Assorted default policy updates
This commit is contained in:
Brian Cox
parent
59947009d0
commit
392b533045
|
|
@ -60,13 +60,14 @@ HOSTNAME=;
|
||||||
#
|
#
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
Device = +pugsdr-intlbamcCMSH ;
|
SEC_DEVICE = +pugsdr-intlbamcCMSH ;
|
||||||
Dynamic = +pinugtd-srlbamcCMSH ;
|
SEC_DYNAMIC = +pinugtd-srlbamcCMSH ;
|
||||||
Growing = +pinugtdl-srbamcCMSH ;
|
SEC_GROWING = +pinugtdl-srbamcCMSH ;
|
||||||
IgnoreAll = -pinugtsdrlbamcCMSH ;
|
SEC_IGNORE_ALL = -pinugtsdrlbamcCMSH ;
|
||||||
IgnoreNone = +pinugtsdrbamcCMSH-l ;
|
SEC_IGNORE_NONE = +pinugtsdrbamcCMSH-l ;
|
||||||
ReadOnly = +pinugtsdbmCM-rlacSH ;
|
SEC_READONLY = +pinugtsdbmCM-rlacSH ;
|
||||||
Temporary = +pugt ;
|
SEC_TEMPORARY = +pugt ;
|
||||||
|
|
||||||
|
|
||||||
@@section FS
|
@@section FS
|
||||||
|
|
||||||
|
|
@ -83,10 +84,10 @@ Temporary = +pugt ;
|
||||||
rulename = "Tripwire Binaries",
|
rulename = "Tripwire Binaries",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
$(TWBIN)/siggen -> $(ReadOnly) ;
|
$(TWBIN)/siggen -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/tripwire -> $(ReadOnly) ;
|
$(TWBIN)/tripwire -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twadmin -> $(ReadOnly) ;
|
$(TWBIN)/twadmin -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twprint -> $(ReadOnly) ;
|
$(TWBIN)/twprint -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
||||||
|
|
@ -103,14 +104,14 @@ Temporary = +pugt ;
|
||||||
# afterward triggers this rule until a database update is run, since the
|
# afterward triggers this rule until a database update is run, since the
|
||||||
# database file does not exist before that point.
|
# database file does not exist before that point.
|
||||||
|
|
||||||
$(TWDB) -> $(Dynamic) -i ;
|
$(TWDB) -> $(SEC_DYNAMIC) -i ;
|
||||||
$(TWPOL)/tw.pol -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.pol -> $(SEC_READONLY) -i ;
|
||||||
$(TWPOL)/tw.cfg -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.cfg -> $(SEC_READONLY) -i ;
|
||||||
$(TWLKEY)/$(HOSTNAME)-local.key -> $(ReadOnly) ;
|
$(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_READONLY) ;
|
||||||
$(TWSKEY)/site.key -> $(ReadOnly) ;
|
$(TWSKEY)/site.key -> $(SEC_READONLY) ;
|
||||||
|
|
||||||
# don't scan the individual reports
|
# don't scan the individual reports
|
||||||
$(TWREPORT) -> $(Dynamic) (recurse=0) ;
|
$(TWREPORT) -> $(SEC_DYNAMIC) (recurse=0) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -124,7 +125,7 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Boot and Configuration Files",
|
rulename = "OS Boot and Configuration Files",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/etc -> $(IgnoreNone) -SHa ;
|
/etc -> $(SEC_IGNORE_NONE) -SHa ;
|
||||||
}
|
}
|
||||||
|
|
||||||
###################################################
|
###################################################
|
||||||
|
|
@ -138,9 +139,9 @@ Temporary = +pugt ;
|
||||||
rulename = "Mount Points",
|
rulename = "Mount Points",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/ -> $(ReadOnly) ;
|
/ -> $(SEC_READONLY) ;
|
||||||
/usr -> $(ReadOnly) ;
|
/usr -> $(SEC_READONLY) ;
|
||||||
/var -> $(ReadOnly) ;
|
/var -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
###################################################
|
###################################################
|
||||||
|
|
@ -154,10 +155,10 @@ Temporary = +pugt ;
|
||||||
rulename = "Misc Top-Level Directories",
|
rulename = "Misc Top-Level Directories",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/lost+found -> $(ReadOnly) ;
|
/lost+found -> $(SEC_READONLY) ;
|
||||||
/hacmplocal -> $(ReadOnly) ;
|
/hacmplocal -> $(SEC_READONLY) ;
|
||||||
/homelocal -> $(ReadOnly) ;
|
/homelocal -> $(SEC_READONLY) ;
|
||||||
/opt -> $(ReadOnly) ;
|
/opt -> $(SEC_READONLY) ;
|
||||||
!/var/adm/csd ;
|
!/var/adm/csd ;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -172,7 +173,7 @@ Temporary = +pugt ;
|
||||||
rulename = "System Devices",
|
rulename = "System Devices",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/dev -> $(Device) ;
|
/dev -> $(SEC_DEVICE) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -186,10 +187,10 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Binaries and Libraries",
|
rulename = "OS Binaries and Libraries",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/sbin -> $(ReadOnly) ;
|
/sbin -> $(SEC_READONLY) ;
|
||||||
/usr/bin -> $(ReadOnly) ;
|
/usr/bin -> $(SEC_READONLY) ;
|
||||||
/usr/lib -> $(ReadOnly) ;
|
/usr/lib -> $(SEC_READONLY) ;
|
||||||
/usr/sbin -> $(ReadOnly) ;
|
/usr/sbin -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -203,11 +204,11 @@ Temporary = +pugt ;
|
||||||
rulename = "Root Directory and Files",
|
rulename = "Root Directory and Files",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
#/.dtprofile -> $(Dynamic) ;
|
#/.dtprofile -> $(SEC_DYNAMIC) ;
|
||||||
! /.netscape/cache ;
|
! /.netscape/cache ;
|
||||||
/.netscape/history.dat -> $(Dynamic) ;
|
/.netscape/history.dat -> $(SEC_DYNAMIC) ;
|
||||||
/.sh_history -> $(Dynamic) ;
|
/.sh_history -> $(SEC_DYNAMIC) ;
|
||||||
#/.Xauthority -> $(ReadOnly) ;
|
#/.Xauthority -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -221,8 +222,8 @@ Temporary = +pugt ;
|
||||||
rulename = "Temporary Directories",
|
rulename = "Temporary Directories",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/tmp -> $(Temporary) ;
|
/tmp -> $(SEC_TEMPORARY) ;
|
||||||
/var/tmp -> $(Temporary) ;
|
/var/tmp -> $(SEC_TEMPORARY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -251,31 +252,31 @@ Temporary = +pugt ;
|
||||||
rulename = "System and Boot Changes",
|
rulename = "System and Boot Changes",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/etc/es/objrepos -> $(ReadOnly) -SHacm ;
|
/etc/es/objrepos -> $(SEC_READONLY) -SHacm ;
|
||||||
/etc/es/objrepos/HACMPresource -> $(ReadOnly) -SHCMcm ;
|
/etc/es/objrepos/HACMPresource -> $(SEC_READONLY) -SHCMcm ;
|
||||||
/etc/lpp/diagnostics/data -> $(ReadOnly) -SHCMacm ;
|
/etc/lpp/diagnostics/data -> $(SEC_READONLY) -SHCMacm ;
|
||||||
/etc/ntp.drift -> $(ReadOnly) -SHiacm ;
|
/etc/ntp.drift -> $(SEC_READONLY) -SHiacm ;
|
||||||
!/etc/objrepos ;
|
!/etc/objrepos ;
|
||||||
/etc/security -> $(ReadOnly) -SHacm ;
|
/etc/security -> $(SEC_READONLY) -SHacm ;
|
||||||
/usr/es/adm/cluster.log -> $(ReadOnly) -SHCMsbm ;
|
/usr/es/adm/cluster.log -> $(SEC_READONLY) -SHCMsbm ;
|
||||||
/usr/es/sbin/cluster/etc/objrepos/active -> $(ReadOnly) -SHim ;
|
/usr/es/sbin/cluster/etc/objrepos/active -> $(SEC_READONLY) -SHim ;
|
||||||
!/usr/etc/sbin/cluster/history ;
|
!/usr/etc/sbin/cluster/history ;
|
||||||
/usr/share/lib/objrepos -> $(ReadOnly) -m ;
|
/usr/share/lib/objrepos -> $(SEC_READONLY) -m ;
|
||||||
/usr/lib/objrepos -> $(ReadOnly) -m ;
|
/usr/lib/objrepos -> $(SEC_READONLY) -m ;
|
||||||
!/var/adm/SPlogs ;
|
!/var/adm/SPlogs ;
|
||||||
/var/ha/log -> $(Growing) -i ;
|
/var/ha/log -> $(SEC_GROWING) -i ;
|
||||||
!/var/adm ;
|
!/var/adm ;
|
||||||
!/var/ct ;
|
!/var/ct ;
|
||||||
|
|
||||||
#/var/backups -> $(Dynamic) -i ;
|
#/var/backups -> $(SEC_DYNAMIC) -i ;
|
||||||
#/var/db/host.random -> $(ReadOnly) -mCM ;
|
#/var/db/host.random -> $(SEC_READONLY) -mCM ;
|
||||||
#/var/db/locate.database -> $(ReadOnly) -misCM ;
|
#/var/db/locate.database -> $(SEC_READONLY) -misCM ;
|
||||||
#/var/cron -> $(Growing) -i ;
|
#/var/cron -> $(SEC_GROWING) -i ;
|
||||||
#/var/log -> $(Growing) -i ;
|
#/var/log -> $(SEC_GROWING) -i ;
|
||||||
#/var/run -> $(Dynamic) -i ;
|
#/var/run -> $(SEC_DYNAMIC) -i ;
|
||||||
#/var/mail -> $(Growing) ;
|
#/var/mail -> $(SEC_GROWING) ;
|
||||||
#/var/msgs/bounds -> $(ReadOnly) -smbCM ;
|
#/var/msgs/bounds -> $(SEC_READONLY) -smbCM ;
|
||||||
#/var/spool/clientmqueue -> $(Temporary) ;
|
#/var/spool/clientmqueue -> $(SEC_TEMPORARY) ;
|
||||||
#/var/spool/mqueue -> $(Temporary) ;
|
#/var/spool/mqueue -> $(SEC_TEMPORARY) ;
|
||||||
#!/var/tmp/vi.recover ; # perl script periodically removes this
|
#!/var/tmp/vi.recover ; # perl script periodically removes this
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -56,13 +56,13 @@ HOSTNAME=;
|
||||||
#
|
#
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
#Device = +pugsdr-intlbamcCMSH ;
|
SEC_DEVICE = +pugsdr-intlbamcCMSH ;
|
||||||
#Dynamic = +pinugtd-srlbamcCMSH ;
|
SEC_DYNAMIC = +pinugtd-srlbamcCMSH ;
|
||||||
#Growing = +pinugtdl-srbamcCMSH ;
|
SEC_GROWING = +pinugtdl-srbamcCMSH ;
|
||||||
#IgnoreAll = -pinugtsdrlbamcCMSH ;
|
SEC_IGNORE_ALL = -pinugtsdrlbamcCMSH ;
|
||||||
#IgnoreNone = +pinugtsdrbamcCMSH-l ;
|
SEC_IGNORE_NONE = +pinugtsdrbamcCMSH-l ;
|
||||||
#ReadOnly = +pinugtsdbmCM-rlacSH ;
|
SEC_READONLY = +pinugtsdbmCM-rlacSH ;
|
||||||
Temporary = +pugt ;
|
SEC_TEMPORARY = +pugt ;
|
||||||
|
|
||||||
@@section FS
|
@@section FS
|
||||||
|
|
||||||
|
|
@ -77,10 +77,10 @@ Temporary = +pugt ;
|
||||||
rulename = "Tripwire Binaries",
|
rulename = "Tripwire Binaries",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
$(TWBIN)/siggen -> $(ReadOnly) ;
|
$(TWBIN)/siggen -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/tripwire -> $(ReadOnly) ;
|
$(TWBIN)/tripwire -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twadmin -> $(ReadOnly) ;
|
$(TWBIN)/twadmin -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twprint -> $(ReadOnly) ;
|
$(TWBIN)/twprint -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
||||||
|
|
@ -97,67 +97,67 @@ Temporary = +pugt ;
