On 08/01/2013 06:44 PM, Truhn, Chad M CTR NSWCDD, CXA30 wrote:
And here is my take: There might be organization which will need to have a package (like acpid) installed (for some inevitable monthly use-case) but they would agree that it should not be run by deafult. Such organization could easily use tailoring feature to turn-off the `uninstall` check.
+1
I tried to come up with a way of saying this earlier, but couldn't figure out a good way. I do know that people do use these guides for some in-house policy creation stuff.
That being said - I don't know if I am convinced the good (rare cases like this) outweighs the harm (false positives and redundancy to the masses).
The false positives can be easily avoided: Add a criterion to the `disabled` definition. That will point out to the test of `uninstalled` test.
- Chad
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide