From ab5f99e34a42437652d733461d62b09a64604ade Mon Sep 17 00:00:00 2001 From: Tavis Ormandy Date: Mon, 13 Dec 2004 18:36:20 +0000 Subject: [PATCH] import patch to use autotools for tripwire --- app-admin/tripwire/ChangeLog | 9 +- app-admin/tripwire/Manifest | 8 +- .../tripwire/files/digest-tripwire-2.3.1.2-r2 | 2 + app-admin/tripwire/files/twpol.txt | 1104 ----------------- app-admin/tripwire/files/twpol.txt.gz | Bin 0 -> 7586 bytes app-admin/tripwire/tripwire-2.3.1.2-r1.ebuild | 8 +- app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild | 100 ++ 7 files changed, 120 insertions(+), 1111 deletions(-) create mode 100644 app-admin/tripwire/files/digest-tripwire-2.3.1.2-r2 delete mode 100644 app-admin/tripwire/files/twpol.txt create mode 100644 app-admin/tripwire/files/twpol.txt.gz create mode 100644 app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild diff --git a/app-admin/tripwire/ChangeLog b/app-admin/tripwire/ChangeLog index c2a9e83e155c..2131e3a48a63 100644 --- a/app-admin/tripwire/ChangeLog +++ b/app-admin/tripwire/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for app-admin/tripwire # Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-admin/tripwire/ChangeLog,v 1.11 2004/06/24 21:41:03 agriffis Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-admin/tripwire/ChangeLog,v 1.12 2004/12/13 18:36:20 taviso Exp $ + +*tripwire-2.3.1.2-r2 (13 Dec 2004) + + 13 Dec 2004; Tavis Ormandy -files/twpol.txt, + +files/twpol.txt.gz, tripwire-2.3.1.2-r1.ebuild, + +tripwire-2.3.1.2-r2.ebuild: + import patch to use autotools for tripwire 05 Jun 2004; Tavis Ormandy tripwire-2.3.1.2.ebuild: removing old ebuilds diff --git a/app-admin/tripwire/Manifest b/app-admin/tripwire/Manifest index 994b02ac034f..c84357728208 100644 --- a/app-admin/tripwire/Manifest +++ b/app-admin/tripwire/Manifest @@ -1,14 +1,16 @@ -MD5 54846356d7bf165ecfed09ac368acf2c tripwire-2.3.1.2-r1.ebuild 2835 -MD5 3f918bc05537d29608b6f4f486a9599f ChangeLog 1886 +MD5 3fcfa833263ade7072a1cd12677e514a tripwire-2.3.1.2-r2.ebuild 2817 +MD5 3a0dd4864170e5fc624fb1c98e5ca26e tripwire-2.3.1.2-r1.ebuild 2969 +MD5 b1b56018ae3a3b59c02c236d34e51d21 ChangeLog 2115 MD5 96f9cca8215d6e0286f08431592d3677 metadata.xml 597 MD5 fa08ee8d578671e3f18b1ce684e0fa31 files/tripwire-2.3.1-2-fhs.patch.bz2 327 MD5 7b5cac2555db706d0bdc2c49d7f6b9e9 files/tripwire-mkstemp.patch.bz2 564 MD5 4a83584d44a4974cd6d48d695dfd1d67 files/twcfg.txt 604 -MD5 1c477e41e000e6579665e97f75a9cefb files/twpol.txt 51817 MD5 9493ba83857bc6cfcd276f74becaa98e files/digest-tripwire-2.3.1.2-r1 142 +MD5 1e76f292b15c2e2e490e3f7a7fbc4e9c files/digest-tripwire-2.3.1.2-r2 163 MD5 0700fa22e2353e11c842f48453703d96 files/tripwire-2.3.0-50-rfc822.patch.bz2 347 MD5 87628f7bb2693d2ee923ad3bc1877533 files/tripwire-format-string-email-report.diff 472 MD5 c0cf6e656870aa10c4ba2e4730080131 files/twinstall.sh 10100 +MD5 f776500cdf290f2a953a9884c0e49f72 files/twpol.txt.gz 7586 MD5 30e2f2f5df395d3dd1dc02fb40d9810c files/tripwire-2.3.1-gcc3.patch.bz2 2878 MD5 504ee0af20b026a651c89030f87c6e10 files/tripwire-2.3.1-2-gcc-3.3.patch.bz2 197 MD5 033e88454d3adcf1cfc83270b4dc452e files/tripwire.cron 315 diff --git a/app-admin/tripwire/files/digest-tripwire-2.3.1.2-r2 b/app-admin/tripwire/files/digest-tripwire-2.3.1.2-r2 new file mode 100644 index 000000000000..91953f2b95f3 --- /dev/null +++ b/app-admin/tripwire/files/digest-tripwire-2.3.1.2-r2 @@ -0,0 +1,2 @@ +MD5 6a15fe110565cef9ed33c1c7e070355e tripwire-2.3.1-2.tar.gz 1514955 +MD5 636163bdefb935e1e5e46aa57f4051eb tripwire-2.3.1-2-pherman-portability-0.9.diff.bz2 739663 diff --git a/app-admin/tripwire/files/twpol.txt b/app-admin/tripwire/files/twpol.txt deleted file mode 100644 index 926615f63548..000000000000 --- a/app-admin/tripwire/files/twpol.txt +++ /dev/null @@ -1,1104 +0,0 @@ - ############################################################################## - # ## -############################################################################## # -# # # -# Policy file for Red Hat Linux # # -# V1.2.0rh # # -# August 9, 2001 # # -# ## -############################################################################## - - - ############################################################################## - # ## -############################################################################## # -# # # -# This is the example Tripwire Policy file. It is intended as a place to # # -# start creating your own custom Tripwire Policy file. Referring to it as # # -# well as the Tripwire Policy Guide should give you enough information to # # -# make a good custom Tripwire Policy file that better covers your # # -# configuration and security needs. A text version of this policy file is # # -# called twpol.txt. # # -# # # -# Note that this file is tuned to an 'everything' install of Red Hat Linux. # # -# If run unmodified, this file should create no errors on database # # -# creation, or violations on a subsiquent integrity check. However, it is # # -# impossible for there to be one policy file for all machines, so this # # -# existing one errs on the side of security. Your Linux configuration will # # -# most likey differ from the one our policy file was tuned to, and will # # -# therefore require some editing of the default Tripwire Policy file. # # -# # # -# The example policy file is best run with 'Loose Directory Checking' # # -# enabled. Set LOOSEDIRECTORYCHECKING=TRUE in the Tripwire Configuration # # -# file. # # -# # # -# Email support is not included and must be added to this file. # # -# Add the 'emailto=' to the rule directive section of each rule (add a comma # # -# after the 'severity=' line and add an 'emailto=' and include the email # # -# addresses you want the violation reports to go to). Addresses are # # -# semi-colon delimited. # # -# ## -############################################################################## - - - - ############################################################################## - # ## -############################################################################## # -# # # -# Global