On 8/21/15 6:03 AM, Martin Preisler wrote:
----- Original Message -----
> >From: "Steve Grubb"<sgrubb(a)redhat.com>
> >To:open-scap-list@redhat.com
> >Cc: "Bryan Kearney"<bkearney(a)redhat.com>, "Ohad
Levy"<olevy(a)redhat.com>
> >Sent: Thursday, August 20, 2015 6:47:22 PM
> >Subject: Re: [Open-scap] scap-workbench - tailoring file
> >
> >On Thursday, August 20, 2015 06:02:27 PM Peter Vrabec wrote:
>> > >Hi Martin,
>> > >
>> > >if I customize a security policy by scap-workbench what option of
export
>> > >are provided by the tool? I assume there could be two options:
>> > >
>> > >1. original content + separate tailoring file,
This is the preferred option and is fully supported. The original content stays
intact and user gets a tailoring file with just their changes. If the user runs
`yum update` and new SSG is released, the fixes will propagate even to the
tailored profile.
In customer meetings and at conferences, most people get excited about
this option.
The tailoring file has become very useful. Customers show their security
department "I only changed the following, codified things"... some even
go as far as md5 the tailoring file.
>> > >2. tailoring file encapsulated in source data
stream.
This is not supported at the moment but would be easy to add. I'd like to
discourage this in favor of 1) because this cuts the user off SSG updates.
> > 3. New file(s) with changes merged?
Same problem as 2), would be slightly more difficult to implement.
--
Shawn Wells
Director, Innovation Programs
Office of the Chief Technologist
NA Public Sector
shawn(a)redhat.com | 443.534.0130