[Open-scap] Struggling with Perl based regular expressions

[Jan Lieskovsky]

Hello Pravin,

  thank you for checking with us.

----- Original Message -----
> From: "Pravin Goyal" <pravin.goyal at outlook.com>
> To: open-scap-list at redhat.com
> Sent: Thursday, April 7, 2016 7:44:34 AM
> Subject: [Open-scap] Struggling with Perl based regular expressions
> 
> 
> 
> Hi All,
> 
> Today, I spent quite a lot of time figuring out how to make pattern match
> work on different flavors of Linux - especially SLES 11 SP3 and Red Hat.

Can you hopefully provide a complete example of particular OVAL check that
isn't working on RHEL vs SLES 11 SP3 systems?

> 
> 
> 
> 
> A pattern match string of ".*auditd.*" works perfectly on Red Hat but gives
> segmentation fault on SLES.
> 
> 
> 
> 
> If I give "*auditd*", it does not work on Red Hat. It also does NOT give
> segmentation fault on SLES but the problem is that it does NOT work either.
> Even though auditd process is running, process58 says "does not exist" in
> oscap oval collect command. Frustrated.

The above makes me only guess the problem is somewhere in the process58 probe.
Having the details provides it's hard to tell source of the issue. My guess
being a mixture of shell glob pattern (when 'equals' operation is provided,
IIRC this is the default operation) vs Perl 5 regex expression (when 'pattern match'
is used as operation).

Both of them required the expression to be written differently (and won't
work when wrong combination is used).

> 
> 
> 
> 
> Do you know how to make it work?

Please provide concrete full example and we might advise what needs to be
changed / how to reproduce the issue.

> 
> 
> 
> 
> The more frustration is because on SLES, we have small utility 'pcretest'.
> The regex '*auditd*' works there but when it comes to OpenSCAP, it does not
> seem to work. Don't know what's wrong.

Thank you && Regards, Jan
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> 
> 
> 
> Please help.
> 
> 
> 
> 
> Thanks and regards,
> 
> Pravin Goyal
> 
> _______________________________________________
> Open-scap-list mailing list
> Open-scap-list at redhat.com
> https://www.redhat.com/mailman/listinfo/open-scap-list