[PATCH 0/3] manual checks (and OCIL?) now/soon, new macros

Michael J. McConachie michael at redhat.com
Thu Sep 6 22:10:48 UTC 2012


@Jeff ACK.

I agree with this direction shift decision.   Hopefully others will
follow suit, or provide other feedback.  As it stands, I will implement
the same logic after pulling the new commit of yours when it's ready,
and I'll resume running the RHEL6 guide top to bottom, adding the
verbiage (checks, and balances so to say).
 
MM

On 09/06/2012 02:50 PM, Jeffrey Blank wrote:
> I'm aware that this commit breaks oscap xccdf eval --profile at the
> moment, but I knew there would be a few loose ends.  I need to figure
> out the most reasonable way to deal with this (perhaps another transform
> to only provide OVAL, or maybe there is an oscap option to execute only
> certain checking systems).
>
> I should ask the openscap list about this too...
>
>
>
> On 09/06/2012 05:14 PM, Jeffrey Blank wrote:
>> This commitset provides a way for us to include manual checking ("auditing" as some call it)
>> for settings compliance with each Rule.
>>
>> The patch should make it clear what the general idea is.  As with the rest of
>> the project, the input format (in this case, new <ocil> tags) is designed to
>> allow for authoring ease and require the author only to provide the necessary
>> information.  Transforms should take care of putting this information into
>> whatever format the specification (or a customer) requires.
>>
>> Note that we do not yet have proper OCIL output here, just a start at formatting/providing it
>> inline with the XCCDF document.
>>
>> Jeffrey Blank (3):
>>   added proposed new "<ocil>" tags to contain manual check information.
>>          * these also use new macros for disabling services and
>>     checking partitioning
>>   use of new macros for disk partition checking, minor language updates
>>   support for handling new <ocil> tags for manual check info      *
>>     also, support for displaying this manual check information in
>>     tables      * definitions of new macros to make developing easier
>>
>>  RHEL6/input/services/avahi.xml                    |    1 +
>>  RHEL6/input/services/base.xml                     |   25 +++++++++++++
>>  RHEL6/input/services/cron.xml                     |    2 +
>>  RHEL6/input/services/dns.xml                      |    1 +
>>  RHEL6/input/services/http.xml                     |    1 +
>>  RHEL6/input/services/obsolete.xml                 |    7 ++++
>>  RHEL6/input/services/printing.xml                 |    1 +
>>  RHEL6/input/services/smb.xml                      |    1 +
>>  RHEL6/input/system/software/disk_partitioning.xml |   41 ++++++++++++---------
>>  RHEL6/transforms/constants.xslt                   |    1 +
>>  RHEL6/transforms/relabelids.py                    |    6 ++-
>>  RHEL6/transforms/shorthand2xccdf.xslt             |   38 +++++++++++++++++++-
>>  RHEL6/transforms/xccdf2table-profileccirefs.xslt  |    7 ++++
>>  13 files changed, 111 insertions(+), 21 deletions(-)
>>
>>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list