From 7d188e88ef47a50714b127658b4138540af8396c Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Tue, 7 Feb 2023 10:53:17 +0100

Subject: [PATCH 2/5] Rsyslog files rules remediations

Patch-name: scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch

Patch-status: Rsyslog files rules remediations

---

 controls/cis_sle12.yml                        |   4 +-

 controls/cis_sle15.yml                        |   4 +-

 .../file_groupowner_logfiles_value.var        |  18 ---

 .../oval/shared.xml                           | 116 ---------------

 .../rsyslog_files_groupownership/rule.yml     |  39 ++++-

 .../tests/IncludeConfig_is_other.fail.sh      |  42 ------

 .../tests/IncludeConfig_is_root.pass.sh       |  39 -----

 .../tests/include_is_other.fail.sh            |  42 ------

 .../tests/include_is_root.pass.sh             |  39 -----

 .../tests/include_multiline_is_root.pass.sh   |  41 ------

 .../tests/is_other.fail.sh                    |  25 ----

 .../tests/is_root.pass.sh                     |  24 ---

 .../rsyslog_files_ownership/oval/shared.xml   | 114 ---------------

 .../rsyslog_files_ownership/rule.yml          |  44 +++++-

 .../ansible/shared.yml                        |  12 ++

 .../rsyslog_logging_configured/bash/shared.sh |   7 +

 .../oval/shared.xml                           |  41 ++++++

 .../rsyslog_logging_configured/rule.yml       |  34 +++++

 ...with_everything_logged_to_messages.pass.sh |  13 ++

 .../rsyslog_file_with_no_logging.fail.sh      |  12 ++

 .../profiles/anssi_np_nt28_average.profile    |   2 -

 products/debian10/profiles/standard.profile   |   2 -

 .../profiles/anssi_np_nt28_average.profile    |   2 -

 products/debian11/profiles/standard.profile   |   2 -

 products/rhel7/profiles/rht-ccp.profile       |   2 -

 products/rhel8/profiles/rht-ccp.profile       |   2 -

 .../profiles/anssi_bp28_intermediary.profile  |   1 +

 products/sle15/profiles/standard.profile      |   2 -

 .../profiles/anssi_np_nt28_average.profile    |   2 -

 products/ubuntu1604/profiles/standard.profile |   2 -

 .../profiles/anssi_np_nt28_average.profile    |   2 -

 products/ubuntu1804/profiles/standard.profile |   2 -

 products/ubuntu2004/profiles/standard.profile |   2 -

 products/ubuntu2204/profiles/standard.profile |   2 -

 shared/references/cce-sle12-avail.txt         |   1 -

 shared/references/cce-sle15-avail.txt         |   1 -

 .../ansible.template                          |  68 +++++++++

 .../bash.template                             | 110 ++++++++++++++

 .../oval.template                             | 137 ++++++++++++++++++

 .../template.yml                              |   4 +

 .../tests/IncludeConfig_is_other.fail.sh      |  14 +-

 .../tests/IncludeConfig_is_root.pass.sh       |  10 +-

 .../tests/include_is_other.fail.sh            |  14 +-

 ...udeConfig_is_other_RainerLogClause.fail.sh |  37 ++++-

 .../tests/include_is_root.pass.sh             |  11 +-

 ...ude_is_root_IncludeConfig_is_other.fail.sh |  16 +-

 ...lude_is_root_IncludeConfig_is_root.pass.sh |  12 +-

 ...ludeConfig_is_root_RainerLogClause.pass.sh |  22 +--

 .../tests/include_multiline_is_root.pass.sh   |  10 +-

 .../tests/is_other.fail.sh                    |  12 +-

 .../tests/is_root.pass.sh                     |   8 +-

 51 files changed, 648 insertions(+), 576 deletions(-)

