<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 3/6/14, 9:29 AM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1573888834.28839685.1394116172402.JavaMail.zimbra@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">Hello folks,

  based on <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005065.html">https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005065.html</a>
this patch adds heading regex anchor support for cups_disable_browsing OVAL check
(dedicated separate post to this patch, because just adding ^[\s]* to the two config file
directives isn't sufficient. See below for further explanation).

Besides adding ^[\s]* prefix to Browsing and BrowseAllow directives, it was also
necessary not to negate the meaning of second test, because since in the new / modified
scenario, only cups config rows starting with Browsing / BrowseAllow (not prefixed
with a comment) are returned as success, what could happen with unmodified criteria
evaluation is the following:

Suppose case Browsing would be turned off:

  Browsing Off

and BrowseAllow would contain 'none', but it would be commented out (possibly containing
another comment behind none), e.g.

  # BrowseAllow none # Some another comment here

Check for 'BrowseAllow[\s]+(?!none)' would return false, it's negation true. AND-ing both
results (true for Browsing Off) and true for the negation would return true / pass as a
result. =&gt; This patch removes the negation, and returns true only for case both of:

  Browsing Off
  BrowseAllow none

are present in the configuration file (possibly suffixed with some comments). For remaining
alternatives it returns false / fail OVAL result.

Has been tested on RHEL-6 and seems to be working properly.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: Patch re-news also test_attestation on RHEL-6 and updates OVAL tests / objects versions
      to indicate the second version.
</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-RHEL-6-Add-heading-regex-anchor-to-cups_disable_brow.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From daf5294fc7023b7d89e43ddb9ec8db8d6452f38f Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 6 Mar 2014 15:12:21 +0100
Subject: [PATCH] [RHEL/6] Add heading regex anchor to cups_disable_browsing
 OVAL check (also renew test_attestation, test / object version numbers and
 don't negate the second test -- see explanation on mailing list for further
 details)

Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 RHEL/6/input/checks/cups_disable_browsing.xml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/RHEL/6/input/checks/cups_disable_browsing.xml b/RHEL/6/input/checks/cups_disable_browsing.xml
index cadd68a..e882cd1 100644
--- a/RHEL/6/input/checks/cups_disable_browsing.xml
+++ b/RHEL/6/input/checks/cups_disable_browsing.xml
@@ -11,35 +11,35 @@
       broadcasts and add and configure these printers for immediate use. By
       disabling this browsing capability, the machine will no longer generate
       or receive such broadcasts.&lt;/description&gt;
-      &lt;reference source="MED" ref_id="20131119" ref_url="test_attestation" /&gt;
+      &lt;reference source="JL" ref_id="20140306" ref_url="test_attestation" /&gt;
     &lt;/metadata&gt;
     &lt;criteria operator="AND"&gt;
       &lt;criterion comment="Ensure remote printer browsing is off"
       test_ref="test_cups_disable_browsing_browsing_off" /&gt;
       &lt;criterion comment="Ensure no incoming printer information packets are allowed"
-      test_ref="test_cups_disable_browsing_browseallow" negate="true" /&gt;
+      test_ref="test_cups_disable_browsing_browseallow" /&gt;
     &lt;/criteria&gt;
   &lt;/definition&gt;
 
   &lt;ind:textfilecontent54_test check="all" check_existence="all_exist"
   comment="Disable Browsing" id="test_cups_disable_browsing_browsing_off"
-  version="1"&gt;
+  version="2"&gt;
     &lt;ind:object object_ref="obj_cups_disable_browsing_browsing_off" /&gt;
   &lt;/ind:textfilecontent54_test&gt;
-  &lt;ind:textfilecontent54_object id="obj_cups_disable_browsing_browsing_off" version="1"&gt;
+  &lt;ind:textfilecontent54_object id="obj_cups_disable_browsing_browsing_off" version="2"&gt;
     &lt;ind:filepath&gt;/etc/cups/cupsd.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;Browsing[\s]+(?:Off|No)&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]*Browsing[\s]+(?:Off|No)&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
 
   &lt;ind:textfilecontent54_test check="all" check_existence="all_exist"
   comment="Do not allow incoming printer information packets"
-  id="test_cups_disable_browsing_browseallow" version="1"&gt;
+  id="test_cups_disable_browsing_browseallow" version="2"&gt;
     &lt;ind:object object_ref="obj_cups_disable_browsing_browseallow" /&gt;
   &lt;/ind:textfilecontent54_test&gt;
-  &lt;ind:textfilecontent54_object id="obj_cups_disable_browsing_browseallow" version="1"&gt;
+  &lt;ind:textfilecontent54_object id="obj_cups_disable_browsing_browseallow" version="2"&gt;
     &lt;ind:filepath&gt;/etc/cups/cupsd.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;BrowseAllow[\s]+(?!none)&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]*BrowseAllow[\s]+(?:none)&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
 &lt;/def-group&gt;
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
      </div>
    </blockquote>
    <br>
    <br>
    IIRC, we inherited this from RHEL5 USGCB. Tomas Heinrich might want
    a heads up.<br>
    <br>
    ack<br>
  </body>
</html>