From 9fbaa6ab52cb7b402e162457f8e0142ed69b271a Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Thu, 19 Sep 2013 16:23:06 +0200 Subject: Update on baseline, now working on services --- xml/SCAP/Makefile | 2 +- .../gentoo-sce_installation-toolchain-hardened.sh | 43 ++ xml/SCAP/gentoo-oval.xml | 551 +++++++++++++++- xml/SCAP/gentoo-xccdf.xml | 690 ++++++++++++++++----- 4 files changed, 1107 insertions(+), 179 deletions(-) create mode 100755 xml/SCAP/bin/gentoo-sce_installation-toolchain-hardened.sh diff --git a/xml/SCAP/Makefile b/xml/SCAP/Makefile index fcbf549..3de65fa 100644 --- a/xml/SCAP/Makefile +++ b/xml/SCAP/Makefile @@ -1,7 +1,7 @@ all: report.html guide.html remediate.sh #guide.pdf report.html: gentoo-cpe.xml gentoo-xccdf.xml gentoo-oval.xml - oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default --results results-xccdf.xml --oval-results --report report.html gentoo-xccdf.xml + -oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default --results results-xccdf.xml --oval-results --report report.html gentoo-xccdf.xml guide.html: gentoo-cpe.xml gentoo-xccdf.xml gentoo-oval.xml oscap xccdf generate guide --profile xccdf_org.gentoo.dev.swift_profile_default --output guide.html gentoo-xccdf.xml diff --git a/xml/SCAP/bin/gentoo-sce_installation-toolchain-hardened.sh b/xml/SCAP/bin/gentoo-sce_installation-toolchain-hardened.sh new file mode 100755 index 0000000..99ff12c --- /dev/null +++ b/xml/SCAP/bin/gentoo-sce_installation-toolchain-hardened.sh @@ -0,0 +1,43 @@ +#!/bin/sh + +# Get CHOST value +echo "Getting CHOST variable content through portageq."; +my_chost=$(portageq envvar CHOST); +if [ -z "${my_chost}" ]; +then + echo "-- The portageq command failed. Falling back to glibc build info."; + my_chost=$(cat /var/db/pkg/sys-libs/glibc-*/CHOST | tail -1); +fi +echo "-- Got CHOST=${my_chost}"; + +# Get current GCC version +echo "Getting current GCC version through /etc/env.d/gcc/config-*"; +current_gcc=$(grep CURRENT /etc/env.d/gcc/config-* | sed -e "s:CURRENT=${my_chost}-::g" | sed -e "s:\([0-9\.-r]*\){$,-.*$}:\1:g" ); +echo "-- Got version=${current_gcc}"; + +# Get type +echo "Getting compiler type (profile/spec) through its CURRENT= value."; +current_type=$(grep CURRENT /etc/env.d/gcc/config-* | sed -e "s:CURRENT=${my_chost}-${current_gcc}::g" | sed -e 's:^-::g'); +echo "-- Got type=${current_type}"; + +echo "Checking USE flags of gcc-${current_gcc} for hardened USE flag."; +grep -q hardened /var/db/pkg/sys-devel/gcc-${current_gcc}/USE; +current_hardened_use=$?; + +if [ ${current_hardened_use} -ne 0 ]; +then + echo "!! GCC ${current_gcc} is not build with USE=hardened!"; + echo "!! Please enable a hardened profile."; + exit ${XCCDF_RESULT_FAIL}; +else + echo "-- GCC ${current_gcc} is build with USE=hardened."; + if [ -z "${current_type}" ]; + then + echo "-- The default type is used which is a hardened type."; + exit ${XCCDF_RESULT_PASS}; + else + echo "!! A non-default type is used: ${current_type}"; + echo "!! This means not all hardened toolchain measures are enabled."; + exit ${XCCDF_RESULT_FAIL}; + fi +fi diff --git a/xml/SCAP/gentoo-oval.xml b/xml/SCAP/gentoo-oval.xml index 9fa2c1e..4fe52b9 100644 --- a/xml/SCAP/gentoo-oval.xml +++ b/xml/SCAP/gentoo-oval.xml @@ -1,17 +1,17 @@ + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" + xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" + xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" + xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" + xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" + xsi:schemaLocation=" + http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd + http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd + http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd + http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd + http://standards.iso.org/iso/19770/-2/2009/schema.xsd schema.xsd"> OVAL Gentoo Linux @@ -46,7 +46,7 @@ This definition tests whether the /home location is a separate file - system. + system. @@ -62,7 +62,7 @@ This definition tests whether the /home partition is mounted with the nosuid - mount option. + mount option. @@ -79,7 +79,7 @@ This definition