On Tue, Jan 8, 2019 at 2:57 PM Trevor Vaughan <tvaughan@onyxpoint.com> wrote:
Personally, I think that anything marked as %config should not be checked because they are allowed to vary anyway.

I'm leaning towards ignoring config files in OVAL check, and making it explicit in rule description.
And add a note with command that would output list of config files that do not match their rpm hash,
in case you would like to review altered config files manually.


On Tue, Jan 8, 2019 at 8:52 AM Watson Sato <wsato@redhat.com> wrote:
Hello,

Regarding rule "Verify file hashes with RPM", which files resides here:

From description in rule.yml I understand that altered files should be reported and, altered configuration files should be reported analyzed individually.
1. Is this the intended action? To evaluate altered configuration files?

Looking at the OVAL check, it mostly cares about altered files under /bin, /sbin ,/lib ,/lib64 or /usr (mainly executables and libraries according to comment).
2. Is this restriction only to optimize for search of libraries and binaries?
I see a slight misalignment between check and description. This way we won't be catching much changes in config files.

--
Watson Sato
Security Technologies | Red Hat, Inc
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org


--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788

-- This account not approved for unencrypted proprietary information --
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org


--
Watson Sato
Security Technologies | Red Hat, Inc