<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Verdana;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p
        {mso-style-priority:99;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:"Calibri",sans-serif;
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri",sans-serif;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Hi Gabe,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">I understand what you’re saying, but the goal is to get rid of symbolic links completely. If we still rely on symbolic links, then we still face the same problem.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">How would one know if a particular oval check is missing?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Trey Henefield, CISSP<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Senior IAVA Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Ultra Electronics<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Advanced Tactical Systems, Inc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">4101 Smith School Road<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Building IV, Suite 100<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Austin, TX 78744 USA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Trey.Henefield@ultra-ats.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Tel: &#43;1 512 327 6795 ext. 647<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Fax: &#43;1 512 327 8043<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Mobile: &#43;1 512 541 6450<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">www.ultra-ats.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org]
<b>On Behalf Of </b>Gabe Alford<br>
<b>Sent:</b> Thursday, April 09, 2015 12:12 PM<br>
<b>To:</b> SCAP Security Guide<br>
<b>Subject:</b> Re: Shared Checks/Fixes ...<o:p></o:p></span></p>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hey Trey,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">IMO rather than read all files from Dir A and then reading all files from Dir B and then processing which content to filter, it would be better to list the content from the current working directory (CWD), check
 if the file is valid, a symlink (just in case there is need for one), or missing. If the file is a symlink or missing, get the actual file from the shared/oval directory. The logic would seem easier to implement that way.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Gabe<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">&nbsp; <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">On Thu, Apr 9, 2015 at 10:27 AM, Trey Henefield &lt;<a href="mailto:trey.henefield@ultra-ats.com" target="_blank">trey.henefield@ultra-ats.com</a>&gt; wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Hi Gabe,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">I probably should have been more specific as to the Makefile change, but essentially, it just involved
 changing the combinechecks.py line from this:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $(SHARED)/$(TRANS)/combinechecks.py $(CONF) $(IN)/checks &gt; $(OUT)/unlinked-$(PROD)-oval.xml</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">To this:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $(SHARED)/$(TRANS)/combinechecks.py $(CONF) $(IN)/checks $(SHARED)/oval &gt; $(OUT)/unlinked-$(PROD)-oval.xml</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">That part seems to work great with the code I provided. But the filtering of shared checks included
 is where the challenge lies.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Best regards,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Trey Henefield, CISSP</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Senior IAVA Engineer</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Ultra Electronics</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Advanced Tactical Systems, Inc.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">4101 Smith School Road</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Building IV, Suite 100</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Austin, TX 78744 USA</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><a href="mailto:Trey.Henefield@ultra-ats.com" target="_blank">Trey.Henefield@ultra-ats.com</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Tel:
<a href="tel:%2B1%20512%20327%206795%20ext.%20647" target="_blank">&#43;1 512 327 6795 ext. 647</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Fax:
<a href="tel:%2B1%20512%20327%208043" target="_blank">&#43;1 512 327 8043</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">Mobile:
<a href="tel:%2B1%20512%20541%206450" target="_blank">&#43;1 512 541 6450</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D"><a href="http://www.ultra-ats.com" target="_blank">www.ultra-ats.com</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">&nbsp;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">
<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org" target="_blank">
scap-security-guide-bounces@lists.fedorahosted.org</a> [mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org" target="_blank">scap-security-guide-bounces@lists.fedorahosted.org</a>]
<b>On Behalf Of </b>Gabe Alford<br>
<b>Sent:</b> Thursday, April 09, 2015 9:59 AM</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<b>To:</b> SCAP Security Guide<br>
<b>Subject:</b> Re: Shared Checks/Fixes ...<o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Thu, Apr 9, 2015 at 8:04 AM, Trey Henefield &lt;<a href="mailto:trey.henefield@ultra-ats.com" target="_blank">trey.henefield@ultra-ats.com</a>&gt; wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204,204,204)">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
<br>
Thank you everyone for the responses!<br>
<br>
I completely agree with the benefits of the shared directory. That really wasn't so much my concern, but rather a better way of utilizing it.<br>
