some questions about the checks / oval tests

Brian Millett bmillett at gmail.com
Fri Feb 8 19:12:37 UTC 2013


I'm trying to understand (as an example) the following results from an
evaluation on a rhel6.3 box using the stig-rhel6-server profile.  And I
apologize if these questions are answered in a FAQ somewhere.

1)
Ensure Log Files Are Owned By Appropriate Group 	unknown
Ensure System Log Files Have Correct Permissions 	unknown

2)
All GIDs referenced in /etc/passwd must be defined in /etc/group notchecked 
Ensure All Accounts on the System Have Unique Names              notchecked

I understand that the "notchecked" is because there is not an oval test
defined and the "unknown" is a specific "I don't know", as in the
rsyslog_files_groupownership.xml:

  <ind:unknown_test check="all"
  comment="use extended content to evaluated this test"
  id="test_20155" version="1" />

So I've been reading the oval language definitions and I cannot see how to
address the "unknown" tests which require parsing a file to get parts out of
it (rsyslog wants defined log paths).  

Q) How does one go about writing a test
that takes the result from evaluating a script?  What is the "extended
content"??

Q) Are the "notchecked" tests because the check is too vague? Or just not
written yet?

Any documents I should be reading?

Thanks.
-- 
Brian Millett
"Terrible to see places I grew up going up in flames."
   -- [ Sinclair, "A Voice in the Wilderness I"]


More information about the scap-security-guide mailing list