Common OVAL code (like for asserting for uninstalled services)

Simon Lukasik isimluk at fedoraproject.org
Thu Aug 1 16:37:47 UTC 2013


Hello,

Recently we have significantly improved handling of OVAL variables in
OpenSCAP.

I believe that SSG can leverage this improved handling to avoid
redundancies (or similar code snippets). And significantly reduce the
size of the OVAL definition file (and consequently the size of OVAL
results).

I understand that it might not be a top priority, so this is just a
heads-up.

Example: There are definitions asserting that a service X is not
installed. If you manage to refactor the service X to a variable you can
the use the very same definition/test/item/object for many services. The
evaluation results will be then distinguished by @variable_instance
attribute and by tested_variable sub-element.

So, where you can start reading? Firstly, we have a general write-up
regarding variable processing at


http://www.open-scap.org/page/Documentation#Notes_on_the_Concept_of_Multiple_OVAL_Values

Secondly, there are some tests in OpenSCAP repo which demonstrate the
usage of the variables:


https://git.fedorahosted.org/cgit/openscap.git/tree/tests/API/XCCDF/variable_instance

Best regards,

--
Simon Lukasik
Security Technologies


More information about the scap-security-guide mailing list