Blame SOURCES/scap-security-guide-0.1.38-aide-scan-email-notification.patch

79aef7
From 0a88755485a67e1e29c62196cc506763594f2154 Mon Sep 17 00:00:00 2001
79aef7
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
79aef7
Date: Thu, 1 Feb 2018 08:36:18 +0100
79aef7
Subject: [PATCH 1/2] Do not fail aide_scan_notification with other email
79aef7
 adresses
79aef7
79aef7
The rule aide_scan_notification says that AIDE should notify appropriate
79aef7
personnell of the detials of an AIDE scan. The check currently requires
79aef7
that the email address of the appropriate personell starts with 'root@'.
79aef7
In practice, the email address could be any email address. The check
79aef7
should match any email address.
79aef7
Fixes RHBZ#1540505
79aef7
---
79aef7
 shared/checks/oval/aide_scan_notification.xml | 6 +++---
79aef7
 1 file changed, 3 insertions(+), 3 deletions(-)
79aef7
79aef7
diff --git a/shared/checks/oval/aide_scan_notification.xml b/shared/checks/oval/aide_scan_notification.xml
79aef7
index 3293efb084..3aba02d144 100644
79aef7
--- a/shared/checks/oval/aide_scan_notification.xml
79aef7
+++ b/shared/checks/oval/aide_scan_notification.xml
79aef7
@@ -23,7 +23,7 @@
79aef7
   </ind:textfilecontent54_test>
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes" id="object_test_aide_scan_notification" version="1">
79aef7
     <ind:filepath>/etc/crontab</ind:filepath>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7
 
79aef7
@@ -32,7 +32,7 @@
79aef7
   </ind:textfilecontent54_test>
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes" id="object_aide_var_cron_notification" version="1">
79aef7
     <ind:filepath>/var/spool/cron/root</ind:filepath>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7
 
79aef7
@@ -42,7 +42,7 @@
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" id="object_aide_crontabs_notification" version="1">
79aef7
     <ind:path operation="pattern match">/etc/cron.(d|daily|weekly|monthly)</ind:path>
79aef7
     <ind:filename operation="pattern match">^.*$</ind:filename>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7
    
79aef7
79aef7
From 381ca3e54eb2e79c18f613a0d95e187e5e622005 Mon Sep 17 00:00:00 2001
79aef7
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
79aef7
Date: Mon, 5 Feb 2018 09:58:23 +0100
79aef7
Subject: [PATCH 2/2] Match at least 1 character in email address
79aef7
79aef7
---
79aef7
 shared/checks/oval/aide_scan_notification.xml | 6 +++---
79aef7
 1 file changed, 3 insertions(+), 3 deletions(-)
79aef7
79aef7
diff --git a/shared/checks/oval/aide_scan_notification.xml b/shared/checks/oval/aide_scan_notification.xml
79aef7
index 3aba02d144..b9f8e78929 100644
79aef7
--- a/shared/checks/oval/aide_scan_notification.xml
79aef7
+++ b/shared/checks/oval/aide_scan_notification.xml
79aef7
@@ -23,7 +23,7 @@
79aef7
   </ind:textfilecontent54_test>
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes" id="object_test_aide_scan_notification" version="1">
79aef7
     <ind:filepath>/etc/crontab</ind:filepath>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7
 
79aef7
@@ -32,7 +32,7 @@
79aef7
   </ind:textfilecontent54_test>
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes" id="object_aide_var_cron_notification" version="1">
79aef7
     <ind:filepath>/var/spool/cron/root</ind:filepath>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7
 
79aef7
@@ -42,7 +42,7 @@
79aef7
   <ind:textfilecontent54_object comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" id="object_aide_crontabs_notification" version="1">
79aef7
     <ind:path operation="pattern match">/etc/cron.(d|daily|weekly|monthly)</ind:path>
79aef7
     <ind:filename operation="pattern match">^.*$</ind:filename>
79aef7
-    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.*@.*$</ind:pattern>
79aef7
+    <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
79aef7
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
79aef7
   </ind:textfilecontent54_object>
79aef7