<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 3/6/14, 12:00 PM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1758476998.29017773.1394125215022.JavaMail.zimbra@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">When disabling print server capabilities search only for uncommented (possibly
whitespace prefixed) occurrences of Port and Listen directives in /etc/cups/cupsd.conf
(so for example when Port directive is present, but commented out the rule wouldn't fail,
when it should actually pass).

Also allow IP address of localhost to be specified in IPv6 form in the Listen directive
pattern.

Patch tested on RHEL-6 and seems to be working properly.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: Also adjusted changed object versions &amp; test_attestation entry.</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-RHEL-6-When-disabling-print-server-capabilities-sear.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From 099daa0f93732e443a4d663a0ba41e933c6fd6f4 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 6 Mar 2014 17:48:41 +0100
Subject: [PATCH] [RHEL/6] When disabling print server capabilities search only
 for uncommented occurrences (possibly prefixed with whitespace) of Port and
 Listen CUPS directives in cupsd configuration file (IOW add heading regex
 anchor for both of them). Also support IPv6 form of localhost IP address in
 the Listen directive case

Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 RHEL/6/input/checks/cups_disable_printserver.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/RHEL/6/input/checks/cups_disable_printserver.xml b/RHEL/6/input/checks/cups_disable_printserver.xml
index 89b907c..30ef74e 100644
--- a/RHEL/6/input/checks/cups_disable_printserver.xml
+++ b/RHEL/6/input/checks/cups_disable_printserver.xml
@@ -12,7 +12,7 @@
       locally configured printers, even if they cannot actually print to them.
       To limit print serving to a particular set of users, use the Policy
       directive.&lt;/description&gt;
-      &lt;reference source="MED" ref_id="20131119" ref_url="test_attestation" /&gt;
+      &lt;reference source="JL" ref_id="20140306" ref_url="test_attestation" /&gt;
     &lt;/metadata&gt;
     &lt;criteria operator="AND"&gt;
       &lt;criterion comment="Don't use port directive" test_ref="test_cups_disable_printserver_disable_port" /&gt;
@@ -25,9 +25,9 @@
   id="test_cups_disable_printserver_disable_port" version="1"&gt;
     &lt;ind:object object_ref="obj_cups_disable_printserver_disable_port" /&gt;
   &lt;/ind:textfilecontent54_test&gt;
-  &lt;ind:textfilecontent54_object id="obj_cups_disable_printserver_disable_port" version="1"&gt;
+  &lt;ind:textfilecontent54_object id="obj_cups_disable_printserver_disable_port" version="2"&gt;
     &lt;ind:filepath&gt;/etc/cups/cupsd.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;Port[\s]+(\d)+&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]*Port[\s]+(\d)+&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
 
@@ -36,9 +36,9 @@
   id="test_cups_disable_printserver_use_listen" version="1"&gt;
     &lt;ind:object object_ref="obj_cups_disable_printserver_use_listen" /&gt;
   &lt;/ind:textfilecontent54_test&gt;
-  &lt;ind:textfilecontent54_object id="obj_cups_disable_printserver_use_listen" version="1"&gt;
+  &lt;ind:textfilecontent54_object id="obj_cups_disable_printserver_use_listen" version="2"&gt;
     &lt;ind:filepath&gt;/etc/cups/cupsd.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;Listen[\s]+(?:localhost|127\.0\.0\.1):(\d)+&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]*Listen[\s]+(?:localhost|127\.0\.0\.1|::1):(\d)+&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
 &lt;/def-group&gt;
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
      </div>
    </blockquote>
    <br>
    applied locally on a 6.4 machine, works. ack.<br>
    <br>
    good call wrt version numbers!<br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>