oscap hangs on wireless_disable_drivers.xml

Gary Gapinski Gapinski at nasa.gov
Tue Aug 28 11:59:05 UTC 2012


On 08/28/2012 07:52 AM, Willem Bos wrote:
> Hi All,
>
> When running `oscap oval eval rhel6-oval-scap-security-guide.xml`the
> scan hangs right after having processed
> oval:scap-security-guide:def:1344. I did some digging around and found
> that this is caused by
> RHEL6/input/checks/wireless_disable_drivers.xml. The check contains a
> pattern in the unix:path tag :
>
> <unix:file_object comment="all local files"
> id="object_wireless_disable_drivers" version="1">
> <unix:path operation="pattern
> match">/lib/modules/.*/kernel/drivers/net/wireless</unix:path>
> <unix:filename operation="pattern match">.*</unix:filename>
> </unix:file_object>
>
> Analyzing the run with strace shows that oscap scans the _whole_
> filesystem instead of just /lib/modules. When I replace the pattern
> with a kernel version the check runs fine. Maybe this is a oscap bug?
>

Odd. However, the pattern match is (supposed to be) a regex, not a glob. 
Does adding an anchor ("^") at the beginning of the <unix:path> value 
constrain the scan to /lib/modules?



More information about the scap-security-guide mailing list