diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/oval/shared.xml index d65a411617c..18deed7df09 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/oval/shared.xml @@ -7,19 +7,21 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_gids_object = "object_" ~ rule_id ~ "_gids" -%}} + {{{ create_local_interactive_users_gids_list_object(interactive_users_gids_object) }}} - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/oval/shared.xml index b1bcee27ea8..6cd8b2bfc0a 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/oval/shared.xml @@ -7,19 +7,21 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_uids_object = "object_" ~ rule_id ~ "_uids" -%}} + {{{ create_local_interactive_users_uids_list_object(interactive_users_uids_object) }}} - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml index 56b33964806..bb86d40e0f3 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml @@ -10,13 +10,13 @@ {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_object) }}} - diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml index e58fb7dd058..6811bb1c26b 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml @@ -5,7 +5,7 @@ prodtype: alinux2,alinux3,fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,sle12,sle15, title: 'All Interactive Users Home Directories Must Exist' description: |- - Create home directories to all interactive users that currently do not + Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in /etc/passwd: 
$ sudo mkdir /home/USER
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/oval/shared.xml index 1633d79bd18..8de8b3263eb 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/oval/shared.xml @@ -7,19 +7,21 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_gids_object = "object_" ~ rule_id ~ "_gids" -%}} + {{{ create_local_interactive_users_gids_list_object(interactive_users_gids_object) }}} - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/oval/shared.xml index c951dc1724b..51158c7a014 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/oval/shared.xml @@ -7,17 +7,20 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_uids_object = "object_" ~ rule_id ~ "_uids" -%}} + {{{ create_local_interactive_users_uids_list_object(interactive_users_uids_object) }}} + - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/oval/shared.xml index e126b8bf053..94bf720a340 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/oval/shared.xml @@ -9,13 +9,13 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} - + diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/oval/shared.xml index 9da1164d5f9..7948b92dab0 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/oval/shared.xml @@ -7,18 +7,20 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_gids_object = "object_" ~ rule_id ~ "_gids" -%}} + {{{ create_local_interactive_users_gids_list_object(interactive_users_gids_object) }}} - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/oval/shared.xml index 366c0a88563..67d18e0fe36 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/oval/shared.xml @@ -13,8 +13,10 @@ - {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}} + {{%- set interactive_users_uids_object = "object_" ~ rule_id ~ "_uids" -%}} + {{{ create_local_interactive_users_uids_list_object(interactive_users_uids_object) }}} - + - + - + diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml index 2331e6ccbec..55df15ebecc 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml @@ -8,11 +8,11 @@ {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}} - {{{ create_interactive_users_list_object(interactive_users_object) }}} + {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_object) }}} - diff --git a/shared/macros/10-oval.jinja b/shared/macros/10-oval.jinja index 36378600ce9..53b0c143f79 100644 --- a/shared/macros/10-oval.jinja +++ b/shared/macros/10-oval.jinja @@ -1077,8 +1077,9 @@ Generates the :code:`` tag for OVAL check using correct product platfo {{# - Extract from /etc/passwd a list composed of password objects related to non-system UIDs. + Extract from system password database a list composed of password objects related to non-system UIDs. This list is then filtered to exclude some special usernames and users with /sbin/nologin shell. + The list includes non-local (LDAP) users, because the implementation of "unix:password_object" in OpenSCAP makes use of getpwent(), which browses all users provided by the NSS. The macro receives a string as parameter, which is used as the password_object id in the rule. @@ -1109,6 +1110,116 @@ Generates the :code:`` tag for OVAL check using correct product platfo {{%- endmacro %}} +{{# + Extract from /etc/passwd a list of specified fields of local interactive users. + The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin shell. + + Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object". + + The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule. + +:param object_id: Object ID to be created. +:type object_id: str +:param second_literal_component_regex: regex in the second literal_component of the concat element of the local variable that forms the regex describing an username row +:type second_literal_component_regex: str + +#}} +{{%- macro create_local_interactive_users_object(object_id, second_literal_component_regex) -%}} + + + + + /etc/passwd + + + 1 + + + + + + ^(?: + + {{{ second_literal_component_regex }}} + + + + + + /etc/passwd + + ^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!\/sbin\/nologin)[^:]*$ + 1 + state_{{{ object_id }}}_users_ignored + + + {{%- set ignored_users_list="(nobody|nfsnobody)" %}} + + ^{{{ ignored_users_list }}}$ + + +{{%- endmacro %}} + +{{# + Extract from /etc/passwd a list of home directories of local interactive users. + The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin shell. + + Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object". + + The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule. + +:param object_id: Object ID to be created. +:type object_id: str + +#}} +{{%- macro create_local_interactive_users_home_dirs_list_object(object_id) -%}} +{{{ create_local_interactive_users_object( + object_id=object_id, + second_literal_component_regex="):(?:[^:]*:){4}([^:]+):[^:]*$") }}} +{{%- endmacro %}} + + +{{# + Extract from /etc/passwd a list of User IDs of local interactive users. + The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin shell. + + Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object". + + The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule. + +:param object_id: Object ID to be created. +:type object_id: str + +#}} +{{%- macro create_local_interactive_users_uids_list_object(object_id) -%}} +{{{ create_local_interactive_users_object( + object_id=object_id, + second_literal_component_regex=":)(?:[^:]*:)([^:]+):(?:[^:]*:){3}[^:]*$") }}} +{{%- endmacro %}} + + +{{# + Extract from /etc/passwd a list of Group IDs of local interactive users. + The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin shell. + + Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object". + + The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule. + +:param object_id: Object ID to be created. +:type object_id: str + +#}} +{{%- macro create_local_interactive_users_gids_list_object(object_id) -%}} +{{{ create_local_interactive_users_object( + object_id=object_id, + second_literal_component_regex=":)(?:[^:]*:){2}([^:]+):(?:[^:]*:){2}[^:]*$") }}} +{{%- endmacro %}} {{# Extract from /etc/passwd a list composed of password objects related to system UIDs.