Skip to content

Commit 2a6c92c

Browse files
cipherboycipherboy
committed
Unify handling of file permissions checks
 * Uses a single template, create_permissions.py, to generate all unix attribute checks (mode, uid, gid) * Removes create_file_groupowner.py, create_file_owner.py, and create_file_permissions.py * Updates file_dir_permissions.csv to contain checks from other csvs * Updates rules, profiles, and overlays to match new names * Removes shadowing checks and remediations Signed-off-by: Alexander Scheel <[email protected]>
1 parent 68c11c5 commit 2a6c92c

File tree

103 files changed

+457
-1041
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

103 files changed

+457
-1041
lines changed

Diff for: ‎fedora/templates/csv/file_dir_permissions.csv

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,11 @@
1-
/etc,gshadow,0,0,0000
21
/etc,shadow,0,0,0000
2+
/etc,gshadow,0,0,0000
3+
/etc,passwd,0,0,0644
4+
/etc,group,0,0,0644
5+
/etc,cron.allow,,,0644,cron_allow
6+
/etc/httpd/conf.d,*,,,0640,httpd_server_conf_d_files
7+
/etc/httpd/conf,*,,,0640,httpd_server_conf_files
8+
/etc/ssh,*.pub,,,0644,sshd_pub_key
9+
/etc/ssh,*_key,,,0600,sshd_private_key
10+
/etc/httpd/conf.modules.d,*,,,0640,https_server_modules_files
11+
/boot/grub,grub.conf,0,0,600,grub_conf

Diff for: ‎fedora/templates/csv/file_groupowner.csv

-1
This file was deleted.

Diff for: ‎fedora/templates/csv/file_owner.csv

-1
This file was deleted.

Diff for: ‎linux_os/guide/system/bootloader-grub-legacy/file_group_owner_grub_conf.rule renamed to ‎linux_os/guide/system/bootloader-grub-legacy/file_groupowner_grub_conf.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/bootloader-grub-legacy/file_user_owner_grub_conf.rule renamed to ‎linux_os/guide/system/bootloader-grub-legacy/file_owner_grub_conf.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/bootloader-grub2/file_group_owner_efi_grub2_cfg.rule renamed to ‎linux_os/guide/system/bootloader-grub2/file_groupowner_efi_grub2_cfg.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/bootloader-grub2/file_group_owner_grub2_cfg.rule renamed to ‎linux_os/guide/system/bootloader-grub2/file_groupowner_grub2_cfg.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/bootloader-grub2/file_user_owner_efi_grub2_cfg.rule renamed to ‎linux_os/guide/system/bootloader-grub2/file_owner_efi_grub2_cfg.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/bootloader-grub2/file_user_owner_grub2_cfg.rule renamed to ‎linux_os/guide/system/bootloader-grub2/file_owner_grub2_cfg.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/permissions/files/permissions_important_account_files/groupowner_shadow_file.rule renamed to ‎linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow.rule

File renamed without changes.

Diff for: ‎linux_os/guide/system/permissions/files/permissions_important_account_files/userowner_shadow_file.rule renamed to ‎linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow.rule

File renamed without changes.

Diff for: ‎ol7/profiles/pci-dss.profile

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,6 @@ selections:
2020
- file_owner_etc_passwd
2121
- file_groupowner_etc_passwd
2222
- file_permissions_etc_passwd
23-
- file_user_owner_grub2_cfg
24-
- file_group_owner_grub2_cfg
23+
- file_owner_grub2_cfg
24+
- file_groupowner_grub2_cfg
2525
- package_libreswan_installed

Diff for: ‎ol7/templates/csv/file_dir_permissions.csv

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
/etc,shadow,0,0,0000
22
/etc,group,0,0,0644
33
/etc,passwd,0,0,0644
4-
#/boot/grub,grub.conf,0,0,600 # different filename
4+
/boot/grub,grub.conf,0,0,600,grub_conf

Diff for: ‎ol7/templates/csv/file_groupowner.csv

-2
This file was deleted.

Diff for: ‎ol7/templates/csv/file_owner.csv

-2
This file was deleted.

Diff for: ‎opensuse/templates/csv/file_dir_permissions.csv

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/etc,cron.allow,0,0,0644,cron_allow

Diff for: ‎opensuse/templates/csv/file_groupowner.csv

-1
This file was deleted.

Diff for: ‎opensuse/templates/csv/file_owner.csv

-1
This file was deleted.

