[PATCH] [Shared] Add initial shared OVAL check for 'Verify that Shared Library Files Have Restrictive Permissions' rule [was: [PATCH] [RFC] Creating shared bash script directory]
Shawn Wells
swells at redhat.com
Fri Dec 6 14:31:45 UTC 2013
Ack - pls push
---
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells
> On Dec 6, 2013, at 5:56 AM, Jan Lieskovsky <jlieskov at redhat.com> wrote:
>
> Hello folks,
>
> can I go ahead and push this patch upstream?
>
> Right now it doesn't touch RHEL-6 code at all (RHEL-6 can
> be attached later via symlinks to existing tests and providing
> attestations).
>
> But having this in upstream repo could simplify the approach
> to me (not to need to keep two separate local git streams),
> and focus on fixing further child bugs which might arise when
> trying to implement this (like the already mentioned "platform"
> XSLT transformation, checking for presence of attestation for
> that platform, the -devel option etc.)
>
> RHEL-6 can start joining this scheme later gradually moving
> selected rules they to be used / obtained from the shared directory
> (once confirmed for work on RHEL-6 too).
>
> And should this have shown as to be a non-viable way, we can
> always return back to the old (OVAL checks pre product) schema
> later just by moving the checks and removing the symlinks (whole
> /shared content).
>
> Would this be just Fedora specific change, would go ahead and push
> (and count with the responsibility that if some issue is found
> later, I will need to fix it).
>
> But since it introduces new main directory structure, would
> like to have your blessing first / prior doing that.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> ----- Original Message -----
>> From: "Jan Lieskovsky" <jlieskov at redhat.com>
>> To: scap-security-guide at lists.fedorahosted.org
>> Sent: Thursday, December 5, 2013 7:53:22 PM
>> Subject: [PATCH] [Shared] Add initial shared OVAL check for 'Verify that Shared Library Files Have Restrictive
>> Permissions' rule [was: [PATCH] [RFC] Creating shared bash script directory]
>>
>>
>> Based on thread:
>> https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-December/thread.html#4585
>>
>> this patch adds first OVAL check into scap-security-guide/shared/oval
>> directory
>> and modifies main Makefile wrt to building Fedora packages it to include OVAL
>> checks directly provided in input/checks directory, together with those
>> linked
>> from shared/ directory.
>>
>> For now didn't change the value of <platform> element (didn't implement the
>> XSLT transformation it to be modified automatically based on underlying
>> system
>> version content is build at) - will do this in next steps, once we have
>> agreed
>> on the expected form of test_attestation element.
>>
>> Passed basic sanity && regression testing on Fedora system.
>>
>> RHEL-6 content has been intentionally kept intact till the moment, we are
>> sure
>> about the final shared OVAL check form.
>>
>> Please review.
>>
>> Thank you && Regards, Jan.
>> --
>> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list