[PATCH 1/2] [RHEL/6] Add upstream STIG for RHEL 6 Server profile disclaimer into the scap-security-guide manual page and also into dedicated file under the package's /doc directory.

[Shawn Wells]

On 5/26/14, 10:56 AM, Jan Lieskovsky wrote:
> 0001-RHEL-6-Add-upstream-STIG-for-RHEL-6-Server-profile-d.patch
>
> From 2f86166884ea549069d53416b421943dbb97d25b Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky
> Date: Mon, 26 May 2014 15:35:02 +0200
> Subject: [PATCH 1/2] [RHEL/6] Add upstream STIG for RHEL 6 Server profile
>   disclaimer into the scap-security-guide          manual page and also into
>   dedicated file under the package's /doc directory.
> Signed-off-by: Jan Lieskovsky
>
> ...STREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER | 16 ++++++++++
>   RHEL/6/input/auxiliary/scap-security-guide.8       | 34 ++++++++++++++--------
>   scap-security-guide.spec                           |  2 +-
>   3 files changed, 39 insertions(+), 13 deletions(-)
>   create mode 100644 RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
>
> diff --git a/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER b/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
> new file mode 100644
> index 0000000..56bd564
> --- /dev/null
> +++ b/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
> @@ -0,0 +1,16 @@
> +The upstream STIG for RHEL 6 Server profile "stig-rhel6-server-upstream" is
> +developed under the DoD consensus model and DISA FSO Vendor STIG process,
> +serving as the upstream development environment for the Red Hat Enterprise
> +Linux 6 Server STIG.
>
> +As a result of the upstream/downstream relationship between the SCAP Security
> +Guide project and the official DISA FSO STIG baseline, users should expect
> +variance between SSG and DISA FSO content. For official DISA FSO STIG content,
> +refer tohttp://iase.disa.mil/stigs/os/unix/red_hat.html.
>
> +While this profile is packaged by Red Hat as part of the SCAP Security Guide
> +package, please note that commercial support of this SCAP content is NOT
> +available. This profile is provided as example SCAP content with no endorsement
> +for suitability or production readiness. Support for this profile is provided
> +by the upstream SCAP Security Guide community on a best-effort basis. The
> +upstream project homepage ishttps://fedorahosted.org/scap-security-guide/.

