Skip to content

Commit 027cd23

Browse files
ggbeckerggbecker
authored
Merge pull request ComplianceAsCode#7789 from dodys/file-owner
File owner rules
2 parents 5c24c20 + 93a9741 commit 027cd23

File tree

9 files changed

+231
-6
lines changed

9 files changed

+231
-6
lines changed

‎linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
documentation_complete: true
2+
3+
title: 'Audit Configuration Files Must Be Owned By Root'
4+
5+
description: |-
6+
All audit configuration files must be owned by root user.
7+
{{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
8+
{{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
9+
10+
rationale: |-
11+
Without the capability to restrict which roles and individuals can
12+
select which events are audited, unauthorized personnel may be able
13+
to prevent the auditing of critical events.
14+
Misconfigured audits may degrade the system's performance by
15+
overwhelming the audit log. Misconfigured audits may also make it more
16+
difficult to establish, correlate, and investigate the events relating
17+
to an incident or identify those responsible for one.
18+
19+
severity: medium
20+
21+
references:
22+
disa: CCI-000171
23+
srg: SRG-OS-000063-GPOS-00032
24+
stigid@ubuntu2004: UBTU-20-010134
25+
26+
ocil: |-
27+
{{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
28+
{{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
29+
30+
template:
31+
name: file_owner
32+
vars:
33+
filepath:
34+
- /etc/audit/
35+
- /etc/audit/rules.d/
36+
file_regex:
37+
- ^audit(\.rules|d\.conf)$
38+
- ^.*\.rules$
39+
fileuid: '0'

‎linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# packages = audit
3+
4+
chown 0 /etc/audit/audit.rules
5+
chown 0 /etc/audit/auditd.conf
6+
chown 0 -R /etc/audit/rules.d/

‎linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
# packages = audit
3+
4+
useradd testuser_123
5+
chown testuser_123 /etc/audit/audit.rules
6+
chown testuser_123 /etc/audit/auditd.conf
7+
chown testuser_123 -R /etc/audit/rules.d/

‎linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
documentation_complete: true
2+
3+
title: 'Verify User Who Owns /var/log/syslog File'
4+
5+
description: '{{{ describe_file_owner(file="/var/log/syslog", owner="syslog") }}}'
6+
7+
rationale: |-
8+
The <tt>/var/log/syslog</tt> file contains logs of error messages in
9+
the system and should only be accessed by authorized personnel.
10+
11+
severity: medium
12+
13+
references:
14+
disa: CCI-001314
15+
srg: SRG-OS-000206-GPOS-00084
16+
stigid@ubuntu2004: UBTU-20-010421
17+
18+
ocil_clause: '{{{ ocil_clause_file_owner(file="/var/log/syslog", owner="syslog") }}}'
19+
20+
ocil: |-
21+
{{{ ocil_file_owner(file="/var/log/syslog", owner="syslog") }}}
22+
23+
template:
24+
name: file_owner
25+
vars:
26+
filepath: /var/log/syslog
27+
fileuid: '104'

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
documentation_complete: true
2+
3+
title: 'Verify that System Executable Have Root Ownership'
4+
5+
description: |-
6+
<pre>/bin
7+
/sbin
8+
/usr/bin
9+
/usr/sbin
10+
/usr/local/bin
11+
/usr/local/sbin</pre>
12+
All these directories should be owned by the <tt>root</tt> user.
13+
If any directory <i>DIR</i> in these directories is found
14+
to be owned by a user other than root, correct its ownership with the
15+
following command:
16+
<pre>$ sudo chown root <i>DIR</i></pre>
17+
18+
rationale: |-
19+
System binaries are executed by privileged users as well as system services,
20+
and restrictive permissions are necessary to ensure that their
21+
execution of these programs cannot be co-opted.
22+
23+
severity: medium
24+
25+
references:
26+
disa: CCI-001495
27+
srg: SRG-OS-000258-GPOS-00099
28+
stigid@ubuntu2004: UBTU-20-010424
29+
30+
ocil_clause: 'any system exectables directories are found to not be owned by root'
31+
32+
ocil: |-
33+
System executables are stored in the following directories by default:
34+
<pre>/bin
35+
/sbin
36+
/usr/bin
37+
/usr/local/bin
38+
/usr/local/sbin
39+
/usr/sbin</pre>
40+
For each of these directories, run the following command to find files
41+
not owned by root:
42+
<pre>$ sudo find -L <i>DIR/</i> ! -user root -type d -exec chown root {} \;</pre>
43+
44+
template:
45+
name: file_owner
46+
vars:
47+
filepath:
48+
- /bin/
49+
- /sbin/
50+
- /usr/bin/
51+
- /usr/sbin/
52+
- /usr/local/bin/
53+
- /usr/local/sbin/
54+
recursive: 'true'
55+
fileuid: '0'

