[PATCH 1/2] Existing check returns false instead of true when the PATH passes all checks, and it doesn't check that path elements begin with /

Maura Dailey maura at eclipse.ncsc.mil
Tue Apr 23 21:29:32 UTC 2013


---
 .../checks/accounts_dangerous_path_for_root.xml    |   42 +++++++++++++++----
 1 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
index abff72c..d78f49a 100644
--- a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
+++ b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
@@ -7,34 +7,58 @@
       </affected>
       <description>The environment variable PATH should be set correctly for the root user.</description>
     </metadata>
-    <criteria comment="environment variable PATH contains dangerous path" operator="OR">
+    <criteria comment="environment variable PATH contains dangerous path" operator="AND">
       <criterion comment="environment variable PATH starts with : or ." test_ref="test_env_var_begins" />
-      <criterion comment="environment variable PATH contains : or . twice in a row" test_ref="test_env_var_contains" />
+      <criterion comment="environment variable PATH contains : twice in a row" test_ref="test_env_var_contains_doublecolon" />
+      <criterion comment="environment variable PATH contains . twice in a row" test_ref="test_env_var_contains_doubleperiod" />
       <criterion comment="environment variable PATH ends with : or ." test_ref="test_env_var_ends" />
+      <criterion comment="environment variable PATH doesn't begin with a /" test_ref="test_env_var_begins_slash" />
+      <criterion comment="environment variable PATH doesn't contain relative paths" test_ref="test_env_var_contains_relative_path" />
     </criteria>
   </definition>
-  <ind:environmentvariable_test check="all" comment="environment variable PATH starts with : or ." id="test_env_var_begins" version="1">
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH starts with : or ." id="test_env_var_begins" version="1">
     <ind:object object_ref="object_env_var_path" />
     <ind:state state_ref="state_begins_colon_period" />
   </ind:environmentvariable_test>
-  <ind:environmentvariable_test check="all" comment="environment variable PATH contains : or . twice in a row" id="test_env_var_contains" version="1">
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH contains : twice in a row" id="test_env_var_contains_doublecolon" version="1">
+    <ind:object object_ref="object_env_var_path" />
+    <ind:state state_ref="state_contains_double_colon" />
+  </ind:environmentvariable_test>
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH contains . twice in a row" id="test_env_var_contains_doubleperiod" version="1">
+    <ind:object object_ref="object_env_var_path" />
+    <ind:state state_ref="state_contains_double_period" />
+  </ind:environmentvariable_test>
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH ends with : or ." id="test_env_var_ends" version="1">
     <ind:object object_ref="object_env_var_path" />
     <ind:state state_ref="state_ends_colon_period" />
   </ind:environmentvariable_test>
-  <ind:environmentvariable_test check="all" comment="environment variable PATH ends with : or ." id="test_env_var_ends" version="1">
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="test_env_var_begins_slash" version="1">
     <ind:object object_ref="object_env_var_path" />
-    <ind:state state_ref="state_contains_double_colon_period" />
+    <ind:state state_ref="state_begins_slash" />
+  </ind:environmentvariable_test>
+  <ind:environmentvariable_test check="none satisfy" comment="environment variable PATH contains relative paths" id="test_env_var_contains_relative_path" version="1">
+    <ind:object object_ref="object_env_var_path" />
+    <ind:state state_ref="state_contains_relative_path" />
   </ind:environmentvariable_test>
   <ind:environmentvariable_object id="object_env_var_path" version="1">
-    <ind:name>PATH</ind:name>
+    <ind:name>PATHTEST</ind:name>
   </ind:environmentvariable_object>
   <ind:environmentvariable_state comment="starts with colon or period" id="state_begins_colon_period" version="1">
     <ind:value operation="pattern match">^[:\.]</ind:value>
   </ind:environmentvariable_state>
-  <ind:environmentvariable_state comment="colon or period twice in a row" id="state_contains_double_colon_period" version="1">
-    <ind:value operation="pattern match">[:\.][:\.]</ind:value>
+  <ind:environmentvariable_state comment="colon twice in a row" id="state_contains_double_colon" version="1">
+    <ind:value operation="pattern match">::</ind:value>
+  </ind:environmentvariable_state>
+  <ind:environmentvariable_state comment="period twice in a row" id="state_contains_double_period" version="1">
+    <ind:value operation="pattern match">\.\.</ind:value>
   </ind:environmentvariable_state>
   <ind:environmentvariable_state comment="ends with colon or period" id="state_ends_colon_period" version="1">
     <ind:value operation="pattern match">[:\.]$</ind:value>
   </ind:environmentvariable_state>
+  <ind:environmentvariable_state comment="begins with a slash" id="state_begins_slash" version="1">
+    <ind:value operation="pattern match">^[^/]</ind:value>
+  </ind:environmentvariable_state>
+  <ind:environmentvariable_state comment="elements begin with a slash" id="state_contains_relative_path" version="1">
+    <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
+  </ind:environmentvariable_state>
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list