Suggestion on the 'Ensure All Files Are Owned...' items
Tomas Heinrich
theinric at redhat.com
Thu Jul 25 16:31:43 UTC 2013
Hi,
I've browsed through the thread and have several remarks.
- the tree under /sys causes the same problems a /proc and should be
filtered out
- OpenSCAP should already consider these as not "local" which mitigates
this problem a bit, but that doesn't help much from SSG's POV
- in the example below, the 'behaviors' element is redundant, as the
specs [1] put it:
> the 'max_depth' and 'recurse_direction' attributes of the 'behaviors'
> element do not apply to the 'filepath' element, only to the 'path'
> and 'filename' elements.
On 07/23/2013 09:47 PM, Maura Dailey wrote:
> I looked at the USGCB stuffs and here's what I put together for
> file_permissions_unowned.xml in OVAL to eliminate /proc.
> <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1">
> <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" />
> <unix:filepath operation="pattern match">^(?!\/proc)/</unix:filepath>
You don't want to do this ^^^. This tries to match a regexp to every
file on the system. You should rather use something along the lines of:
> <unix:behaviors recurse="symlinks and directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
> <unix:path operation="pattern match">^/(?!proc/)[^/]*/$</unix:path>
> <unix:filename operation="pattern match">^.*$</unix:filename>
The regex in 'path' just matches a top-level directory and the recursion
follows from each of them, which should be faster.
[1]
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-definitions-schema.html
Tomas
More information about the scap-security-guide
mailing list