On Tuesday, August 28, 2012 02:59:46 PM Willem Bos wrote: > Ah, should have thought about adding '^' myself, thanks. It works > fine. Should the ^ be necessary?
Yes. This is a common performance problem in OVAL content. The RHEL5 USGCB content is pretty well tested and reviewed. You can use it for examples on how things are done. For example, this is in the USGCB content: <unix-def:path operation="pattern match">^/lib/modules/*/kernel/drivers/usb/storage$</unix-def:path> -Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
