Definition Criteria ...

[Trey Henefield]

Greetings,

So I am still in the learning process and am currently creating my own SSG benchmark for Java.

Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.

While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.

However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal.

I can't seem to find any good information that breaks down each of these and their intended outcome.

Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true.

So to achieve my suggested goal, my thoughts were the following for cpe-oval:

<AND>
               Def.UNIX
               <OR>
                              Def.JRE-SUN
               <OR>
                              Def.JRE-ORACLE
               ...

That seems to work, but the criteria for the actual checks seem to get a little more grey.

My thoughts were:

<OR>
               TST.JRE-SUN-INSTALLED
               <AND>
TST.JRE-SUN-CHECK
               TST.JRE-ORACLE-INSTALLED
               <AND>
TST.JRE-ORACLE-CHECK

But that doesn't seem to pan out the way I expected it to.

Any thoughts on how best to accomplish this?

Thaks!

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-29 12:13:20 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

[Trey Henefield]

Thanks for the feedback!

I believe I have the cpe-oval good to go.

I have pulled down every 1.6 and 1.7 java package for rhel6, in addition to Oracle’s own packaged rpm and tested it out with one and a combination of, as well as none.

Seems to work as expected.

But I am still pulling hair out over the OVAL checks.

Here is what I currently have for one of the checks:

<criteria operator="OR">
      <criteria operator="AND" negate="false">
                                             <!-- Check Oracle's 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_oracle_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Oracle's JRE 1.6.0 is installed"
                                               test_ref="test_oracle_160_java" />
                                               <criterion comment="Oracle's JRE 1.7.0 is installed"
                                               test_ref="test_oracle_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's IBM 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_ibm_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Red Hat's IBM JRE 1.6.0 is installed"
                                               test_ref="test_rhel_ibm_160_java" />
                                               <criterion comment="Red Hat's IBM JRE 1.7.0 is installed"
                                               test_ref="test_rhel_ibm_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's OpenJDK 1.6.0 & 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_openjdk_java" />
                                <criteria operator="OR" negate="false">
                                               <criterion comment="Red Hat's OpenJDK JRE 1.6.0 is installed"
                                               test_ref="test_rhel_openjdk_160_java" />
                                               <criterion comment="Red Hat's OpenJDK JRE 1.7.0 is installed"
                                               test_ref="test_rhel_openjdk_170_java" />
                                </criteria>
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's Sun 1.6.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_sun_java" />
                                <criterion comment="Red Hat's Sun JRE 1.6.0 is installed"
                                test_ref="test_rhel_sun_160_java" />
                 </criteria>
      <criteria operator="AND" negate="false">
                                             <!-- Check Red Hat's Oracle 1.7.0 Java ... -->
                                <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                test_ref="test_untrusted_sources_rhel_oracle_java" />
                                <criterion comment="Red Hat's Oracle JRE 1.7.0 is installed"
                                test_ref="test_rhel_oracle_170_java" />
                 </criteria>
   </criteria>

However with the above checks, if one of the packages are installed and includes the deployment.properties file with the required data, the check passes. It passes even though another Java package is installed and does not have the required file and data.

I know its because of the preceeding OR statement. But if I switch to AND, then it will expect all java packages to be installed and configured accordingly.

There has to be a better way.

The SCAP Compliance Checker has been a great help in identifying how each test gets evaluated.

Tests:

true (One or more item-state comparisons may be true.)
        false (All item-state comparisons must be true.)
            false (One or more item-state comparisons may be true.)
                false (Oracle JRE 1.6.0 is installed)
                false (Oracle JRE 1.7.0 is installed)
            false (Check deployment.security.askgrantdialog.notinca)
        false (All item-state comparisons must be true.)
            false (One or more item-state comparisons may be true.)
                false (Red Hat's IBM JRE 1.6.0 is installed)
                false (Red Hat's IBM JRE 1.7.0 is installed)
            false (Check deployment.security.askgrantdialog.notinca)
        true (All item-state comparisons must be true.)
            true (One or more item-state comparisons may be true.)
                true (Red Hat's OpenJDK JRE 1.6.0 is installed)
                false (Red Hat's OpenJDK JRE 1.7.0 is installed)
            true (Check deployment.security.askgrantdialog.notinca)
        false (All item-state comparisons must be true.)
            false (Check deployment.security.askgrantdialog.notinca)
            false (Red Hat's Sun JRE 1.6.0 is installed)
        false (All item-state comparisons must be true.)
            false (Check deployment.security.askgrantdialog.notinca)
            true (Red Hat's Oracle JRE 1.7.0 is installed)

So far, there are only a couple issues I noticed in using SSG.

