________________________________________
Date: Mon, 11 Jul 2016 13:06:35 -0600
From: Gabe Alford <redhatrises(a)gmail.com>
Subject: Re: investigating "notapplicable"
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
Hello Radzy,
> I'm trying to figure out how to go about investigating why
"notapplicable"
> is returned. Mostly, I'm working with a new directory for WR Linux.
Are you saying that all checks return "notapplicable" when you run a scan?
Or are you saying that you created a custom OVAL and the OVAL itself is
returning "notapplicable"?
Hi Gabe
When I tested the four commented-out rules on Fedora, there were
a mix of notapplicable, pass, and fail.
On WRLinux, all checks return "notapplicable". I wonder whether
this might have been caused by a change I didn't make in OpenSCAP
and should have. But I haven't been able to figure out where the
current CPE is determined. But I expect the "how do I" question
to be relevant when I get a mix of responses, too.
I did create a custom OVAL, but as far as I can tell, it was
never checked.
Enjoy!
-- radzy
> Thanks,
>
> Gabe
>
> On Mon, Jul 11, 2016 at 12:15 PM, <radzy(a)windriver.com> wrote:
>
> > Hi folks
> >
> > I'm trying to figure out how to go about investigating why
"notapplicable"
> > is returned. Mostly, I'm working with a new directory for WR Linux.
> >
> > However, I also see that for Fedora, there are four rules that are
> > commented out with a comment:
> >
> > The following rules currently returns 'notapplicable' on Fedora
> > container
> > Investigate why, fix the issues, and re-enable back once fixed
> >
> > The specific rules that are commented out are:
> >
> > accounts_password_all_shadowed
> > root_path_no_dot
> > mount_option_dev_shm_nodev
> > mount_option_dev_shm_nosuid
> >
> > When I tried to reproduce this, I find that accounts_password_all_shadowed
> > passes on a vanilla Fedora 23 installation. Maybe it's different on a
> > container-based install than on an install on a plain old laptop.
> >
> > root_path_no_dot appears to be malformed, with various pieces missing.
> >
> > The other two don't show up in my output results at all. Not sure why.
> > They do appear to be present in the DS file, and I haven't yet found any
> > reason to consider them malformed.
> >
> > But my general question is about the procedure to go about this
> > investigation. Is there a document that gives hints about the
> > best way to do this ? I've looked for one, but haven't found it.
> > What I've done so far is largely manual, and it has been somewhat
> > awkward getting the results. (Mostly, I've tried to investigate
> > WR Linux, but the Fedora issues seemed like a good thing to use
> > for more experience.)
> >
> > Any help would be appreciated.
> >
> > Enjoy!
> >
> > -- radzy
> > --
> > SCAP Security Guide mailing list
> > scap-security-guide(a)lists.fedorahosted.org
> >
> >
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
> >
https://github.com/OpenSCAP/scap-security-guide/