Blame SOURCES/scap-security-guide-0.1.61-file_groupowner-PR_7791.patch

ff1465
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
ff1465
new file mode 100644
5fd106
index 00000000000..de85c892704
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
ff1465
@@ -0,0 +1,38 @@
ff1465
+documentation_complete: true
ff1465
+
ff1465
+title: 'Audit Configuration Files Must Be Owned By Group root'
ff1465
+
ff1465
+description: |-
ff1465
+    All audit configuration files must be owned by group root.
ff1465
+    
chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
ff1465
+
ff1465
+rationale: |-
ff1465
+    Without the capability to restrict which roles and individuals can
ff1465
+    select which events are audited, unauthorized personnel may be able
ff1465
+    to prevent the auditing of critical events.
ff1465
+    Misconfigured audits may degrade the system's performance by
ff1465
+    overwhelming the audit log. Misconfigured audits may also make it more
ff1465
+    difficult to establish, correlate, and investigate the events relating
ff1465
+    to an incident or identify those responsible for one.
ff1465
+
ff1465
+severity: medium
ff1465
+
ff1465
+references:
ff1465
+    disa: CCI-000171
ff1465
+    srg: SRG-OS-000063-GPOS-00032
ff1465
+    stigid@ubuntu2004: UBTU-20-010135
ff1465
+
ff1465
+ocil: |-
ff1465
+    {{{ describe_file_group_owner(file="/etc/audit/", group="root") }}}
ff1465
+    {{{ describe_file_group_owner(file="/etc/audit/rules.d/", group="root") }}}
ff1465
+
ff1465
+template:
ff1465
+    name: file_groupowner
ff1465
+    vars:
ff1465
+        filepath:
ff1465
+            - /etc/audit/
ff1465
+            - /etc/audit/rules.d/
ff1465
+        file_regex:
ff1465
+            - ^audit(\.rules|d\.conf)$
ff1465
+            - ^.*\.rules$
ff1465
+        filegid: '0'
ff1465
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
ff1465
new file mode 100644
5fd106
index 00000000000..5235e0d05a3
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
ff1465
@@ -0,0 +1,9 @@
ff1465
+#!/bin/bash
ff1465
+
ff1465
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
ff1465
+export AUDITFILE=/etc/audit/auditd.conf
ff1465
+mkdir -p /etc/audit/rules.d/
ff1465
+touch $TESTFILE
ff1465
+touch $AUDITFILE
ff1465
+chgrp root $TESTFILE
ff1465
+chgrp root $AUDITFILE
ff1465
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
ff1465
new file mode 100644
5fd106
index 00000000000..52378d810a5
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
ff1465
@@ -0,0 +1,10 @@
ff1465
+#!/bin/bash
ff1465
+
ff1465
+groupadd group_test
ff1465
+export TESTFILLE=/etc/audit/rules.d/test_rule.rules
ff1465
+export AUDITFILE=/etc/audit/auditd.conf
ff1465
+mkdir -p /etc/audit/rules.d/
ff1465
+touch $TESTFILLE
ff1465
+touch $AUDITFILE
ff1465
+chgrp group_test $TESTFILLE
ff1465
+chgrp group_test $AUDITFILE
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
5fd106
index 5e2cabafc34..927d08d03d4 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
ff1465
@@ -1,8 +1,15 @@
ff1465
+{{% if 'ubuntu' in product %}}
ff1465
+{{% set gid = 'syslog' %}}
ff1465
+{{% else %}}
ff1465
+{{% set gid = 'root' %}}
ff1465
+{{% endif %}}
ff1465
+
ff1465
+
ff1465
 documentation_complete: true
ff1465
 
ff1465
 title: 'Verify Group Who Owns /var/log Directory'
ff1465
 
ff1465
-description: '{{{ describe_file_group_owner(file="/var/log", group="root") }}}'
ff1465
+description: '{{{ describe_file_group_owner(file="/var/log", group=gid) }}}'
ff1465
 
ff1465
 rationale: |-
ff1465
     The <tt>/var/log</tt> directory contains files with logs of error
5fd106
@@ -22,13 +29,16 @@ references:
ff1465
     stigid@rhel8: RHEL-08-010260
ff1465
     stigid@ubuntu2004: UBTU-20-010417
ff1465
 
