<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 9/13/13 1:32 AM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1598151360.12439121.1379053950283.JavaMail.root@redhat.com"
      type="cite">
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0002-Add-FEDORA-input-checks-subdir-content-Fedora-19-sys.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From e23ca121306946ebdda61228f1f8aafda43d13d0 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 12 Sep 2013 17:18:27 +0200
Subject: [PATCH 2/8] Add FEDORA input/checks subdir content - Fedora-19
 system detection and oval definitions for two gpgcheck
 related tests. Include Fedora CPE dictionary too.


Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 .../checks/ensure_gpgcheck_never_disabled.xml      | 29 +++++++++++++++
 FEDORA/input/checks/installed_OS_is_fedora19.xml   | 41 ++++++++++++++++++++++
 .../checks/platform/fedora-cpe-dictionary.xml      | 10 ++++++
 .../checks/yum_gpgcheck_global_activation.xml      | 25 +++++++++++++
 4 files changed, 105 insertions(+)
 create mode 100644 FEDORA/input/checks/ensure_gpgcheck_never_disabled.xml
 create mode 100644 FEDORA/input/checks/installed_OS_is_fedora19.xml
 create mode 100644 FEDORA/input/checks/platform/fedora-cpe-dictionary.xml
 create mode 100644 FEDORA/input/checks/yum_gpgcheck_global_activation.xml

