[PATCH 0/3] manual checks (and OCIL?) now/soon, new macros

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Sep 6 23:19:41 UTC 2012


Pushed.  You may also want to make macros for package installation/removal.

There are also scripts in the RHEL 5 STIG that should be useful when
creating manual checks.  For this pass, please try to avoid specialized
language like "This is a finding" -- just try providing instructions
that make it clear to the administrator what the results mean.  If
additional, specialized language is deemed necessary, a mechanism to
automatically insert the necessarily phrases can be implemented.

The larger (and more complicated) question is whether the manual
checking information should be placed into an interrogatory form so that
it is compatible with OCIL, which is dependent on baseline issuers'
intentions.  (And please forgive the temporary abuse of the OCIL
namespace.  The new manual checks are obviously not properly-formatted
OCIL -- though they could be.



On 09/06/2012 06:10 PM, Michael J. McConachie wrote:
> @Jeff ACK.
> 
> I agree with this direction shift decision.   Hopefully others will
> follow suit, or provide other feedback.  As it stands, I will implement
> the same logic after pulling the new commit of yours when it's ready,
> and I'll resume running the RHEL6 guide top to bottom, adding the
> verbiage (checks, and balances so to say).
>  
> MM
> 
> On 09/06/2012 02:50 PM, Jeffrey Blank wrote:
>> I'm aware that this commit breaks oscap xccdf eval --profile at the
>> moment, but I knew there would be a few loose ends.  I need to figure
>> out the most reasonable way to deal with this (perhaps another transform
>> to only provide OVAL, or maybe there is an oscap option to execute only
>> certain checking systems).
>>
>> I should ask the openscap list about this too...
>>
>>
>>
>> On 09/06/2012 05:14 PM, Jeffrey Blank wrote:
>>> This commitset provides a way for us to include manual checking ("auditing" as some call it)
>>> for settings compliance with each Rule.
>>>
>>> The patch should make it clear what the general idea is.  As with the rest of
>>> the project, the input format (in this case, new <ocil> tags) is designed to
>>> allow for authoring ease and require the author only to provide the necessary
>>> information.  Transforms should take care of putting this information into
>>> whatever format the specification (or a customer) requires.
>>>
>>> Note that we do not yet have proper OCIL output here, just a start at formatting/providing it
>>> inline with the XCCDF document.
>>>
>>> Jeffrey Blank (3):
>>>   added proposed new "<ocil>" tags to contain manual check information.
>>>          * these also use new macros for disabling services and
>>>     checking partitioning
>>>   use of new macros for disk partition checking, minor language updates
>>>   support for handling new <ocil> tags for manual check info      *
>>>     also, support for displaying this manual check information in
>>>     tables      * definitions of new macros to make developing easier
>>>
>>>  RHEL6/input/services/avahi.xml                    |    1 +
>>>  RHEL6/input/services/base.xml                     |   25 +++++++++++++
>>>  RHEL6/input/services/cron.xml                     |    2 +
>>>  RHEL6/input/services/dns.xml                      |    1 +
>>>  RHEL6/input/services/http.xml                     |    1 +
>>>  RHEL6/input/services/obsolete.xml                 |    7 ++++
>>>  RHEL6/input/services/printing.xml                 |    1 +
>>>  RHEL6/input/services/smb.xml                      |    1 +
>>>  RHEL6/input/system/software/disk_partitioning.xml |   41 ++++++++++++---------
>>>  RHEL6/transforms/constants.xslt                   |    1 +
>>>  RHEL6/transforms/relabelids.py                    |    6 ++-
>>>  RHEL6/transforms/shorthand2xccdf.xslt             |   38 +++++++++++++++++++-
>>>  RHEL6/transforms/xccdf2table-profileccirefs.xslt  |    7 ++++
>>>  13 files changed, 111 insertions(+), 21 deletions(-)
>>>
>>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-- 
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance


More information about the scap-security-guide mailing list