intermittent failure of oval check, how to debug?
Brian Millett
bmillett at gmail.com
Wed Jun 19 16:55:54 UTC 2013
On Wed, 19 Jun 2013 12:35:43 -0400
Maura Dailey <maura at eclipse.ncsc.mil> wrote:
> On 06/19/2013 12:29 PM, Brian Millett wrote:
> > Ok, how do I go about debugging this:
> >
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml OpenSCAP
> > Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> > [root at deckard scap]# ./testcheck.py
> > dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL
> > tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml Definition
> > oval:scap-security-guide.testing:def:100: false
> >
> >
> > The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is
> > failing, but sometimes it does not.
> >
> > When I run an evaluation with the stig-rhel policy, I get
> >
> > OpenSCAP Error: Unable to receive a message from probe
> > [oval_probe_ext.c:584] No definition with ID: oval:ssg:def:509 in result
> > model. [oval_agent.c:182]
> >
>
> Two quick checks:
> - What version of openscap are you running? Is your ONE machine
> running a different version?
> - Does the output file in /tmp get created, and if so, does it have
> any clues?
>
> - Maura Dailey
Thanks,
the tmp files do not show anything helpful
[root at deckard scap]# diff -wruN \
/tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml \
/tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml
The same, so ??
[root at deckard scap]#
oscap -V OSCAP util (oscap) 0.9.3 Copyright 2009-2012 Red Hat Inc., Durham,
North Carolina.
==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.10.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1
==== Paths ====
Schema files: /usr/share/openscap/schemas
Schematron files: /usr/share/openscap/xsl
Default CPE files: /usr/share/openscap/cpe
Probes: /usr/libexec/openscap
==== Inbuilt CPE names ====
Red Hat Enterprise Linux 5 - cpe:/o:redhat:enterprise_linux:5
Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Fedora 16 - cpe:/o:fedoraproject:fedora:16
Fedora 17 - cpe:/o:fedoraproject:fedora:17
Fedora 18 - cpe:/o:fedoraproject:fedora:18
==== Supported OVAL objects and associated OpenSCAP probes ====
system_info probe_system_info
family probe_family
filehash probe_filehash
environmentvariable probe_environmentvariable
textfilecontent54 probe_textfilecontent54
textfilecontent probe_textfilecontent
variable probe_variable
xmlfilecontent probe_xmlfilecontent
environmentvariable58 probe_environmentvariable58
filehash58 probe_filehash58
inetlisteningservers probe_inetlisteningservers
rpminfo probe_rpminfo
partition probe_partition
iflisteners probe_iflisteners
rpmverify probe_rpmverify
rpmverifyfile probe_rpmverifyfile
rpmverifypackage probe_rpmverifypackage
selinuxboolean probe_selinuxboolean
selinuxsecuritycontext probe_selinuxsecuritycontext
file probe_file
interface probe_interface
password probe_password
process probe_process
runlevel probe_runlevel
shadow probe_shadow
uname probe_uname
xinetd probe_xinetd
sysctl probe_sysctl
process58 probe_process58
fileextendedattribute probe_fileextendedattribute
gconf probe_gconf
routingtable probe_routingtable
--
Brian Millett
"They're a prideful people and the BLACKSTAR was their flagship."
'That's why it make a good target.'
-- [ Ivanova and Sheridan (re: the Minbari), "Points of Departure"]
More information about the scap-security-guide
mailing list