Thanks for the testing, Leam!
Indeed. Nobody should be cutting RPMs with these outstanding.
Nor should anybody push a commit without running "make validate" first.
I am still toying with the idea of adding some git pre-commit hooks to
attempt to enforce some discipline in this matter.
The environmentvariable one relates to an OVAL check that was
apparently in the RHEL 5 USGCB (and not the RHEL 6 STIG) and which I
had advocated simply removing from our body of checks; the related
XCCDF is perfectly nice as best practice guidance, but some changes
occurred in the OVAL language between 5.8 and 5.10 that make this a
headache to support.
Any USGCB (per NIST 800-70 Appendix E) is to be based on the
submission to NIST by a USG "champion agency", which has often (but
not always) been a STIG from DoD. The RHEL 5 USGCB preceded the STIG
for RHEL 5 (and our regular listeners are aware of the significant
quality differences in these). However things have been converging
and the USGCB for RHEL 6 (if submitted to NIST by DoD) will be based
on the STIG (as captured in SSG). It should simply be an additional
Profile, with some adjustments for the federal audience. (Indeed
there should be giant "pre-submission draft" labelling around our
current "USGCB" Profile for that purpose). I would like to draw
Shawn's attention to the intended nature of this lineage, and thus
complete this thread differently, with application of Maura's patch:
David and I are working the USGCB submission angle and meeting with
relevant leadership tomorrow. Er, today...
On Thu, Aug 29, 2013 at 12:55 PM, leam hall <leamhall(a)gmail.com> wrote:
Pulled the latest from
and did a make
and make validate. Received the following:
oscap xccdf validate-xml output/ssg-rhel6-xccdf.xml
oscap oval validate-xml output/ssg-rhel6-oval.xml
oscap oval validate-xml output/ssg-rhel6-cpe-oval.xml
cd output; ../utils/verify-references.py --rules-with-invalid-checks
Invalid OVAL definition referenced by XCCDF Rule: set_gdm_login_banner_text
Invalid OVAL definition referenced by XCCDF Rule:
OVAL Check is not referenced by XCCDF: oval:ssg:def:1052
oscap oval validate-xml --schematron output/ssg-rhel6-oval.xml
DEPRECATED OBJECT: ind:environmentvariable_object ID: oval:ssg:obj:2112
Invalid OVAL Definition content(5.10) in output/ssg-rhel6-oval.xml.
make: *** [validate] Error 2
Mind on a Mission
scap-security-guide mailing list