Patch to "RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml"

Shane Shaffer shane.shaffer at g2-inc.com
Wed Jul 10 14:58:07 UTC 2013


While I can't comment on whether the intent is right or wrong, I don't
think the suggested regular expression is quite correct. It may be giving
you the result you expected, but probably not for the right reason. Inside
the [] the (, ),  and | characters lose their significance, so effectively
that pattern is [^bcdhopt()|]. A value of "static" would pass based on the
s, a, or i characters. "none" would pass because of the n or e
characters.  "dhcp" and "bootp" fail because they contain only characters
that are not permitted.  But "pchd" would also fail, as would any other
permutation of the ten characters in the character class.

If you really want to allow anything other than "dhcp" or "bootp" it is
probably easiest to use something like ^(dhcp|bootp)$ and then negate the
test.

Shane Shaffer
G2, Inc.
shane.shaffer at g2-inc.com


On Wed, Jul 10, 2013 at 7:17 AM, Rui Pedro Bernardino <
rui-p-bernardino at ptinovacao.pt> wrote:

> Hi all,****
>
> ** **
>
> I think there’s a mistake on how sysconfig_networking_bootproto_ifcfg
> checks whether dhcp client is enabled. According to RHEL6 docs, BOOTPROTO
> should be one of “none”, “bootp” or “dhcp” and not “static”; /sbin/ifup
> assumes static IP configuration unless either “dhcp” or “bootp” is
> specified.****
>
> ** **
>
> I suggest altering the check from  ‘equals to  “static”’ to ‘anything but
> “dhcp” or “bootp”’, which matches how it will be applied.****
>
> ** **
>
> *** 22,28 ********
>
>     </ind:textfilecontent54_test>****
>
>     <ind:textfilecontent54_state id="state_20135"****
>
>     version="1">****
>
> !   *  <ind:subexpression operation="equals">static</ind:subexpression>***
> **
>
>     </ind:textfilecontent54_state>****
>
>     <ind:textfilecontent54_object id="obj_20135"****
>
>     version="1">****
>
> --- 22,28 ----****
>
>     </ind:textfilecontent54_test>****
>
>     <ind:textfilecontent54_state id="state_20135"****
>
>     version="1">****
>
> !     <*ind:subexpression operation="pattern
> match">[^(dhcp|bootp)]</ind:subexpression>*****
>
>     </ind:textfilecontent54_state>****
>
>     <ind:textfilecontent54_object id="obj_20135"****
>
>     version="1">****
>
> ** **
>
> Regards****
>
> ** **
>
> --****
>
> Rui Pedro Bernardino****
>
> CTE2/Tecnologias e Desenvolvimento****
>
> PT Inovação****
>
> ** **
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130710/0b5270b9/attachment.html>


More information about the scap-security-guide mailing list