[PATCH 0/4] removal of CCE information from OVAL templates

Gary Gapinski gapinski at nasa.gov
Tue Sep 4 18:02:03 UTC 2012


My natural antipathy for CCE, particularly within but not limited to
OVAL, results in an

ACK.

However, I expect such <ident>s will end up needing augmentation to
distinguish amongst "platforms".


On 09/04/2012 01:31 PM, Jeffrey Blank wrote:
> This is being done in favor of storing CCE identifiers only in the
> XCCDF Rules as idents (which made sense for a number of reasons).
>
> Yes, these templates/scripts feel so very much like an undergraduate (or
> possibly high-school) programming project.  But consider the superficiality of
> their operation as a benefit.
>
> If I were starting over, I might have instead created a small dictionary of
> macros in XSLT to take care of generating the significant
> non-information-bearing OVAL overhead instead.  This would allow for authors to
> create extremely simple XML files to express the necessary information, and
> also avoid the creation of any kind of parser.  Maybe for RHEL 7...
>
>
> Jeffrey Blank (4):
>   new helper scripts for making/verifying/installing templated files
>   removed CCE handling from scripts that create templated OVAL checks
>   removed CCE identifiers from template source-info files
>   removal of CCE info from templates for kernelmods, packages, perms,
>     services, sysctls
>
>  RHEL6/input/checks/templates/Makefile              |   30 ++++++
>  RHEL6/input/checks/templates/README                |   32 +++++-
>  .../templates/create_kernel_modules_disabled.py    |   15 ++--
>  .../checks/templates/create_package_installed.py   |   11 +--
>  .../checks/templates/create_package_removed.py     |   10 +--
>  .../checks/templates/create_permission_checks.py   |    9 +-
>  .../checks/templates/create_services_disabled.py   |    6 +-
>  .../checks/templates/create_services_enabled.py    |    6 +-
>  .../input/checks/templates/create_sysctl_checks.py |    5 +-
>  .../checks/templates/file_dir_permissions.csv      |    7 +-
>  RHEL6/input/checks/templates/find_untemplated.py   |   31 ++++++
>  .../checks/templates/kernel_modules_disabled.csv   |   24 ++--
>  .../input/checks/templates/packages_installed.csv  |   34 ++++---
>  RHEL6/input/checks/templates/packages_removed.csv  |  106 ++++++++++----------
>  RHEL6/input/checks/templates/services_disabled.csv |  103 ++++++++++----------
>  RHEL6/input/checks/templates/services_enabled.csv  |   24 ++--
>  RHEL6/input/checks/templates/sysctl_values.csv     |   36 +++----
>  .../templates/template_kernel_module_disabled      |    2 -
>  .../checks/templates/template_package_installed    |    1 -
>  .../checks/templates/template_package_removed      |    1 -
>  RHEL6/input/checks/templates/template_permissions  |    1 -
>  .../checks/templates/template_service_disabled     |    1 -
>  .../checks/templates/template_service_enabled      |    1 -
>  RHEL6/input/checks/templates/template_sysctl       |    1 -
>  24 files changed, 281 insertions(+), 216 deletions(-)
>  create mode 100644 RHEL6/input/checks/templates/Makefile
>  create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list