question about fix-common code
Francisco Slavin
fslavin at tresys.com
Mon Jun 3 18:41:05 UTC 2013
On Sunday, June 02, 2013 1:57 PM, Jeff Blank wrote:
> Francisco, Shawn,
> What was your thinking behind the common-fix elements?
I believe those elements were an attempt at allowing for function re-use. The inspiration was a set of examples posted to this list by Simon Lukasik (of OpenSCAP fame). The discussion that led up to my patch was in this thread:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-April/002970.html
> Please also see (shortly) my new patches for fix insertion.
> I've re-written the fix insertion stuff. So that people can "declare" their use of particular environment variables in bash (using a bash function).
> Then the reworked combinefixes.py will pick up on the declaration and assign an XCCDF <sub idref/> to that variable. <sub idref/> is how oscap supports inserting particular values inside a fix.
> For unit testing (still incomplete), the bash function "needs" should grab the right value from XCCDF and populate it accordingly.
> Do we still need the fix-common elements, to insert them into the XCCDF?
> I like to delete unused code.
I need to look through your new patches to properly respond here. The original goal was to populate some top-level <plain-text> elements with common functions. Per Simon's examples, the <sub idref/> can refer directly to these <plain-text> elements. This follows the way Mike P's original SSG-targeted remediation scripts were authored in Aqueduct:
https://fedorahosted.org/aqueduct/browser/trunk/compliance/Bash/SSG/dev
Where there were a series of scripts ending in "common" which were referenced as appropriate by the other ".sh" scripts.
My approach was just to drop all of the "common" content into <plain-text> elements and have the ".sh" content be specific to individual <fix> elements.
- Francisco
> Jeff
More information about the scap-security-guide
mailing list