diff --git a/FEDORA/input/checks/ensure_gpgcheck_never_disabled.xml b/FEDORA/input/checks/ensure_gpgcheck_never_disabled.xml
new file mode 100644
index 0000000..5b7601f
--- /dev/null
+++ b/FEDORA/input/checks/ensure_gpgcheck_never_disabled.xml
@@ -0,0 +1,29 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="ensure_gpgcheck_never_disabled"
+  version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Ensure gpgcheck Enabled For All Yum Package Repositories&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;Ensure all yum repositories utilize signature checking.&lt;/description&gt;
+      &lt;reference source="MED" ref_id="20130807" ref_url="test_attestation" /&gt;</pre>
      </div>
    </blockquote>
    <br>
    ^^ here's the OVAL test attestation that Dave spoke of<br>
    <br>
    <blockquote
      cite="mid:1598151360.12439121.1379053950283.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+    &lt;/metadata&gt;
+    &lt;criteria comment="ensure all yum repositories utilize signiature checking" operator="AND"&gt;
+      &lt;criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files"
+      test_ref="test_ensure_gpgcheck_never_disabled" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+  &lt;ind:textfilecontent54_test check="all" check_existence="none_exist"
+  comment="check for existence of gpgcheck=0 in <i class="moz-txt-slash"><span class="moz-txt-tag">/</span>etc/yum.repos.d<span class="moz-txt-tag">/</span></i> files"
+  id="test_ensure_gpgcheck_never_disabled" version="1"&gt;
+    &lt;ind:object object_ref="obj_ensure_gpgcheck_never_disabled" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+  &lt;ind:textfilecontent54_object id="obj_ensure_gpgcheck_never_disabled"
+  version="1"&gt;
+    &lt;ind:path&gt;/etc/yum.repos.d&lt;/ind:path&gt;
+    &lt;ind:filename operation="pattern match"&gt;.*&lt;/ind:filename&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^\s*gpgcheck\s*=\s*0\s*$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+&lt;/def-group&gt;
diff --git a/FEDORA/input/checks/installed_OS_is_fedora19.xml b/FEDORA/input/checks/installed_OS_is_fedora19.xml
new file mode 100644
index 0000000..7e2e7ac
--- /dev/null
+++ b/FEDORA/input/checks/installed_OS_is_fedora19.xml
@@ -0,0 +1,41 @@
+&lt;def-group&gt;
+  &lt;definition class="inventory"
+  id="installed_OS_is_fedora19" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Fedora release 19 (Schrödinger's Cat)&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;reference ref_id="cpe:/o:fedoraproject:fedora:19"
+      source="CPE" /&gt;
+      &lt;description&gt;The operating system installed on the system is
+      Fedora release 19 (Schrödinger's Cat)&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria&gt;
+      &lt;criterion comment="Installed operating system is part of the unix family"
+      test_ref="test_unix_family" /&gt;
+      &lt;criterion comment="Fedora release 19 is installed"
+      test_ref="test_fedora_release" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="test_unix_family" version="1"&gt;
+    &lt;ind:object object_ref="obj_unix_family" /&gt;
+    &lt;ind:state state_ref="state_unix_family" /&gt;
+  &lt;/ind:family_test&gt;
+  &lt;ind:family_state id="state_unix_family" version="1"&gt;
+    &lt;ind:family&gt;unix&lt;/ind:family&gt;
+  &lt;/ind:family_state&gt;
+  &lt;ind:family_object id="obj_unix_family" version="1" /&gt;
+
+  &lt;linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release is version 19" id="test_fedora_release" version="1"&gt;
+    &lt;linux:object object_ref="obj_fedora_release" /&gt;
+    &lt;linux:state state_ref="state_fedora_release" /&gt;
+  &lt;/linux:rpminfo_test&gt;
+  &lt;linux:rpminfo_state id="state_fedora_release" version="1"&gt;
+    &lt;linux:version operation="pattern match"&gt;^19$&lt;/linux:version&gt;
+  &lt;/linux:rpminfo_state&gt;
+  &lt;linux:rpminfo_object id="obj_fedora_release" version="1"&gt;
+    &lt;linux:name&gt;fedora-release&lt;/linux:name&gt;
+  &lt;/linux:rpminfo_object&gt;
+&lt;/def-group&gt;
diff --git a/FEDORA/input/checks/platform/fedora-cpe-dictionary.xml b/FEDORA/input/checks/platform/fedora-cpe-dictionary.xml
new file mode 100644
index 0000000..b457e21
--- /dev/null
+++ b/FEDORA/input/checks/platform/fedora-cpe-dictionary.xml
@@ -0,0 +1,10 @@
+&lt;?xml version="1.0" encoding="UTF-8"?&gt;
+&lt;cpe-list xmlns=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://cpe.mitre.org/dictionary/2.0">"http://cpe.mitre.org/dictionary/2.0"</a>
+          xmlns:xsi=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
+          xsi:schemaLocation=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://cpe.mitre.org/dictionary/2.0http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">"http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd"</a>&gt;
+      &lt;cpe-item name="cpe:/o:fedoraproject:fedora:19"&gt;
+            &lt;title xml:lang="en-us"&gt;Fedora release 19 (Schrödinger's Cat)&lt;/title&gt;
+            &lt;!-- the check references an OVAL file that contains an inventory definition --&gt;
+            &lt;check system=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5">"http://oval.mitre.org/XMLSchema/oval-definitions-5"</a> href="filename"&gt;installed_OS_is_fedora19&lt;/check&gt;
+      &lt;/cpe-item&gt;
+&lt;/cpe-list&gt;
diff --git a/FEDORA/input/checks/yum_gpgcheck_global_activation.xml b/FEDORA/input/checks/yum_gpgcheck_global_activation.xml
new file mode 100644
index 0000000..c2a73c6
--- /dev/null
+++ b/FEDORA/input/checks/yum_gpgcheck_global_activation.xml
@@ -0,0 +1,25 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="yum_gpgcheck_global_activation" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Ensure Yum gpgcheck Globally Activated&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The gpgcheck option should be used to ensure that checking
+      of an RPM package's signature always occurs prior to its
+      installation.&lt;/description&gt;
+      &lt;reference source="MED" ref_id="20130807" ref_url="test_attestation" /&gt;</pre>
      </div>
    </blockquote>
    <br>
    ^^ another test attestation<br>
    <br>
    granted, things *should* work, but the testcheck.py is easy enough
    to quickly validate.<br>
    <br>
    <br>
    <blockquote
      cite="mid:1598151360.12439121.1379053950283.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+    &lt;/metadata&gt;
+    &lt;criteria&gt;
+      &lt;criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="test_yum_gpgcheck_global_activation" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+  &lt;ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="test_yum_gpgcheck_global_activation" version="1"&gt;
+    &lt;ind:object object_ref="object_yum_gpgcheck_global_activation" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+  &lt;ind:textfilecontent54_object id="object_yum_gpgcheck_global_activation" comment="gpgcheck set in /etc/yum.conf" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/yum.conf&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^\s*gpgcheck\s*=\s*1\s*$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int" operation="equals"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+&lt;/def-group&gt;
<div class="moz-txt-sig">-- 
1.7.11.7

</div></pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>