oval_developer@lists.cisecurity.org

A list for people interested in developing the OVAL language.

View all threads

rpmVerifyFile ghost file attribute comparison across sym links?

UJ
Ulmer, John R CIV USN SPAWARSYSCEN LANT SC (US)
Fri, May 19, 2017 5:27 PM

When identifying and reporting on ghost files and determining the mode, owner, and group for the file, what do we do when the file on disk turns out to be a link?

Say, the packageOne contains an entry for ghost file : "/some/path/to/ghostFile" with permissions of 644.  And, the  file, "/some/path/to/ghostFile" turns out to be a link to a file supplied by a completely different packageTwo.  The link will have perms of 777.  This would cause a 'mode_differs' positive result.  However, I would not expect a content author to want the perms of the link head (meaningless) or the link target (belongs to another package).

Options:

1 - Item 'does not exist' and consequently does not get created.
2 - Item 'exists' and we report the file attributes of the target of the sym link?
3 - Item 'exists' and we report the file attributes of the head of the sym link?

I lean toward option 1.  While the file technically exists, it is a link,  the attributes of the link head are useless, and the attributes of the target are of a file that belongs to another package.  Ergo, no item created.

However, if the link points to another file that does belong to first package (packageOne), then we could report the item based on the attributes of the link target.

Thoughts?


John R. Ulmer
SPAWAR Systems Center Atlantic
john.r.ulmer6.civ@mail.mil
843.218.5953

...

When identifying and reporting on ghost files and determining the mode, owner, and group for the file, what do we do when the file on disk turns out to be a link? Say, the packageOne contains an entry for ghost file : "/some/path/to/ghostFile" with permissions of 644. And, the file, "/some/path/to/ghostFile" turns out to be a link to a file supplied by a completely different packageTwo. The link will have perms of 777. This would cause a 'mode_differs' positive result. However, I would not expect a content author to want the perms of the link head (meaningless) or the link target (belongs to another package). Options: 1 - Item 'does not exist' and consequently does not get created. 2 - Item 'exists' and we report the file attributes of the target of the sym link? 3 - Item 'exists' and we report the file attributes of the head of the sym link? I lean toward option 1. While the file technically exists, it is a link, the attributes of the link head are useless, and the attributes of the target are of a file that belongs to another package. Ergo, no item created. However, if the link points to another file that does belong to first package (packageOne), then we could report the item based on the attributes of the link target. Thoughts? ----------------------------------------- John R. Ulmer SPAWAR Systems Center Atlantic john.r.ulmer6.civ@mail.mil 843.218.5953 ...