From rmtzcx at gmail.com Fri Jun 17 18:19:21 2016 Content-Type: multipart/mixed; boundary="===============3855614025704948865==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Issue with file_permissions_ungroupowned in CentOS 5 Date: Fri, 17 Jun 2016 13:19:08 -0500 Message-ID: In-Reply-To: 576437BA.2030300@redhat.com --===============3855614025704948865== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Fri, Jun 17, 2016 at 12:47 PM, Shawn Wells wrote: > > > On 6/15/16 2:09 PM, Rodolfo Mart=C3=ADnez wrote: > > Here is the relevant part of the file_permissions_ungroupowned OVAL test: > > id=3D"file_permissions_ungroupowned_object" version=3D"1"> > max_depth=3D"-1" recurse_file_system=3D"local" /> > / > .* > action=3D"exclude">file_permissions_ungroupowned_list_match > > > If I create 'aaa' file in /tmp and chage the GID to a non-existing group > in /etc/group, the test should fail, but it passes. > > If I change the file name pattern match from '.*' to 'a.*' or change the > path to /tmp, the test fails correctly. > > Is there any limitation in the amount of files that oscap can process? > > Thanks > > > -- > Rodolfo Mart=C3=ADnez > > On Tue, Jun 14, 2016 at 11:55 PM, Rodolfo Mart=C3=ADnez < > rmtzcx(a)gmail.com> wrote: > >> Hi, >> >> I am having an issue with OVAL test file_permissions_ungroupowned in >> CentOS 5. I believe it is a bug in the oscap version that it is available >> in CentOS 5 (kind of old, v1.0.8). >> >> Here is the procedure I am doing: >> >> 1. Download and build scap-security-guide for RHEL5 in my Fedora 23 >> machine; then copy the output to my CentOS 5 testing server: >> >> wget >> https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.29.tar.gz >> -O scap-security-guide-0.1.29.tar.gz >> >> tar -zxf scap-security-guide-0.1.29.tar.gz >> >> make -C scap-security-guide-0.1.29/RHEL/5 dist >> >> scp -r scap-security-guide-0.1.29/RHEL/5/dist/content centos5-test: >> >> Now in the CentOS 5 testing server, create a tailoring file to run >> file_permissions_ungroupowned test alone: >> >> cat >ssg-centos5-xccdf-tailoring.xml <<"EOF" >> >> > id=3D"xccdf_ssg-centos5_tailoring_xccdf"> >> 1 >> >> CentOS 5 [TAILORED] >>