On Čt, bře 26, 2020 at 13:30, Shawn Wells <shawn(a)redhat.com> wrote:
On 3/26/20 1:18 PM, Gabe Alford wrote:
>
> We think the rule is expected to check for all types of removable
> devices. Probably, they could be defined as the pretty common ones,
> like floppy disks, CDs, DVDs or USB sticks. But we need to clarify
> all
> the requirements before completing the fix.
What specific questions / concerns can be clarified?
We definitely need to strike the right balance between difficulty of
the task and its worth.
Here are questions that I see in Jan's e-mail:
What is a removable medium? The description of the rule is quite
ambitious, if we aim for feasible implementation, we have to change it.
Should we determine removable media by their mount points? Or by device
names?
Current status: We check only for the /dev/cdrom, so it is relatively
easy to come with incremental improvements.How to make the rule
tailorable?
Should we use a blacklists, or rather a whitelists?
Current status: The rule is formally tailorable, but the usefulness of
tailoring is nearly zero.Remediations don't work. Although they can be
fixed easily to work with /dev/cdrom, what about cases that are implied
by the rule's description?Should we check the run-time status as well?
Runtime checks are not implied by the rule description, and testing
their correctness seems to be a quite expensive task to me.