.4-8.el6.x86_64.rpm.list:/var/log/mail/statistics setroubleshoot-server-3.0.47-6.el6.x86_64.rpm.list:/var/log/setroubleshoot setup-2.8.14-20.el6.noarch.rpm.list:/var/log/lastlog squid-3.1.10-16.el6.x86_64.rpm.list:/var/log/squid sssd-1.9.2-82.el6.x86_64.rpm.list:/var/log/sssd subscription-manager-1.1.23-1.el6.x86_64.rpm.list:/var/log/rhsm sysstat-9.0.4-20.el6.x86_64.rpm.list:/var/log/sa systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server systemtap-server-1.8-7.el6.x86_64.rpm.list:/var/log/stap-server/log tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6 tomcat6-6.0.24-49.el6.noarch.rpm.list:/var/log/tomcat6/catalina.out tuned-0.2.19-11.el6.noarch.rpm.list:/var/log/tuned util-linux-ng-2.17.2-12.9.el6.i686.rpm.list:/var/log/lastlog util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.list:/var/log/lastlog
ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts:if [ -f /var/log/ConsoleKit/history ]; then ConsoleKit-0.4.1-3.el6.x86_64.rpm.scripts: chmod a+r /var/log/ConsoleKit/history gdm-2.30.4-39.el6.x86_64.rpm.scripts: -e 's@^LogDir=/var/log/gdm@#&@' \ initscripts-9.03.38-1.el6.x86_64.rpm.scripts:touch /var/log/wtmp /var/run/utmp /var/log/btmp initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chown root:utmp /var/log/wtmp /var/run/utmp /var/log/btmp initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 664 /var/log/wtmp /var/run/utmp initscripts-9.03.38-1.el6.x86_64.rpm.scripts:chmod 600 /var/log/btmp mysql-server-5.1.66-2.el6_3.x86_64.rpm.scripts:/bin/touch /var/log/mysqld.log openwsman-server-2.2.3-8.el6.i686.rpm.scripts:rm -f /var/log/wsmand.log openwsman-server-2.2.3-8.el6.x86_64.rpm.scripts:rm -f /var/log/wsmand.log pam-1.1.1-13.el6.i686.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then pam-1.1.1-13.el6.i686.rpm.scripts: install -m 600 /dev/null /var/log/tallylog pam-1.1.1-13.el6.x86_64.rpm.scripts:if [ ! -e /var/log/tallylog ] ; then pam-1.1.1-13.el6.x86_64.rpm.scripts: install -m 600 /dev/null /var/log/tallylog rsyslog-5.8.10-6.el6.x86_64.rpm.scripts:for n in /var/log/{messages,secure,maillog,spooler} selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts:restorecon -R /root /var/log /var/run 2> /dev/null selinux-policy-minimum-3.7.19-195.el6.noarch.rpm.scripts: restorecon -R /root /var/log /var/run 2> /dev/null; selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon -R /root /var/log /var/run 2> /dev/null selinux-policy-mls-3.7.19-195.el6.noarch.rpm.scripts: restorecon - -R /root /var/log /var/run 2> /dev/null; selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts:); restorecon -R /root /var/log /var/run 2> /dev/null selinux-policy-targeted-3.7.19-195.el6.noarch.rpm.scripts: restorecon -R /root /var/log /var/run 2> /dev/null; squid-3.1.10-16.el6.x86_64.rpm.scripts:for i in /var/log/squid /var/spool/squid ; do squid-3.1.10-16.el6.x86_64.rpm.scripts: rm -f /var/log/squid/* sysstat-9.0.4-20.el6.x86_64.rpm.scripts: rm -f /var/log/sa/* systemtap-server-1.8-7.el6.x86_64.rpm.scripts:test -e /var/log/stap-server/log || { systemtap-server-1.8-7.el6.x86_64.rpm.scripts: touch /var/log/stap-server/log systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chmod 664 /var/log/stap-server/log systemtap-server-1.8-7.el6.x86_64.rpm.scripts: chown stap-server:stap-server /var/log/stap-server/log util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:# only for minimal buildroots without /var/log util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:[ -d /var/log ] || /bin/mkdir -p /var/log util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/touch /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chown root:root /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts:/bin/chmod 0644 /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: SECXT=$( /usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null ) util-linux-ng-2.17.2-12.9.el6.i686.rpm.scripts: /usr/bin/chcon "$SECXT" /var/log/lastlog >/dev/null 2>&1 || : util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:# only for minimal buildroots without /var/log util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:[ -d /var/log ] || /bin/mkdir -p /var/log util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/touch /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chown root:root /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts:/bin/chmod 0644 /var/log/lastlog util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: SECXT=$( /usr/sbin/matchpathcon -n /var/log/lastlog 2> /dev/null ) util-linux-ng-2.17.2-12.9.el6.x86_64.rpm.scripts: /usr/bin/chcon "$SECXT" /var/log/lastlog >/dev/null 2>&1 || :
- -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993