Skip to content

Commit 9033391

Browse files
Mab879Mab879
authored
Merge pull request #14370 from vojtapolasek/add_rule_home_dirs_on_separate_partition
Add rule accounts_user_interactive_home_directory_on_separate_partition
2 parents 881b368 + 663217e commit 9033391

8 files changed

Lines changed: 174 additions & 1 deletion

File tree

‎components/operating-system.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ rules:
66
- accounts_user_home_paths_only
77
- accounts_user_interactive_home_directory_defined
88
- accounts_user_interactive_home_directory_exists
9+
- accounts_user_interactive_home_directory_on_separate_partition
910
- bios_assign_password
1011
- bios_disable_usb_boot
1112
- bios_enable_execution_restrictions

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/oval/shared.xml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<def-group>
2+
<definition class="compliance"
3+
id="{{{ rule_id }}}" version="1">
4+
{{{ oval_metadata("All interactive user home directories must reside on a separate partition from root.", rule_title=rule_title) }}}
5+
<criteria operator="OR">
6+
<criterion test_ref="test_{{{ rule_id }}}"
7+
comment="All interactive user home directories are on a separate partition"/>
8+
<criterion test_ref="test_{{{ rule_id }}}_no_interactive_users"
9+
comment="No interactive users exist on the system"/>
10+
</criteria>
11+
</definition>
12+
13+
<!-- ============================================================ -->
14+
<!-- Part 1: Collect all non-root mount points from the system -->
15+
<!-- ============================================================ -->
16+
<linux:partition_object id="object_{{{ rule_id }}}_non_root_partitions" version="1">
17+
<linux:mount_point operation="not equal">/</linux:mount_point>
18+
</linux:partition_object>
19+
20+
<!-- Build regex patterns from mount points: ^<mount_point>(/|$)
21+
The (/|$) suffix prevents substring false matches, e.g.
22+
mount point /home should not match home directory /home2/user -->
23+
<local_variable id="var_{{{ rule_id }}}_mount_regex" datatype="string" version="1"
24+
comment="Regex patterns to match home dirs on non-root partitions">
25+
<concat>
26+
<literal_component>^</literal_component>
27+
<object_component item_field="mount_point"
28+
object_ref="object_{{{ rule_id }}}_non_root_partitions"/>
29+
<literal_component>(/|$)</literal_component>
30+
</concat>
31+
</local_variable>
32+
33+
<!-- ============================================================ -->
34+
<!-- Part 2: Extract home directories of interactive users -->
35+
<!-- Interactive users: UID >= 1000, shell not nologin, -->
36+
<!-- username not nobody/nfsnobody -->
37+
<!-- ============================================================ -->
38+
<ind:textfilecontent54_object id="object_{{{ rule_id }}}_interactive_users" version="1">
39+
<ind:filepath>/etc/passwd</ind:filepath>
40+
<ind:pattern operation="pattern match"
41+
>^(?:(?!nobody|nfsnobody)[^:]*):(?:[^:]*:)[1-9]\d{3,}:(?:[^:]*:){2}([^:]+):(?!(?:/usr)?/sbin/nologin$)[^:]*$</ind:pattern>
42+
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
43+
</ind:textfilecontent54_object>
44+
45+
<!-- ============================================================ -->
46+
<!-- Part 3: Test that ALL interactive users' home directories -->
47+
<!-- match at least one non-root mount point regex -->
48+
<!-- ============================================================ -->
49+
<ind:textfilecontent54_test id="test_{{{ rule_id }}}"
50+
check="all" check_existence="at_least_one_exists"
51+
version="1"
52+
comment="All interactive user home dirs are on separate partitions">
53+
<ind:object object_ref="object_{{{ rule_id }}}_interactive_users"/>
54+
<ind:state state_ref="state_{{{ rule_id }}}_on_separate_partition"/>
55+
</ind:textfilecontent54_test>
56+
57+
<ind:textfilecontent54_state id="state_{{{ rule_id }}}_on_separate_partition" version="1">
58+
<ind:subexpression operation="pattern match" var_check="at least one"
59+
var_ref="var_{{{ rule_id }}}_mount_regex"/>
60+
</ind:textfilecontent54_state>
61+
62+
<!-- ============================================================ -->
63+
<!-- Part 4: Handle edge case - no interactive users on system -->
64+
<!-- ============================================================ -->
65+
<ind:textfilecontent54_test id="test_{{{ rule_id }}}_no_interactive_users"
66+
check="all" check_existence="none_exist"
67+
version="1"
68+
comment="No interactive users exist on the system">
69+
<ind:object object_ref="object_{{{ rule_id }}}_interactive_users"/>
70+
</ind:textfilecontent54_test>
71+
</def-group>

