Skip to content

Commit 0abbd32

Browse files
vickeybrownvickeybrown
committed
added compliance checks
update # Conflicts: # shared/references/cce-redhat-avail.txt
1 parent 0f75098 commit 0abbd32

22 files changed

Lines changed: 279 additions & 4 deletions

File tree

‎components/at.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,7 @@ packages:
33
- at
44
rules:
55
- file_at_deny_not_exist
6+
- file_permissions_at_binaries
67
- service_atd_disabled
8+
templates:
9+
- file_permissions

‎components/dnf.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ packages:
44
- dnf-automatic
55
- dnf-plugin-subscription-manager
66
- libdnf-plugin-subscription-manager
7+
- python3-dnf
78
rules:
89
- clean_components_post_updating
910
- disable_weak_deps
@@ -12,6 +13,9 @@ rules:
1213
- ensure_gpgcheck_local_packages
1314
- ensure_gpgcheck_never_disabled
1415
- ensure_gpgcheck_repo_metadata
16+
- file_permissions_dnf_binaries
1517
- package_dnf-automatic_installed
1618
- package_dnf-plugin-subscription-manager_installed
1719
- package_libdnf-plugin-subscription-manager_installed
20+
templates:
21+
- file_permissions

‎components/nmap-ncat.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
name: nmap-ncat
2+
packages:
3+
- nmap-ncat
4+
rules:
5+
- file_permissions_nmap_ncat_binaries
6+
templates:
7+
- file_permissions

‎components/socat.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
name: socat
2+
packages:
3+
- socat
4+
rules:
5+
- file_permissions_socat_binaries
6+
templates:
7+
- file_permissions

‎linux_os/guide/services/cron_and_at/file_permissions_at_binaries/rule.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
documentation_complete: true
2+
3+
title: 'Restrict Execution of At Job Scheduling Binaries'
4+
5+
description: |-
6+
On RHCOS, packages in the base image cannot be removed. As a compensating
7+
control, job scheduling utilities such as at should have their execute
8+
permissions removed to prevent unauthorized task scheduling.
9+
{{{ describe_file_permissions(file="/usr/bin/at", perms="0000") }}}
10+
{{{ describe_file_permissions(file="/usr/bin/atq", perms="0000") }}}
11+
{{{ describe_file_permissions(file="/usr/bin/atrm", perms="0000") }}}
12+
{{{ describe_file_permissions(file="/usr/bin/batch", perms="0000") }}}
13+
14+
rationale: |-
15+
The at package provides the ability to schedule one-time tasks for future
16+
execution. While not installed by default on RHCOS, if present, attackers
17+
could use these utilities to schedule malicious tasks, making it harder to
18+
detect and trace unauthorized activity. On immutable systems like RHCOS,
19+
removing execute permissions prevents these tools from being used while
20+
maintaining system integrity.
21+
22+
severity: high
23+
24+
identifiers:
25+
cce@rhcos4: CCE-86492-6
26+
27+
platform: rhcos4
28+
29+
ocil: |-
30+
{{{ describe_file_permissions(file="/usr/bin/at", perms="0000") }}}
31+
{{{ describe_file_permissions(file="/usr/bin/atq", perms="0000") }}}
32+
{{{ describe_file_permissions(file="/usr/bin/atrm", perms="0000") }}}
33+
{{{ describe_file_permissions(file="/usr/bin/batch", perms="0000") }}}
34+
35+
template:
36+
name: file_permissions
37+
vars:
38+
filepath:
39+
- /usr/bin/at
40+
- /usr/bin/atq
41+
- /usr/bin/atrm
42+
- /usr/bin/batch
43+
filemode: '0000'
44+
missing_file_pass: 'true'

‎linux_os/guide/services/cron_and_at/file_permissions_at_binaries/tests/correct.pass.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
# Create binaries with correct permissions (0000)
5+
touch /usr/bin/at
6+
touch /usr/bin/atq
7+
touch /usr/bin/atrm
8+
touch /usr/bin/batch
9+
chmod 0000 /usr/bin/at
10+
chmod 0000 /usr/bin/atq
11+
chmod 0000 /usr/bin/atrm
12+
chmod 0000 /usr/bin/batch

‎linux_os/guide/services/cron_and_at/file_permissions_at_binaries/tests/missing_files.pass.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
# Remove binaries - should pass because missing_file_pass: true
5+
rm -f /usr/bin/at
6+
rm -f /usr/bin/atq
7+
rm -f /usr/bin/atrm
8+
rm -f /usr/bin/batch

‎linux_os/guide/services/cron_and_at/file_permissions_at_binaries/tests/wrong_permissions.fail.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
# Create binaries with wrong permissions (0755)
5+
touch /usr/bin/at
6+
touch /usr/bin/atq
7+
touch /usr/bin/atrm
8+
touch /usr/bin/batch
9+
chmod 0755 /usr/bin/at
10+
chmod 0755 /usr/bin/atq
11+
chmod 0755 /usr/bin/atrm
12+
chmod 0755 /usr/bin/batch

‎linux_os/guide/system/software/system-tools/file_permissions_dnf_binaries/rule.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
documentation_complete: true
2+
3+
title: 'Restrict Execution of DNF Package Manager Binaries'
4+
5+
description: |-
6+
On RHCOS, packages in the base image cannot be removed. As a compensating
7+
control, package management utilities such as dnf and yum should have their
8+
execute permissions removed to prevent unauthorized package installation.
9+
{{{ describe_file_permissions(file="/usr/bin/dnf", perms="0000") }}}
10+
{{{ describe_file_permissions(file="/usr/bin/dnf-3", perms="0000") }}}
11+
{{{ describe_file_permissions(file="/usr/bin/yum", perms="0000") }}}
12+
13+
rationale: |-
14+
The dnf and python3-dnf packages provide package management utilities for
15+
installing, updating, and removing software. RHCOS is designed to be an
16+
immutable operating system managed through atomic upgrades and containerization.
17+
Retaining these utilities with execute permissions allows unauthorized users
18+
to install or modify packages, potentially compromising system integrity.
19+
On immutable systems like RHCOS, removing execute permissions prevents
20+
unauthorized package management while maintaining system integrity.
21+
22+
severity: high
23+
24+
identifiers:
25+
cce@rhcos4: CCE-86494-2
26+
27+
platform: rhcos4
28+
29+
ocil: |-
30+
{{{ describe_file_permissions(file="/usr/bin/dnf", perms="0000") }}}
31+
{{{ describe_file_permissions(file="/usr/bin/dnf-3", perms="0000") }}}
32+
{{{ describe_file_permissions(file="/usr/bin/yum", perms="0000") }}}
33+
34+
template:
35+
name: file_permissions
36+
vars:
37+
filepath:
38+
- /usr/bin/dnf
39+
- /usr/bin/dnf-3
40+
- /usr/bin/yum
41+
filemode: '0000'
42+
missing_file_pass: 'true'

‎linux_os/guide/system/software/system-tools/file_permissions_dnf_binaries/tests/correct.pass.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
# Create binaries with correct permissions (0000)
5+
touch /usr/bin/dnf
6+
touch /usr/bin/dnf-3
7+
touch /usr/bin/yum
8+
chmod 0000 /usr/bin/dnf
9+
chmod 0000 /usr/bin/dnf-3
10+
chmod 0000 /usr/bin/yum

0 commit comments

Comments
 (0)