intermittent failure of oval check, how to debug?

Brian Millett bmillett at gmail.com
Wed Jun 19 16:55:54 UTC 2013


On Wed, 19 Jun 2013 12:35:43 -0400
Maura Dailey <maura at eclipse.ncsc.mil> wrote:

> On 06/19/2013 12:29 PM, Brian Millett wrote:
> > Ok, how do I go about debugging this:
> >
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml Definition
> > oval:scap-security-guide.testing:def:100: false
> >
> >
> > The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is
> > failing, but sometimes it does not.
> >
> > When I run an evaluation with the stig-rhel policy, I get
> >
> > OpenSCAP Error: Unable to receive a message from probe
> > [oval_probe_ext.c:584] No definition with ID: oval:ssg:def:509 in result
> > model. [oval_agent.c:182]
> >
> 
> Two quick checks:
>    - What version of openscap are you running? Is your ONE machine 
> running a different version?
>    - Does the output file in /tmp get created, and if so, does it have 
> any clues?
> 
> - Maura Dailey


Thanks,

the tmp files do not show anything helpful

[root at deckard scap]# diff -wruN \
/tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml \
/tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml 


The same, so ??

[root at deckard scap]#
oscap -V OSCAP util (oscap) 0.9.3 Copyright 2009-2012 Red Hat Inc., Durham,
North Carolina.

==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.10.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1

==== Paths ====
Schema files: /usr/share/openscap/schemas
Schematron files: /usr/share/openscap/xsl
Default CPE files: /usr/share/openscap/cpe
Probes: /usr/libexec/openscap

==== Inbuilt CPE names ====
Red Hat Enterprise Linux 5 - cpe:/o:redhat:enterprise_linux:5
Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Fedora 16 - cpe:/o:fedoraproject:fedora:16
Fedora 17 - cpe:/o:fedoraproject:fedora:17
Fedora 18 - cpe:/o:fedoraproject:fedora:18

==== Supported OVAL objects and associated OpenSCAP probes ====
system_info                  probe_system_info           
family                       probe_family                
filehash                     probe_filehash              
environmentvariable          probe_environmentvariable   
textfilecontent54            probe_textfilecontent54     
textfilecontent              probe_textfilecontent       
variable                     probe_variable              
xmlfilecontent               probe_xmlfilecontent        
environmentvariable58        probe_environmentvariable58 
filehash58                   probe_filehash58            
inetlisteningservers         probe_inetlisteningservers  
rpminfo                      probe_rpminfo               
partition                    probe_partition             
iflisteners                  probe_iflisteners           
rpmverify                    probe_rpmverify             
rpmverifyfile                probe_rpmverifyfile         
rpmverifypackage             probe_rpmverifypackage      
selinuxboolean               probe_selinuxboolean        
selinuxsecuritycontext       probe_selinuxsecuritycontext
file                         probe_file                  
interface                    probe_interface             
password                     probe_password              
process                      probe_process               
runlevel                     probe_runlevel              
shadow                       probe_shadow                
uname                        probe_uname                 
xinetd                       probe_xinetd                
sysctl                       probe_sysctl                
process58                    probe_process58             
fileextendedattribute        probe_fileextendedattribute 
gconf                        probe_gconf                 
routingtable                 probe_routingtable          


-- 
Brian Millett
"They're a prideful people and the BLACKSTAR was their flagship."
'That's why it make a good target.'
           -- [ Ivanova and Sheridan (re: the Minbari), "Points of Departure"]


More information about the scap-security-guide mailing list