Greetings,

 

So I am still in the learning process and am currently creating my own SSG benchmark for Java.

 

Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.

 

While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.

 

However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal.

 

I can’t seem to find any good information that breaks down each of these and their intended outcome.

 

Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true.

 

So to achieve my suggested goal, my thoughts were the following for cpe-oval:

 

<AND>

               Def.UNIX

               <OR>

                              Def.JRE-SUN

               <OR>

                              Def.JRE-ORACLE

               …

 

That seems to work, but the criteria for the actual checks seem to get a little more grey.

 

My thoughts were:

 

<OR>

               TST.JRE-SUN-INSTALLED

               <AND>

TST.JRE-SUN-CHECK

               TST.JRE-ORACLE-INSTALLED

               <AND>

TST.JRE-ORACLE-CHECK

 

But that doesn’t seem to pan out the way I expected it to.

 

Any thoughts on how best to accomplish this?

 

Thaks!

 

Best regards,

 

Trey Henefield, CISSP

Senior IAVA Engineer

 

Ultra Electronics

Advanced Tactical Systems, Inc.

4101 Smith School Road

Building IV, Suite 100

Austin, TX 78744 USA

 

Trey.Henefield@ultra-ats.com

Tel: +1 512 327 6795 ext. 647

Fax: +1 512 327 8043

Mobile: +1 512 541 6450

 

www.ultra-ats.com

 



Disclaimer
The information contained in this communication from
trey.henefield@ultra-ats.com sent at 2013-08-29 12:13:20 is private and may be legally privileged or export controlled. It is intended solely for use by scap-security-guide@lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide@lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.