On Tue, Jan 8, 2019, at 9:08 AM, Watson Sato wrote:
On Tue, Jan 8, 2019 at 2:57 PM Trevor Vaughan
> Personally, I think that anything marked as %config should not be checked
> because they are allowed to vary anyway.
I'm leaning towards ignoring config files in OVAL check, and making it
explicit in rule description.
And add a note with command that would output list of config files that do
not match their rpm hash,
in case you would like to review altered config files manually.
I think it's fine to ignore hash for config files, but permissions and ownership
should still be verified, though that may be a separate rule.