ldap_client_tls_checkpeer question

Jeffrey Blank blank at eclipse.ncsc.mil
Mon May 21 21:22:59 UTC 2012


When conducting this kind of check, the application should be
installed/active (or the system should be configured to use the service)
-- and the test should pass if it's not.

We do not want to make changes to files to satisfy tests that would be,
in context, bogus.

As examples, see some check against services (such as
service_cupsd_disabled.xml) which pass if the package is not even
installed.  These make use of extend_definition to call another,
existing definition which checks to see if a package is installed first.
(In general, these other definitions exists because there a check exists
against the installation of this package, on its own).  (That said, I'd
prefer not to create a definition unless it's also usable on its own, or
has 2 referrers.)

In general, I'd just make use of "and"-ing criteria to pass checks if
the check is irrelevant in context.



On 05/20/2012 03:11 PM, Joe Nall wrote:
> There are a number of checks like ldap_client_tls_checkpeer that look
> for a string or value in a file that are not sensitive to whether the
> relevant application is installed. What is the preferred way to deal
> with this problem? I would prefer not to create unused config files
> just to make a bogus test happy.
> 
> Is there a good example in the code of how to test for installation
> then configuration?
> 
> I know I can profile my way around this, but down that path is
> failures to identify issues when a package is added to a system under
> management.
> 
> joe
> 
> _______________________________________________ scap-security-guide
> mailing list scap-security-guide at lists.fedorahosted.org 
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list