Ah, indeed. Mirek's original suggestion (sent via OVAL list) also had
the filter, but somehow it did not make it into our commit.
I'll check with Michael to see what happened, and then make an update.
Thanks very much for the sharp eye!
On 12/13/2011 08:55 AM, Peter Vrabec wrote:
I have noticed new rpm_verify.xml check with following commit message:
" the "rpm_verify.xml" check now works but a word of caution:
* it creates an approximately 250M results file
* it takes a long time to execute on a reasonably powerful system"
It's true that OVAL rpmverify is not used effectively here. You collect all
rpmverify items from all packages on a system. This is not very happy
I suggest changing logic of the test. Filter out items you don't need. :)
scap:tst:1001" version="1" check="all" comment="Files with
comment="(RPM)Verify all files">
<lin-def:behaviors nodeps="true" nofiles="false"
noscripts="true" nosignature="true" nomd5="true"/>
<lin-def:name operation="pattern match">.*</lin-def:name>
scap-security-guide mailing list