While I can't comment on whether the intent is right or wrong, I don't
think the suggested regular expression is quite correct. It may be giving
you the result you expected, but probably not for the right reason. Inside
the [] the (, ), and | characters lose their significance, so effectively
that pattern is [^bcdhopt()|]. A value of "static" would pass based on the
s, a, or i characters. "none" would pass because of the n or e
characters. "dhcp" and "bootp" fail because they contain only
characters
that are not permitted. But "pchd" would also fail, as would any other
permutation of the ten characters in the character class.
If you really want to allow anything other than "dhcp" or "bootp" it
is
probably easiest to use something like ^(dhcp|bootp)$ and then negate the
test.
Shane Shaffer
G2, Inc.
shane.shaffer(a)g2-inc.com
On Wed, Jul 10, 2013 at 7:17 AM, Rui Pedro Bernardino <
rui-p-bernardino(a)ptinovacao.pt> wrote:
Hi all,****
** **
I think there’s a mistake on how sysconfig_networking_bootproto_ifcfg
checks whether dhcp client is enabled. According to RHEL6 docs, BOOTPROTO
should be one of “none”, “bootp” or “dhcp” and not “static”; /sbin/ifup
assumes static IP configuration unless either “dhcp” or “bootp” is
specified.****
** **
I suggest altering the check from ‘equals to “static”’ to ‘anything but
“dhcp” or “bootp”’, which matches how it will be applied.****
** **
*** 22,28 ********
</ind:textfilecontent54_test>****
<ind:textfilecontent54_state id="state_20135"****
version="1">****
! * <ind:subexpression
operation="equals">static</ind:subexpression>***
**
</ind:textfilecontent54_state>****
<ind:textfilecontent54_object id="obj_20135"****
version="1">****
--- 22,28 ----****
</ind:textfilecontent54_test>****
<ind:textfilecontent54_state id="state_20135"****
version="1">****
! <*ind:subexpression operation="pattern
match">[^(dhcp|bootp)]</ind:subexpression>*****
</ind:textfilecontent54_state>****
<ind:textfilecontent54_object id="obj_20135"****
version="1">****
** **
Regards****
** **
--****
Rui Pedro Bernardino****
CTE2/Tecnologias e Desenvolvimento****
PT Inovação****
** **
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide