SLES-15-10352 rule #6822

teacup-on-rockingchair · 2021-04-11T20:09:23Z

Description:

Verify that Shared Library Directories Have Restrictive Permissions

Rationale:

Clone implementation of file_permissions_library_dirs to dir_permissions_library_dirs
Add some tests to cover basic scenarios

openscap-ci · 2021-04-11T20:09:24Z

Can one of the admins verify this patch?

openscap-ci · 2021-04-11T20:09:24Z

Can one of the admins verify this patch?

openshift-ci-robot · 2021-04-11T20:09:30Z

Hi @teacup-on-rockingchair. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

brett060102

See inline comments

brett060102 · 2021-04-12T15:51:44Z

...ions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml

@@ -0,0 +1,18 @@
+# platform = SUSE Linux Enterprise 15


Needs to be multi_platform_sle not "SUSE Linux Enterprise 15"

Thanks for the comment - should be ok in 86173c7

brett060102 · 2021-04-12T15:53:18Z

...em/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml

+documentation_complete: true
+
+title: |-
+{{% if product in ["sle15"] %}}


I don't think that the title should ever vary by distro.

thanks - removed that in 4e4ea53

brett060102 · 2021-04-12T16:02:35Z

...em/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml

+    <pre>$ sudo chmod go-w <i>DIR</i></pre>
+
+rationale: |-
+    If the SUSE operating system were to allow any user to make changes to software libraries,


Don't think this should be SUSE specific.

thanks - removed that in 4e4ea53

brett060102 · 2021-04-12T16:10:37Z

...issions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml

+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">dir_state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">dir_perms_state_symlink</filter>
+  </unix:file_object>


It looks like the dir_object_file_permissions_lib_files and dir_object_file_permissions_lib_dir are doing the same thing. Am I missing something here? I guess from test name that one is for dirs and files, but test look there are the same and the rule is for dir's only so. I feel uncomfortable if the oval does something different than what is in the rule file.

It probably needs to replace the unix:filename with <unix:filename xsi:nil="true" />. See how it's done in the file_permissions template

brett060102 · 2021-04-12T16:17:42Z

sle15/profiles/stig.profile

@@ -147,6 +147,7 @@ selections:
    - dconf_db_up_to_date
    - dconf_gnome_banner_enabled
    - dconf_gnome_login_banner_text
+    - dir_permissions_library_dirs


There is a conflict on this file that should be addressed.

rebased the branch so conflict should be resolved now in 07143f3

ggbecker · 2021-04-13T14:29:31Z

@openscap-ci ok to test

openscap-ci · 2021-04-13T14:35:44Z

Changes identified:
Rules:
dir_permissions_library_dirs
Profiles:
stig on sle15

Show details

Rule dir_permissions_library_dirs:
Bash remediation is newly added.
OVAL check is newly added.
Ansible remediation newly added.
Profile stig on sle15:
Rule dir_permissions_library_dirs added to stig profile.

Recommended tests to execute:
build_product sle15
tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-sle15-ds.xml dir_permissions_library_dirs
tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-sle15-ds.xml dir_permissions_library_dirs
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-sle15-ds.xml stig

ggbecker · 2021-04-22T15:36:06Z

...issions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml

+  <unix:file_object comment="library files" id="dir_object_file_permissions_lib_files" version="1">
+    <!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
+    <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>


Suggested change

<unix:filename operation="pattern match">^.*$</unix:filename>

<unix:filename xsi:nil="true" />

The idea of the rule dir_object_file_permissions_lib_files was to match all files in the directories, as far as I understood <unix:filename xsi:nil="true" /> will match only the directories, which should have been done in dir_object_file_permissions_lib_dir, so my point here is to match all files with dir_object_file_permissions_lib_files and dirs and subdirs with dir_object_file_permissions_lib_dir object. I guess once you are suggested changes I misunderstood something in the syntax. When I implemented it I had in mind the file_object description in the oval spec (https://oval.mitre.org/language/version5.11/ovaldefinition/documentation/unix-definitions-schema.html), where it is stated that:

...
For example, one would set xsi:nil to true if the desire was to test the attributes or permissions associated with a directory. Setting xsi:nil equal to true is different than using a .* pattern match, which says to collect every file under a given path.

This was my motivation but as far as I understand from your feedback it was wrong so you would suggest to change both rules <unix:filename xsi:nil="true" />, but then I will not need both objects but only one would be enough - am I right

I have probably misread the comment from brett. If the idea is to check for all files in the directories then it is probably fine. I'm will go through the PR once again soon, please bear with me.

Based on text from SLES-15-010351, I understand that no files should be checked within this rule, I think that was my original concern.

The library files test should be covered by this rule already:
https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml#L43

My question is, do we really want to have the test dir_object_file_permissions_lib_files in this rule?

@ggbecker @teacup-on-rockingchair SLES-15-010352 the STIG for this PR is explicit in covering directories only "-type d", SLES-15-010351 is explicit in covering files "-type f" So, in this case the oval should only be handling directories. So, if I understand this correctly <unix:filename xsi:nil="true" /> is what is needed here.

Thanks @brett060102 and @ggbecker , it seems I was totally confused on this one. Dropped completely the rule for files so now(252fa36) only dirs are checked by this one.

brett060102

test cases need to end in either .fail.sh or .pass.sh so for example:

rename:
linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.sh

to
linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
same for owner_only_writable_dir.sh, world_writable_dir_on_lib.sh, world_writable_dir_on_lib.sh, world_writable_dir_on_usr_lib.sh

brett060102 · 2021-04-28T15:59:27Z

...ns_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.sh

+# platform = multi_platform_sle
+DIRS="/usr/lib /usr/lib64"
+for dirPath in $DIRS; do
+	mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/test"


"$dirPath/test needs to be "$dirPath/testme

Thx should be ok in 8851e58

ggbecker · 2021-05-03T14:26:11Z

Unfortunately, there is a conflict with the stig.profile file, can you resolve it?

