<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/4/13 8:46 PM, Jeff Bachtel wrote:<br>
</div>
<blockquote
cite="mid:CAHahqg1h=xQs=MNVE1iiwt6G2bvFXYmLY2SONNzg631mdqu-0Q@mail.gmail.com"
type="cite">
<div class="moz-text-html" lang="x-western">
<div dir="ltr">Ah cool, but that's <strong class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">no_files_unowned_by_user,
</strong><span class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">not </span><strong
class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">world_writable_files_system_ownership
</strong><span class=""
style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">(</span>CCE-26642-9)
that I had the false pos on.
<div>
<br>
</div>
<div>I'll try to log in in a few to update the ticket if
you're busy.</div>
</div>
</div>
</blockquote>
<br>
Hah, whoops. *I* was looking at the
dir_perms_world_writable_system_owned check. Either way, it's the
same process to see what's up.<br>
<br>
For CCE-27032-2/no_files_unowned_by_user, it's the same story... the
OCIL needs to be updated. <br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo find / -xdev -nouser -print<br>
[shawn@SSG-RHEL6 checks]$ ./testcheck.py
no_files_unowned_by_user.xml <br>
Evaluating with OVAL tempfile :
/tmp/no_files_unowned_by_userWvvmmI.xml<br>
Writing results to : /tmp/no_files_unowned_by_userWvvmmI.xml-results<br>
Definition oval:scap-security-guide.testing:def:152: false<br>
Evaluation done.<br>
[shawn@SSG-RHEL6 checks]$ vim ^C<br>
[shawn@SSG-RHEL6 checks]$ grep -4 system_data
/tmp/no_files_unowned_by_userWvvmmI.xml-results<br>
<object id="oval:scap-security-guide.testing:obj:154"
version="1" flag="complete"><br>
<reference item_ref="1105751"/><br>
</object><br>
</collected_objects><br>
<system_data><br>
<unix-sys:file_item id="1105751" status="exists"><br>
<unix-sys:filepath>//.autofsck</unix-sys:filepath><br>
<unix-sys:path>/</unix-sys:path><br>
<unix-sys:filename>.autofsck</unix-sys:filename><br>
--<br>
<br>
<br>
<br>
I updated the ticket to review *all* the OCIL checks. A few of us
are on #ssg on freenode tonight, and actively developing (so will be
on the list) until late EST<br>
<br>
<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAHahqg1h=xQs=MNVE1iiwt6G2bvFXYmLY2SONNzg631mdqu-0Q@mail.gmail.com"
type="cite">
<div class="moz-text-html" lang="x-western">
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Oct 4, 2013 at 8:32 PM, Shawn
Wells <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb">
<div class="h5">On 10/4/13 8:28 PM, Shawn Wells wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
On 10/4/13 8:13 PM, Jeff Bachtel wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
I keep getting a fail on CCE-27032-2, even after
rebuilding SSG from master. The bad thing is that
find / -nouser and find / -nogroup are not finding
whatever files are triggering the warning.<br>
<br>
Is there a debug flag I should be using for more
details from oscap to track this down?<br>
<br>
</blockquote>
<br>
The failure should be in your results file. Since
you're using source:<br>
<br>
[shawn@SSG-RHEL6 checks]$ pwd<br>
/var/www/html/scap-security-guide/RHEL6/input/checks<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo find / -xdev -type d
-perm 0002 -uid +500 -print<br>
<br>
[shawn@SSG-RHEL6 checks]$ ./testcheck.py
dir_perms_world_writable_system_owned.xml<br>
Evaluating with OVAL tempfile :
/tmp/dir_perms_world_writable_system_owneddqzNLB.xml<br>
Writing results to : /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results<br>
Definition oval:scap-security-guide.testing:def:148:
false<br>
Evaluation done.<br>
<br>
Open your results file and check what's in the
system_data area. It'll indicate what files/dirs are
causing the fail. On mine:<br>
<br>
[shawn@SSG-RHEL6 checks]$ grep -4 system_data
/tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results<br>
<object id="oval:scap-security-guide.testing:obj:150"
version="1" flag="complete"><br>
<reference item_ref="1104981"/><br>
</object><br>
</collected_objects><br>
<system_data><br>
<unix-sys:file_item id="1104981"
status="exists"><br>
<unix-sys:path>/test</unix-sys:path><br>
<unix-sys:filename></unix-sys:filename><br>
<unix-sys:type>directory</unix-sys:type><br>
-- <br>
<br>
<br>
Clearly the find command needs updating though<br>
</blockquote>
</div>
</div>
To ensure updating the find command doesn't get forgotten
about:<br>
<a moz-do-not-send="true"
href="https://fedorahosted.org/scap-security-guide/ticket/417"
target="_blank">https://fedorahosted.org/scap-security-guide/ticket/417</a><br>
<br>
.... whoever feels ambitious to take that ticket, please
do so!
<div class="HOEnZb">
<div class="h5"><br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a moz-do-not-send="true"
href="mailto:scap-security-guide@lists.fedorahosted.org"
target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-unicode">
<pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
</body>
</html>