On Wed, Nov 15, 2017 at 05:52:35PM +0100, Watson Yuuma Sato wrote:
On 15/11/17 13:15, Olivier BONHOMME wrote:
> Dear OpenScap community,
>
> I'm currently working for my company on checking the RHEL 7 SSG profile (0.1.36
version) coverage against STIG 1.3 release.
>
> While browsing the 0.1.36 release, I discovered the stig-overlays.xml which shows
the matching between SSG rule and STIG rule.
>
> Can anybody confirm that I can use that file in order to check the coverage rate of
the SSG profile ?
Hello, Olivier.
I'd say yes, as the stig_overlay maps Rules in STIG to Rules in SSG.
Rules that don't map to any Rule in SSG will have ruleid="XXXX".
Last time stig_overlay.xml was updated in upstream was around 8 months
ago, so the version there probably isn't STIG 1.3. And unfortunately I
couldn't find to witch version it corresponds.
To generate an updated stig_overlays.xml file, please refer to our
Developer Guide [1].
[1]
https://github.com/OpenSCAP/scap-security-guide/blob/master/docs/manual/d...
Hello Watson,
Thanks for that clear answer. I followed the documentation from the dev guide
and the result is that there is only two rules which are not matched against the
STIG v1.3. So congrats to the team for such a good job !
I also have a more "senstive" question. It's about the same task but with
CentOS
profile but when I used the create-stig-overlay.py script, all the rules were
tagged XXXX.
After some investigations, I identified that when the derivative distribution
generation is enabled, the matching with STIG is removed which is bad for doing
a coverage check for the CentOS profile.
I fully understand the reason provided in the commit message when it has been
enabled but I would be curious if it would be possible to let the RHEL stigid
rules in a very unofficial way adding a CMake option ?
Regards,
Olivier Bonhomme