New tested field for OVAL Checks

Maura Dailey maura at eclipse.ncsc.mil
Wed Jul 31 21:30:51 UTC 2013


Going forward, we're going to use <reference> tags inside of OVAL checks 
to track if they've been tested. An example is as follows:

|<reference ||source="MED" ref_id="20130731" ref_url="test_attestation" />|

Source should uniquely identify the tester (here, I used my initials); 
ref_id should be in the format YYYYMMDD. We'll probably be adding empty 
tags into all the checks to get everyone started. This is similar to the 
<tested> tag in XCCDF, which is converted into an XCCDF <reference> tag 
during our build process.

Here is an example of the <reference> tag in an existing check. Note 
that it comes just after the description tag, inside of <metadata>.

|<def-group>||
||  <definition class="compliance" id="file_permissions_etc_group" 
version="1">||
||    <metadata>||
||      <title>Verify permissions on 'group' file</title>||
||      <affected family="unix">||
||        <platform>Red Hat Enterprise Linux 6</platform>||
||      </affected>||
||      <description>File permissions for /etc/group should be set 
correctly.</description>||
||      <reference source="MED" ref_id="20130731" 
ref_url="test_attestation"/>||
||    </metadata>||
||    <criteria>||
||      <criterion test_ref="file_permissions_etc_group_test" />||
||    </criteria>||
||  </definition>||
||  <unix:file_test check="all" check_existence="all_exist" 
comment="Testing /etc/group permissions" 
id="file_permissions_etc_group_test" version="1">||
||    <unix:object object_ref="file_permissions_etc_group_object" />||
||    <unix:state state_ref="file_permissions_etc_group_state" />||
||  </unix:file_test>||
||  <unix:file_state id="file_permissions_etc_group_state" version="1">||
||    <unix:uread datatype="boolean">true</unix:uread>||
||    <unix:uwrite datatype="boolean">true</unix:uwrite>||
||    <unix:uexec datatype="boolean">false</unix:uexec>||
||    <unix:gread datatype="boolean">true</unix:gread>||
||    <unix:gwrite datatype="boolean">false</unix:gwrite>||
||    <unix:gexec datatype="boolean">false</unix:gexec>||
||    <unix:oread datatype="boolean">true</unix:oread>||
||    <unix:owrite datatype="boolean">false</unix:owrite>||
||    <unix:oexec datatype="boolean">false</unix:oexec>||
||  </unix:file_state>||
||  <unix:file_object comment="/etc/group" 
id="file_permissions_etc_group_object" version="1">||
||    <unix:path>/etc</unix:path>||
||    <unix:filename>group</unix:filename>||
||  </unix:file_object>||
||</def-group>|

- Maura Dailey

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130731/6504aeaa/attachment.html>


More information about the scap-security-guide mailing list