[PATCH 0/2] Two fixes for OVAL checks accounts_dangerous_path_for_root and package_red_hat_gpgkeys_installed

Maura Dailey maura at eclipse.ncsc.mil
Tue Apr 23 17:51:28 UTC 2013


I unit tested this to the best of my ability using grep's regular 
expressions.

- Maura Dailey

On 04/23/2013 01:44 PM, Jeffrey Blank wrote:
> Did you unit test this?
>
>
>
> On 04/23/2013 01:35 PM, Maura Dailey wrote:
>> Forgive the cruddy formatting. I don't generate patches with git often enough to get all the options to look right on the first try.
>>
>> For accounts_dangerous_path_for_root.xml:
>>   - First, I noticed that this check returned a result of true if any of the conditions that we didn't want to see were satisfied. I assumed that a false result was desired, so I made sure all tests had a check value of "none satisfy" and that the criteria operator was AND, not OR. A single failure will now give a result of false.
>>
>>   - Second, I noticed that the test_env_var_contains check would also check for the values ".:" or ":.". If this is actually desired behavior, I'll reverse this one, but for now, I split it into two checks, one for "::" and one for "\.\."
>>
>>   - Third, no check was done to see if the path began with a / or if elements in the path began with /. My checks ensure that PATH only begins with / and that each instance of : is followed by a slash. This is the riskiest change I made, since : is a valid character in folder names. I tried to exclude : characters that begin with \.
>>
>> For package_red_hat_gpgkeys_installed.xml:
>>   - There were two problems in this particular check. The first was that the check for gpg-pubkey-2fa658e0-45700c69 had its release and version numbers reversed, so that it would always fail. The second was that both rpminfo_state blocks shared the same id.
>>
>> Maura Dailey (2):
>>    Maura: Existing check returns false instead of true when the PATH
>>      passes all checks, and it doesn't check that path elements begin
>>      with /
>>    Maura: Duplicate state ids fixed, fixed reversed version and release
>>      info for the auxillary key
>>
>>   .../checks/accounts_dangerous_path_for_root.xml    |   30 ++++++++++++++----
>>   .../checks/package_red_hat_gpgkeys_installed.xml   |   32 +++++++-------------
>>   2 files changed, 34 insertions(+), 28 deletions(-)
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list