Diff for: ‎rhel6/checks/oval/file_permissions_grub_conf.xml

-33
This file was deleted.

Diff for: ‎rhel6/checks/oval/file_user_owner_grub_conf.xml

-37
This file was deleted.

Diff for: ‎rhel6/fixes/bash/file_group_owner_grub_conf.sh

-2
This file was deleted.

Diff for: ‎rhel6/fixes/bash/file_permissions_grub_conf.sh

-2
This file was deleted.

Diff for: ‎rhel6/fixes/bash/file_user_owner_grub_conf.sh

-2
This file was deleted.

Diff for: ‎rhel6/fixes/bash/groupowner_shadow_file.sh

-2
This file was deleted.

Diff for: ‎rhel6/fixes/bash/userowner_shadow_file.sh

-2
This file was deleted.

Diff for: ‎rhel6/overlays/stig_overlay.xml

+4-4
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,11 @@
9696
<VMSinfo VKey="38500" SVKey="50301" VRelease="2" />
9797
<title>The root account must be the only account having a UID of 0.</title>
9898
</overlay>
99-
<overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium">
99+
<overlay owner="disastig" ruleid="file_owner_etc_shadow" ownerid="RHEL-06-000033" disa="366" severity="medium">
100100
<VMSinfo VKey="38502" SVKey="50303" VRelease="1" />
101101
<title>The /etc/shadow file must be owned by root.</title>
102102
</overlay>
103-
<overlay owner="disastig" ruleid="groupowner_shadow_file" ownerid="RHEL-06-000034" disa="366" severity="medium">
103+
<overlay owner="disastig" ruleid="file_groupowner_etc_shadow" ownerid="RHEL-06-000034" disa="366" severity="medium">
104104
<VMSinfo VKey="38503" SVKey="50304" VRelease="1" />
105105
<title>The /etc/shadow file must be group-owned by root.</title>
106106
</overlay>
@@ -212,11 +212,11 @@
212212
<VMSinfo VKey="38577" SVKey="50378" VRelease="1" />
213213
<title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf).</title>
214214
</overlay>
215-
<overlay owner="disastig" ruleid="file_user_owner_grub_conf" ownerid="RHEL-06-000065" disa="366" severity="medium">
215+
<overlay owner="disastig" ruleid="file_owner_grub_conf" ownerid="RHEL-06-000065" disa="366" severity="medium">
216216
<VMSinfo VKey="38579" SVKey="50380" VRelease="1" />
217217
<title>The system boot loader configuration file(s) must be owned by root.</title>
218218
</overlay>
219-
<overlay owner="disastig" ruleid="file_group_owner_grub_conf" ownerid="RHEL-06-000066" disa="366" severity="medium">
219+
<overlay owner="disastig" ruleid="file_groupowner_grub_conf" ownerid="RHEL-06-000066" disa="366" severity="medium">
220220
<VMSinfo VKey="38581" SVKey="50382" VRelease="1" />
221221
<title>The system boot loader configuration file(s) must be group-owned by root.</title>
222222
</overlay>

Diff for: ‎rhel6/overlays/transition_notes.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1548,7 +1548,7 @@ rule=no_files_unowned_by_group manual=no
15481548
<note ref="22339" auth="KS">
15491549
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it
15501550
does exist.
1551-
rule=userowner_shadow_file manual=no
1551+
rule=file_owner_etc_shadow manual=no
15521552
</note>
15531553

15541554
<note ref="22347" auth="KS">

Diff for: ‎rhel6/profiles/C2S.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ selections:
5454
- package_setroubleshoot_removed
5555
- package_mcstrans_removed
5656
- selinux_confinement_of_daemons
57-
- file_user_owner_grub_conf
58-
- file_group_owner_grub_conf
57+
- file_owner_grub_conf
58+
- file_groupowner_grub_conf
5959
- file_permissions_grub_conf
6060
- grub_legacy_password
6161
- require_singleuser_auth
@@ -185,8 +185,8 @@ selections:
185185
- file_permissions_etc_group
186186
- file_owner_etc_passwd
187187
- file_groupowner_etc_passwd
188-
- userowner_shadow_file
189-
- groupowner_shadow_file
188+
- file_owner_etc_shadow
189+
- file_groupowner_etc_shadow
190190
- file_owner_etc_gshadow
191191
- file_groupowner_etc_gshadow
192192
- file_owner_etc_group

