<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <BODY> <div class="WordSection1"> Absolutely!<o:p></o:p> <o:p> </o:p> So here is the oval check I produced to test this:<o:p></o:p> <o:p> </o:p> <def-group><o:p></o:p> <definition class="compliance" id="test_rule" version="1"><o:p></o:p> <metadata><o:p></o:p> <title>Test Rule</title><o:p></o:p> <affected family="unix"><o:p></o:p> </affected><o:p></o:p> <description>Rule for testing.</description><o:p></o:p> </metadata><o:p></o:p> <criteria operator="OR"><o:p></o:p> <criterion comment="Xwindows is not running" test_ref="test_xwindows_running" /><o:p></o:p> <criteria operator="AND"><o:p></o:p> <criterion comment="Xwindows has '-auth' option enabled" test_ref="test_xwindows_auth" /><o:p></o:p> <criterion comment="Xwindows has '-audit 4' option enabled" test_ref="test_xwindows_audit" /><o:p></o:p> <criterion comment="Xwindows has '-s 15' option enabled" test_ref="test_xwindows_screensaver" /><o:p></o:p> </criteria><o:p></o:p> </criteria><o:p></o:p> </definition><o:p></o:p> <o:p> </o:p> <unix:process58_test check="all" check_existence="none_exist" comment="Testing xwindows process existence" id="test_xwindows_running" version="1"><o:p></o:p> <unix:object object_ref="object_xwindows_running" /><o:p></o:p> </unix:process58_test><o:p></o:p> <unix:process58_object comment="xwindows process" id="object_xwindows_running" version="1"><o:p></o:p> <unix:command_line datatype="string" operation="pattern match">X</unix:command_line><o:p></o:p> <unix:pid datatype="int" operation="greater than">0</unix:pid><o:p></o:p> </unix:process58_object><o:p></o:p> <o:p> </o:p> <unix:process58_test check="all" check_existence="all_exist" comment="Xwindows has '-auth' option enabled" id="test_xwindows_auth" version="1"><o:p></o:p> <unix:object object_ref="object_xwindows_auth" /><o:p></o:p> </unix:process58_test><o:p></o:p> <unix:process58_object comment="xwindows '-auth' option" id="object_xwindows_auth" version="1"><o:p></o:p> <unix:command_line datatype="string" operation="pattern match">^(?:/usr/bin/)*X(?:org)*[\s]*:0(?:.*)?[\s]+-auth(?:$|[\s]+(?:.*)?$)</unix:command_line><o:p></o:p> <unix:pid datatype="int" operation="greater than">0</unix:pid><o:p></o:p> </unix:process58_object><o:p></o:p> <o:p> </o:p> <unix:process58_test check="all" check_existence="all_exist" comment="Xwindows has '-audit 4' option enabled" id="test_xwindows_audit" version="1"><o:p></o:p> <unix:object object_ref="object_xwindows_audit" /><o:p></o:p> </unix:process58_test><o:p></o:p> <unix:process58_object comment="xwindows '-audit 4' option" id="object_xwindows_audit" version="1"><o:p></o:p> <unix:command_line datatype="string" operation="pattern match">^(?:/usr/bin/)*X(?:org)*[\s]*:0(?:.*)?[\s]+(-audit[\s]+4)(?:$|[\s]+(?:.*)?$)</unix:command_line><o:p></o:p> <unix:pid datatype="int" operation="greater than">0</unix:pid><o:p></o:p> </unix:process58_object><o:p></o:p> <o:p> </o:p> <unix:process58_test check="all" check_existence="all_exist" comment="Xwindows has '-s 15' option enabled" id="test_xwindows_screensaver" version="1"><o:p></o:p> <unix:object object_ref="object_xwindows_screensaver" /><o:p></o:p> </unix:process58_test><o:p></o:p> <unix:process58_object comment="xwindows '-s 15' option" id="object_xwindows_screensaver" version="1"><o:p></o:p> <unix:command_line datatype="string" operation="pattern match">^(?:/usr/bin/)*X(?:org)*[\s]*:0(?:.*)?[\s]+(-s[\s]+([0-9]|1[0-5]))(?:$|[\s]+(?:.*)?$)</unix:command_line><o:p></o:p> <unix:pid datatype="int" operation="greater than">0</unix:pid><o:p></o:p> </unix:process58_object><o:p></o:p> <o:p> </o:p> <external_variable comment="Test Variable"<o:p></o:p> datatype="int" id="var_test"<o:p></o:p> version="1" /><o:p></o:p> <o:p> </o:p> </def-group><o:p></o:p> <div> <o:p> </o:p> Best regards,<o:p></o:p> <o:p></o:p> <o:p> </o:p> Trey Henefield, CISSP<o:p></o:p> Senior IAVA Engineer<o:p></o:p> <o:p> </o:p> Ultra Electronics<o:p></o:p> Advanced Tactical Systems, Inc.<o:p></o:p> 4101 Smith School Road<o:p></o:p> Building IV, Suite 100<o:p></o:p> Austin, TX 78744 USA<o:p></o:p> <o:p> </o:p> Trey.Henefield@ultra-ats.com<o:p></o:p> Tel: +1 512 327 6795 ext. 647<o:p></o:p> Fax: +1 512 327 8043<o:p></o:p> Mobile: +1 512 541 6450<o:p></o:p> <o:p> </o:p> www.ultra-ats.com<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: open-scap-list-bounces@redhat.com [mailto:open-scap-list-bounces@redhat.com] On Behalf Of Shawn Wells Sent: Wednesday, March 11, 2015 10:38 AM To: open-scap-list@redhat.com Subject: Re: [Open-scap] Process58 - command_line<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> <div> On 3/10/15 11:40 AM, Trey Henefield wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Greetings, <o:p></o:p> <div> I am writing a SCAP check to capture the ps output for the X Server, in an effort to capture the actual parameters passed when starting the X Server. This is in reference to the RHEL5 STIG requirement GEN000000-LNX00360. <o:p></o:p> I am using openscap v1.0.8, which shows to support OVAL 5.10.1. <o:p></o:p> The problem I have is that the command_line test only returns the process command and not the full output of the parameters passed to the command. <o:p></o:p> However, according to the OVAL specification for 5.10.1, it says that the full set of parameters should be returned. <o:p></o:p> <a href="https://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-definitions-schema.html#process58_test">https://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-definitions-schema.html#process58_test</a> <o:p></o:p> Here is what I get: <o:p></o:p> <unix-sys:command_line>X</unix-sys:command_line> <o:p></o:p> What I had expected was: <o:p></o:p> <unix-sys:command_line>/usr/bin/X :0 -auth /home/test/.serverauth.7854</unix-sys:command_line><o:p></o:p> Is this a bug, or by design?<o:p></o:p> </div> </blockquote> Can you share your code?<o:p></o:p> </div> Disclaimer The information contained in this communication from trey.henefield@ultra-ats.com sent at 2015-03-11 11:59:25 is private and may be legally privileged or export controlled. It is intended solely for use by open-scap-list@redhat.com and others authorized to receive it. If you are not open-scap-list@redhat.com you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful. </BODY> </html>