On Tue, Jan 8, 2019 at 7:08 AM Watson Sato wsato@redhat.com wrote:
On Tue, Jan 8, 2019 at 2:57 PM Trevor Vaughan tvaughan@onyxpoint.com wrote:
Personally, I think that anything marked as %config should not be checked because they are allowed to vary anyway.
I'm leaning towards ignoring config files in OVAL check, and making it explicit in rule description. And add a note with command that would output list of config files that do not match their rpm hash, in case you would like to review altered config files manually.
This isn't a great fix and is more of a bandaid. It would be better for us to open BZs and fix this in the troublesome RPMs spec files.
On Tue, Jan 8, 2019 at 8:52 AM Watson Sato wsato@redhat.com wrote:
Hello,
Regarding rule "Verify file hashes with RPM", which files resides here:
https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/syste...
From description in rule.yml I understand that altered files should be reported and, altered configuration files should be reported analyzed individually.
- Is this the intended action? To evaluate altered configuration files?
Looking at the OVAL check, it mostly cares about altered files under /bin, /sbin ,/lib ,/lib64 or /usr (mainly executables and libraries according to comment). 2. Is this restriction only to optimize for search of libraries and binaries? I see a slight misalignment between check and description. This way we won't be catching much changes in config files.
-- Watson Sato Security Technologies | Red Hat, Inc _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
-- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788
-- This account not approved for unencrypted proprietary information -- _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
-- Watson Sato Security Technologies | Red Hat, Inc _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...