[PATCH] Added checks for 'hard' or '-' for checks in /etc/security/limits.conf

Shawn Wells shawn at redhat.com
Thu Oct 3 03:09:28 UTC 2013


On 9/30/13 2:16 PM, Shane Shaffer wrote:
> Is this object being used in a test that does a comparison on the 
> numerical value? The parentheses around the \d+ in the previous 
> version suggests that it is. Since the new parentheses create a second 
> subexpression, that could interfere with the evaluation of the 
> intended subexpression. There are a few ways around this, but unless 
> the value of hard|- is needed somewhere, the cleanest way would be to 
> make that a non-capturing group.

The full OVAL is here:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml

The important bits:
> |
>    <ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1">
>      <ind:filepath>/etc/security/limits.conf</ind:filepath>
>      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
>      <ind:instance datatype="int">1</ind:instance>
>    </ind:textfilecontent54_object>
>
>    <ind:textfilecontent54_state id="state_maxlogins" version="1">
>      <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
>    </ind:textfilecontent54_state>|

So then, you're right. The new parenthesis act as a capture group. 
Oddly, things still check out when doing a testcheck!

I can't find the OVAL 5.10 spec with this info, however reference the 
(now antiquated) 5.6 spec. Specifically the "extensions":
http://oval.mitre.org/language/about/re_support_5.6.html

I believe the pattern match should be updated to:

|^[\s]*\*[\s]+(*?:*hard|-)[\s]+maxlogins[\s]+(\d+)\s*$|


(note the "?:")

Frank, could you bugfix this?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131002/d939012d/attachment-0001.html>


More information about the scap-security-guide mailing list