[PATCH 1/7] updates to the CCE verification script to be more informative

Jeffrey Blank blank at eclipse.ncsc.mil
Thu May 16 03:51:34 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/utils/verify-cce.py |   38 +++++++++++++++++++++-----------------
 1 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/RHEL6/utils/verify-cce.py b/RHEL6/utils/verify-cce.py
index d22fab5..b43e29b 100755
--- a/RHEL6/utils/verify-cce.py
+++ b/RHEL6/utils/verify-cce.py
@@ -19,29 +19,33 @@ granted_ids = []
 # print the list of assigned CCEs
 print "Assigned CCEs:"
 for item in cces_assigned:
-    print item.text
-    assigned_ids.append(item.text)
+	print item.text
+	assigned_ids.append(item.text)
 print "-------------"
 
+# check for duplicates in the assigned CCE list
+dup_assigned_ids = [item for item in cces_assigned if cces_assigned.count(item) > 1]
+for item in dup_assigned_ids:
+	print "Duplicate assignment of CCE: %s" % item
+
 # open the available CCE file
 with open('../references/cce-rhel6-avail.txt', 'r') as f:
-   for line in f:
-       granted_ids = [line.rstrip('\n') for line in f]
-#       print granted_ids
-
-# print CCEs that appear in content but are not valid
-   for item in assigned_ids:
-       if item not in granted_ids:
-           print "Invalid CCE: %s" % item
+	for line in f:
+		granted_ids = [line.rstrip('\n') for line in f]
 
 # print CCEs that are available (i.e. in granted but not assigned)
-   for item in granted_ids:
-       if item not in assigned_ids:
-           print "Available CCE: %s" % item
-
-# check for duplicates in the assigned CCE list                
-if len(set(assigned_ids)) != len(assigned_ids):
-	print "duplicate"
+	for item in granted_ids:
+		if item not in assigned_ids:
+			print "Available CCE: %s" % item
+
+for rule in tree.findall("//{%s}Rule" % xccdf_ns):
+#	print "rule is " + rule.get("id")
+	items = rule.findall("{%s}ident[@system='http://cce.mitre.org']" % xccdf_ns)
+	if len(items) > 1:
+		print "Rule with multiple CCEs assigned: %s" % rule.get("id")
+	for item in items:
+		if item.text not in granted_ids:
+			print "Invalid CCE: %s in %s" % (item.text, rule.get("id"))
 
 sys.exit()
 
-- 
1.7.1



More information about the scap-security-guide mailing list