Going forward, we're going to use <reference> tags inside of
OVAL checks to track if they've been tested. An example is as
follows:
<reference
source="MED" ref_id="20130731"
ref_url="test_attestation" />
Source should uniquely identify the tester (here, I used my
initials); ref_id should be in the format YYYYMMDD. We'll probably
be adding empty tags into all the checks to get everyone started.
This is similar to the <tested> tag in XCCDF, which is
converted into an XCCDF <reference> tag during our build
process.
Here is an example of the <reference> tag in an existing
check. Note that it comes just after the description tag, inside of
<metadata>.
<def-group>
<definition class="compliance"
id="file_permissions_etc_group" version="1">
<metadata>
<title>Verify permissions on 'group'
file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux
6</platform>
</affected>
<description>File permissions for
/etc/group should be set correctly.</description>
<reference source="MED" ref_id="20130731"
ref_url="test_attestation"/>
</metadata>
<criteria>
<criterion
test_ref="file_permissions_etc_group_test" />
</criteria>
</definition>
<unix:file_test check="all"
check_existence="all_exist" comment="Testing /etc/group
permissions" id="file_permissions_etc_group_test" version="1">
<unix:object
object_ref="file_permissions_etc_group_object" />
<unix:state
state_ref="file_permissions_etc_group_state" />
</unix:file_test>
<unix:file_state
id="file_permissions_etc_group_state" version="1">
<unix:uread
datatype="boolean">true</unix:uread>
<unix:uwrite
datatype="boolean">true</unix:uwrite>
<unix:uexec
datatype="boolean">false</unix:uexec>
<unix:gread
datatype="boolean">true</unix:gread>
<unix:gwrite
datatype="boolean">false</unix:gwrite>
<unix:gexec
datatype="boolean">false</unix:gexec>
<unix:oread
datatype="boolean">true</unix:oread>
<unix:owrite
datatype="boolean">false</unix:owrite>
<unix:oexec
datatype="boolean">false</unix:oexec>
</unix:file_state>
<unix:file_object comment="/etc/group"
id="file_permissions_etc_group_object" version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
</def-group>
- Maura Dailey