Common OVAL code (like for asserting for uninstalled services)

Steve Grubb sgrubb at redhat.com
Mon Aug 5 12:35:28 UTC 2013


On Monday, August 05, 2013 01:23:47 PM Simon Lukasik wrote:
> > I do not believe such usage is precluded by XCCDF or OVAL. Nor
> > does a cursory scan of SCAP 1.1 (§3.2.5.2 appears to be 
> > the only applicable section) or SCAP 1.2 (§3.2.5).
> 
> There is couple of places where the multiple variable values are
> described. However, the exact use case use shared with us is part of
> requirement SCAP.T.2000.5 within NISTIR-7511. (The automated test suite
> for SCAP.T.2000.5 contains the very same example as yours).
> 
> I cannot speak for other scanners. And I don't know if it is supported
> by ovaldi. Nevertheless, I wanted to raise this functionality to your
> attention.

Ovaldi was never intended to be a 100% complete and functional implementation. 
If it were, then nobody would be wasting time and money making other scanners. 
Its intention is to demonstrate many of the concepts in the OVAL language so 
that people writing a scanner can compare their against it for the things it 
has implemented. So, anyone pinning their hopes on doing complex things in 
ovaldi is likely to be in a hard spot.


> Perhaps, there is indeed a risk of inter-operability loss assigned with
> usage of advanced concepts of SCAP. If so, then the standard needs to be
> more explicit next time.

It can always be better specified, but I don't think that helps in this 
situation. Everyone that needs reliable results must use a certified scanner. 
The purpose of certification is to make that scanners can do what's asked of 
them. If you do not use a certified scanner, then there is nothing to guarantee 
that the implementation is correct. This is why we are putting openscap 
through an evaluation...to be able to say it implements everything required in 
the standard to the extent that validation tests it.

-Steve



More information about the scap-security-guide mailing list