On Èt, bøe 26, 2020 at 13:30, Shawn Wells <shawn@redhat.com> wrote:
On 3/26/20 1:18 PM, Gabe Alford wrote:
We think the rule is expected to check for all types of removable devices. Probably, they could be defined as the pretty common ones, like floppy disks, CDs, DVDs or USB sticks. But we need to clarify all the requirements before completing the fix.
What specific questions / concerns can be clarified?

We definitely need to strike the right balance between difficulty of the task and its worth.
Here are questions that I see in Jan's e-mail:
  1. What is a removable medium? The description of the rule is quite ambitious, if we aim for feasible implementation, we have to change it. Should we determine removable media by their mount points? Or by device names? Current status: We check only for the /dev/cdrom, so it is relatively easy to come with incremental improvements.
  2. How to make the rule tailorable? Should we use a blacklists, or rather a whitelists? Current status: The rule is formally tailorable, but the usefulness of tailoring is nearly zero.
  3. Remediations don't work. Although they can be fixed easily to work with /dev/cdrom, what about cases that are implied by the rule's description?
  4. Should we check the run-time status as well? Runtime checks are not implied by the rule description, and testing their correctness seems to be a quite expensive task to me.