On 4/13/12 2:20 PM, Jeffrey Blank wrote:
Attached is a patch that demonstrates a method for adding fixes in a modular way.
It should allow fixes from different "systems" (bash, puppet, chef(?), well whatever) and even different sets of fixes from the same "system" (such as different sets of Puppet modules designed for different use cases) to be linked into XCCDF output easily, and also would keep remediation resources discrete from both each other and the main project. It depends on linkage to Rules via id.
Comments are solicited.
Assuming I understand correctly (and that's a big assumption!....) this would allow us to modify our existing content and include something like:
<Rule id="audit_config_immutable"> <title>Make the <tt>auditd</tt> Configuration Immutable</title> <description>Add the following to <tt>/etc/audit/audit.rules</tt> in order to make the configuration immutable: <pre>-e 2</pre> With this setting, a reboot will be required to change any audit rules. </description> <rationale>Making the audit configuration immutable prevents the accidential as well as malicious modification of the audit rules.</rationale> <ident cce="14692-8" /> <oval id="audit_rules_immutable" /> <ref nist="AU-2" />/ *<fix group="audit_config_immutable">*/ </Rule>
Then within input/fixes/bash.xml I would add something like this?
<fix-group id="audit_config_immutable" system="urn:xccdf:fix:script:bash" xmlns="http://checklists.nist.gov/xccdf/1.1"> <fix rule="audit_selinux_perms">do something in bash</fix> <fix rule="audit_append_e">do something else in bash</fix> </fix-group>