Rule ensure_redhat_gpgkey_installed

Maura Dailey maura at eclipse.ncsc.mil
Fri Apr 25 19:08:35 UTC 2014


The truth tables appear to be correct with the checks as written. To 
illustrate, here is what appears in the results file when testcheck.py 
is run and the proper package IS installed (the result value gets passed 
to the top level and sets the result of the entire check to false):

         <test test_id="oval:scap-security-guide.testing:tst:248" 
version="1" check_existence="any_exist" check="only one" result="true">
           <tested_item item_id="1037109" result="false"/>
           <tested_item item_id="1037107" result="false"/>
           <tested_item item_id="1037105" result="false"/>
           <tested_item item_id="1037108" result="false"/>
           <tested_item item_id="1037102" result="false"/>
           <tested_item item_id="1037101" result="true"/>
           <tested_item item_id="1037106" result="false"/>
           <tested_item item_id="1037103" result="false"/>
           <tested_item item_id="1037104" result="false"/>
         </test>

And here is the result of the same testcheck.py script when the proper 
version of the package is not installed (the result value gets passed to 
the top level and sets the result of the entire check to false):

         <test test_id="oval:scap-security-guide.testing:tst:248" 
version="1" check_existence="any_exist" check="only one" result="false">
           <tested_item item_id="1037714" result="false"/>
           <tested_item item_id="1037716" result="false"/>
           <tested_item item_id="1037717" result="false"/>
           <tested_item item_id="1037715" result="false"/>
           <tested_item item_id="1037713" result="false"/>
           <tested_item item_id="1037718" result="false"/>
           <tested_item item_id="1037711" result="false"/>
           <tested_item item_id="1037712" result="false"/>
         </test>

- Maura Dailey

On 01/17/2014 02:25 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
> The OVAL check for the Red Hat release and auxiliary key packages is passing when the packages are not installed.  The check_existence and check attributes on the associated rpminfo_test elements are set to "any_exist" and "only one", respectively.  Shouldn't the check_existence attribute be "at_least_one_exists" for these tests instead?
>
>
> Thanks,
> Leland
> --
> Leland Steinke, Security+
> DISA FSO Technical Support Contractor
> tapestry technologies, Inc
> 717-267-5797 (DSN 570)
> leland.j.steinke.ctr at mail.mil (gov't)
> lsteinke at tapestrytech.com (com'l)
>
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140425/19d67b58/attachment.html>


More information about the scap-security-guide mailing list