Compose with the OSCAP Anaconda Addon available

Vratislav Podzimek vpodzime at redhat.com
Mon Nov 25 09:27:04 UTC 2013


On Wed, 2013-11-20 at 22:13 -0500, Shawn Wells wrote:
> On 11/20/13, 9:15 AM, Vratislav Podzimek wrote:
> > The project page of the OSCAP Anaconda Addon [1] now has a section about
> > testing with links to the custom Fedora 20 compose with the OSCAP
> > Anaconda Addon included and to some testing files.
> >
> > [1]https://fedorahosted.org/oscap-anaconda-addon/
> >
> > Suggestions, comments and bug reports welcome.
> 
> That page is fantastic. The instructions are incredibly simple -- this 
> should greatly increase testing done by users. Thank you!
> 
> Attempted to perform an install against Fedora 20 SSG content [1], which 
> lead to BZ 1032846 [2] that was generated from the installer. After 
> reviewing the BZ, it's clear my issue was that Anaconda expects a SCAP 
> Datastream and SSG content is expressed as a Benchmark.
Thanks for filing the bug report. Unfortunately, this is an expected
behaviour, because the GUI content specification is something like an
experimental and unfinished feature. So far only datastreams are
supported this way, benchmarks are supported via kickstart %addon
section.

> 
> 1) When using SSG content for "fetch," an error was thrown regarding SSG 
> not being a datastream. After submitting the bugzilla the entire install 
> crashed/rebooted, instead of giving me the option to use another 
> datastream URL or continue without SCAP addon enabled. Is that expected 
> behavior?
I've already answered this above. It needs additional work.

> 
> 2) Will Benchmark content be accepted in the future, or must content be 
> in datastream formats? If datastream, we're looking at a fundamental 
> change to how SSG content is expressed. That's not necessarily a bad 
> thing, just want to start the conversation and understand your direction :)
Standalone benchmarks and OVAL XMLs are supported by the %addon
kickstart section, interactive (GUI) fetching is planned for the future.

> 
> 3) Nit pick. After fetching your datastream content [3] I was brought to 
> the "profile selection" screen where options included "testing profile" 
> and "testing profile2". My natural reaction was to double-click on the 
> profile names -- and after nothing happened -- I finally noticed the 
> "Select Profile" button. Would it be possible to edit the workflow so 
> that users could double click on the profile?
Yeah, that's a good idea and quite an easy fix. Thanks for the tip!

-- 
Vratislav Podzimek

Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic



More information about the scap-security-guide mailing list