Create new rule file_permissions_cron_not_modified#14901
Conversation
This rule implements RHEL 10 STIG requirement RHEL-10-400230: RHEL 10 must be configured to prohibit modification of permissions for cron configuration files and directories from the operating system defaults. The new rule matches the check and fix texts in the STIG requirement better than the currently selected rules. It uses the STIG suggested implementation of matching the configuration files against RPM database instead of checking the permissions directly like the existing rules.
jan-cerny
added
New Rule
| @@ -0,0 +1,5 @@ | |||
| #!/bin/bash | |||
There was a problem hiding this comment.
Should we add tests for invalid user? We check and fixing those?
There was a problem hiding this comment.
This is similar as in the other PR for sshd. There are other requirements in RHEL 10 STIG that check for file owners and groups:
https://stigaview.com/products/rhel10/v1r2/RHEL-10-400130/
https://stigaview.com/products/rhel10/v1r2/RHEL-10-400135/
There was a problem hiding this comment.
But this PR is fixing permissions should we remove that from this PR?
|
@jan-cerny: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
This rule implements RHEL 10 STIG requirement RHEL-10-400230: RHEL 10 must be configured to prohibit modification of permissions for cron configuration files and directories from the operating system defaults.
The new rule matches the check and fix texts in the STIG requirement better than the currently selected rules. It uses the STIG suggested implementation of matching the configuration files against RPM database instead of checking the permissions directly like the existing rules.