From b09bf3ad8acd82003f068f0d8f60a44f04092656 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Tue, 7 Feb 2023 10:53:17 +0100

Subject: [PATCH 3/5] Extends rsyslog_logfiles_attributes_modify template for

 permissions

Patch-name: scap-security-guide-0.1.67-rsyslog_files_permissions_template-PR_10139.patch

Patch-status: Extends rsyslog_logfiles_attributes_modify template for permissions

---

 .../ansible/shared.yml                        |  59 --------

 .../rsyslog_files_permissions/bash/shared.sh  |  92 ------------

 .../rsyslog_files_permissions/oval/shared.xml | 131 -----------------

 .../rsyslog_files_permissions/rule.yml        |  30 +++-

 .../IncludeConfig_glob_perms_0600.pass.sh     |  40 -----

 .../IncludeConfig_glob_perms_0601.fail.sh     |  41 ------

 .../tests/IncludeConfig_perms_0600.pass.sh    |  39 -----

 .../tests/IncludeConfig_perms_0601.fail.sh    |  40 -----

 .../include_config_syntax_perms_0600.pass.sh  |  85 -----------

 .../include_config_syntax_perms_0601.fail.sh  |  86 -----------

 .../include_multiline_perms_0600.pass.sh      |  41 ------

 .../tests/include_perms_0600.pass.sh          |  39 -----

 ...erms_0600_IncludeConfig_perms_0600.pass.sh |  52 -------

 ...erms_0600_IncludeConfig_perms_0601.fail.sh |  53 -------

 ...00_IncludeConfig_perms_0601_hidden.pass.sh |  53 -------

 ...0_IncludeConfig_perms_0601_missing.pass.sh |  45 ------

 .../include_perms_0600_cloudinit.pass.sh      |  23 ---

 .../tests/include_perms_0601.fail.sh          |  41 ------

 .../include_perms_0601_cloudinit.fail.sh      |  22 ---

 .../mixed_correct_attr_group_read.pass.sh     |  25 ++++

 .../tests/mixed_correct_attr_stricter.pass.sh |  25 ++++

 .../tests/perms_0600.pass.sh                  |  35 -----

 .../tests/perms_0601.fail.sh                  |  34 -----

 .../ansible.template                          |   7 +-

 .../bash.template                             |  33 ++---

 .../oval.template                             | 138 +++++++++---------

 .../template.py                               |  18 +++

 .../tests/IncludeConfig_is_other.fail.sh      |  50 -------

 .../tests/include_is_other.fail.sh            |  50 -------

 ...udeConfig_is_other_RainerLogClause.fail.sh |  75 ----------

 .../tests/include_is_root.pass.sh             |  46 ------

 ...ude_is_root_IncludeConfig_is_other.fail.sh |  63 --------

 ...lude_is_root_IncludeConfig_is_root.pass.sh |  58 --------

 ...ludeConfig_is_root_RainerLogClause.pass.sh |  59 --------

 .../tests/include_multiline_is_root.pass.sh   |  47 ------

 .../tests/is_root.pass.sh                     |  30 ----

 ...er.fail.sh => legacy_correct_attr.pass.sh} |  26 ++--

 ...sh => legacy_include_correct_attr.pass.sh} |  32 ++--

 .../legacy_include_incorrect_attr.fail.sh     |  50 +++++++

 .../tests/legacy_incorrect_attr.fail.sh       |  33 +++++

 .../tests/mixed_correct_attr.pass.sh          |  33 +++++

 .../tests/mixed_include_correct_attr.pass.sh  |  58 ++++++++

 ...ixed_include_incorrect_attr_legacy.fail.sh |  63 ++++++++

 ...ixed_include_incorrect_attr_rainer.fail.sh |  63 ++++++++

 .../mixed_incorrect_attr_cloudinit.fail.sh    |  38 +++++

 .../tests/mixed_incorrect_attr_legacy.fail.sh |  38 +++++

 .../tests/mixed_incorrect_attr_rainer.fail.sh |  38 +++++

 .../tests/rainer_correct_attr.pass.sh         |  31 ++++

 .../tests/rainer_include_correct_attr.pass.sh |  45 ++++++

 .../rainer_include_incorrect_attr.fail.sh     |  50 +++++++

 ...ner_include_multiline_correct_attr.pass.sh |  47 ++++++

 ...r_include_multiline_incorrect_attr.fail.sh |  52 +++++++

 .../tests/rainer_incorrect_attr.fail.sh       |  33 +++++

 53 files changed, 875 insertions(+), 1660 deletions(-)

