[PATCH] improved verify-references.py to not flag OVAL definitions which are extended by others as unused
Jeffrey Blank
scapafterhours at gmail.com
Thu Apr 25 04:01:34 UTC 2013
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/utils/verify-references.py | 10 +++++++++-
1 files changed, 9 insertions(+), 1 deletions(-)
diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
index 75a2ce9..928bd0f 100755
--- a/RHEL6/utils/verify-references.py
+++ b/RHEL6/utils/verify-references.py
@@ -103,6 +103,11 @@ def main():
ovaltree = ET.parse(ovalfile)
ovaldefs = ovaltree.findall(".//{%s}definition" % oval_ns)
ovaldef_ids = [ovaldef.get("id") for ovaldef in ovaldefs]
+
+ oval_extenddefs = ovaltree.findall(".//{%s}extend_definition" % oval_ns)
+ ovaldef_ids_extended = [oval_extenddef.get("definition_ref") for oval_extenddef in oval_extenddefs]
+ ovaldef_ids_extended = list(set(ovaldef_ids_extended))
+
check_content_refs = xccdftree.findall(".//{%s}check-content-ref" % xccdf_ns)
# now we can actually do the verification work here
@@ -160,6 +165,7 @@ def main():
if options.ovaldefs_unused or options.all_checks:
# create a list of all of the OVAL checks that are defined in the oval file
oval_checks_list = [ovaldef.get("id") for ovaldef in ovaldefs]
+ oval_defs_extended = []
# now loop through the xccdf rules; if a rule references an oval check we remove the oval check from our list
for check_content in check_content_refs:
# remove from the list
@@ -168,7 +174,9 @@ def main():
# the list should now contain the OVAL checks that are not referenced by any XCCDF rule
oval_checks_list.sort()
for oval_id in oval_checks_list:
- print "XCCDF does not reference OVAL Check: %s" % oval_id
+ # don't print out the OVAL defs that are extended by others, as they're not unused
+ if oval_id not in ovaldef_ids_extended:
+ print "XCCDF does not reference OVAL Check: %s" % oval_id
sys.exit(0)
--
1.7.1
More information about the scap-security-guide
mailing list