On 7/19/13 1:52 PM, Andrew Gilmore wrote:
I agree, I see false positives on my systems where the only output
from a manual 'sudo find / -type f -perm o+w' is errors on /proc
directories.
Andrew
On Thu, Jul 18, 2013 at 11:11 AM, Robert Sanders<rsanders(a)trustedcs.com> wrote:
> >I was wondering why the tests for 'Ensure all Files Are Owned by a User'
and
> >'Ensure all Files are Owned by a Group' kept on failing. Drilling down
it
> >looks like the underlying find command being used is along the lines of :
> >
> >find PARTITION -xdev -nouser -print
> >
> >When I run this command manually I've had complaints that find can't
read
> >files in /proc. Looking at the man page suggests this can be avoided by
> >adding the '-ignore_readdir_race' option before the -xdev option.
> >
> >This change may need to be added for both SSG items 2.2.3.e and 2.2.3.f
> >
> >-Rob
> >
Hmm. The OVAL spec is here (search for " == FileBehaviors =="):
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation...
And our OVAL:
<unix:file_object comment="all local files"
id="obj_20022" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_file_system="local" />
<unix:path>/</unix:path>
<unix:filename operation="pattern match">.*</unix:filename>
</unix:file_object>
According to the spec, it should be possible to use
recurse_file_system="defined", and use the unix:filename to create a
regex that excludes /proc
Maura seems to have the best regex skills.... ;)