[PATCH ] [RHEL/6] search for libraries would find items outsite /lib /lib64 /usr/lib and /usr/lib64

Jan Ruzicka jan.ruzicka at comtechmobile.com
Tue Apr 22 16:04:43 UTC 2014


Hi

Should the "library directories" test include subdirectories or just directories themselves?
The required '/' at the expression end doesn't look right.
Mentioned directories (/lib, /lib64, /usr/lib, and /usr/lib64) would not match the pattern.

Jan

On Apr 22, 2014, at 11:49, Shawn Wells wrote:

> 
> On 4/22/14, 11:23 AM, Renshaw, Richard /c wrote:
>> In my particular case, it would fail the ‘file_ownership_library_dirs’ CCE-27424-1, test by finding this file:
>>  
>> 528273   12 -rwsr-xr-x   1 abrt     abrt         9904 Aug 13  2013 /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
>>  
>> Patched ssg-rhel6-oval.xml to include a / at the end of the directory in the pattern match
>>  
>> --- orig.ssg-rhel6-oval.xml            2014-04-22 10:14:05.181639519 -0500
>> +++ ssg-rhel6-oval.xml  2014-04-22 10:15:26.376636705 -0500
>> @@ -10573,13 +10573,13 @@
>>      </linux:rpminfo_object>
>>      <unix:file_object comment="library directories" id="oval:ssg:obj:1862" version="1">
>>        <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
>> -      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
>> +      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
>>        <unix:filename xsi:nil="true"/>
>>        <filter action="include">oval:ssg:ste:2182</filter>
>>      </unix:file_object>
>>      <unix:file_object comment="library files" id="oval:ssg:obj:1863" version="1">
>>        <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
>> -      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
>> +      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
>>        <unix:filename operation="pattern match">^.*$</unix:filename>
>>       <filter action="include">oval:ssg:ste:2182</filter>
>>      </unix:file_object>
>>  
>>  
>> Verified it passes on my test system.
>>  
>> Thanks,
>> Rick Renshaw
> 
> 
> I'm able to replicate:
> 
>> $ sudo ./testcheck.py file_ownership_library_dirs.xml
>> $ sudo vim /tmp/file_ownership_library_dirs4UFZxe.xml-results 
>> ......
>>         <system_data>
>>           <unix-sys:file_item id="1300351" status="exists">
>>             <unix-sys:filepath>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</unix-sys:filepath>
>>             <unix-sys:path>/usr/libexec</unix-sys:path>
> 
> As Rick called out, /usr/libexec is artificially being scanned.
>> $ sudo ./testcheck.py file_ownership_library_dirs.xml 
>> Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsKSd7er.xml
>> Writing results to : /tmp/file_ownership_library_dirsKSd7er.xml-results
>> Definition oval:scap-security-guide.testing:def:100: true
>> Evaluation done.
> 
> Acking and pushing this patch:
> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=55b5ec008650ead4249edc6305196326aa09b2fd
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Jan Ruzicka
Senior Software Engineer
Comtech Mobile Datacom Corporation
20430 Century Blvd, Germantown, MD 20874
Office: 240-686-3300
Fax: 240-686-3301
 
The information contained in this message may be privileged and/or confidential. If you are not the intended recipient, or responsible for delivering this message to the intended recipient, any review, forwarding, dissemination, distribution or copying of this communication or any attachment(s) is strictly prohibited. If you have received this message in error, please so notify the sender immediately, and delete it and all attachments from your computer and network.



More information about the scap-security-guide mailing list