On 03/20/2012 03:40 PM, Michael Palmiotto wrote:
>> It looks like if we want to achieve the "prose guide,
with desktop and server profiles
>> and content" milestones, content needs to be added to a couple of places:
>>
>> 1) The prose and rationale need to be added to rhel6/src/input/services or
>> rhel6/src/input/system, depending upon what's being addressed.
> Yes, this meets the M1.1 objective to have a "human-readable prose
> guide, with level of completeness and quality similar to the NSA SNAC
> RHEL 5 guide" as well as the M1.3 objective to have rationale for all
> rules in the desktop and server profiles.
Just for clarification:
If a service Group has a Rule with system settings (ie Group: "Configure
Squid"
and Rule: "Configure iptables to Allow Access to the Proxy Server") should the
Group
be added to both rhel6/src/input/service and system?
Or would the Rule just be added to service? It seems like we'd want some way of
relating system settings prose back to the service that necessitates it.
I'd
only add the group and rule to the service. We definitely want to
avoid duplication of rules in different sections. Remember that the
files in the service and and system directories are all merged together
into a single xccdf via make at the end state. The breakdown into
various folders and files is really just a means to facilitate
collaboration.
-Kevin
--Mike
> -Kevin
>> --Mike