A question about the ensure_redhat_gpgkey_installed test

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Sep 10 21:39:13 UTC 2012


I believe it's more complicated than that.  Here's another case of where
the XCCDF text simply doesn't align with the OVAL check. (So I
appreciate the QA.)  And this is an important check since it ensures the
system is configured to cryptographically verify the authenticity of
updates.

Regarding what the actual check should be: it's not just that a package
is installed with that name, it's that it's a Red Hat release key (as
indicated in the Rule).  Perhaps there is a way to get at the particular
package summary name using the rpminfo test.  And yes, that would
definitely need to be a custom (non-templated) test...

Steve G would know more.




On 09/10/2012 05:25 PM, Kenneth Stailey wrote:
> Hi,
> 
> RHEL6/input/checks/templates/packages_installed.csv contains
> rhn_gpgkey but the real Red Hat release signing key package name is
> gpg-pubkey.  The version and release strings must be used since they
> specify the key ID and there are usually several versions of
> gpg-pubkey installed at the same time.
> 
> Unless create_package_installed.py and template_package_installed are
> refactored to support specifying RPM version and release strings this
> test can't use templating.
> 
> Given that the only two packages that can have multiple versions
> installed are gpg-pubkey and kernel is it worth modifying the
> templating code to support these special cases?
> 
> Thanks,
> Kenneth
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list