[PATCH] Consolidate ntp and openssh package checks for Fedora, RHEL 6, and RHEL 7 into the shared directory, since they all share the same package name.

Jan Lieskovsky jlieskov at redhat.com
Mon Mar 31 15:10:30 UTC 2014


----- Original Message -----
> From: "Maura Dailey" <maura at eclipse.ncsc.mil>
> 
> This small patch takes care of the existing package checks in Fedora and
> shared. More patches will be forthcoming for shared package checks in RHEL 6
> and RHEL 7.
> 
> - Maura Dailey

Tested on all three products and works fine [*].

ACK for me, please push.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

[*] For RHEL/7 there doesn't seem to be service_ntpd_enabled.xml OVAL check
    yet (=> attempt to scan returns 'notchecked' as result). But the (proper work)
    on RHEL-7 can be verified by evaluating just package_ntp_installed.xml rule via
    oscap oval eval --id .. command (verified it returns correct results
    depending on the fact if ntp package is installed on the system or not).

> 
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
>  Fedora/input/checks/package_ntp_installed.xml      |   26 +-----------------
>  .../checks/package_openssh-server_removed.xml      |   26 +-----------------
>  RHEL/6/input/checks/package_ntp_installed.xml      |   27
>  +------------------
>  RHEL/7/input/checks/package_ntp_installed.xml      |    1 +
>  shared/oval/package_ntp_installed.xml              |   28
>  ++++++++++++++++++++
>  shared/oval/package_openssh-server_removed.xml     |    1 +
>  6 files changed, 33 insertions(+), 76 deletions(-)
>  mode change 100644 => 120000 Fedora/input/checks/package_ntp_installed.xml
>  mode change 100644 => 120000
>  Fedora/input/checks/package_openssh-server_removed.xml
>  mode change 100644 => 120000 RHEL/6/input/checks/package_ntp_installed.xml
>  create mode 120000 RHEL/7/input/checks/package_ntp_installed.xml
>  create mode 100644 shared/oval/package_ntp_installed.xml
> 
> diff --git a/Fedora/input/checks/package_ntp_installed.xml
> b/Fedora/input/checks/package_ntp_installed.xml
> deleted file mode 100644
> index 389f166..0000000
> --- a/Fedora/input/checks/package_ntp_installed.xml
> +++ /dev/null
> @@ -1,25 +0,0 @@
> -<def-group>
> - <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.
> -->
> -  <definition class="compliance" id="package_ntp_installed"
> -  version="1">
> -    <metadata>
> -      <title>Package ntp Installed</title>
> -      <affected family="unix">
> -        <platform>Fedora 19</platform>
> -      </affected>
> -      <description>The RPM package ntp should be installed.</description>
> -    </metadata>
> -    <criteria>
> -      <criterion comment="package ntp is installed"
> -      test_ref="test_package_ntp_installed" />
> -    </criteria>
> -  </definition>
> -  <linux:rpminfo_test check="all" check_existence="all_exist"
> -  id="test_package_ntp_installed" version="1"
> -  comment="package ntp is installed">
> -    <linux:object object_ref="obj_package_ntp_installed" />
> -  </linux:rpminfo_test>
> -  <linux:rpminfo_object id="obj_package_ntp_installed" version="1">
> -    <linux:name>ntp</linux:name>
> -  </linux:rpminfo_object>
> -</def-group>
> diff --git a/Fedora/input/checks/package_ntp_installed.xml
> b/Fedora/input/checks/package_ntp_installed.xml
> new file mode 120000
> index 0000000..7432e41
> --- /dev/null
> +++ b/Fedora/input/checks/package_ntp_installed.xml
> @@ -0,0 +1 @@
> +../../../shared/oval/package_ntp_installed.xml
> \ No newline at end of file
> diff --git a/Fedora/input/checks/package_openssh-server_removed.xml
> b/Fedora/input/checks/package_openssh-server_removed.xml
> deleted file mode 100644
> index 785681d..0000000
> --- a/Fedora/input/checks/package_openssh-server_removed.xml
> +++ /dev/null
> @@ -1,25 +0,0 @@
> -<def-group>
> - <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.
> -->
> -  <definition class="compliance" id="package_openssh-server_removed"
> -  version="1">
> -    <metadata>
> -      <title>Package openssh-server Removed</title>
> -      <affected family="unix">
> -        <platform>Fedora 19</platform>
> -      </affected>
> -      <description>The RPM package openssh-server should be
> removed.</description>
> -    </metadata>
> -    <criteria>
> -      <criterion comment="package openssh-server is removed"
> -      test_ref="test_package_openssh-server_removed" />
> -    </criteria>
> -  </definition>
> -  <linux:rpminfo_test check="all" check_existence="none_exist"
> -  id="test_package_openssh-server_removed" version="1"
> -  comment="package openssh-server is removed">
