I'm working with a set of config files and I need a way to only cherry pick out certain entries when defining an Augeas lens.

How do I effectively state "if what Augeas sees isn't already listed specifically as an extraction it is OK to ignore"?

I was thinking a lens that explicitly doesn't match any other lens combined with a union might work but I have no idea on how the syntax would work.

My use case would be the following:

I'm parsing out some details (comments, script id, tag_summary, script_tag). There are other lines - logic statements, custom fields that only exist in certain cases and the like - that aren't structured and I can't readily write extractions for.

# Description: Unpassworded bash account

tag_summary = "The account 'account' has no password set. An attacker may use it to gain further privileges on this system
This account was probably created by a backdoor installed  by a fake Linux Redhat patch. See http://www.k-otik.com/news/FakeRedhatPatchAnalysis.txt";

 script_version("$Revision: 17 $");
 script_tag(name:"last_modification", value:"$Date: 2013-10-27 15:01:43 +0100 (Sun, 27 Oct 2013) $");

Augeas has a holistic approach to parsing files. Each file is matched against a regular expression which is generated from the lens. The file is parsed entirely, and there is (currently) no way to ignore parts of the file.

  • Thanks. I realize that Augeas needs to parse the whole file and the nature of the regular expressions in use (although I'm more of a PCRE guy). Flipping the regex logic isn't that hard. I'm thinking it should be possible to have a lens that matches everything but a list of other lenses provided, eg L4 = NOT( (L1,L2,L3)*). Therefore the L4 should be "everything else" if L1,L2,L3 is a list of all lenses. – Tim Brigham Jan 9 '14 at 17:26
  • Yes, you can match anything but a regexp, something like store (reg1 - reg2) or, if you have more than one regexp, store (reg1 - (reg2|reg3|reg4)). However, you still need to make sure this doesn't lead to an ambiguous concatenation. – ℝaphink Jan 9 '14 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.