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh

 create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh

 create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh

 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/template.py

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh

 delete mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh

 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh

 rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{is_other.fail.sh => legacy_correct_attr.pass.sh} (53%)

 rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{IncludeConfig_is_root.pass.sh => legacy_include_correct_attr.pass.sh} (51%)

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh

 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml

deleted file mode 100644

index ae8bbe3302..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml

+++ /dev/null

@@ -1,59 +0,0 @@

-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle

-# reboot = false

-# strategy = configure

-# complexity = low

-# disruption = medium

-

-- name: "Set rsyslog logfile configuration facts"

-  set_fact:

-    rsyslog_etc_config: "/etc/rsyslog.conf"

-{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}

-    desired_perm_mode: "640"

-{{% else %}}

-    desired_perm_mode: "600"

-{{% endif %}}

-

-# * And also the log file paths listed after rsyslog's $IncludeConfig directive

-#   (store the result into array for the case there's shell glob used as value of IncludeConfig)

-- name: "Get IncludeConfig directive"

-  shell: |

-    set -o pipefail

-    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true

-  register: rsyslog_old_inc

-  changed_when: False

-

-- name: "Get include files directives"

-  shell: |

-    set -o pipefail

-    grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut  -d"\"" -f 2 || true

-  register: rsyslog_new_inc

-  changed_when: False

-

-- name: "Expand glob expressions"

-  shell: |

-    set -o pipefail

-    eval printf '%s\\n' {{ item }}

-  register: include_config_output

-  loop: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}"

-

-- name: "List all config files"

-  shell: find {{ item }} -not -path "*/.*" -type f

-  loop: "{{ include_config_output.results|map(attribute='stdout_lines')|list|flatten }}"

-  register: rsyslog_config_files

-  failed_when: False

-  changed_when: False

-

-- name: "Extract log files"

-  shell: |

-    set -o pipefail

-    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }}  |awk '{print $NF}'|sed -e 's/^-//' || true

-  loop: "{{ rsyslog_config_files.results|map(attribute='stdout_lines')|list|flatten|unique + [ rsyslog_etc_config ] }}"

-  register: log_files

-  changed_when: False

-

-- name: "Setup log files permissions"

-  ignore_errors: yes

-  file:

-    path: "{{ item }}"

-    mode: "{{ desired_perm_mode }}"

-  loop: "{{ log_files.results|map(attribute='stdout_lines')|list|flatten|unique }}"

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh

deleted file mode 100644

index e4e2ade29e..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh

+++ /dev/null

@@ -1,92 +0,0 @@

-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle

-

-# List of log file paths to be inspected for correct permissions

-# * Primarily inspect log file paths listed in /etc/rsyslog.conf

-RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"

-# * And also the log file paths listed after rsyslog's $IncludeConfig directive

-#   (store the result into array for the case there's shell glob used as value of IncludeConfig)

-readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)

-readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

-readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)

-readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

-

-# Declare an array to hold the final list of different log file paths

-declare -a LOG_FILE_PATHS

-

-# Array to hold all rsyslog config entries

-RSYSLOG_CONFIGS=()

-RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

-

-# Get full list of files to be checked

-# RSYSLOG_CONFIGS may contain globs such as

-# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule

-# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.

-RSYSLOG_CONFIG_FILES=()

-for ENTRY in "${RSYSLOG_CONFIGS[@]}"

-do

-	# If directory, rsyslog will search for config files in recursively.

-	# However, files in hidden sub-directories or hidden files will be ignored.

-	if [ -d "${ENTRY}" ]

-	then

-		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)

-		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")

-	elif [ -f "${ENTRY}" ]

-	then

-		RSYSLOG_CONFIG_FILES+=("${ENTRY}")

-	else

-		echo "Invalid include object: ${ENTRY}"

-	fi

-done

-

-# Browse each file selected above as containing paths of log files

-# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)

-for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"

-do

-	# From each of these files extract just particular log file path(s), thus:

-	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,

-	# * Ignore empty lines,

-	# * Strip quotes and closing brackets from paths.

