On 9/30/13 2:16 PM, Shane Shaffer wrote:
Is this object being used in a test that does a comparison on the
numerical value? The parentheses around the \d+ in the previous
version suggests that it is. Since the new parentheses create a second
subexpression, that could interfere with the evaluation of the
intended subexpression. There are a few ways around this, but unless
the value of hard|- is needed somewhere, the cleanest way would be to
make that a non-capturing group.
The full OVAL is here:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/inpu...
The important bits:
|
<ind:textfilecontent54_object
id="object_etc_security_limits_conf_maxlogins" version="1">
<ind:filepath>/etc/security/limits.conf</ind:filepath>
<ind:pattern operation="pattern
match">^[\s]*\*[\s]+(hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_maxlogins"
version="1">
<ind:subexpression operation="less than or equal"
var_ref="max_concurrent_login_sessions_value" datatype="int" />
</ind:textfilecontent54_state>|
So then, you're right. The new parenthesis act as a capture group.
Oddly, things still check out when doing a testcheck!
I can't find the OVAL 5.10 spec with this info, however reference the
(now antiquated) 5.6 spec. Specifically the "extensions":
http://oval.mitre.org/language/about/re_support_5.6.html
I believe the pattern match should be updated to:
|^[\s]*\*[\s]+(*?:*hard|-)[\s]+maxlogins[\s]+(\d+)\s*$|
(note the "?:")
Frank, could you bugfix this?