-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 08/13/2013 05:24 PM, Maura Dailey wrote:
On 08/13/2013 07:18 PM, Kurt Seifried wrote: On 08/13/2013 03:08 PM, Maura Dailey wrote:
On 08/13/2013 03:36 PM, Shawn Wells wrote:
On 8/13/13 3:25 PM, Maura Dailey wrote:
How do you think we should handle file owner and group permission checks on rsyslog files? Should we look for a predetermined list of files (trying to search for *.log is insufficient, since at the very least, /var/log/messages, /var/log/secure, and /var/log/maillog would get passed over)? Or should we try ninja regex to parse rsyslog.conf?
I'm torn. The 'right way' would be regex ninja. However that's hard, and has resulted in nothing getting done. Personally I'd rather have *something* hard coded, then evolve into ninja regex.
With that said.... your regex-foo is strong and perhaps you could hack this out in 15min... ;) _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
LOL, no, my regex is not that great. I played around with it this
morning and got as far as the following check, but I can't even imagine how to handle rsyslog.conf's templating. If we have a consensus, perhaps the best strategy is just to delete both rsyslog log permissions checks. I can submit a patch that will do that pretty quickly.
- Maura Dailey
Not to be a Debbie Downer but you forgot:
/etc/rsyslog.d/*
e.g.: /etc/rsyslog.d/spice-vdagentd.conf :
# A template to for higher precision timestamps + severity logging $template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl
Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't there. The point is that the check I wrote in my last email isn't complete. I'm voting for deleting both the rsyslog permission checks.
- Maura Dailey
You can download the rpms and check their file listing/scripts for /etc/rsyslog* and whatnot content if you do want to find all instances of what Red Hat ships there.
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
- --
Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993