[PATCH ] [RHEL/6] search for libraries would find items outsite /lib /lib64 /usr/lib and /usr/lib64

Jan Ruzicka jan.ruzicka at comtechmobile.com
Tue Apr 22 18:53:56 UTC 2014


Shawn,

The string terminator was, what I had in mind.
The pattern would not match on subdirectories and that was reason why I asked.
I was aware of the wrongfully tested libexec directory that triggered the patter change in the first place.

Jan


On Apr 22, 2014, at 13:25, Shawn Wells wrote:


On 4/22/14, 12:16 PM, Renshaw, Richard /c wrote:

Jan,
Without the trailing / the regex will match any directory starting with /lib, /lib64, /usr/lib, or /usr/lib64.  Like the spurious /usr/libexec/ file I was running into. Even if the trailing / isn't the correct fix, something needs to be changed to fix the regex.


Jan is right. Add a string terminator? e.g.:

-      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
+      <unix:path operation="pattern match">^\/lib(|64)$|^\/usr\/lib(|64)$</unix:path>



$ sudo chown root /lib
$ sudo ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsp5REdU.xml
Writing results to : /tmp/file_ownership_library_dirsp5REdU.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.

$ sudo chown shawn /lib
$ sudo ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsWTFf4x.xml
Writing results to : /tmp/file_ownership_library_dirsWTFf4x.xml-results
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.

$ sudo chown shawn /usr/libexec/ ; sudo chown root /lib
$ sudo ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsJ5RNOT.xml
Writing results to : /tmp/file_ownership_library_dirsJ5RNOT.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.


_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org<mailto:scap-security-guide at lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Jan Ruzicka
Senior Software Engineer
Comtech Mobile Datacom Corporation
20430 Century Blvd, Germantown, MD 20874
Office: 240-686-3300
Fax: 240-686-3301

The information contained in this message may be privileged and/or confidential. If you are not the intended recipient, or responsible for delivering this message to the intended recipient, any review, forwarding, dissemination, distribution or copying of this communication or any attachment(s) is strictly prohibited. If you have received this message in error, please so notify the sender immediately, and delete it and all attachments from your computer and network.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140422/a2ddc444/attachment-0001.html>


More information about the scap-security-guide mailing list