Implementation of openscap
Joe Wulf
joe_wulf at yahoo.com
Thu Sep 13 17:02:51 UTC 2012
Steve,
If I understand what you are saying correctly: I could install/build openscap on late-model editions of RHEL, 6.3 today, and once each for relevant architectures (32 and 64 bits). I would bring the latest edition of '/usr/lib64/libopenscap.so.x.x.x' (and the one for x32) along with the oscap software and XML content placing them in the NFS mount available to all hosts to be assessed. I would prefix my NFS path to $LD_LIBRARY_PATH. So far, so good, right?
The probes you mentioned would be in an obvious place once I've got openscap compiled or installed? Once I know that location, I'd set $OVAL_PROVE_DIR to it.
Thank you for the feedback.
R,
-Joe
>________________________________
> From: Steve Grubb <sgrubb at redhat.com>
>To: scap-security-guide at lists.fedorahosted.org; Joe Wulf <joe_wulf at yahoo.com>
>Sent: Thursday, September 13, 2012 12:35 PM
>Subject: Re: Implementation of openscap
>
>On Thursday, September 13, 2012 08:20:24 AM Joe Wulf wrote:
>> - Can a single edition (preferably the latest) of openscap combined with
>> the latest content be 'brought' into the RHEL test/dev hosts and be
>> successful in executing for scoring/assessment? - Has anyone tried this
>> yet?
>
>The answer is probably...
>
>The oscap commandline tool depends on a library in the openscap package,
>/usr/lib64/libopenscap.so.1.0.0. So, you would need to export LD_LIBRARY_PATH
>with this nfs location so that it finds the correct one before the one that's
>possibly installed.
>
>The other thing is that the OVAL scan uses individual probe executables to do
>certain checks. So, you would have to tell it how to find the new binaries.
>Fortunately, this was addressed to get the self test working. You would export
>OVAL_PROBE_DIR pointing to the directory where the probes are.
>
>There are also schemas and various supporting xml files. If your content is
>complete, you might not have any problems. But this is the only area where I
>think you'd need to do experimenting in.
>
>-Steve
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20120913/eecfe85f/attachment-0001.html>
More information about the scap-security-guide
mailing list