ff1465
-ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group="root") }}}'
ff1465
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group=gid) }}}'
ff1465
 
ff1465
 ocil: |-
ff1465
-    {{{ ocil_file_group_owner(file="/var/log", group="root") }}}
ff1465
+    {{{ ocil_file_group_owner(file="/var/log", group=gid) }}}
ff1465
 
ff1465
 template:
ff1465
     name: file_groupowner
ff1465
     vars:
ff1465
         filepath: /var/log/
ff1465
         filegid: '0'
ff1465
+        filegid@ubuntu1604: '110'
ff1465
+        filegid@ubuntu1804: '110'
ff1465
+        filegid@ubuntu2004: '110'
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
ff1465
new file mode 100644
5fd106
index 00000000000..f654279fe54
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
ff1465
@@ -0,0 +1,27 @@
ff1465
+documentation_complete: true
ff1465
+
ff1465
+title: 'Verify Group Who Owns /var/log/syslog File'
ff1465
+
ff1465
+description: '{{{ describe_file_group_owner(file="/var/log/syslog", group="adm") }}}'
ff1465
+
ff1465
+rationale: |-
ff1465
+    The <tt>/var/log/syslog</tt> file contains logs of error messages in
ff1465
+    the system and should only be accessed by authorized personnel.
ff1465
+
ff1465
+severity: medium
ff1465
+
ff1465
+references:
ff1465
+    disa: CCI-001314
ff1465
+    srg: SRG-OS-000206-GPOS-00084
ff1465
+    stigid@ubuntu2004: UBTU-20-010420
ff1465
+
ff1465
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log/syslog", group="adm") }}}'
ff1465
+
ff1465
+ocil: |-
ff1465
+    {{{ ocil_file_group_owner(file="/var/log/syslog", group="adm") }}}
ff1465
+
ff1465
+template:
ff1465
+    name: file_groupowner
ff1465
+    vars:
ff1465
+        filepath: /var/log/syslog
ff1465
+        filegid: '4'
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
ff1465
new file mode 100644
5fd106
index 00000000000..655b2cd1aef
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
ff1465
@@ -0,0 +1,65 @@
ff1465
+documentation_complete: true
ff1465
+
ff1465
+prodtype: ubuntu2004
ff1465
+
ff1465
+title: 'Verify that system commands directories are group owned by root'
ff1465
+
ff1465
+description: |-
ff1465
+    System commands files are stored in the following directories by default:
ff1465
+    
/bin
ff1465
+    /sbin
ff1465
+    /usr/bin
ff1465
+    /usr/sbin
ff1465
+    /usr/local/bin
ff1465
+    /usr/local/sbin
ff1465
+    
ff1465
+    All these directories should be owned by the <tt>root</tt> group.
ff1465
+    If the directory is found to be owned by a group other than root correct
ff1465
+    its ownership with the following command:
ff1465
+    
$ sudo chgrp root DIR
ff1465
+
ff1465
+rationale: |-
ff1465
+    If the operating system allows any user to make changes to software
ff1465
+    libraries, then those changes might be implemented without undergoing the
ff1465
+    appropriate testing and approvals that are part of a robust change management
ff1465
+    process.
ff1465
+    This requirement applies to operating systems with software libraries
ff1465
+    that are accessible and configurable, as in the case of interpreted languages.
ff1465
+    Software libraries also include privileged programs which execute with
ff1465
+    escalated privileges. Only qualified and authorized individuals must be
ff1465
+    allowed to obtain access to information system components for purposes
ff1465
+    of initiating changes, including upgrades and modifications.
ff1465
+
ff1465
+severity: medium
ff1465
+
ff1465
+references:
ff1465
+    disa: CCI-001495
ff1465
+    srg: SRG-OS-000258-GPOS-00099
ff1465
+    stigid@ubuntu2004: UBTU-20-010425
ff1465
+
ff1465
+ocil_clause: 'any of these directories are not owned by root group'
ff1465
+ 
ff1465
+ocil: |-
ff1465
+    System commands are stored in the following directories:
ff1465
+    
/bin
ff1465
+    /sbin
ff1465
+    /usr/bin
ff1465
+    /usr/sbin
ff1465
+    /usr/local/bin
ff1465
+    /usr/local/sbin
ff1465
+    For each of these directories, run the following command to find files not
ff1465
+    owned by root group:
ff1465
+    
$ sudo find -L $DIR ! -group root -type d \;
ff1465
+
ff1465
+template:
ff1465
+    name: file_groupowner
ff1465
+    vars:
ff1465
+        filepath:
ff1465
+            - /bin/
ff1465
+            - /sbin/
ff1465
+            - /usr/bin/
ff1465
+            - /usr/sbin/
ff1465
+            - /usr/local/bin/
ff1465
+            - /usr/local/sbin/
ff1465
+        recursive: 'true'
ff1465
