On 9/30/13 2:16 PM, Shane Shaffer wrote:
Is this object being used in a test that does a comparison on the numerical value? The parentheses around the \d+ in the previous version suggests that it is. Since the new parentheses create a second subexpression, that could interfere with the evaluation of the intended subexpression. There are a few ways around this, but unless the value of hard|- is needed somewhere, the cleanest way would be to make that a non-capturing group.

The full OVAL is here:

The important bits:

  <ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1">
    <ind:pattern operation="pattern match">^[\s]*\*[\s]+(hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>

  <ind:textfilecontent54_state id="state_maxlogins" version="1">
    <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />

So then, you're right. The new parenthesis act as a capture group. Oddly, things still check out when doing a testcheck!

I can't find the OVAL 5.10 spec with this info, however reference the (now antiquated) 5.6 spec. Specifically the "extensions":

I believe the pattern match should be updated to:

(note the "?:")

Frank, could you bugfix this?