<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" bgcolor="#ffffff">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">That would remove the issues of catching things in /proc, which is probably where there is the most 'churn' in terms of 'files' appearing and disappearing rapidly. There would
still be the occasional case where a file exists when 'find' scans a directory for files but doesn't exists by the time 'find' loops throught entries to actually look at it. I haven't look back historically to see when the '-ignore_readdir_race' flag appeared,
so I haven't a clue how often such a race condition occurs.<br>
<br>
-Rob<br>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF591137"><font color="#000000" face="Tahoma" size="2"><b>From:</b> scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Shawn Wells [shawn@redhat.com]<br>
<b>Sent:</b> Monday, July 22, 2013 9:27 PM<br>
<b>To:</b> scap-security-guide@lists.fedorahosted.org<br>
<b>Subject:</b> Re: Suggestion on the 'Ensure All Files Are Owned...' items<br>
</font><br>
</div>
<div></div>
<div>
<div class="moz-cite-prefix">On 7/19/13 1:52 PM, Andrew Gilmore wrote:<br>
</div>
<blockquote type="cite">
<pre>I agree, I see false positives on my systems where the only output
from a manual 'sudo find / -type f -perm o+w' is errors on /proc
directories.
Andrew
On Thu, Jul 18, 2013 at 11:11 AM, Robert Sanders <a class="moz-txt-link-rfc2396E" href="mailto:rsanders@trustedcs.com" target="_blank"><rsanders@trustedcs.com></a> wrote:
</pre>
<blockquote type="cite" style="color: rgb(0, 0, 0);">
<pre><span class="moz-txt-citetags">> </span>I was wondering why the tests for 'Ensure all Files Are Owned by a User' and
<span class="moz-txt-citetags">> </span>'Ensure all Files are Owned by a Group' kept on failing. Drilling down it
<span class="moz-txt-citetags">> </span>looks like the underlying find command being used is along the lines of :
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">> </span>find PARTITION -xdev -nouser -print
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">> </span>When I run this command manually I've had complaints that find can't read
<span class="moz-txt-citetags">> </span>files in /proc. Looking at the man page suggests this can be avoided by
<span class="moz-txt-citetags">> </span>adding the '-ignore_readdir_race' option before the -xdev option.
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">> </span>This change may need to be added for both SSG items 2.2.3.e and 2.2.3.f
<span class="moz-txt-citetags">></span>
<span class="moz-txt-citetags">> </span>-Rob
<span class="moz-txt-citetags">></span></pre>
</blockquote>
</blockquote>
<br>
Hmm. The OVAL spec is here (search for " == FileBehaviors =="):<br>
<a class="moz-txt-link-freetext" href="http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/linux-definitions-schema.html" target="_blank">http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/linux-definitions-schema.html</a><br>
<br>
And our OVAL:<br>
<blockquote type="cite"> <unix:file_object comment="all local files"<br>
id="obj_20022" version="1"><br>
<unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /><br>
<unix:path>/</unix:path><br>
<unix:filename operation="pattern match">.*</unix:filename><br>
</unix:file_object></blockquote>
<br>
According to the spec, it should be possible to use recurse_file_system="defined", and use the unix:filename to create a regex that excludes /proc<br>
<br>
Maura seems to have the best regex skills.... ;)<br>
</div>
</div>
</div>
</body>
</html>