[PATCH 01/21] Updated rpm_verify_hashes for OVAL 5.10 compliance

Shawn Wells shawn.d.wells at gmail.com
Mon May 13 03:11:04 UTC 2013


-------------- next part --------------
>From f5b90ce2aac2162636c158c6ee4441054476514f Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 12 May 2013 21:27:33 -0400
Subject: [PATCH 01/21] Updated rpm_verify_hashes for OVAL 5.10 compliance
 The old rpmverify_* is now depricated, updated check to rpmverifyfile_

Quick test:
[shawn at rhel6 checks]$ ./testcheck.py rpm_verify_hashes.xml
Evaluating with OVAL tempfile : /tmp/rpm_verify_hashescTfOUe.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
---
 RHEL6/input/checks/rpm_verify_hashes.xml |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/RHEL6/input/checks/rpm_verify_hashes.xml b/RHEL6/input/checks/rpm_verify_hashes.xml
index aad9459..78439cd 100644
--- a/RHEL6/input/checks/rpm_verify_hashes.xml
+++ b/RHEL6/input/checks/rpm_verify_hashes.xml
@@ -19,21 +19,21 @@
   <!-- configuration files, documentation files, etc. Using these discriminators in the state reduced -->
   <!-- the number of false positives, but it did not eliminate them. I left them commented out to serve -->
   <!-- as an example of what they look like. -->
-  <linux:rpmverify_test check_existence="none_exist" id="test_files_fail_md5_hash" version="1" check="all" comment="verify file md5 hashes">
+  <linux:rpmverifyfile_test check_existence="none_exist" id="test_files_fail_md5_hash" version="1" check="all" comment="verify file md5 hashes">
     <linux:object object_ref="object_files_fail_md5_hash"/>
-  </linux:rpmverify_test>
-  <linux:rpmverify_object id="object_files_fail_md5_hash" version="1" comment="rpm verify of all files">
-    <linux:behaviors nodeps="true" nofiles="false" nodigest="true" noscripts="true" nosignature="true" nomd5="false"/>
+  </linux:rpmverifyfile_test>
+  <linux:rpmverifyfile_object id="object_files_fail_md5_hash" version="1" comment="rpm verify of all files">
+    <linux:behaviors nomd5="false"/>
     <linux:name operation="pattern match">.*</linux:name>
     <linux:filepath operation="pattern match">^.*bin/.*$</linux:filepath>
     <filter action="include">state_files_fail_md5_hash</filter>
-  </linux:rpmverify_object>
-  <linux:rpmverify_state id="state_files_fail_md5_hash" version="1" operator="AND">
+  </linux:rpmverifyfile_object>
+  <linux:rpmverifyfile_state id="state_files_fail_md5_hash" version="1" operator="AND">
     <linux:md5_differs>fail</linux:md5_differs>
     <!-- <linux:configuration_file datatype="boolean">false</linux:configuration_file> -->
     <!-- <linux:documentation_file datatype="boolean">false</linux:documentation_file> -->
     <!-- <linux:ghost_file datatype="boolean">false</linux:ghost_file> -->
     <!-- <linux:license_file datatype="boolean">false</linux:license_file> -->
     <!-- <linux:readme_file datatype="boolean">false</linux:readme_file> -->
-  </linux:rpmverify_state>
+  </linux:rpmverifyfile_state>
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list