1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
<def-group>
<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Check if sudo includes only the default includedir", rule_title=rule_title) }}}
<criteria operator="OR">
<criteria operator="AND">
<criterion comment="Check /etc/sudoers doesn't have any #include or @include" test_ref="test_sudoers_without_include" />
<criterion comment="Check /etc/sudoers doesn't have any #includedir" test_ref="test_sudoers_without_includedir" />
</criteria>
<criteria operator="AND">
<criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
<criterion comment="Check /etc/sudoers doesn't have any #include" test_ref="test_sudoers_without_include" />
<criterion comment="Check /etc/sudoers doesn't have any @includedir" test_ref="test_sudoers_without_includedir_new" />
<criterion comment="Check /etc/sudoers.d doesn't have any #include or #includedir" test_ref="test_sudoersd_without_includes" />
</criteria>
</criteria>
</definition>
<ind:textfilecontent54_test check="all" check_existence="only_one_exists"
comment="test only one sudoers #includedir" id="test_sudoers_default_includedir" version="1">
<ind:object object_ref="object_sudoers_default_includedir" />
<ind:state state_ref="state_sudoers_default_includedir" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_sudoers_default_includedir" version="1">
<ind:filepath>/etc/sudoers</ind:filepath>
<ind:pattern operation="pattern match">^#includedir[\s]+(.*)$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_sudoers_default_includedir" version="1">
<ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
</ind:textfilecontent54_state>
<ind:textfilecontent54_test check="all" check_existence="none_exist"
comment="test none sudoers #include or @include" id="test_sudoers_without_include" version="1">
<ind:object object_ref="object_sudoers_without_include" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_sudoers_without_include" version="1">
<ind:filepath>/etc/sudoers</ind:filepath>
<ind:pattern operation="pattern match">^[#@]include[\s]+.*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_test check="all" check_existence="none_exist"
comment="test none sudoers @includedir" id="test_sudoers_without_includedir_new" version="1">
<ind:object object_ref="object_sudoers_without_include_new" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_sudoers_without_include_new" version="1">
<ind:filepath>/etc/sudoers</ind:filepath>
<ind:pattern operation="pattern match">^@includedir[\s]+.*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_test check="all" check_existence="none_exist"
comment="test none sudoers #includedir or @includdir" id="test_sudoers_without_includedir" version="1">
<ind:object object_ref="object_sudoers_without_includedir" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_sudoers_without_includedir" version="1">
<ind:filepath>/etc/sudoers</ind:filepath>
<ind:pattern operation="pattern match">^[#@]includedir[\s]+.*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_test check="all" check_existence="none_exist"
comment="test none sudoers.d #include, @include, #includedir or @includedir" id="test_sudoersd_without_includes" version="1">
<ind:object object_ref="object_sudoersd_without_includes" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_sudoersd_without_includes" version="1">
<ind:path>/etc/sudoers.d/</ind:path>
<ind:filename operation="pattern match">.*</ind:filename>
<ind:pattern operation="pattern match">^[#@]include(?:dir)?[\s]+.*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
|
