[PATCH] improved verify-references.py to not flag OVAL definitions which are extended by others as unused

Shawn Wells shawn at redhat.com
Thu Apr 25 04:06:06 UTC 2013


On 4/25/13 12:01 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   RHEL6/utils/verify-references.py |   10 +++++++++-
>   1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py
> index 75a2ce9..928bd0f 100755
> --- a/RHEL6/utils/verify-references.py
> +++ b/RHEL6/utils/verify-references.py
> @@ -103,6 +103,11 @@ def main():
>   	ovaltree = ET.parse(ovalfile)
>   	ovaldefs = ovaltree.findall(".//{%s}definition" % oval_ns)
>   	ovaldef_ids = [ovaldef.get("id") for ovaldef in ovaldefs]
> +
> +	oval_extenddefs = ovaltree.findall(".//{%s}extend_definition" % oval_ns)
> +	ovaldef_ids_extended = [oval_extenddef.get("definition_ref") for oval_extenddef in oval_extenddefs]
> +	ovaldef_ids_extended = list(set(ovaldef_ids_extended))
> +
>   	check_content_refs = xccdftree.findall(".//{%s}check-content-ref" % xccdf_ns)
>   
>   	# now we can actually do the verification work here
> @@ -160,6 +165,7 @@ def main():
>   	if options.ovaldefs_unused or options.all_checks:
>   		# create a list of all of the OVAL checks that are defined in the oval file
>   		oval_checks_list = [ovaldef.get("id") for ovaldef in ovaldefs]
> +		oval_defs_extended = []

Love where this is going, but what's the line above for?


>   		# now loop through the xccdf rules; if a rule references an oval check we remove the oval check from our list
>   		for check_content in check_content_refs:
>   			# remove from the list
> @@ -168,7 +174,9 @@ def main():
>   		# the list should now contain the OVAL checks that are not referenced by any XCCDF rule
>   		oval_checks_list.sort()
>   		for oval_id in oval_checks_list:
> -			print "XCCDF does not reference OVAL Check: %s" % oval_id
> +			# don't print out the OVAL defs that are extended by others, as they're not unused
> +			if oval_id not in ovaldef_ids_extended:
> +				print "XCCDF does not reference OVAL Check: %s" % oval_id
>   
>   	sys.exit(0)


-- 
Shawn Wells
Director, Innovation Programs
(e) shawn at redhat.com
(c) 443.534.0130



More information about the scap-security-guide mailing list