<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 4/22/14, 12:16 PM, Renshaw, Richard
/c wrote:<br>
</div>
<blockquote
cite="mid:3DE8EBB4-57D6-4F5D-82E3-3DDC32EE7A33@xtoenergy.com"
type="cite">
<pre wrap="">Jan,
Without the trailing / the regex will match any directory starting with <i class="moz-txt-slash"><span class="moz-txt-tag">/</span>lib, /lib64, /usr/lib, or /usr/lib64. Like the spurious /usr/libexec<span class="moz-txt-tag">/</span></i> file I was running into. Even if the trailing / isn't the correct fix, something needs to be changed to fix the regex.
</pre>
</blockquote>
<br>
Jan is right. Add a string terminator? e.g.:<br>
<blockquote type="cite">
<pre wrap="">- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
+ <unix:path operation="pattern match">^\/lib(|64)$|^\/usr\/lib(|64)$</unix:path>
</pre>
</blockquote>
<br>
<br>
$ sudo chown root /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsp5REdU.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsp5REdU.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: true<br>
Evaluation done.<br>
<br>
$ sudo chown shawn /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsWTFf4x.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsWTFf4x.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: false<br>
Evaluation done.<br>
<br>
$ sudo chown shawn /usr/libexec/ ; sudo chown root /lib<br>
$ sudo ./testcheck.py file_ownership_library_dirs.xml <br>
Evaluating with OVAL tempfile :
/tmp/file_ownership_library_dirsJ5RNOT.xml<br>
Writing results to :
/tmp/file_ownership_library_dirsJ5RNOT.xml-results<br>
Definition oval:scap-security-guide.testing:def:100: true<br>
Evaluation done.<br>
<br>
<br>
</body>
</html>