On Thursday, September 06, 2012 10:25:48 PM Francisco Slavin wrote:
We are planning to continue using the <fix> tag with a custom
system
attribute string to indicate that the <fix> tag contains BASH remediation
content. We are currently considering JSON notation as the leading
candidate for writing the <fix> content because it is both easy to write
and easy to parse. The information we want to make sure we cover for
running a remediation script is:
One of the fundamental items that show up over and over is the kickstart
script for system installation. If you want to spin up a VM, kickstart can be
used. If you want to make a liveCD, kickstart again. If you want to install a
bare-metal system...you guessed it.
The open scap tool can take the XCCDF docs and turn it into a remediation
script. You then add boiler plate at the top for partitioning, language, time
zone, etc...and you have a kickstart file.
I'd really like to keep things so that moving between XCCDF and kickstart is
simple.
-Steve