Introduce rule that will be checking if underlying Fedora system is updated wrt to recently reported security flaws (success = all available security updates for installed packages are installed on the system).
It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first.
Proposed patch passed all testing except: make validate
rule in Fedora directory (utils/verify-references.py returned following traceback):
Non-OVAL checking system found: http://open-scap.org/page/SCE Traceback (most recent call last): File "../utils/verify-references.py", line 184, in <module> main() File "../utils/verify-references.py", line 120, in main print "Invalid OVAL definition referenced by XCCDF Rule: " + rule.get("id") TypeError: cannot concatenate 'str' and 'NoneType' objects make: *** [validate] Error 1
but this error message is expected / safe, since 'security_patches_up_to_date' rule uses in the complex-check section also one SCE rule (reason where 'Non-OVAL checking system' warning comes from).
Please review.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
On Thursday, October 03, 2013 01:54:17 PM Jan Lieskovsky wrote:
It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first.
What are the possibilities of tying the bodhi release system to create OVAL files for the Fedora project? All we'd need to do is when the release is security sensitive, add the CVE information. Then Bodhi can use this to make OVAL files to be downloaded.
-Steve
Hi Steve,
On Thursday, October 03, 2013 01:54:17 PM Jan Lieskovsky wrote:
It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first.
What are the possibilities of tying the bodhi release system to create OVAL files for the Fedora project?
We have previously considered this alternative, and SCE way has been chosen as a short-term way to go.
All we'd need to do is when the release is security sensitive, add the CVE information. Then Bodhi can use this to make OVAL files to be downloaded.
Not sure at the moment, which exact bits would need to be updated in Bodhi system to make it automa{t,g}ically generate OVAL CVE content for Fedora.
We will inspect this possibility yet though.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
-Steve
This is the actual proposal that should check if Fedora system is updated wrt to currently avaiable security fixes.
Any progress reviewing it?
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
----- Original Message -----
From: "Jan Lieskovsky" jlieskov@redhat.com To: scap-security-guide@lists.fedorahosted.org Sent: Thursday, October 3, 2013 7:54:17 PM Subject: [PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule
Introduce rule that will be checking if underlying Fedora system is updated wrt to recently reported security flaws (success = all available security updates for installed packages are installed on the system).
It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first.
Proposed patch passed all testing except: make validate
rule in Fedora directory (utils/verify-references.py returned following traceback):
Non-OVAL checking system found: http://open-scap.org/page/SCE Traceback (most recent call last): File "../utils/verify-references.py", line 184, in <module> main() File "../utils/verify-references.py", line 120, in main print "Invalid OVAL definition referenced by XCCDF Rule: " + rule.get("id") TypeError: cannot concatenate 'str' and 'NoneType' objects make: *** [validate] Error 1
but this error message is expected / safe, since 'security_patches_up_to_date' rule uses in the complex-check section also one SCE rule (reason where 'Non-OVAL checking system' warning comes from).
Please review.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
scap-security-guide@lists.fedorahosted.org