some questions about the checks / oval tests

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Feb 11 23:35:36 UTC 2013



>> Ensure Log Files Are Owned By Appropriate Group 	unknown
>> Ensure System Log Files Have Correct Permissions 	unknown
>>
>> may be reformulated to:
>> Ensure Log Files Are stored in /var/log 		pass (if lucky)
> 
> Not the same thing. As written currently, files match rsyslog config.

I'll push up a patch to demonstrate what I mean.


>> (Really, the Rule for having a separate partition for /var/log is
>> already sort of assuming that we're doing this...)
> 
> I don't think these are equivalent.

What I mean is that the rationale for having /var/log on a separate
partition does not exist if logfiles can live elsewhere.


> In any case I have been directed to relax that particular requirement
> (separate filesystem for /var/log) for at least single-user workstations
> within NASA. Such rules will be altered via <Profile> to have
> role="unscored", severity="low", and selected="true".

Sounds perfectly reasonable to me.  Ah -- excellent -- thanks for
pointing out that it's possible for a Profile to override a Rule's
severity setting.


More information about the scap-security-guide mailing list