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
documentation_complete: true
2+
3+
prodtype: ubuntu2004
4+
5+
title: 'Verify that audit tools are owned by root'
6+
7+
description: |-
8+
The {{{ full_name }}} operating system audit tools must have the proper
9+
ownership configured to protected against unauthorized access.
10+
11+
Verify it by running the following command:
12+
<pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
13+
14+
/sbin/auditctl root
15+
/sbin/aureport root
16+
/sbin/ausearch root
17+
/sbin/autrace root
18+
/sbin/auditd root
19+
/sbin/audispd root
20+
/sbin/augenrules root
21+
</pre>
22+
23+
Audit tools needed to successfully view and manipulate audit information
24+
system activity and records. Audit tools include custom queries and report
25+
generators
26+
27+
rationale: |-
28+
Protecting audit information also includes identifying and protecting the
29+
tools used to view and manipulate log data. Therefore, protecting audit
30+
tools is necessary to prevent unauthorized operation on audit information.
31+
32+
Operating systems providing tools to interface with audit information
33+
will leverage user permissions and roles identifying the user accessing the
34+
tools and the corresponding rights the user enjoys to make access decisions
35+
regarding the access to audit tools.
36+
37+
severity: medium
38+
39+
references:
40+
disa: CCI-001493,CCI-001494
41+
srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
42+
stigid@ubuntu2004: UBTU-20-010200
43+
44+
ocil: |-
45+
Verify it by running the following command:
46+
<pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
47+
48+
/sbin/auditctl root
49+
/sbin/aureport root
50+
/sbin/ausearch root
51+
/sbin/autrace root
52+
/sbin/auditd root
53+
/sbin/audispd root
54+
/sbin/augenrules root
55+
</pre>
56+
57+
If the command does not return all the above lines, the missing ones
58+
need to be added.
59+
60+
Run the following command to correct the permissions of the missing
61+
entries:
62+
<pre>$ sudo chown root [audit_tool] </pre>
63+
64+
Replace "[audit_tool]" with each audit tool not owned by root.
65+
66+
template:
67+
name: file_owner
68+
vars:
69+
filepath:
70+
- /sbin/auditctl
71+
- /sbin/aureport
72+
- /sbin/ausearch
73+
- /sbin/autrace
74+
- /sbin/auditd
75+
- /sbin/audispd
76+
- /sbin/augenrules
77+
fileuid: '0'

‎products/ubuntu2004/profiles/stig.profile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ selections:
199199
- file_permissions_etc_audit_auditd
200200

201201
# UBTU-20-010134 The Ubuntu operating system must permit only authorized accounts to own the audit configuration files.
202+
- file_ownership_audit_configuration
202203

203204
# UBTU-20-010135 The Ubuntu operating system must permit only authorized groups to own the audit configuration files.
204205
- file_groupownership_audit_configuration
@@ -350,6 +351,7 @@ selections:
350351
# UBTU-20-010199 The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
351352

352353
# UBTU-20-010200 The Ubuntu operating system must configure audit tools to be owned by root.
354+
- file_ownership_audit_binaries
353355

354356
# UBTU-20-010201 The Ubuntu operating system must configure the audit tools to be group-owned by root.
355357
- file_groupownership_audit_binaries
@@ -474,12 +476,14 @@ selections:
474476
- file_groupowner_var_log_syslog
475477

476478
# UBTU-20-010421 The Ubuntu operating system must configure /var/log/syslog file to be owned by syslog.
479+
- file_owner_var_log_syslog
477480

478481
# UBTU-20-010422 The Ubuntu operating system must configure /var/log/syslog file with mode 0640 or less permissive.
479482

480483
# UBTU-20-010423 The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.
481484

482485
# UBTU-20-010424 The Ubuntu operating system must have directories that contain system commands owned by root.
486+
- dir_ownership_binary_dirs
483487

484488
# UBTU-20-010425 The Ubuntu operating system must have directories that contain system commands group-owned by root.
485489
- dir_groupownership_binary_dirs

‎shared/templates/file_owner/ansible.template‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525

2626
- name: Ensure owner on {{{ path }}} recursively
2727
file:
28-
paths "{{{ path }}}"
28+
path: "{{{ path }}}"
2929
state: directory
3030
recurse: yes
3131
owner: "{{{ FILEUID }}}"

‎shared/templates/file_owner/tests/missing_file_test.pass.sh‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,18 @@
11
#!/bin/bash
22
#
33

4-
{{% if MISSING_FILE_PASS %}}
5-
rm -f {{{ FILEPATH }}}
6-
{{% else %}}
7-
true
8-
{{% endif %}}
4+
{{% for path in FILEPATH %}}
5+
{{% if MISSING_FILE_PASS %}}
6+
rm -f {{{ path }}}
7+
{{% else %}}
8+
{{% if IS_DIRECTORY and RECURSIVE %}}
9+
find -L {{{ path }}} -type d -exec chown {{{ FILEUID }}} {} \;
10+
{{% else %}}
11+
if [ ! -f {{{ path }}} ]; then
12+
mkdir -p "$(dirname '{{{ path }}}')"
13+
touch {{{ path }}}
14+
fi
15+
chown {{{ FILEUID }}} {{{ path }}}
16+
{{% endif %}}
17+
{{% endif %}}
18+
{{% endfor %}}

0 commit comments

Comments
 (0)