<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/4/13 8:46 PM, Jeff Bachtel wrote:<br>
    </div>
    <blockquote
cite="mid:CAHahqg1h=xQs=MNVE1iiwt6G2bvFXYmLY2SONNzg631mdqu-0Q@mail.gmail.com"
      type="cite">
      <div class="moz-text-html" lang="x-western">
        <div dir="ltr">Ah cool, but that's <strong class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">no_files_unowned_by_user,
          </strong><span class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">not </span><strong
            class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">world_writable_files_system_ownership
          </strong><span class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">(</span>CCE-26642-9)
          that I had the false pos on.
          <div>
            <br>
          </div>
          <div>I'll try to log in in a few to update the ticket if
            you're busy.</div>
        </div>
      </div>
    </blockquote>
    <br>
    Hah, whoops. *I* was looking at the
    dir_perms_world_writable_system_owned check. Either way, it's the
    same process to see what's up.<br>
    <br>
    For CCE-27032-2/no_files_unowned_by_user, it's the same story... the
    OCIL needs to be updated. <br>
    <br>
    [shawn@SSG-RHEL6 checks]$ sudo find / -xdev -nouser -print<br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    no_files_unowned_by_user.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/no_files_unowned_by_userWvvmmI.xml<br>
    Writing results to : /tmp/no_files_unowned_by_userWvvmmI.xml-results<br>
    Definition oval:scap-security-guide.testing:def:152: false<br>
    Evaluation done.<br>
    [shawn@SSG-RHEL6 checks]$ vim ^C<br>
    [shawn@SSG-RHEL6 checks]$ grep -4 system_data
    /tmp/no_files_unowned_by_userWvvmmI.xml-results<br>
              &lt;object id="oval:scap-security-guide.testing:obj:154"
    version="1" flag="complete"&gt;<br>
                &lt;reference item_ref="1105751"/&gt;<br>
              &lt;/object&gt;<br>
            &lt;/collected_objects&gt;<br>
            &lt;system_data&gt;<br>
              &lt;unix-sys:file_item id="1105751" status="exists"&gt;<br>
               
    &lt;unix-sys:filepath&gt;//.autofsck&lt;/unix-sys:filepath&gt;<br>
                &lt;unix-sys:path&gt;/&lt;/unix-sys:path&gt;<br>
               
    &lt;unix-sys:filename&gt;.autofsck&lt;/unix-sys:filename&gt;<br>
    --<br>
    <br>
    <br>
    <br>
    I updated the ticket to review *all* the OCIL checks. A few of us
    are on #ssg on freenode tonight, and actively developing (so will be
    on the list) until late EST<br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <blockquote
cite="mid:CAHahqg1h=xQs=MNVE1iiwt6G2bvFXYmLY2SONNzg631mdqu-0Q@mail.gmail.com"
      type="cite">
      <div class="moz-text-html" lang="x-western">
        <div class="gmail_extra"><br>
          <br>
          <div class="gmail_quote">On Fri, Oct 4, 2013 at 8:32 PM, Shawn
            Wells <span dir="ltr">&lt;<a moz-do-not-send="true"
                href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div class="HOEnZb">
                <div class="h5">On 10/4/13 8:28 PM, Shawn Wells wrote:<br>
                  <blockquote class="gmail_quote" style="margin:0 0 0
                    .8ex;border-left:1px #ccc solid;padding-left:1ex">
                    On 10/4/13 8:13 PM, Jeff Bachtel wrote:<br>
                    <blockquote class="gmail_quote" style="margin:0 0 0
                      .8ex;border-left:1px #ccc solid;padding-left:1ex">
                      I keep getting a fail on CCE-27032-2, even after
                      rebuilding SSG from master. The bad thing is that
                      find / -nouser and find / -nogroup are not finding
                      whatever files are triggering the warning.<br>
                      <br>
                      Is there a debug flag I should be using for more
                      details from oscap to track this down?<br>
                      <br>
                    </blockquote>
                    <br>
                    The failure should be in your results file. Since
                    you're using source:<br>
                    <br>
                    [shawn@SSG-RHEL6 checks]$ pwd<br>
                    /var/www/html/scap-security-guide/RHEL6/input/checks<br>
                    <br>
                    [shawn@SSG-RHEL6 checks]$ sudo find / -xdev -type d
                    -perm 0002 -uid +500 -print<br>
                    <br>
                    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
                    dir_perms_world_writable_system_owned.xml<br>
                    Evaluating with OVAL tempfile :
                    /tmp/dir_perms_world_writable_system_owneddqzNLB.xml<br>
                    Writing results to : /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results<br>
                    Definition oval:scap-security-guide.testing:def:148:
                    false<br>
                    Evaluation done.<br>
                    <br>
                    Open your results file and check what's in the
                    system_data area. It'll indicate what files/dirs are
                    causing the fail. On mine:<br>
                    <br>
                    [shawn@SSG-RHEL6 checks]$ grep -4 system_data
                    /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results<br>
                              &lt;object id="oval:scap-security-guide.testing:obj:150"
                    version="1" flag="complete"&gt;<br>
                                &lt;reference item_ref="1104981"/&gt;<br>
                              &lt;/object&gt;<br>
                            &lt;/collected_objects&gt;<br>
                            &lt;system_data&gt;<br>
                              &lt;unix-sys:file_item id="1104981"
                    status="exists"&gt;<br>
                                &lt;unix-sys:path&gt;/test&lt;/unix-sys:path&gt;<br>
                                &lt;unix-sys:filename&gt;&lt;/unix-sys:filename&gt;<br>
                                &lt;unix-sys:type&gt;directory&lt;/unix-sys:type&gt;<br>
                    -- <br>
                    <br>
                    <br>
                    Clearly the find command needs updating though<br>
                  </blockquote>
                </div>
              </div>
              To ensure updating the find command doesn't get forgotten
              about:<br>
              <a moz-do-not-send="true"
                href="https://fedorahosted.org/scap-security-guide/ticket/417"
                target="_blank">https://fedorahosted.org/scap-security-guide/ticket/417</a><br>
              <br>
              .... whoever feels ambitious to take that ticket, please
              do so!
              <div class="HOEnZb">
                <div class="h5"><br>
                  _______________________________________________<br>
                  scap-security-guide mailing list<br>
                  <a moz-do-not-send="true"
                    href="mailto:scap-security-guide@lists.fedorahosted.org"
                    target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
                  <a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide"
                    target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
                </div>
              </div>
            </blockquote>
          </div>
          <br>
        </div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>