Various False Positives?

Shawn Wells shawn at redhat.com
Sun Sep 1 15:39:50 UTC 2013


On 8/28/13 6:15 PM, Maura Dailey wrote:
> I think the RPM is just really out of date.
It is! :(  There's been 63 patches since the July release. I'll cut a 
new RPM once the patches I sent out today are reviewed (Dave Smith said 
he might be able to take a look).



$ git log --oneline --after={2013-07-05} --no-merges
1253b6e [bugfix] Updated selinux_bootloader_notdisabled per ticket 391
eb4d177 [bugfix] Updated regex+filepath for umask_for_daemons - Wrong 
filepath - Broke regex - Added signoff
b034d93 Updated STIG refine values for ucredit, ocredit, lcredit
297ffb2 OVAL signoff for template_permissions
53faca6 [bugfix] oval/checks/templates/output/.gitignore updated to 
ignore .sh files
ccd8c14 OVAL testing template_package_removed
92a6939 OVAL testing for template_kernel_module_disabled
285b70d template_OVAL_package_installed testing + bash remediations - 
Testing of OVAL for template_OVAL_package_installed  - Adding of ass
6ebc93f Updated NIST profile ID
90f3331 added "checks" as a dependency for tables
4c76e49 Tiny patch to correct typo, it's -S stime, not -S time.
156d71a Prose changes and copy editing
8612b07 added interrogatory phrase to OCIL questions
ee53c82 Another batch of tested checks. Includes some checks that had 
their comments expanded or were renamed from random values.
cca02fb Check will return list of all partitions without nodev instead 
of a complete list of all partitions and the return value of true/fa
3c2ddb9 improved table to indicate when OVAL checks have been tested
92dc471 made CSS adjustments to make <pre> wrap
b5c35b6 Existing check was screwed up (title was wrong, comments were 
wrong, etc.) and was easily replaced by a templated check
2f92bb8 Improbably, the input line for UDP is $UDPServerRun, not 
$InputUDPServerRun. Also, the check forgot to include the port number, so
eeec622 Original check assumed that sha512 would always be the first option
95c8805 Guide refers to :omrelp: as a valid remote logging option, so 
I've updated the check to accept that format as well
6d40bcb Making SSH checks uniform and hopefully adding case insensitive 
matches properly
8d2b031 Adding reference tags to show which checks I've tested. Some 
very slight whitespace corrections were made as well.
04a0fb6 [bugfix] Updated XCCDF rule name of 
set_sysctl_ipv6_default_accept_redirects in profiles
477cf7d Check needs to be reversed. As is, if you specified 10 as the 
maximum number of concurrent logins, it would allow 20.
499d1ca Small patch to replace autogenerated test, state, and object ids 
with human readable ones (now with 80 character line breaks)
0bea4ab moved namespace assignment into shorthand2xccdf.xslt transform
464b876 added comment, added calls to insert Profiles
2a62395 removing calls to now-unnecessary transforms
61da0f5 Adding new OVAL check that will parse /etc/passwd, looking for 
system accounts with real login shells (not /sbin/nologin, /sbin/hal
fc064ce renaming namespace addition file, as part of refactoring
9c366bb removing namespaces from no-namespace fragments, transforms
28630df refactoring of XCCDF shorthand expansion and namespace assignments
b22713b Added rule for disabling interface use of IPv6
57464ba Additional option for number of max concurrent logins
19be81c Added rule regarding anonymous NFS connections
0986a65 modified transform to include new profile
65b0a84 added example of a custom profile
92dd7a3 DHCP section referred to the wrong file location for dhcpd.conf
c351938 Last item in Avahi file feels like it's supposed to be a Rule, 
not a Group
c929fc5 It IS always,exit NEVER exit,always!
996bf22 what?
0b1ad85 Correct telnet service disabled checks
53ae081 Audit test fix to match rest of checks, also fixed text doc
748b723 Corrected bash services template - Updated Makefile - Removed 
incorrectly generated service enable scripts
9ce1c3a Removing content of pattern match line, since it seems to break 
OVAL. Also, updated id names to be real words, not randomly generat
8f89e00 removal of invalid state child element in world-writable files test
6699d5a removal of invalid state child element in /var/log/audit 
ownership test
ff9da0a new versions of unauth suid/sgid OVAL checks
789e0c1 Added line to indicate test output file, to OVAL testing script
e24cf91 Created remediation template: create_services_enabled
52a2e0b Removing unreferenced OVAL file_ssh_host_keys_public_permissions.xml
fd78bd7 Removing unreferenced 
file_ssh_host_keys_private_permissions.xml   Removing unreferenced 
file_ssh_host_keys_private_permissions.xml
a8b3a2b Updated selinux_all_devicefiles_labeled  The check enumeration 
of 'none exist' was depricated for 'none satisfy' as of OVAL 5.3, re
32652f9 Added OVAL mapping to world_writeable_files  Mapped OVAL 
file_permissions_unauthorized_world_writable to XCCDF world_writeable_file
2a027a4 Corrected naming of set_sysctl_ipv6_default_accept_redirects   
Updated naming of XCCDF rule "set_sysctl_ipv6_default_accept_redirec
e2a0203 Added OVAL + remediation for 
sysctl_net_ipv6_conf_default_accept_ra   Generated from templates
a46ca9b Created OVAL + remediation for 
sysctl_net_ipv6_conf_default_accept_redirects  Created using templates
73f5ddc removal of invalid state child element in world-writable files 
test pushing for jeff blank via https://lists.fedorahosted.org/piper
fe7008e removal of invalid state child element in /var/log/audit 
ownership test pushing for jeff blank per https://lists.fedorahosted.org/p
76d18ba Changes to SSHD Ciphers
7bcca7b Removing '\' from audit rule lines to prevent confusion.
3fd0b9f Updated RPM version to 0.1-12



More information about the scap-security-guide mailing list