First, I'd like to point out that my /proc and /sys is never searched.
Or /tmp. All three are separate partitions on my system, but I'm not
sure if that's related.
I've tested your suggested change with some success, but not great
success. The first problem is that <unix:path> will never return a
result that ends in a /.
So far:
<unix:file_object comment="all local files"
id="object_file_permissions_unowned" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local"
max_depth="-1" />
<unix:path operation="pattern
match">^/(?!proc|sys)[^/]*$</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
<filter
action="exclude">file_permissions_unowned_userid_list_match</filter>
</unix:file_object>
Results in:
Nothing with /proc or /sys is returned, but the test file file /meh
isn't returned either.
My regex is pretty rudimentary. If you have an idea for a change that
will match /meh, let me know. I have to substitute different directory
names for proc and sys to ensure it's working correctly, since, as I
said above, I never get results for /proc and /sys.
(My single line <unix:filepath> will let me exclude directories, while
still returning the file /meh. This makes my inability to get it to work
in two lines frustrating.)
- Maura Dailey
On 07/25/2013 12:31 PM, Tomas Heinrich wrote:
Hi,
I've browsed through the thread and have several remarks.
- the tree under /sys causes the same problems a /proc and should be
filtered out
- OpenSCAP should already consider these as not "local" which
mitigates this problem a bit, but that doesn't help much from SSG's POV
- in the example below, the 'behaviors' element is redundant, as the
specs [1] put it:
> the 'max_depth' and 'recurse_direction' attributes of the
'behaviors'
> element do not apply to the 'filepath' element, only to the 'path'
> and 'filename' elements.
On 07/23/2013 09:47 PM, Maura Dailey wrote:
> I looked at the USGCB stuffs and here's what I put together for
> file_permissions_unowned.xml in OVAL to eliminate /proc.
> <unix:file_object comment="all local files"
> id="file_permissions_unowned_object" version="1">
> <unix:behaviors recurse="symlinks and directories"
> recurse_direction="down" recurse_file_system="local" />
> <unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>
You don't want to do this ^^^. This tries to match a regexp to every
file on the system. You should rather use something along the lines of:
> <unix:behaviors recurse="symlinks and directories"
> recurse_direction="down" recurse_file_system="local"
max_depth="-1"/>
> <unix:path operation="pattern
match">^/(?!proc/)[^/]*/$</unix:path>
> <unix:filename operation="pattern match">^.*$</unix:filename>
The regex in 'path' just matches a top-level directory and the
recursion follows from each of them, which should be faster.
[1]
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation...
Tomas