The filename is a bit long in the tooth; perhaps just "DISCLAIMER"? It's 
a nitpick, but many users will likely be familiar with "DISCLAIMER" as 
the filename.
> diff --git a/RHEL/6/input/auxiliary/scap-security-guide.8 b/RHEL/6/input/auxiliary/scap-security-guide.8
> index da81608..44ae1ab 100644
> --- a/RHEL/6/input/auxiliary/scap-security-guide.8
> +++ b/RHEL/6/input/auxiliary/scap-security-guide.8
> @@ -34,8 +34,17 @@ security posture of DoD's security systems by providing the Security Technical
>   Implementation Guides (STIGs). This profile was created as a collaboration
>   effort between the National Security Agency, DISA FSO, and Red Hat.
>
> -For additional information relating to STIGs, please refer to the DISA FSO
> -webpage athttp://iase.disa.mil/stigs/
> +As a result of the upstream/downstream relationship between the SCAP Security
> +Guide project and the official DISA FSO STIG baseline, users should expect
> +variance between SSG and DISA FSO content. For additional information relating
> +to STIGs, please refer to the DISA FSO webpage athttp://iase.disa.mil/stigs/
>
> +While this profile is packaged by Red Hat as part of the SCAP Security Guide
> +package, please note that commercial support of this SCAP content is NOT
> +available. This profile is provided as example SCAP content with no
> +endorsement for suitability or production readiness. Support for this profile
> +is provided by the upstream SCAP Security Guide community on a best-effort
> +basis. The upstream project homepage ishttps://fedorahosted.org/scap-security-guide/.
>
> .RE
>   .I usgcb-rhel6-server
> @@ -59,7 +68,7 @@ webpage athttp://usgcb.nist.gov/usgcb_content.html.
>
> .SH EXAMPLES
> -To scan your system utilizing the OpenSCAP utility against the
> +To scan your system utilizing the OpenSCAP utility against the
>   stig-rhel6-server-upstream profile:
>
> oscap  xccdf eval --profile stig-rhel6-server-upstream \
> @@ -103,7 +112,7 @@ conforms to.
>
> .SH STATEMENT OF SUPPORT
>   The SCAP Security Guide, an open source project jointly maintained by Red Hat
> -and the NSA, provides XCCDF and OVAL content for Red Hat technologies. As an open
> +and the NSA, provides XCCDF and OVAL content for Red Hat technologies. As an open
>   source project, community participation extends into U.S. Department of Defense
>   agencies, civilian agencies, academia, and other industrial partners.
>
> @@ -112,13 +121,14 @@ Packages for Enterprise Linux (EPEL) repository. As such, SCAP Security Guide
>   content is considered "vendor provided."
>
> Note that while Red Hat hosts the infrastructure for this project and
> -Red Hat engineers are involved as maintainers and leaders, there is no
> +Red Hat engineers are involved as maintainers and leaders, there is no
>   commercial support contracts or service level agreements provided by Red Hat.
>
> Support, for both users and developers, is provided through the SCAP Security
>   Guide community.
>
> Homepage:https://fedorahosted.org/scap-security-guide/
> +.PP
>   Mailing List:https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> .SH DEPLOYMENT TO U.S. CIVILIAN GOVERNMENT SYSTEMS
> @@ -136,11 +146,11 @@ Information Systems Agency (DISA) to "develop and provide security configuration
>   guidance for IA and IA-enabled IT products in coordination with Director, NSA."
>   The output of this authority is the DISA Security Technical Implementation Guides,
>   or STIGs. DISA FSO is in the process of moving the STIGs towards the use
> -of the NIST Security Content Automation Protocol (SCAP) in order to "automate"
> +of the NIST Security Content Automation Protocol (SCAP) in order to "automate"
>   compliance reporting of the STIGs.
>
> -Through a common, shared vision, the SCAP Security Guide community enjoys
> -close collaboration directly with NSA and DISA FSO. As stated in Section 1.1 of
> +Through a common, shared vision, the SCAP Security Guide community enjoys
> +close collaboration directly with NSA and DISA FSO. As stated in Section 1.1 of
>   the RHEL6 STIG Overview, Version 1, Release 2, issued on 03-JUNE-2013:
>
> "The consensus content was developed using an open-source project called SCAP
> @@ -155,10 +165,10 @@ DoD RHEL6 STIG contains only XCCDF content and is available online:
>   http://iase.disa.mil/stigs/os/unix/red_hat.html
>
> Content published against the iase.disa.mil website  is authoritative
> -STIG content. The SCAP Security Guide project, as noted in the STIG overview,
> -is considered upstream content. Unlike DISA FSO, the SCAP Security Guide project
> -does publish OVAL automation content. Individual programs and C&A evaluators
> -make program-level determinations on the direct usage of the SCAP Security Guide.
> +STIG content. The SCAP Security Guide project, as noted in the STIG overview,
> +is considered upstream content. Unlike DISA FSO, the SCAP Security Guide project
> +does publish OVAL automation content. Individual programs and C&A evaluators
> +make program-level determinations on the direct usage of the SCAP Security Guide.
>   Currently there is no blanket approval.
>
> .SH SEE ALSO
> diff --git a/scap-security-guide.spec b/scap-security-guide.spec
> index ef13559..fad1c6f 100644
> --- a/scap-security-guide.spec
> +++ b/scap-security-guide.spec
> @@ -50,7 +50,7 @@ cp -a RHEL/6/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
>   %files
>   %{_datadir}/xml/scap
>   %lang(en) %{_mandir}/en/man8/scap-security-guide.8.gz
> -%doc RHEL/6/LICENSE RHEL/6/output/rhel6-guide.html RHEL/6/output/table-rhel6-cces.html RHEL/6/output/table-rhel6-nistrefs-common.html RHEL/6/output/table-rhel6-nistrefs.html RHEL/6/output/table-rhel6-srgmap-flat.html RHEL/6/output/table-rhel6-srgmap-flat.xhtml RHEL/6/output/table-rhel6-srgmap.html RHEL/6/output/table-rhel6-stig.html JBossEAP5/docs/JBossEAP5_Guide.html
> +%doc RHEL/6/LICENSE RHEL/6/output/rhel6-guide.html RHEL/6/output/table-rhel6-cces.html RHEL/6/output/table-rhel6-nistrefs-common.html RHEL/6/output/table-rhel6-nistrefs.html RHEL/6/output/table-rhel6-srgmap-flat.html RHEL/6/output/table-rhel6-srgmap-flat.xhtml RHEL/6/output/table-rhel6-srgmap.html RHEL/6/output/table-rhel6-stig.html RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER JBossEAP5/docs/JBossEAP5_Guide.html
>
> %changelog
> Fri May 09 2014 Jan iankko Lieskovsky  0.1.17-1
>
> -- 1.8.3.1
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

