Re: adding fixes -- a proposed patch
On 4/13/12 2:20 PM, Jeffrey Blank wrote:
Attached is a patch that demonstrates a method for adding fixes in a
modular way.
It should allow fixes from different "systems" (bash, puppet, chef(?),
well whatever) and even different sets of fixes from the same "system"
(such as different sets of Puppet modules designed for different use
cases) to be linked into XCCDF output easily, and also would keep
remediation resources discrete from both each other and the main
project. It depends on linkage to Rules via id.
Comments are solicited.
Assuming I understand correctly (and that's a big assumption!....) this
would allow us to modify our existing content and include something like:
<Rule id="audit_config_immutable">
<title>Make the <tt>auditd</tt> Configuration Immutable</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt> in
order
to make the configuration immutable:
<pre>-e 2</pre>
With this setting, a reboot will be required to change any
audit rules.
</description>
<rationale>Making the audit configuration immutable prevents the
accidential as
well as malicious modification of the audit rules.</rationale>
<ident cce="14692-8" />
<oval id="audit_rules_immutable" />
<ref nist="AU-2" />/
*<fix group="audit_config_immutable">*/
</Rule>
Then within input/fixes/bash.xml I would add something like this?
<fix-group id="audit_config_immutable"
system="urn:xccdf:fix:script:bash"
xmlns="http://checklists.nist.gov/xccdf/1.1">
<fix rule="audit_selinux_perms">do something in bash</fix>
<fix rule="audit_append_e">do something else in bash</fix>
</fix-group>
Attachments:
- attachment.html (text/html — 2.4 KB)