I believe it's more complicated than that. Here's another case of where
the XCCDF text simply doesn't align with the OVAL check. (So I
appreciate the QA.) And this is an important check since it ensures the
system is configured to cryptographically verify the authenticity of
updates.
Regarding what the actual check should be: it's not just that a package
is installed with that name, it's that it's a Red Hat release key (as
indicated in the Rule). Perhaps there is a way to get at the particular
package summary name using the rpminfo test. And yes, that would
definitely need to be a custom (non-templated) test...
Steve G would know more.
On 09/10/2012 05:25 PM, Kenneth Stailey wrote:
Hi,
RHEL6/input/checks/templates/packages_installed.csv contains
rhn_gpgkey but the real Red Hat release signing key package name is
gpg-pubkey. The version and release strings must be used since they
specify the key ID and there are usually several versions of
gpg-pubkey installed at the same time.
Unless create_package_installed.py and template_package_installed are
refactored to support specifying RPM version and release strings this
test can't use templating.
Given that the only two packages that can have multiple versions
installed are gpg-pubkey and kernel is it worth modifying the
templating code to support these special cases?
Thanks,
Kenneth
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide