Going forward, we're going to use <reference> tags inside of OVAL checks
to track if they've been tested. An example is as follows:
|<reference ||source="MED" ref_id="20130731" ref_url="test_attestation" />|
Source should uniquely identify the tester (here, I used my initials);
ref_id should be in the format YYYYMMDD. We'll probably be adding empty
tags into all the checks to get everyone started. This is similar to the
<tested> tag in XCCDF, which is converted into an XCCDF <reference> tag
during our build process.
Here is an example of the <reference> tag in an existing check. Note
that it comes just after the description tag, inside of <metadata>.
|<def-group>||
|| <definition class="compliance" id="file_permissions_etc_group"
version="1">||
|| <metadata>||
|| <title>Verify permissions on 'group' file</title>||
|| <affected family="unix">||
|| <platform>Red Hat Enterprise Linux 6</platform>||
|| </affected>||
|| <description>File permissions for /etc/group should be set
correctly.</description>||
|| <reference source="MED" ref_id="20130731"
ref_url="test_attestation"/>||
|| </metadata>||
|| <criteria>||
|| <criterion test_ref="file_permissions_etc_group_test" />||
|| </criteria>||
|| </definition>||
|| <unix:file_test check="all" check_existence="all_exist"
comment="Testing /etc/group permissions"
id="file_permissions_etc_group_test" version="1">||
|| <unix:object object_ref="file_permissions_etc_group_object" />||
|| <unix:state state_ref="file_permissions_etc_group_state" />||
|| </unix:file_test>||
|| <unix:file_state id="file_permissions_etc_group_state" version="1">||
|| <unix:uread datatype="boolean">true</unix:uread>||
|| <unix:uwrite datatype="boolean">true</unix:uwrite>||
|| <unix:uexec datatype="boolean">false</unix:uexec>||
|| <unix:gread datatype="boolean">true</unix:gread>||
|| <unix:gwrite datatype="boolean">false</unix:gwrite>||
|| <unix:gexec datatype="boolean">false</unix:gexec>||
|| <unix:oread datatype="boolean">true</unix:oread>||
|| <unix:owrite datatype="boolean">false</unix:owrite>||
|| <unix:oexec datatype="boolean">false</unix:oexec>||
|| </unix:file_state>||
|| <unix:file_object comment="/etc/group"
id="file_permissions_etc_group_object" version="1">||
|| <unix:path>/etc</unix:path>||
|| <unix:filename>group</unix:filename>||
|| </unix:file_object>||
||</def-group>|
- Maura Dailey