[PATCH 1/2] Existing check returns false instead of true when the PATH passes all checks, and it doesn't check that path elements begin with /

Jeffrey Blank scapafterhours at gmail.com
Wed Apr 24 02:19:44 UTC 2013


ACK.  Though I'll fully admit that I also want it committed so that we can
test it more.  (So complicated!)


On Tue, Apr 23, 2013 at 5:29 PM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:

> ---
>  .../checks/accounts_dangerous_path_for_root.xml    |   42
> +++++++++++++++----
>  1 files changed, 33 insertions(+), 9 deletions(-)
>
> diff --git a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
> b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
> index abff72c..d78f49a 100644
> --- a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
> +++ b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
> @@ -7,34 +7,58 @@
>        </affected>
>        <description>The environment variable PATH should be set correctly
> for the root user.</description>
>      </metadata>
> -    <criteria comment="environment variable PATH contains dangerous path"
> operator="OR">
> +    <criteria comment="environment variable PATH contains dangerous path"
> operator="AND">
>        <criterion comment="environment variable PATH starts with : or ."
> test_ref="test_env_var_begins" />
> -      <criterion comment="environment variable PATH contains : or . twice
> in a row" test_ref="test_env_var_contains" />
> +      <criterion comment="environment variable PATH contains : twice in a
> row" test_ref="test_env_var_contains_doublecolon" />
> +      <criterion comment="environment variable PATH contains . twice in a
> row" test_ref="test_env_var_contains_doubleperiod" />
>        <criterion comment="environment variable PATH ends with : or ."
> test_ref="test_env_var_ends" />
> +      <criterion comment="environment variable PATH doesn't begin with a
> /" test_ref="test_env_var_begins_slash" />
> +      <criterion comment="environment variable PATH doesn't contain
> relative paths" test_ref="test_env_var_contains_relative_path" />
>      </criteria>
>    </definition>
> -  <ind:environmentvariable_test check="all" comment="environment variable
> PATH starts with : or ." id="test_env_var_begins" version="1">
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH starts with : or ." id="test_env_var_begins" version="1">
>      <ind:object object_ref="object_env_var_path" />
>      <ind:state state_ref="state_begins_colon_period" />
>    </ind:environmentvariable_test>
> -  <ind:environmentvariable_test check="all" comment="environment variable
> PATH contains : or . twice in a row" id="test_env_var_contains" version="1">
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH contains : twice in a row"
> id="test_env_var_contains_doublecolon" version="1">
> +    <ind:object object_ref="object_env_var_path" />
> +    <ind:state state_ref="state_contains_double_colon" />
> +  </ind:environmentvariable_test>
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH contains . twice in a row"
> id="test_env_var_contains_doubleperiod" version="1">
> +    <ind:object object_ref="object_env_var_path" />
> +    <ind:state state_ref="state_contains_double_period" />
> +  </ind:environmentvariable_test>
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH ends with : or ." id="test_env_var_ends" version="1">
>      <ind:object object_ref="object_env_var_path" />
>      <ind:state state_ref="state_ends_colon_period" />
>    </ind:environmentvariable_test>
> -  <ind:environmentvariable_test check="all" comment="environment variable
> PATH ends with : or ." id="test_env_var_ends" version="1">
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH starts with an absolute path /"
> id="test_env_var_begins_slash" version="1">
>      <ind:object object_ref="object_env_var_path" />
> -    <ind:state state_ref="state_contains_double_colon_period" />
> +    <ind:state state_ref="state_begins_slash" />
> +  </ind:environmentvariable_test>
> +  <ind:environmentvariable_test check="none satisfy" comment="environment
> variable PATH contains relative paths"
> id="test_env_var_contains_relative_path" version="1">
> +    <ind:object object_ref="object_env_var_path" />
> +    <ind:state state_ref="state_contains_relative_path" />
>    </ind:environmentvariable_test>
>    <ind:environmentvariable_object id="object_env_var_path" version="1">
> -    <ind:name>PATH</ind:name>
> +    <ind:name>PATHTEST</ind:name>
>    </ind:environmentvariable_object>
>    <ind:environmentvariable_state comment="starts with colon or period"
> id="state_begins_colon_period" version="1">
>      <ind:value operation="pattern match">^[:\.]</ind:value>
>    </ind:environmentvariable_state>
> -  <ind:environmentvariable_state comment="colon or period twice in a row"
> id="state_contains_double_colon_period" version="1">
> -    <ind:value operation="pattern match">[:\.][:\.]</ind:value>
> +  <ind:environmentvariable_state comment="colon twice in a row"
> id="state_contains_double_colon" version="1">
> +    <ind:value operation="pattern match">::</ind:value>
> +  </ind:environmentvariable_state>
> +  <ind:environmentvariable_state comment="period twice in a row"
> id="state_contains_double_period" version="1">
> +    <ind:value operation="pattern match">\.\.</ind:value>
>    </ind:environmentvariable_state>
>    <ind:environmentvariable_state comment="ends with colon or period"
> id="state_ends_colon_period" version="1">
>      <ind:value operation="pattern match">[:\.]$</ind:value>
>    </ind:environmentvariable_state>
> +  <ind:environmentvariable_state comment="begins with a slash"
> id="state_begins_slash" version="1">
> +    <ind:value operation="pattern match">^[^/]</ind:value>
> +  </ind:environmentvariable_state>
> +  <ind:environmentvariable_state comment="elements begin with a slash"
> id="state_contains_relative_path" version="1">
> +    <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
> +  </ind:environmentvariable_state>
>  </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130423/a3e4eaab/attachment.html>


More information about the scap-security-guide mailing list