Generate Fix
Simon Lukasik
isimluk at fedoraproject.org
Thu Dec 19 11:44:02 UTC 2013
On 12/18/2013 09:33 PM, Shawn Wells wrote:
> On 12/18/13, 11:39 AM, Simon Lukasik wrote:
>> You can then verify the fix by running:
>>
>> $ oscap xccdf generate fix \
>> --output my-fixes.xml
>> --profile usgcb-rhel6-server \
>> --template urn:xccdf:fix:script:sh \
>> ./scap-security-guide/RHEL6/dist/content/ssg-rhel6-xccdf.xml
>>
>> No need to run it on a system. Nor sed.
>
>
> Incredibly handy! Two things:
>
> (1) On OpenSCAP 0.9.12-1, the output file is chmod'd to 100. Could this
> be something more reasonable -- such as inheriting the umask value, or
> perhaps 500, as this will be a script to execute?
>
Yep, there was a bug in mask as well. It should have been created with
700 now.
> (2) The output file does not include any of the CCE information. Is
> there a way to have this included (happy to open an RFE if needed)?
>
I am wondering for whom is the CCE useful in the fix script. But yes,
you can file an RFE for anything. ;-)
--
Simon Lukasik
Security Technologies
More information about the scap-security-guide
mailing list