Suggestion on the 'Ensure All Files Are Owned...' items

Tomas Heinrich theinric at redhat.com
Thu Jul 25 16:31:43 UTC 2013


Hi,

I've browsed through the thread and have several remarks.

- the tree under /sys causes the same problems a /proc and should be 
filtered out

- OpenSCAP should already consider these as not "local" which mitigates 
this problem a bit, but that doesn't help much from SSG's POV

- in the example below, the 'behaviors' element is redundant, as the 
specs [1] put it:
> the 'max_depth' and 'recurse_direction' attributes of the 'behaviors'
> element do not apply to the 'filepath' element, only to the 'path'
> and 'filename' elements.

On 07/23/2013 09:47 PM, Maura Dailey wrote:
> I looked at the USGCB stuffs and here's what I put together for
> file_permissions_unowned.xml in OVAL to eliminate /proc.

>  <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1">
>    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" />
>    <unix:filepath operation="pattern match">^(?!\/proc)/</unix:filepath>

You don't want to do this ^^^. This tries to match a regexp to every 
file on the system. You should rather use something along the lines of:

> <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
> <unix:path operation="pattern match">^/(?!proc/)[^/]*/$</unix:path>
> <unix:filename operation="pattern match">^.*$</unix:filename>

The regex in 'path' just matches a top-level directory and the recursion 
follows from each of them, which should be faster.

[1] 
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-definitions-schema.html

Tomas



More information about the scap-security-guide mailing list