Suggestion on the 'Ensure All Files Are Owned...' items

Steve Grubb sgrubb at redhat.com
Tue Jul 23 18:19:53 UTC 2013


On Tuesday, July 23, 2013 02:04:48 PM Maura Dailey wrote:
> On 07/23/2013 01:23 PM, Gary Gapinski wrote:
> > On 07/23/2013 01:17 PM, Maura Dailey wrote:
> >> Does anyone actually have a way to "unown" or "ungroup own" a file for
> >> testing purposes? I'd like to see if the uid shows up as 0 or as xsi:nil.
> > 
> > chown <pick some unused uid> file
> > chgrp <pick some unused gid> file
> 
> Huh, didn't realize that was all we were testing for. That makes it way
> harder to test in OVAL, obviously, since the normal file test will
> happily report whatever value it finds without checking if it's assigned
> to a user or group.

This test is correctly working in RHEL5 USGCB. There is a variable with local user ID's:

                <ind-def:textfilecontent54_object id="oval:gov.nist.usgcb.rhel:obj:200501" version="1">
                        <ind-def:filepath>/etc/passwd</ind-def:filepath>
                        <ind-def:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind-def:pattern>
                        <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                </ind-def:textfilecontent54_object>

And this is used in another test:
                <unix-def:file_state id="oval:gov.nist.usgcb.rhel:ste:20050" version="1" comment="Files with a valid user id assigned">
                        <unix-def:user_id datatype="int" var_check="at least one" var_ref="oval:gov.nist.usgcb.rhel:var:200501"/>
                </unix-def:file_state>


which checks the results of recursing the local file system:

                <unix-def:file_object id="oval:gov.nist.usgcb.rhel:obj:20050" version="1" comment="all local files without a valid user assigned">
                        <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
                        <unix-def:path>/</unix-def:path>
                        <unix-def:filename operation="pattern match">.*</unix-def:filename>
                        <filter>oval:gov.nist.usgcb.rhel:ste:20050</filter>
                </unix-def:file_object>

This was working in the past.

-Steve


More information about the scap-security-guide mailing list