[PATCH] improved verify-references.py to not flag OVAL definitions which are extended by others as unused

Jeffrey Blank scapafterhours at gmail.com
Thu Apr 25 04:01:34 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/utils/verify-references.py |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
index 75a2ce9..928bd0f 100755
--- a/RHEL6/utils/verify-references.py
+++ b/RHEL6/utils/verify-references.py
@@ -103,6 +103,11 @@ def main():
 	ovaltree = ET.parse(ovalfile) 
 	ovaldefs = ovaltree.findall(".//{%s}definition" % oval_ns)
 	ovaldef_ids = [ovaldef.get("id") for ovaldef in ovaldefs] 
+
+	oval_extenddefs = ovaltree.findall(".//{%s}extend_definition" % oval_ns)
+	ovaldef_ids_extended = [oval_extenddef.get("definition_ref") for oval_extenddef in oval_extenddefs]
+	ovaldef_ids_extended = list(set(ovaldef_ids_extended))
+
 	check_content_refs = xccdftree.findall(".//{%s}check-content-ref" % xccdf_ns)
 
 	# now we can actually do the verification work here
@@ -160,6 +165,7 @@ def main():
 	if options.ovaldefs_unused or options.all_checks:
 		# create a list of all of the OVAL checks that are defined in the oval file
 		oval_checks_list = [ovaldef.get("id") for ovaldef in ovaldefs]
+		oval_defs_extended = []
 		# now loop through the xccdf rules; if a rule references an oval check we remove the oval check from our list
 		for check_content in check_content_refs:
 			# remove from the list
@@ -168,7 +174,9 @@ def main():
 		# the list should now contain the OVAL checks that are not referenced by any XCCDF rule
 		oval_checks_list.sort()
 		for oval_id in oval_checks_list:
-			print "XCCDF does not reference OVAL Check: %s" % oval_id
+			# don't print out the OVAL defs that are extended by others, as they're not unused
+			if oval_id not in ovaldef_ids_extended:
+				print "XCCDF does not reference OVAL Check: %s" % oval_id
 
 	sys.exit(0)
 
-- 
1.7.1



More information about the scap-security-guide mailing list