[PATCH 02/8] Updated verify-references.py to ignore ocil-transitional
Shawn Wells
shawn.d.wells at gmail.com
Fri Dec 14 02:49:42 UTC 2012
-------------- next part --------------
>From c69f76b1ed965dce8cab420202834f6193cc2713 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 13 Dec 2012 21:02:15 -0500
Subject: [PATCH 02/28] Updated verify-references.py to ignore ocil-transitional
The verify-references.py script was generating significant noice on our OCIL checks,
however ocil-transitional is expected as it generates our "this is a finding if...."
language.
Updated verify-references ignore ocil-transitional as an OVAL tag
Behavior before:
$ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml
Non-OVAL checking system found: ocil-transitional
Non-OVAL checking system found: ocil-transitional
Non-OVAL checking system found: ocil-transitional
Non-OVAL checking system found: ocil-transitional
Non-OVAL checking system found: ocil-transitional
.....
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_prelink
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: aide_build_database
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_nonroot_partitions
Behavior after:
$ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_prelink
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: aide_build_database
XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_nonroot_partitions
---
RHEL6/utils/verify-references.py | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
index d7f082d..ddaec7b 100755
--- a/RHEL6/utils/verify-references.py
+++ b/RHEL6/utils/verify-references.py
@@ -55,7 +55,8 @@ def get_ovalfiles(checks):
if check.get("system") == oval_ns:
checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns)
ovalfiles.add(checkcontentref.get("href"))
- else:
+ #else:
+ elif check.get("system") != "ocil-transitional":
print "Non-OVAL checking system found: " + check.get("system")
return ovalfiles
--
1.7.1
More information about the scap-security-guide
mailing list