|
||||||
# afterward triggers this rule until a database update is run, since the
|
# afterward triggers this rule until a database update is run, since the
|
||||||
# database file does not exist before that point.
|
# database file does not exist before that point.
|
||||||
|
|
||||||
$(TWDB) -> $(Dynamic) -i ;
|
$(TWDB) -> $(SEC_DYNAMIC) -i ;
|
||||||
$(TWPOL)/tw.pol -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.pol -> $(SEC_READONLY) -i ;
|
||||||
$(TWPOL)/tw.cfg -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.cfg -> $(SEC_READONLY) -i ;
|
||||||
$(TWLKEY)/$(HOSTNAME)-local.key -> $(ReadOnly) ;
|
$(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_READONLY) ;
|
||||||
$(TWSKEY)/site.key -> $(ReadOnly) ;
|
$(TWSKEY)/site.key -> $(SEC_READONLY) ;
|
||||||
|
|
||||||
# don't scan the individual reports
|
# don't scan the individual reports
|
||||||
$(TWREPORT) -> $(Dynamic) (recurse=0) ;
|
$(TWREPORT) -> $(SEC_DYNAMIC) (recurse=0) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
(rulename="Binary files",)
|
(rulename="Binary files",)
|
||||||
{
|
{
|
||||||
/bin -> $(IgnoreNone) -a;
|
/bin -> $(SEC_READONLY) -a;
|
||||||
/usr/bin -> $(IgnoreNone) -a;
|
/usr/bin -> $(SEC_READONLY) -a;
|
||||||
/usr/local/bin -> $(IgnoreNone) -a;
|
/usr/local/bin -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Development",)
|
(rulename="Development",)
|
||||||
{
|
{
|
||||||
/usr/x86_64-pc-cygwin -> $(IgnoreNone) -a;
|
/usr/x86_64-pc-cygwin -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Libexec",)
|
(rulename="Libexec",)
|
||||||
{
|
{
|
||||||
/usr/libexec -> $(IgnoreNone) -a;
|
/usr/libexec -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Admin binaries",)
|
(rulename="Admin binaries",)
|
||||||
{
|
{
|
||||||
/sbin -> $(IgnoreNone) -a;
|
/sbin -> $(SEC_READONLY) -a;
|
||||||
/usr/sbin -> $(IgnoreNone) -a;
|
/usr/sbin -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Libraries",)
|
(rulename="Libraries",)
|
||||||
{
|
{
|
||||||
/lib -> $(IgnoreNone) -a;
|
/lib -> $(SEC_READONLY) -a;
|
||||||
/usr/lib -> $(IgnoreNone) -a;
|
/usr/lib -> $(SEC_READONLY) -a;
|
||||||
/usr/local/lib -> $(IgnoreNone) -a;
|
/usr/local/lib -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Etc",)
|
(rulename="Etc",)
|
||||||
{
|
{
|
||||||
/etc -> $(IgnoreNone) -a;
|
/etc -> $(SEC_READONLY) -a;
|
||||||
/usr/local/etc -> $(IgnoreNone) -a;
|
/usr/local/etc -> $(SEC_READONLY) -a;
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Dev",)
|
(rulename="Dev",)
|
||||||
{
|
{
|
||||||
/dev -> $(Device);
|
/dev -> $(SEC_DEVICE);
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Tmp",)
|
(rulename="Tmp",)
|
||||||
{
|
{
|
||||||
/tmp -> $(Temporary);
|
/tmp -> $(SEC_TEMPORARY);
|
||||||
/var/tmp -> $(Temporary);
|
/var/tmp -> $(SEC_TEMPORARY);
|
||||||
/usr/tmp -> $(Temporary);
|
/usr/tmp -> $(SEC_TEMPORARY);
|
||||||
}
|
}
|
||||||
|
|
||||||
(rulename="Log",)
|
(rulename="Log",)
|
||||||
{
|
{
|
||||||
/var/log -> $(Growing);
|
/var/log -> $(SEC_GROWING);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -2,8 +2,8 @@
|
||||||
# ##
|
# ##
|
||||||
############################################################################## #
|
############################################################################## #
|
||||||
# # #
|
# # #
|
||||||
# Policy file for Mac OS X # #
|
# Tripwire 2.4 policy for Mac OS X # #
|
||||||
# September 3, 2003 # #
|
# updated March 2018 # #
|
||||||
# ##
|
# ##
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
|
|
@ -28,7 +28,7 @@ TWDB=;
|
||||||
TWSKEY=;
|
TWSKEY=;
|
||||||
TWLKEY=;
|
TWLKEY=;
|
||||||
TWREPORT=;
|
TWREPORT=;
|
||||||
#USER1=frodo ;
|
HOSTNAME=;
|
||||||
|
|
||||||
|
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
@ -67,9 +67,10 @@ SEC_DYNAMIC = +pinugt-dsrlbamcCMSH ;
|
||||||
SEC_READONLY = +pinugtsbmCM-drlacSH ;
|
SEC_READONLY = +pinugtsbmCM-drlacSH ;
|
||||||
SEC_GROWING = +pinugtl-dsrbamcCMSH ;
|
SEC_GROWING = +pinugtl-dsrbamcCMSH ;
|
||||||
|
|
||||||
IgnoreAll = -pinugtsdrlbamcCMSH ;
|
SEC_IGNORE_ALL = -pinugtsdrlbamcCMSH ;
|
||||||
IgnoreNone = +pinugtsdrbamcCMSH-l ;
|
SEC_IGNORE_NONE = +pinugtsdrbamcCMSH-l ;
|
||||||
Temporary = +pugt ;
|
SEC_TEMPORARY = +pugt ;
|
||||||
|
|
||||||
|
|
||||||
@@section FS
|
@@section FS
|
||||||
|
|
||||||
|
|
@ -109,7 +110,7 @@ Temporary = +pugt ;
|
||||||
$(TWDB) -> $(SEC_DYNAMIC) -i ;
|
