[PATCH] [RHEL/6] Don't allow whitespace around equal sign in /etc/sysconfig/init

Jan Ruzicka jan.ruzicka at comtechmobile.com
Mon Apr 21 18:00:46 UTC 2014


On Apr 18, 2014, at 00:00, Shawn Wells wrote:

On 4/7/14, 6:12 AM, Jan Lieskovsky wrote:

When checking /etc/sysconfig/init file for the PROMPT row,
don't allow whitespace characters around the equal sign, since
it's invalid configuration [*].

But comments can be present after the setting, so count with
them (don't fail when the settings meets the criteria, but
there's comment present at the same line yet).

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

[*] /etc/sysconfig/init script has format of a Bash script --
    is run within e.g. /etc/init.d/functions script by each
    service status check etc. Whitespace around equal sign
    result into warning like:

   /etc/sysconfig/init: line 28: no: command not found

   when the PROMPT line has had the form of:

   ^PROMPT=\tno

   But comments are allowed (no warning in the same situation
   when PROMPT line has the proper syntax)


0001-RHEL-6-Don-t-allow-whitespace-around-equal-sign-in-e.patch


>From d14395814d42ee5c732ce4805c1cbbe521268a4a Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov at redhat.com><mailto:jlieskov at redhat.com>
Date: Mon, 7 Apr 2014 14:56:41 +0200
Subject: [PATCH] [RHEL/6] Don't allow whitespace around equal sign in
 /etc/sysconfig/init,          when retrieving PROMPT value (it's invalid
 setting). But allow          trailing comments.

Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com><mailto:jlieskov at redhat.com>
---
 RHEL/6/input/checks/disable_interactive_boot.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/RHEL/6/input/checks/disable_interactive_boot.xml b/RHEL/6/input/checks/disable_interactive_boot.xml
index 1a4f55b..bf5e89c 100644
--- a/RHEL/6/input/checks/disable_interactive_boot.xml
+++ b/RHEL/6/input/checks/disable_interactive_boot.xml
@@ -1,5 +1,5 @@
 <def-group>
-  <definition class="compliance" id="disable_interactive_boot" version="1">
+  <definition class="compliance" id="disable_interactive_boot" version="2">
     <metadata>
       <title>Disable Interactive Boot</title>
       <affected family="unix">
@@ -7,7 +7,7 @@
       </affected>
       <description>The ability for users to perform interactive startups should
       be disabled.</description>
-      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
+      <reference source="JL" ref_id="20140407" ref_url="test_attestation" />
     </metadata>
     <criteria>
       <criterion test_ref="test_disable_interactive_boot" />
@@ -21,9 +21,9 @@
   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_disable_interactive_boot"
-  version="1">
+  version="2">
     <ind:filepath>/etc/sysconfig/init</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*PROMPT[\s]*=[\s]*no[\s]*$</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*PROMPT=no[\s]+</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>


--
1.8.3.1


Great bugfix! This doesn't appear to have been acked.

Ack

Will the pattern allow line containing only "PROMPT=no" ?
The RE  expects at least one space after the "no", but the space is not mentioned in comment nor e-mail.

The example in e-mail would not match.

Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140421/1b11647d/attachment.html>


More information about the scap-security-guide mailing list