[PATCH] Fix processor_type value for 32-bit systems

Shawn Wells shawn at redhat.com
Wed Jan 23 22:10:24 UTC 2013


On 1/22/13 3:58 PM, Kenneth Stailey wrote:
> 32-bit systems use i686 not x86 because OpenSCAP
> uses `uname -p` to populate processor_type.
>
> Signed-off-by: Kenneth Stailey<kstailey.lists at gmail.com>
> ---
>   RHEL6/input/checks/audit_rules_record_timechange.xml | 2 +-
>   RHEL6/input/checks/system_info_architecture_x86.xml  | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/checks/audit_rules_record_timechange.xml b/RHEL6/input/checks/audit_rules_record_timechange.xml
> index def4568..bc0a251 100644
> --- a/RHEL6/input/checks/audit_rules_record_timechange.xml
> +++ b/RHEL6/input/checks/audit_rules_record_timechange.xml
> @@ -27,7 +27,7 @@
>     <unix:uname_object comment="32 bit architecture" id="object_audit_rules_record_timechange_32_bit" version="1">
>     </unix:uname_object>
>     <unix:uname_state comment="32 bit architecture" id="state_audit_rules_record_timechange_32_bit" version="1">
> -    <unix:processor_type operation="equals">x86</unix:processor_type>
> +    <unix:processor_type operation="equals">i686</unix:processor_type>
>     </unix:uname_state>
>     <unix:uname_test check="all" comment="64 bit architecture" id="test_audit_rules_record_timechange_64_bit" version="1">
>       <unix:object object_ref="object_audit_rules_record_timechange_64_bit" />
> diff --git a/RHEL6/input/checks/system_info_architecture_x86.xml b/RHEL6/input/checks/system_info_architecture_x86.xml
> index 894e499..2486a2c 100644
> --- a/RHEL6/input/checks/system_info_architecture_x86.xml
> +++ b/RHEL6/input/checks/system_info_architecture_x86.xml
> @@ -25,6 +25,6 @@ only tests for patches per 5.10.1 Revision 1 -->
>     <unix:uname_object comment="32 bit architecture" id="object_system_info_architecture_x86" version="1">
>     </unix:uname_object>
>     <unix:uname_state comment="32 bit architecture" id="state_system_info_architecture_x86" version="1">
> -    <unix:processor_type operation="equals">x86</unix:processor_type>
> +    <unix:processor_type operation="equals">i686</unix:processor_type>
>     </unix:uname_state>
>   </def-group>
> -- 1.8.1.1

First... serious love for your OVAL patches!

My initial fear was that changing this could potentially break other 
SCAP checkers, such as the SCC.... however the OVAL standard itself for 
processor_type utilizes uname -p (so it's not just OpenSCAP behaving 
this way) [1].

Ack.

[1] 
http://oval.mitre.org/language/version5.10/ovaldefinition/documentation/unix-definitions-schema.html
Search for "processor_type"


More information about the scap-security-guide mailing list