why is testing for file integrity monitoring technology specific?

Gabe Alford redhatrises at gmail.com
Tue Aug 4 15:02:44 UTC 2015


On Tue, Aug 4, 2015 at 8:43 AM, Shawn Wells <shawn at redhat.com> wrote:

>
>
> On 7/30/15 5:57 PM, Bond Masuda wrote:
>
>> Ok. I guess I will need to learn how to write OVAL and XCCDF content....
>>
>>
> Writing SCAP isn't the only way to contribute :)
>
> If you can create guidance (just text) for a tool, people here can help
> convert to XCCDF. On the OVAL side, if you can help us understand what
> regex/files/system attributes need to be examined for a pass/fail, that's a
> huge jumping off point too.
>
> Besides that, my coworker and I just noticed that although we fail the
>> AIDE test, we are passing the aide_periodic_cron_checking test. This might
>> be a bug??? Can anyone replicate?
>>
>
> Skimming the code, likely a bug.  Do you mind opening a ticket? The OVAL
> code checks to see if aide is installed:
>
>>     <criteria operator="AND">
>>       <extend_definition comment="Aide is installed"
>> definition_ref="package_aide_installed" />
>>       <criteria operator="OR">
>>         <criterion comment="run aide daily with cron"
>> test_ref="test_aide_periodic_cron_checking" />
>>         <criterion comment="run aide daily with cron"
>> test_ref="test_aide_crond_checking" />
>>         <criterion comment="run aide daily with cron"
>> test_ref="test_aide_var_cron_checking" />
>>       </criteria>
>>     </criteria>
>>
>
This was recently fixed with
https://github.com/OpenSCAP/scap-security-guide/pull/631 (which is actually
listed above by Shawn)


> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150804/9081fb9b/attachment.html>


More information about the scap-security-guide mailing list