[PATCH 3/3] [bugfix] Updated regex+filepath for umask_for_daemons

Shawn Wells shawn.d.wells at gmail.com
Sun Sep 1 14:17:10 UTC 2013


-------------- next part --------------
>From eb4d1772221d7c31edcc8e72371343624fba0a60 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 30 Aug 2013 20:05:54 -0400
Subject: [PATCH 3/3] [bugfix] Updated regex+filepath for umask_for_daemons
 - Wrong filepath
 - Broke regex
 - Added signoff

Testing:
The XCCDF (set_daemon_umask) points to:

<oval id="umask_for_daemons" value="var_umask_for_daemons"/>

so, to test:
[shawn at rhel6 checks]$ grep umask /etc/init.d/functions
umask 022
[shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export var_umask_for_daemons
[shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
Definition oval:scap-security-guide.testing:def:212: false
Evaluation done.

but then in the OVAL code, it's looking at the wrong place:
<ind:textfilecontent54_object id="object_umask_for_daemons" version="1">
    <ind:path>/etc/sysconfig</ind:path>
    <ind:filename>init</ind:filename>
    <ind:pattern operation="pattern match">umask[\s]+(.*)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

verified no other XCCDF rule was using this OVAL:
[shawn at rhel6 input]$ grep -rin umask_for_daemons system/*
system/permissions/execution.xml:18:<Value id="var_umask_for_daemons" type="string" operator="equals" interactive="0">
system/permissions/execution.xml:47:<oval id="umask_for_daemons" value="var_umask_for_daemons"/>

.... wrote a patch to fix the pattern match expression, and file path things seem OK now:
[shawn at rhel6 checks]$ var_umask_for_daemons=022 ; export var_umask_for_daemons
[shawn at rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
Writing results to : /tmp/umask_for_daemons394CCR.xml-results
Definition oval:scap-security-guide.testing:def:212: true
Evaluation done.
---
 RHEL6/input/checks/umask_for_daemons.xml |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/checks/umask_for_daemons.xml b/RHEL6/input/checks/umask_for_daemons.xml
index 61fdd94..5317911 100644
--- a/RHEL6/input/checks/umask_for_daemons.xml
+++ b/RHEL6/input/checks/umask_for_daemons.xml
@@ -7,6 +7,7 @@
       </affected>
       <description>The daemon umask should be set as
       appropriate</description>
+      <reference source="swells" ref_id="20130901" ref_url="test_attestation" />
     </metadata>
     <criteria>
       <criterion test_ref="test_umask_for_daemons" />
@@ -27,9 +28,9 @@
   <external_variable comment="external variable for daemon umask" datatype="string" id="var_umask_for_daemons" version="1" />
 
   <ind:textfilecontent54_object id="object_umask_for_daemons" version="1">
-    <ind:path>/etc/sysconfig</ind:path>
-    <ind:filename>init</ind:filename>
-    <ind:pattern operation="pattern match">umask[\s]+(.*)</ind:pattern>
+    <ind:path>/etc/init.d</ind:path>
+    <ind:filename>functions</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-- 
1.7.1



More information about the scap-security-guide mailing list