From rmtzcx at gmail.com Wed Jun 15 19:05:32 2016 Content-Type: multipart/mixed; boundary="===============2595293138890037503==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Issue with file_permissions_ungroupowned in CentOS 5 Date: Wed, 15 Jun 2016 13:09:13 -0500 Message-ID: In-Reply-To: CAB6RzTtD2p8_NU1X2+z80uLiMib2zSTj4JtAGOk9RJ=wi=w=5Q@mail.gmail.com --===============2595293138890037503== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Here is the relevant part of the file_permissions_ungroupowned OVAL test: / .* file_permissions_ungroupowned_list_match If I create 'aaa' file in /tmp and chage the GID to a non-existing group in /etc/group, the test should fail, but it passes. If I change the file name pattern match from '.*' to 'a.*' or change the path to /tmp, the test fails correctly. Is there any limitation in the amount of files that oscap can process? Thanks -- Rodolfo Mart=C3=ADnez On Tue, Jun 14, 2016 at 11:55 PM, Rodolfo Mart=C3=ADnez wrote: > Hi, > > I am having an issue with OVAL test file_permissions_ungroupowned in > CentOS 5. I believe it is a bug in the oscap version that it is available > in CentOS 5 (kind of old, v1.0.8). > > Here is the procedure I am doing: > > 1. Download and build scap-security-guide for RHEL5 in my Fedora 23 > machine; then copy the output to my CentOS 5 testing server: > > wget > https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.29.tar.gz -O > scap-security-guide-0.1.29.tar.gz > > tar -zxf scap-security-guide-0.1.29.tar.gz > > make -C scap-security-guide-0.1.29/RHEL/5 dist > > scp -r scap-security-guide-0.1.29/RHEL/5/dist/content centos5-test: > > Now in the CentOS 5 testing server, create a tailoring file to run > file_permissions_ungroupowned test alone: > > cat >ssg-centos5-xccdf-tailoring.xml <<"EOF" > > id=3D"xccdf_ssg-centos5_tailoring_xccdf"> > 1 > > CentOS 5 [TAILORED] >