> -    <linux:object object_ref="obj_package_openssh-server_removed" />
> -  </linux:rpminfo_test>
> -  <linux:rpminfo_object id="obj_package_openssh-server_removed" version="1">
> -    <linux:name>openssh-server</linux:name>
> -  </linux:rpminfo_object>
> -</def-group>
> diff --git a/Fedora/input/checks/package_openssh-server_removed.xml
> b/Fedora/input/checks/package_openssh-server_removed.xml
> new file mode 120000
> index 0000000..f7e880d
> --- /dev/null
> +++ b/Fedora/input/checks/package_openssh-server_removed.xml
> @@ -0,0 +1 @@
> +../../../shared/oval/package_openssh-server_removed.xml
> \ No newline at end of file
> diff --git a/RHEL/6/input/checks/package_ntp_installed.xml
> b/RHEL/6/input/checks/package_ntp_installed.xml
> deleted file mode 100644
> index 2495849..0000000
> --- a/RHEL/6/input/checks/package_ntp_installed.xml
> +++ /dev/null
> @@ -1,26 +0,0 @@
> -<def-group>
> - <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.
> -->
> -  <definition class="compliance" id="package_ntp_installed"
> -  version="1">
> -    <metadata>
> -      <title>Package ntp Installed</title>
> -      <affected family="unix">
> -        <platform>Red Hat Enterprise Linux 6</platform>
> -      </affected>
> -      <description>The RPM package ntp should be installed.</description>
> -      <reference source="swells" ref_id="20130829"
> ref_url="test_attestation"/>
> -    </metadata>
> -    <criteria>
> -      <criterion comment="package ntp is installed"
> -      test_ref="test_package_ntp_installed" />
> -    </criteria>
> -  </definition>
> -  <linux:rpminfo_test check="all" check_existence="all_exist"
> -  id="test_package_ntp_installed" version="1"
> -  comment="package ntp is installed">
> -    <linux:object object_ref="obj_package_ntp_installed" />
> -  </linux:rpminfo_test>
> -  <linux:rpminfo_object id="obj_package_ntp_installed" version="1">
> -    <linux:name>ntp</linux:name>
> -  </linux:rpminfo_object>
> -</def-group>
> diff --git a/RHEL/6/input/checks/package_ntp_installed.xml
> b/RHEL/6/input/checks/package_ntp_installed.xml
> new file mode 120000
> index 0000000..e9413c8
> --- /dev/null
> +++ b/RHEL/6/input/checks/package_ntp_installed.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/package_ntp_installed.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/checks/package_ntp_installed.xml
> b/RHEL/7/input/checks/package_ntp_installed.xml
> new file mode 120000
> index 0000000..e9413c8
> --- /dev/null
> +++ b/RHEL/7/input/checks/package_ntp_installed.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/package_ntp_installed.xml
> \ No newline at end of file
> diff --git a/shared/oval/package_ntp_installed.xml
> b/shared/oval/package_ntp_installed.xml
> new file mode 100644
> index 0000000..ee8d0ac
> --- /dev/null
> +++ b/shared/oval/package_ntp_installed.xml
> @@ -0,0 +1,28 @@
> +<def-group>
> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.
> -->
> +  <definition class="compliance" id="package_ntp_installed"
> +  version="1">
> +    <metadata>
> +      <title>Package ntp Installed</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +        <platform>Red Hat Enterprise Linux 7</platform>
> +      </affected>
> +      <description>The RPM package ntp should be installed.</description>
> +      <reference source="swells" ref_id="20130829"
> ref_url="test_attestation"/>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="package ntp is installed"
> +      test_ref="test_package_ntp_installed" />
> +    </criteria>
> +  </definition>
> +  <linux:rpminfo_test check="all" check_existence="all_exist"
> +  id="test_package_ntp_installed" version="1"
> +  comment="package ntp is installed">
> +    <linux:object object_ref="obj_package_ntp_installed" />
> +  </linux:rpminfo_test>
> +  <linux:rpminfo_object id="obj_package_ntp_installed" version="1">
> +    <linux:name>ntp</linux:name>
> +  </linux:rpminfo_object>
> +</def-group>
> diff --git a/shared/oval/package_openssh-server_removed.xml
> b/shared/oval/package_openssh-server_removed.xml
> index 311463e..b72eb32 100644
> --- a/shared/oval/package_openssh-server_removed.xml
> +++ b/shared/oval/package_openssh-server_removed.xml
> @@ -5,6 +5,7 @@
>      <metadata>
>        <title>Package openssh-server Removed</title>
>        <affected family="unix">
> +        <platform>Fedora 19</platform>
>          <platform>Red Hat Enterprise Linux 6</platform>
>          <platform>Red Hat Enterprise Linux 7</platform>
>        </affected>
> --
> 1.7.1
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list