Before we could be ACK'ed (for commit), it needs some changes, primarily relating to granularity as noted in https://fedorahosted.org/scap-security-guide/wiki/newxccdf . The overall goal is to include the relevant information from the RHEL 5 prose document, but translate it into XCCDF in a way that facilitates its re-use by different parties (and straightforward automation).
There was also some discussion in https://fedorahosted.org/pipermail/scap-security-guide/2012-April/000185.htm... suggesting one CCE per Rule (as the preferred level of granularity).
There are some benefits to this:
1) This will position us (and Mitre) to easily verify the correspondence/agreement between CCE description and XCCDF description.
2) After a set of OVAL checks is run, an admin (or a C&A person) may only see a list of pass/fail results. When possible, we want to keep these precise to enable well-informed decisions. This is also relevant to the eventual addition of <fix> tags, which may attempt to tie a remediation action to a particular check's result.
The software also could have changed since RHEL 5, and we should not assume that there are no errors in the RHEL 5 document to begin with. I noticed that there is a squid user as the owner (of presumably a sub-task) of the squid service. In your testing, does the product now do (out of the box) what the lower_privileges Rule suggests configuring for RHEL 5 (for the most part)? If so, we can drop that. I'm also generally a bit more reluctant now to suggest things like altering system startup scripts; this affects our ability to verify their integrity.
Thanks, Jeff