Forgive the cruddy formatting. I don't generate patches with git
often enough to get all the options to look right on the first try.
For accounts_dangerous_path_for_root.xml:
- First, I noticed that this check returned a result of true if any of the conditions
that we didn't want to see were satisfied. I assumed that a false result was desired,
so I made sure all tests had a check value of "none satisfy" and that the
criteria operator was AND, not OR. A single failure will now give a result of false.
- Second, I noticed that the test_env_var_contains check would also check for the values
".:" or ":.". If this is actually desired behavior, I'll reverse
this one, but for now, I split it into two checks, one for "::" and one for
"\.\."
- Third, no check was done to see if the path began with a / or if elements in the path
began with /. My checks ensure that PATH only begins with / and that each instance of : is
followed by a slash. This is the riskiest change I made, since : is a valid character in
folder names. I tried to exclude : characters that begin with \.
For package_red_hat_gpgkeys_installed.xml:
- There were two problems in this particular check. The first was that the check for
gpg-pubkey-2fa658e0-45700c69 had its release and version numbers reversed, so that it
would always fail. The second was that both rpminfo_state blocks shared the same id.
Maura Dailey (2):
Maura: Existing check returns false instead of true when the PATH
passes all checks, and it doesn't check that path elements begin
with /
Maura: Duplicate state ids fixed, fixed reversed version and release
info for the auxillary key
.../checks/accounts_dangerous_path_for_root.xml | 30 ++++++++++++++----
.../checks/package_red_hat_gpgkeys_installed.xml | 32 +++++++-------------
2 files changed, 34 insertions(+), 28 deletions(-)
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide