<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">Hello, Trey:<br>
      <br>
      Welcome.<br>
      <br>
      On 08/29/2013 12:13 PM, Trey Henefield wrote:<br>
    </div>
    <blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator" content="Microsoft Word 14 (filtered
        medium)">
      <style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri","sans-serif";}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><o:p></o:p>
      <div class="WordSection1">
        <p class="MsoNormal"><o:p></o:p>Given that there are numerous
          iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle,
          ibm, openjdk) and different install paths
          (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I
          am attempting to produce the appropriate criteria to account
          for all types.<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">While typically one would only go with one
          particular type of java, I would like to ensure that if more
          than one type is installed, that I capture compliance for
          everyone.</p>
      </div>
    </blockquote>
    <br>
    However, you mention <u>CPE OVAL</u> below, which would be used to
    establish the existence of some sort of Java on the ToE.<br>
    <br>
    <blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">However, I am having trouble grasping the
          concept of the criteria (AND, OR, ONE, XOR) and how best to
          use each in the proper hierarchy to achieve my goal.<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">I can’t seem to find any good information
          that breaks down each of these and their intended outcome.</p>
      </div>
    </blockquote>
    <br>
    AFAIK, there isn't any.<br>
    <br>
    <blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">Now obviously if you have more than one
          definition underneath AND, the requirement is that all equate
          to true.</p>
      </div>
    </blockquote>
    <br>
    Yes, or false if no Java is present.<br>
    <br>
    <blockquote
cite="mid:2395AFDB339FB542AB62020E846F4A631CC5FD09C8@ATSEXCHANGE.ultra-ats.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">So to achieve my suggested goal, my
          thoughts were the following for cpe-oval:<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">&lt;AND&gt;<o:p></o:p></p>
        <p class="MsoNormal">               Def.UNIX<o:p></o:p></p>
        <p class="MsoNormal">               &lt;OR&gt;<o:p></o:p></p>
        <p class="MsoNormal">                              Def.JRE-SUN<o:p></o:p></p>
        <p class="MsoNormal">               &lt;OR&gt;<o:p></o:p></p>
        <p class="MsoNormal">                             
          Def.JRE-ORACLE<o:p></o:p></p>
        <p class="MsoNormal">               …<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">That seems to work, but the criteria for
          the actual checks seem to get a little more grey.<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">My thoughts were:<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">&lt;OR&gt;<o:p></o:p></p>
        <p class="MsoNormal">               TST.JRE-SUN-INSTALLED<o:p></o:p></p>
        <p class="MsoNormal">               &lt;AND&gt;<o:p></o:p></p>
        <p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">TST.JRE-SUN-CHECK<o:p></o:p></p>
        <p class="MsoNormal">               TST.JRE-ORACLE-INSTALLED<o:p></o:p></p>
        <p class="MsoNormal">               &lt;AND&gt;<o:p></o:p></p>
        <p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">TST.JRE-ORACLE-CHECK<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">But that doesn’t seem to pan out the way I
          expected it to.<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal">Any thoughts on how best to accomplish
          this?<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p><br>
        </p>
      </div>
    </blockquote>
    <br>
    For CPE OVAL, the following is an example:<br>
    <blockquote>
      <pre>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;oval_definitions xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5">"http://oval.mitre.org/XMLSchema/oval-definitions-5"</a>
    xmlns:ind=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">"http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"</a>
    xmlns:unix=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"</a>
    xmlns:linux=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"</a>
    xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
    xsi:schemaLocation=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/oval-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#independenthttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/independent-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#unixhttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/unix-definitions-schema.xsdhttp://oval.mitre.org/XMLSchema/oval-definitions-5#linuxhttp://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-definitions-schema.xsd">"
