On 12/13/12 9:49 PM, Shawn Wells wrote:

0002-Updated-verify-references.py-to-ignore-ocil-transiti.patch

From c69f76b1ed965dce8cab420202834f6193cc2713 Mon Sep 17 00:00:00 2001 From: Shawn Wellsshawn@redhat.com Date: Thu, 13 Dec 2012 21:02:15 -0500 Subject: [PATCH 02/28] Updated verify-references.py to ignore ocil-transitional The verify-references.py script was generating significant noice on our OCIL checks, however ocil-transitional is expected as it generates our "this is a finding if...." language.

Updated verify-references ignore ocil-transitional as an OVAL tag

Behavior before: $ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml Non-OVAL checking system found: ocil-transitional Non-OVAL checking system found: ocil-transitional Non-OVAL checking system found: ocil-transitional Non-OVAL checking system found: ocil-transitional Non-OVAL checking system found: ocil-transitional ..... XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_prelink XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: aide_build_database XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_nonroot_partitions

Behavior after: $ /var/www/html/scap-security-guide/RHEL6/utils/verify-references.py -p stig-rhel6-server --rules-with-disarefs-outside-profile ssg-rhel6-xccdf.xml XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: disable_prelink XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: aide_build_database XCCDF Rule found with DISA CCI reference outside Profile stig-rhel6-server: mountopt_nodev_on_nonroot_partitions

---

RHEL6/utils/verify-references.py | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/RHEL6/utils/verify-references.py b/RHEL6/utils/verify-references.py index d7f082d..ddaec7b 100755 --- a/RHEL6/utils/verify-references.py +++ b/RHEL6/utils/verify-references.py @@ -55,7 +55,8 @@ def get_ovalfiles(checks): if check.get("system") == oval_ns: checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns) ovalfiles.add(checkcontentref.get("href"))

• else:
  

• #else:
  

• elif check.get("system") != "ocil-transitional":
  print "Non-OVAL checking system found: " + check.get("system")
  

  return ovalfiles

I went ahead and pushed this