Skip to content

Commit e322ea7

Browse files
ericeberryericeberry
committed
Ubuntu 24.04 STIG Rule UBTU-24-300010
1 parent 69efaa7 commit e322ea7

File tree

13 files changed

+121
-39
lines changed

13 files changed

+121
-39
lines changed

‎controls/stig_ubuntu2404.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -546,9 +546,9 @@ controls:
546546
account.
547547
levels:
548548
- medium
549-
related_rules:
549+
rules:
550550
- file_groupownership_system_commands_dirs
551-
status: planned
551+
status: automated
552552

553553
- id: UBTU-24-300014
554554
title: Ubuntu 24.04 LTS must prevent the use of dictionary words for passwords.

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux
22

3-
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
3+
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin
44
do
55
find -L $SYSCMDFILES \! -group root -type f -exec chgrp root '{}' \;
66
done

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/ubuntu.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
# platform = multi_platform_ubuntu
22

3+
{{% if product in ["ubuntu2404"] %}}
4+
find -L /bin/ /sbin/ /usr/bin/ /usr/sbin/ /usr/local/bin/ /usr/local/sbin/ -maxdepth 1 -type f ! -group root ! -group daemon ! -group adm ! -group shadow ! -group mail ! -group crontab ! -group _ssh -regextype posix-extended -regex '.*' -exec chgrp -L root {} \;
5+
6+
{{% else %}}
37
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
48
do
59
find -L $SYSCMDFILES ! -group root -type f ! -perm /2000 -exec chgrp root '{}' \;
610
done
11+
{{% endif %}}

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/oval/shared.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{% if product not in ["ubuntu2404"] %}}
12
<def-group>
23
<definition class="compliance" id="file_groupownership_system_commands_dirs" version="1">
34
{{{ oval_metadata("
@@ -26,3 +27,4 @@
2627
</unix:file_state>
2728

2829
</def-group>
30+
{{% endif %}}

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/oval/ubuntu.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{% if product not in ["ubuntu2404"] %}}
12
<def-group>
23
<definition class="compliance" id="file_groupownership_system_commands_dirs" version="1">
34
{{{ oval_metadata("
@@ -27,3 +28,4 @@
2728
</unix:file_state>
2829

2930
</def-group>
31+
{{% endif %}}

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/rule.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,18 @@ fixtext: |-
6767
6868
srg_requirement:
6969
{{{ full_name }}} system commands must be group-owned by root or a system account.
70+
71+
{{% if product in ["ubuntu2404"] %}}
72+
template:
73+
name: file_groupowner
74+
vars:
75+
filepath:
76+
- /bin/
77+
- /sbin/
78+
- /usr/bin/
79+
- /usr/sbin/
80+
- /usr/local/bin/
81+
- /usr/local/sbin/
82+
file_regex: .*
83+
gid_or_name: 'root|daemon|adm|shadow|mail|crontab|_ssh'
84+
{{% endif %}}

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/correct_groupowner.pass.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
3+
{{% if product in ["ubuntu2404"] %}}
4+
useradd crontab
5+
{{% endif %}}
6+
7+
{{% if 'ubuntu' in product %}}
8+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
9+
{{% else %}}
10+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin
11+
{{% endif %}}
12+
do
13+
find -L $SYSLIBDIRS \! -group root -type f -exec chgrp root '{}' \;
14+
done

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/correct_groupowner_sgid.fail.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
4+
{{% if product in ["ubuntu2404"] %}}
5+
useradd crontab
6+
{{% endif %}}
7+
8+
{{% if 'ubuntu' in product %}}
9+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
10+
{{% else %}}
11+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin
12+
{{% endif %}}
13+
do
14+
find -L $SYSLIBDIRS \! -group root -type f -exec chgrp root '{}' \;
15+
done
16+
17+
groupadd group_test
18+
19+
{{% if 'ubuntu' in product %}}
20+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
21+
{{% else %}}
22+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me
23+
{{% endif %}}
24+
do
25+
if [[ ! -f $TESTFILE ]]
26+
then
27+
touch $TESTFILE
28+
fi
29+
chgrp group_test $TESTFILE
30+
chmod g+s $TESTFILE
31+
done

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/correct_groupowner_sgid.pass.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
4+
{{% if product in ["ubuntu2404"] %}}
5+
useradd crontab
6+
{{% endif %}}
7+
8+
9+
{{% if 'ubuntu' in product %}}
10+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
11+
{{% else %}}
12+
for SYSLIBDIRS in /bin /sbin /usr/bin /usr/sbin /usr/local/bin
13+
{{% endif %}}
14+
do
15+
find -L $SYSLIBDIRS \! -group root -type f -exec chgrp root '{}' \;
16+
done
17+
18+
{{% if 'ubuntu' in product %}}
19+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
20+
{{% else %}}
21+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me
22+
{{% endif %}}
23+
do
24+
if [[ ! -f $TESTFILE ]]
25+
then
26+
touch $TESTFILE
27+
fi
28+
chgrp root $TESTFILE
29+
chmod g+s $TESTFILE
30+
done

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/correct_groupownership.pass.sh

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/correct_groupownership_sgid.pass.sh

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
#!/bin/bash
22

3+
{{% if product in ["ubuntu2404"] %}}
4+
useradd crontab
5+
{{% endif %}}
6+
37
groupadd group_test
48

9+
{{% if 'ubuntu' in product %}}
510
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
11+
{{% else %}}
12+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me
13+
{{% endif %}}
614
do
7-
if [[ ! -f $TESTFILE ]]
8-
then
9-
touch $TESTFILE
10-
fi
11-
chgrp group_test $TESTFILE
15+
if [[ ! -f $TESTFILE ]]
16+
then
17+
touch $TESTFILE
18+
fi
19+
chgrp group_test $TESTFILE
1220
done

‎linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/system_account_groupownership.pass.sh

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
# gid of sshd group is 74
77
test_group="sshd"
88

9-
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
9+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me
1010
do
11-
if [[ ! -f $TESTFILE ]]
12-
then
13-
touch $TESTFILE
14-
fi
15-
chgrp "$test_group" $TESTFILE
11+
if [[ ! -f $TESTFILE ]]
12+
then
13+
touch $TESTFILE
14+
fi
15+
chgrp "$test_group" $TESTFILE
1616
done

0 commit comments

Comments
 (0)