AFAIK, removable media is best identified via the UDEV subsystem and
queries should probably follow that path.
On Tue, Mar 31, 2020 at 5:41 AM Matěj Týč <matyc(a)redhat.com> wrote:
On Čt, bře 26, 2020 at 13:30, Shawn Wells <shawn(a)redhat.com> wrote:
On 3/26/20 1:18 PM, Gabe Alford wrote:
We think the rule is expected to check for all types of removable devices.
Probably, they could be defined as the pretty common ones, like floppy
disks, CDs, DVDs or USB sticks. But we need to clarify all the requirements
before completing the fix.
What specific questions / concerns can be clarified?
We definitely need to strike the right balance between difficulty of the
task and its worth.
Here are questions that I see in Jan's e-mail:
1. What is a removable medium? The description of the rule is quite
ambitious, if we aim for feasible implementation, we have to change it.
Should we determine removable media by their mount points? Or by device
names? Current status: We check only for the /dev/cdrom, so it is
relatively easy to come with incremental improvements.
2. How to make the rule tailorable? Should we use a blacklists, or
rather a whitelists? Current status: The rule is formally tailorable, but
the usefulness of tailoring is nearly zero.
3. Remediations don't work. Although they can be fixed easily to work
with /dev/cdrom, what about cases that are implied by the rule's
4. Should we check the run-time status as well? Runtime checks are not
implied by the rule description, and testing their correctness seems to be
a quite expensive task to me.
scap-security-guide mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --