Hello, Trey:

Welcome.

On 08/29/2013 12:13 PM, Trey Henefield wrote:

Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.

 

While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.


However, you mention CPE OVAL below, which would be used to establish the existence of some sort of Java on the ToE.

 

However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal.

 

I can’t seem to find any good information that breaks down each of these and their intended outcome.


AFAIK, there isn't any.

 

Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true.


Yes, or false if no Java is present.

 

So to achieve my suggested goal, my thoughts were the following for cpe-oval:

 

<AND>

               Def.UNIX

               <OR>

                              Def.JRE-SUN

               <OR>

                              Def.JRE-ORACLE

               …

 

That seems to work, but the criteria for the actual checks seem to get a little more grey.

 

My thoughts were:

 

<OR>

               TST.JRE-SUN-INSTALLED

               <AND>

TST.JRE-SUN-CHECK

               TST.JRE-ORACLE-INSTALLED

               <AND>

TST.JRE-ORACLE-CHECK

 

But that doesn’t seem to pan out the way I expected it to.

 

Any thoughts on how best to accomplish this?

 


For CPE OVAL, the following is an example:
<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
    xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
    xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
    xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
    http://oval.mitre.org/XMLSchema/oval-definitions-5             http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/oval-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/independent-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#unix        http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/unix-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#linux       http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-definitions-schema.xsd
    ">
    <generator>
        <schema_version xmlns="http://oval.mitre.org/XMLSchema/oval-common-5">5.10.1</schema_version>
        <timestamp xmlns="http://oval.mitre.org/XMLSchema/oval-common-5">2013-08-29T00:00:00Z</timestamp>
    </generator>
    <definitions>
        <definition id="oval:com.example:def:1" version="1" class="inventory">
            <metadata>
                <title/>
                <description/>
            </metadata>
            <criteria operator="OR">
                <criterion test_ref="oval:com.example:tst:1" comment="Sun Java is installed"/>
                <criterion test_ref="oval:com.example:tst:2" comment="Oracle Java is installed"/>
                <criterion test_ref="oval:com.example:tst:3" comment="IBM Java is installed"/>
                <criterion test_ref="oval:com.example:tst:3" comment="OpenJDK Java is installed"/>
            </criteria>
        </definition>
    </definitions>
    <tests>
        <linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed">
            <linux:object object_ref="oval:com.example:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed">
            <linux:object object_ref="oval:com.example:obj:2"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed">
            <linux:object object_ref="oval:com.example:obj:3"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed">
            <linux:object object_ref="oval:com.example:obj:4"/>
        </linux:rpminfo_test>
    </tests>
    <objects>
        <linux:rpminfo_object id="oval:com.example:obj:1" version="1">
            <linux:name>sun-java</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:com.example:obj:2" version="1">
            <linux:name>oracle-java</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:com.example:obj:3" version="1">
            <linux:name>ibm-java</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:com.example:obj:4" version="1">
            <linux:name>openjdk-java</linux:name>
        </linux:rpminfo_object>
    </objects>
</oval_definitions>
This is a single OVAL definition which returns true if some Java is present. It simply looks to see if certain RPMs are installed.

NOTE: I faked the RPM names, and file test rather than RPM test would be necessary to find Java artifacts for something installed other than with an RPM. Not tested: YMMV.

A benchmark using a <platform> element for "any sort of Java" would be accompanied by a CPE definition document, which would in turn reference the CPE OVAL document above. The above would have to be split into one-definition-per-Java to correspond to individual <platform> declarations.

An OVAL compliance check would be more complicated but build on such to, for each Java variant, establish existence and then perform additional evaluations for proper security posture.

The XCCDF using such could either refer to one complicated multi-definition-multi-Java OVAL definition, or (using <complex-check>) refer to individual per-Java definitions each of which would have an accompany existence check. At either the XCCDF level or below, the desired logic would be "for every Java installed, it is compliant" which at a lower level becomes "for each extant Java, evaluate all compliance checks".

Composite checks are likely going to be something like "return ((not installed) or (check1 and check2 and ... and check n)).

There are multiple ways to approach this using both XCCDF and OVAL. Feel free to pose questions and examples as encountered. This stuff is not easy to digest.

Regards,

Gary