1)      I have no variables defined, so the output oval file creates a variables footer without the variables header. I just delete the footer.

2)      In order to get the content to be used in SCC, I had to remove the ocil-transition sections.

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

From: [e-mail] [mailto:[e-mail]] On Behalf Of Gary Gapinski
Sent: Thursday, August 29, 2013 1:14 PM
To: [e-mail]
Subject: Re: Definition Criteria ...

On 08/29/2013 02:05 PM, Gary Gapinski wrote:

Bungled a few comments…

For CPE OVAL, the following is an example:

[snip]

<tests>

<linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"

comment="Sun Java is installed">

<linux:object object_ref="oval:com.example:obj:1"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"

comment="Oracle Java is installed">

<linux:object object_ref="oval:com.example:obj:2"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"

comment="IBM Java is installed">

<linux:object object_ref="oval:com.example:obj:3"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"

comment="OpenJDK Java is installed">

<linux:object object_ref="oval:com.example:obj:4"/>

</linux:rpminfo_test>

</tests>

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-29 16:02:59 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

[Trey Henefield]

So I finally got it!

I had to include checks for the packages not being installed. So for each package to evaluate as true, I had to check that either the package is installed and the appropriate configuration setting is applied or the package is not installed.

Here is what I ended up with:

<criteria operator="AND">
      <criteria operator="OR" negate="false">
                                <criteria operator="AND" negate="false">
                                                            <!-- Check Oracle's 1.6.0 & 1.7.0 Java ... -->
                                               <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                               test_ref="test_untrusted_sources_oracle_java" />
                                               <criterion comment="Oracle's JRE is installed"
                                              test_ref="test_oracle_java" />
                                </criteria>
                                <criterion comment="Oracle's JRE is not installed"
                                test_ref="test_oracle_java_not" />
                 </criteria>
      <criteria operator="OR" negate="false">
                                <criteria operator="AND" negate="false">
                                                            <!-- Check Red Hat's IBM 1.6.0 & 1.7.0 Java ... -->
                                               <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                               test_ref="test_untrusted_sources_rhel_ibm_java" />
                                               <criteria operator="OR" negate="false">
                                                              <criterion comment="Red Hat's IBM JRE 1.6.0 is installed"
                                                              test_ref="test_rhel_ibm_160_java" />
                                                              <criterion comment="Red Hat's IBM JRE 1.7.0 is installed"
                                                              test_ref="test_rhel_ibm_170_java" />
                                               </criteria>
                                </criteria>
                                <criteria operator="AND" negate="false">
                                               <criterion comment="Red Hat's IBM JRE 1.6.0 is not installed"
                                               test_ref="test_rhel_ibm_160_java_not" />
                                               <criterion comment="Red Hat's IBM JRE 1.7.0 is not installed"
                                               test_ref="test_rhel_ibm_170_java_not" />
                                </criteria>
                 </criteria>
      <criteria operator="OR" negate="false">
                                <criteria operator="AND" negate="false">
                                                            <!-- Check Red Hat's OpenJDK 1.6.0 & 1.7.0 Java ... -->
                                               <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                               test_ref="test_untrusted_sources_rhel_openjdk_java" />
                                               <criteria operator="OR" negate="false">
                                                              <criterion comment="Red Hat's OpenJDK JRE 1.6.0 is installed"
                                                              test_ref="test_rhel_openjdk_160_java" />
                                                              <criterion comment="Red Hat's OpenJDK JRE 1.7.0 is installed"
                                                              test_ref="test_rhel_openjdk_170_java" />
                                               </criteria>
                                </criteria>
                                <criteria operator="AND" negate="false">
                                               <criterion comment="Red Hat's OpenJDK JRE 1.6.0 is not installed"
                                               test_ref="test_rhel_openjdk_160_java_not" />
                                               <criterion comment="Red Hat's OpenJDK JRE 1.7.0 is not installed"
                                               test_ref="test_rhel_openjdk_170_java_not" />
                                </criteria>
                 </criteria>
      <criteria operator="OR" negate="false">
                                <criteria operator="AND" negate="false">
                                                            <!-- Check Red Hat's Sun 1.6.0 Java ... -->
                                               <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                               test_ref="test_untrusted_sources_rhel_sun_java" />
                                               <criterion comment="Red Hat's Sun JRE 1.6.0 is installed"
                                               test_ref="test_rhel_sun_160_java" />
                                </criteria>
                                <criterion comment="Red Hat's Sun JRE 1.6.0 is not installed"
                                test_ref="test_rhel_sun_160_java_not" />
                 </criteria>
      <criteria operator="OR" negate="false">
                                <criteria operator="AND" negate="false">
                                                            <!-- Check Red Hat's Oracle 1.7.0 Java ... -->
                                               <criterion comment="Check deployment.security.askgrantdialog.notinca"
                                               test_ref="test_untrusted_sources_rhel_oracle_java" />
                                               <criterion comment="Red Hat's Oracle JRE 1.7.0 is installed"
                                               test_ref="test_rhel_oracle_170_java" />
                                </criteria>
                                <criterion comment="Red Hat's Oracle JRE 1.7.0 is not installed"
                                test_ref="test_rhel_oracle_170_java_not" />
                 </criteria>
   </criteria>

