I am quite new to this. I am trying to figure out how things works and how to use compliance as code. I am interested in STIG compliance.
As recommended, I ran the script called "create_stig_overlay.py". It created a new stig_overly.xml file. The file is interesting as it provide the link between STIG rules and complianceascode rules. Is it correct?
I noticed the script create a one to one relation between rules in STIG and rules in compliance as code.
For instance the first STIG rule: "The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values. "
It mentions ownership and permission. The STIG profile in complianceascode has both rpm_verify_ownership and rpm_verify_permissions.
But the created overlay only map to one of those rule .... and not always the same to the stig rule above.
So my question: is this intended or is there an issue here? Or may be I missed something else?
If you have any comment to help me to progress, I will be gratefull.
*Release of Content version 0.1.52 is scheduled for September 18th*, so
I've created a stabilization branch for it.
Now is a good time to hunt for bugs and propose fixes for them. Starting
today, merged Pull Requests should be assigned to milestone v0.1.53.
Bug fixes should be proposed to master and labeled "bugfix", they will
be cherry-picked to the stabilization branch.
The next release 0.1.53 will happen on November 13th. Stabilization
phase will start on November 2nd.