[Jan Lieskovsky]

----- Original Message -----
> From: "Shawn Wells" 
> To: [e-mail]
> Sent: Tuesday, May 27, 2014 6:36:29 PM
> Subject: Re: [PATCH 1/2] [RHEL/6] Add upstream STIG for RHEL 6 Server profile	disclaimer into the scap-security-guide
> manual page and also into	dedicated file under the package's /doc directory.
>
> On 5/26/14, 10:56 AM, Jan Lieskovsky wrote:
>
> 0001-RHEL-6-Add-upstream-STIG-for-RHEL-6-Server-profile-d.patch
> From 2f86166884ea549069d53416b421943dbb97d25b Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky  Date: Mon, 26 May 2014 15:35:02
> +0200
> Subject: [PATCH 1/2] [RHEL/6] Add upstream STIG for RHEL 6 Server profile
>  disclaimer into the scap-security-guide          manual page and also into
>  dedicated file under the package's /doc directory.
>
> Signed-off-by: Jan Lieskovsky  ---
>  ...STREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER | 16 ++++++++++
>  RHEL/6/input/auxiliary/scap-security-guide.8       | 34
>  ++++++++++++++--------
>  scap-security-guide.spec                           |  2 +-
>  3 files changed, 39 insertions(+), 13 deletions(-)
>  create mode 100644
>  RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
>
> diff --git
> a/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
> b/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
> new file mode 100644
> index 0000000..56bd564
> --- /dev/null
> +++
> b/RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
> @@ -0,0 +1,16 @@
> +The upstream STIG for RHEL 6 Server profile "stig-rhel6-server-upstream" is
> +developed under the DoD consensus model and DISA FSO Vendor STIG process,
> +serving as the upstream development environment for the Red Hat Enterprise
> +Linux 6 Server STIG.
>
> +As a result of the upstream/downstream relationship between the SCAP
> Security
> +Guide project and the official DISA FSO STIG baseline, users should expect
> +variance between SSG and DISA FSO content. For official DISA FSO STIG
> content,
> +refer to http://iase.disa.mil/stigs/os/unix/red_hat.html .
>
> +While this profile is packaged by Red Hat as part of the SCAP Security Guide
> +package, please note that commercial support of this SCAP content is NOT
> +available. This profile is provided as example SCAP content with no
> endorsement
> +for suitability or production readiness. Support for this profile is
> provided
> +by the upstream SCAP Security Guide community on a best-effort basis. The
> +upstream project homepage is https://fedorahosted.org/scap-security-guide/ .
>
> The filename is a bit long in the tooth; perhaps just "DISCLAIMER"? It's a
> nitpick, but many users will likely be familiar with "DISCLAIMER" as the
> filename.

Thanks, Shawn. Agree that the filename was way too long. Shortened to your
proposal & pushed to master:
  https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=e05053e...

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
> --
> Shawn Wells
> Director, Innovation Programs [e-mail] | 443.534.0130
> @shawndwells
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide