[PATCH 0/2] Two fixes for OVAL checks accounts_dangerous_path_for_root and package_red_hat_gpgkeys_installed

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Apr 23 18:25:53 UTC 2013


I mean, with regard to a positive and negative result.

That is, did you alter the root path and achieve the expected results
from the OVAL checks, for both negative and positive test cases, using
testcheck.py?


And indeed it is an interesting question, as to the value proposition
for building and maintaining a test harness...



On 04/23/2013 01:51 PM, Maura Dailey wrote:
> I unit tested this to the best of my ability using grep's regular
> expressions.
> 
> - Maura Dailey
> 
> On 04/23/2013 01:44 PM, Jeffrey Blank wrote:
>> Did you unit test this?
>>
>>
>>
>> On 04/23/2013 01:35 PM, Maura Dailey wrote:
>>> Forgive the cruddy formatting. I don't generate patches with git
>>> often enough to get all the options to look right on the first try.
>>>
>>> For accounts_dangerous_path_for_root.xml:
>>>   - First, I noticed that this check returned a result of true if any
>>> of the conditions that we didn't want to see were satisfied. I
>>> assumed that a false result was desired, so I made sure all tests had
>>> a check value of "none satisfy" and that the criteria operator was
>>> AND, not OR. A single failure will now give a result of false.
>>>
>>>   - Second, I noticed that the test_env_var_contains check would also
>>> check for the values ".:" or ":.". If this is actually desired
>>> behavior, I'll reverse this one, but for now, I split it into two
>>> checks, one for "::" and one for "\.\."
>>>
>>>   - Third, no check was done to see if the path began with a / or if
>>> elements in the path began with /. My checks ensure that PATH only
>>> begins with / and that each instance of : is followed by a slash.
>>> This is the riskiest change I made, since : is a valid character in
>>> folder names. I tried to exclude : characters that begin with \.
>>>
>>> For package_red_hat_gpgkeys_installed.xml:
>>>   - There were two problems in this particular check. The first was
>>> that the check for gpg-pubkey-2fa658e0-45700c69 had its release and
>>> version numbers reversed, so that it would always fail. The second
>>> was that both rpminfo_state blocks shared the same id.
>>>
>>> Maura Dailey (2):
>>>    Maura: Existing check returns false instead of true when the PATH
>>>      passes all checks, and it doesn't check that path elements begin
>>>      with /
>>>    Maura: Duplicate state ids fixed, fixed reversed version and release
>>>      info for the auxillary key
>>>
>>>   .../checks/accounts_dangerous_path_for_root.xml    |   30
>>> ++++++++++++++----
>>>   .../checks/package_red_hat_gpgkeys_installed.xml   |   32
>>> +++++++-------------
>>>   2 files changed, 34 insertions(+), 28 deletions(-)
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
> 

-- 
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance


More information about the scap-security-guide mailing list