[PATCH 0/8] Introduce FEDORA directory skeleton and transform scripts. Include start up 'test' profile having two gpgcheck scans

Jan Lieskovsky jlieskov at redhat.com
Mon Sep 16 10:15:16 UTC 2013


Hello David,

> Ahh, excellent - glad to see the addition of Fedora content!
> 
> Two quick things before I can ack this patch set:
> 
> 1) Have the OVAL checks been tested in Fedora 19? In the RHEL 6 content,
> there is a testcheck.py within /input/checks/ -- it might be worth copying
> that over.

Thank you for your reply and suggestion(s). No, the proposed content haven't been
tested via testcheck.py / verify-input-sanity.py utilities yet (have just focused
those scripts listed in Makefile to work [and tested that those OVAL definitions /
scans work properly on Fedora-19 and return 'not applicable' for other products]).

But definitely reasonable enhancement. Attached file contains current output of
its run in / against the RHEL6 directory. Those warnings cover definitions
not currently present in Fedora (not saying those shouldn't be fixed of course) =>
we should be safe wrt to these and Fedora.

Regarding the traceback I will try to find why / where it's failing, and submit
a patch to overcome it. Subsequently (when got it working) we could possibly
add verify-input-sanity.py script it to be run by default (hopefully under 
make checks', 'make validate-xml', or 'make validate' clauses), so we would
catch possible regressions / notice something changed into wrong direction
in the future.

> 
> 2) When copying XCCDF and OVAL from the RHEL 6 content, we should be careful
> to remove the test attestation that was done under RHEL, and re-add it with
> the tester's initials and date when tested under Fedora 19.

Original wanted to ask what you mean under test attestation, but Shawn clarified
already :). Sure will grep the content for its occurrences and remove particular
records for now.

Do you possibly have link to some documentation, how is that attestation created?

Is it like, SSG content is committed into the repository (after internal review).
Subsequently some 3-rd party performs independent testing of the profiles (or
even individual OVAL file definitions) and if they pass the review, grants the
attestation? What kind of organisation does this for RHEL6? And who would be
able to grant these for Fedora? IOW how this attestation testing should look like
for Fedora?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: verify-input-sanity-testcheck-rhel-6-result.txt
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130916/72c78a2e/attachment.txt>


More information about the scap-security-guide mailing list