[PATCH 0/3] Added datastream outputs for Fedora, RHEL7, RHEL6

Jan Lieskovsky jlieskov at redhat.com
Thu Feb 20 16:06:39 UTC 2014


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Wednesday, February 19, 2014 10:36:56 PM
> Subject: Re: [PATCH 0/3] Added datastream outputs for Fedora, RHEL7, RHEL6
> 
> On 2/18/14, 12:31 PM, Shawn Wells wrote:
> 
> 
> 
> 0000-cover-letter.patch
> From 440572f256746f3e8acb225a784be3bb29ed2020 Mon Sep 17 00:00:00 2001
> From: Shawn Wells <shawn at redhat.com> Date: Tue, 18 Feb 2014 12:26:37 -0500
> Subject: [PATCH 0/3] Added datastream outputs for Fedora, RHEL7, RHEL6
> 
> SCAP datastreams allow for simplified SCAP content distribution, and also set
> us up for cryptographically signing
> the content. Additionally, our colleagues within SCAP Workbench and
> oscap-anaconda request datastreams for testing
> their content.
> 
> This patch generates ssg-(fedora rhel7 rhel6)-ds.xml, which will include
> XCCDF, CPE, and OVAL content. This should
> be considered development preview; the RPM build and documentation has NOT
> been updated yet.
> 
> Thank you to Alan Wylie for posting procedural guidance to the open-scap
> list! As he noted, profiles will now have
> new names when using the datastream:
> 
> $ grep "<Profile" output/ssg-rhel6-ds.xml
>   <Profile id="xccdf_org.ssgproject.content_profile_test">
>   <Profile id="xccdf_org.ssgproject.content_profile_CS2">
>   <Profile id="xccdf_org.ssgproject.content_profile_common">
>   <Profile id="xccdf_org.ssgproject.content_profile_server">
>   <Profile
>   id="xccdf_org.ssgproject.content_profile_stig-rhel6-server-upstream">
>   <Profile id="xccdf_org.ssgproject.content_profile_usgcb-rhel6-server">
>   <Profile id="xccdf_org.ssgproject.content_profile_rht-ccp">
> 
> Additionally, the --cpe flag is no longer needed as it's included in the
> datastream:
> $ oscap xccdf eval \
>  --profile xccdf_org.ssgproject.content_profile_CS2 \
>  --report /tmp/ssg-report.html \
>  --results /tmp/ssg-results.xml \
>  output/ssg-rhel6-ds.xml
> 
> 
> 
> Shawn Wells (3):
>   Adding datastream output for RHEL6
>   Updated Fedora build process to generate datastream
>   Added datastream output for RHEL7
> 
>  Fedora/Makefile |   11 +++++++++++
>  RHEL/6/Makefile |   10 ++++++++++
>  RHEL/7/Makefile |   11 +++++++++++
>  3 files changed, 32 insertions(+), 0 deletions(-)
> 
> Pushed set per Jan's ack

Thanks, Shawn. Would it be possible to make a new RHEL-6 rpm version bump too
and upload it to hosting service? (I would like to enhance Fedora's rpm
to include datastreams for both of RHEL-6 and RHEL-7 so it would be
possible from Fedora host to scan RHEL-{6,7} guests / remote systems too)

The motivation behind having remote RHEL-{6,7} system scans possibility
is to provide chance content to be more widely used / tested without the
need to install it explicitly on each of the remote system scheduled to be
scanned (vision being: more wider easier usage => more sooner bug reports
=> higher chance to fix them very soon).

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> --
> Shawn Wells
> Director, Innovation Programs shawn at redhat.com | 443.534.0130
> @shawndwells
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list