$(TWDB) -> $(SEC_DYNAMIC) -i ;
|
||||||
$(TWPOL)/tw.pol -> $(SEC_READONLY) -i ;
|
$(TWPOL)/tw.pol -> $(SEC_READONLY) -i ;
|
||||||
$(TWPOL)/tw.cfg -> $(SEC_READONLY) -i ;
|
$(TWPOL)/tw.cfg -> $(SEC_READONLY) -i ;
|
||||||
$(TWLKEY)/local.key -> $(SEC_READONLY) ;
|
$(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_READONLY) ;
|
||||||
$(TWSKEY)/site.key -> $(SEC_READONLY) ;
|
$(TWSKEY)/site.key -> $(SEC_READONLY) ;
|
||||||
|
|
||||||
# don't scan the individual reports
|
# don't scan the individual reports
|
||||||
|
|
@ -129,14 +130,14 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Boot and Configuration Files", severity=100
|
rulename = "OS Boot and Configuration Files", severity=100
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/mach.sym -> $(SEC_READONLY)-im ;
|
#/mach.sym -> $(SEC_READONLY)-im ;
|
||||||
/mach_kernel -> $(SEC_READONLY) ;
|
/mach_kernel -> $(SEC_READONLY) ;
|
||||||
/private/etc -> $(SEC_READONLY)-m ;
|
/private/etc -> $(SEC_READONLY)-m ;
|
||||||
|
|
||||||
#/private/etc/appletalk.cfg -> $(SEC_READONLY)-im ;
|
#/private/etc/appletalk.cfg -> $(SEC_READONLY)-im ;
|
||||||
#/private/etc/appletalk.nvram.en0 -> $(SEC_DYNAMIC) ;
|
#/private/etc/appletalk.nvram.en0 -> $(SEC_DYNAMIC) ;
|
||||||
/private/etc/cups/certs -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
/private/etc/cups/certs -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
||||||
/private/etc/smb.conf -> $(SEC_READONLY)-im ;
|
#/private/etc/smb.conf -> $(SEC_READONLY)-im ;
|
||||||
|
|
||||||
/Library -> $(SEC_READONLY) ;
|
/Library -> $(SEC_READONLY) ;
|
||||||
/System -> $(SEC_READONLY) ;
|
/System -> $(SEC_READONLY) ;
|
||||||
|
|
@ -182,8 +183,6 @@ Temporary = +pugt ;
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/dev -> $(SEC_DEVICE)(recurse=0) ;
|
/dev -> $(SEC_DEVICE)(recurse=0) ;
|
||||||
#/private/var/cron/tabs/.sock -> $(SEC_DEVICE) ;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -203,8 +202,8 @@ Temporary = +pugt ;
|
||||||
/usr/lib -> $(SEC_READONLY) ;
|
/usr/lib -> $(SEC_READONLY) ;
|
||||||
/usr/libexec -> $(SEC_READONLY) ;
|
/usr/libexec -> $(SEC_READONLY) ;
|
||||||
/usr/sbin -> $(SEC_READONLY) ;
|
/usr/sbin -> $(SEC_READONLY) ;
|
||||||
#/usr/X11R6 -> $(SEC_READONLY)(recurse=2) ; # May not be present
|
/usr/X11 -> $(SEC_READONLY)(recurse=2) ; # May not be present
|
||||||
#/usr/X11R6/man -> $(SEC_DYNAMIC)-i(recurse=1) ; # May not be present
|
#/usr/X11/man -> $(SEC_DYNAMIC)-i(recurse=1) ; # May not be present
|
||||||
/usr/share -> $(SEC_READONLY) ;
|
/usr/share -> $(SEC_READONLY) ;
|
||||||
/usr/share/man -> $(SEC_DYNAMIC)-i(recurse=1) ;
|
/usr/share/man -> $(SEC_DYNAMIC)-i(recurse=1) ;
|
||||||
|
|
||||||
|
|
@ -223,12 +222,6 @@ Temporary = +pugt ;
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/Applications -> $(SEC_READONLY)-im(recurse=2) ;
|
/Applications -> $(SEC_READONLY)-im(recurse=2) ;
|
||||||
"/Applications (Mac OS 9)" -> $(SEC_READONLY) ;
|
|
||||||
|
|
||||||
|
|
||||||
!/Applications/Internet/P2P/Downloads ;
|
|
||||||
!/Applications/Games/"Warcraft III Folder"/Save ;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -243,10 +236,19 @@ Temporary = +pugt ;
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/usr/local -> $(SEC_READONLY) ;
|
/usr/local -> $(SEC_READONLY) ;
|
||||||
#/usr/local/bin -> $(SEC_READONLY) ;
|
/usr/local/sbin -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/bin -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/include -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/opt -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/libexec -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/lib -> $(SEC_READONLY) ;
|
||||||
/usr/local/etc -> $(SEC_READONLY) ;
|
/usr/local/etc -> $(SEC_READONLY) ;
|
||||||
#/usr/local/sbin -> $(SEC_READONLY) ;
|
/usr/local/share -> $(SEC_READONLY) ;
|
||||||
#/usr/local/share -> $(SEC_READONLY) ;
|
/usr/local/man -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/Frameworks -> $(SEC_READONLY) ;
|
||||||
|
# Homebrew
|
||||||
|
/usr/local/.git -> $(SEC_READONLY) ;
|
||||||
|
/usr/local/Cellar -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -263,24 +265,26 @@ Temporary = +pugt ;
|
||||||
{
|
{
|
||||||
/private/tmp -> $(SEC_DYNAMIC)-in(recurse=0) ;
|
/private/tmp -> $(SEC_DYNAMIC)-in(recurse=0) ;
|
||||||
|
|
||||||
|
/private/tftpboot -> $(SEC_READONLY)-i ;
|
||||||
|
|
