Current scan issues

Andrew Gilmore agilmore2 at gmail.com
Mon May 19 19:37:55 UTC 2014


Periodically, I do a git merge with upstream and test the result against my
system. Most of the time, things get better, but occasionally, something
breaks. Here's my list of broken stuff:

Rule world_writeable_files:
Now scans /proc and shows thousands of files from /proc/#/attr/<file> with
permissions 777.

Rule package_openswan_installed: Yum tells me that I have libreswan
installed, which obsoletes openswan. Is downgrading to openswan really
required, and why?

Rule world_writable_files_system_ownership:
Now finding /tmp/.X11-unix and /tmp/.ICE-unix where it did not before.
What's the right way to address this? Why are these 777 anyway?

Rule accounts_max_concurrent_login_sessions:
Broken regular expressions, I may get to a patch for this one, something
like (if I can ever figure out gmail's formatting!)

diff --git a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
index b08faa5..b0f0920 100644
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -21,7 +21,7 @@

   <ind:textfilecontent54_object
id="object_etc_security_limits_conf_maxlogins" version="1">
     <ind:filepath>/etc/security/limits.conf</ind:filepath>
-    <ind:pattern operation="pattern
match">^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
+    <ind:pattern operation="pattern
match">^[\s]*\*[\s]+hard|-[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140519/d9e2b416/attachment-0001.html>


More information about the scap-security-guide mailing list