On Thu, Nov 16, 2017 at 8:49 AM, Olivier BONHOMME <obonhomme@nerim.net> wrote:
On Wed, Nov 15, 2017 at 05:52:35PM +0100, Watson Yuuma Sato wrote:
> On 15/11/17 13:15, Olivier BONHOMME wrote:
> > Dear OpenScap community,
> >
> > I'm currently working for my company on checking the RHEL 7 SSG profile (0.1.36 version) coverage against STIG 1.3 release.
> >
> > While browsing the 0.1.36 release, I discovered the stig-overlays.xml which shows the matching between SSG rule and STIG rule.
> >
> > Can anybody confirm that I can use that file in order to check the coverage rate of the SSG profile ?
> Hello, Olivier.
>
> I'd say yes, as the stig_overlay maps Rules in STIG to Rules in SSG.
> Rules that don't map to any Rule in SSG will have ruleid="XXXX".
>
> Last time stig_overlay.xml was updated in upstream was around 8 months
> ago, so the version there probably isn't STIG 1.3. And unfortunately I
> couldn't find to witch version it corresponds.
>
> To generate an updated stig_overlays.xml file, please refer to our
> Developer Guide [1].
>
> [1]
> https://github.com/OpenSCAP/scap-security-guide/blob/master/docs/manual/developer_guide.adoc#stig-overlay-content

Hello Watson,

Thanks for that clear answer. I followed the documentation from the dev guide
and the result is that there is only two rules which are not matched against the
STIG v1.3. So congrats to the team for such a good job !

I also have a more "senstive" question. It's about the same task but with CentOS
profile but when I used the create-stig-overlay.py script, all the rules were
tagged XXXX.

After some investigations, I identified that when the derivative distribution
generation is enabled, the matching with STIG is removed which is bad for doing
a coverage check for the CentOS profile.

I fully understand the reason provided in the commit message when it has been
enabled but I would be curious if it would be possible to let the RHEL stigid
rules in a very unofficial way adding a CMake option ?

This is expected behaviour. A separate CentOS STIG has to be created and exist for a
stig_overlay.xml to be created and exist.CentOS does not meet STIG compliance
equirements nor do Red Hat certificationstransfer or follow down to the derivatives. The
CentOS project also echos this statement at
https://wiki.centos.org/FAQ/General#head-4b2dd1ea6dcc1243d6e3886dc3e5d1ebb252c194
For this reason, all RHEL identifiers have been stripped out of the derivative profiles.

You should not have to check coverage of the CentOS profile as the CentOS profile
is almost an exact copy of the RHEL profile just with some changes to work on CentOS.

Also, some RHEL checks/rules in the STIG are duplicates of others, or they are no longer valid for
the latest release. Any of duplicated/outdated checks/rules have been remove/updated (as much
as feasibly possible) for the latest release. So if there are missing RHEL identifiers, it is usually
because of duplication or new content that has yet to be added.