results validation
by Peter Vrabec
Hi all,
I have found that If I validate OVAL results by schematron rules:
$ oscap oval validate-xml --results --schematron
rhel6-oval-scap-security-guide.xml.result.xml
I get two types of errors:
oval:scap-security-guide:tst:960 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:959 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:811 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:787 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:786 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:359 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:267 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:221 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:tst:1085 - No state should be referenced when
check_existence has a value of 'none_exist'.
oval:scap-security-guide:var:2663 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2655 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2651 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2649 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2648 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2644 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2636 - inconsistent datatype between the
variable and an associated var_ref
oval:scap-security-guide:var:2629 - inconsistent datatype between the
variable and an associated var_ref
Peter.
11 years, 6 months
[PATCH] Minor regexp correction in wireless_disable_drivers.xml
by Willem Bos
Hi All,
The missing '^' in the regexp makes oscap 0.8.0 (from the RHEL6 repo)
scan the whole filesystem. Credits to Gary Gapinsky for the quick fix.
Jeffrey suggested replacing the check by a version that would advice
disabling the driver in /etc/modules.conf (see the 'oscap hangs on
wireless_disable_drivers.xml' thread). I'm not familiar with a robust
way to determine the presence of such a NIC without using specialized
utilities that might not be installed on the system. I did a `grep
net/wireless /lib/modules/$(uname -r)/modules.dep` to see if all
wireless drivers maybe shared a common dependency but this is not the
case. Also, I queried the device using udevadm for attributes unique
to wireless cards but could not see anything obvious :
udevadm info --path=/sys/class/net/wlan0 --attribute-walk
looking at device
'/devices/pci0000:00/0000:00:1c.1/0000:02:00.0/bcma0:0/net/wlan0':
KERNEL=="wlan0"
SUBSYSTEM=="net"
DRIVER==""
ATTR{addr_assign_type}=="0"
ATTR{addr_len}=="6"
ATTR{dev_id}=="0x0"
ATTR{ifalias}==""
ATTR{iflink}=="2"
ATTR{ifindex}=="2"
ATTR{type}=="1"
ATTR{link_mode}=="1"
ATTR{address}=="b8:8d:12:08:14:ea"
ATTR{broadcast}=="ff:ff:ff:ff:ff:ff"
ATTR{carrier}=="1"
ATTR{dormant}=="0"
ATTR{operstate}=="up"
ATTR{mtu}=="1500"
ATTR{flags}=="0x1003"
ATTR{tx_queue_len}=="1000"
ATTR{netdev_group}=="0"
udevadm info --path=/sys/class/net/eth0 --attribute-walk
looking at device '/devices/pci0000:00/0000:00:15.0/0000:03:00.0/net/eth0':
KERNEL=="eth0"
SUBSYSTEM=="net"
DRIVER==""
ATTR{addr_assign_type}=="0"
ATTR{addr_len}=="6"
ATTR{dev_id}=="0x0"
ATTR{ifalias}==""
ATTR{iflink}=="2"
ATTR{ifindex}=="2"
ATTR{features}=="0x118ba9"
ATTR{type}=="1"
ATTR{link_mode}=="0"
ATTR{address}=="00:50:56:b5:00:12"
ATTR{broadcast}=="ff:ff:ff:ff:ff:ff"
ATTR{carrier}=="1"
ATTR{speed}=="10000"
ATTR{duplex}=="full"
ATTR{dormant}=="0"
ATTR{operstate}=="unknown"
ATTR{mtu}=="1500"
ATTR{flags}=="0x1003"
ATTR{tx_queue_len}=="1000"
If anyone can give me a suggestion I'd be happy to spend more time on it.
Regards,
Willem.
---
RHEL6/input/checks/wireless_disable_drivers.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/wireless_disable_drivers.xml
b/RHEL6/input/checks/wireless_disable_drivers.xml
index 9760f7c..129b308 100644
--- a/RHEL6/input/checks/wireless_disable_drivers.xml
+++ b/RHEL6/input/checks/wireless_disable_drivers.xml
@@ -21,7 +21,7 @@
</unix:file_test>
<unix:file_object comment="all local files"
id="object_wireless_disable_drivers" version="1">
- <unix:path operation="pattern
match">/lib/modules/.*/kernel/drivers/net/wireless</unix:path>
+ <unix:path operation="pattern
match">^/lib/modules/.*/kernel/drivers/net/wireless</unix:path>
<unix:filename operation="pattern match">.*</unix:filename>
</unix:file_object>
</def-group>
--
1.7.1
11 years, 6 months
/etc/shadow and gshadow mode 0400 or 0?
by Kenneth Stailey
Hi,
RHEL5 ships with /etc/shadow and gshadow set to mode 0400
while RHEL 6 uses mode 0 for those two files.
