On 07/25/2013 12:31 PM, Tomas Heinrich wrote:
Hi,
I've browsed through the thread and have several remarks.
- the tree under /sys causes the same problems a /proc and should be
filtered out
- OpenSCAP should already consider these as not "local" which
mitigates this problem a bit, but that doesn't help much from SSG's POV
- in the example below, the 'behaviors' element is redundant, as the
specs [1] put it:
> the 'max_depth' and 'recurse_direction' attributes of the
'behaviors'
> element do not apply to the 'filepath' element, only to the 'path'
> and 'filename' elements.
On 07/23/2013 09:47 PM, Maura Dailey wrote:
> I looked at the USGCB stuffs and here's what I put together for
> file_permissions_unowned.xml in OVAL to eliminate /proc.
> <unix:file_object comment="all local files"
> id="file_permissions_unowned_object" version="1">
> <unix:behaviors recurse="symlinks and directories"
> recurse_direction="down" recurse_file_system="local" />
> <unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>
You don't want to do this ^^^. This tries to match a regexp to every
file on the system. You should rather use something along the lines of:
> <unix:behaviors recurse="symlinks and directories"
> recurse_direction="down" recurse_file_system="local"
max_depth="-1"/>
> <unix:path operation="pattern
match">^/(?!proc/)[^/]*/$</unix:path>
> <unix:filename operation="pattern match">^.*$</unix:filename>
The regex in 'path' just matches a top-level directory and the
recursion follows from each of them, which should be faster.
[1]
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation...
Thanks for the correction. I don't have a good intuitive grasp on OVAL's
regex support yet. I switched to filepath because I was fighting with
path and filename unsuccessfully.
Tomas
- Maura Dailey