rpm_verify.xml - improvements

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Dec 13 18:53:11 UTC 2011


Ah, indeed.  Mirek's original suggestion (sent via OVAL list) also had 
the filter, but somehow it did not make it into our commit.

I'll check with Michael to see what happened, and then make an update.

Thanks very much for the sharp eye!




On 12/13/2011 08:55 AM, Peter Vrabec wrote:
> Hi all,
>
> I have noticed new rpm_verify.xml check with following commit message:
>
> " the "rpm_verify.xml" check now works but a word of caution:
>   * it creates an approximately 250M results file
>   * it takes a long time to execute on a reasonably powerful system"
>
> It's true that OVAL rpmverify is not used effectively here. You collect all
> rpmverify items from all packages on a system. This is not very happy
> solution. ;)
>
> I suggest changing logic of the test. Filter out items you don't need. :)
>
> example:
> (thnx. to<mitr at redhat.com>)
>
>    <tests>
>      <lin-def:rpmverify_test check_existence="none_exist" id="oval:org.open-
> scap:tst:1001" version="1" check="all" comment="Files with changed
> permissions">
>        <lin-def:object object_ref="oval:org.open-scap:obj:1001"/>
>      </lin-def:rpmverify_test>
>    </tests>
>
>    <objects>
>      <lin-def:rpmverify_object id="oval:org.open-scap:obj:1001" version="1"
> comment="(RPM)Verify all files">
>        <lin-def:behaviors nodeps="true" nofiles="false" nodigest="true"
> noscripts="true" nosignature="true" nomd5="true"/>
>        <lin-def:name operation="pattern match">.*</lin-def:name>
>        <lin-def:filepath operation="pattern match">.*</lin-def:filepath>
>        <filter action="include">oval:org.open-scap:ste:1001</filter>
>      </lin-def:rpmverify_object>
>    </objects>
>
>    <states>
>      <lin-def:rpmverify_state id="oval:org.open-scap:ste:1001" version="1">
>        <lin-def:mode_differs>fail</lin-def:mode_differs>
>      </lin-def:rpmverify_state>
>    </states>
>
>
> Regards,
>
> Peter.
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list