    http://oval.mitre.org/XMLSchema/oval-definitions-5             http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/oval-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/independent-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#unix        http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/unix-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#linux       http://oval.mitre.org/language/version5.10.1/ovaldefinition/complete/linux-definitions-schema.xsd
    "</a>&gt;
    &lt;generator&gt;
        &lt;schema_version xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-common-5">"http://oval.mitre.org/XMLSchema/oval-common-5"</a>&gt;5.10.1&lt;/schema_version&gt;
        &lt;timestamp xmlns=<a class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-common-5">"http://oval.mitre.org/XMLSchema/oval-common-5"</a>&gt;2013-08-29T00:00:00Z&lt;/timestamp&gt;
    &lt;/generator&gt;
    &lt;definitions&gt;
        &lt;definition id="oval:com.example:def:1" version="1" class="inventory"&gt;
            &lt;metadata&gt;
                &lt;title/&gt;
                &lt;description/&gt;
            &lt;/metadata&gt;
            &lt;criteria operator="OR"&gt;
                &lt;criterion test_ref="oval:com.example:tst:1" comment="Sun Java is installed"/&gt;
                &lt;criterion test_ref="oval:com.example:tst:2" comment="Oracle Java is installed"/&gt;
                &lt;criterion test_ref="oval:com.example:tst:3" comment="IBM Java is installed"/&gt;
                &lt;criterion test_ref="oval:com.example:tst:3" comment="OpenJDK Java is installed"/&gt;
            &lt;/criteria&gt;
        &lt;/definition&gt;
    &lt;/definitions&gt;
    &lt;tests&gt;
        &lt;linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed"&gt;
            &lt;linux:object object_ref="oval:com.example:obj:1"/&gt;
        &lt;/linux:rpminfo_test&gt;
        &lt;linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed"&gt;
            &lt;linux:object object_ref="oval:com.example:obj:2"/&gt;
        &lt;/linux:rpminfo_test&gt;
        &lt;linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed"&gt;
            &lt;linux:object object_ref="oval:com.example:obj:3"/&gt;
        &lt;/linux:rpminfo_test&gt;
        &lt;linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"
            comment="Sun Java is installed"&gt;
            &lt;linux:object object_ref="oval:com.example:obj:4"/&gt;
        &lt;/linux:rpminfo_test&gt;
    &lt;/tests&gt;
    &lt;objects&gt;
        &lt;linux:rpminfo_object id="oval:com.example:obj:1" version="1"&gt;
            &lt;linux:name&gt;sun-java&lt;/linux:name&gt;
        &lt;/linux:rpminfo_object&gt;
        &lt;linux:rpminfo_object id="oval:com.example:obj:2" version="1"&gt;
            &lt;linux:name&gt;oracle-java&lt;/linux:name&gt;
        &lt;/linux:rpminfo_object&gt;
        &lt;linux:rpminfo_object id="oval:com.example:obj:3" version="1"&gt;
            &lt;linux:name&gt;ibm-java&lt;/linux:name&gt;
        &lt;/linux:rpminfo_object&gt;
        &lt;linux:rpminfo_object id="oval:com.example:obj:4" version="1"&gt;
            &lt;linux:name&gt;openjdk-java&lt;/linux:name&gt;
        &lt;/linux:rpminfo_object&gt;
    &lt;/objects&gt;
&lt;/oval_definitions&gt;
</pre>
    </blockquote>
    This is a single OVAL definition which returns true if some Java is
    present. It simply looks to see if certain RPMs are installed.<br>
    <br>
    NOTE: I faked the RPM names, and file test rather than RPM test
    would be necessary to find Java artifacts for something installed
    other than with an RPM. Not tested: YMMV.<br>
    <br>
    A benchmark using a &lt;platform&gt; element for "any sort of Java"
    would be accompanied by a CPE definition document, which would in
    turn reference the CPE OVAL document above. The above would have to
    be split into one-definition-per-Java to correspond to individual
    &lt;platform&gt; declarations.<br>
    <br>
    An OVAL compliance check would be more complicated but build on such
    to, for each Java variant, establish existence and then perform
    additional evaluations for proper security posture.<br>
    <br>
    The XCCDF using such could either refer to one complicated
    multi-definition-multi-Java OVAL definition, or (using
    &lt;complex-check&gt;) refer to individual per-Java definitions each
    of which would have an accompany existence check. At either the
    XCCDF level or below, the desired logic would be "for every Java
    installed, it is compliant" which at a lower level becomes "for each
    extant Java, evaluate all compliance checks".<br>
    <br>
    Composite checks are likely going to be something like "return ((not
    installed) or (check1 and check2 and ... and check n)).<br>
    <br>
    There are multiple ways to approach this using both XCCDF and OVAL.
    Feel free to pose questions and examples as encountered. This stuff
    is not easy to digest.<br>
    <br>
    Regards,<br>
    <br>
    Gary<br>
    <br>
    <br>
  </body>
</html>