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh

 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh

 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_everything_logged_to_messages.pass.sh

 create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_no_logging.fail.sh

 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/ansible.template

 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/bash.template

 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/oval.template

 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/template.yml

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/IncludeConfig_is_other.fail.sh (75%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/IncludeConfig_is_root.pass.sh (81%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_other.fail.sh (75%)

 rename linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_root.pass.sh => shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh (50%)

 mode change 100755 => 100644

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root.pass.sh (81%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root_IncludeConfig_is_other.fail.sh (77%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root_IncludeConfig_is_root.pass.sh (82%)

 rename linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_other.fail.sh => shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh (65%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_multiline_is_root.pass.sh (81%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/is_other.fail.sh (70%)

 rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/is_root.pass.sh (77%)

diff --git a/controls/cis_sle12.yml b/controls/cis_sle12.yml

index 5c464fe556..8576343b9d 100644

--- a/controls/cis_sle12.yml

+++ b/controls/cis_sle12.yml

@@ -1321,7 +1321,9 @@ controls:

     levels:

     - l1_server

     - l1_workstation

-    status: manual 

+    automated: yes

+    rules:

+      - rsyslog_logging_configured

   - id: 4.2.1.5

     title: Ensure rsyslog is configured to send logs to a remote log host (Automated)

diff --git a/controls/cis_sle15.yml b/controls/cis_sle15.yml

index 36d7616f90..f82341a038 100644

--- a/controls/cis_sle15.yml

+++ b/controls/cis_sle15.yml

@@ -1469,7 +1469,9 @@ controls:

     levels:

       - l1_server

       - l1_workstation

-    status: manual 

+    automated: yes

+    rules:

+      - rsyslog_logging_configured

   - id: 4.2.1.5

     title: Ensure rsyslog is configured to send logs to a remote log host (Automated)

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var

deleted file mode 100644

index 7ebf8c191a..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var

+++ /dev/null

@@ -1,18 +0,0 @@

-documentation_complete: true

-

-title: 'group who owns log files'

-

-description: |-

-    Specify group owner of all logfiles specified in

-    <tt>/etc/rsyslog.conf.</tt>

-

-type: string

-

-operator: equals

-

-interactive: false

-

-options:

-    default: root

-    adm: adm

-    root: root

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml

deleted file mode 100644

index 4567f4d411..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml

+++ /dev/null

@@ -1,116 +0,0 @@

-<def-group oval_version="5.11">

-  <definition class="compliance" id="rsyslog_files_groupownership" version="1">

-    {{{ oval_metadata("All syslog log files should be owned by the appropriate group.") }}}

-

-    <criteria operator="AND">

-      {{% if product in ["debian10", "debian11", "ubuntu1604"] %}}

-      <extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="package_rsyslog_installed" />

-      {{% endif %}}

-      <criterion comment="Check if all system log files are owned by the appropriate group" test_ref="test_rsyslog_files_groupownership" />

-    </criteria>

-

-  </definition>

-

-  

-  <ind:textfilecontent54_object id="object_rfg_rsyslog_include_config_value" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">

-    <ind:filepath>/etc/rsyslog.conf</ind:filepath>

-    <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-  </ind:textfilecontent54_object>

-

-  

-  <local_variable id="var_rfg_include_config_regex" datatype="string" version="1" comment="$IncludeConfig value converted to regex">

-    <unique>

-      <glob_to_regex>

-        <object_component item_field="subexpression" object_ref="object_rfg_rsyslog_include_config_value" />

-      </glob_to_regex>

-    </unique>

-  </local_variable>

-

-  

-       If the variable has no values, there won't be any objects -->

-  <ind:variable_object id="object_var_rfg_include_config_regex" comment="Make variable object from regex variable" version="1">

-    <ind:var_ref>var_rfg_include_config_regex</ind:var_ref>

-  </ind:variable_object>

-

-  <local_variable id="var_rfg_syslog_config" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <literal_component datatype="string">^/etc/rsyslog.conf$</literal_component>

-  </local_variable>

-

-  <ind:variable_object id="object_var_rfg_syslog_config" comment="Make variable object for use" version="1">

-    <ind:var_ref>var_rfg_syslog_config</ind:var_ref>

-  </ind:variable_object>

-

-  

-       We do it this way to avoid referencing an empty variable in a state comparison, which

-       will cause a test to evaluate to fail. Combining an empty set of objects is fine though -->

-  <ind:variable_object id="object_var_rfg_all_log_files" comment="Filter out empty string" version="1">

-    <set>

-      <object_reference>object_var_rfg_include_config_regex</object_reference>

-      <object_reference>object_var_rfg_syslog_config</object_reference>

-    </set>

-  </ind:variable_object>

-

-  

-       a list of objects won't do. So we make a local_variable from the variable_objects. -->

-  <local_variable id="var_rfg_all_log_files" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <object_component object_ref="object_var_rfg_all_log_files" item_field="value"/>

-  </local_variable>

-

-  

-       that rsyslog's configuration file to select file paths for log files directives

-  -->

-  <ind:textfilecontent54_object id="object_rfg_log_files_paths" comment="All rsyslog configuration files" version="1">

-    <ind:filepath operation="pattern match" var_ref="var_rfg_all_log_files" var_check="at least one" />

-    

-         to constitute a log file path if all of the following conditions are met:

-         * the string represents a regular file on particular file system

-           (verified via corresponding file_state below),

-         * the chunk of text is in the last column in the row,

-           (possibly suffixed by ';' character and rsyslog Template name),

-         * contains at least one slash '/' character, and simultaneously

-           doesn't contain any of ';', ':' and space characters,

-         * the chunk was retrieved from a row not starting with space, '#',

-           or '$' characters

-    -->

-    <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-    <filter action="exclude">state_groupownership_ignore_include_paths</filter>

-  </ind:textfilecontent54_object>

-

-  <ind:textfilecontent54_state id="state_groupownership_ignore_include_paths" comment="ignore" version="1">

-    

-         include() or $IncludeConfig statements.

-         These paths are conf files, not log files. Their groupownership don't need to be as

-         required for log files, thus, lets exclude them from the list of objects found

-    -->

-	  <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>

-  </ind:textfilecontent54_state>

-

-  

-       retrieved from the different rsyslog configuration files

-  -->

-  <local_variable id="var_rfg_log_files_paths" datatype="string" version="1" comment="File paths of all rsyslog configuration files">

-    <object_component item_field="subexpression" object_ref="object_rfg_log_files_paths" />

-  </local_variable>

-

-  

-  <unix:file_test check="all" check_existence="all_exist" id="test_rsyslog_files_groupownership" version="1" comment="System log files are owned by the appropriate group">

-    <unix:object object_ref="object_rsyslog_files_groupownership" />

-    <unix:state state_ref="state_rsyslog_files_groupownership" />

-  </unix:file_test>

-

-  <unix:file_object id="object_rsyslog_files_groupownership" comment="Various system log files" version="1">

-    <unix:filepath datatype="string" var_ref="var_rfg_log_files_paths" var_check="at least one" />

-  </unix:file_object>

-

-  <unix:file_state id="state_rsyslog_files_groupownership" version="1">

-    <unix:type operation="equals">regular</unix:type>

-    {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu2004", "ubuntu2204"] %}}

-    <unix:group_id datatype="int">4</unix:group_id>

-    {{% else %}}

-    <unix:group_id datatype="int">0</unix:group_id>

-    {{% endif %}}

-  </unix:file_state>

-

-</def-group>

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml

index 4f797f4a21..13c89d90c5 100644

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml

+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml

@@ -4,15 +4,30 @@ title: 'Ensure Log Files Are Owned By Appropriate Group'

 description: |-

     The group-owner of all log files written by

-    <tt>rsyslog</tt> should be <tt>{{{ xccdf_value("file_groupowner_logfiles_value") }}}</tt>.

+    <tt>rsyslog</tt> should be

+{{% if 'debian' in product or 'ubuntu' in product %}}

+    <tt>adm</tt>.

+{{% else %}}

+    <tt>root</tt>.

+{{% endif %}}

     These log files are determined by the second part of each Rule line in

     <tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>.

     For each log file LOGFILE referenced in <tt>/etc/rsyslog.conf</tt>,

     run the following command to inspect the file's group owner:

     
$ ls -l LOGFILE

-    If the owner is not <tt>{{{ xccdf_value("file_groupowner_logfiles_value") }}}</tt>, run the following command to

+    If the owner is not

+    {{% if 'debian' in product or 'ubuntu' in product %}}

+    <tt>adm</tt>,

+    {{% else %}}

+    <tt>root</tt>,

+    {{% endif %}}

+    run the following command to

     correct this:

-    
$ sudo chgrp {{{ xccdf_value("file_groupowner_logfiles_value") }}} LOGFILE

+{{% if 'debian' in product or 'ubuntu' in product %}}

+    
$ sudo chgrp adm LOGFILE

+{{% else %}}

+    
$ sudo chgrp root LOGFILE

+{{% endif %}}

 rationale: |-

     The log files generated by rsyslog contain valuable information regarding system

@@ -47,8 +62,24 @@ references:

 ocil_clause: 'the group-owner is not correct'

 ocil: |-

-    The group-owner of all log files written by <tt>rsyslog</tt> should be <tt>{{{ xccdf_value("file_groupowner_logfiles_value") }}}</tt>.

+    The group-owner of all log files written by <tt>rsyslog</tt> should be

+    {{% if 'debian' in product or 'ubuntu' in product %}}

+    <tt>adm</tt>.

+    {{% else %}}

+    <tt>root</tt>.

+    {{% endif %}}

     These log files are determined by the second part of each Rule line in

     <tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>.

     To see the group-owner of a given log file, run the following command:

     
$ ls -l LOGFILE

+

+template:

+  name: rsyslog_logfiles_attributes_modify

+  vars:

+    attribute: groupowner

+    value: 0

+    value@debian10: 4

+    value@debian11: 4

+    value@ubuntu1604: 4

+    value@ubuntu2004: 4

+    value@ubuntu2204: 4

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh

deleted file mode 100755

index 575530ef2e..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh

+++ /dev/null

@@ -1,42 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check rsyslog.conf with root group-owner log from rules and

-# non root group-owner log from $IncludeConfig fails.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP_TEST=testssg

-groupadd $GROUP_TEST

-

-GROUP_ROOT=root

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files ownership

-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[0]}

-chgrp $GROUP_TEST ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*      ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${test_conf}

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh

deleted file mode 100755

index 39efc1a4b7..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh

+++ /dev/null

@@ -1,39 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check rsyslog.conf with root group-owner log from rules and

-# root group-owner log from $IncludeConfig passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP=root

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files ownership

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]}

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-\$IncludeConfig ${test_conf}

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh

deleted file mode 100755

index c0db7056b4..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh

+++ /dev/null

@@ -1,42 +0,0 @@

-#!/bin/bash

-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle

-

-# Check rsyslog.conf with root group-owner log from rules and

-# non root group-owner log from include() fails.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP_TEST=testssg

-groupadd $GROUP_TEST

-

-GROUP_ROOT=root

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files ownership

-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[0]}

-chgrp $GROUP_TEST ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*      ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-include(file="${test_conf}")

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh

deleted file mode 100755

index 1feaf762fc..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh

+++ /dev/null

@@ -1,39 +0,0 @@

-#!/bin/bash

-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle

-

-# Check rsyslog.conf with root group-owner log from rules and

-# root group-owner log from include() passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP=root

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files ownership

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]}

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-include(file="${test_conf}")

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh

deleted file mode 100755

index 5a357d029b..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh

+++ /dev/null

@@ -1,41 +0,0 @@

-#!/bin/bash

-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle

-

-# Check rsyslog.conf with root group-owner log from rules and

-# root group-owner log from multiline include() passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP=root

-

-# setup test data

-create_rsyslog_test_logs 2

-

-# setup test log files ownership

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]}

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]}

-

-# create test configuration file

-test_conf=${RSYSLOG_TEST_DIR}/test1.conf

-cat << EOF > ${test_conf}

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[1]}

-EOF

-

-# create rsyslog.conf configuration file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-

-#### MODULES ####

-

-include(

-   file="${test_conf}"

-)

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh

deleted file mode 100755

index c7c01132f2..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh

+++ /dev/null

@@ -1,25 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check if log file with non root group-owner in rsyslog.conf fails.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP=testssg

-

-groupadd $GROUP

-

-# setup test data

-create_rsyslog_test_logs 1

-

-# setup test log file ownership

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]}

-

-# add rule with non-root group owned log file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*     ${RSYSLOG_TEST_LOGS[0]}

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh

deleted file mode 100755

index 0ecbb35bd1..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh

+++ /dev/null

@@ -1,24 +0,0 @@

-#!/bin/bash

-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle

-

-# Check if log file with root group-owner in rsyslog.conf passes.