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/rule.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
documentation_complete: true
2+
3+
title: 'All Interactive User Home Directories Must Reside On a Separate Partition'
4+
5+
description: |-
6+
All interactive user home directories must be located on a file system
7+
partition separate from the root (<tt>/</tt>) partition. If any interactive
8+
user's home directory resides directly on the root file system, a failure
9+
of that file system or a user filling it up could impact system operation.
10+
11+
rationale: |-
12+
Ensuring that interactive user home directories are on a separate
13+
partition from the root file system prevents users from filling the root
14+
partition, which could result in system instability or denial of service.
15+
It also allows administrators to apply more restrictive mount options
16+
such as <tt>noexec</tt>, <tt>nosuid</tt>, and <tt>nodev</tt> to the
17+
partition containing user home directories.
18+
19+
severity: medium
20+
21+
identifiers:
22+
cce@rhel8: CCE-90711-3
23+
24+
references:
25+
srg: SRG-OS-000480-GPOS-00227
26+
27+
ocil_clause: 'any interactive user home directory is on the root partition'
28+
29+
ocil: |-
30+
Verify that all interactive user home directories are on a separate
31+
file system partition with the following commands:
32+
33+
List interactive users and their home directories:
34+
<pre>$ awk -F: '($3&gt;={{{ uid_min }}})&amp;&amp;($7 !~ /nologin/){print $1, $6}' /etc/passwd</pre>
35+
36+
For each home directory listed, verify it is on a separate partition:
37+
<pre>$ df &lt;home_directory&gt; | tail -1 | awk '{print $6}'</pre>
38+
39+
If the command returns <tt>/</tt> for any interactive user home directory,
40+
this is a finding.
41+
42+
fixtext: |-
43+
Migrate interactive user home directories that reside on the root
44+
file system to a separate partition.
45+
46+
srg_requirement: 'All {{{ full_name }}} interactive user home directories must reside on a file system separate from the root partition.'
47+
48+
platform: machine

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/tests/home_on_root_partition.fail.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
# remediation = none
4+
5+
{{{ bash_remove_interactive_users_from_passwd_by_uid() }}}
6+
7+
mkdir -p /root_home
8+
useradd -m -d /root_home/testUser1 testUser1

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/tests/home_on_separate_partition.pass.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
. $SHARED/partition.sh
5+
6+
{{{ bash_remove_interactive_users_from_passwd_by_uid() }}}
7+
8+
umount /srv || true
9+
10+
clean_up_partition /srv
11+
12+
create_partition
13+
14+
make_fstab_correct_partition_line /srv
15+
16+
mount_partition /srv
17+
18+
mkdir -p /srv/home
19+
useradd -m -d /srv/home/testUser1 testUser1

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/tests/mixed_users_one_on_root.fail.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
# remediation = none
4+
5+
. $SHARED/partition.sh
6+
7+
{{{ bash_remove_interactive_users_from_passwd_by_uid() }}}
8+
9+
umount /srv || true
10+
11+
clean_up_partition /srv
12+
13+
create_partition
14+
15+
make_fstab_correct_partition_line /srv
16+
17+
mount_partition /srv
18+
19+
mkdir -p /srv/home
20+
useradd -m -d /srv/home/testUser1 testUser1
21+
22+
mkdir -p /root_home
23+
useradd -m -d /root_home/testUser2 testUser2

‎linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/tests/no_interactive_users.pass.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
# platform = multi_platform_all
3+
4+
{{{ bash_remove_interactive_users_from_passwd_by_uid() }}}

‎shared/references/cce-redhat-avail.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2342,7 +2342,6 @@ CCE-90705-5
23422342
CCE-90706-3
23432343
CCE-90707-1
23442344
CCE-90710-5
2345-
CCE-90711-3
23462345
CCE-90715-4
23472346
CCE-90720-4
23482347
CCE-90721-2

0 commit comments

Comments
 (0)