[PATCH] improved verify-references.py to not flag OVAL definitions which are extended by others as unused

Jeffrey Blank scapafterhours at gmail.com
Thu Apr 25 04:21:21 UTC 2013


Um, nothing anymore.  It's a vestige of some earlier code, which involved
grabbing the extended definition info here (instead of above).  I just
amended my commit to remove this.


On Thu, Apr 25, 2013 at 12:06 AM, Shawn Wells <shawn at redhat.com> wrote:

> On 4/25/13 12:01 AM, Jeffrey Blank wrote:
>
>> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
>> ---
>>   RHEL6/utils/verify-references.**py |   10 +++++++++-
>>   1 files changed, 9 insertions(+), 1 deletions(-)
>>
>> diff --git a/RHEL6/utils/verify-**references.py b/RHEL6/utils/verify-**
>> references.py
>> index 75a2ce9..928bd0f 100755
>> --- a/RHEL6/utils/verify-**references.py
>> +++ b/RHEL6/utils/verify-**references.py
>> @@ -103,6 +103,11 @@ def main():
>>         ovaltree = ET.parse(ovalfile)
>>         ovaldefs = ovaltree.findall(".//{%s}**definition" % oval_ns)
>>         ovaldef_ids = [ovaldef.get("id") for ovaldef in ovaldefs]
>> +
>> +       oval_extenddefs = ovaltree.findall(".//{%s}**extend_definition"
>> % oval_ns)
>> +       ovaldef_ids_extended = [oval_extenddef.get("**definition_ref")
>> for oval_extenddef in oval_extenddefs]
>> +       ovaldef_ids_extended = list(set(ovaldef_ids_extended)**)
>> +
>>         check_content_refs = xccdftree.findall(".//{%s}**check-content-ref"
>> % xccdf_ns)
>>         # now we can actually do the verification work here
>> @@ -160,6 +165,7 @@ def main():
>>         if options.ovaldefs_unused or options.all_checks:
>>                 # create a list of all of the OVAL checks that are
>> defined in the oval file
>>                 oval_checks_list = [ovaldef.get("id") for ovaldef in
>> ovaldefs]
>> +               oval_defs_extended = []
>>
>
> Love where this is going, but what's the line above for?
>
>
>
>                  # now loop through the xccdf rules; if a rule references
>> an oval check we remove the oval check from our list
>>                 for check_content in check_content_refs:
>>                         # remove from the list
>> @@ -168,7 +174,9 @@ def main():
>>                 # the list should now contain the OVAL checks that are
>> not referenced by any XCCDF rule
>>                 oval_checks_list.sort()
>>                 for oval_id in oval_checks_list:
>> -                       print "XCCDF does not reference OVAL Check: %s" %
>> oval_id
>> +                       # don't print out the OVAL defs that are extended
>> by others, as they're not unused
>> +                       if oval_id not in ovaldef_ids_extended:
>> +                               print "XCCDF does not reference OVAL
>> Check: %s" % oval_id
>>         sys.exit(0)
>>
>
>
> --
> Shawn Wells
> Director, Innovation Programs
> (e) shawn at redhat.com
> (c) 443.534.0130
>
> ______________________________**_________________
> scap-security-guide mailing list
> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130425/36d0bd35/attachment-0001.html>


More information about the scap-security-guide mailing list