[PATCH 1/1] Update CCE-14440-2 "Ensure Red Hat GPG Key is Installed"
Kenneth Stailey
kstailey.lists at gmail.com
Wed Sep 12 16:30:28 UTC 2012
Confirm that RPM packages gpg-pubkey-fd431d51-4ae0493b and gpg-pubkey-2fa658e0-45700c69 are installed.
The Red Hat release key package is gpg-pubkey-fd431d51-4ae0493b.
The Red Hat auxiliary key package is gpg-pubkey-2fa658e0-45700c69.
Signed-off-by: Kenneth Stailey <kstailey.lists at gmail.com>
---
.../checks/package_red_hat_gpgkeys_installed.xml | 45 ++++++++++++++++++++++
.../input/checks/package_rhn_gpgkey_installed.xml | 25 ------------
.../input/checks/templates/packages_installed.csv | 1 -
RHEL6/input/system/software/updating.xml | 2 +-
4 files changed, 46 insertions(+), 27 deletions(-)
create mode 100644 RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
delete mode 100644 RHEL6/input/checks/package_rhn_gpgkey_installed.xml
diff --git a/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml b/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
new file mode 100644
index 0000000..ccdeb89
--- /dev/null
+++ b/RHEL6/input/checks/package_red_hat_gpgkeys_installed.xml
@@ -0,0 +1,45 @@
+<def-group>
+ <definition class="compliance" id="package_red_hat_gpgkeys_installed"
+ version="1">
+ <metadata>
+ <title>Red Hat Release and Auxiliary gpg-pubkey Packages Installed</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The Red Hat release and auxiliary key packages are required to be installed.</description>
+ </metadata>
+ <criteria comment="packages gpg-pubkey-fd431d51-4ae0493b and gpg-pubkey-2fa658e0-45700c69 are installed"
+ operator="AND">
+ <criterion comment="package gpg-pubkey-fd431d51-4ae0493b is installed"
+ test_ref="test_package_gpgkey-fd431d51-4ae0493b_installed" />
+ <criterion comment="package gpg-pubkey-2fa658e0-45700c69 is installed"
+ test_ref="test_package_gpgkey-2fa658e0-45700c69_installed" />
+ </criteria>
+ </definition>
+ <linux:rpminfo_test check="only one" check_existence="any_exist"
+ id="test_package_gpgkey-fd431d51-4ae0493b_installed" version="1"
+ comment="Red Hat release key package is installed">
+ <linux:object object_ref="obj_package_gpg-pubkey" />
+ <linux:state state_ref="state_package_gpg-pubkey" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_object id="obj_package_gpg-pubkey" version="1">
+ <linux:name>gpg-pubkey</linux:name>
+ </linux:rpminfo_object>
+ <linux:rpminfo_state id="state_package_gpg-pubkey" version="1">
+ <linux:release>4ae0493b</linux:release>
+ <linux:version>fd431d51</linux:version>
+ </linux:rpminfo_state>
+ <linux:rpminfo_test check="only one" check_existence="any_exist"
+ id="test_package_gpgkey-2fa658e0-45700c69_installed" version="1"
+ comment="Red Hat auxiliary key package is installed">
+ <linux:object object_ref="obj_package_gpg-pubkey" />
+ <linux:state state_ref="state_package_gpg-pubkey" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_object id="obj_package_gpg-pubkey" version="1">
+ <linux:name>gpg-pubkey</linux:name>
+ </linux:rpminfo_object>
+ <linux:rpminfo_state id="state_package_gpg-pubkey" version="1">
+ <linux:release>2fa658e0</linux:release>
+ <linux:version>45700c69</linux:version>
+ </linux:rpminfo_state>
+</def-group>
diff --git a/RHEL6/input/checks/package_rhn_gpgkey_installed.xml b/RHEL6/input/checks/package_rhn_gpgkey_installed.xml
deleted file mode 100644
index 9628434..0000000
--- a/RHEL6/input/checks/package_rhn_gpgkey_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_rhn_gpgkey_installed"
- version="1">
- <metadata>
- <title>Package rhn_gpgkey Installed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package rhn_gpgkey should be installed.</description>
- </metadata>
- <criteria>
- <criterion comment="package rhn_gpgkey is installed"
- test_ref="test_package_rhn_gpgkey_installed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="all_exist"
- id="test_package_rhn_gpgkey_installed" version="1"
- comment="package rhn_gpgkey is installed">
- <linux:object object_ref="obj_package_rhn_gpgkey" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_rhn_gpgkey" version="1">
- <linux:name>rhn_gpgkey</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv
index 0028011..2a9fe8b 100644
--- a/RHEL6/input/checks/templates/packages_installed.csv
+++ b/RHEL6/input/checks/templates/packages_installed.csv
@@ -13,7 +13,6 @@ openswan
policycoreutils
postfix
psacct
-rhn_gpgkey
rsyslog
vlock
vsftpd
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 2670147..b43e21f 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -37,7 +37,7 @@ This key is necessary to cryptographically verify that packages
are from Red Hat.
</rationale>
<ident cce="14440-2"/>
-<oval id="package_rhn_gpgkey_installed" />
+<oval id="package_red_hat_gpgkeys_installed" />
<ref nist="SI-2, SI-7, SC-13"/>
</Rule>
--
1.7.12
More information about the scap-security-guide
mailing list