[PATCH] improvement to verify-references.py
by Jeffrey Blank
This should eliminate the improper flagging of some OVAL definitions as
"unused". Some OVAL definitions are used only by other OVAL definitions but
not directly called from the XCCDF, by means of the <extend_definition> tag
which acts as a criterion.
Admittedly, it is still possible for an OVAL definition to exist which is
extended by another unused one, and then the script will not flag it.
But the extendor should be flagged, and should it be removed, then further
discovery should ensue.
And yes, this does suggest we are not interested in providing OVAL definitions
for which XCCDF does not exist.
Jeffrey Blank (1):
improved verify-references.py to not flag OVAL definitions which are
extended by others as unused
RHEL6/utils/verify-references.py | 10 +++++++++-
1 files changed, 9 insertions(+), 1 deletions(-)
10 years, 12 months
[PATCH] added some new Makerules to validate content
by Jeffrey Blank
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/Makefile | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 5d8d3ac..3e0ba59 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -97,11 +97,15 @@ submission-stig-check: table-stigs
# content-usgcb: coming soon
-validate:
+validate-xml:
oscap xccdf validate-xml $(OUT)/$(ID)-rhel6-xccdf.xml
oscap oval validate-xml $(OUT)/$(ID)-rhel6-oval.xml
oscap oval validate-xml $(OUT)/$(ID)-rhel6-cpe-oval.xml
+validate: validate-xml
+ cd output; ../$(UTILS)/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-rhel6-xccdf.xml
+ oscap oval validate-xml --schematron $(OUT)/$(ID)-rhel6-oval.xml
+
eval-test:
oscap xccdf eval --profile test $(OUT)/$(ID)-rhel6-xccdf.xml
--
1.7.1
10 years, 12 months
validating project content more thoroughly, automatically
by Jeffrey Blank
In order to address our need for discipline in OVAL development, I have
updated the Makefile to make it easier to run some automated checks
that are possible using OpenSCAP and the verify-references.py script.
So, after someone OKs my next patch, you can try:
make validate-xml (this is the old, fast schema validation)
make validate (that, plus other problem indicators)
I haven't decided to add these into git commit hooks. Yet.
Some of the OpenSCAP developers had flagged our issues with schematron
validation a while ago; I believe we're now in a position to address.
And I believe that failed schematron validation is also likely to
discover OVAL code that may need attention for other reasons, too.
There seem to be a number of OVAL checks that are not used by some of
the XCCDF we have. The "right" choice may be to either delete the OVAL
or delete the XCCDF. It may vary on a case-by-case basis. HOWEVER note
also that some OVAL definitions "extend" others, and so there may be
some OVAL checks that are not _directly_ referenced by the XCCDF, but
are in fact referenced by other OVAL. I will be updating
verify-references.py to handle this. Hopefully it explains the current
long list of seemingly orphaned OVAL.
As a convenience, also, note that each OVAL check (in final output)
includes a human-readable ID, which should indicate the input filename
(or even still be hanging around in the XCCDF as a commented-out
reference to an OVAL check). For example, in the final OVAL output,
you'll see in the metadata for each definition something like:
<reference source="ssg" ref_id="sysconfig_ipv6_networking"/>
So, if you're developer who likes a list of stuff to work through, now
you've got more tools to generate these...
Thanks,
Jeff
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance
10 years, 12 months
[PATCH 0/2] Replacement patches for last set for accounts_dangerous_path_for_root.xml and package_red_hat_gpgkey_installed.xml
by Maura Dailey
Functionally, these are intended to be identical to my previous set of two patches, but I've corrected some mistakes in OVAL in accounts_dangerous_path_for_root.xml and realized my line breaks in package_red_hat_gpgkeys_installed.xml don't appear to match what was originally there, which led to unnecessary line changes (despite git diff's previous reassurances to the contrary).
Thank you for your patience. By ironing out some kinks now, I hope to create better patches in the next few weeks.
- Maura Dailey
Maura Dailey (2):
Existing check returns false instead of true when the PATH passes all
checks, and it doesn't check that path elements begin with /
Duplicate state ids fixed, fixed reversed version and release info
for the auxillary key
.../checks/accounts_dangerous_path_for_root.xml | 42 +++++++++++++++----
.../checks/package_red_hat_gpgkeys_installed.xml | 15 +++----
2 files changed, 39 insertions(+), 18 deletions(-)
10 years, 12 months
[PATCH 0/2] Two fixes for OVAL checks accounts_dangerous_path_for_root and package_red_hat_gpgkeys_installed
by Maura Dailey
Forgive the cruddy formatting. I don't generate patches with git often enough to get all the options to look right on the first try.
For accounts_dangerous_path_for_root.xml:
- First, I noticed that this check returned a result of true if any of the conditions that we didn't want to see were satisfied. I assumed that a false result was desired, so I made sure all tests had a check value of "none satisfy" and that the criteria operator was AND, not OR. A single failure will now give a result of false.
- Second, I noticed that the test_env_var_contains check would also check for the values ".:" or ":.". If this is actually desired behavior, I'll reverse this one, but for now, I split it into two checks, one for "::" and one for "\.\."
- Third, no check was done to see if the path began with a / or if elements in the path began with /. My checks ensure that PATH only begins with / and that each instance of : is followed by a slash. This is the riskiest change I made, since : is a valid character in folder names. I tried to exclude : characters that begin with \.
For package_red_hat_gpgkeys_installed.xml:
- There were two problems in this particular check. The first was that the check for gpg-pubkey-2fa658e0-45700c69 had its release and version numbers reversed, so that it would always fail. The second was that both rpminfo_state blocks shared the same id.
Maura Dailey (2):
Maura: Existing check returns false instead of true when the PATH
passes all checks, and it doesn't check that path elements begin
with /
Maura: Duplicate state ids fixed, fixed reversed version and release
info for the auxillary key
.../checks/accounts_dangerous_path_for_root.xml | 30 ++++++++++++++----
.../checks/package_red_hat_gpgkeys_installed.xml | 32 +++++++-------------
2 files changed, 34 insertions(+), 28 deletions(-)
10 years, 12 months
RHEL6
by Moessbauer, David
I have been informed that in the recent past the website had provided zip bundles for RHEL6, but have recently been removed and replaced with YUM package downloads. I have not had success in getting YUM packages to setup properly - getting ewrro the 'Scheme missing' and no package available for download.
Can someone provide guidance regarding the location of the zip bundles, or further detail on YUM?
v/r
David Moessbauer
Software Engineer
Progeny Systems Corp.
www.progeny.net<http://www.progeny.net>
david.moessbauer(a)progeny.net<mailto:david.moessbauer@progeny.net>
SIPR: david.moessbauer.ctr(a)progeny.spawar-chas.navy.smil.mil<mailto:david.moessbauer.ctr@progeny.spawar-chas.navy.smil.mil>
(410) 627-5633 (M)
(703) 368-6107 x315 (O) / x125 (Lab)
The Information contained in or attached to this communication may be confidential and privileged proprietary intended only for the individual/s or entity to whom/which it is addressed. Any unauthorized use, distribution, copying or disclosure of this information is strictly prohibited. If you have received this communication in error please contact the sender immediately and delete from your system.
10 years, 12 months