[PATCH 0/2] CCE sanity checking

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Apr 15 14:52:07 UTC 2013


Yes, great stuff.

However, a nit to pick:

commit 2e6bbc53d8e399d0f65915ea3be11eb64979eeca
Author: David Smith <dsmith at eclipse.ncsc.mil>
Date:   Fri Apr 12 13:33:45 2013 -0400

    added blank line at the top to avoid a false positive with verify-cce.py


This suggest the script should be changed instead.
We generally want to avoid alterations to the items in the references
folder.  Requiring a blank line for correct behavior is not expected
behavior for future maintainers, too.


No hurry, but it would also be desirable to provide the files (the
available CCE block and the XCCDF to be scanned) as command-line
parameters.  This will make the script more reusable/flexible.

Indeed there are a few XSLT transforms which are guilty of hardcoded
paths, but that's only because providing parameterized input to xsltproc
is such a pain...




On 04/12/2013 01:37 PM, David Smith wrote:
> Added a script to the utils directory which 1) lists granted CCEs, 2)
> checks assigned CCEs against the list of granted CCEs for validity,
> 3) lists available CCEs, and 4) checks for any duplicate entries.
> 
> David Smith (2): added script to verify validity of CCE assignments 
> added blank line at the top to avoid a false positive with 
> verify-cce.py
> 
> RHEL6/references/cce-rhel6-avail.txt |    1 + 
> RHEL6/utils/verify-cce.py            |   47
> ++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+),
> 0 deletions(-) create mode 100755 RHEL6/utils/verify-cce.py
> 
> _______________________________________________ scap-security-guide
> mailing list scap-security-guide at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list