On 11/26/19 9:05 AM, Kern, Thomas (CONTR) wrote:
Having the openscap tools available is great. I know that it is difficult to provide each distribution with SCAP control files to check for all compliance settings. It would be nice if there were SCAP control files for a 'Linux distribution independent' compliance scan, checking the setting of the most common compliance issues across all variations of Linux.
Has been discussed. Creating such content would be very cumbersome -- most linux distros keep things in different places (e.g. Fedora vs RHEL vs Ubuntu vs SLES), or have different implementations (AppArmor vs SELinux).
While SCAP does support if-clauses ("If SuSE, check AppArmor; elif RHEL, check SELinux") there hasn't been a development community form to take on that work. Patches welcome if someone wants to begin though!
It seems arm builds and arm repo for fedora are populated just fine - https://koji.fedoraproject.org/koji/buildinfo?buildID=1332384 https://dl.fedoraproject.org/pub/fedora/linux/releases/31/Everything/aarch64... https://dl.fedoraproject.org/pub/fedora/linux/releases/31/Everything/aarch64...
Foxy, installing Fedora on the Raspberry jsou give you chance to use OpenSCAP and SCAP Security Guide just fine :)
Regards, Marek
On Tue, Nov 26, 2019 at 3:43 PM Shawn Wells shawn@redhat.com wrote:
On 11/26/19 9:05 AM, Kern, Thomas (CONTR) wrote:
Having the openscap tools available is great. I know that it is
difficult to provide each distribution with SCAP control files to check for all compliance settings. It would be nice if there were SCAP control files for a 'Linux distribution independent' compliance scan, checking the setting of the most common compliance issues across all variations of Linux.
Has been discussed. Creating such content would be very cumbersome -- most linux distros keep things in different places (e.g. Fedora vs RHEL vs Ubuntu vs SLES), or have different implementations (AppArmor vs SELinux).
While SCAP does support if-clauses ("If SuSE, check AppArmor; elif RHEL, check SELinux") there hasn't been a development community form to take on that work. Patches welcome if someone wants to begin though! _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
scap-security-guide@lists.fedorahosted.org
-
Marek Haicman -
Shawn Wells