<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/30/13 2:16 PM, Shane Shaffer
wrote:<br>
</div>
<blockquote
cite="mid:CA+K-tmtNfSBUtXSbi7aWrLaNhCERAd0HWx9ZsuWZygPt2jKV3w@mail.gmail.com"
type="cite">
<div class="gmail_extra">Is this object being used in a test that
does a comparison on the numerical value? The parentheses around
the \d+ in the previous version suggests that it is. Since the
new parentheses create a second subexpression, that could
interfere with the evaluation of the intended subexpression.
There are a few ways around this, but unless the value of hard|-
is needed somewhere, the cleanest way would be to make that a
non-capturing group.</div>
</blockquote>
<br>
The full OVAL is here:<br>
<a class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml">https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml</a><br>
<br>
The important bits:<br class="Apple-interchange-newline">
<blockquote type="cite">
<pre style="margin: 0px; padding: 0px; color: rgb(0, 0, 0); font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 19px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><code style="background-color: rgba(0, 0, 0, 0.0980392); padding: 1px; background-position: initial initial; background-repeat: initial initial;">
<ind:textfilecontent54_object id="object_etc_security_limits_conf_maxlogins" version="1">
<ind:filepath>/etc/security/limits.conf</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*\*[\s]+(hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_maxlogins" version="1">
<ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
</ind:textfilecontent54_state></code></pre>
</blockquote>
<br>
So then, you're right. The new parenthesis act as a capture group.
Oddly, things still check out when doing a testcheck!<br>
<br>
I can't find the OVAL 5.10 spec with this info, however reference
the (now antiquated) 5.6 spec. Specifically the "extensions":<br>
<a class="moz-txt-link-freetext" href="http://oval.mitre.org/language/about/re_support_5.6.html">http://oval.mitre.org/language/about/re_support_5.6.html</a><br>
<br>
I believe the pattern match should be updated to:<br>
<pre style="margin: 0px; padding: 0px; color: rgb(0, 0, 0); font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 19px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><code style="background-color: rgba(0, 0, 0, 0.0980392); padding: 1px; background-position: initial initial; background-repeat: initial initial;">^[\s]*\*[\s]+(<b><font color="#ff0000">?:</font></b>hard|-)[\s]+maxlogins[\s]+(\d+)\s*$</code></pre>
<br>
(note the "?:")<br>
<br>
Frank, could you bugfix this?<br>
</body>
</html>