[PATCH 1/3] [RHEL/6, RHEL/7, shared] Fix "Invalid OVAL definition referenced by XCCDF Rule: install_vsftpd" utils/verify-references.py issue

Jan Lieskovsky jlieskov at redhat.com
Fri May 23 10:11:13 UTC 2014


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Thursday, May 22, 2014 7:39:43 PM
> Subject: Re: [PATCH 1/3] [RHEL/6, RHEL/7, shared] Fix "Invalid OVAL definition	referenced by XCCDF Rule:
> install_vsftpd" utils/verify-references.py	issue
> 
> 
> On 5/22/14, 1:16 PM, Jan Lieskovsky wrote:
> 
> 
> 
> 
> 
> 0001-RHEL-6-RHEL-7-shared-Fix-Invalid-OVAL-definition-ref.patch
> From 28bf796f5adf6658adf55896bf40e1b93de67d43 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Thu, 22 May 2014 16:38:24
> +0200
> Subject: [PATCH 1/3] [RHEL/6, RHEL/7, shared] Fix "Invalid OVAL definition
>  referenced by XCCDF Rule: install_vsftpd" utils/verify-references.py issue
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  RHEL/6/input/checks/package_vsftpd_installed.xml   |  1 +
>  .../input/checks/templates/packages_installed.csv  |  1 +
>  RHEL/6/input/profiles/ftp.xml                      |  2 +-
>  RHEL/6/input/services/ftp.xml                      |  2 +-
>  RHEL/7/input/checks/package_vsftpd_installed.xml   |  1 +
>  RHEL/7/input/services/ftp.xml                      |  2 +-
>  shared/fixes/bash/package_vsftpd_installed.sh      |  1 +
>  shared/oval/package_vsftpd_installed.xml           | 27
>  ++++++++++++++++++++++
>  8 files changed, 34 insertions(+), 3 deletions(-)
>  create mode 120000 RHEL/6/input/checks/package_vsftpd_installed.xml
>  create mode 120000 RHEL/7/input/checks/package_vsftpd_installed.xml
>  create mode 100644 shared/fixes/bash/package_vsftpd_installed.sh
>  create mode 100644 shared/oval/package_vsftpd_installed.xml
> 
> diff --git a/RHEL/6/input/checks/package_vsftpd_installed.xml
> b/RHEL/6/input/checks/package_vsftpd_installed.xml
> new file mode 120000
> index 0000000..7957a23
> --- /dev/null
> +++ b/RHEL/6/input/checks/package_vsftpd_installed.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/package_vsftpd_installed.xml
> \ No newline at end of file
> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv
> b/RHEL/6/input/checks/templates/packages_installed.csv
> index ef6e737..dc0ae21 100644
> --- a/RHEL/6/input/checks/templates/packages_installed.csv
> +++ b/RHEL/6/input/checks/templates/packages_installed.csv
> @@ -13,3 +13,4 @@ postfix
>  psacct
>  rsyslog
>  screen
> +vsftpd
> diff --git a/RHEL/6/input/profiles/ftp.xml b/RHEL/6/input/profiles/ftp.xml
> index 5bbb931..bc1682a 100644
> --- a/RHEL/6/input/profiles/ftp.xml
> +++ b/RHEL/6/input/profiles/ftp.xml
> @@ -3,7 +3,7 @@
>  <!--<Profile id="ftp" extends="server" xmlns=
>  "http://checklists.nist.gov/xccdf/1.1" > -->
>  <title>ftp</title>
>  <description>This profile is for FTP servers.</description>
> -<select idref="install_vsftpd" selected="true"/>
> +<select idref="package_vsftpd_installed" selected="true"/>
>  <select idref="ftp_log_transactions" selected="true"/>
>  <select idref="ftp_present_banner" selected="true"/>
>  <select idref="ftp_restrict_to_anon" selected="true"/>
> diff --git a/RHEL/6/input/services/ftp.xml b/RHEL/6/input/services/ftp.xml
> index ef3ad28..993d6cd 100644
> --- a/RHEL/6/input/services/ftp.xml
> +++ b/RHEL/6/input/services/ftp.xml
> @@ -55,7 +55,7 @@ accidental activation.
>  <Group id="ftp_use_vsftpd">
>  <title>Use vsftpd to Provide FTP Service if Necessary</title>
>  
> -<Rule id="install_vsftpd">
> +<Rule id="package_vsftpd_installed">
> 
> This content is great. You've changed an XCCDF name without updating the
> XCCDF profiles, though ;)
> 
> Please submit a patch to update profiles/*

