[PATCH 1/1] Update CCE-14440-2 "Ensure Red Hat GPG Key is Installed"

Kenneth Stailey kstailey.lists at gmail.com
Wed Sep 12 16:30:28 UTC 2012


Confirm that RPM packages gpg-pubkey-fd431d51-4ae0493b and gpg-pubkey-2fa658e0-45700c69 are installed.
The Red Hat release key package is gpg-pubkey-fd431d51-4ae0493b.
The Red Hat auxiliary key package is gpg-pubkey-2fa658e0-45700c69.

Signed-off-by: Kenneth Stailey <kstailey.lists at gmail.com>
---
 .../checks/package_red_hat_gpgkeys_installed.xml   | 45 ++++++++++++++++++++++
 .../input/checks/package_rhn_gpgkey_installed.xml  | 25 ------------
 .../input/checks/templates/packages_installed.csv  |  1 -
 RHEL6/input/system/software/updating.xml           |  2 +-
 4 files changed, 46 insertions(+), 27 deletions(-)
 create mode 100644 RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
 delete mode 100644 RHEL6/input/checks/package_rhn_gpgkey_installed.xml

diff --git a/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml b/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
new file mode 100644
index 0000000..ccdeb89
--- /dev/null
+++ b/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
@@ -0,0 +1,45 @@
+<def-group>
+  <definition class="compliance" id="package_red_hat_gpgkeys_installed"
+  version="1">
+    <metadata>
+      <title>Red Hat Release and Auxiliary gpg-pubkey Packages Installed</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The Red Hat release and auxiliary key packages are required to be installed.</description>
+    </metadata>
+    <criteria comment="packages gpg-pubkey-fd431d51-4ae0493b and gpg-pubkey-2fa658e0-45700c69 are installed"
+	      operator="AND">
+      <criterion comment="package gpg-pubkey-fd431d51-4ae0493b is installed"
+		 test_ref="test_package_gpgkey-fd431d51-4ae0493b_installed" />
+      <criterion comment="package gpg-pubkey-2fa658e0-45700c69 is installed"
+		 test_ref="test_package_gpgkey-2fa658e0-45700c69_installed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="only one" check_existence="any_exist"
+  id="test_package_gpgkey-fd431d51-4ae0493b_installed" version="1"
+  comment="Red Hat release key package is installed">
+    <linux:object object_ref="obj_package_gpg-pubkey" />
+    <linux:state state_ref="state_package_gpg-pubkey" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_gpg-pubkey" version="1">
+    <linux:name>gpg-pubkey</linux:name>
+  </linux:rpminfo_object>
+  <linux:rpminfo_state id="state_package_gpg-pubkey" version="1">
+    <linux:release>4ae0493b</linux:release>
+    <linux:version>fd431d51</linux:version>
+  </linux:rpminfo_state>
+  <linux:rpminfo_test check="only one" check_existence="any_exist"
+  id="test_package_gpgkey-2fa658e0-45700c69_installed" version="1"
+  comment="Red Hat auxiliary key package is installed">
+    <linux:object object_ref="obj_package_gpg-pubkey" />
+    <linux:state state_ref="state_package_gpg-pubkey" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_gpg-pubkey" version="1">
+    <linux:name>gpg-pubkey</linux:name>
+  </linux:rpminfo_object>
+  <linux:rpminfo_state id="state_package_gpg-pubkey" version="1">
+    <linux:release>2fa658e0</linux:release>
+    <linux:version>45700c69</linux:version>
+  </linux:rpminfo_state>
+</def-group>
diff --git a/RHEL6/input/checks/package_rhn_gpgkey_installed.xml b/RHEL6/input/checks/package_rhn_gpgkey_installed.xml
deleted file mode 100644
index 9628434..0000000
--- a/RHEL6/input/checks/package_rhn_gpgkey_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_rhn_gpgkey_installed"
-  version="1">
-    <metadata>
-      <title>Package rhn_gpgkey Installed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package rhn_gpgkey should be installed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package rhn_gpgkey is installed"
-      test_ref="test_package_rhn_gpgkey_installed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="all_exist"
-  id="test_package_rhn_gpgkey_installed" version="1"
-  comment="package rhn_gpgkey is installed">
-    <linux:object object_ref="obj_package_rhn_gpgkey" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_rhn_gpgkey" version="1">
-    <linux:name>rhn_gpgkey</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv
index 0028011..2a9fe8b 100644
--- a/RHEL6/input/checks/templates/packages_installed.csv
+++ b/RHEL6/input/checks/templates/packages_installed.csv
@@ -13,7 +13,6 @@ openswan
 policycoreutils
 postfix
 psacct
-rhn_gpgkey
 rsyslog
 vlock
 vsftpd
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 2670147..b43e21f 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -37,7 +37,7 @@ This key is necessary to cryptographically verify that packages
 are from Red Hat.
 </rationale>
 <ident cce="14440-2"/>
-<oval id="package_rhn_gpgkey_installed" />
+<oval id="package_red_hat_gpgkeys_installed" />
 <ref nist="SI-2, SI-7, SC-13"/>
 </Rule>
 
-- 
1.7.12



More information about the scap-security-guide mailing list