-

-source $SHARED/rsyslog_log_utils.sh

-

-GROUP=root

-

-# setup test data

-create_rsyslog_test_logs 1

-

-# setup test log file ownership

-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]}

-

-# add rule with root group owned log file

-cat << EOF > $RSYSLOG_CONF

-# rsyslog configuration file

-

-#### RULES ####

-

-*.*        ${RSYSLOG_TEST_LOGS[0]}

-

-EOF

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml

deleted file mode 100644

index 8e3f68db26..0000000000

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml

+++ /dev/null

@@ -1,114 +0,0 @@

-<def-group oval_version="5.11">

-  <definition class="compliance" id="rsyslog_files_ownership" version="1">

-    {{{ oval_metadata("All syslog log files should be owned by the appropriate user.") }}}

-

-    <criteria>

-      <criterion comment="Check if all system log files are owned by appropriate user" test_ref="test_rsyslog_files_ownership" />

-    </criteria>

-

-  </definition>

-

-  

-  <ind:textfilecontent54_object id="object_rfo_rsyslog_include_config_value" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">

-    <ind:filepath>/etc/rsyslog.conf</ind:filepath>

-    <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-  </ind:textfilecontent54_object>

-

-  

-  <local_variable id="var_rfo_include_config_regex" datatype="string" version="1" comment="$IncludeConfig value converted to regex">

-    <unique>

-      <glob_to_regex>

-        <object_component item_field="subexpression" object_ref="object_rfo_rsyslog_include_config_value" />

-      </glob_to_regex>

-    </unique>

-  </local_variable>

-

-  

-       If the variable has no values, there won't be any objects -->

-  <ind:variable_object id="object_var_rfo_include_config_regex" comment="Make variable object from regex variable" version="1">

-    <ind:var_ref>var_rfo_include_config_regex</ind:var_ref>

-  </ind:variable_object>

-

-  <local_variable id="var_rfo_syslog_config" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <literal_component datatype="string">^/etc/rsyslog.conf$</literal_component>

-  </local_variable>

-

-  <ind:variable_object id="object_var_rfo_syslog_config" comment="Make variable object for use" version="1">

-    <ind:var_ref>var_rfo_syslog_config</ind:var_ref>

-  </ind:variable_object>

-

-  

-       We do it this way to avoid referencing an empty variable in a state comparison, which

-       will cause a test to evaluate to fail. Combining an empty set of objects is fine though -->

-  <ind:variable_object id="object_var_rfo_all_log_files" comment="Filter out empty string" version="1">

-    <set>

-      <object_reference>object_var_rfo_include_config_regex</object_reference>

-      <object_reference>object_var_rfo_syslog_config</object_reference>

-    </set>

-  </ind:variable_object>

-

-  

-       a list of objects won't do. So we make a local_variable from the variable_objects. -->

-  <local_variable id="var_rfo_all_log_files" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">

-    <object_component object_ref="object_var_rfo_all_log_files" item_field="value"/>

-  </local_variable>

-

-  

-       that rsyslog's configuration file to select file paths for log files directives

-  -->

-  <ind:textfilecontent54_object id="object_rfo_log_files_paths" comment="All rsyslog configuration files" version="1">

-    <ind:filepath operation="pattern match" var_ref="var_rfo_all_log_files" var_check="at least one" />

-    

-         to constitute a log file path if all of the following conditions are met:

-         * the string represents a regular file on particular file system

-           (verified via corresponding file_state below),

-         * the chunk of text is in the last column in the row,

-           (possibly suffixed by ';' character and rsyslog Template name),

-         * contains at least one slash '/' character, and simultaneously

-           doesn't contain any of ';', ':' and space characters,

-         * the chunk was retrieved from a row not starting with space, '#',

-           or '$' characters

-    -->

-    <ind:pattern operation="pattern match">^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>

-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

-    <filter action="exclude">state_owner_ignore_include_paths</filter>

-  </ind:textfilecontent54_object>

-

-  <ind:textfilecontent54_state id="state_owner_ignore_include_paths" comment="ignore" version="1">

-    

-         include() or $IncludeConfig statements.

-         These paths are conf files, not log files. Their owner don't need to be as

-         required for log files, thus, lets exclude them from the list of objects found

-    -->

-    <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>

-  </ind:textfilecontent54_state>