On 9/30/13 2:16 PM, Shane Shaffer wrote:
Is this object being used in a test that does a comparison on the numerical value? The parentheses around the \d+ in the previous version suggests that it is. Since the new parentheses create a second subexpression, that could interfere with the evaluation of the intended subexpression. There are a few ways around this, but unless the value of hard|- is needed somewhere, the cleanest way would be to make that a non-capturing group.

The full OVAL is here:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml

The important bits:

  <ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1">
    <ind:filepath>/etc/security/limits.conf</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*\*[\s]+(hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_maxlogins" version="1">
    <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
  </ind:textfilecontent54_state>

So then, you're right. The new parenthesis act as a capture group. Oddly, things still check out when doing a testcheck!

I can't find the OVAL 5.10 spec with this info, however reference the (now antiquated) 5.6 spec. Specifically the "extensions":
http://oval.mitre.org/language/about/re_support_5.6.html

I believe the pattern match should be updated to:
^[\s]*\*[\s]+(?:hard|-)[\s]+maxlogins[\s]+(\d+)\s*$

(note the "?:")

Frank, could you bugfix this?