Diff for: ‎rhel6/profiles/CS2.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,8 @@ selections:
133133
- audit_rules_file_deletion_events
134134
- securetty_root_login_console_only
135135
- no_direct_root_logins
136-
- userowner_shadow_file
137-
- groupowner_shadow_file
136+
- file_owner_etc_shadow
137+
- file_groupowner_etc_shadow
138138
- file_permissions_etc_shadow
139139
- file_owner_etc_gshadow
140140
- file_groupowner_etc_gshadow
@@ -151,8 +151,8 @@ selections:
151151
- file_ownership_binary_dirs
152152
- gid_passwd_group_same
153153
- file_permissions_home_dirs
154-
- file_user_owner_grub_conf
155-
- file_group_owner_grub_conf
154+
- file_owner_grub_conf
155+
- file_groupowner_grub_conf
156156
- file_permissions_grub_conf
157157
- sysctl_fs_suid_dumpable
158158
- service_restorecond_enabled

Diff for: ‎rhel6/profiles/CSCF-RHEL6-MLS.profile

+2-2
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ selections:
118118
- file_groupowner_etc_gshadow
119119
- file_groupowner_etc_passwd
120120
- rsyslog_files_groupownership
121-
- groupowner_shadow_file
121+
- file_groupowner_etc_shadow
122122
- file_permissions_httpd_server_conf_files
123123
- dir_perms_var_log_httpd
124124
- httpd_servertokens_prod
@@ -253,7 +253,7 @@ selections:
253253
- file_owner_etc_gshadow
254254
- file_owner_etc_passwd
255255
- "!rsyslog_files_ownership"
256-
- userowner_shadow_file
256+
- file_owner_etc_shadow
257257
- wireless_disable_in_bios
258258
- "!dir_perms_world_writable_system_owned"
259259
- grub_legacy_disable_interactive_boot

Diff for: ‎rhel6/profiles/fisma-medium-rhel6-server.profile

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ selections:
2828
- var_umask_for_daemons=022
2929
- sshd_disable_root_login
3030
- umask_for_daemons
31-
- userowner_shadow_file
32-
- groupowner_shadow_file
31+
- file_owner_etc_shadow
32+
- file_groupowner_etc_shadow
3333
- file_permissions_etc_shadow
3434
- file_owner_etc_group
3535
- file_groupowner_etc_group

Diff for: ‎rhel6/profiles/nist-CL-IL-AL.profile

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ selections:
4949
- rpm_verify_permissions
5050
- file_permissions_var_log_audit
5151
- file_ownership_var_log_audit
52-
- userowner_shadow_file
53-
- groupowner_shadow_file
52+
- file_owner_etc_shadow
53+
- file_groupowner_etc_shadow
5454
- file_permissions_etc_shadow
5555
- file_owner_etc_group
5656
- file_groupowner_etc_group

Diff for: ‎rhel6/profiles/pci-dss.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -95,15 +95,15 @@ selections:
9595
- set_password_hashing_algorithm_systemauth
9696
- set_password_hashing_algorithm_logindefs
9797
- set_password_hashing_algorithm_libuserconf
98-
- userowner_shadow_file
99-
- groupowner_shadow_file
98+
- file_owner_etc_shadow
99+
- file_groupowner_etc_shadow
100100
- file_permissions_etc_shadow
101101
- file_owner_etc_group
102102
- file_groupowner_etc_group
103103
- file_permissions_etc_group
104104
- file_owner_etc_passwd
105105
- file_groupowner_etc_passwd
106106
- file_permissions_etc_passwd
107-
- file_user_owner_grub_conf
108-
- file_group_owner_grub_conf
107+
- file_owner_grub_conf
108+
- file_groupowner_grub_conf
109109
- package_libreswan_installed

Diff for: ‎rhel6/profiles/rht-ccp.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ selections:
5656
- set_password_hashing_algorithm_logindefs
5757
- set_password_hashing_algorithm_libuserconf
5858
- require_singleuser_auth
59-
- userowner_shadow_file
60-
- groupowner_shadow_file
59+
- file_owner_etc_shadow
60+
- file_groupowner_etc_shadow
6161
- file_permissions_etc_shadow
6262
- file_owner_etc_gshadow
6363
- file_groupowner_etc_gshadow
@@ -73,8 +73,8 @@ selections:
7373
- file_permissions_binary_dirs
7474
- file_ownership_binary_dirs
7575
- file_permissions_var_log_audit
76-
- file_user_owner_grub_conf
77-
- file_group_owner_grub_conf
76+
- file_owner_grub_conf
77+
- file_groupowner_grub_conf
7878
- file_permissions_grub_conf
7979
- grub_legacy_password
8080
- sysctl_kernel_randomize_va_space

