[PATCH] Fix check for Red Hat Enterprise Linux 6 installed.

Šimon Lukašík isimluk at fedoraproject.org
Tue Mar 18 12:23:01 UTC 2014


From: Simon Lukasik <slukasik at redhat.com>

The previous version of the check generated false positives.
It was even matching on even Fedora system.

Also this new check asserts for any variant of Red Hat Enterprise
Linux 6.
---
 RHEL/6/input/checks/installed_OS_is_rhel6.xml | 35 ++++++++++-----------------
 1 file changed, 13 insertions(+), 22 deletions(-)

diff --git a/RHEL/6/input/checks/installed_OS_is_rhel6.xml b/RHEL/6/input/checks/installed_OS_is_rhel6.xml
index 1ffeb53..7f77491 100644
--- a/RHEL/6/input/checks/installed_OS_is_rhel6.xml
+++ b/RHEL/6/input/checks/installed_OS_is_rhel6.xml
@@ -14,10 +14,8 @@
     <criteria>
       <criterion comment="Installed operating system is part of the unix family"
       test_ref="test_unix_family" />
-      <criterion comment="Red Hat Enterprise Linux 6 Workstation is installed"
-      test_ref="test_rhel_workstation" />
-      <criterion comment="Red Hat Enterprise Linux 6 Server is installed"
-      test_ref="test_rhel_server" />
+      <criterion comment="Red Hat Enterprise Linux 6 is installed"
+      test_ref="test_rhel_6" />
     </criteria>
   </definition>
 
@@ -30,25 +28,18 @@
   </ind:family_state>
   <ind:family_object id="obj_unix_family" version="1" />
 
-  <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-workstation is version 6" id="test_rhel_workstation" version="1">
-    <linux:object object_ref="obj_rhel_workstation" />
-    <linux:state state_ref="state_rhel_workstation" />
+  <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-* is version 6" id="test_rhel_6" version="1">
+    <linux:object object_ref="obj_rhel_release" />
+    <linux:state state_ref="state_rhel_6" />
   </linux:rpminfo_test>
-  <linux:rpminfo_state id="state_rhel_workstation" version="1">
-    <linux:version operation="pattern match">^6Workstation$</linux:version>
+  <linux:rpminfo_state id="state_rhel_6" version="1">
+    <linux:name operation="pattern match">^redhat-release</linux:name>
+    <linux:version operation="pattern match">^6[^\d]</linux:version>
   </linux:rpminfo_state>
-  <linux:rpminfo_object id="obj_rhel_workstation" version="1">
-    <linux:name>redhat-release-workstation</linux:name>
-  </linux:rpminfo_object>
+  <linux:rpmverifyfile_object id="obj_rhel_release" version="1">
+    <!-- Sadly, OVAL cannot do the right query (that is: rpm -q -whatprovides system-release).
+         Let's check the filename instead. -->
+    <linux:filepath>/etc/redhat-release</linux:filepath>
+  </linux:rpmverifyfile_object>
 
-  <linux:rpminfo_test check="all" check_existence="any_exist" comment="redhat-release-server is version 6" id="test_rhel_server" version="1">
-    <linux:object object_ref="obj_rhel_server" />
-    <linux:state state_ref="state_rhel_server" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_state id="state_rhel_server" version="1">
-    <linux:version operation="pattern match">^6Server$</linux:version>
-  </linux:rpminfo_state>
-  <linux:rpminfo_object id="obj_rhel_server" version="1">
-    <linux:name>redhat-release-server</linux:name>
-  </linux:rpminfo_object>
 </def-group>
-- 
1.8.5.3



More information about the scap-security-guide mailing list