[PATCH] Created OVAL for ensure_gpgcheck_never_disabled

Shawn Wells shawn.d.wells at gmail.com
Fri May 24 23:13:49 UTC 2013


-------------- next part --------------
>From 5ed6dc228bde585ab95b52db161e8dbb3aa3da68 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 24 May 2013 18:49:45 -0400
Subject: [PATCH] Created OVAL for ensure_gpgcheck_never_disabled
 XCCDF rule called nonexisting OVAL, created it.

Testing:
[shawn at rhel6 checks]$ grep -rin gpgcheck=0 /etc/yum.repos.d/epel-6-openscap.repo
8:gpgcheck=0
15:gpgcheck=0
[shawn at rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml
Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabledWx0NNA.xml
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
[shawn at rhel6 checks]$ sudo sh -c "sed -i -e 's/gpgcheck=0/gpgcheck=1/g' /etc/yum.repos.d/epel-6-openscap.repo"
[shawn at rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml
Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabled1vRO1h.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
---
 .../checks/ensure_gpgcheck_never_disabled.xml      |   30 ++++++++++++++++++++
 1 files changed, 30 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml

diff --git a/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
new file mode 100644
index 0000000..a155cb9
--- /dev/null
+++ b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance"
+  id="ensure_gpgcheck_never_disabled" version="1">
+    <metadata>
+      <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>Ensure all yum repositories utilize signature checking.</description>
+    </metadata>
+    <criteria comment="ensure all yum repositories utilize signiature checking" operator="AND">
+      <criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files"
+      test_ref="test_ensure_gpgcheck_never_disabled" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all"
+  check_existence="none_exist"
+  comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files"
+  id="test_ensure_gpgcheck_never_disabled" version="1">
+    <ind:object object_ref="obj_ensure_gpgcheck_never_disabled" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_ensure_gpgcheck_never_disabled"
+  version="1">
+    <ind:path>/etc/yum.repos.d</ind:path>
+    <ind:filename operation="pattern match">.*</ind:filename>
+    <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list