On Mon, Sep 10, 2012 at 5:39 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil> wrote:
[...]
Regarding what the actual check should be: it's not just that a package
is installed with that name, it's that it's a Red Hat release key (as
indicated in the Rule). Perhaps there is a way to get at the particular
package summary name using the rpminfo test. [...]
The OVAL 5.10.1 Linux definition does not provide a means to examine
an RPM package summary.
The OVAL checks provided as USGCB 1.0.5.0 content do not examine the
Red Hat release key RPM summary. Instead they confirm that there is a
package installed with the name gpg-pubkey and with the version string
set to the 32-bits of the Red Hat release key ID and with the release
string set to the 32-bits of the Red Hat release key signature date.
Unlike RHEL 5, RHEL 6 comes with an auxiliary key that is used for
disaster recovery. For details:
http://www.awe.com/mark/blog/20101111.html
https://access.redhat.com/security/team/key/
It seems important to verify that the auxiliary key package is is also
installed.
Are there issues with continuing to use the (package name, key ID,
signature date) combination to specify the release key RPM?
Regards,
Kenneth