|
 |
b5e178 |
From 76aede9cea67f4ea37eaa05ad74bf80273638de2 Mon Sep 17 00:00:00 2001
|
|
|
b5e178 |
From: Watson Sato <wsato@redhat.com>
|
|
|
b5e178 |
Date: Wed, 28 Oct 2020 18:52:13 +0100
|
|
|
b5e178 |
Subject: [PATCH] Select rules for ANSSI R37
|
|
|
b5e178 |
|
|
|
b5e178 |
These rules are better fit for R37 than R38.
|
|
|
b5e178 |
R37 is about binaries designed to be used with setuid or setgid bits.
|
|
|
b5e178 |
R38 is about reducing number of binaries with setuid root.
|
|
|
b5e178 |
---
|
|
|
b5e178 |
controls/anssi.yml | 17 ++++++++++++-----
|
|
|
b5e178 |
1 file changed, 12 insertions(+), 5 deletions(-)
|
|
|
b5e178 |
|
|
|
b5e178 |
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
|
|
b5e178 |
index 26bc7f4694..4648b98dff 100644
|
|
|
b5e178 |
--- a/controls/anssi.yml
|
|
|
b5e178 |
+++ b/controls/anssi.yml
|
|
|
b5e178 |
@@ -590,8 +590,17 @@ controls:
|
|
|
b5e178 |
|
|
|
b5e178 |
- id: R37
|
|
|
b5e178 |
level: minimal
|
|
|
b5e178 |
- title: Executables with setuid and/or setgid bits
|
|
|
b5e178 |
- # rules: TBD
|
|
|
b5e178 |
+ title: Executables with setuid and setgid bits
|
|
|
b5e178 |
+ notes: >-
|
|
|
b5e178 |
+ Only programs specifically designed to be used with setuid or setgid bits can have these privilege bits set.
|
|
|
b5e178 |
+ This requirement considers apropriate for setuid and setgid bits the binaries that are installed from
|
|
|
b5e178 |
+ recognized and authorized repositories (covered in R15).
|
|
|
b5e178 |
+ The remediation resets the sticky bit to intended value by vendor/developer, any finding after remediation
|
|
|
b5e178 |
+ should be reviewed.
|
|
|
b5e178 |
+ automated: yes
|
|
|
b5e178 |
+ rules:
|
|
|
b5e178 |
+ - file_permissions_unauthorized_suid
|
|
|
b5e178 |
+ - file_permissions_unauthorized_sgid
|
|
|
b5e178 |
|
|
|
b5e178 |
- id: R38
|
|
|
b5e178 |
level: enhanced
|
|
|
b5e178 |
@@ -600,9 +609,7 @@ controls:
|
|
|
b5e178 |
Setuid executables should be as small as possible. When it is expected
|
|
|
b5e178 |
that only the administrators of the machine execute them, the setuid bit
|
|
|
b5e178 |
must be removed and prefer them commands like su or sudo, which can be monitored
|
|
|
b5e178 |
- rules:
|
|
|
b5e178 |
- - file_permissions_unauthorized_suid
|
|
|
b5e178 |
- - file_permissions_unauthorized_sgid
|
|
|
b5e178 |
+ # rules: TBD
|
|
|
b5e178 |
|
|
|
b5e178 |
- id: R39
|
|
|
b5e178 |
level: intermediary
|