Definition Criteria ...

Trey Henefield trey.henefield at ultra-ats.com
Thu Aug 29 20:02:56 UTC 2013


Thanks for the feedback!

I believe I have the cpe-oval good to go.

I have pulled down every 1.6 and 1.7 java package for rhel6, in addition to Oracle’s own packaged rpm and tested it out with one and a combination of, as well as none.

Seems to work as expected.

But I am still pulling hair out over the OVAL checks.

Here is what I currently have for one of the checks:


    <criteria operator="OR">
      <criteria operator="AND" negate="false">
                                             <!-- Check Oracle's 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_oracle_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Oracle's JRE 1.6.0 is installed"
                                               test_ref="test_oracle_160_java" />
                                               <criterion comment="Oracle's JRE 1.7.0 is installed"
                                               test_ref="test_oracle_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's IBM 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_ibm_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Red Hat's IBM JRE 1.6.0 is installed"
                                               test_ref="test_rhel_ibm_160_java" />
                                               <criterion comment="Red Hat's IBM JRE 1.7.0 is installed"
                                               test_ref="test_rhel_ibm_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's OpenJDK 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_openjdk_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Red Hat's OpenJDK JRE 1.6.0 is installed"
                                               test_ref="test_rhel_openjdk_160_java" />
                                               <criterion comment="Red Hat's OpenJDK JRE 1.7.0 is installed"
                                               test_ref="test_rhel_openjdk_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's Sun 1.6.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_sun_java" />
                                <criterion comment="Red Hat's Sun JRE 1.6.0 is installed"
                                test_ref="test_rhel_sun_160_java" />
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's Oracle 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_oracle_java" />
                                <criterion comment="Red Hat's Oracle JRE 1.7.0 is installed"
                                test_ref="test_rhel_oracle_170_java" />
                 </criteria>
   </criteria>


However with the above checks, if one of the packages are installed and includes the deployment.properties file with the required data, the check passes. It passes even though another Java package is installed and does not have the required file and data.

I know its because of the preceeding OR statement. But if I switch to AND, then it will expect all java packages to be installed and configured accordingly.

There has to be a better way.

The SCAP Compliance Checker has been a great help in identifying how each test gets evaluated.

Tests:

    true (One or more item-state comparisons may be true.)
        false (All item-state comparisons must be true.)
            false (One or more item-state comparisons may be true.)
                false (Oracle JRE 1.6.0 is installed)
                false (Oracle JRE 1.7.0 is installed)
            false (Check deployment.security.askgrantdialog.notinca)
        false (All item-state comparisons must be true.)
            false (One or more item-state comparisons may be true.)
                false (Red Hat's IBM JRE 1.6.0 is installed)
                false (Red Hat's IBM JRE 1.7.0 is installed)
            false (Check deployment.security.askgrantdialog.notinca)
        true (All item-state comparisons must be true.)
            true (One or more item-state comparisons may be true.)
                true (Red Hat's OpenJDK JRE 1.6.0 is installed)
                false (Red Hat's OpenJDK JRE 1.7.0 is installed)
            true (Check deployment.security.askgrantdialog.notinca)
        false (All item-state comparisons must be true.)
            false (Check deployment.security.askgrantdialog.notinca)
            false (Red Hat's Sun JRE 1.6.0 is installed)
        false (All item-state comparisons must be true.)
            false (Check deployment.security.askgrantdialog.notinca)
            true (Red Hat's Oracle JRE 1.7.0 is installed)

So far, there are only a couple issues I noticed in using SSG.


1)      I have no variables defined, so the output oval file creates a variables footer without the variables header. I just delete the footer.

2)      In order to get the content to be used in SCC, I had to remove the ocil-transition sections.

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com

From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Gary Gapinski
Sent: Thursday, August 29, 2013 1:14 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: Definition Criteria ...

On 08/29/2013 02:05 PM, Gary Gapinski wrote:

Bungled a few comments…


For CPE OVAL, the following is an example:

[snip]

    <tests>

        <linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"

            comment="Sun Java is installed">

            <linux:object object_ref="oval:com.example:obj:1"/>

        </linux:rpminfo_test>

        <linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"

            comment="Oracle Java is installed">

            <linux:object object_ref="oval:com.example:obj:2"/>

        </linux:rpminfo_test>

        <linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"

            comment="IBM Java is installed">

            <linux:object object_ref="oval:com.example:obj:3"/>

        </linux:rpminfo_test>

        <linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"

            comment="OpenJDK Java is installed">

            <linux:object object_ref="oval:com.example:obj:4"/>

        </linux:rpminfo_test>

    </tests>

Disclaimer
The information contained in this communication from trey.henefield at ultra-ats.com sent at 2013-08-29 16:02:59 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide at lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide at lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130829/165a4fd9/attachment-0001.html>


More information about the scap-security-guide mailing list