Suggestion on the 'Ensure All Files Are Owned...' items

Maura Dailey maura at eclipse.ncsc.mil
Tue Aug 6 19:52:48 UTC 2013


First, I'd like to point out that my /proc and /sys is never searched. 
Or /tmp. All three are separate partitions on my system, but I'm not 
sure if that's related.

I've tested your suggested change with some success, but not great 
success. The first problem is that <unix:path> will never return a 
result that ends in a /.

So far:
   <unix:file_object comment="all local files" 
id="object_file_permissions_unowned" version="1">
     <unix:behaviors recurse="symlinks and directories" 
recurse_direction="down" recurse_file_system="local" max_depth="-1" />
     <unix:path operation="pattern match">^/(?!proc|sys)[^/]*$</unix:path>
     <unix:filename operation="pattern match">^.*$</unix:filename>
     <filter 
action="exclude">file_permissions_unowned_userid_list_match</filter>
   </unix:file_object>

Results in:
Nothing with /proc or /sys is returned, but the test file file /meh 
isn't returned either.

My regex is pretty rudimentary. If you have an idea for a change that 
will match /meh, let me know. I have to substitute different directory 
names for proc and sys to ensure it's working correctly, since, as I 
said above, I never get results for /proc and /sys.

(My single line <unix:filepath> will let me exclude directories, while 
still returning the file /meh. This makes my inability to get it to work 
in two lines frustrating.)

- Maura Dailey

On 07/25/2013 12:31 PM, Tomas Heinrich wrote:
> Hi,
>
> I've browsed through the thread and have several remarks.
>
> - the tree under /sys causes the same problems a /proc and should be 
> filtered out
>
> - OpenSCAP should already consider these as not "local" which 
> mitigates this problem a bit, but that doesn't help much from SSG's POV
>
> - in the example below, the 'behaviors' element is redundant, as the 
> specs [1] put it:
>> the 'max_depth' and 'recurse_direction' attributes of the 'behaviors'
>> element do not apply to the 'filepath' element, only to the 'path'
>> and 'filename' elements.
>
> On 07/23/2013 09:47 PM, Maura Dailey wrote:
>> I looked at the USGCB stuffs and here's what I put together for
>> file_permissions_unowned.xml in OVAL to eliminate /proc.
>
>>  <unix:file_object comment="all local files" 
>> id="file_permissions_unowned_object" version="1">
>>    <unix:behaviors recurse="symlinks and directories" 
>> recurse_direction="down" recurse_file_system="local" />
>>    <unix:filepath operation="pattern match">^(?!\/proc)/</unix:filepath>
>
> You don't want to do this ^^^. This tries to match a regexp to every 
> file on the system. You should rather use something along the lines of:
>
>> <unix:behaviors recurse="symlinks and directories" 
>> recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
>> <unix:path operation="pattern match">^/(?!proc/)[^/]*/$</unix:path>
>> <unix:filename operation="pattern match">^.*$</unix:filename>
>
> The regex in 'path' just matches a top-level directory and the 
> recursion follows from each of them, which should be faster.
>
> [1] 
> http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-definitions-schema.html
>
> Tomas
>



More information about the scap-security-guide mailing list