The truth tables appear to be correct with the checks as written. To illustrate, here is what appears in the results file when testcheck.py is run and the proper package IS installed (the result value gets passed to the top level and sets the result of the entire check to false):

<test test_id="oval:scap-security-guide.testing:tst:248" version="1" check_existence="any_exist" check="only one" result="true"> <tested_item item_id="1037109" result="false"/> <tested_item item_id="1037107" result="false"/> <tested_item item_id="1037105" result="false"/> <tested_item item_id="1037108" result="false"/> <tested_item item_id="1037102" result="false"/> <tested_item item_id="1037101" result="true"/> <tested_item item_id="1037106" result="false"/> <tested_item item_id="1037103" result="false"/> <tested_item item_id="1037104" result="false"/> </test>

And here is the result of the same testcheck.py script when the proper version of the package is not installed (the result value gets passed to the top level and sets the result of the entire check to false):

<test test_id="oval:scap-security-guide.testing:tst:248" version="1" check_existence="any_exist" check="only one" result="false"> <tested_item item_id="1037714" result="false"/> <tested_item item_id="1037716" result="false"/> <tested_item item_id="1037717" result="false"/> <tested_item item_id="1037715" result="false"/> <tested_item item_id="1037713" result="false"/> <tested_item item_id="1037718" result="false"/> <tested_item item_id="1037711" result="false"/> <tested_item item_id="1037712" result="false"/> </test>

- Maura Dailey

On 01/17/2014 02:25 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:

The OVAL check for the Red Hat release and auxiliary key packages is passing when the packages are not installed. The check_existence and check attributes on the associated rpminfo_test elements are set to "any_exist" and "only one", respectively. Shouldn't the check_existence attribute be "at_least_one_exists" for these tests instead?

Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)

---

scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide