So I finally got it!
I had to include checks for the packages not being installed. So for each package to
evaluate as true, I had to check that either the package is installed and the appropriate
configuration setting is applied or the package is not installed.
Here is what I ended up with:
<criteria operator="AND">
<criteria operator="OR" negate="false">
<criteria operator="AND"
negate="false">
<!-- Check Oracle's
1.6.0 & 1.7.0 Java ... -->
<criterion comment="Check
deployment.security.askgrantdialog.notinca"
test_ref="test_untrusted_sources_oracle_java" />
<criterion comment="Oracle's
JRE is installed"
test_ref="test_oracle_java"
/>
</criteria>
<criterion comment="Oracle's JRE is not
installed"
test_ref="test_oracle_java_not" />
</criteria>
<criteria operator="OR" negate="false">
<criteria operator="AND"
negate="false">
<!-- Check Red Hat's
IBM 1.6.0 & 1.7.0 Java ... -->
<criterion comment="Check
deployment.security.askgrantdialog.notinca"
test_ref="test_untrusted_sources_rhel_ibm_java" />
<criteria operator="OR"
negate="false">
<criterion
comment="Red Hat's IBM JRE 1.6.0 is installed"
test_ref="test_rhel_ibm_160_java" />
<criterion
comment="Red Hat's IBM JRE 1.7.0 is installed"
test_ref="test_rhel_ibm_170_java" />
</criteria>
</criteria>
<criteria operator="AND"
negate="false">
<criterion comment="Red Hat's
IBM JRE 1.6.0 is not installed"
test_ref="test_rhel_ibm_160_java_not" />
<criterion comment="Red Hat's
IBM JRE 1.7.0 is not installed"
test_ref="test_rhel_ibm_170_java_not" />
</criteria>
</criteria>
<criteria operator="OR" negate="false">
<criteria operator="AND"
negate="false">
<!-- Check Red Hat's
OpenJDK 1.6.0 & 1.7.0 Java ... -->
<criterion comment="Check
deployment.security.askgrantdialog.notinca"
test_ref="test_untrusted_sources_rhel_openjdk_java" />
<criteria operator="OR"
negate="false">
<criterion
comment="Red Hat's OpenJDK JRE 1.6.0 is installed"
test_ref="test_rhel_openjdk_160_java" />
<criterion
comment="Red Hat's OpenJDK JRE 1.7.0 is installed"
test_ref="test_rhel_openjdk_170_java" />
</criteria>
</criteria>
<criteria operator="AND"
negate="false">
<criterion comment="Red Hat's
OpenJDK JRE 1.6.0 is not installed"
test_ref="test_rhel_openjdk_160_java_not" />
<criterion comment="Red Hat's
OpenJDK JRE 1.7.0 is not installed"
test_ref="test_rhel_openjdk_170_java_not" />
</criteria>
</criteria>
<criteria operator="OR" negate="false">
<criteria operator="AND"
negate="false">
<!-- Check Red Hat's
Sun 1.6.0 Java ... -->
<criterion comment="Check
deployment.security.askgrantdialog.notinca"
test_ref="test_untrusted_sources_rhel_sun_java" />
<criterion comment="Red Hat's
Sun JRE 1.6.0 is installed"
test_ref="test_rhel_sun_160_java"
/>
</criteria>
<criterion comment="Red Hat's Sun JRE 1.6.0 is
not installed"
test_ref="test_rhel_sun_160_java_not" />
</criteria>
<criteria operator="OR" negate="false">
<criteria operator="AND"
negate="false">
<!-- Check Red Hat's
Oracle 1.7.0 Java ... -->
<criterion comment="Check
deployment.security.askgrantdialog.notinca"
test_ref="test_untrusted_sources_rhel_oracle_java" />
<criterion comment="Red Hat's
Oracle JRE 1.7.0 is installed"
test_ref="test_rhel_oracle_170_java" />
</criteria>
<criterion comment="Red Hat's Oracle JRE 1.7.0
is not installed"
test_ref="test_rhel_oracle_170_java_not" />
</criteria>
</criteria>
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Gary Gapinski
Sent: Thursday, August 29, 2013 1:14 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: Definition Criteria ...
On 08/29/2013 02:05 PM, Gary Gapinski wrote:
Bungled a few comments…
For CPE OVAL, the following is an example:
[snip]
<tests>
<linux:rpminfo_test id="oval:com.example:tst:1" version="1"
check="all" check_existence="at_least_one_exists"
comment="Sun Java is installed">
<linux:object object_ref="oval:com.example:obj:1"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:2" version="1"
check="all" check_existence="at_least_one_exists"
comment="Oracle Java is installed">
<linux:object object_ref="oval:com.example:obj:2"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:3" version="1"
check="all" check_existence="at_least_one_exists"
comment="IBM Java is installed">
<linux:object object_ref="oval:com.example:obj:3"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:4" version="1"
check="all" check_existence="at_least_one_exists"
comment="OpenJDK Java is installed">
<linux:object object_ref="oval:com.example:obj:4"/>
</linux:rpminfo_test>
</tests>
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at
2013-08-29 17:02:18 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others
authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you
are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this
information is strictly prohibited and may be unlawful.