<br>
As Jan pointed out, I am using a mixed Windows/Linux environment, making it challenging to maintain the symbolic links when traversing different filesystems (NTFS -&gt; EXT).<br>
<br>
So far, I have looked at some minor adjustments that can be made to shared/transforms/combinechecks.py and shared/transforms/combinefixes.py.<br>
<br>
I have tried adding an additional parameter through the Makefile to point to the $(SHARED)/oval folder and adding the following to shared/transforms/combinechecks.py:<br>
<br>
for filename in os.listdir(sys.argv[2]):<br>
if filename.endswith(&quot;.xml&quot;):<br>
with open(sys.argv[2] &#43; &quot;/&quot; &#43; filename, 'r') as xml_file:<br>
body = body &#43; xml_file.read()<br>
&#43;<br>
&#43; for filename in os.listdir(sys.argv[3]):<br>
&#43; if filename.endswith(&quot;.xml&quot;):<br>
&#43; with open(sys.argv[3] &#43; &quot;/&quot; &#43; filename, 'r') as xml_file:<br>
&#43; body = body &#43; xml_file.read()<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">You could do it this way for combinechecks.py:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43; SHARED = os.environ.get('SHARED_DIR')<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
for filename in os.listdir(sys.argv[2]):<br>
&nbsp;&nbsp;&nbsp;&nbsp; if filename.endswith(&quot;.xml&quot;):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; local_path = sys.argv[2] &#43; &quot;/&quot; &#43; filename<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if not os.path.islink(local_path):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; xml_filename = local_path<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; xml_filename = SHARED &#43; &quot;/oval/&quot; &#43; filename<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; with open(sys.argv[2] &#43; &quot;/&quot; &#43; filename, 'r') as xml_file:<br>
&#43;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; with open(xml_filename, 'r') as xml_file:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Then add the following to the Makefile(s):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">export SHARED_DIR=$(SHARED)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204,204,204)">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">This has the proper effect of adding all project-specific checks first, then adding in all shared checks. If there is a shared check with the same name as a project-specific check, the
 shared check will be excluded in favor of the project-specific check. Although, I personally think the identifier of each shared check should be prefaced with 'shared_' to help identify it as a shared check. This could help to prevent duplicate IDs in any
 case.<br>
<br>
The downside of the above code though is that it adds all oval checks in the shared folder to the oval output of a specific project. It builds fine. But 'make validate' complains about oval checks not being included in the XCCDF profile. There should be a better
 way to filter xml file content added from the shared folder to just those specific to the project's supported platform.<br>
<br>
As Shawn has hinted, this could perhaps be resolved in some XSLT magic. Are there any XSLT magicians out there? ;) This is a language I have yet to conquer.<br>
<br>
Best regards,<br>
<br>
<br>
Trey Henefield, CISSP<br>
Senior IAVA Engineer<br>
<br>
Ultra Electronics<br>
Advanced Tactical Systems, Inc.<br>
4101 Smith School Road<br>
Building IV, Suite 100<br>
Austin, TX 78744 USA<br>
<br>
<a href="mailto:Trey.Henefield@ultra-ats.com" target="_blank">Trey.Henefield@ultra-ats.com</a><br>
Tel: <a href="tel:%2B1%20512%20327%206795%20ext.%20647" target="_blank">&#43;1 512 327 6795 ext. 647</a><br>
Fax: <a href="tel:%2B1%20512%20327%208043" target="_blank">&#43;1 512 327 8043</a><br>
Mobile: <a href="tel:%2B1%20512%20541%206450" target="_blank">&#43;1 512 541 6450</a><br>
<br>
<a href="http://www.ultra-ats.com" target="_blank">www.ultra-ats.com</a><br>
<br>
-----Original Message-----<br>
From: <a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org" target="_blank">
scap-security-guide-bounces@lists.fedorahosted.org</a> [mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org" target="_blank">scap-security-guide-bounces@lists.fedorahosted.org</a>] On Behalf Of Jan Lieskovsky<br>
Sent: Thursday, April 09, 2015 7:31 AM<br>
To: SCAP Security Guide<br>
Subject: Re: Shared Checks/Fixes ...<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Hello Trey,<br>
<br>
----- Original Message -----<br>
&gt; From: &quot;Trey Henefield&quot; &lt;<a href="mailto:trey.henefield@ultra-ats.com" target="_blank">trey.henefield@ultra-ats.com</a>&gt;<br>
&gt; To: &quot;<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>&quot;
<br>
&gt; &lt;<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
&gt; Sent: Wednesday, April 8, 2015 11:13:48 PM<br>
&gt; Subject: Shared Checks/Fixes ...<br>
&gt; <br>
&gt; Greetings,<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; I wanted to propose a change to the current structure in place for <br>
&gt; shared checks (shared/oval) and fixes (shared/fixes/bash). I was <br>
&gt; curious to get everyone’s opinion before committing.<br>
<br>
Thank you for opening this topic.<br>
<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; So the problem I see is with the symbolic linking of checks and fixes <br>
&gt; to the shared folder. I have found it problematic when working between <br>
&gt; different operating systems, file systems, and version control systems.<br>
<br>
Right from the beginning we knew the concept of symbolic links will introduce issues when dealing with SSG content across multiple OS versions.<br>
But so far there hasn't been urgent need to fix this (to be read as so far there haven't been much reports current behaviour causing issues for developers).<br>
