I unit tested this to the best of my ability using grep's regular
expressions.
- Maura Dailey
On 04/23/2013 01:44 PM, Jeffrey Blank wrote:
Did you unit test this?
On 04/23/2013 01:35 PM, Maura Dailey wrote:
> Forgive the cruddy formatting. I don't generate patches with git often enough to
get all the options to look right on the first try.
>
> For accounts_dangerous_path_for_root.xml:
> - First, I noticed that this check returned a result of true if any of the
conditions that we didn't want to see were satisfied. I assumed that a false result
was desired, so I made sure all tests had a check value of "none satisfy" and
that the criteria operator was AND, not OR. A single failure will now give a result of
false.
>
> - Second, I noticed that the test_env_var_contains check would also check for the
values ".:" or ":.". If this is actually desired behavior, I'll
reverse this one, but for now, I split it into two checks, one for "::" and one
for "\.\."
>
> - Third, no check was done to see if the path began with a / or if elements in the
path began with /. My checks ensure that PATH only begins with / and that each instance of
: is followed by a slash. This is the riskiest change I made, since : is a valid character
in folder names. I tried to exclude : characters that begin with \.
>
> For package_red_hat_gpgkeys_installed.xml:
> - There were two problems in this particular check. The first was that the check
for gpg-pubkey-2fa658e0-45700c69 had its release and version numbers reversed, so that it
would always fail. The second was that both rpminfo_state blocks shared the same id.
>
> Maura Dailey (2):
> Maura: Existing check returns false instead of true when the PATH
> passes all checks, and it doesn't check that path elements begin
> with /
> Maura: Duplicate state ids fixed, fixed reversed version and release
> info for the auxillary key
>
> .../checks/accounts_dangerous_path_for_root.xml | 30 ++++++++++++++----
> .../checks/package_red_hat_gpgkeys_installed.xml | 32 +++++++-------------
> 2 files changed, 34 insertions(+), 28 deletions(-)
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide