[PATCH 0/2] Two fixes for OVAL checks accounts_dangerous_path_for_root and package_red_hat_gpgkeys_installed
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Apr 23 17:44:47 UTC 2013
Did you unit test this?
On 04/23/2013 01:35 PM, Maura Dailey wrote:
> Forgive the cruddy formatting. I don't generate patches with git often enough to get all the options to look right on the first try.
>
> For accounts_dangerous_path_for_root.xml:
> - First, I noticed that this check returned a result of true if any of the conditions that we didn't want to see were satisfied. I assumed that a false result was desired, so I made sure all tests had a check value of "none satisfy" and that the criteria operator was AND, not OR. A single failure will now give a result of false.
>
> - Second, I noticed that the test_env_var_contains check would also check for the values ".:" or ":.". If this is actually desired behavior, I'll reverse this one, but for now, I split it into two checks, one for "::" and one for "\.\."
>
> - Third, no check was done to see if the path began with a / or if elements in the path began with /. My checks ensure that PATH only begins with / and that each instance of : is followed by a slash. This is the riskiest change I made, since : is a valid character in folder names. I tried to exclude : characters that begin with \.
>
> For package_red_hat_gpgkeys_installed.xml:
> - There were two problems in this particular check. The first was that the check for gpg-pubkey-2fa658e0-45700c69 had its release and version numbers reversed, so that it would always fail. The second was that both rpminfo_state blocks shared the same id.
>
> Maura Dailey (2):
> Maura: Existing check returns false instead of true when the PATH
> passes all checks, and it doesn't check that path elements begin
> with /
> Maura: Duplicate state ids fixed, fixed reversed version and release
> info for the auxillary key
>
> .../checks/accounts_dangerous_path_for_root.xml | 30 ++++++++++++++----
> .../checks/package_red_hat_gpgkeys_installed.xml | 32 +++++++-------------
> 2 files changed, 34 insertions(+), 28 deletions(-)
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
More information about the scap-security-guide
mailing list