[PATCH] Created OVAL for ensure_gpgcheck_never_disabled
Shawn Wells
shawn.d.wells at gmail.com
Fri May 24 23:13:49 UTC 2013
-------------- next part --------------
>From 5ed6dc228bde585ab95b52db161e8dbb3aa3da68 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 24 May 2013 18:49:45 -0400
Subject: [PATCH] Created OVAL for ensure_gpgcheck_never_disabled
XCCDF rule called nonexisting OVAL, created it.
Testing:
[shawn at rhel6 checks]$ grep -rin gpgcheck=0 /etc/yum.repos.d/epel-6-openscap.repo
8:gpgcheck=0
15:gpgcheck=0
[shawn at rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml
Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabledWx0NNA.xml
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
[shawn at rhel6 checks]$ sudo sh -c "sed -i -e 's/gpgcheck=0/gpgcheck=1/g' /etc/yum.repos.d/epel-6-openscap.repo"
[shawn at rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml
Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabled1vRO1h.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
---
.../checks/ensure_gpgcheck_never_disabled.xml | 30 ++++++++++++++++++++
1 files changed, 30 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
diff --git a/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
new file mode 100644
index 0000000..a155cb9
--- /dev/null
+++ b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
@@ -0,0 +1,30 @@
+<def-group>
+ <definition class="compliance"
+ id="ensure_gpgcheck_never_disabled" version="1">
+ <metadata>
+ <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>Ensure all yum repositories utilize signature checking.</description>
+ </metadata>
+ <criteria comment="ensure all yum repositories utilize signiature checking" operator="AND">
+ <criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files"
+ test_ref="test_ensure_gpgcheck_never_disabled" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all"
+ check_existence="none_exist"
+ comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files"
+ id="test_ensure_gpgcheck_never_disabled" version="1">
+ <ind:object object_ref="obj_ensure_gpgcheck_never_disabled" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_ensure_gpgcheck_never_disabled"
+ version="1">
+ <ind:path>/etc/yum.repos.d</ind:path>
+ <ind:filename operation="pattern match">.*</ind:filename>
+ <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.1
More information about the scap-security-guide
mailing list