[PATCH] [RHEL/6] Add heading regex anchor to cups_disable_browsing OVAL check

Jan Lieskovsky jlieskov at redhat.com
Thu Mar 6 14:29:32 UTC 2014


Hello folks,

  based on https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005065.html
this patch adds heading regex anchor support for cups_disable_browsing OVAL check
(dedicated separate post to this patch, because just adding ^[\s]* to the two config file
directives isn't sufficient. See below for further explanation).

Besides adding ^[\s]* prefix to Browsing and BrowseAllow directives, it was also
necessary not to negate the meaning of second test, because since in the new / modified
scenario, only cups config rows starting with Browsing / BrowseAllow (not prefixed
with a comment) are returned as success, what could happen with unmodified criteria
evaluation is the following:

Suppose case Browsing would be turned off:

  Browsing Off

and BrowseAllow would contain 'none', but it would be commented out (possibly containing
another comment behind none), e.g.

  # BrowseAllow none # Some another comment here

Check for 'BrowseAllow[\s]+(?!none)' would return false, it's negation true. AND-ing both
results (true for Browsing Off) and true for the negation would return true / pass as a
result. => This patch removes the negation, and returns true only for case both of:

  Browsing Off
  BrowseAllow none

are present in the configuration file (possibly suffixed with some comments). For remaining
alternatives it returns false / fail OVAL result.

Has been tested on RHEL-6 and seems to be working properly.

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: Patch re-news also test_attestation on RHEL-6 and updates OVAL tests / objects versions
      to indicate the second version.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-RHEL-6-Add-heading-regex-anchor-to-cups_disable_brow.patch
Type: text/x-patch
Size: 3272 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140306/1797ee58/attachment.bin>


More information about the scap-security-guide mailing list