<div dir="ltr"><div class="gmail_extra">Is this object being used in a test that does a comparison on the numerical value? The parentheses around the \d+ in the previous version suggests that it is. Since the new parentheses create a second subexpression, that could interfere with the evaluation of the intended subexpression. There are a few ways around this, but unless the value of hard|- is needed somewhere, the cleanest way would be to make that a non-capturing group.</div>

<div class="gmail_extra"> </div><div class="gmail_extra"> </div><div class="gmail_extra">Shane Shaffer<div style="font-size:13.2px">G2, Inc.</div><div style="font-size:13.2px"><a style="color:rgb(28,81,168)" href="mailto:shane.shaffer@g2-inc.com" target="_blank">shane.shaffer@g2-inc.com</a>  <br>

<br></div></div><div class="gmail_quote">On Mon, Sep 30, 2013 at 1:14 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div><div>On 9/30/13 1:09 PM, Frank Caviggia wrote:<br>

<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
From: Frank Caviggia&lt;<a href="mailto:fcaviggi@ra.iad.redhat.com" target="_blank">fcaviggi@ra.iad.<u></u>redhat.com</a>&gt;<br>
<br>
Signed-off-by: Frank Caviggia&lt;<a href="mailto:fcaviggi@ra.iad.redhat.com" target="_blank">fcaviggi@ra.iad.<u></u>redhat.com</a>&gt;<br>
---<br>
  RHEL6/input/checks/accounts_<u></u>max_concurrent_login_sessions.<u></u>xml | 2 +-<br>
  RHEL6/input/checks/disable_<u></u>users_coredumps.xml                | 2 +-<br>
  2 files changed, 2 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/RHEL6/input/checks/accounts_<u></u>max_concurrent_login_sessions.<u></u>xml b/RHEL6/input/checks/accounts_<u></u>max_concurrent_login_sessions.<u></u>xml<br>
index cb2e859..a3658ff 100644<br>
--- a/RHEL6/input/checks/accounts_<u></u>max_concurrent_login_sessions.<u></u>xml<br>
+++ b/RHEL6/input/checks/accounts_<u></u>max_concurrent_login_sessions.<u></u>xml<br>
@@ -21,7 +21,7 @@<br>
      &lt;ind:textfilecontent54_object id=&quot;object_etc_security_<u></u>limits_conf_maxlogins&quot; version=&quot;1&quot;&gt;<br>
      &lt;ind:filepath&gt;/etc/security/<u></u>limits.conf&lt;/ind:filepath&gt;<br>
-    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*\*[\s]+hard[\s]+<u></u>maxlogins[\s]+(\d+)\s*$&lt;/ind:<u></u>pattern&gt;<br>
+    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*\*[\s]+(hard|-)[\<u></u>s]+maxlogins[\s]+(\d+)\s*$&lt;/<u></u>ind:pattern&gt;<br>
      &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:<u></u>instance&gt;<br>
    &lt;/ind:textfilecontent54_<u></u>object&gt;<br>
  diff --git a/RHEL6/input/checks/disable_<u></u>users_coredumps.xml b/RHEL6/input/checks/disable_<u></u>users_coredumps.xml<br>
index d8491cd..ad217a7 100644<br>
--- a/RHEL6/input/checks/disable_<u></u>users_coredumps.xml<br>
+++ b/RHEL6/input/checks/disable_<u></u>users_coredumps.xml<br>
@@ -14,7 +14,7 @@<br>
      &lt;/criteria&gt;<br>
    &lt;/definition&gt;<br>
    &lt;ind:textfilecontent54_test check=&quot;all&quot;<br>
-  comment=&quot;Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]<u></u>+([\d]+) setting in the /etc/security/limits.conf file&quot;<br>
+  comment=&quot;Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+<u></u>core[\s]+([\d]+) setting in the /etc/security/limits.conf file&quot;<br>
    id=&quot;test_core_dumps_<u></u>limitsconf&quot; version=&quot;1&quot;&gt;<br>
      &lt;ind:object object_ref=&quot;object_core_dumps_<u></u>limitsconf&quot; /&gt;<br>
      &lt;ind:state state_ref=&quot;state_core_dumps_<u></u>limitsconf&quot; /&gt;<br>
-- 1.8.3.1<br>
</blockquote>
<br></div></div>
Ack! Tested locally w/testcheck -- good call w/ensuring we support both methods!<div><div><br>
<br>
<br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><div class="gmail_extra"><br></div></div>