[PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches Installed' rule

Jan Lieskovsky jlieskov at redhat.com
Thu Oct 3 18:15:10 UTC 2013


Hi Steve,

> 
> On Thursday, October 03, 2013 01:54:17 PM Jan Lieskovsky wrote:
> > It uses SCE script to determine if there are security
> > updates available, and requires former 'ensure
> > yum fedora-updates.repo enabled' rule to pass first.
> 
> What are the possibilities of tying the bodhi release system to create OVAL
> files for the Fedora project?

We have previously considered this alternative, and SCE way has been
chosen as a short-term way to go.

> All we'd need to do is when the release is
> security sensitive, add the CVE information. Then Bodhi can use this to make
> OVAL files to be downloaded.

Not sure at the moment, which exact bits would need to be updated in Bodhi
system to make it automa{t,g}ically generate OVAL CVE content for Fedora.

We will inspect this possibility yet though.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> -Steve
> 


More information about the scap-security-guide mailing list