Clone implementation of file_permissions_library_dirs to dir_permissions_library_dirs

@brett060102

Thanks to @brett060102 for the feedback

@brett060102

Thanks to @brett060102

@brett060102

Thanks to @brett060102 for pointing it out

@ggbecker

Remove the dir_object_file_permissions_lib_files from dir_permissions_library_dirs, since this check is covered in separate rule. Thanks to @ggbecker and @brett060102 for the help on this 🙇

...em/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml

@ggbecker

…ortant_dirs/dir_permissions_library_dirs/rule.yml Thanx to @ggbecker for pointing this one Co-authored-by: Gabriel Becker <ggasparb@redhat.com>

ggbecker

LGTM. Thanks for addressing all the requests. The next step is to remove the dirs checking from this rule: https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/oval/shared.xml#L21

openshift-ci-robot added the needs-ok-to-test Used by openshift-ci bot. label Apr 11, 2021

brett060102 suggested changes Apr 12, 2021

View reviewed changes

teacup-on-rockingchair force-pushed the suse_SLES-15-010352 branch from 25576d5 to 86173c7 Compare April 12, 2021 16:47

ggbecker reviewed Apr 22, 2021

View reviewed changes

brett060102 suggested changes Apr 28, 2021

View reviewed changes

openshift-ci bot added the needs-rebase Used by openshift-ci bot. label May 3, 2021

ggbecker self-assigned this May 3, 2021

ggbecker added this to the 0.1.56 milestone May 3, 2021

teacup-on-rockingchair added 6 commits May 4, 2021 21:19

Add rule for SLES-15-10352

0febfb6

Clone implementation of file_permissions_library_dirs to dir_permissions_library_dirs

Remove distribution specific notes from the rule description

2b32e0e

Thanks to @brett060102 for the feedback

Platform specification needs to be multi_platform_sle

dc415c7

Thanks to @brett060102

Fix misspelling in the test script

4135d74

Thanks to @brett060102 for pointing it out

Drop dir_object_file_permissions_lib_files rule

01d5986

Remove the dir_object_file_permissions_lib_files from dir_permissions_library_dirs, since this check is covered in separate rule. Thanks to @ggbecker and @brett060102 for the help on this 🙇

Rename test scripts to follow correct convention

421f33a

teacup-on-rockingchair force-pushed the suse_SLES-15-010352 branch from ed07741 to 421f33a Compare May 4, 2021 18:21

openshift-ci bot removed the needs-rebase Used by openshift-ci bot. label May 4, 2021

ggbecker reviewed May 5, 2021

View reviewed changes

...em/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml Outdated Show resolved Hide resolved

Update linux_os/guide/system/permissions/files/permissions_within_imp…

708875f

…ortant_dirs/dir_permissions_library_dirs/rule.yml Thanx to @ggbecker for pointing this one Co-authored-by: Gabriel Becker <ggasparb@redhat.com>

ggbecker approved these changes May 5, 2021

View reviewed changes

ggbecker merged commit 424835a into ComplianceAsCode:master May 5, 2021

teacup-on-rockingchair deleted the suse_SLES-15-010352 branch May 10, 2021 04:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SLES-15-10352 rule #6822

SLES-15-10352 rule #6822

teacup-on-rockingchair commented Apr 11, 2021

openscap-ci commented Apr 11, 2021

openscap-ci commented Apr 11, 2021

openshift-ci-robot commented Apr 11, 2021

brett060102 left a comment

brett060102 Apr 12, 2021

teacup-on-rockingchair Apr 13, 2021

brett060102 Apr 12, 2021

teacup-on-rockingchair Apr 13, 2021

brett060102 Apr 12, 2021

teacup-on-rockingchair Apr 13, 2021

brett060102 Apr 12, 2021

ggbecker Apr 22, 2021

brett060102 Apr 12, 2021

teacup-on-rockingchair Apr 13, 2021

ggbecker commented Apr 13, 2021

openscap-ci commented Apr 13, 2021 •

edited

ggbecker Apr 22, 2021

teacup-on-rockingchair Apr 23, 2021 •

edited

ggbecker Apr 29, 2021

ggbecker Apr 29, 2021

brett060102 Apr 30, 2021

teacup-on-rockingchair May 3, 2021

brett060102 left a comment

brett060102 Apr 28, 2021

teacup-on-rockingchair May 3, 2021

ggbecker commented May 3, 2021

ggbecker left a comment

	<unix:filename operation="pattern match">^.*$</unix:filename>
	<unix:filename xsi:nil="true" />

SLES-15-10352 rule #6822

SLES-15-10352 rule #6822

Conversation

teacup-on-rockingchair commented Apr 11, 2021

Description:

Rationale:

openscap-ci commented Apr 11, 2021

openscap-ci commented Apr 11, 2021

openshift-ci-robot commented Apr 11, 2021

brett060102 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ggbecker commented Apr 13, 2021

openscap-ci commented Apr 13, 2021 • edited

Choose a reason for hiding this comment

teacup-on-rockingchair Apr 23, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brett060102 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ggbecker commented May 3, 2021

ggbecker left a comment

Choose a reason for hiding this comment

openscap-ci commented Apr 13, 2021 •

edited

teacup-on-rockingchair Apr 23, 2021 •

edited