Compose with the OSCAP Anaconda Addon available

Shawn Wells shawn at redhat.com
Thu Nov 21 03:13:45 UTC 2013


On 11/20/13, 9:15 AM, Vratislav Podzimek wrote:
> The project page of the OSCAP Anaconda Addon [1] now has a section about
> testing with links to the custom Fedora 20 compose with the OSCAP
> Anaconda Addon included and to some testing files.
>
> [1]https://fedorahosted.org/oscap-anaconda-addon/
>
> Suggestions, comments and bug reports welcome.

That page is fantastic. The instructions are incredibly simple -- this 
should greatly increase testing done by users. Thank you!

Attempted to perform an install against Fedora 20 SSG content [1], which 
lead to BZ 1032846 [2] that was generated from the installer. After 
reviewing the BZ, it's clear my issue was that Anaconda expects a SCAP 
Datastream and SSG content is expressed as a Benchmark.

1) When using SSG content for "fetch," an error was thrown regarding SSG 
not being a datastream. After submitting the bugzilla the entire install 
crashed/rebooted, instead of giving me the option to use another 
datastream URL or continue without SCAP addon enabled. Is that expected 
behavior?

2) Will Benchmark content be accepted in the future, or must content be 
in datastream formats? If datastream, we're looking at a fundamental 
change to how SSG content is expressed. That's not necessarily a bad 
thing, just want to start the conversation and understand your direction :)

3) Nit pick. After fetching your datastream content [3] I was brought to 
the "profile selection" screen where options included "testing profile" 
and "testing profile2". My natural reaction was to double-click on the 
profile names -- and after nothing happened -- I finally noticed the 
"Select Profile" button. Would it be possible to edit the workflow so 
that users could double click on the profile?


[1] 
http://people.redhat.com/swells/scap-security-guide/Fedora/output/ssg-fedora-xccdf.xml
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1032846
[3] http://vpodzime.fedorapeople.org/oscap-anaconda-addon/testing_ds.xml


More information about the scap-security-guide mailing list