coming soon: consistency checking scripts

Kevin Spargur kspargur at redhat.com
Tue Mar 13 13:33:16 UTC 2012


Perhaps it's beyond the scope of this script but identifying rules 
without NIST controls would also be of value.

Number 5 could be tricky with respect to nested checks, some checks are 
not referenced in the xccdf directly.

V/r,

Kevin Spargur



On 03/12/2012 10:26 PM, Shawn Wells wrote:
> On 3/12/12 5:59 PM, Jeffrey Blank wrote:
>> We'll shortly be committing a script to do checking for consistency 
>> between our OVAL and XCCDF.  This should detect situations such as:
>>
>> 1)
>> a reference from an XCCDF rule to an OVAL definition that doesn't exist.
>>
>> 2)
>> an XCCDF rule exists (and is used in a profile) but doesn't include 
>> any reference to a check.
>>
>> 3)
>> mismatch between filename and OVAL definition name (as this is an 
>> important convention for our approach to modular definitions) 
>
> I think the following would be helpful too:
>
> 4)
> An XCCDF rule exists and isn't used in a profile
>
> 5)
> Any checks that are not present in an XCCDF rule
> (I can't imagine there would actually be any of these given how we've 
> been making XCCFD then the checks, but it'd be good to watch for)
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list