OVAL checks that work correctly

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Dec 14 19:04:57 UTC 2011


Peter,

Yes, there are still lots of issues, and it's too early to send reports.
The only profile that might fully work is the little "test" profile.
:)

The current goal is to be able to run the other profiles (as you say), like:
make content; make validate
oscap xccdf eval --profile desktop_fastcheck output/rhel6-xccdf-valid.html

Right now, we are still working to make fixes.  You are also invited to 
commit fixes directly, if you'd like.

We did just push a fix for one silly problem, in which pattern matches 
were broken by newlines.  (A result of tidy's "nice indenting" of the 
translation of the USGCB content.)

The informal plan is:

1) Make sure that the large number of "templated" checks work properly.
The "templated" checks (services, packages, audit rules, kernel modules) 
should work now.  (Right?)

2) Make the other checks work, discovering problems by executing the 
profile (with the oscap line above).  Right now there is a problem with 
a missing <Value> that Michael is investigating.

3) Do the real research about the RHEL 6 platform and add additional checks.

I will consider it a major milestone when we can execute the desktop or 
server profile with oscap.  (I plan to send messages to the list when we 
can do so.)

At that time, we'd want reports of problems.  Until then, we're trying 
to fix up as much as possible.

Also note:
The testcheck.py script can't handle external variables right now, so I 
was considering updating it to:
replace external vars with local vars,
using values from (the shell's) environment variables.

Or perhaps we should try using oscap directly for unit tests of the OVAL 
checks, since we have valid XCCDF and OVAL to use now ...


Thanks,
Jeff





On 12/14/2011 08:59 AM, Peter Vrabec wrote:
> Hi all,
>
> I'd like to test the content but I don't know which OVAL tests are considered
> to be OK. I mean they are "implemented" correctly.
>
> My assumption is that tests from one of the XCCDF profiles should be OK. Could
> you please clarify it. The reason I'm asking is that I don't want to report
> you issues that you are already aware of. :)
>
> Peter.
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list