That's about where I was going with it just now, actually (although I
was unsuccessfully trying something more complicated with the
password_test and password_object OVAL pieces), but do we have to solve
network user ids as well? Or do you think it is sufficient in this check
to just check local accounts?
- Maura Dailey
On 07/23/2013 02:19 PM, Steve Grubb wrote:
On Tuesday, July 23, 2013 02:04:48 PM Maura Dailey wrote:
> On 07/23/2013 01:23 PM, Gary Gapinski wrote:
>> On 07/23/2013 01:17 PM, Maura Dailey wrote:
>>> Does anyone actually have a way to "unown" or "ungroup
own" a file for
>>> testing purposes? I'd like to see if the uid shows up as 0 or as
xsi:nil.
>> chown <pick some unused uid> file
>> chgrp <pick some unused gid> file
> Huh, didn't realize that was all we were testing for. That makes it way
> harder to test in OVAL, obviously, since the normal file test will
> happily report whatever value it finds without checking if it's assigned
> to a user or group.
This test is correctly working in RHEL5 USGCB. There is a variable with local user
ID's:
<ind-def:textfilecontent54_object
id="oval:gov.nist.usgcb.rhel:obj:200501" version="1">
<ind-def:filepath>/etc/passwd</ind-def:filepath>
<ind-def:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind-def:pattern>
<ind-def:instance operation="greater than or equal"
datatype="int">1</ind-def:instance>
</ind-def:textfilecontent54_object>
And this is used in another test:
<unix-def:file_state
id="oval:gov.nist.usgcb.rhel:ste:20050" version="1"
comment="Files with a valid user id assigned">
<unix-def:user_id datatype="int" var_check="at
least one" var_ref="oval:gov.nist.usgcb.rhel:var:200501"/>
</unix-def:file_state>
which checks the results of recursing the local file system:
<unix-def:file_object
id="oval:gov.nist.usgcb.rhel:obj:20050" version="1" comment="all
local files without a valid user assigned">
<unix-def:behaviors recurse="directories"
recurse_direction="down" recurse_file_system="local"/>
<unix-def:path>/</unix-def:path>
<unix-def:filename operation="pattern
match">.*</unix-def:filename>
<filter>oval:gov.nist.usgcb.rhel:ste:20050</filter>
</unix-def:file_object>
This was working in the past.
-Steve