Diff for: ‎rhel6/profiles/standard.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ selections:
3737
- dir_perms_world_writable_sticky_bits
3838
- accounts_password_all_shadowed
3939
- accounts_no_uid_except_zero
40-
- userowner_shadow_file
41-
- groupowner_shadow_file
40+
- file_owner_etc_shadow
41+
- file_groupowner_etc_shadow
4242
- file_permissions_etc_shadow
4343
- file_owner_etc_gshadow
4444
- file_groupowner_etc_gshadow
@@ -68,8 +68,8 @@ selections:
6868
- set_password_hashing_algorithm_systemauth
6969
- set_password_hashing_algorithm_logindefs
7070
- set_password_hashing_algorithm_libuserconf
71-
- file_user_owner_grub_conf
72-
- file_group_owner_grub_conf
71+
- file_owner_grub_conf
72+
- file_groupowner_grub_conf
7373
- file_permissions_grub_conf
7474
- grub_legacy_password
7575
- require_singleuser_auth

Diff for: ‎rhel6/profiles/usgcb-rhel6-server.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ selections:
4343
- file_owner_etc_gshadow
4444
- file_groupowner_etc_gshadow
4545
- file_permissions_etc_shadow
46-
- userowner_shadow_file
47-
- groupowner_shadow_file
46+
- file_owner_etc_shadow
47+
- file_groupowner_etc_shadow
4848
- file_permissions_etc_group
4949
- file_owner_etc_group
5050
- file_groupowner_etc_group
@@ -102,8 +102,8 @@ selections:
102102
- accounts_umask_etc_csh_cshrc
103103
- accounts_umask_etc_profile
104104
- accounts_umask_etc_login_defs
105-
- file_user_owner_grub_conf
106-
- file_group_owner_grub_conf
105+
- file_owner_grub_conf
106+
- file_groupowner_grub_conf
107107
- file_permissions_grub_conf
108108
- grub_legacy_password
109109
- grub_legacy_disable_interactive_boot

Diff for: ‎rhel6/templates/csv/file_dir_permissions.csv

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
/etc,shadow,0,0,0000
22
/etc,gshadow,0,0,0000
33
/etc,passwd,0,0,0644
4-
/etc,group,0,0,0000
5-
#/boot/grub,grub.conf,0,0,600 # different filename
4+
/etc,group,0,0,0644
5+
/etc,cron.allow,0,0,0644,cron_allow
6+
/etc/httpd/conf.d,*,,,0640,httpd_server_conf_d_files
7+
/etc/httpd/conf,*,,,0640,httpd_server_conf_files
8+
/etc/ssh,*.pub,,,0644,sshd_pub_key
9+
/etc/ssh,*_key,,,0600,sshd_private_key
10+
/etc/httpd/conf.modules.d,*,,,0640,https_server_modules_files
11+
/boot/grub,grub.conf,0,0,600,grub_conf

Diff for: ‎rhel6/templates/csv/file_groupowner.csv

-4
This file was deleted.

Diff for: ‎rhel6/templates/csv/file_owner.csv

-4
This file was deleted.

Diff for: ‎rhel6/templates/csv/file_permissions.csv

-8
This file was deleted.

Diff for: ‎rhel7/fixes/bash/groupowner_shadow_file.sh

-2
This file was deleted.

Diff for: ‎rhel7/fixes/bash/userowner_shadow_file.sh

-2
This file was deleted.

Diff for: ‎rhel7/profiles/C2S.profile

+4-4
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ selections:
4949
- service_rhnsd_disabled
5050
- package_aide_installed
5151
- aide_periodic_cron_checking
52-
- file_user_owner_grub2_cfg
53-
- file_group_owner_grub2_cfg
52+
- file_owner_grub2_cfg
53+
- file_groupowner_grub2_cfg
5454
- file_permissions_grub2_cfg
5555
- grub2_password
5656
- grub2_uefi_password
@@ -227,8 +227,8 @@ selections:
227227
- file_owner_etc_passwd
228228
- file_groupowner_etc_passwd
229229
- file_permissions_etc_passwd
230-
- userowner_shadow_file
231-
- groupowner_shadow_file
230+
- file_owner_etc_shadow
231+
- file_groupowner_etc_shadow
232232
- file_permissions_etc_shadow
233233
- file_owner_etc_group
234234
- file_groupowner_etc_group

0 commit comments

Comments
 (0)