On 08/01/2013 02:11 PM, Steve Grubb wrote:
OVAL variable support is a certification requirement for any SCAP 1.2 scanner. Its in the 7511 as SCAP.T.2000.5. So, any validated scanner should handle it.
Perhaps. I would expect that had my expectations not been previously negatively calibrated.
Please take a close look at the example I provided. It is an acid test for proper evaluation in the context of a single OVAL external variable assuming two values for two invocations of a definition. I do not believe such usage is precluded by XCCDF or OVAL. Nor does a cursory scan of SCAP 1.1 (§3.2.5.2 appears to be the only applicable section) or SCAP 1.2 (§3.2.5).
Such re-use allows great economy of expression. It can, be extended to check settings such as those specified using sysctl, e.g., net.ipv4.ip_forward = 0.
Regards,
Gary