Unused/obsoleted checks should be deleted.  And there are plenty.  Unless we really anticipate writing prose for a check, delete it.

A lot of prose has been deleted because it is now obsolete (or has since been covered elsewhere more adequately).

Less is more.  Cost-benefit is totally out of whack for C&A as it is; let's not give well-intentioned people more rope to hang themselves with, and try sticking instead to the important stuff.

I'm shortly going to add an enhancement to verify-references to print out the SSG id instead of just the meaningless urn+number, when it tells about "OVAL Check is not referenced by XCCDF".



On Mon, May 13, 2013 at 8:05 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:
On 05/13/2013 07:42 PM, Jeffrey Blank wrote:
NACK.  This check is not references by the XCCDF.  The right course of action is instead to delete this check.

Please run "make validate" if you are looking for OVAL that should probably be deleted.


I won't push it out, then, but is the overall goal to write prose to cover existing unused checks or is it to remove checks that aren't referenced? There was at least one other check that wasn't referenced that seemed to be broken the last time I checked. I had assumed checks that weren't referenced were missing prose, not the other way around, since I'd assumed a lot of the prose came from older guidance.


On Mon, May 13, 2013 at 2:20 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:

Signed-off-by: Maura Dailey <maura@eclipse.ncsc.mil>
---
 RHEL6/input/checks/xwindows_remote_listening.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/checks/xwindows_remote_listening.xml b/RHEL6/input/checks/xwindows_remote_listening.xml
index 0d5e5c9..cb4ef3d 100644
--- a/RHEL6/input/checks/xwindows_remote_listening.xml
+++ b/RHEL6/input/checks/xwindows_remote_listening.xml
@@ -24,7 +24,7 @@
   version="1">
     <ind:path>/etc/X11/xinit</ind:path>
     <ind:filename>xserverrc</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*exec\sX\s:0\s\-nolisten\stcp\s\$@</ind:pattern>
+    <ind:pattern operation="pattern match">^\s*exec\s*[ /\\\.\w]*X\s*:0\s*\-nolisten\s*tcp\s*["]?\$@["]?$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
--
1.7.1

_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide