Actually, scratch that last bit about an enhancement to verify-references.
It's just as easy (and provides more content) to look into
output/ssg-rhel6-oval.xml directly -- and this does include the SSG id
inside <metadata><reference> inside each <definition>.
On Mon, May 13, 2013 at 8:14 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil>wrote:
Unused/obsoleted checks should be deleted. And there are plenty.
Unless
we really anticipate writing prose for a check, delete it.
A lot of prose has been deleted because it is now obsolete (or has since
been covered elsewhere more adequately).
Less is more. Cost-benefit is totally out of whack for C&A as it is;
let's not give well-intentioned people more rope to hang themselves with,
and try sticking instead to the important stuff.
I'm shortly going to add an enhancement to verify-references to print out
the SSG id instead of just the meaningless urn+number, when it tells about
"OVAL Check is not referenced by XCCDF".
On Mon, May 13, 2013 at 8:05 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
> On 05/13/2013 07:42 PM, Jeffrey Blank wrote:
>
> NACK. This check is not references by the XCCDF. The right course of
> action is instead to delete this check.
>
> Please run "make validate" if you are looking for OVAL that should
> probably be deleted.
>
>
> I won't push it out, then, but is the overall goal to write prose to
> cover existing unused checks or is it to remove checks that aren't
> referenced? There was at least one other check that wasn't referenced that
> seemed to be broken the last time I checked. I had assumed checks that
> weren't referenced were missing prose, not the other way around, since I'd
> assumed a lot of the prose came from older guidance.
>
>
> On Mon, May 13, 2013 at 2:20 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
>
>>
>> Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
>> ---
>> RHEL6/input/checks/xwindows_remote_listening.xml | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/RHEL6/input/checks/xwindows_remote_listening.xml
>> b/RHEL6/input/checks/xwindows_remote_listening.xml
>> index 0d5e5c9..cb4ef3d 100644
>> --- a/RHEL6/input/checks/xwindows_remote_listening.xml
>> +++ b/RHEL6/input/checks/xwindows_remote_listening.xml
>> @@ -24,7 +24,7 @@
>> version="1">
>> <ind:path>/etc/X11/xinit</ind:path>
>> <ind:filename>xserverrc</ind:filename>
>> - <ind:pattern operation="pattern
>> match">^[\s]*exec\sX\s:0\s\-nolisten\stcp\s\$@</ind:pattern>
>> + <ind:pattern operation="pattern match">^\s*exec\s*[
>> /\\\.\w]*X\s*:0\s*\-nolisten\s*tcp\s*["]?\$@["]?$</ind:pattern>
>> <ind:instance datatype="int">1</ind:instance>
>> </ind:textfilecontent54_object>
>> </def-group>
>> --
>> 1.7.1
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>
>
> _______________________________________________
> scap-security-guide mailing
listscap-security-guide@lists.fedorahosted.orghttps://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>