||||||
/private/var -> $(SEC_READONLY)-i ;
|
/private/var -> $(SEC_READONLY)-i ;
|
||||||
/private/var/backups -> $(SEC_READONLY)-imc(severity=100) ;
|
/private/var/backups -> $(SEC_READONLY)-imc(severity=100) ;
|
||||||
#/private/var/backups/local.nidump -> $(SEC_DYNAMIC) -i(severity=100) ;
|
#/private/var/backups/local.nidump -> $(SEC_DYNAMIC) -i(severity=100) ;
|
||||||
#/private/var/cron -> $(SEC_DYNAMIC) -i ;
|
#/private/var/cron -> $(SEC_DYNAMIC) -i ;
|
||||||
/private/var/db -> $(SEC_READONLY)-im ;
|
/private/var/db -> $(SEC_READONLY)-im ;
|
||||||
/private/var/db/BootCache.playlist -> $(SEC_DYNAMIC) -i ;
|
/private/var/db/BootCache.playlist -> $(SEC_DYNAMIC) -i ;
|
||||||
/private/var/db/netinfo/local.nidb/Store.384 -> $(SEC_READONLY)-imc(severity=100) ;
|
#/private/var/db/netinfo/local.nidb/Store.384 -> $(SEC_READONLY)-imc(severity=100) ;
|
||||||
#/private/var/db/netinfo/local.nidb/Store.672 -> $(SEC_READONLY)-imc(severity=100) ;
|
#/private/var/db/netinfo/local.nidb/Store.672 -> $(SEC_READONLY)-imc(severity=100) ;
|
||||||
/private/var/db/prebindOnDemandBadFiles -> $(SEC_DYNAMIC) -i ;
|
#/private/var/db/prebindOnDemandBadFiles -> $(SEC_DYNAMIC) -i ;
|
||||||
/private/var/log -> $(SEC_DYNAMIC) -i ;
|
/private/var/log -> $(SEC_DYNAMIC) -i ;
|
||||||
#/private/var/mail -> $(SEC_DYNAMIC) ;
|
#/private/var/mail -> $(SEC_DYNAMIC) ;
|
||||||
/private/var/msgs/bounds -> $(SEC_READONLY)-smbCM ;
|
/private/var/msgs/bounds -> $(SEC_READONLY)-smbCM ;
|
||||||
/private/var/root/Library/Caches -> $(SEC_DYNAMIC) -i ;
|
/private/var/root/Library/Caches -> $(SEC_DYNAMIC) -i ;
|
||||||
/private/var/run -> $(SEC_DYNAMIC) -i(rulename="Running Services") ;
|
/private/var/run -> $(SEC_DYNAMIC) -i(rulename="Running Services") ;
|
||||||
#/private/var/slp.regfile -> $(SEC_READONLY)-im ;
|
#/private/var/slp.regfile -> $(SEC_READONLY)-im ;
|
||||||
/private/var/spool/clientmqueue -> $(SEC_DYNAMIC)(recurse=0) ;
|
#/private/var/spool/clientmqueue -> $(SEC_DYNAMIC)(recurse=0) ;
|
||||||
/private/var/spool/mqueue -> $(SEC_DYNAMIC)(recurse=0) ;
|
/private/var/spool/mqueue -> $(SEC_DYNAMIC)(recurse=0) ;
|
||||||
/private/var/spool/lock -> $(SEC_DYNAMIC) -i(recurse=1) ;
|
#/private/var/spool/lock -> $(SEC_DYNAMIC) -i(recurse=1) ;
|
||||||
/private/var/spool/cups -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
/private/var/spool/cups -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
||||||
/private/var/tmp -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
/private/var/tmp -> $(SEC_DYNAMIC) -i(recurse=0) ;
|
||||||
/private/var/vm -> $(SEC_DYNAMIC)(recurse=0) ;
|
/private/var/vm -> $(SEC_DYNAMIC)(recurse=0) ;
|
||||||
|
|
@ -294,37 +298,19 @@ Temporary = +pugt ;
|
||||||
!/private/var/db/dhcpd_leases ;
|
!/private/var/db/dhcpd_leases ;
|
||||||
!/private/var/db/locate.database ;
|
!/private/var/db/locate.database ;
|
||||||
!/private/var/db/SystemEntropyCache ;
|
!/private/var/db/SystemEntropyCache ;
|
||||||
|
!/private/var/db/mds/messages/se_SecurityMessages ;
|
||||||
!/private/var/db/samba/secrets.tdb ;
|
!/private/var/db/samba/secrets.tdb ;
|
||||||
|
!/private/var/db/ntp.drift ;
|
||||||
|
!/private/var/folders ;
|
||||||
|
!/private/var/vm/sleepimage ;
|
||||||
|
!/private/var/vm/swap0 ;
|
||||||
|
!/private/var/vm/swap[1-9][0-9]* ;
|
||||||
|
# Sophos
|
||||||
|
!/Library/Caches/com.sophos.sau ;
|
||||||
|
!/Library/Caches/com.sophos.sxld ;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
################################################
|
|
||||||
# ##
|
|
||||||
################################################ #
|
|
||||||
# # #
|
|
||||||
# Classic Environment # #
|
|
||||||
# ##
|
|
||||||
################################################
|
|
||||||
(
|
|
||||||
rulename = "Classic Environment", severity=100
|
|
||||||
)
|
|
||||||
{
|
|
||||||
|
|
||||||
/"System Folder" -> $(SEC_READONLY) ;
|
|
||||||
/"System Folder"/Preferences -> $(SEC_DYNAMIC)-i(recurse=0) ;
|
|
||||||
/"System Folder"/Extensions -> $(SEC_READONLY)-im ;
|
|
||||||
/"System Folder/Apple Menu Items" -> $(SEC_READONLY)-im(recurse=0) ;
|
|
||||||
/"System Folder"/Clipboard -> $(SEC_DYNAMIC) ;
|
|
||||||
|
|
||||||
!/"System Folder"/VolumeNameIconPict ;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
###################################################
|
###################################################
|
||||||
# ##
|
# ##
|
