Hello,
I have noticed that pci-dss profile, ssg-centos7-xccdf.xml will always fail
on test and remediation for disable_prelink rule. That seem to be caused by
insufficient CentOS RPM customization of upstream code. Specifically this:
https://github.com/OpenSCAP/scap-security-guide/blob/master/shared/oval/disable_prelink.xml#L24-L35
<https://github.com/OpenSCAP/scap-security-guide/blob/master/shared/oval/disable_prelink.xml>
That condition will always fail on CentOS because it misses:
<extend_definition comment="Installed OS is CentOS7" definition_ref="
installed_OS_is_centos7" />
I was thinking about raising a bug on https://bugs.centos.org or committing
a fix in https://git.centos.org/summary/rpms!scap-security-guide but I am
unsure as to what action should I take.
The other issue I'm facing is trying to workaround the disable_prelink rule
by simply taking it out of tests. I have create a tailor file but it
doesn't seem to be taken into consideration. The file:
<?xml version="1.0" encoding="UTF-8"?>
<cdf-11-tailoring:Tailoring xmlns:cdf-11-tailoring="
http://open-scap.org/page/Xccdf-1.1-tailoring"; xmlns:xccdf="
http://checklists.nist.gov/xccdf/1.1";
id="xccdf_scap-workbench_tailoring_default">
<cdf-11-tailoring:benchmark href="/private/tmp/ssg-centos7-xccdf.xml"/>
<cdf-11-tailoring:version
time="2017-01-31T14:41:00">1</cdf-11-tailoring:version>
<xccdf:Profile id="pci-dss_disable_rule_prelink" extends="pci-dss">
<xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml";
xml:lang="en-US" override="true">PCI-DSS v3 Control Baseline for CentOS
Linux 7 [CUSTOMIZED]</xccdf:title>
<xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml";
xml:lang="en-US" override="true">This is a *draft* profile for PCI-DSS
v3</xccdf:description>
<xccdf:select idref="disable_prelink" selected="false"/>
</xccdf:Profile>
</cdf-11-tailoring:Tailoring>
Then the oscap command I tried:
oscap xccdf eval --remediate --tailoring-file tailor.xml --profile pci-dss
--fetch-remote-resources
/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml
It is my debut on the list, thank you for your consideration :-)
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
