<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Shawn,</div><div><br></div>The string terminator was, what I had in mind.<div>The pattern would not match on subdirectories and that was reason why I asked.<div>I was aware of the wrongfully tested libexec directory that triggered the patter change in the first place.</div><div><br></div><div>Jan<br><div><br><div><br><div><div>On Apr 22, 2014, at 13:25, Shawn Wells wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 4/22/14, 12:16 PM, Renshaw, Richard
/c wrote:<br>
</div>
<blockquote cite="mid:3DE8EBB4-57D6-4F5D-82E3-3DDC32EE7A33@xtoenergy.com" type="cite">
<pre wrap="">Jan,
Without the trailing / the regex will match any directory starting with <i class="moz-txt-slash"><span class="moz-txt-tag">/</span>lib, /lib64, /usr/lib, or /usr/lib64. Like the spurious /usr/libexec<span class="moz-txt-tag">/</span></i> file I was running into. Even if the trailing / isn't the correct fix, something needs to be changed to fix the regex.
</pre>
</blockquote>
<br>
Jan is right. Add a string terminator? e.g.:<br>
<blockquote type="cite">
<pre wrap="">- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
+ <unix:path operation="pattern match">^\/lib(|64)$|^\/usr\/lib(|64)$</unix:path>
</pre>
</blockquote>
<br>
<br>
$ sudo chown root /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsp5REdU.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsp5REdU.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: true<br>
Evaluation done.<br>
<br>
$ sudo chown shawn /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsWTFf4x.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsWTFf4x.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: false<br>
Evaluation done.<br>
<br>
$ sudo chown shawn /usr/libexec/ ; sudo chown root /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsJ5RNOT.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsJ5RNOT.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: true<br>
Evaluation done.<br>
<br>
<br>
</div>
_______________________________________________<br>scap-security-guide mailing list<br><a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide<br></blockquote></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Jan Ruzicka<br>Senior Software Engineer<br>Comtech Mobile Datacom Corporation<br>20430 Century Blvd, Germantown, MD 20874<br>Office: 240-686-3300<br>Fax: 240-686-3301<br> <br>The information contained in this message may be privileged and/or confidential. If you are not the intended recipient, or responsible for delivering this message to the intended recipient, any review, forwarding, dissemination, distribution or copying of this communication or any attachment(s) is strictly prohibited. If you have received this message in error, please so notify the sender immediately, and delete it and all attachments from your computer and network.</span>
</div>
<br></div></div></div></div></body></html>