-	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files

-	# * From the remaining valid rows select only fields constituting a log file path

-	# Text file column is understood to represent a log file path if and only if all of the following are met:

-	# * it contains at least one slash '/' character,

-	# * it is preceded by space

-	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters

-	# Search log file for path(s) only in case it exists!

-	if [[ -f "${LOG_FILE}" ]]

-	then

-		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")

-		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")

-		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")

-		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")

-		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")

-		# Since above sed command might return more than one item (delimited by newline), split the particular

-		# matches entries into new array specific for this log file

-		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"

-		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with

-		# items from newly created array for this log file

-		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")

-		# Delete the temporary array

-		unset ARRAY_FOR_LOG_FILE

-	fi

-done

-{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}

-DESIRED_PERM_MOD=640

-{{% else %}}

-DESIRED_PERM_MOD=600

-{{% endif %}}

-# Correct the form o

-for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"

-do

-	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing

-	if [ -z "$LOG_FILE_PATH" ]

-	then

-		continue

-	fi

-

-	# Also for each log file check if its permissions differ from 600. If so, correct them

-	if [ -f "$LOG_FILE_PATH" ] && [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne $DESIRED_PERM_MOD ]

-	then

-		/bin/chmod $DESIRED_PERM_MOD "$LOG_FILE_PATH"

-	fi

-done

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml

deleted file mode 100644

index 559d5fb101..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml

+++ /dev/null

@@ -1,131 +0,0 @@

-<def-group oval_version="5.11">

-  <definition class="compliance" id="rsyslog_files_permissions" version="1">

-    {{{ oval_metadata("File permissions for all syslog log files should be set correctly.") }}}

-

-    <criteria operator="AND">

-      {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804"] %}}

-      <extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="package_rsyslog_installed" />

-      {{% endif %}}

-      <criterion comment="Check permissions of all system log files" test_ref="test_rsyslog_files_permissions" />

-    </criteria>

-

-  </definition>

-

-  

-       To workaround empty include objects case, when FunctionGroup operations return "does not exist" result, added empty string match -->

-  <ind:textfilecontent54_object id="object_rfp_rsyslog_include_config_value" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">

-    <ind:filepath>/etc/rsyslog.conf</ind:filepath>

-    <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-    <filter action="exclude">state_permissions_ignore_hidden_paths</filter>

-  </ind:textfilecontent54_object>

-

-  <ind:textfilecontent54_state id="state_permissions_ignore_hidden_paths" comment="ignore hidden conf files" version="1">

-    

-         include() or $IncludeConfig that point to hidden dirs or files.

-         Rsyslog ignores these conf files, so we should ignore them too.

-    -->

-    <ind:subexpression operation="pattern match">^.*\/\..*$</ind:subexpression>

-  </ind:textfilecontent54_state>

-

-  

-  <local_variable id="var_rfp_include_config_regex" datatype="string" version="1" comment="$IncludeConfig value converted to regex">

-    <unique>

-      <glob_to_regex>

-        <object_component item_field="subexpression" object_ref="object_rfp_rsyslog_include_config_value" />

-      </glob_to_regex>

-    </unique>

-  </local_variable>

-

-  

-       If the variable has no values, there won't be any objects -->

-  <ind:variable_object id="object_var_rfp_include_config_regex" comment="Make variable object from regex variable" version="1">

-    <ind:var_ref>var_rfp_include_config_regex</ind:var_ref>

-  </ind:variable_object>

-

-  <local_variable id="var_rfp_syslog_config" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <literal_component datatype="string">^/etc/rsyslog.conf$</literal_component>

-  </local_variable>

-

-  <ind:variable_object id="object_var_rfp_syslog_config" comment="Make variable object for use" version="1">

-    <ind:var_ref>var_rfp_syslog_config</ind:var_ref>

-  </ind:variable_object>

-

-  

-       We do it this way to avoid referencing an empty variable in a state comparison, which

-       will cause a test to evaluate to fail. Combining an empty set of objects is fine though -->

-  <ind:variable_object id="object_var_rfp_all_log_files" comment="Filter out empty string" version="1">

-    <set>

-      <object_reference>object_var_rfp_include_config_regex</object_reference>

-      <object_reference>object_var_rfp_syslog_config</object_reference>

-    </set>

-  </ind:variable_object>

-

-  

-       a list of objects won't do. So we make a local_variable from the variable_objects. -->

-  <local_variable id="var_rfp_all_log_files" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <object_component object_ref="object_var_rfp_all_log_files" item_field="value"/>

-  </local_variable>

-

-  

-       that rsyslog's configuration file to select file paths for log files directives

-  -->

-  <ind:textfilecontent54_object id="object_rfp_log_files_paths" comment="All rsyslog configuration files" version="1">

-    <ind:filepath operation="pattern match" var_ref="var_rfp_all_log_files" var_check="at least one" />

-    

-         to constitute a log file path if all of the following conditions are met:

-         * the string represents a regular file on particular file system

-           (verified via corresponding file_state below),

-         * the chunk of text is in the last column in the row,

-           (possibly suffixed by ';' character and rsyslog Template name),

-         * contains at least one slash '/' character, and simultaneously

-           doesn't contain any of ';', ':' and space characters,

-         * the chunk was retrieved from a row not starting with space, '#',

-           or '$' characters

-    -->

-    <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-    <filter action="exclude">state_permissions_ignore_include_paths</filter>

-  </ind:textfilecontent54_object>

-

-  <ind:textfilecontent54_state id="state_permissions_ignore_include_paths" comment="ignore" version="1">

-    

-         include() or $IncludeConfig statements.

-         These paths are conf files, not log files. Their permissions don't need to be as

-         required for log files, thus, lets exclude them from the list of objects found

-    -->

-    <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>

-  </ind:textfilecontent54_state>

-

-  

-       retrieved from the different rsyslog configuration files

-  -->

-  <local_variable id="var_rfp_log_files_paths" datatype="string" version="1" comment="File paths of all rsyslog configuration files">

-    <object_component item_field="subexpression" object_ref="object_rfp_log_files_paths" />

-  </local_variable>

-

-  

-  <unix:file_test check="all" check_existence="all_exist" id="test_rsyslog_files_permissions" version="1" comment="Permissions of system log files are correct">

-    <unix:object object_ref="object_rsyslog_files_permissions" />

-    <unix:state state_ref="state_rsyslog_files_permissions" />

-  </unix:file_test>

-

-  <unix:file_object id="object_rsyslog_files_permissions" comment="Various system log files" version="1">

-    <unix:filepath datatype="string" var_ref="var_rfp_log_files_paths" var_check="at least one" />

-  </unix:file_object>

-

-  <unix:file_state id="state_rsyslog_files_permissions" version="1">

-    <unix:type operation="equals">regular</unix:type>

-    <unix:uexec datatype="boolean">false</unix:uexec>

-    {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}

-    <unix:gread datatype="boolean">true</unix:gread>

-    {{% else %}}

-    <unix:gread datatype="boolean">false</unix:gread>

-    {{% endif %}}

-    <unix:gwrite datatype="boolean">false</unix:gwrite>

-    <unix:gexec datatype="boolean">false</unix:gexec>

-    <unix:oread datatype="boolean">false</unix:oread>

-    <unix:owrite datatype="boolean">false</unix:owrite>

-    <unix:oexec datatype="boolean">false</unix:oexec>

-  </unix:file_state>

-</def-group>

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

index 508ff73cde..042c35362d 100644

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

@@ -1,18 +1,24 @@

+{{%- if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}

+    {{%- set rsyslog_perm='640' %}}

+{{%- else %}}

+    {{%- set rsyslog_perm='600' %}}

+{{%- endif %}}

+

 documentation_complete: true

 title: 'Ensure System Log Files Have Correct Permissions'

 description: |-

     The file permissions for all log files written by <tt>rsyslog</tt> should

-    be set to 600, or more restrictive. These log files are determined by the

+    be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the

     second part of each Rule line in <tt>/etc/rsyslog.conf</tt> and typically

     all appear in <tt>/var/log</tt>. For each log file LOGFILE

     referenced in <tt>/etc/rsyslog.conf</tt>, run the following command to

     inspect the file's permissions:

