oscap hangs on wireless_disable_drivers.xml

Willem Bos whbos at xs4all.nl
Tue Aug 28 12:59:46 UTC 2012


Hi Gary,

Ah, should have thought about adding '^' myself, thanks. It works
fine. Should the ^ be necessary?

Regards,
Willem.

On Tue, Aug 28, 2012 at 1:59 PM, Gary Gapinski <Gapinski at nasa.gov> wrote:
> On 08/28/2012 07:52 AM, Willem Bos wrote:
>>
>> Hi All,
>>
>> When running `oscap oval eval rhel6-oval-scap-security-guide.xml`the
>> scan hangs right after having processed
>> oval:scap-security-guide:def:1344. I did some digging around and found
>> that this is caused by
>> RHEL6/input/checks/wireless_disable_drivers.xml. The check contains a
>> pattern in the unix:path tag :
>>
>> <unix:file_object comment="all local files"
>> id="object_wireless_disable_drivers" version="1">
>> <unix:path operation="pattern
>> match">/lib/modules/.*/kernel/drivers/net/wireless</unix:path>
>> <unix:filename operation="pattern match">.*</unix:filename>
>> </unix:file_object>
>>
>> Analyzing the run with strace shows that oscap scans the _whole_
>> filesystem instead of just /lib/modules. When I replace the pattern
>> with a kernel version the check runs fine. Maybe this is a oscap bug?
>>
>
> Odd. However, the pattern match is (supposed to be) a regex, not a glob.
> Does adding an anchor ("^") at the beginning of the <unix:path> value
> constrain the scan to /lib/modules?
>


More information about the scap-security-guide mailing list