adding fixes -- a proposed patch

Shawn Wells shawn at redhat.com
Tue Apr 17 03:30:47 UTC 2012


On 4/13/12 2:20 PM, Jeffrey Blank wrote:
> Attached is a patch that demonstrates a method for adding fixes in a
> modular way.
>
> It should allow fixes from different "systems"  (bash, puppet, chef(?),
> well whatever) and even different sets of fixes from the same "system"
> (such as different sets of Puppet modules designed for different use
> cases) to be linked into XCCDF output easily, and also would keep
> remediation resources discrete from both each other and the main
> project.  It depends on linkage to Rules via id.
>
> Comments are solicited.

Assuming I understand correctly (and that's a big assumption!....) this 
would allow us to modify our existing content and include something like:


<Rule id="audit_config_immutable">
<title>Make the <tt>auditd</tt> Configuration Immutable</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt> in order
to make the configuration immutable:
<pre>-e 2</pre>
With this setting, a reboot will be required to change any
audit rules.
</description>
<rationale>Making the audit configuration immutable prevents the 
accidential as
well as malicious modification of the audit rules.</rationale>
<ident cce="14692-8" />
<oval id="audit_rules_immutable" />
<ref nist="AU-2" />/
*<fix group="audit_config_immutable">*/
</Rule>


Then within input/fixes/bash.xml I would add something like this?

<fix-group id="audit_config_immutable" system="urn:xccdf:fix:script:bash" xmlns="http://checklists.nist.gov/xccdf/1.1">
	<fix rule="audit_selinux_perms">do something in bash</fix>
	<fix rule="audit_append_e">do something else in bash</fix>
</fix-group>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120416/0ed9d8a6/attachment.html>


More information about the scap-security-guide mailing list