||||||
################################################### #
|
################################################### #
|
||||||
|
|
@ -375,7 +361,3 @@ Temporary = +pugt ;
|
||||||
#!"/Users/$(USER1)/.lpoptions" ;
|
#!"/Users/$(USER1)/.lpoptions" ;
|
||||||
#!"/Users/$(USER1)/.Trash" ;
|
#!"/Users/$(USER1)/.Trash" ;
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
|
||||||
# JTI
|
|
||||||
#
|
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,8 @@
|
||||||
# ##
|
# ##
|
||||||
############################################################################## #
|
############################################################################## #
|
||||||
# # #
|
# # #
|
||||||
# Tripwire 2.4 policy for Linux # #
|
# Tripwire 2.4 policy for Linux (RPM) # #
|
||||||
|
# updated March 2018 # #
|
||||||
# ##
|
# ##
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
|
|
@ -59,13 +60,13 @@ HOSTNAME=;
|
||||||
#
|
#
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
Device = +pugsdr-intlbamcCMSH ;
|
SEC_DEVICE = +pugsdr-intlbamcCMSH ;
|
||||||
Dynamic = +pinugtd-srlbamcCMSH ;
|
SEC_DYNAMIC = +pinugtd-srlbamcCMSH ;
|
||||||
Growing = +pinugtdl-srbamcCMSH ;
|
SEC_GROWING = +pinugtdl-srbamcCMSH ;
|
||||||
IgnoreAll = -pinugtsdrlbamcCMSH ;
|
SEC_IGNORE_ALL = -pinugtsdrlbamcCMSH ;
|
||||||
IgnoreNone = +pinugtsdrbamcCMSH-l ;
|
SEC_IGNORE_NONE = +pinugtsdrbamcCMSH-l ;
|
||||||
ReadOnly = +pinugtsdbmCM-rlacSH ;
|
SEC_READONLY = +pinugtsdbmCM-rlacSH ;
|
||||||
Temporary = +pugt ;
|
SEC_TEMPORARY = +pugt ;
|
||||||
|
|
||||||
@@section FS
|
@@section FS
|
||||||
|
|
||||||
|
|
@ -82,10 +83,10 @@ Temporary = +pugt ;
|
||||||
rulename = "Tripwire Binaries",
|
rulename = "Tripwire Binaries",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
$(TWBIN)/siggen -> $(ReadOnly) ;
|
$(TWBIN)/siggen -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/tripwire -> $(ReadOnly) ;
|
$(TWBIN)/tripwire -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twadmin -> $(ReadOnly) ;
|
$(TWBIN)/twadmin -> $(SEC_READONLY) ;
|
||||||
$(TWBIN)/twprint -> $(ReadOnly) ;
|
$(TWBIN)/twprint -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
|
||||||
|
|
@ -102,14 +103,14 @@ Temporary = +pugt ;
|
||||||
# afterward triggers this rule until a database update is run, since the
|
# afterward triggers this rule until a database update is run, since the
|
||||||
# database file does not exist before that point.
|
# database file does not exist before that point.
|
||||||
|
|
||||||
$(TWDB) -> $(Dynamic) -i ;
|
$(TWDB) -> $(SEC_DYNAMIC) -i ;
|
||||||
$(TWPOL)/tw.pol -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.pol -> $(SEC_READONLY) -i ;
|
||||||
$(TWPOL)/tw.cfg -> $(ReadOnly) -i ;
|
$(TWPOL)/tw.cfg -> $(SEC_READONLY) -i ;
|
||||||
$(TWLKEY)/$(HOSTNAME)-local.key -> $(ReadOnly) ;
|
$(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_READONLY) ;
|
||||||
$(TWSKEY)/site.key -> $(ReadOnly) ;
|
$(TWSKEY)/site.key -> $(SEC_READONLY) ;
|
||||||
|
|
||||||
# don't scan the individual reports
|
# don't scan the individual reports
|
||||||
$(TWREPORT) -> $(Dynamic) (recurse=0) ;
|
$(TWREPORT) -> $(SEC_DYNAMIC) (recurse=0) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -123,10 +124,10 @@ Temporary = +pugt ;
|
||||||
rulename = "RPM Checksum Files",
|
rulename = "RPM Checksum Files",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/var/lib/rpm -> $(ReadOnly);
|
/var/lib/rpm -> $(SEC_READONLY);
|
||||||
/var/lib/rpm/__db.001 -> $(Dynamic) ;
|
/var/lib/rpm/__db.001 -> $(SEC_DYNAMIC) ;
|
||||||
/var/lib/rpm/__db.002 -> $(Dynamic) ;
|
/var/lib/rpm/__db.002 -> $(SEC_DYNAMIC) ;
|
||||||
/var/lib/rpm/__db.003 -> $(Dynamic) ;
|
/var/lib/rpm/__db.003 -> $(SEC_DYNAMIC) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -140,18 +141,18 @@ Temporary = +pugt ;
|
||||||
rulename = "Global Configuration Files",
|
rulename = "Global Configuration Files",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/etc -> $(IgnoreNone) -SHa ;
|
/etc -> $(SEC_IGNORE_NONE) -SHa ;
|
||||||
/etc/adjtime -> $(Dynamic) ;
|
/etc/adjtime -> $(SEC_DYNAMIC) ;
|
||||||
/etc/aliases.db -> $(Dynamic) ;
|
/etc/aliases.db -> $(SEC_DYNAMIC) ;
|
||||||
/etc/bashrc -> $(Dynamic) ;
|
/etc/bashrc -> $(SEC_DYNAMIC) ;
|
||||||
/etc/csh.cshrc -> $(Dynamic) ;
|
/etc/csh.cshrc -> $(SEC_DYNAMIC) ;
|
||||||
/etc/csh.login -> $(Dynamic) ;
|
/etc/csh.login -> $(SEC_DYNAMIC) ;
|
