<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 9/28/13 8:15 PM, Shawn Wells wrote:<br>
    </div>
    <blockquote cite="mid:20130929001517.GA30512@mail.corp.redhat.com"
      type="cite">
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-OVAL-signoff-accounts_dangerous_path_for_root.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From 273fca22af9e24a42da94bbf92a64af4e3082a13 Mon Sep 17 00:00:00 2001
From: Shawn Wells <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:shawn@redhat.com">&lt;shawn@redhat.com&gt;</a>
Date: Fri, 27 Sep 2013 15:59:58 -0400
Subject: [PATCH 1/8] OVAL signoff: accounts_dangerous_path_for_root

TESTING:
[root@SSG-RHEL6 checks]# find /lib -perm /022 -type f ; find /lib64/ -perm /022 -type f ; find /usr/lib -perm /022 -type f ; find /usr/lib64 -perm /022 -type f
[root@SSG-RHEL6 checks]# ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirstUlHnu.xml
Writing results to : /tmp/file_permissions_library_dirstUlHnu.xml-results
Definition oval:scap-security-guide.testing:def:207: true
Evaluation done.
[root@SSG-RHEL6 checks]# chmod go+w /lib64/libacl.so.1
[root@SSG-RHEL6 checks]# ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirstTWqp5.xml
Writing results to : /tmp/file_permissions_library_dirstTWqp5.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
---
 .../checks/accounts_dangerous_path_for_root.xml    |   67 +++++++++++++-------
 1 files changed, 44 insertions(+), 23 deletions(-)

diff --git a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
index efc4f0d..7e475c4 100644
--- a/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
+++ b/RHEL6/input/checks/accounts_dangerous_path_for_root.xml
@@ -5,7 +5,9 @@
       &lt;affected family="unix"&gt;
         &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
       &lt;/affected&gt;
-      &lt;description&gt;The environment variable PATH should be set correctly for the root user.&lt;/description&gt;
+      &lt;description&gt;The environment variable PATH should be set correctly for
+      the root user.&lt;/description&gt;
+      &lt;reference source="MED" ref_id="20130925" ref_url="test_attestation" /&gt;
     &lt;/metadata&gt;
     &lt;criteria comment="environment variable PATH contains dangerous path" operator="AND"&gt;
       &lt;criterion comment="environment variable PATH starts with : or ." test_ref="test_env_var_begins" /&gt;
@@ -16,50 +18,69 @@
       &lt;criterion comment="environment variable PATH doesn't contain relative paths" test_ref="test_env_var_contains_relative_path" /&gt;
     &lt;/criteria&gt;
   &lt;/definition&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with : or ." id="test_env_var_begins" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_object id="object_accounts_dangerous_path_for_root"
+  version="1"&gt;
+    &lt;ind:pid xsi:nil="true" datatype="int" /&gt;
+    &lt;ind:name&gt;PATH&lt;/ind:name&gt;
+  &lt;/ind:environmentvariable58_object&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH starts with : or ."
+  id="test_env_var_begins" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_begins_colon_period" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains : twice in a row" id="test_env_var_contains_doublecolon" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH doesn't contain : twice in a row"
+  id="test_env_var_contains_doublecolon" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_contains_double_colon" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains . twice in a row" id="test_env_var_contains_doubleperiod" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH doesn't contain . twice in a row"
+  id="test_env_var_contains_doubleperiod" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_contains_double_period" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH ends with : or ." id="test_env_var_ends" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH ends with : or ." id="test_env_var_ends"
+  version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_ends_colon_period" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="test_env_var_begins_slash" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH starts with an absolute path /"
+  id="test_env_var_begins_slash" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_begins_slash" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains relative paths" id="test_env_var_contains_relative_path" version="1"&gt;
-    &lt;ind:object object_ref="object_env_var_path" /&gt;
+  &lt;ind:environmentvariable58_test check="none satisfy"
+  comment="environment variable PATH contains relative paths"
+  id="test_env_var_contains_relative_path" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_dangerous_path_for_root" /&gt;
     &lt;ind:state state_ref="state_contains_relative_path" /&gt;
   &lt;/ind:environmentvariable58_test&gt;
-  &lt;ind:environmentvariable58_object id="object_env_var_path" version="1"&gt;
-    &lt;ind:pid xsi:nil="true" datatype="int" /&gt;
-    &lt;ind:name&gt;PATH&lt;/ind:name&gt;
-  &lt;/ind:environmentvariable58_object&gt;
-  &lt;ind:environmentvariable58_state comment="starts with colon or period" id="state_begins_colon_period" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="starts with colon or period"
+  id="state_begins_colon_period" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;^[:\.]&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
-  &lt;ind:environmentvariable58_state comment="colon twice in a row" id="state_contains_double_colon" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="colon twice in a row"
+  id="state_contains_double_colon" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;::&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
-  &lt;ind:environmentvariable58_state comment="period twice in a row" id="state_contains_double_period" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="period twice in a row"
+  id="state_contains_double_period" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;\.\.&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
-  &lt;ind:environmentvariable58_state comment="ends with colon or period" id="state_ends_colon_period" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="ends with colon or period"
+  id="state_ends_colon_period" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;[:\.]$&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
-  &lt;ind:environmentvariable58_state comment="begins with a slash" id="state_begins_slash" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="begins with a slash"
+  id="state_begins_slash" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;^[^/]&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
-  &lt;ind:environmentvariable58_state comment="elements begin with a slash" id="state_contains_relative_path" version="1"&gt;
+  &lt;ind:environmentvariable58_state comment="elements begin with a slash"
+  id="state_contains_relative_path" version="1"&gt;
     &lt;ind:value operation="pattern match"&gt;[^\\]:[^/]&lt;/ind:value&gt;
   &lt;/ind:environmentvariable58_state&gt;
 &lt;/def-group&gt;
<div class="moz-txt-sig">-- 
1.7.1

</div></pre>
      </div>
    </blockquote>
    <br>
    Shawn Wells 10:53<br>
    patches sent<br>
    <br>
    Dave 10:55<br>
    Looks awesome, ack to all.  I hesitate to ack now (don't have access
    to work address)<br>
    <br>
    Shawn Wells 10:56<br>
    i can copy/paste this chat, if that works [stripping emails]<br>
    err, you know, the pieces to show the ack<br>
    <br>
    Dave 10:57<br>
    that works<br>
    <br>
    <br>
    <br>
    ..... result: pushed patches<br>
  </body>
</html>