Variable Definitions # # -# # # -# These are defined at install time by the installation script. You may # # -# Manually edit these if you are using this file directly and not from the # # -# installation script itself. # # -# ## -############################################################################## - -@@section GLOBAL -TWROOT=/usr/sbin; -TWBIN=/usr/sbin; -TWPOL="/etc/tripwire"; -TWDB="/var/lib/tripwire"; -TWSKEY="/etc/tripwire"; -TWLKEY="/etc/tripwire"; -TWREPORT="/var/lib/tripwire/report"; -HOSTNAME=localhost; - -@@section FS -SEC_CRIT = $(IgnoreNone)-SHa ; # Critical files that cannot change -SEC_SUID = $(IgnoreNone)-SHa ; # Binaries with the SUID or SGID flags set -SEC_BIN = $(ReadOnly) ; # Binaries that should not change -SEC_CONFIG = $(Dynamic) ; # Config files that are changed infrequently but accessed often -SEC_LOG = $(Growing) ; # Files that grow, but that should never change ownership -SEC_INVARIANT = +tpug ; # Directories that should never change permission or ownership -SIG_LOW = 33 ; # Non-critical files that are of minimal security impact -SIG_MED = 66 ; # Non-critical files that are of significant security impact -SIG_HI = 100 ; # Critical files that are significant points of vulnerability - - -# Tripwire Binaries -( - rulename = "Tripwire Binaries", - severity = $(SIG_HI) -) -{ - $(TWBIN)/siggen -> $(SEC_BIN) ; - $(TWBIN)/tripwire -> $(SEC_BIN) ; - $(TWBIN)/twadmin -> $(SEC_BIN) ; - $(TWBIN)/twprint -> $(SEC_BIN) ; -} - -# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases -( - rulename = "Tripwire Data Files", - severity = $(SIG_HI) -) -{ - # NOTE: We remove the inode attribute because when Tripwire creates a backup, - # it does so by renaming the old file and creating a new one (which will - # have a new inode number). Inode is left turned on for keys, which shouldn't - # ever change. - - # NOTE: The first integrity check triggers this rule and each integrity check - # afterward triggers this rule until a database update is run, since the - # database file does not exist before that point. - - $(TWDB) -> $(SEC_CONFIG) -i ; - $(TWPOL)/tw.pol -> $(SEC_BIN) -i ; - $(TWPOL)/tw.cfg -> $(SEC_BIN) -i ; - $(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_BIN) ; - $(TWSKEY)/site.key -> $(SEC_BIN) ; - - #don't scan the individual reports - $(TWREPORT) -> $(SEC_CONFIG) (recurse=0) ; -} - - -# Tripwire HQ Connector Binaries -#( -# rulename = "Tripwire HQ Connector Binaries", -# severity = $(SIG_HI) -#) -#{ -# $(TWBIN)/hqagent -> $(SEC_BIN) ; -#} -# -# Tripwire HQ Connector - Configuration Files, Keys, and Logs - - ############################################################################## - # ## -############################################################################## # -# # # -# Note: File locations here are different than in a stock HQ Connector # # -# installation. This is because Tripwire 2.3 uses a different path # # -# structure than Tripwire 2.2.1. # # -# # # -# You may need to update your HQ Agent configuation file (or this policy # # -# file) to correct the paths. We have attempted to support the FHS standard # # -# here by placing the HQ Agent files similarly to the way Tripwire 2.3 # # -# places them. # # -# ## -############################################################################## - -#( -# rulename = "Tripwire HQ Connector Data Files", -# severity = $(SIG_HI) -#) -#{ -# ############################################################################# -# ############################################################################## -# # NOTE: Removing the inode attribute because when Tripwire creates a backup ## -# # it does so by renaming the old file and creating a new one (which will ## -# # have a new inode number). Leaving inode turned on for keys, which ## -# # shouldn't ever change. ## -# ############################################################################# -# -# $(TWBIN)/agent.cfg -> $(SEC_BIN) -i ; -# $(TWLKEY)/authentication.key -> $(SEC_BIN) ; -# $(TWDB)/tasks.dat -> $(SEC_CONFIG) ; -# $(TWDB)/schedule.dat -> $(SEC_CONFIG) ; -# -# # Uncomment if you have agent logging enabled. -# #/var/log/tripwire/agent.log -> $(SEC_LOG) ; -#} - - - -# Commonly accessed directories that should remain static with regards to owner and group -( - rulename = "Invariant Directories", - severity = $(SIG_MED) -) -{ - / -> $(SEC_INVARIANT) (recurse = 0) ; - /home -> $(SEC_INVARIANT) (recurse = 0) ; - /etc -> $(SEC_INVARIANT) (recurse = 0) ; -} - ################################################ - # ## -################################################ # -# # # -# File System and Disk Administration Programs # # -# ## -################################################ - -( - rulename = "File System and Disk Administraton Programs", - severity = $(SIG_HI) -) -{ - /sbin/accton -> $(SEC_CRIT) ; - /sbin/badblocks -> $(SEC_CRIT) ; - /sbin/busybox -> $(SEC_CRIT) ; - /sbin/busybox.anaconda -> $(SEC_CRIT) ; - /sbin/convertquota -> $(SEC_CRIT) ; - /sbin/dosfsck -> $(SEC_CRIT) ; - /sbin/debugfs -> $(SEC_CRIT) ; - /sbin/debugreiserfs -> $(SEC_CRIT) ; - /sbin/dumpe2fs -> $(SEC_CRIT) ; - /sbin/dump -> $(SEC_CRIT) ; - /sbin/dump.static -> $(SEC_CRIT) ; - # /sbin/e2fsadm -> $(SEC_CRIT) ; tune2fs? - /sbin/e2fsck -> $(SEC_CRIT) ; - /sbin/e2label -> $(SEC_CRIT) ; - /sbin/fdisk -> $(SEC_CRIT) ; - /sbin/fsck -> $(SEC_CRIT) ; - /sbin/fsck.ext2 -> $(SEC_CRIT) ; - /sbin/fsck.ext3 -> $(SEC_CRIT) ; - /sbin/fsck.minix -> $(SEC_CRIT) ; - /sbin/fsck.msdos -> $(SEC_CRIT) ; - /sbin/fsck.vfat -> $(SEC_CRIT) ; - /sbin/ftl_check -> $(SEC_CRIT) ; - /sbin/ftl_format -> $(SEC_CRIT) ; - /sbin/hdparm -> $(SEC_CRIT) ; - #/sbin/lvchange -> $(SEC_CRIT) ; - #/sbin/lvcreate -> $(SEC_CRIT) ; - #/sbin/lvdisplay -> $(SEC_CRIT) ; - #/sbin/lvextend -> $(SEC_CRIT) ; - #/sbin/lvmchange -> $(SEC_CRIT) ; - #/sbin/lvmcreate_initrd -> $(SEC_CRIT) ; - #/sbin/lvmdiskscan -> $(SEC_CRIT) ; - #/sbin/lvmsadc -> $(SEC_CRIT) ; - #/sbin/lvmsar -> $(SEC_CRIT) ; - #/sbin/lvreduce -> $(SEC_CRIT) ; - #/sbin/lvremove -> $(SEC_CRIT) ; - #/sbin/lvrename -> $(SEC_CRIT) ; - #/sbin/lvscan -> $(SEC_CRIT) ; - /sbin/mkbootdisk -> $(SEC_CRIT) ; - /sbin/mkdosfs -> $(SEC_CRIT) ; - /sbin/mke2fs -> $(SEC_CRIT) ; - /sbin/mkfs -> $(SEC_CRIT) ; - /sbin/mkfs.bfs -> $(SEC_CRIT) ; - /sbin/mkfs.ext2 -> $(SEC_CRIT) ; - /sbin/mkfs.minix -> $(SEC_CRIT) ; - /sbin/mkfs.msdos -> $(SEC_CRIT) ; - /sbin/mkfs.vfat -> $(SEC_CRIT) ; - /sbin/mkinitrd -> $(SEC_CRIT) ; - #/sbin/mkpv -> $(SEC_CRIT) ; - /sbin/mkraid -> $(SEC_CRIT) ; - /sbin/mkreiserfs -> $(SEC_CRIT) ; - /sbin/mkswap -> $(SEC_CRIT) ; - #/sbin/mtx -> $(SEC_CRIT) ; - /sbin/pam_console_apply -> $(SEC_CRIT) ; - /sbin/parted -> $(SEC_CRIT) ; - /sbin/pcinitrd -> $(SEC_CRIT) ; - #/sbin/pvchange -> $(SEC_CRIT) ; - #/sbin/pvcreate -> $(SEC_CRIT) ; - #/sbin/pvdata -> $(SEC_CRIT) ; - #/sbin/pvdisplay -> $(SEC_CRIT) ; - #/sbin/pvmove -> $(SEC_CRIT) ; - #/sbin/pvscan -> $(SEC_CRIT) ; - /sbin/quotacheck -> $(SEC_CRIT) ; - /sbin/quotaon -> $(SEC_CRIT) ; - /sbin/raidstart -> $(SEC_CRIT) ; - /sbin/reiserfsck -> $(SEC_CRIT) ; - /sbin/resize2fs -> $(SEC_CRIT) ; - /sbin/resize_reiserfs -> $(SEC_CRIT) ; - /sbin/restore -> $(SEC_CRIT) ; - /sbin/restore.static -> $(SEC_CRIT) ; - /sbin/scsi_info -> $(SEC_CRIT) ; - /sbin/sfdisk -> $(SEC_CRIT) ; - /sbin/stinit -> $(SEC_CRIT) ; - #/sbin/tapeinfo -> $(SEC_CRIT) ; - /sbin/tune2fs -> $(SEC_CRIT) ; - /sbin/unpack -> $(SEC_CRIT) ; - /sbin/update -> $(SEC_CRIT) ; - #/sbin/vgcfgbackup -> $(SEC_CRIT) ; - #/sbin/vgcfgrestore -> $(SEC_CRIT) ; - #/sbin/vgchange -> $(SEC_CRIT) ; - #/sbin/vgck -> $(SEC_CRIT) ; - #/sbin/vgcreate -> $(SEC_CRIT) ; - #/sbin/vgdisplay -> $(SEC_CRIT) ; - #/sbin/vgexport -> $(SEC_CRIT) ; - #/sbin/vgextend -> $(SEC_CRIT) ; - #/sbin/vgimport -> $(SEC_CRIT) ; - #/sbin/vgmerge -> $(SEC_CRIT) ; - #/sbin/vgmknodes -> $(SEC_CRIT) ; - #/sbin/vgreduce -> $(SEC_CRIT) ; - #/sbin/vgremove -> $(SEC_CRIT) ; - #/sbin/vgrename -> $(SEC_CRIT) ; - #/sbin/vgscan -> $(SEC_CRIT) ; - #/sbin/vgsplit -> $(SEC_CRIT) ; - /bin/chgrp -> $(SEC_CRIT) ; - /bin/chmod -> $(SEC_CRIT) ; - /bin/chown -> $(SEC_CRIT) ; - /bin/cp -> $(SEC_CRIT) ; - /bin/cpio -> $(SEC_CRIT) ; - /bin/mount -> $(SEC_CRIT) ; - /bin/umount -> $(SEC_CRIT) ; - /bin/mkdir -> $(SEC_CRIT) ; - /bin/mknod -> $(SEC_CRIT) ; - /bin/mktemp -> $(SEC_CRIT) ; - /bin/rm -> $(SEC_CRIT) ; - /bin/rmdir -> $(SEC_CRIT) ; - /bin/touch -> $(SEC_CRIT) ; -} - - ################################## - # ## -################################## # -# # # -# Kernel Administration Programs # # -# ## -################################## - -( - rulename = "Kernel Administration Programs", - severity = $(SIG_HI) -) -{ - /sbin/adjtimex -> $(SEC_CRIT) ; - /sbin/ctrlaltdel -> $(SEC_CRIT) ; - /sbin/depmod -> $(SEC_CRIT) ; - /sbin/insmod -> $(SEC_CRIT) ; - /sbin/insmod.static -> $(SEC_CRIT) ; - /sbin/insmod_ksymoops_clean -> $(SEC_CRIT) ; - /sbin/klogd -> $(SEC_CRIT) ; - /sbin/ldconfig -> $(SEC_CRIT) ; - /sbin/minilogd -> $(SEC_CRIT) ; - /sbin/modinfo -> $(SEC_CRIT) ; - #/sbin/nuactlun -> $(SEC_CRIT) ; - #/sbin/nuscsitcpd -> $(SEC_CRIT) ; - /sbin/pivot_root -> $(SEC_CRIT) ; - /sbin/sndconfig -> $(SEC_CRIT) ; - /sbin/sysctl -> $(SEC_CRIT) ; -} - - ####################### - # ## -####################### # -# # # -# Networking Programs # # -# ## -####################### - -( - rulename = "Networking Programs", - severity = $(SIG_HI) -) -{ - /etc/sysconfig/network-scripts/ifdown -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-cipcb -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-ippp -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-ipv6 -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-isdn -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-post -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-ppp -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-sit -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifdown-sl -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-aliases -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-cipcb -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-ippp -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-ipv6 -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-isdn -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-plip -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-plusb -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-post -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-ppp -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-routes -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-sit -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-sl -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/ifup-wireless -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/network-functions -> $(SEC_CRIT) ; - /etc/sysconfig/network-scripts/network-functions-ipv6 -> $(SEC_CRIT) ; - /bin/ping -> $(SEC_CRIT) ; - /sbin/agetty -> $(SEC_CRIT) ; - /sbin/arp -> $(SEC_CRIT) ; - /sbin/arping -> $(SEC_CRIT) ; - /sbin/dhcpcd -> $(SEC_CRIT) ; - /sbin/ether-wake -> $(SEC_CRIT) ; - #/sbin/getty -> $(SEC_CRIT) ; - /sbin/ifcfg -> $(SEC_CRIT) ; - /sbin/ifconfig -> $(SEC_CRIT) ; - /sbin/ifdown -> $(SEC_CRIT) ; - /sbin/ifenslave -> $(SEC_CRIT) ; - /sbin/ifport -> $(SEC_CRIT) ; - /sbin/ifup -> $(SEC_CRIT) ; - /sbin/ifuser -> $(SEC_CRIT) ; - /sbin/ip -> $(SEC_CRIT) ; - /sbin/ip6tables -> $(SEC_CRIT) ; - /sbin/ipchains -> $(SEC_CRIT) ; - /sbin/ipchains-restore -> $(SEC_CRIT) ; - /sbin/ipchains-save -> $(SEC_CRIT) ; - /sbin/ipfwadm -> $(SEC_CRIT) ; - /sbin/ipmaddr -> $(SEC_CRIT) ; - /sbin/iptables -> $(SEC_CRIT) ; - /sbin/iptables-restore -> $(SEC_CRIT) ; - /sbin/iptables-save -> $(SEC_CRIT) ; - /sbin/iptunnel -> $(SEC_CRIT) ; - /sbin/ipvsadm -> $(SEC_CRIT) ; - /sbin/ipvsadm-restore -> $(SEC_CRIT) ; - /sbin/ipvsadm-save -> $(SEC_CRIT) ; - /sbin/ipx_configure -> $(SEC_CRIT) ; - /sbin/ipx_interface -> $(SEC_CRIT) ; - /sbin/ipx_internal_net -> $(SEC_CRIT) ; - /sbin/iwconfig -> $(SEC_CRIT) ; - /sbin/iwgetid -> $(SEC_CRIT) ; - /sbin/iwlist -> $(SEC_CRIT) ; - /sbin/iwpriv -> $(SEC_CRIT) ; - /sbin/iwspy -> $(SEC_CRIT) ; - /sbin/mgetty -> $(SEC_CRIT) ; - /sbin/mingetty -> $(SEC_CRIT) ; - /sbin/nameif -> $(SEC_CRIT) ; - /sbin/netreport -> $(SEC_CRIT) ; - /sbin/plipconfig -> $(SEC_CRIT) ; - /sbin/portmap -> $(SEC_CRIT) ; - /sbin/ppp-watch -> $(SEC_CRIT) ; - #/sbin/rarp -> $(SEC_CRIT) ; - /sbin/route -> $(SEC_CRIT) ; - /sbin/slattach -> $(SEC_CRIT) ; - /sbin/tc -> $(SEC_CRIT) ; - #/sbin/uugetty -> $(SEC_CRIT) ; - /sbin/vgetty -> $(SEC_CRIT) ; - /sbin/ypbind -> $(SEC_CRIT) ; -} - - ################################## - # ## -################################## # -# # # -# System Administration Programs # # -# ## -################################## - -( - rulename = "System Administration Programs", - severity = $(SIG_HI) -) -{ - /sbin/chkconfig -> $(SEC_CRIT) ; - /sbin/fuser -> $(SEC_CRIT) ; - /sbin/halt -> $(SEC_CRIT) ; - /sbin/init -> $(SEC_CRIT) ; - /sbin/initlog -> $(SEC_CRIT) ; - /sbin/install-info -> $(SEC_CRIT) ; - /sbin/killall5 -> $(SEC_CRIT) ; - #/sbin/linuxconf -> $(SEC_CRIT) ; - #/sbin/linuxconf-auth -> $(SEC_CRIT) ; - /sbin/pam_tally -> $(SEC_CRIT) ; - /sbin/pwdb_chkpwd -> $(SEC_CRIT) ; - #/sbin/remadmin -> $(SEC_CRIT) ; - /sbin/rescuept -> $(SEC_CRIT) ; - /sbin/rmt -> $(SEC_CRIT) ; - /sbin/rpc.lockd -> $(SEC_CRIT) ; - /sbin/rpc.statd -> $(SEC_CRIT) ; - /sbin/rpcdebug -> $(SEC_CRIT) ; - /sbin/service -> $(SEC_CRIT) ; - /sbin/setsysfont -> $(SEC_CRIT) ; - /sbin/shutdown -> $(SEC_CRIT) ; - /sbin/sulogin -> $(SEC_CRIT) ; - /sbin/swapon -> $(SEC_CRIT) ; - /sbin/syslogd -> $(SEC_CRIT) ; - /sbin/unix_chkpwd -> $(SEC_CRIT) ; - /bin/pwd -> $(SEC_CRIT) ; - /bin/uname -> $(SEC_CRIT) ; -} - - ######################################## - # ## -######################################## # -# # # -# Hardware and Device Control Programs # # -# ## -######################################## -( - rulename = "Hardware and Device Control Programs", - severity = $(SIG_HI) -) -{ - /bin/setserial -> $(SEC_CRIT) ; - /bin/sfxload -> $(SEC_CRIT) ; - /sbin/blockdev -> $(SEC_CRIT) ; - /sbin/cardctl -> $(SEC_CRIT) ; - /sbin/cardmgr -> $(SEC_CRIT) ; - /sbin/cbq -> $(SEC_CRIT) ; - /sbin/dump_cis -> $(SEC_CRIT) ; - /sbin/elvtune -> $(SEC_CRIT) ; - /sbin/hotplug -> $(SEC_CRIT) ; - /sbin/hwclock -> $(SEC_CRIT) ; - /sbin/ide_info -> $(SEC_CRIT) ; - #/sbin/isapnp -> $(SEC_CRIT) ; - #/sbin/kbdrate -> $(SEC_CRIT) ; - /sbin/losetup -> $(SEC_CRIT) ; - /sbin/lspci -> $(SEC_CRIT) ; - /sbin/lspnp -> $(SEC_CRIT) ; - /sbin/mii-tool -> $(SEC_CRIT) ; - /sbin/pack_cis -> $(SEC_CRIT) ; - #/sbin/pnpdump -> $(SEC_CRIT) ; - /sbin/probe -> $(SEC_CRIT) ; - #/sbin/pump -> $(SEC_CRIT) ; - /sbin/setpci -> $(SEC_CRIT) ; - /sbin/shapecfg -> $(SEC_CRIT) ; -} - - ############################### - # ## -############################### # -# # # -# System Information Programs # # -# ## -############################### -( - rulename = "System Information Programs", - severity = $(SIG_HI) -) -{ - /sbin/consoletype -> $(SEC_CRIT) ; - /sbin/kernelversion -> $(SEC_CRIT) ; - /sbin/runlevel -> $(SEC_CRIT) ; -} - - #################################### - # ## -#################################### # -# # # -# Application Information Programs # # -# ## -#################################### - -( - rulename = "Application Information Programs", - severity = $(SIG_HI) -) -{ - /sbin/genksyms -> $(SEC_CRIT) ; - #/sbin/genksyms.old -> $(SEC_CRIT) ; - /sbin/rtmon -> $(SEC_CRIT) ; -} - - ########################## - # ## -########################## # -# # # -# Shell Related Programs # # -# ## -########################## -( - rulename = "Shell Related Programs", - severity = $(SIG_HI) -) -{ - /sbin/getkey -> $(SEC_CRIT) ; - /sbin/nash -> $(SEC_CRIT) ; - /sbin/sash -> $(SEC_CRIT) ; -} - - - ################ - # ## -################ # -# # # -# OS Utilities # # -# ## -################ -( - rulename = "Operating System Utilities", - severity = $(SIG_HI) -) -{ - /bin/arch -> $(SEC_CRIT) ; - /bin/ash -> $(SEC_CRIT) ; - /bin/ash.static -> $(SEC_CRIT) ; - /bin/aumix-minimal -> $(SEC_CRIT) ; - /bin/basename -> $(SEC_CRIT) ; - /bin/cat -> $(SEC_CRIT) ; - #/bin/consolechars -> $(SEC_CRIT) ; - /bin/cut -> $(SEC_CRIT) ; - /bin/date -> $(SEC_CRIT) ; - /bin/dd -> $(SEC_CRIT) ; - /bin/df -> $(SEC_CRIT) ; - /bin/dmesg -> $(SEC_CRIT) ; - /bin/doexec -> $(SEC_CRIT) ; - /bin/echo -> $(SEC_CRIT) ; - /bin/ed -> $(SEC_CRIT) ; - /bin/egrep -> $(SEC_CRIT) ; - /bin/false -> $(SEC_CRIT) ; - /bin/fgrep -> $(SEC_CRIT) ; - /bin/gawk -> $(SEC_CRIT) ; - /bin/gawk-3.1.0 -> $(SEC_CRIT) ; - /bin/gettext -> $(SEC_CRIT) ; - /bin/grep -> $(SEC_CRIT) ; - /bin/gunzip -> $(SEC_CRIT) ; - /bin/gzip -> $(SEC_CRIT) ; - /bin/hostname -> $(SEC_CRIT) ; - /bin/igawk -> $(SEC_CRIT) ; - /bin/ipcalc -> $(SEC_CRIT) ; - /bin/kill -> $(SEC_CRIT) ; - /bin/ln -> $(SEC_CRIT) ; - /bin/loadkeys -> $(SEC_CRIT) ; - /bin/login -> $(SEC_CRIT) ; - /bin/ls -> $(SEC_CRIT) ; - /bin/mail -> $(SEC_CRIT) ; - /bin/more -> $(SEC_CRIT) ; - /bin/mt -> $(SEC_CRIT) ; - /bin/mv -> $(SEC_CRIT) ; - /bin/netstat -> $(SEC_CRIT) ; - /bin/nice -> $(SEC_CRIT) ; - /bin/pgawk -> $(SEC_CRIT) ; - /bin/ps -> $(SEC_CRIT) ; - /bin/rpm -> $(SEC_CRIT) ; - /bin/sed -> $(SEC_CRIT) ; - /bin/sleep -> $(SEC_CRIT) ; - /bin/sort -> $(SEC_CRIT) ; - /bin/stty -> $(SEC_CRIT) ; - /bin/su -> $(SEC_CRIT) ; - /bin/sync -> $(SEC_CRIT) ; - /bin/tar -> $(SEC_CRIT) ; - /bin/true -> $(SEC_CRIT) ; - /bin/usleep -> $(SEC_CRIT) ; - /bin/vi -> $(SEC_CRIT) ; - /bin/zcat -> $(SEC_CRIT) ; - /bin/zsh -> $(SEC_CRIT) ; - /bin/zsh-4.0.2 -> $(SEC_CRIT) ; - /sbin/sln -> $(SEC_CRIT) ; - /usr/bin/vimtutor -> $(SEC_CRIT) ; -} - - ############################## - # ## -############################## # -# # # -# Critical Utility Sym-Links # # -# ## -############################## -( - rulename = "Critical Utility Sym-Links", - severity = $(SIG_HI) -) -{ - #/sbin/askrunlevel -> $(SEC_CRIT) ; - /sbin/clock -> $(SEC_CRIT) ; - #/sbin/fixperm -> $(SEC_CRIT) ; - /sbin/fsck.reiserfs -> $(SEC_CRIT) ; - #/sbin/fsconf -> $(SEC_CRIT) ; - /sbin/ipfwadm-wrapper -> $(SEC_CRIT) ; - /sbin/kallsyms -> $(SEC_CRIT) ; - /sbin/ksyms -> $(SEC_CRIT) ; - /sbin/lsmod -> $(SEC_CRIT) ; - #/sbin/mailconf -> $(SEC_CRIT) ; - /sbin/mkfs.reiserfs -> $(SEC_CRIT) ; - #/sbin/modemconf -> $(SEC_CRIT) ; - /sbin/modprobe -> $(SEC_CRIT) ; - /sbin/mount.ncp -> $(SEC_CRIT) ; - /sbin/mount.ncpfs -> $(SEC_CRIT) ; - /sbin/mount.smb -> $(SEC_CRIT) ; - /sbin/mount.smbfs -> $(SEC_CRIT) ; - #/sbin/netconf -> $(SEC_CRIT) ; - /sbin/pidof -> $(SEC_CRIT) ; - /sbin/poweroff -> $(SEC_CRIT) ; - /sbin/quotaoff -> $(SEC_CRIT) ; - /sbin/raid0run -> $(SEC_CRIT) ; - /sbin/raidhotadd -> $(SEC_CRIT) ; - /sbin/raidhotgenerateerror -> $(SEC_CRIT) ; - /sbin/raidhotremove -> $(SEC_CRIT) ; - /sbin/raidstop -> $(SEC_CRIT) ; - /sbin/rdump -> $(SEC_CRIT) ; - /sbin/rdump.static -> $(SEC_CRIT) ; - /sbin/reboot -> $(SEC_CRIT) ; - /sbin/rmmod -> $(SEC_CRIT) ; - /sbin/rrestore -> $(SEC_CRIT) ; - /sbin/rrestore.static -> $(SEC_CRIT) ; - /sbin/swapoff -> $(SEC_CRIT) ; - /sbin/telinit -> $(SEC_CRIT) ; - #/sbin/userconf -> $(SEC_CRIT) ; - #/sbin/uucpconf -> $(SEC_CRIT) ; - #/sbin/vregistry -> $(SEC_CRIT) ; - /bin/awk -> $(SEC_CRIT) ; - /bin/bash2 -> $(SEC_CRIT) ; - /bin/bsh -> $(SEC_CRIT) ; - /bin/csh -> $(SEC_CRIT) ; - /bin/dnsdomainname -> $(SEC_CRIT) ; - /bin/domainname -> $(SEC_CRIT) ; - /bin/ex -> $(SEC_CRIT) ; - /bin/gtar -> $(SEC_CRIT) ; - /bin/nisdomainname -> $(SEC_CRIT) ; - /bin/red -> $(SEC_CRIT) ; - /bin/rvi -> $(SEC_CRIT) ; - /bin/rview -> $(SEC_CRIT) ; - /bin/view -> $(SEC_CRIT) ; - /bin/ypdomainname -> $(SEC_CRIT) ; -} - - - ######################### - # ## -######################### # -# # # -# Temporary directories # # -# ## -######################### -( - rulename = "Temporary directories", - recurse = false, - severity = $(SIG_LOW) -) -{ - /usr/tmp -> $(SEC_INVARIANT) ; - /var/tmp -> $(SEC_INVARIANT) ; - /tmp -> $(SEC_INVARIANT) ; -} - - ############### - # ## -############### # -# # # -# Local files # # -# ## -############### -( - rulename = "User binaries", - severity = $(SIG_MED) -) -{ - /sbin -> $(SEC_BIN) (recurse = 1) ; - /usr/bin -> $(SEC_BIN) (recurse = 1) ; - /usr/sbin -> $(SEC_BIN) (recurse = 1) ; - /usr/local/bin -> $(SEC_BIN) (recurse = 1) ; -} - -( - rulename = "Shell Binaries", - severity = $(SIG_HI) -) -{ - /bin/bash -> $(SEC_BIN) ; - /bin/ksh -> $(SEC_BIN) ; - # /bin/psh -> $(SEC_BIN) ; # No longer used? - # /bin/Rsh -> $(SEC_BIN) ; # No longer used? - /bin/sh -> $(SEC_BIN) ; - # /bin/shell -> $(SEC_SUID) ; # No longer used? - # /bin/tsh -> $(SEC_BIN) ; # No longer used? - /bin/tcsh -> $(SEC_BIN) ; - /sbin/nologin -> $(SEC_BIN) ; -} - -( - rulename = "Security Control", - severity = $(SIG_HI) -) -{ - /etc/group -> $(SEC_CRIT) ; - /etc/security -> $(SEC_CRIT) ; - #/var/spool/cron/crontabs -> $(SEC_CRIT) ; # Uncomment when this file exists -} - -#( -# rulename = "Boot Scripts", -# severity = $(SIG_HI) -#) -#{ -# /etc/rc -> $(SEC_CONFIG) ; -# /etc/rc.bsdnet -> $(SEC_CONFIG) ; -# /etc/rc.dt -> $(SEC_CONFIG) ; -# /etc/rc.net -> $(SEC_CONFIG) ; -# /etc/rc.net.serial -> $(SEC_CONFIG) ; -# /etc/rc.nfs -> $(SEC_CONFIG) ; -# /etc/rc.powerfail -> $(SEC_CONFIG) ; -# /etc/rc.tcpip -> $(SEC_CONFIG) ; -# /etc/trcfmt.Z -> $(SEC_CONFIG) ; -#} - -( - rulename = "Login Scripts", - severity = $(SIG_HI) -) -{ - /etc/bashrc -> $(SEC_CONFIG) ; - /etc/csh.cshrc -> $(SEC_CONFIG) ; - /etc/csh.login -> $(SEC_CONFIG) ; - /etc/inputrc -> $(SEC_CONFIG) ; - # /etc/tsh_profile -> $(SEC_CONFIG) ; #Uncomment when this file exists - /etc/profile -> $(SEC_CONFIG) ; -} - -# Libraries -( - rulename = "Libraries", - severity = $(SIG_MED) -) -{ - /usr/lib -> $(SEC_BIN) ; - /usr/local/lib -> $(SEC_BIN) ; -} - - - ###################################################### - # ## -###################################################### # -# # # -# Critical System Boot Files # # -# These files are critical to a correct system boot. # # -# ## -###################################################### - -( - rulename = "Critical system boot files", - severity = $(SIG_HI) -) -{ - /boot -> $(SEC_CRIT) ; - #/sbin/devfsd -> $(SEC_CRIT) ; - /sbin/grub -> $(SEC_CRIT) ; - /sbin/grub-install -> $(SEC_CRIT) ; - /sbin/grub-md5-crypt -> $(SEC_CRIT) ; - /sbin/installkernel -> $(SEC_CRIT) ; - /sbin/lilo -> $(SEC_CRIT) ; - /sbin/mkkerneldoth -> $(SEC_CRIT) ; - !/boot/System.map ; - !/boot/module-info ; - /usr/share/grub/i386-redhat/e2fs_stage1_5 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/fat_stage1_5 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/ffs_stage1_5 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/minix_stage1_5 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/reiserfs_stage1_5 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/stage1 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/stage2 -> $(SEC_CRIT) ; - /usr/share/grub/i386-redhat/vstafs_stage1_5 -> $(SEC_CRIT) ; - # other boot files may exist. Look for: - #/ufsboot -> $(SEC_CRIT) ; -} - ################################################## - ################################################### - # These files change every time the system boots ## - ################################################## -( - rulename = "System boot changes", - severity = $(SIG_HI) -) -{ - !/var/run/ftp.pids-all ; # Comes and goes on reboot. - !