It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first.

From: "Jan Lieskovsky" <jlieskov(a)redhat.com&gt; To: scap-security-guide(a)lists.fedorahosted.org Sent: Thursday, October 3, 2013 7:54:17 PM Subject: [PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule Introduce rule that will be checking if underlying Fedora system is updated wrt to recently reported security flaws (success = all available security updates for installed packages are installed on the system). It uses SCE script to determine if there are security updates available, and requires former 'ensure yum fedora-updates.repo enabled' rule to pass first. Proposed patch passed all testing except: make validate rule in Fedora directory (utils/verify-references.py returned following traceback): Non-OVAL checking system found: http://open-scap.org/page/SCE Traceback (most recent call last): File "../utils/verify-references.py", line 184, in <module> main() File "../utils/verify-references.py", line 120, in main print "Invalid OVAL definition referenced by XCCDF Rule: " + rule.get("id") TypeError: cannot concatenate 'str' and 'NoneType' objects make: *** [validate] Error 1 but this error message is expected / safe, since 'security_patches_up_to_date' rule uses in the complex-check section also one SCE rule (reason where 'Non-OVAL checking system' warning comes from). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team