<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>The scripts in Aqueduct are hard coded (rhel 5).</div>
<div><br>
</div>
<div>Vince</div>
<br>
<br>
<br>
-------- Original message --------<br>
From: Jeffrey Blank <blank@eclipse.ncsc.mil> <br>
Date: 06/03/2013 5:32 PM (GMT-06:00) <br>
To: scap-security-guide@lists.fedorahosted.org <br>
Subject: Re: question about fix-common code <br>
<br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Thanks for the reminder on mailing list posts!<br>
<br>
Ah, okay, I was wondering how the plain-text was getting properly<br>
associated/inserted with the individual fixes inside the XCCDF; this<br>
explains it. My newer combinefixes.py does not yet solve that problem,<br>
but it certainly makes sense for it to do so.<br>
<br>
Was there any support for parameters in your scripts on Aqueduct, or was<br>
it STIG-hardcoded?<br>
<br>
<br>
<br>
<br>
On 06/03/2013 02:41 PM, Francisco Slavin wrote:<br>
> On Sunday, June 02, 2013 1:57 PM, Jeff Blank wrote: <br>
>> Francisco, Shawn,<br>
>> What was your thinking behind the common-fix elements?<br>
> I believe those elements were an attempt at allowing for function re-use. The inspiration was a set of examples posted to this list by Simon Lukasik (of OpenSCAP fame). The discussion that led up to my patch was in this thread:<br>
> <a href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-April/002970.html">
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-April/002970.html</a><br>
> <br>
> <br>
>> Please also see (shortly) my new patches for fix insertion.<br>
>> I've re-written the fix insertion stuff. So that people can "declare" their use of particular environment variables in bash (using a bash function).<br>
>> Then the reworked combinefixes.py will pick up on the declaration and assign an XCCDF <sub idref/> to that variable. <sub idref/> is how oscap supports inserting particular values inside a fix.
<br>
>> For unit testing (still incomplete), the bash function "needs" should grab the right value from XCCDF and populate it accordingly.<br>
>> Do we still need the fix-common elements, to insert them into the XCCDF?<br>
>> I like to delete unused code.<br>
> <br>
> I need to look through your new patches to properly respond here. The original goal was to populate some top-level <plain-text> elements with common functions. Per Simon's examples, the <sub idref/> can refer directly to these <plain-text> elements. This
follows the way Mike P's original SSG-targeted remediation scripts were authored in Aqueduct:<br>
> <a href="https://fedorahosted.org/aqueduct/browser/trunk/compliance/Bash/SSG/dev">
https://fedorahosted.org/aqueduct/browser/trunk/compliance/Bash/SSG/dev</a><br>
> Where there were a series of scripts ending in "common" which were referenced as appropriate by the other ".sh" scripts.<br>
> My approach was just to drop all of the "common" content into <plain-text> elements and have the ".sh" content be specific to individual <fix> elements.
<br>
> <br>
> - Francisco<br>
> <br>
>> Jeff<br>
> _______________________________________________<br>
> scap-security-guide mailing list<br>
> scap-security-guide@lists.fedorahosted.org<br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
><br>
_______________________________________________<br>
scap-security-guide mailing list<br>
scap-security-guide@lists.fedorahosted.org<br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</div>
</span></font>
</body>
</html>