||||||
/etc/mail/statistics -> $(Growing) ;
|
/etc/mail/statistics -> $(SEC_GROWING) ;
|
||||||
/etc/profile -> $(Dynamic) -i ;
|
/etc/profile -> $(SEC_DYNAMIC) -i ;
|
||||||
/etc/mtab -> $(Dynamic) -i ;
|
/etc/mtab -> $(SEC_DYNAMIC) -i ;
|
||||||
/etc/rc.d -> $(IgnoreNone) -SHa ;
|
/etc/rc.d -> $(SEC_IGNORE_NONE) -SHa ;
|
||||||
/etc/sysconfig -> $(IgnoreNone) -SHa ;
|
/etc/sysconfig -> $(SEC_IGNORE_NONE) -SHa ;
|
||||||
/etc/sysconfig/hwconf -> $(Dynamic) -m ;
|
/etc/sysconfig/hwconf -> $(SEC_DYNAMIC) -m ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -165,10 +166,10 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Boot Files and Mount Points",
|
rulename = "OS Boot Files and Mount Points",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/boot -> $(ReadOnly) ;
|
/boot -> $(SEC_READONLY) ;
|
||||||
/cdrom -> $(Dynamic) ;
|
/cdrom -> $(SEC_DYNAMIC) ;
|
||||||
/floppy -> $(Dynamic) ;
|
/floppy -> $(SEC_DYNAMIC) ;
|
||||||
/mnt -> $(Dynamic) ;
|
/mnt -> $(SEC_DYNAMIC) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -182,12 +183,12 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Devices and Misc Directories",
|
rulename = "OS Devices and Misc Directories",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/dev -> $(Device) ;
|
/dev -> $(SEC_DEVICE) ;
|
||||||
/initrd -> $(Dynamic) ;
|
/initrd -> $(SEC_DYNAMIC) ;
|
||||||
/opt -> $(Dynamic) ;
|
/opt -> $(SEC_DYNAMIC) ;
|
||||||
/lost+found -> $(Dynamic) ;
|
/lost+found -> $(SEC_DYNAMIC) ;
|
||||||
/var/lost+found -> $(Dynamic) ;
|
/var/lost+found -> $(SEC_DYNAMIC) ;
|
||||||
/home/lost+found -> $(Dynamic) ;
|
/home/lost+found -> $(SEC_DYNAMIC) ;
|
||||||
!/dev/pts ; # Ignore this file
|
!/dev/pts ; # Ignore this file
|
||||||
!/dev/shm ; # Ignore this file
|
!/dev/shm ; # Ignore this file
|
||||||
}
|
}
|
||||||
|
|
@ -203,14 +204,14 @@ Temporary = +pugt ;
|
||||||
rulename = "OS Binaries and Libraries",
|
rulename = "OS Binaries and Libraries",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/bin -> $(ReadOnly) ;
|
/bin -> $(SEC_READONLY) ;
|
||||||
/lib -> $(ReadOnly) ;
|
/lib -> $(SEC_READONLY) ;
|
||||||
/sbin -> $(ReadOnly) ;
|
/sbin -> $(SEC_READONLY) ;
|
||||||
/usr/bin -> $(ReadOnly) ;
|
/usr/bin -> $(SEC_READONLY) ;
|
||||||
/usr/lib -> $(ReadOnly) ;
|
/usr/lib -> $(SEC_READONLY) ;
|
||||||
/usr/libexec -> $(ReadOnly) ;
|
/usr/libexec -> $(SEC_READONLY) ;
|
||||||
/usr/sbin -> $(ReadOnly) ;
|
/usr/sbin -> $(SEC_READONLY) ;
|
||||||
/usr/X11R6/lib -> $(ReadOnly) ;
|
/usr/X11R6/lib -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
################################################
|
################################################
|
||||||
# ##
|
# ##
|
||||||
|
|
@ -224,19 +225,19 @@ Temporary = +pugt ;
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
!/home/local;
|
!/home/local;
|
||||||
/usr/local -> $(ReadOnly) ;
|
/usr/local -> $(SEC_READONLY) ;
|
||||||
/usr/local/bin -> $(ReadOnly) ;
|
/usr/local/bin -> $(SEC_READONLY) ;
|
||||||
/usr/local/doc -> $(ReadOnly) ;
|
/usr/local/doc -> $(SEC_READONLY) ;
|
||||||
/usr/local/etc -> $(ReadOnly) ;
|
/usr/local/etc -> $(SEC_READONLY) ;
|
||||||
/usr/local/games -> $(ReadOnly) ;
|
/usr/local/games -> $(SEC_READONLY) ;
|
||||||
/usr/local/include -> $(ReadOnly) ;
|
/usr/local/include -> $(SEC_READONLY) ;
|
||||||
/usr/local/lib -> $(ReadOnly) ;
|
/usr/local/lib -> $(SEC_READONLY) ;
|
||||||
/usr/local/libexec -> $(ReadOnly) ;
|
/usr/local/libexec -> $(SEC_READONLY) ;
|
||||||
/usr/local/man -> $(ReadOnly) ;
|
/usr/local/man -> $(SEC_READONLY) ;
|
||||||
/usr/local/sbin -> $(ReadOnly) ;
|
/usr/local/sbin -> $(SEC_READONLY) ;
|
||||||
/usr/local/share -> $(ReadOnly) ;
|
/usr/local/share -> $(SEC_READONLY) ;
|
||||||
/usr/local/src -> $(ReadOnly) ;
|
/usr/local/src -> $(SEC_READONLY) ;
|
||||||
/usr/local/sysinfo -> $(ReadOnly) ;
|
/usr/local/sysinfo -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -250,29 +251,29 @@ Temporary = +pugt ;
|
||||||
rulename = "Root Directory and Files",
|
rulename = "Root Directory and Files",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/root -> $(IgnoreNone) -SHa ;
|
/root -> $(SEC_IGNORE_NONE) -SHa ;
|
||||||
/root/.bashrc -> $(Dynamic) ;
|
/root/.bashrc -> $(SEC_DYNAMIC) ;
|
||||||
/root/.bash_history -> $(Dynamic) ;
|
/root/.bash_history -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.bash_logout -> $(Dynamic) ;
|