/root/.enlightenment ; - /dev/log -> $(SEC_CONFIG) ; - /dev/cua0 -> $(SEC_CONFIG) ; - # /dev/printer -> $(SEC_CONFIG) ; # Uncomment if you have a printer device - /dev/console -> $(SEC_CONFIG) -u ; # User ID may change on console login/logout. - /dev/tty1 -> $(SEC_CONFIG) ; # tty devices - /dev/tty2 -> $(SEC_CONFIG) ; # tty devices - /dev/tty3 -> $(SEC_CONFIG) ; # are extremely - /dev/tty4 -> $(SEC_CONFIG) ; # variable - /dev/tty5 -> $(SEC_CONFIG) ; - /dev/tty6 -> $(SEC_CONFIG) ; - /dev/urandom -> $(SEC_CONFIG) ; - /dev/initctl -> $(SEC_CONFIG) ; - /var/lock/subsys -> $(SEC_CONFIG) ; - /var/lock/subsys/amd -> $(SEC_CONFIG) ; - /var/lock/subsys/anacron -> $(SEC_CONFIG) ; - /var/lock/subsys/apmd -> $(SEC_CONFIG) ; - /var/lock/subsys/arpwatch -> $(SEC_CONFIG) ; - /var/lock/subsys/atd -> $(SEC_CONFIG) ; - /var/lock/subsys/autofs -> $(SEC_CONFIG) ; - /var/lock/subsys/bcm5820 -> $(SEC_CONFIG) ; - /var/lock/subsys/bgpd -> $(SEC_CONFIG) ; - /var/lock/subsys/bootparamd -> $(SEC_CONFIG) ; - /var/lock/subsys/canna -> $(SEC_CONFIG) ; - /var/lock/subsys/crond -> $(SEC_CONFIG) ; - /var/lock/subsys/cWnn -> $(SEC_CONFIG) ; - /var/lock/subsys/dhcpd -> $(SEC_CONFIG) ; - /var/lock/subsys/firewall -> $(SEC_CONFIG) ; - /var/lock/subsys/freeWnn -> $(SEC_CONFIG) ; - /var/lock/subsys/gated -> $(SEC_CONFIG) ; - /var/lock/subsys/gpm -> $(SEC_CONFIG) ; - /var/lock/subsys/httpd -> $(SEC_CONFIG) ; - /var/lock/subsys/identd -> $(SEC_CONFIG) ; - /var/lock/subsys/innd -> $(SEC_CONFIG) ; - /var/lock/subsys/ipchains -> $(SEC_CONFIG) ; - /var/lock/subsys/iptables -> $(SEC_CONFIG) ; - /var/lock/subsys/ipvsadm -> $(SEC_CONFIG) ; - /var/lock/subsys/irda -> $(SEC_CONFIG) ; - /var/lock/subsys/iscsi -> $(SEC_CONFIG) ; - /var/lock/subsys/isdn -> $(SEC_CONFIG) ; - /var/lock/subsys/junkbuster -> $(SEC_CONFIG) ; - /var/lock/subsys/kadmin -> $(SEC_CONFIG) ; - /var/lock/subsys/keytable -> $(SEC_CONFIG) ; - /var/lock/subsys/kprop -> $(SEC_CONFIG) ; - /var/lock/subsys/krb524 -> $(SEC_CONFIG) ; - /var/lock/subsys/krb5kdc -> $(SEC_CONFIG) ; - /var/lock/subsys/kudzu -> $(SEC_CONFIG) ; - /var/lock/subsys/kWnn -> $(SEC_CONFIG) ; - /var/lock/subsys/ldap -> $(SEC_CONFIG) ; - /var/lock/subsys/linuxconf -> $(SEC_CONFIG) ; - /var/lock/subsys/lpd -> $(SEC_CONFIG) ; - /var/lock/subsys/mars_nwe -> $(SEC_CONFIG) ; - /var/lock/subsys/mcserv -> $(SEC_CONFIG) ; - /var/lock/subsys/mysqld -> $(SEC_CONFIG) ; - /var/lock/subsys/named -> $(SEC_CONFIG) ; - /var/lock/subsys/netfs -> $(SEC_CONFIG) ; - /var/lock/subsys/network -> $(SEC_CONFIG) ; - /var/lock/subsys/nfs -> $(SEC_CONFIG) ; - /var/lock/subsys/nfslock -> $(SEC_CONFIG) ; - /var/lock/subsys/nscd -> $(SEC_CONFIG) ; - /var/lock/subsys/ntpd -> $(SEC_CONFIG) ; - /var/lock/subsys/ospf6d -> $(SEC_CONFIG) ; - /var/lock/subsys/ospfd -> $(SEC_CONFIG) ; - /var/lock/subsys/pcmcia -> $(SEC_CONFIG) ; - /var/lock/subsys/portmap -> $(SEC_CONFIG) ; - /var/lock/subsys/postgresql -> $(SEC_CONFIG) ; - /var/lock/subsys/pxe -> $(SEC_CONFIG) ; - /var/lock/subsys/radvd -> $(SEC_CONFIG) ; - /var/lock/subsys/random -> $(SEC_CONFIG) ; - /var/lock/subsys/rarpd -> $(SEC_CONFIG) ; - /var/lock/subsys/reconfig -> $(SEC_CONFIG) ; - /var/lock/subsys/rhnsd -> $(SEC_CONFIG) ; - /var/lock/subsys/ripd -> $(SEC_CONFIG) ; - /var/lock/subsys/ripngd -> $(SEC_CONFIG) ; - /var/lock/subsys/routed -> $(SEC_CONFIG) ; - /var/lock/subsys/rstatd -> $(SEC_CONFIG) ; - /var/lock/subsys/rusersd -> $(SEC_CONFIG) ; - /var/lock/subsys/rwalld -> $(SEC_CONFIG) ; - /var/lock/subsys/rwhod -> $(SEC_CONFIG) ; - /var/lock/subsys/sendmail -> $(SEC_CONFIG) ; - /var/lock/subsys/smb -> $(SEC_CONFIG) ; - /var/lock/subsys/snmpd -> $(SEC_CONFIG) ; - /var/lock/subsys/squid -> $(SEC_CONFIG) ; - /var/lock/subsys/sshd -> $(SEC_CONFIG) ; - /var/lock/subsys/syslog -> $(SEC_CONFIG) ; - /var/lock/subsys/tux -> $(SEC_CONFIG) ; - /var/lock/subsys/tWnn -> $(SEC_CONFIG) ; - /var/lock/subsys/ups -> $(SEC_CONFIG) ; - /var/lock/subsys/vncserver -> $(SEC_CONFIG) ; - /var/lock/subsys/wine -> $(SEC_CONFIG) ; - /var/lock/subsys/xfs -> $(SEC_CONFIG) ; - /var/lock/subsys/xinetd -> $(SEC_CONFIG) ; - /var/lock/subsys/ypbind -> $(SEC_CONFIG) ; - /var/lock/subsys/yppasswdd -> $(SEC_CONFIG) ; - /var/lock/subsys/ypserv -> $(SEC_CONFIG) ; - /var/lock/subsys/ypxfrd -> $(SEC_CONFIG) ; - /var/lock/subsys/zebra -> $(SEC_CONFIG) ; - /var/run -> $(SEC_CONFIG) ; - /var/log -> $(SEC_CONFIG) ; - /etc/ioctl.save -> $(SEC_CONFIG) ; - /etc/issue.net -> $(SEC_CONFIG) -i ; # Inode number changes - /etc/issue -> $(SEC_CONFIG) ; - /etc/mtab -> $(SEC_CONFIG) -i ; # Inode number changes on any mount/unmount - /lib/modules -> $(SEC_CONFIG) ; - /etc/.pwd.lock -> $(SEC_CONFIG) ; - # /lib/modules/preferred -> $(SEC_CONFIG) ; #Uncomment when this file exists -} - -# These files change the behavior of the root account -( - rulename = "Root config files", - severity = 100 -) -{ - /root -> $(SEC_CRIT) ; # Catch all additions to /root - /root/.Xresources -> $(SEC_CONFIG) ; - /root/.bashrc -> $(SEC_CONFIG) ; - /root/.bash_profile -> $(SEC_CONFIG) ; - /root/.bash_logout -> $(SEC_CONFIG) ; - /root/.cshrc -> $(SEC_CONFIG) ; - /root/.tcshrc -> $(SEC_CONFIG) ; - #/root/Mail -> $(SEC_CONFIG) ; - #/root/mail -> $(SEC_CONFIG) ; - #/root/.amandahosts -> $(SEC_CONFIG) ; - #/root/.addressbook.lu -> $(SEC_CONFIG) ; - #/root/.addressbook -> $(SEC_CONFIG) ; - /root/.bash_history -> $(SEC_CONFIG) ; - #/root/.elm -> $(SEC_CONFIG) ; - /root/.esd_auth -> $(SEC_CONFIG) ; - /root/.gnome_private -> $(SEC_CONFIG) ; - /root/.gnome-desktop -> $(SEC_CONFIG) ; - /root/.gnome -> $(SEC_CONFIG) ; - /root/.ICEauthority -> $(SEC_CONFIG) ; - #/root/.mc -> $(SEC_CONFIG) ; - #/root/.pinerc -> $(SEC_CONFIG) ; - #/root/.sawfish -> $(SEC_CONFIG) ; - /root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login - #/root/.xauth -> $(SEC_CONFIG) ; - #/root/.xsession-errors -> $(SEC_CONFIG) ; -} - - ################################ - # ## -################################ # -# # # -# Critical configuration files # # -# ## -################################ -( - rulename = "Critical configuration files", - severity = $(SIG_HI) -) -{ - #/etc/conf.linuxconf -> $(SEC_BIN) ; - /etc/crontab -> $(SEC_BIN) ; - /etc/cron.hourly -> $(SEC_BIN) ; - /etc/cron.daily -> $(SEC_BIN) ; - /etc/cron.weekly -> $(SEC_BIN) ; - /etc/cron.monthly -> $(SEC_BIN) ; - /etc/default -> $(SEC_BIN) ; - /etc/fstab -> $(SEC_BIN) ; - /etc/exports -> $(SEC_BIN) ; - /etc/group- -> $(SEC_BIN) ; # changes should be infrequent - /etc/host.conf -> $(SEC_BIN) ; - /etc/hosts.allow -> $(SEC_BIN) ; - /etc/hosts.deny -> $(SEC_BIN) ; - /etc/httpd/conf -> $(SEC_BIN) ; # changes should be infrequent - /etc/protocols -> $(SEC_BIN) ; - /etc/services -> $(SEC_BIN) ; - /etc/rc.d/init.d -> $(SEC_BIN) ; - /etc/rc.d -> $(SEC_BIN) ; - /etc/mail.rc -> $(SEC_BIN) ; - /etc/modules.conf -> $(SEC_BIN) ; - /etc/motd -> $(SEC_BIN) ; - /etc/named.conf -> $(SEC_BIN) ; - /etc/passwd -> $(SEC_CONFIG) ; - /etc/passwd- -> $(SEC_CONFIG) ; - /etc/profile.d -> $(SEC_BIN) ; - /var/lib/nfs/rmtab -> $(SEC_BIN) ; - /usr/sbin/fixrmtab -> $(SEC_BIN) ; - /etc/rpc -> $(SEC_BIN) ; - /etc/sysconfig -> $(SEC_BIN) ; - /etc/samba/smb.conf -> $(SEC_CONFIG) ; - #/etc/gettydefs -> $(SEC_BIN) ; - /etc/nsswitch.conf -> $(SEC_BIN) ; - /etc/yp.conf -> $(SEC_BIN) ; - /etc/hosts -> $(SEC_CONFIG) ; - /etc/xinetd.conf -> $(SEC_CONFIG) ; - /etc/inittab -> $(SEC_CONFIG) ; - /etc/resolv.conf -> $(SEC_CONFIG) ; - /etc/syslog.conf -> $(SEC_CONFIG) ; -} - - #################### - # ## -#################### # -# # # -# Critical devices # # -# ## -#################### -( - rulename = "Critical devices", - severity = $(SIG_HI), - recurse = false -) -{ - /dev/kmem -> $(Device) ; - /dev/mem -> $(Device) ; - /dev/null -> $(Device) ; - /dev/zero -> $(Device) ; - /proc/devices -> $(Device) ; - /proc/net -> $(Device) ; - /proc/sys -> $(Device) ; - /proc/cpuinfo -> $(Device) ; - /proc/modules -> $(Device) ; - /proc/mounts -> $(Device) ; - /proc/dma -> $(Device) ; - /proc/filesystems -> $(Device) ; - /proc/pci -> $(Device) ; - /proc/interrupts -> $(Device) ; - /proc/driver/rtc -> $(Device) ; - /proc/ioports -> $(Device) ; - /proc/scsi -> $(Device) ; - /proc/kcore -> $(Device) ; - /proc/self -> $(Device) ; - /proc/kmsg -> $(Device) ; - /proc/stat -> $(Device) ; - /proc/ksyms -> $(Device) ; - /proc/loadavg -> $(Device) ; - /proc/uptime -> $(Device) ; - /proc/locks -> $(Device) ; - /proc/version -> $(Device) ; - /proc/mdstat -> $(Device) ; - /proc/meminfo -> $(Device) ; - /proc/cmdline -> $(Device) ; - /proc/misc -> $(Device) ; -} - -# Rest of critical system binaries -( - rulename = "OS executables and libraries", - severity = $(SIG_HI) -) -{ - /bin -> $(SEC_BIN) ; - /lib -> $(SEC_BIN) ; -} - -#============================================================================= -# -# Copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, -# Inc. in the United States and other countries. All rights reserved. -# -# Linux is a registered trademark of Linus Torvalds. -# -# UNIX is a registered trademark of The Open Group. -# -#============================================================================= -# -# Permission is granted to make and distribute verbatim copies of this document -# provided the copyright notice and this permission notice are preserved on all -# copies. -# -# Permission is granted to copy and distribute modified versions of this -# document under the conditions for verbatim copying, provided that the entire -# resulting derived work is distributed under the terms of a permission notice -# identical to this one. -# -# Permission is granted to copy and distribute translations of this document -# into another language, under the above conditions for modified versions, -# except that this permission notice may be stated in a translation approved by -# Tripwire, Inc. -# -# DCM diff --git a/app-admin/tripwire/files/twpol.txt.gz b/app-admin/tripwire/files/twpol.txt.gz new file mode 100644 index 0000000000000000000000000000000000000000..e7257952b3a4aa8422f103fdb52f06673fb91af0 GIT binary patch literal 7586 zcmV;T9bMudiwFo6@)th>19W$AZ)`4fcys{lUF(nAHn#she}%TQKoZ>8lT4amZ;RaB zyqXL;&GgPpTl9Vz&=MtUEs+XI+2bzqzwbGeY|9T);)#nbE*caKV*7UvALq?i6rCRR z&q;I|9q|tkJZ}3UAb8XUx(NO#i#%RNXz@$o1_s*Ae_@raa>JtgJwoZ&h9` za>ct6K8~UbgFnoL;UWQ1XF6h0Rj`;xMs5gd!<30)#hJ-P7A+HI!}0{r?M`RD9h&@`9)mFI-5dEK`TpWh7?;ZEZK}h z(=#a(U#oy2DD#9H!&MZ^Iaj*r&E6QsQlxoStA-U5Nu+sPtK2Lj!Fi&gf3G6L?@fe6 z@Ha9A>M)p9hh4tua?FYXM%XOi`?0w<Vcv~0T5Z6UwUwbc=XLyv6RP|7t5HH_3sil9xu zqTn@-Wn0=7Iq+Etwge+zE~Q;Xb8qX(B#f|R_4_Qgi3 zW%LGT+sfwlqzDExoQ$Iz4kCJWb@T4+#r3;4w^!G{zWMO(&G#1{-@m-Q{^=da&9+5) zvo$Rnf?K2TJ4GU2M(|z9@&Z(%s-&_KFC?l(T-4UggItstJ%F6EBx%%pt(xOQ1YaeI z9h(OnDI59nL4yG?s$p&tI|pd2HU8b0Lk_CaeEkr(fQrVlELlsCrD%gKNsX!rIsr5b zP%Ya$3lLp)_-WgN#v-~>*Uw=klM^U}^g`BV=`kAR5%}(@|r@6=*NA<@r4q#xx zY@)y?*ful>X6?;Q4&Gq0w7S!N)~Jt;!7Q4_Z-EzFb_o8!L=C@NS}%e~AfKmJ50Oi) zZ4kJ2{f)7JpQB2nVOqPiwO`(644zx_A|3yKRK0)vV`VkpUtYa_b$N38%k|aO?aQ-T zt1~^x#kcUu>x+-uAN+WA`SPnXZsIf3I;^koYUTMLya7=H~l%zaBzdIzGRC z_v6*|?Ez|MjVXm6eYm>0{rKvKcP|SG0qzunm2bP<`R?ZA=G~jSH`f=p&EUO^{`&AD z6A*rUgz)9j=;i~9zQsv;0}dbu5>`TV6Nbi2pmfAjCNgdb-TZX%wujK`T!7{Q2^%7y zP+1T}Z#VDZ@3df<2GedVJs8tyL+_fi~^Mwe>E zRhjE1BT`)+7w@49zpT6P?Aa~@%L8U}6d#ZU94!bbN-(7*e6vo*AcAMHvDANf_jXPF z#S02`oo50Pl^A1(LmWO_L~9ODpFG)TaafL#dY5!1Awki|a9$TMK5UW~zzIC?=_dAE z$=%6A@XHuPflzVa`_g&mh?6tr2?*X=AGbqn*&*e)@Qo#I*nVo-g75*G*LT z*upXE^o;n1L*JN#s9oK@`zHDY)2vd?dFxLl1h34%h=OKX9!B;M(FfD5?O-hWF zmS@}UGNl4N3AeAfC0qpcV@?{q19-7{jqCaN(?s0)`e(|_h<$181qV~03GC1{c{TkNx0kS(lnTQC3# z&TTc(NH9}dGu9>8O;EsWt}5;;gT9{f^YJrCf2=XzaH*J??zT`HRmWg&dDDgtf%Eax z@gE^;T%~Bc zXlu5*UA8MBc9o(WA7u>x*lFlc!?_g(^_tG(8Ze}IdVGp)z;cbT+Dde2(OR^kc$|Q3 zHPtu~SPFg?>_uyTVUl`W`-&@}-?I*2|5ZRX=AfhBUggw>SKnklyitdLoTQ@mQu zu!yEKBeP9urWq#qXouJ3)%!Lku`$#e;3Ear;8vA}#F5=AEVK)>wJ?57RYma(tgfx3 z+XUarai(Nl?d47vVvdDSXn&`Aa5#H{{C$-^oedGWb=TIVi%qx)M4vP#FD}&-BaFE5B;21`9Km>79Ki@TxNswEaReh=&JL<=zo3<~ zYEGF3#qxxNbH-49oL;bspz@`;k0^3hvGNXLQ!NXA$EvDW4#p|0BZl*fiSt)comxe8 zYSkQ9w+M4lQN3X`_ZVM4kY+_~I^vFL{5W^I=ER{gHT&NKaji0iwo`GP|K>K_J-9oU z4*PIMDjq&A4bGL&IB`1G`5kWK59Fu)IfWZ%PYUnnY zU0g0HxKh@_5O8%5(8+I>v$T1`#fy(%7Ar^LFNA; zs|wAJzUNBt;>*@21~qAa4Z_cQ;Ic#VPu!z_9~vjbMis0uiKCqBDX&*P3**G)LVp3y zSt#$p-Oco}l(N!yalyOx+liYMGD`?)XpuCVU4rv$n0gOOH%=y=aMa_FM9pGT)PexS zVBN%35|}XOb7}6Bl!4V_ExbeO#w|5;@Hm#qWsckm?=%BQB zDN%JSO0_=Di0^3~ozmXaQ7I`|o1MIxNJ;PKpj1l5vGfjis1;o6FQT;icUp_Md#v^d zlv>qsifYV$Na8*PS(7bwKa2u-*#>G>X3mp-0qr+wE zew;oyhaOzI2-vaJ!IgNA1p((9&VF3@xU{(7aWS&G4Lo)33_ zx4O)S2jcMDqe@v!!U|B3RwpY^cveLS6!ik$uc&9fz! z6^0a{`F2h8;MS*)!piq}qITq{al6a+c~JoFdH6O?ym=3&f(#ttv9hpzYsOxa6lg;i z$>a{i2L2ATp}cfo!QtQ96W6>l!MM_pk^xo4V>}R(5OBCmM8MfIBf&m`t9c%WZ?5J4fk<5pPTfY>Qnkj~!)G7SEyG#d&b8fERPz+ZY~!NK+McctkK= z#5fb-kwn7p!ZvQU{xa9B5|o|nvq_>ndobNw2qXx19iCMcx{7nkmIdwWpD(-3M@Guv zsts;v4U@Fh=5SH@PFcDcDme+u{#Fc$XF6g2d{g0Z?X2SN5;n;d^?9IvYu@V_wlc7b z&Ry&Q-le}8uDt6I!+}Xxb6mtMD;_jWGrM1Fb;El=gjtIM+Eg4p(ijwF40PMW;(+%0 z=c+2&+cT*19@4b^)Vr?%!{i|20{4f78>AI*j90gW2!bg+5p}R2c&6VwvcAb_b$W_V zGF8!