Thanks for the review, Shawn. FWICT the original "install_vsftpd" rule was used
in RHEL/6/input/profiles/ftp.xml profile only:

..  scap-security-guide]$ grep -rHn "\"install_vsftpd" * | more
    RHEL/6/input/profiles/ftp.xml:6:<select idref="install_vsftpd" selected="true"/>
    RHEL/6/input/services/ftp.xml:58:<Rule id="install_vsftpd">
    RHEL/7/input/services/ftp.xml:58:<Rule id="install_vsftpd">

and that ftp.xml profile got updated within the patch. There are couple of more occurrences
of 'uninstall_vsftpd' (which should be probably moved to package_vsftpd_removed), but I
didn't touch those, since didn't touch uninstall vsftpd rule (can be done next time).

Not sure what you mean by 'Please submit a patch to update profiles/*' above? Like
add reference to this rule into other profiles too (where it's not present yet)?
If so, can you list into which of them it should be added?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> 
> 
> 
> 
> 
> 
> 
> <title>Install vsftpd Package</title>
>  <description>If this machine must operate as an FTP server, install the
>  <tt>vsftpd</tt> package via the standard channels.
>  <pre># yum install vsftpd</pre>
> diff --git a/RHEL/7/input/checks/package_vsftpd_installed.xml
> b/RHEL/7/input/checks/package_vsftpd_installed.xml
> new file mode 120000
> index 0000000..7957a23
> --- /dev/null
> +++ b/RHEL/7/input/checks/package_vsftpd_installed.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/package_vsftpd_installed.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/services/ftp.xml b/RHEL/7/input/services/ftp.xml
> index e4f76d4..c62618c 100644
> --- a/RHEL/7/input/services/ftp.xml
> +++ b/RHEL/7/input/services/ftp.xml
> @@ -55,7 +55,7 @@ accidental activation.
>  <Group id="ftp_use_vsftpd">
>  <title>Use vsftpd to Provide FTP Service if Necessary</title>
>  
> -<Rule id="install_vsftpd">
> +<Rule id="package_vsftpd_installed">
>  <title>Install vsftpd Package</title>
>  <description>If this machine must operate as an FTP server, install the
>  <tt>vsftpd</tt> package via the standard channels.
>  <pre># yum install vsftpd</pre>
> diff --git a/shared/fixes/bash/package_vsftpd_installed.sh
> b/shared/fixes/bash/package_vsftpd_installed.sh
> new file mode 100644
> index 0000000..5d56d77
> --- /dev/null
> +++ b/shared/fixes/bash/package_vsftpd_installed.sh
> @@ -0,0 +1 @@
> +yum -y install vsftpd
> diff --git a/shared/oval/package_vsftpd_installed.xml
> b/shared/oval/package_vsftpd_installed.xml
> new file mode 100644
> index 0000000..84a0bbe
> --- /dev/null
> +++ b/shared/oval/package_vsftpd_installed.xml
> @@ -0,0 +1,27 @@
> +<def-group>
> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.
> -->
> +  <definition class="compliance" id="package_vsftpd_installed"
> +  version="1">
> +    <metadata>
> +      <title>Package vsftpd Installed</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +        <platform>Red Hat Enterprise Linux 7</platform>
> +      </affected>
> +      <description>The RPM package vsftpd should be installed.</description>
> +      <reference source="JL" ref_id="20140522" ref_url="test_attestation"/>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="package vsftpd is installed"
> +      test_ref="test_package_vsftpd_installed" />
> +    </criteria>
> +  </definition>
> +  <linux:rpminfo_test check="all" check_existence="all_exist"
> +  id="test_package_vsftpd_installed" version="1"
> +  comment="package vsftpd is installed">
> +    <linux:object object_ref="obj_package_vsftpd_installed" />
> +  </linux:rpminfo_test>
> +  <linux:rpminfo_object id="obj_package_vsftpd_installed" version="1">
> +    <linux:name>vsftpd</linux:name>
> +  </linux:rpminfo_object>
> +</def-group>
> --
> 1.8.3.1
> 
> 
> _______________________________________________
> scap-security-guide mailing list scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
> --
> Shawn Wells
> Director, Innovation Programs shawn at redhat.com | 443.534.0130
> @shawndwells
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list