Hi,
I've browsed through the thread and have several remarks.
- the tree under /sys causes the same problems a /proc and should be
filtered out
- OpenSCAP should already consider these as not "local" which mitigates
this problem a bit, but that doesn't help much from SSG's POV
- in the example below, the 'behaviors' element is redundant, as the
specs [1] put it:
the 'max_depth' and 'recurse_direction' attributes of
the 'behaviors'
element do not apply to the 'filepath' element, only to the 'path'
and 'filename' elements.
On 07/23/2013 09:47 PM, Maura Dailey wrote:
I looked at the USGCB stuffs and here's what I put together for
file_permissions_unowned.xml in OVAL to eliminate /proc.
<unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />
<unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>
You don't want to do this ^^^. This tries to match a regexp to every
file on the system. You should rather use something along the lines of:
<unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local"
max_depth="-1"/>
<unix:path operation="pattern
match">^/(?!proc/)[^/]*/$</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
The regex in 'path' just matches a top-level directory and the recursion
follows from each of them, which should be faster.
[1]
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation...
Tomas