<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hello, Trey:<br>
<br>
Welcome.<br>
<br>
On 08/29/2013 12:13 PM, Trey Henefield wrote:<br>
</div>
<blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri","sans-serif";}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><o:p></o:p>
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p>Given that there are numerous
iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle,
ibm, openjdk) and different install paths
(/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I
am attempting to produce the appropriate criteria to account
for all types.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While typically one would only go with one
particular type of java, I would like to ensure that if more
than one type is installed, that I capture compliance for
everyone.</p>
</div>
</blockquote>
<br>
However, you mention <u>CPE OVAL</u> below, which would be used to
establish the existence of some sort of Java on the ToE.<br>
<br>
<blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, I am having trouble grasping the
concept of the criteria (AND, OR, ONE, XOR) and how best to
use each in the proper hierarchy to achieve my goal.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can’t seem to find any good information
that breaks down each of these and their intended outcome.</p>
</div>
</blockquote>
<br>
AFAIK, there isn't any.<br>
<br>
<blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now obviously if you have more than one
definition underneath AND, the requirement is that all equate
to true.</p>
</div>
</blockquote>
<br>
Yes, or false if no Java is present.<br>
<br>
<blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So to achieve my suggested goal, my
thoughts were the following for cpe-oval:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><AND><o:p></o:p></p>
<p class="MsoNormal"> Def.UNIX<o:p></o:p></p>
<p class="MsoNormal"> <OR><o:p></o:p></p>
<p class="MsoNormal"> Def.JRE-SUN<o:p></o:p></p>
<p class="MsoNormal"> <OR><o:p></o:p></p>
<p class="MsoNormal">
Def.JRE-ORACLE<o:p></o:p></p>
<p class="MsoNormal"> …<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">That seems to work, but the criteria for
the actual checks seem to get a little more grey.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My thoughts were:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><OR><o:p></o:p></p>
<p class="MsoNormal"> TST.JRE-SUN-INSTALLED<o:p></o:p></p>
<p class="MsoNormal"> <AND><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">TST.JRE-SUN-CHECK<o:p></o:p></p>
<p class="MsoNormal"> TST.JRE-ORACLE-INSTALLED<o:p></o:p></p>
<p class="MsoNormal"> <AND><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">TST.JRE-ORACLE-CHECK<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But that doesn’t seem to pan out the way I
expected it to.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any thoughts on how best to accomplish
this?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p><br>
</p>
</div>
</blockquote>
<br>
For CPE OVAL, the following is an example:<br>
<blockquote>
<pre><?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5">"http://oval.mitre.org/XMLSchema/oval-definitions-5"</a>
xmlns:ind=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">"http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"</a>
xmlns:unix=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"</a>
xmlns:linux=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:schemaLocation=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/oval-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#independenthttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/independent-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#unixhttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/unix-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#linuxhttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-definitions-schema.xsd">"
http://oval.mitre.org/XMLSchema/oval-definitions-5 http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/oval-definitions-schema.xsd
http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/independent-definitions-schema.xsd
http://oval.mitre.org/XMLSchema/oval-definitions-5#unix http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/unix-definitions-schema.xsd
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-definitions-schema.xsd
"</a>>
<generator>
<schema_version xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-common-5">"http://oval.mitre.org/XMLSchema/oval-common-5"</a>>5.10.1</schema_version>
<timestamp xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-common-5">"http://oval.mitre.org/XMLSchema/oval-common-5"</a>>2013-08-29T00:00:00Z</timestamp>
</generator>
<definitions>
<definition id="oval:com.example:def:1" version="1" class="inventory">
<metadata>
<title/>
<description/>
</metadata>
<criteria operator="OR">
<criterion test_ref="oval:com.example:tst:1" comment="Sun Java is installed"/>
<criterion test_ref="oval:com.example:tst:2" comment="Oracle Java is installed"/>
<criterion test_ref="oval:com.example:tst:3" comment="IBM Java is installed"/>
<criterion test_ref="oval:com.example:tst:3" comment="OpenJDK Java is installed"/>
</criteria>
</definition>
</definitions>
<tests>
<linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"
comment="Sun Java is installed">
<linux:object object_ref="oval:com.example:obj:1"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"
comment="Sun Java is installed">
<linux:object object_ref="oval:com.example:obj:2"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"
comment="Sun Java is installed">
<linux:object object_ref="oval:com.example:obj:3"/>
</linux:rpminfo_test>
<linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"
comment="Sun Java is installed">
<linux:object object_ref="oval:com.example:obj:4"/>
</linux:rpminfo_test>
</tests>
<objects>
<linux:rpminfo_object id="oval:com.example:obj:1" version="1">
<linux:name>sun-java</linux:name>
</linux:rpminfo_object>
<linux:rpminfo_object id="oval:com.example:obj:2" version="1">
<linux:name>oracle-java</linux:name>
</linux:rpminfo_object>
<linux:rpminfo_object id="oval:com.example:obj:3" version="1">
<linux:name>ibm-java</linux:name>
</linux:rpminfo_object>
<linux:rpminfo_object id="oval:com.example:obj:4" version="1">
<linux:name>openjdk-java</linux:name>
</linux:rpminfo_object>
</objects>
</oval_definitions>
</pre>
</blockquote>
This is a single OVAL definition which returns true if some Java is
present. It simply looks to see if certain RPMs are installed.<br>
<br>
NOTE: I faked the RPM names, and file test rather than RPM test
would be necessary to find Java artifacts for something installed
other than with an RPM. Not tested: YMMV.<br>
<br>
A benchmark using a <platform> element for "any sort of Java"
would be accompanied by a CPE definition document, which would in
turn reference the CPE OVAL document above. The above would have to
be split into one-definition-per-Java to correspond to individual
<platform> declarations.<br>
<br>
An OVAL compliance check would be more complicated but build on such
to, for each Java variant, establish existence and then perform
additional evaluations for proper security posture.<br>
<br>
The XCCDF using such could either refer to one complicated
multi-definition-multi-Java OVAL definition, or (using
<complex-check>) refer to individual per-Java definitions each
of which would have an accompany existence check. At either the
XCCDF level or below, the desired logic would be "for every Java
installed, it is compliant" which at a lower level becomes "for each
extant Java, evaluate all compliance checks".<br>
<br>
Composite checks are likely going to be something like "return ((not
installed) or (check1 and check2 and ... and check n)).<br>
<br>
There are multiple ways to approach this using both XCCDF and OVAL.
Feel free to pose questions and examples as encountered. This stuff
is not easy to digest.<br>
<br>
Regards,<br>
<br>
Gary<br>
<br>
<br>
</body>
</html>