[PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule

Jan Lieskovsky jlieskov at redhat.com
Thu Oct 10 15:41:39 UTC 2013


This is the actual proposal that should check
if Fedora system is updated wrt to currently avaiable
security fixes.

Any progress reviewing it?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team


----- Original Message -----
> From: "Jan Lieskovsky" <jlieskov at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Thursday, October 3, 2013 7:54:17 PM
> Subject: [PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule
> 
> 
> Introduce rule that will be checking if underlying
> Fedora system is updated wrt to recently reported
> security flaws (success = all available security
> updates for installed packages are installed on
> the system).
> 
> It uses SCE script to determine if there are security
> updates available, and requires former 'ensure
> yum fedora-updates.repo enabled' rule to pass first.
> 
> Proposed patch passed all testing except:
>   make validate
> 
> rule in Fedora directory (utils/verify-references.py
> returned following traceback):
> 
>   Non-OVAL checking system found: http://open-scap.org/page/SCE
>   Traceback (most recent call last):
>     File "../utils/verify-references.py", line 184, in <module>
>       main()
>     File "../utils/verify-references.py", line 120, in main
>       print "Invalid OVAL definition referenced by XCCDF Rule: " +
>       rule.get("id")
>   TypeError: cannot concatenate 'str' and 'NoneType' objects
>   make: *** [validate] Error 1
> 
> but this error message is expected / safe, since
> 'security_patches_up_to_date'
> rule uses in the complex-check section also one SCE rule (reason where
> 'Non-OVAL checking system' warning comes from).
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Fedora-Introduce-Ensure-Software-Security-Patches-In.patch
Type: text/x-patch
Size: 5834 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131010/fd589a04/attachment.bin>


More information about the scap-security-guide mailing list