tests whether the /home partition is mounted with the nodev - mount option. + mount option. @@ -97,7 +97,7 @@ This definition tests whether the /tmp location is a separate file - system. + system. @@ -105,7 +105,297 @@ + + + The /var location must be a separate file system + + Gentoo Linux + + + + This definition tests whether the /var location is a separate file + system. + + + + + + + + + + The /var/log location must be a separate file system + + Gentoo Linux + + + + This definition tests whether the /var/log location is a separate file + system. + + + + + + + + + + The /var/log/audit location must be a separate file system + + Gentoo Linux + + + + This definition tests whether the /var/log/audit location is a separate file + system. + + + + + + + + + + The /var file system is mounted with the nodev option + + Gentoo Linux + + + + This definition tests whether the /var partition is mounted with the nodev + mount option. + + + + + + + + + + + The /var/log file system is mounted with the nodev option + + Gentoo Linux + + + + This definition tests whether the /var/log partition is mounted with the nodev + mount option. + + + + + + + + + + + The /var/log/audit file system is mounted with the nodev option + + Gentoo Linux + + + + This definition tests whether the /var/log/audit partition is mounted with the nodev + mount option. + + + + + + + + + + + The /tmp file system is mounted with the nodev option + + Gentoo Linux + + + + This definition tests whether the /tmp partition is mounted with the nodev + mount option. + + + + + + + + + + + The /tmp file system is mounted with the nosuid option + + Gentoo Linux + + + + This definition tests whether the /tmp partition is mounted with the nosuid + mount option. + + + + + + + + + + + The /dev/shm file system is mounted with the nosuid option + + Gentoo Linux + + + + This definition tests whether the /dev/shm partition is mounted with the nosuid + mount option. + + + + + + + + + + + The /tmp file system is mounted with the noexec option + + Gentoo Linux + + + + This definition tests whether the /tmp partition is mounted with the noexec + mount option. + + + + + + + + + + + The /dev/shm file system is mounted with the noexec option + + Gentoo Linux + + + + This definition tests whether the /dev/shm partition is mounted with the noexec + mount option. + + + + + + + + + + + The /var/tmp location is on a separate file system + + Gentoo Linux + + + + This definition tests whether the /var/tmp location is on its own file system. + + + + + + + + + + The kernel is build with quota support (CONFIG_QUOTA) + + Gentoo Linux + + + This definition tests whether the Linux kernel is build with quota support (CONFIG_QUOTA). + + + + + + + + + + No process matching "telnetd" is running + + Gentoo Linux + + + + This definition tests if no telnet daemon processes are running. + + + + + + + + + No process matching "ftpd" is running + + Gentoo Linux + + + + This definition tests if no FTP daemon processes are running. + + + + + + + + + + rc.conf's rc_shell should be set to /sbin/sulogin + + Gentoo Linux + + + + This definition tests if rc_shell in /etc/rc.conf is set to /sbin/sulogin, ensuring + that single user boots still require the root password to be provided. + + + + + + + + + + Single user definitions in inittab should only refer to '/sbin/rc single' or '/sbin/sulogin' + + Gentoo Linux + + + + This definition tests if /etc/inittab single user login settings only refers + to '/sbin/rc single' or '/sbin/sulogin'. + + + + + + @@ -145,9 +435,158 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -167,6 +606,64 @@ /tmp + + /var + + + + /var/log + + + + /var/log/audit + + + + /dev/shm + + + + /var/tmp + + + + /usr/src/linux/.config + ^CONFIG_.* + 1 + + + + .*[Tt][Ee][Ll][Nn][Ee][Tt][Dd].* + 0 + + + + .*[Ff][Tt][Pp][Dd].* + 0 + + + + /etc/rc.conf + ^[[:space:]]*[\S]+[[:space:]]*=[[:space:]]*[\S]+ + 1 + + + + /etc/inittab + ^[\S]+:S:[\S]+:.* + 1 + + @@ -181,6 +678,26 @@ nodev + + noexec + + + + ^CONFIG_QUOTA=[ym] + + + + rc_shell[[:space:]]*=[[:space:]]*["]?/sbin/sulogin["]? + + + + su[[:digit:]]+:S:[\S]+:(/sbin/rc single|/sbin/sulogin) + + + + + + + + + + + + + + + + + + + +