[PATCH 0/3] manual checks (and OCIL?) now/soon, new macros

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Sep 6 21:50:40 UTC 2012


I'm aware that this commit breaks oscap xccdf eval --profile at the
moment, but I knew there would be a few loose ends.  I need to figure
out the most reasonable way to deal with this (perhaps another transform
to only provide OVAL, or maybe there is an oscap option to execute only
certain checking systems).

I should ask the openscap list about this too...



On 09/06/2012 05:14 PM, Jeffrey Blank wrote:
> This commitset provides a way for us to include manual checking ("auditing" as some call it)
> for settings compliance with each Rule.
> 
> The patch should make it clear what the general idea is.  As with the rest of
> the project, the input format (in this case, new <ocil> tags) is designed to
> allow for authoring ease and require the author only to provide the necessary
> information.  Transforms should take care of putting this information into
> whatever format the specification (or a customer) requires.
> 
> Note that we do not yet have proper OCIL output here, just a start at formatting/providing it
> inline with the XCCDF document.
> 
> Jeffrey Blank (3):
>   added proposed new "<ocil>" tags to contain manual check information.
>          * these also use new macros for disabling services and
>     checking partitioning
>   use of new macros for disk partition checking, minor language updates
>   support for handling new <ocil> tags for manual check info      *
>     also, support for displaying this manual check information in
>     tables      * definitions of new macros to make developing easier
> 
>  RHEL6/input/services/avahi.xml                    |    1 +
>  RHEL6/input/services/base.xml                     |   25 +++++++++++++
>  RHEL6/input/services/cron.xml                     |    2 +
>  RHEL6/input/services/dns.xml                      |    1 +
>  RHEL6/input/services/http.xml                     |    1 +
>  RHEL6/input/services/obsolete.xml                 |    7 ++++
>  RHEL6/input/services/printing.xml                 |    1 +
>  RHEL6/input/services/smb.xml                      |    1 +
>  RHEL6/input/system/software/disk_partitioning.xml |   41 ++++++++++++---------
>  RHEL6/transforms/constants.xslt                   |    1 +
>  RHEL6/transforms/relabelids.py                    |    6 ++-
>  RHEL6/transforms/shorthand2xccdf.xslt             |   38 +++++++++++++++++++-
>  RHEL6/transforms/xccdf2table-profileccirefs.xslt  |    7 ++++
>  13 files changed, 111 insertions(+), 21 deletions(-)
> 
> 


More information about the scap-security-guide mailing list