#/root/.bash_logout -> $(SEC_DYNAMIC) ;
|
||||||
/root/.bash_profile -> $(Dynamic) ;
|
/root/.bash_profile -> $(SEC_DYNAMIC) ;
|
||||||
/root/.cshrc -> $(Dynamic) ;
|
/root/.cshrc -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.enlightenment -> $(Dynamic) ;
|
#/root/.enlightenment -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.esd-auth -> $(Dynamic) ;
|
#/root/.esd-auth -> $(SEC_DYNAMIC) ;
|
||||||
!/root/.gconf ;
|
!/root/.gconf ;
|
||||||
!/root/.gconfd ;
|
!/root/.gconfd ;
|
||||||
#/root/.gnome -> $(Dynamic) ;
|
#/root/.gnome -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.gnome-desktop -> $(Dynamic) ;
|
#/root/.gnome-desktop -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.gnome2 -> $(Dynamic) ;
|
#/root/.gnome2 -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.gtkrc -> $(Dynamic) ;
|
#/root/.gtkrc -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.gtkrc-1.2-gnome2 -> $(Dynamic) ;
|
#/root/.gtkrc-1.2-gnome2 -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.metacity -> $(Dynamic) ;
|
#/root/.metacity -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.nautilus -> $(Dynamic) ;
|
#/root/.nautilus -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.rhn-applet.conf -> $(Dynamic) ;
|
#/root/.rhn-applet.conf -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.tcshrc -> $(Dynamic) ;
|
#/root/.tcshrc -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.xauth -> $(Dynamic) ;
|
#/root/.xauth -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.ICEauthority -> $(Dynamic) ;
|
#/root/.ICEauthority -> $(SEC_DYNAMIC) ;
|
||||||
#/root/.Xauthority -> $(Dynamic) -i ;
|
#/root/.Xauthority -> $(SEC_DYNAMIC) -i ;
|
||||||
#/root/.Xresources -> $(Dynamic) ;
|
#/root/.Xresources -> $(SEC_DYNAMIC) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -286,12 +287,12 @@ Temporary = +pugt ;
|
||||||
rulename = "Temporary Directories",
|
rulename = "Temporary Directories",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/usr/tmp -> $(Temporary) ;
|
/usr/tmp -> $(SEC_TEMPORARY) ;
|
||||||
/var/tmp -> $(Temporary) ;
|
/var/tmp -> $(SEC_TEMPORARY) ;
|
||||||
/tmp -> $(Temporary) ;
|
/tmp -> $(SEC_TEMPORARY) ;
|
||||||
#/tmp/.fam-socket -> $(Temporary) ;
|
#/tmp/.fam-socket -> $(SEC_TEMPORARY) ;
|
||||||
#/tmp/.ICE-unix -> $(Temporary) ;
|
#/tmp/.ICE-unix -> $(SEC_TEMPORARY) ;
|
||||||
#/tmp/.X11-unix -> $(Temporary) ;
|
#/tmp/.X11-unix -> $(SEC_TEMPORARY) ;
|
||||||
!/tmp/orbit-root ;
|
!/tmp/orbit-root ;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -306,21 +307,21 @@ Temporary = +pugt ;
|
||||||
rulename = "System Boot Changes",
|
rulename = "System Boot Changes",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/.autofsck -> $(Dynamic) -m ;
|
/.autofsck -> $(SEC_DYNAMIC) -m ;
|
||||||
/var/cache/man/whatis -> $(Growing) ;
|
/var/cache/man/whatis -> $(SEC_GROWING) ;
|
||||||
/var/lib/logrotate.status -> $(Growing) ;
|
/var/lib/logrotate.status -> $(SEC_GROWING) ;
|
||||||
#/var/lib/nfs/statd -> $(Growing) ;
|
#/var/lib/nfs/statd -> $(SEC_GROWING) ;
|
||||||
!/var/lib/random-seed ;
|
!/var/lib/random-seed ;
|
||||||
#/var/lib/slocate/slocate.db -> $(Growing) -is ;
|
#/var/lib/slocate/slocate.db -> $(SEC_GROWING) -is ;
|
||||||
/var/lock/subsys -> $(Dynamic) -i ;
|
/var/lock/subsys -> $(SEC_DYNAMIC) -i ;
|
||||||
/var/log -> $(Growing) -i ;
|
/var/log -> $(SEC_GROWING) -i ;
|
||||||
!/var/log/sa;
|
!/var/log/sa;
|
||||||
!/var/log/cisco;
|
!/var/log/cisco;
|
||||||
/var/run -> $(Dynamic) -i ;
|
/var/run -> $(SEC_DYNAMIC) -i ;
|
||||||
/etc/cron.daily -> $(Growing);
|
/etc/cron.daily -> $(SEC_GROWING);
|
||||||
/etc/cron.weekly -> $(Growing);
|
/etc/cron.weekly -> $(SEC_GROWING);
|
||||||
/etc/cron.monthly -> $(Growing);
|
/etc/cron.monthly -> $(SEC_GROWING);
|
||||||
/var/spool/mail -> $(Growing);
|
/var/spool/mail -> $(SEC_GROWING);
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
@ -334,10 +335,10 @@ Temporary = +pugt ;
|
||||||
rulename = "Monitor Filesystems",
|
rulename = "Monitor Filesystems",
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
/ -> $(ReadOnly) ;
|
/ -> $(SEC_READONLY) ;
|
||||||
/home -> $(ReadOnly) ; # Modify as needed
|
/home -> $(SEC_READONLY) ; # Modify as needed
|
||||||
/usr -> $(ReadOnly) ;
|
/usr -> $(SEC_READONLY) ;
|
||||||
/var -> $(ReadOnly) ;
|
/var -> $(SEC_READONLY) ;
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue