Greetings,
So I am still in the learning process and am currently creating my own SSG benchmark for
Java.
Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle,
ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle,
/etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account
for all types.
While typically one would only go with one particular type of java, I would like to ensure
that if more than one type is installed, that I capture compliance for everyone.
However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and
how best to use each in the proper hierarchy to achieve my goal.
I can't seem to find any good information that breaks down each of these and their
intended outcome.
Now obviously if you have more than one definition underneath AND, the requirement is that
all equate to true.
So to achieve my suggested goal, my thoughts were the following for cpe-oval:
<AND>
Def.UNIX
<OR>
Def.JRE-SUN
<OR>
Def.JRE-ORACLE
...
That seems to work, but the criteria for the actual checks seem to get a little more
grey.
My thoughts were:
<OR>
TST.JRE-SUN-INSTALLED
<AND>
TST.JRE-SUN-CHECK
TST.JRE-ORACLE-INSTALLED
<AND>
TST.JRE-ORACLE-CHECK
But that doesn't seem to pan out the way I expected it to.
Any thoughts on how best to accomplish this?
Thaks!
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at
2013-08-29 12:13:20 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others
authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you
are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this
information is strictly prohibited and may be unlawful.