^pnAB zLGe14L%-T5wKw8d6<5vGLahN^Qydg{Gv(dz>kPd8W9P+ru1E0T>N39{t!{=Lj>AhJ zeJP=HCp$CYHQ$aGilKpeiqb8o`=`Mc-F)#A6DaMU9EEhq8A>(D6% zChwUDC$5TFLC}ZU`iYn@Tp?)sfMprHlr9|SscQOgn%2(s10$h0&v{xe&Jf!2UpX^Q!hnK!5OAV{EVte za#r_DgbO#%Y2)%+Peka%5d&qwjlLc~8J~x5auA{X@WGL0Y)VsaZbAOyaz;-fqqk1b zS8iy2uzro9$$XZO2$iGD9CG>of<a$i{^&F}HO zj^O;*-bWU6<=*KU=v;9hu%B|YP^_x<_d&P|c&sSG3O+5)1M*kcy{EA~m*GIH;TanL zr9_mOfOhgSX#2w&=c}@NaJ4XF;W|Fvk4rTHr^^Y6AK(V_J6&(d^U1d7v}7Vvf~Zw; z!IeydC8oIuCme?t;XF~bpx~y!GD%3djN=PAhTG>s18}bUB6=?RkyUX2{P%(Saqfbb zXLruTb+Wc+cTT8jYH|J>f_ia|F8X(&q~UsGc;VZ#=Gln}wlmE1uD5W;6$v<3Jj4Bi z%dohwr##~;bWYDHIAVMn6LE>qiNwps9Yqs&9nb^v)#dJK@qX5m(75wvTK^O=A5}dG zjR(gU1Y8fyiCb3w863FWG9b6`#q^$hpnW!z<26f6Ew`@9_u@S4_Fox0MBXM2o7>}U zMfhMYae4L2dhrHxHd78fnbooXQJ~Wz|-wa`^$;+wPp|z`&O8zJ$@pePaMm?L*Fc1 z`>o*}*_5+~x}P=dbX8{z0^0W^qe6-dgav|#qL&v~|cPzT+VVxKe#bZGX(`HERcWQc}WS5g*dv6906 z&#;OADuAsgW9+*`n^%_YgNE9^k-7J-(`(EiZkki@L*8(*y;AYeaH;zuP757Rbh3Xw zaTqi)WUg+OL!e{l#^WAns;OLUR-ZZ+p8QY~S9wL?YE+z-X8eC4&;uHFX*F~sRQ>9O z_Fct6Bh@0ojErLs*pKwt5;rmzRc$=YJ%~JQhgeVVDkZI64#P&LeTv;S%SYDHEcEy>SiH}~ApV*_m^|!NV(eB!^#=3de*bls& z^7dI<-MlWoB4lL5)~_t;hAI}3#`I?i$zyZkUN-5ptm#Fc6^Ssc@D;-x&NfHzcZh62@?Y8?{FrgK=f@d=#r?WrpKgR?R-<0DeVYNJ{_8S;H!k`zIq0Qwu!$$>&tMDa;9M`pu`u8nUmQ%C!_jPOoa`?zSwit32S%XI?7 z4o|~&h;jalO=?t)4@yrSn5Swkzz266H7(ZLbk2`N=UEsX40HHBF81+a zxlQToFiQ5B(n-O$i9Dx?7$9HJkhKDxkR<_$i(k&;r%q(^er!BD)Ad9zH63}z%7ls( z467X!WVOR|I8s&H_tFeU8gf5tBU4R5PU7A+*L7Q=4fWjEtEOjKmYg zAfX|D5rWoFyz`L8GtCuWbOZU}NX7Y9g9jrsw)2M7aOCc8*uluDF~kwd6L5S92`L0o zZuhPT3_$K&q8EVNxt?w~Qtdp*I~<9ZvlEdCQCI$1i`k^sn+Rwya<+RD&2S`N+G!ym zE496yXE;(#o}YhBMb5e}XAVc!$!|5SwPf2@B&;GLcW+M`j;yHuvt&x&i3LFt${6qN zA@N-5PX)<>Vd_M)nu42DQ;~R~F$KB1WD$bg-hMnBsbivz7ls58rU)RA?g4oGQ0~6d6fw z?Twf;WUU6QEv68`roZxOK;pZ z5Wf3Y2=FzQ-QIgB+#)d0v_&3(Zvj`N*2GGbDoXpvukXxIyVkDwMsf)Z`{N9ULvl1P z%1oqw%hW#8;VlO_PRC3MjoDVs)aTx1dqsxAyMr$pd5|}qv7(X3?3?!pH1qc7su^qo zvS(T!-jn$gkhwP4sXx|37PmjdW{CGhxQiRYG;^HMlvU7GV^ap(jN6b}Pr{Ypvi1{8 z@^Zf5vz>*S+70OV?8v_zGix3#e51unz{3stt(iI%REP68Df)jV)X2>o57Zefmi>X3 zu1YzN-+w{%u^&V&h9P9whqE^*2g4G~!3fSqys^FPhN7$KXL?DERTW9%HZt>>LNdmZ zu?Ee5d3sue%ZJo(ImT+pQHqW(#eUm2eBeUwRyAue$gFw3JpYN)>@2yh zA>p=Fk*k6|m^pcS2JY2EE$u1CfvLW_ChES;p63hf>Q;l>jH0jCd>tLy5;3KthK&J7 z@BOuTBiHr4$!{S9+x@tz<+|d17f(6zc(qUYv zGdT0}BKE^7%lBaX zU=E^w9}1ig;oI4U#4p`upF`95Qsa?M6V7V3IqW05VRd7Y%?WufGt4ox+uWMRbDCI| z+UA9)0(07St!Vu_%)BgdoeAdyxlw9rnsn3;F?4AtINHz#3fyT{l&_l2jneK;iyl|+uw@zZBCDUWnRNmx*yP`eq72_*>PMY4uR+3Ic^qs{%Xw&Z zZadeb8#g&baj0Dt=m%q`C7L>eR;#xeI`8Rg>7f;B6=p?YJ5#pbCZa$qq}L7OpjGYC zIdnc?;NO+pEkzGXv>E3{)$&FvkxEPIDsq*{-~L(X5uNJQZN=H#m0;aL{Y!x@rl&bC z5X%)Be|6+dahi;6k$Ythg-R-I#gX^F{mg%NWEgb)X~6P};@79Ar{e1%dwjtCL-C@j z^73OLK`@2sXe2N)G7gN3mJK@;^#ycyZ(veUOye6^UhubHK*MIinpzzSa-ew2;&-@@ ziM)o ${T}/twcfg.txt || ewarn "twcfg.txt zcat error" insinto /etc/tripwire - doins ${FILESDIR}/twcfg.txt ${FILESDIR}/twpol.txt + doins ${T}/twcfg.txt ${FILESDIR}/twpol.txt exeinto /etc/tripwire doexe ${FILESDIR}/twinstall.sh diff --git a/app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild b/app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild new file mode 100644 index 000000000000..e734cb91e059 --- /dev/null +++ b/app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild @@ -0,0 +1,100 @@ +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-admin/tripwire/tripwire-2.3.1.2-r2.ebuild,v 1.1 2004/12/13 18:36:20 taviso Exp $ + +inherit eutils flag-o-matic + +TW_VER="2.3.1-2" +DESCRIPTION="Open Source File Integrity Checker and IDS" +HOMEPAGE="http://www.tripwire.org/" +SRC_URI="mirror://sourceforge/tripwire/tripwire-${TW_VER}.tar.gz + mirror://gentoo/tripwire-2.3.1-2-pherman-portability-0.9.diff.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~x86" +IUSE="ssl" + +DEPEND="virtual/libc + sys-devel/automake + sys-devel/autoconf + dev-util/patchutils + ssl? ( dev-libs/openssl )" +RDEPEND="virtual/libc + virtual/cron + virtual/mta + ssl? ( dev-libs/openssl )" + +S=${WORKDIR}/tripwire-${TW_VER} + +src_unpack() { + # unpack tripwire source tarball + unpack tripwire-${TW_VER}.tar.gz; cd ${S} + + # Paul Herman has been maintaining some updates to tripwire + # including autoconf support and portability fixes. + # http://www.frenchfries.net/paul/tripwire/ + epatch ${DISTDIR}/tripwire-2.3.1-2-pherman-portability-0.9.diff.bz2 + epatch ${FILESDIR}/tripwire-2.3.0-50-rfc822.patch.bz2 +} + +src_compile() { + # tripwire can be sensitive to compiler optimisation. + # see #32613, #45823, and others. + # -taviso@gentoo.org + strip-flags + replace-flags -O2 -O1 + append-flags -DCONFIG_DIR='"\"/etc/tripwire\""' + + einfo "Preapring build..." + rm -f ${S}/configure + ebegin " Running aclocal" + aclocal &> /dev/null || true + eend + ebegin " Running autoheader" + autoheader &> /dev/null || true + eend + ebegin " Running automake" + automake --add-missing &> /dev/null || true + eend + ebegin " Running autoreconf" + autoreconf &> /dev/null || true + eend + ebegin " Preparing Directory" + mkdir ${S}/lib ${S}/bin || die + eend + einfo "Done." + econf `use_enable ssl openssl` || die + emake || die +} + +src_install() { + dosbin ${S}/bin/{siggen,tripwire,twadmin,twprint} + doman ${S}/man/man{4/*.4,5/*.5,8/*.8} + dodir /etc/tripwire /var/lib/tripwire{,/report} + keepdir /var/lib/tripwire{,/report} + + exeinto /etc/cron.daily + doexe ${FILESDIR}/tripwire.cron + + dodoc README Release_Notes ChangeLog policy/policyguide.txt TRADEMARK \ + ${FILESDIR}/tripwire.gif ${FILESDIR}/tripwire.txt + + zcat ${FILESDIR}/twcfg.txt > ${T}/twcfg.txt || ewarn "twcfg.txt zcat error" + insinto /etc/tripwire + doins ${T}/twcfg.txt ${FILESDIR}/twpol.txt + + exeinto /etc/tripwire + doexe ${FILESDIR}/twinstall.sh + + fperms 755 /etc/tripwire/twinstall.sh /etc/cron.daily/tripwire.cron +} + +pkg_postinst() { + einfo "After installing this package, you should run \"/etc/tripwire/twinstall.sh\"" + einfo "to generate cryptographic keys, and \"tripwire --init\" to initialize the" + einfo "database Tripwire uses." + einfo + einfo "A quickstart guide is included with the documentation." + einfo +} -- 2.26.2