     
$ ls -l LOGFILE

-    If the permissions are not 600 or more restrictive, run the following

+    If the permissions are not {{{ rsyslog_perm }}} or more restrictive, run the following

     command to correct this:

-    
$ sudo chmod 0600 LOGFILE
"

+    
$ sudo chmod {{{ rsyslog_perm }}} LOGFILE
"

 rationale: |-

     Log files can contain valuable information regarding system

@@ -46,9 +52,23 @@ ocil_clause: 'the permissions are not correct'

 ocil: |-

     The file permissions for all log files written by <tt>rsyslog</tt> should

-    be set to 600, or more restrictive. These log files are determined by the

+    be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the

     second part of each Rule line in <tt>/etc/rsyslog.conf</tt> and typically

     all appear in <tt>/var/log</tt>. To see the permissions of a given log

     file, run the following command:

     
$ ls -l LOGFILE

-    The permissions should be 600, or more restrictive.

+    The permissions should be {{{ rsyslog_perm }}}, or more restrictive.

+

+template:

+  name: rsyslog_logfiles_attributes_modify

+  vars:

+    attribute: permissions

+    value: '0600'

+    value@debian10: '0640'

+    value@debian11: '0640'

+    value@sle12: '0640'

+    value@sle15: '0640'

+    value@ubuntu1604: '0640'

+    value@ubuntu1804: '0640'

+    value@ubuntu2004: '0640'

+    value@ubuntu2204: '0640'

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh

deleted file mode 100755

index c27e7874d9..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh

+++ /dev/null

@@ -1,40 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check rsyslog.conf with log file permissions 0600 from rules and

-# log file permissions 0600 from $IncludeConfig passes.

-# test $IncludeConfig with wildcard (*.conf)

-

-source $SHARED/rsyslog_log_utils.sh

-

-PERMS=0600

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files and permissions

-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh

deleted file mode 100755

index 124b5e863e..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh

+++ /dev/null

@@ -1,41 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol

-

-# Check rsyslog.conf with log file permissions 0600 from rules and

-# log file permissions 0601 from $IncludeConfig fails.

-# test $IncludeConfig with wildcard (*.conf)

-

-source $SHARED/rsyslog_log_utils.sh

-

-PERMS_PASS=0600

-PERMS_FAIL=0601

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files and permissions

-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}

-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*      ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh

deleted file mode 100755

index a6ff6a1109..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh

+++ /dev/null

@@ -1,39 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check rsyslog.conf with log file permissions 0600 from rules and

-# log file permissions 0600 from $IncludeConfig passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-PERMS=0600

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files and permissions

-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${test_conf}

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh

deleted file mode 100755

index 2ae5c89a4e..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh

+++ /dev/null

@@ -1,40 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol

-

-# Check rsyslog.conf with log file permissions 0600 from rules and

-# log file permissions 0601 from $IncludeConfig fails.

-

-source $SHARED/rsyslog_log_utils.sh

-

-PERMS_PASS=0600

-PERMS_FAIL=0601

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files and permissions

-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}

-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*      ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${test_conf}

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh

deleted file mode 100755

index a5a2f67fad..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh

+++ /dev/null

@@ -1,85 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check rsyslog.conf with log file permissions 0600 from rules and

-# log file permissions 0600 from $IncludeConfig passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-PERMS=0600

-

-# setup test data

-create_rsyslog_test_logs 5

-

-# setup test log files and permissions

-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[2]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[3]}

-chmod $PERMS ${RSYSLOG_TEST_LOGS[4]}

-

-# create test configuration files

-conf_subdir=${RSYSLOG_TEST_DIR}/subdir

-conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir

-mkdir ${conf_subdir}

-mkdir ${conf_hiddir}

-

-test_conf_in_subdir=${conf_subdir}/in_subdir.conf

-test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak

-

-test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf

-test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf

-

-cat << EOF > ${test_conf_in_subdir}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-cat << EOF > ${test_conf_name_bak}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[2]}

-EOF

-

-cat << EOF > ${test_conf_in_hiddir}

-# rsyslog configuration file

-# not used

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[3]}

-EOF

-

-cat << EOF > ${test_conf_dot_name}