[PATCH 0/4] removal of CCE information from OVAL templates
Gary Gapinski
gapinski at nasa.gov
Tue Sep 4 18:02:03 UTC 2012
My natural antipathy for CCE, particularly within but not limited to
OVAL, results in an
ACK.
However, I expect such <ident>s will end up needing augmentation to
distinguish amongst "platforms".
On 09/04/2012 01:31 PM, Jeffrey Blank wrote:
> This is being done in favor of storing CCE identifiers only in the
> XCCDF Rules as idents (which made sense for a number of reasons).
>
> Yes, these templates/scripts feel so very much like an undergraduate (or
> possibly high-school) programming project. But consider the superficiality of
> their operation as a benefit.
>
> If I were starting over, I might have instead created a small dictionary of
> macros in XSLT to take care of generating the significant
> non-information-bearing OVAL overhead instead. This would allow for authors to
> create extremely simple XML files to express the necessary information, and
> also avoid the creation of any kind of parser. Maybe for RHEL 7...
>
>
> Jeffrey Blank (4):
> new helper scripts for making/verifying/installing templated files
> removed CCE handling from scripts that create templated OVAL checks
> removed CCE identifiers from template source-info files
> removal of CCE info from templates for kernelmods, packages, perms,
> services, sysctls
>
> RHEL6/input/checks/templates/Makefile | 30 ++++++
> RHEL6/input/checks/templates/README | 32 +++++-
> .../templates/create_kernel_modules_disabled.py | 15 ++--
> .../checks/templates/create_package_installed.py | 11 +--
> .../checks/templates/create_package_removed.py | 10 +--
> .../checks/templates/create_permission_checks.py | 9 +-
> .../checks/templates/create_services_disabled.py | 6 +-
> .../checks/templates/create_services_enabled.py | 6 +-
> .../input/checks/templates/create_sysctl_checks.py | 5 +-
> .../checks/templates/file_dir_permissions.csv | 7 +-
> RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++
> .../checks/templates/kernel_modules_disabled.csv | 24 ++--
> .../input/checks/templates/packages_installed.csv | 34 ++++---
> RHEL6/input/checks/templates/packages_removed.csv | 106 ++++++++++----------
> RHEL6/input/checks/templates/services_disabled.csv | 103 ++++++++++----------
> RHEL6/input/checks/templates/services_enabled.csv | 24 ++--
> RHEL6/input/checks/templates/sysctl_values.csv | 36 +++----
> .../templates/template_kernel_module_disabled | 2 -
> .../checks/templates/template_package_installed | 1 -
> .../checks/templates/template_package_removed | 1 -
> RHEL6/input/checks/templates/template_permissions | 1 -
> .../checks/templates/template_service_disabled | 1 -
> .../checks/templates/template_service_enabled | 1 -
> RHEL6/input/checks/templates/template_sysctl | 1 -
> 24 files changed, 281 insertions(+), 216 deletions(-)
> create mode 100644 RHEL6/input/checks/templates/Makefile
> create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list