On 02/19/2014 11:17 AM, Jeffrey Blank wrote:
I do not want a variety of government agencies
creating Frankenstein forks of scap-security-guide.
I am unsure whether this is worthy of a fork, but read on.
I want them to use
the profiling mechanisms of XCCDF to select what they need from a single
high-quality dictionary of compliance checks (for each product for which
such content exists). One of the unstated goals of the project is to
keep the variety of government compliance machines under some control by
providing a solution which meets >95% of use cases.
Our intent is to score a subset of all checklist items but have all
items evaluated on all systems. This requires all¹ <Rule>s to be selected.
A <Profile> cannot alter the role² attribute of a <Rule> (to unscored
rather than full).
We intend to do this using a modified benchmark containing a single
<Profile>, and applying arbitrary "profiles" to the evaluation results
at a subsequent time.
This is most easily done using a fork describing the necessary changes.
A fork may also ease the task of having a single checklist for RHEL6 and
RHEL7 comprised of parts common to both as well as parts peculiar to either.
Regards,
Gary
--
¹ Actually most, as we will not traipse through terabytes of local
storage looking for unowned files, e.g.
² Goes back a ways:
http://making-security-measurable.1364806.n2.nabble.com/role-unchecked-er....