Re: [Open-scap] scap-workbench - tailoring file
by Shawn Wells
On 8/21/15 6:03 AM, Martin Preisler wrote:
> ----- Original Message -----
>> >From: "Steve Grubb"<sgrubb(a)redhat.com>
>> >To:open-scap-list@redhat.com
>> >Cc: "Bryan Kearney"<bkearney(a)redhat.com>, "Ohad Levy"<olevy(a)redhat.com>
>> >Sent: Thursday, August 20, 2015 6:47:22 PM
>> >Subject: Re: [Open-scap] scap-workbench - tailoring file
>> >
>> >On Thursday, August 20, 2015 06:02:27 PM Peter Vrabec wrote:
>>> > >Hi Martin,
>>> > >
>>> > >if I customize a security policy by scap-workbench what option of export
>>> > >are provided by the tool? I assume there could be two options:
>>> > >
>>> > >1. original content + separate tailoring file,
> This is the preferred option and is fully supported. The original content stays
> intact and user gets a tailoring file with just their changes. If the user runs
> `yum update` and new SSG is released, the fixes will propagate even to the
> tailored profile.
In customer meetings and at conferences, most people get excited about
this option.
The tailoring file has become very useful. Customers show their security
department "I only changed the following, codified things"... some even
go as far as md5 the tailoring file.
>>> > >2. tailoring file encapsulated in source data stream.
> This is not supported at the moment but would be easy to add. I'd like to
> discourage this in favor of 1) because this cuts the user off SSG updates.
>
>> > 3. New file(s) with changes merged?
> Same problem as 2), would be slightly more difficult to implement.
--
Shawn Wells
Director, Innovation Programs
Office of the Chief Technologist
NA Public Sector
shawn(a)redhat.com | 443.534.0130
8 years, 8 months