[PATCH] [RHEL/6] Add heading regex anchor to cups_disable_browsing OVAL check
Jan Lieskovsky
jlieskov at redhat.com
Thu Mar 6 14:29:32 UTC 2014
Hello folks,
based on https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005065.html
this patch adds heading regex anchor support for cups_disable_browsing OVAL check
(dedicated separate post to this patch, because just adding ^[\s]* to the two config file
directives isn't sufficient. See below for further explanation).
Besides adding ^[\s]* prefix to Browsing and BrowseAllow directives, it was also
necessary not to negate the meaning of second test, because since in the new / modified
scenario, only cups config rows starting with Browsing / BrowseAllow (not prefixed
with a comment) are returned as success, what could happen with unmodified criteria
evaluation is the following:
Suppose case Browsing would be turned off:
Browsing Off
and BrowseAllow would contain 'none', but it would be commented out (possibly containing
another comment behind none), e.g.
# BrowseAllow none # Some another comment here
Check for 'BrowseAllow[\s]+(?!none)' would return false, it's negation true. AND-ing both
results (true for Browsing Off) and true for the negation would return true / pass as a
result. => This patch removes the negation, and returns true only for case both of:
Browsing Off
BrowseAllow none
are present in the configuration file (possibly suffixed with some comments). For remaining
alternatives it returns false / fail OVAL result.
Has been tested on RHEL-6 and seems to be working properly.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
P.S.: Patch re-news also test_attestation on RHEL-6 and updates OVAL tests / objects versions
to indicate the second version.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-RHEL-6-Add-heading-regex-anchor-to-cups_disable_brow.patch
Type: text/x-patch
Size: 3272 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140306/1797ee58/attachment.bin>
More information about the scap-security-guide
mailing list