I'm trying to understand (as an example) the following results from an evaluation on a rhel6.3 box using the stig-rhel6-server profile. And I apologize if these questions are answered in a FAQ somewhere.
1) Ensure Log Files Are Owned By Appropriate Group unknown Ensure System Log Files Have Correct Permissions unknown
2) All GIDs referenced in /etc/passwd must be defined in /etc/group notchecked Ensure All Accounts on the System Have Unique Names notchecked
I understand that the "notchecked" is because there is not an oval test defined and the "unknown" is a specific "I don't know", as in the rsyslog_files_groupownership.xml:
<ind:unknown_test check="all" comment="use extended content to evaluated this test" id="test_20155" version="1" />
So I've been reading the oval language definitions and I cannot see how to address the "unknown" tests which require parsing a file to get parts out of it (rsyslog wants defined log paths).
Q) How does one go about writing a test that takes the result from evaluating a script? What is the "extended content"??
Q) Are the "notchecked" tests because the check is too vague? Or just not written yet?
Any documents I should be reading?
Thanks.