[PATCH 21/21] Renamed OVAL no_empty_passwords.xml to match XCCDF rule name

Jeffrey Blank scapafterhours at gmail.com
Wed Apr 3 02:13:41 UTC 2013


Yeah, well, it wasn't.

These are certainly undesirable or neutral:

rename RHEL6/input/checks/{yum_gpgcheck_never_disabled.xml =>
ensure_gpgcheck_never_disabled.xml}
rename RHEL6/input/checks/{accounts_nologin_for_system.xml =>
no_shelllogin_for_systemaccounts.xml}

In many ways the OVAL titles were more desirable than the XCCDF ones from
an organization/naming perspective, but it's hardly a big deal.  In any
event, we should probably have a discussion to hash out some kind of naming
strategy, if you think it's important.  In any event, I think everyone
seriously appreciates the OVAL QA that accompanied this!

Relatedly, is there any use for the description text in the current OVAL
definitions?  I believe it's just XCCDF description and could be added back
in during the linking phase (occupied by a placeholder until then if it's a
necessary element for the schema during the unit testing).

I also think changes to the template scripts in checks (which now generate
some fixes) should instead have been done is a separate new directory for
templated fixes in input/fixes/bash.  Or possibly entirely auto-generated
from a comment or note field in the OVAL checks.  But it's fine for now,
and we can improve it later.  Refactoring is fun too.






On Tue, Apr 2, 2013 at 6:25 PM, Shawn Wells <shawn at redhat.com> wrote:

> On 4/2/13 6:19 PM, Shawn Wells wrote:
>
>> On 4/2/13 6:07 PM, Shawn Wells wrote:
>>
>>> On 4/2/13 6:02 PM, Jeffrey Blank wrote:
>>>
>>>> oh, okay, I see you are changing it to match the XCCDF.
>>>>
>>>> change the XCCDF ID instead.  its ID is more precise.
>>>>
>>>
>>> (responding to all the NACKs, since the reasoning is the same).
>>>
>>> I was making my way through the OVAL (in preparation to create
>>> remediation scripts), and several OVAL checks don't match the XCCDF rule
>>> name. In the past our stated goal was to have XCCDF == OVAL == remediation
>>> in regards of naming. Do you feel that no longer makes sense?
>>>
>>
>>
>> Jeff and I were chatting over IM, wanted to copy/paste the conversation
>> to the list for transparency:
>>
>>  Jeff
>>> 6:11
>>> i want to be able to spot things in a directory listing
>>> 6:12
>>> and yes, i'm only interested in bothering with renaming if we're
>>> actually going to think about it and have it make sense
>>> 6:12
>>> in a complete way
>>> 6:13
>>> it's just not worth the time otherwise
>>>
>>> 6:13
>>> Shawn
>>> fair. i'd like to atleast have XCCDF rules match OVAL titles for
>>> templated items, though. Example: sysctl
>>>
>>> 6:13
>>> Blank, Jeff
>>> sure, that totally makes sense
>>>
>>
>> So in effect, scrap the random renamings until (if?) a naming standard is
>> developed, but keep those for macro'd content (generated out of
>> RHEL6/input/checks/templates/) as those have a good enough quasi-standard
>> for the project.
>>
>>
>
> And some more --
>
>  Shawn
>> other stuff an ack?
>>
>> 6:22
>> Jeff
>> sure
>>
>> 6:23
>> Shawn
>> wow, what a full endorsement ;)
>>
>
> ______________________________**_________________
> scap-security-guide mailing list
> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130402/29f174d4/attachment.html>


More information about the scap-security-guide mailing list