But as the count of the SCAP content products raises it's time to fix this.<br>
<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Rather than creating symbolic links to certain oval checks in the <br>
&gt; shared/oval folder, we could choose to just process all oval checks in <br>
&gt; both the project’s checks folder and the shared/oval folder.<br>
<br>
The original idea behind introducing /shared directory was the following - when trying to identify corresponding OVAL check for particular XCCDF rule the following scheme should be applied:<br>
* when there's is OVAL check for that product present in input/checks<br>
directory for that product, this OVAL check should be used with priority,<br>
* when there isn't, use the corresponding (equally named) OVAL check from<br>
shared/ directory.<br>
<br>
During the time we advanced the idea / concept even more in the sense that shared/ version of OVAL checks doesn't necessarily need to be working for all of the products having these checks (that's the case below mentioning there are shared/ OVAL checks used
 just for RHEL-7 &amp; Fedora systems, while<br>
RHEL-6 version is different / RHEL-6 product specific).<br>
<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; However, not all checks in the current ‘shared/oval’ folder are shared <br>
&gt; by all OS. For example, there are some that only apply to RHEL7 and <br>
&gt; Fedora, and not RHEL6.<br>
<br>
See the explanation above why that's the case.<br>
<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Any thoughts?<br>
<br>
If I should attempt to summary:<br>
* the concept of shared/ checks has proven to be beneficial (in the sense it's<br>
less work to keep just one concrete copy updated than try to keep updated multiple<br>
identical copies),<br>
* the mechanism of symbolic links is not the way to go (since it's known not to work<br>
e.g. on Microsoft Windows OS systems),<br>
<br>
So IMHO we want to keep the shared/ OVAL checks / fixes concept, but implement it different way. Maybe as already suggested by modificating the build process to look not just into CWD for OVAL check / remediation fix, but also to look into particular subdirectory
 of shared/ directory (OVAL checks vs fixes) simultaneously with preserving priority (if there's OVAL check / fix present for that product, use that one. If there isn't and there's is symlink, use the /shared version. If there isn't even symlink, return no
 check / no fix available leading to 'notchecked' state).<br>
<br>
HTH<br>
<br>
Regards, Jan.<br>
--<br>
Jan iankko Lieskovsky / Red Hat Security Technologies Team<br>
<br>
P.S.: As the count of products we produce SCAP content for is only going to<br>
raise in the future, IMHO concept of /shared directory for OVAL checks &amp;<br>
fixes can only save us a lot of duplicate work in the future (when compared<br>
to the scenario of managing multiple copies of the same file on per product<br>
basis).<br>
<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Thanks!<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Best regards,<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Trey Henefield, CISSP<br>
&gt; <br>
&gt; Senior IAVA Engineer<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Ultra Electronics<br>
&gt; <br>
&gt; Advanced Tactical Systems, Inc.<br>
&gt; <br>
&gt; 4101 Smith School Road<br>
&gt; <br>
&gt; Building IV, Suite 100<br>
&gt; <br>
&gt; Austin, TX 78744 USA<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <a href="mailto:Trey.Henefield@ultra-ats.com" target="_blank">Trey.Henefield@ultra-ats.com</a><br>
&gt; <br>
&gt; Tel: <a href="tel:%2B1%20512%20327%206795%20ext.%20647" target="_blank">&#43;1 512 327 6795 ext. 647</a><br>
&gt; <br>
&gt; Fax: <a href="tel:%2B1%20512%20327%208043" target="_blank">&#43;1 512 327 8043</a><br>
&gt; <br>
&gt; Mobile: <a href="tel:%2B1%20512%20541%206450" target="_blank">&#43;1 512 541 6450</a><br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <a href="http://www.ultra-ats.com" target="_blank">www.ultra-ats.com</a><br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; Disclaimer<br>
&gt; The information contained in this communication from <br>
&gt; <a href="mailto:trey.henefield@ultra-ats.com" target="_blank">trey.henefield@ultra-ats.com</a> sent at 2015-04-08 17:13:55 is private<br>
&gt; and may be legally privileged or export controlled. It is intended <br>
&gt; solely for use by <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">
scap-security-guide@lists.fedorahosted.org</a> and<br>
&gt; others authorized to receive it. If you are not <br>
&gt; <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a> you are hereby notified<br>
&gt; that any disclosure, copying, distribution or taking action in <br>
&gt; reliance of the contents of this information is strictly prohibited and may be unlawful.<br>
&gt; <br>
&gt; <br>
&gt; --<br>
&gt; SCAP Security Guide mailing list<br>
&gt; <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
&gt; <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt; <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><o:p></o:p></p>
</div>
</div>
<p style="margin-bottom:12.0pt"><b><span style="font-size:7.5pt;font-family:&quot;Verdana&quot;,sans-serif;color:#666666">Disclaimer</span></b><span style="font-size:7.5pt;font-family:&quot;Verdana&quot;,sans-serif;color:#666666"><br>
The information contained in this communication from <b><a href="mailto:trey.henefield@ultra-ats.com" target="_blank">trey.henefield@ultra-ats.com</a>
</b>sent at 2015-04-09 10:04:14 is private and may be legally privileged or export controlled. It is intended solely for use by
<b><a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
</b>and others authorized to receive it. If you are not <b><a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
</b>you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>