My natural antipathy for CCE, particularly within but not limited to
OVAL, results in an
ACK.
However, I expect such <ident>s will end up needing augmentation to
distinguish amongst "platforms".
On 09/04/2012 01:31 PM, Jeffrey Blank wrote:
This is being done in favor of storing CCE identifiers only in the
XCCDF Rules as idents (which made sense for a number of reasons).
Yes, these templates/scripts feel so very much like an undergraduate (or
possibly high-school) programming project. But consider the superficiality of
their operation as a benefit.
If I were starting over, I might have instead created a small dictionary of
macros in XSLT to take care of generating the significant
non-information-bearing OVAL overhead instead. This would allow for authors to
create extremely simple XML files to express the necessary information, and
also avoid the creation of any kind of parser. Maybe for RHEL 7...
Jeffrey Blank (4):
new helper scripts for making/verifying/installing templated files
removed CCE handling from scripts that create templated OVAL checks
removed CCE identifiers from template source-info files
removal of CCE info from templates for kernelmods, packages, perms,
services, sysctls
RHEL6/input/checks/templates/Makefile | 30 ++++++
RHEL6/input/checks/templates/README | 32 +++++-
.../templates/create_kernel_modules_disabled.py | 15 ++--
.../checks/templates/create_package_installed.py | 11 +--
.../checks/templates/create_package_removed.py | 10 +--
.../checks/templates/create_permission_checks.py | 9 +-
.../checks/templates/create_services_disabled.py | 6 +-
.../checks/templates/create_services_enabled.py | 6 +-
.../input/checks/templates/create_sysctl_checks.py | 5 +-
.../checks/templates/file_dir_permissions.csv | 7 +-
RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++
.../checks/templates/kernel_modules_disabled.csv | 24 ++--
.../input/checks/templates/packages_installed.csv | 34 ++++---
RHEL6/input/checks/templates/packages_removed.csv | 106 ++++++++++----------
RHEL6/input/checks/templates/services_disabled.csv | 103 ++++++++++----------
RHEL6/input/checks/templates/services_enabled.csv | 24 ++--
RHEL6/input/checks/templates/sysctl_values.csv | 36 +++----
.../templates/template_kernel_module_disabled | 2 -
.../checks/templates/template_package_installed | 1 -
.../checks/templates/template_package_removed | 1 -
RHEL6/input/checks/templates/template_permissions | 1 -
.../checks/templates/template_service_disabled | 1 -
.../checks/templates/template_service_enabled | 1 -
RHEL6/input/checks/templates/template_sysctl | 1 -
24 files changed, 281 insertions(+), 216 deletions(-)
create mode 100644 RHEL6/input/checks/templates/Makefile
create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide