oscap hangs on wireless_disable_drivers.xml

Gary Gapinski gapinski at nasa.gov
Tue Aug 28 14:35:49 UTC 2012


On 08/28/2012 09:58 AM, Willem Bos wrote:
> Sounds plausable. Should you or I create a patch?

Please go ahead and patch. I have not yet created a good unit test
environment.

The other two inefficient ones are

    RHEL6/input/checks/file_permissions_ungroupowned.xml
      <unix:file_object comment="all local files"
      id="obj_20025" version="1">
        <unix:behaviors recurse="files" recurse_file_system="local" />
        <unix:path operation="pattern match">.*</unix:path>
        <unix:filename operation="pattern match">.*</unix:filename>
      </unix:file_object>

    RHEL6/input/checks/file_permissions_unowned.xml
      <unix:file_object comment="all local files"
      id="obj_20022" version="1">
        <unix:behaviors recurse="files" recurse_file_system="local" />
        <unix:path operation="pattern match">.*</unix:path>
        <unix:filename operation="pattern match">.*</unix:filename>
      </unix:file_object>

These will traverse all non-network mounted file systems.



It appears there are some errors in other checks, i.e.,

    RHEL6/input/checks/file_groupowner_ldap_server_files.xml
    Description: <unix:filename operation="pattern match">*</unix:filename>

    RHEL6/input/checks/file_owner_ldap_server_files.xml
    Description: <unix:filename operation="pattern match">*</unix:filename

These seem patently invalid.



In some other checks, anchors appear in <unix:filename>
(RHEL6/input/checks/file_permissions_unauthorized_suid.xml). These are
likely superfluous in many cases. In others, the anchors are missing
(e.g,  RHEL6/input/checks/file_permissions_samba_password.xml) and might
be necessary.



Regards,

Gary



More information about the scap-security-guide mailing list