On 3/5/14, 12:13 PM, Jan Lieskovsky wrote:
Hello folks,

  another reasonable change originally pointed out by Tomas Heinrich
for USGCB content, but applicable also against SSG content.

The current bootloader_password.xml OVAL check implementation checks
for presence of:

  password --encrypted .*

string in /etc/grub.conf configuration file. But without having the heading /
starting anchor defined (IOW explicitly allowing only whitespace characters
from the beginning of the pattern match string). Therefore it would return
success for all three of the following cases (which is wrong):

  password --encrypted .*
  #password --encrypted .*
  #\tpassword --encrypted .*

Therefore add starting / heading anchor requirement (in the form of ^[\s]*)
which ensures:

  password --encrypted .*         will still pass, but
  #password --encrypted .*        and
  #\tpassword --encrypted .*      will both fail.

Proposed change briefly tested and seems to be working properly.

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

0001-RHEL-6-When-checking-GRUB-bootloader-security-passwo.patch

From 0a29eb7e7be27191ead7110ee5674ca7156c9f03 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Wed, 5 Mar 2014 17:53:35 +0100
Subject: [PATCH] [RHEL/6] When checking GRUB bootloader security ("password"
 directive being present in grub.conf configuration file) succeed only in case
 there's uncommented occurrence present (IOW add heading anchor ensuring
 occurrences "in-the-middle-of-string" wouldn't meet the requirement)

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 RHEL/6/input/checks/bootloader_password.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RHEL/6/input/checks/bootloader_password.xml b/RHEL/6/input/checks/bootloader_password.xml
index 6545c4d..201c369 100644
--- a/RHEL/6/input/checks/bootloader_password.xml
+++ b/RHEL/6/input/checks/bootloader_password.xml
@@ -18,7 +18,7 @@
   <ind:textfilecontent54_object id="object_bootloader_password" version="1">
     <ind:path>/etc</ind:path>
     <ind:filename>grub.conf</ind:filename>
-    <ind:pattern operation="pattern match">password[\s]+--encrypted[\s]+.*</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*password[\s]+--encrypted[\s]+.*</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
-- 1.8.3.1
Completely sane. I'm sure there are other regex's like this within the OVAL code...

ack.