+        filegid: '0'
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
ff1465
deleted file mode 100644
5fd106
index 28df7839430..00000000000
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
ff1465
+++ /dev/null
ff1465
@@ -1,23 +0,0 @@
ff1465
-# platform = multi_platform_sle
ff1465
-# reboot = false
ff1465
-# strategy = restrict
ff1465
-# complexity = medium
ff1465
-# disruption = medium
ff1465
-- name: "Read list libraries without root ownership"
ff1465
-  find:
ff1465
-    paths:
ff1465
-      - "/usr/lib"
ff1465
-      - "/usr/lib64"
ff1465
-      - "/lib"
ff1465
-      - "/lib64"
ff1465
-    file_type: "directory"
ff1465
-  register: library_dirs_not_owned_by_root
ff1465
-
ff1465
-- name: "Set ownership of system library dirs to root"
ff1465
-  file:
ff1465
-    path: "{{ item.path }}"
ff1465
-    owner: "root"
ff1465
-    state: "directory"
ff1465
-    mode: "{{ item.mode }}"
ff1465
-  with_items: "{{ library_dirs_not_owned_by_root.files }}"
ff1465
-  when: library_dirs_not_owned_by_root.matched > 0
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
ff1465
new file mode 100644
5fd106
index 00000000000..f61a5f988dc
ff1465
--- /dev/null
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
ff1465
@@ -0,0 +1,77 @@
ff1465
+documentation_complete: true
ff1465
+
ff1465
+prodtype: ubuntu2004
ff1465
+
ff1465
+title: 'Verify that audit tools are owned by group root'
ff1465
+
ff1465
+description: |-
ff1465
+    The {{{ full_name }}} operating system audit tools must have the proper
ff1465
+    ownership configured to protected against unauthorized access.
ff1465
+
ff1465
+    Verify it by running the following command:
ff1465
+    
$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
ff1465
+
ff1465
+    /sbin/auditctl root
ff1465
+    /sbin/aureport root
ff1465
+    /sbin/ausearch root
ff1465
+    /sbin/autrace root
ff1465
+    /sbin/auditd root
ff1465
+    /sbin/audispd root
ff1465
+    /sbin/augenrules root
ff1465
+    
ff1465
+
ff1465
+    Audit tools needed to successfully view and manipulate audit information
ff1465
+    system activity and records. Audit tools include custom queries and report
ff1465
+    generators
ff1465
+
ff1465
+rationale: |-
ff1465
+    Protecting audit information also includes identifying and protecting the
ff1465
+    tools used to view and manipulate log data. Therefore, protecting audit
ff1465
+    tools is necessary to prevent unauthorized operation on audit information.
ff1465
+ 
ff1465
+    Operating systems providing tools to interface with audit information
ff1465
+    will leverage user permissions and roles identifying the user accessing the
ff1465
+    tools and the corresponding rights the user enjoys to make access decisions
ff1465
+    regarding the access to audit tools.
ff1465
+
ff1465
+severity: medium
ff1465
+
ff1465
+references:
ff1465
+    disa: CCI-001493,CCI-001494
ff1465
+    srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
ff1465
+    stigid@ubuntu2004: UBTU-20-010201
ff1465
+
ff1465
+ocil: |-
ff1465
+    Verify it by running the following command:
ff1465
+    
$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
ff1465
+
ff1465
+    /sbin/auditctl root
ff1465
+    /sbin/aureport root
ff1465
+    /sbin/ausearch root
ff1465
+    /sbin/autrace root
ff1465
+    /sbin/auditd root
ff1465
+    /sbin/audispd root
ff1465
+    /sbin/augenrules root
ff1465
+    
ff1465
+
ff1465
+    If the command does not return all the above lines, the missing ones
ff1465
+    need to be added.
ff1465
+
ff1465
+    Run the following command to correct the permissions of the missing
ff1465
+    entries:
ff1465
+    
$ sudo chown :root [audit_tool] 
ff1465
+
ff1465
+    Replace "[audit_tool]" with each audit tool not group-owned by root.
ff1465
+
ff1465
+template:
ff1465
+    name: file_groupowner
ff1465
+    vars:
ff1465
+        filepath:
ff1465
+            - /sbin/auditctl
ff1465
+            - /sbin/aureport
ff1465
+            - /sbin/ausearch
ff1465
+            - /sbin/autrace
ff1465
+            - /sbin/auditd
ff1465
+            - /sbin/audispd
ff1465
+            - /sbin/augenrules
ff1465
+        filegid: '0'
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
5fd106
index bb7c72550e9..a9e8c7d8e25 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
ff1465
@@ -1,4 +1,4 @@
5fd106
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
ff1465
+# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
ff1465
 
ff1465
 for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
ff1465
 do
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
5fd106
index 7cf507ca5f4..33a0c85d35b 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
ff1465
@@ -1,10 +1,12 @@
ff1465
 #!/bin/bash
ff1465
 
ff1465
+groupadd group_test
ff1465
+
ff1465
 for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
ff1465
 do
ff1465
    if [[ ! -f $TESTFILE ]]
ff1465
    then
ff1465
      touch $TESTFILE
ff1465
    fi
ff1465
-   chown nobody.nobody $TESTFILE
ff1465
+   chgrp group_test $TESTFILE
ff1465
 done
5fd106
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
5fd106
deleted file mode 100644
5fd106
index 08019fd48bb..00000000000
5fd106
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
5fd106
+++ /dev/null
5fd106
@@ -1,26 +0,0 @@
5fd106
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
5fd106
-# reboot = false
5fd106
-# strategy = restrict
5fd106
-# complexity = high
5fd106
-# disruption = medium
5fd106
-
5fd106
-- name: "Read list libraries without root ownership"
5fd106
-  find:
5fd106
-    paths:
5fd106
-      - "/usr/lib"
5fd106
-      - "/usr/lib64"
5fd106
-      - "/lib"
5fd106
-      - "/lib64"
5fd106
-    file_type: "file"
5fd106
-  register: library_files_not_group_owned_by_root
5fd106
-
5fd106
-- name: "Set group ownership of system library files to root"
5fd106
-  file:
5fd106
-    path: "{{ item.path }}"
5fd106
-    group: "root"
5fd106
-    state: "file"
5fd106
-    mode: "{{ item.mode }}"
5fd106
-  with_items: "{{ library_files_not_group_owned_by_root.files }}"
5fd106
-  when:
5fd106
-    - library_files_not_group_owned_by_root.matched > 0
5fd106
-    - item.gid != 0
5fd106
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
5fd106
deleted file mode 100644
5fd106
index 3a42beafb8a..00000000000
5fd106
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
5fd106
+++ /dev/null
5fd106
@@ -1,7 +0,0 @@
5fd106
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
5fd106
-
5fd106
-find /lib \
5fd106
-/lib64 \
5fd106
-/usr/lib \
5fd106
-/usr/lib64 \
5fd106
-\! -group root -type f -exec chgrp root '{}' \;
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
ff1465
deleted file mode 100644
5fd106
index f5ca9380b55..00000000000
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
ff1465
+++ /dev/null
ff1465
@@ -1,27 +0,0 @@
ff1465
-<def-group>
ff1465
-  <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
ff1465
-    {{{ oval_metadata("
ff1465
-        Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
ff1465
-        are owned by root.
ff1465
-      ") }}}
ff1465
-    <criteria >
ff1465
-      <criterion test_ref="test_root_permissions_for_syslibrary_files" />
ff1465
-    </criteria>
ff1465
-  </definition>
ff1465
-
ff1465
-  <unix:file_test  check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
ff1465
-    <unix:object object_ref="root_permissions_for_system_wide_library_files" />
ff1465
-  </unix:file_test>
ff1465
-
ff1465
-  <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
ff1465
-    
ff1465
-        are owned by root. -->
ff1465
-    <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
ff1465
-    <unix:filename operation="pattern match">^.*$</unix:filename>
ff1465
-    <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
ff1465
-  </unix:file_object>
ff1465
-
ff1465
-  <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
ff1465
-    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
ff1465
-  </unix:file_state>
ff1465
-</def-group>
ff1465
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
5fd106
index 17923f52ea6..eaf04c8d36c 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
ff1465
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
ff1465
@@ -1,6 +1,6 @@
ff1465
 documentation_complete: true
ff1465
 
5fd106
-prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15
ff1465
+prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15,ubuntu2004
ff1465
 
ff1465
 title: |-
ff1465
     Verify the system-wide library files in directories
5fd106
@@ -46,6 +46,7 @@ references:
ff1465
     stigid@rhel8: RHEL-08-010350
ff1465
     stigid@sle12: SLES-12-010875
ff1465
     stigid@sle15: SLES-15-010355
ff1465
+    stigid@ubuntu2004: UBTU-20-01430
ff1465
 
ff1465
 ocil_clause: 'system wide library files are not group owned by root'
ff1465
 
5fd106
@@ -59,3 +60,14 @@ ocil: |-
ff1465
     To find if system-wide library files stored in these directories are not group-owned by
ff1465
     root run the following command for each directory DIR:
ff1465
     
$ sudo find -L DIR ! -group root -type f 
ff1465
+
ff1465
+template:
ff1465
+    name: file_groupowner
ff1465
+    vars:
ff1465
+        filepath:
ff1465
+            - /lib/
ff1465
+            - /lib64/
ff1465
+            - /usr/lib/
ff1465
+            - /usr/lib64/
ff1465
+        file_regex: ^.*$
ff1465
+        filegid: '0'
5fd106
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
5fd106
similarity index 86%
5fd106
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
5fd106
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
5fd106
index a4ae2854db1..0e982c3b8ca 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
5fd106
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
ff1465
@@ -1,4 +1,4 @@
ff1465
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
ff1465
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
ff1465
 
ff1465
 for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
ff1465
 do
5fd106
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
5fd106
similarity index 70%
5fd106
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
5fd106
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
5fd106
index c96f65b989c..23a7703f57d 100644
ff1465
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
5fd106
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
ff1465
@@ -1,10 +1,11 @@
ff1465
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
ff1465
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
ff1465
 
ff1465
+groupadd group_test
ff1465
 for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
ff1465
 do
ff1465
    if [[ ! -f $TESTFILE ]]
ff1465
    then
ff1465
      touch $TESTFILE
ff1465
    fi
ff1465
-   chown nobody.nobody $TESTFILE
ff1465
+   chgrp group_test $TESTFILE
ff1465
 done
5fd106
diff --git a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
5fd106
index 938e6b30819..015ff98c99d 100644
5fd106
--- a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
5fd106
+++ b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
5fd106
@@ -1,8 +1,20 @@
5fd106
 #!/bin/bash
5fd106
 #
5fd106
 
5fd106
-{{% if MISSING_FILE_PASS %}}
5fd106
-    rm -f {{{ FILEPATH }}}
5fd106
-{{% else %}}
5fd106
-    true
5fd106
-{{% endif %}}
5fd106
+{{% for path in FILEPATH %}}
5fd106
+    {{% if MISSING_FILE_PASS %}}
5fd106
+        rm -f {{{ path }}}
5fd106
+    {{% else %}}
5fd106
+        {{% if IS_DIRECTORY and FILE_REGEX %}}
5fd106
+        echo "Create specific tests for this rule because of regex"
5fd106
+        {{% elif IS_DIRECTORY and RECURSIVE %}}
5fd106
+        find -L {{{ path }}} -type d -exec chgrp {{{ FILEGID }}} {} \;
5fd106
+        {{% else %}}
5fd106
+        if [ ! -f {{{ path }}} ]; then
5fd106
+            mkdir -p "$(dirname '{{{ path }}}')"
5fd106
+            touch {{{ path }}}
5fd106
+        fi
5fd106
+        chgrp {{{ FILEGID }}} {{{ path }}}
5fd106
+        {{% endif %}}
5fd106
+    {{% endif %}}
5fd106
+{{% endfor %}}