[PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule

Jan Lieskovsky jlieskov at redhat.com
Thu Oct 3 17:54:17 UTC 2013


Introduce rule that will be checking if underlying
Fedora system is updated wrt to recently reported
security flaws (success = all available security
updates for installed packages are installed on
the system).

It uses SCE script to determine if there are security
updates available, and requires former 'ensure
yum fedora-updates.repo enabled' rule to pass first.

Proposed patch passed all testing except:
  make validate

rule in Fedora directory (utils/verify-references.py
returned following traceback):

  Non-OVAL checking system found: http://open-scap.org/page/SCE
  Traceback (most recent call last):
    File "../utils/verify-references.py", line 184, in <module>
      main()
    File "../utils/verify-references.py", line 120, in main
      print "Invalid OVAL definition referenced by XCCDF Rule: " + rule.get("id")
  TypeError: cannot concatenate 'str' and 'NoneType' objects
  make: *** [validate] Error 1

but this error message is expected / safe, since 'security_patches_up_to_date'
rule uses in the complex-check section also one SCE rule (reason where
'Non-OVAL checking system' warning comes from).

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Fedora-Introduce-Ensure-Software-Security-Patches-In.patch
Type: text/x-patch
Size: 5834 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131003/8657e269/attachment.bin>


More information about the scap-security-guide mailing list