[PATCH] [RHEL/6] Don't allow whitespace around equal sign in /etc/sysconfig/init
Shawn Wells
shawn at redhat.com
Fri Apr 18 04:00:45 UTC 2014
On 4/7/14, 6:12 AM, Jan Lieskovsky wrote:
> When checking /etc/sysconfig/init file for the PROMPT row,
> don't allow whitespace characters around the equal sign, since
> it's invalid configuration [*].
>
> But comments can be present after the setting, so count with
> them (don't fail when the settings meets the criteria, but
> there's comment present at the same line yet).
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> [*] /etc/sysconfig/init script has format of a Bash script --
> is run within e.g. /etc/init.d/functions script by each
> service status check etc. Whitespace around equal sign
> result into warning like:
>
> /etc/sysconfig/init: line 28: no: command not found
>
> when the PROMPT line has had the form of:
>
> ^PROMPT=\tno
>
> But comments are allowed (no warning in the same situation
> when PROMPT line has the proper syntax)
>
> 0001-RHEL-6-Don-t-allow-whitespace-around-equal-sign-in-e.patch
>
>
> From d14395814d42ee5c732ce4805c1cbbe521268a4a Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Mon, 7 Apr 2014 14:56:41 +0200
> Subject: [PATCH] [RHEL/6] Don't allow whitespace around equal sign in
> /etc/sysconfig/init, when retrieving PROMPT value (it's invalid
> setting). But allow trailing comments.
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
> RHEL/6/input/checks/disable_interactive_boot.xml | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/RHEL/6/input/checks/disable_interactive_boot.xml b/RHEL/6/input/checks/disable_interactive_boot.xml
> index 1a4f55b..bf5e89c 100644
> --- a/RHEL/6/input/checks/disable_interactive_boot.xml
> +++ b/RHEL/6/input/checks/disable_interactive_boot.xml
> @@ -1,5 +1,5 @@
> <def-group>
> - <definition class="compliance" id="disable_interactive_boot" version="1">
> + <definition class="compliance" id="disable_interactive_boot" version="2">
> <metadata>
> <title>Disable Interactive Boot</title>
> <affected family="unix">
> @@ -7,7 +7,7 @@
> </affected>
> <description>The ability for users to perform interactive startups should
> be disabled.</description>
> - <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140407" ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_disable_interactive_boot" />
> @@ -21,9 +21,9 @@
> </ind:textfilecontent54_test>
>
> <ind:textfilecontent54_object id="object_disable_interactive_boot"
> - version="1">
> + version="2">
> <ind:filepath>/etc/sysconfig/init</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*PROMPT[\s]*=[\s]*no[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*PROMPT=no[\s]+</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
>
> -- 1.8.3.1
Great bugfix! This doesn't appear to have been acked.
Ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140417/c40ae7fb/attachment-0001.html>
More information about the scap-security-guide
mailing list