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

From: [e-mail] [mailto:[e-mail]] On Behalf Of Gary Gapinski
Sent: Thursday, August 29, 2013 1:14 PM
To: [e-mail]
Subject: Re: Definition Criteria ...

On 08/29/2013 02:05 PM, Gary Gapinski wrote:

Bungled a few comments…

For CPE OVAL, the following is an example:

[snip]

<tests>

<linux:rpminfo_test id="oval:com.example:tst:1" version="1" check="all" check_existence="at_least_one_exists"

comment="Sun Java is installed">

<linux:object object_ref="oval:com.example:obj:1"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:2" version="1" check="all" check_existence="at_least_one_exists"

comment="Oracle Java is installed">

<linux:object object_ref="oval:com.example:obj:2"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:3" version="1" check="all" check_existence="at_least_one_exists"

comment="IBM Java is installed">

<linux:object object_ref="oval:com.example:obj:3"/>

</linux:rpminfo_test>

<linux:rpminfo_test id="oval:com.example:tst:4" version="1" check="all" check_existence="at_least_one_exists"

comment="OpenJDK Java is installed">

<linux:object object_ref="oval:com.example:obj:4"/>

</linux:rpminfo_test>

</tests>

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-29 17:02:18 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

[Shawn Wells]

On 8/29/13 12:13 PM, Trey Henefield wrote:
> So I am still in the learning process and am currently creating my own 
> SSG benchmark for Java.
>
> Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, 
> java-1.7.0-oracle, ibm, openjdk) and different install paths 
> (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am 
> attempting to produce the appropriate criteria to account for all types.
>
> While typically one would only go with one particular type of java, I 
> would like to ensure that if more than one type is installed, that I 
> capture compliance for everyone.

Are you interested in committing your profile back to the SSG community? 
It seems content for Java would be most useful!

[Trey Henefield]

I would certainly love to. Unfortunately I have to get approval from my company first. I am working on that now.  As soon as that goes through, you can expect allot of commits from me. ;)

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

From: [e-mail] [mailto:[e-mail]] On Behalf Of Shawn Wells
Sent: Thursday, August 29, 2013 4:09 PM
To: [e-mail]
Subject: Re: Definition Criteria ...

On 8/29/13 12:13 PM, Trey Henefield wrote:
So I am still in the learning process and am currently creating my own SSG benchmark for Java.

Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.

While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.

Are you interested in committing your profile back to the SSG community? It seems content for Java would be most useful!

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-29 17:10:59 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.