CCE-3932-1 and CCE-4130-1 require mode 0400.
Changing RHEL 6 to use 0400 causes CCE-14931 (verify
files against RPM database) to flag /etc/shadow
and gshadow as modified.
Is it better to change /etc/shadow and gshadow to 0400
or use the mode 0 that the files are distributed from Red Hat with?
Thanks
11 years, 6 months
[PATCH] Fix paths and requires in spec file.
by Spencer R. Shimko
The spec file was dropping things in /usr/local. Shift it to
/usr/share/doc/scap-security-guide-<version>.
Update Requires and BuildRequires based on perusal of apps leveraged
during build.
Signed-off-by: Spencer Shimko <sshimko(a)tresys.com>
---
scap-security-guide.spec | 15 +++++++++------
1 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/scap-security-guide.spec b/scap-security-guide.spec
index 55e22a5..0867fb1 100644
--- a/scap-security-guide.spec
+++ b/scap-security-guide.spec
@@ -12,8 +12,8 @@ BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
BuildArch: %{arch}
-BuildRequires: /bin/rm, /bin/mkdir, /bin/cp
-Requires: /bin/bash, /bin/date, /usr/bin/oscap
+BuildRequires: coreutils, libxslt, expat, python
+Requires: coreutils, openscap
%description
The scap-security-guide project provides security configuration guidance in
@@ -28,13 +28,12 @@ requirements and specific implementation guidance.
%build
cd RHEL6 && make dist
-
%install
rm -rf $RPM_BUILD_ROOT
#make install DESTDIR=$RPM_BUILD_ROOT
-mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/
+mkdir -p $RPM_BUILD_ROOT/%{_usr}/share/doc/%{name}-%{version}/
-cp -r RHEL6/dist/* $RPM_BUILD_ROOT/usr/local/%{name}/
+cp -r RHEL6/dist/* $RPM_BUILD_ROOT/%{_usr}/share/doc/%{name}-%{version}/
%clean
@@ -43,10 +42,14 @@ rm -rf $RPM_BUILD_ROOT
%files
%defattr(0644,root,root,0755)
-%attr(0755,root,root) /usr/local/scap-security-guide/
+%attr(0755,root,root) %{_usr}/share/doc/%{name}-%{version}/
%changelog
+* Tue Aug 28 2012 Spencer Shimko <sshimko(a)tresys.com> 1.0-4
+- Move away from using /usr/local for installation dir.
+- Fix BuildRequires and Requires.
+
* Wed Jul 3 2012 Jeffrey Blank <blank(a)eclipse.ncsc.mil> 1.0-3
- Modified install section, made description more concise.
--
1.7.1
11 years, 6 months
[PATCH] RHEL6/Makefile target shorthand2xccdf requires target shorthand-guide to be complete
by Kenneth Stailey
To test:
cd RHEL6
make clean
make shorthand2xccdf
This will fail because the required prerequisite tasks were not run.
Fix:
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -11,7 +11,7 @@ shorthand-guide:
xsltproc -o $(OUT)/rhel6-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml
xmllint --format --output $(OUT)/rhel6-shorthand.xml
$(OUT)/rhel6-shorthand.xml
-shorthand2xccdf:
+shorthand2xccdf: shorthand-guide
xsltproc -o $(OUT)/rhel6-xccdf-noprofiles.xml
$(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml
xsltproc -stringparam profile "allprofiles" -o
$(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-addprofiles.xslt
$(OUT)/rhel6-xccdf-noprofiles.xml
xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o
$(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt
$(OUT)/rhel6-xccdf.xml
11 years, 6 months
[PATCH] /etc/gshadow perms test check /etc/shadow user instead
by Kenneth Stailey
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -118,7 +118,7 @@ correctly.</description>
<rationale>The /etc/gshadow file contains group password hashes.
Protection of this file
is critical for system security.</rationale>
<ident cce="3932-1" />
-<oval id="file_owner_etc_shadow" />
+<oval id="file_permissions_etc_gshadow" />
<ref nist="AC-3, CM-6"/>
</Rule>
11 years, 6 months