[PATCH 1/7] updates to the CCE verification script to be more informative
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu May 16 03:51:34 UTC 2013
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/utils/verify-cce.py | 38 +++++++++++++++++++++-----------------
1 files changed, 21 insertions(+), 17 deletions(-)
diff --git a/RHEL6/utils/verify-cce.py b/RHEL6/utils/verify-cce.py
index d22fab5..b43e29b 100755
--- a/RHEL6/utils/verify-cce.py
+++ b/RHEL6/utils/verify-cce.py
@@ -19,29 +19,33 @@ granted_ids = []
# print the list of assigned CCEs
print "Assigned CCEs:"
for item in cces_assigned:
- print item.text
- assigned_ids.append(item.text)
+ print item.text
+ assigned_ids.append(item.text)
print "-------------"
+# check for duplicates in the assigned CCE list
+dup_assigned_ids = [item for item in cces_assigned if cces_assigned.count(item) > 1]
+for item in dup_assigned_ids:
+ print "Duplicate assignment of CCE: %s" % item
+
# open the available CCE file
with open('../references/cce-rhel6-avail.txt', 'r') as f:
- for line in f:
- granted_ids = [line.rstrip('\n') for line in f]
-# print granted_ids
-
-# print CCEs that appear in content but are not valid
- for item in assigned_ids:
- if item not in granted_ids:
- print "Invalid CCE: %s" % item
+ for line in f:
+ granted_ids = [line.rstrip('\n') for line in f]
# print CCEs that are available (i.e. in granted but not assigned)
- for item in granted_ids:
- if item not in assigned_ids:
- print "Available CCE: %s" % item
-
-# check for duplicates in the assigned CCE list
-if len(set(assigned_ids)) != len(assigned_ids):
- print "duplicate"
+ for item in granted_ids:
+ if item not in assigned_ids:
+ print "Available CCE: %s" % item
+
+for rule in tree.findall("//{%s}Rule" % xccdf_ns):
+# print "rule is " + rule.get("id")
+ items = rule.findall("{%s}ident[@system='http://cce.mitre.org']" % xccdf_ns)
+ if len(items) > 1:
+ print "Rule with multiple CCEs assigned: %s" % rule.get("id")
+ for item in items:
+ if item.text not in granted_ids:
+ print "Invalid CCE: %s in %s" % (item.text, rule.get("id"))
sys.exit()
--
1.7.1
More information about the scap-security-guide
mailing list