[CentOS] CentOS 7.3.1611 scap-security-guide issue

Michał Jankowski

pielu at pielu.ch
Wed Feb 1 16:15:52 UTC 2017


Hello,

I have noticed that pci-dss profile, ssg-centos7-xccdf.xml will always fail
on test and remediation for disable_prelink rule. That seem to be caused by
insufficient CentOS RPM customization of upstream code. Specifically this:
https://github.com/OpenSCAP/scap-security-guide/blob/master/shared/oval/disable_prelink.xml#L24-L35
<https://github.com/OpenSCAP/scap-security-guide/blob/master/shared/oval/disable_prelink.xml>

That condition will always fail on CentOS because it misses:
<extend_definition comment="Installed OS is CentOS7" definition_ref="
installed_OS_is_centos7" />

I was thinking about raising a bug on https://bugs.centos.org or committing
a fix in https://git.centos.org/summary/rpms!scap-security-guide but I am
unsure as to what action should I take.

The other issue I'm facing is trying to workaround the disable_prelink rule
by simply taking it out of tests. I have create a tailor file but it
doesn't seem to be taken into consideration. The file:
<?xml version="1.0" encoding="UTF-8"?>
<cdf-11-tailoring:Tailoring xmlns:cdf-11-tailoring="
http://open-scap.org/page/Xccdf-1.1-tailoring" xmlns:xccdf="
http://checklists.nist.gov/xccdf/1.1"
id="xccdf_scap-workbench_tailoring_default">
  <cdf-11-tailoring:benchmark href="/private/tmp/ssg-centos7-xccdf.xml"/>
  <cdf-11-tailoring:version
time="2017-01-31T14:41:00">1</cdf-11-tailoring:version>
  <xccdf:Profile id="pci-dss_disable_rule_prelink" extends="pci-dss">
    <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml"
xml:lang="en-US" override="true">PCI-DSS v3 Control Baseline for CentOS
Linux 7 [CUSTOMIZED]</xccdf:title>
    <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml"
xml:lang="en-US" override="true">This is a *draft* profile for PCI-DSS
v3</xccdf:description>
    <xccdf:select idref="disable_prelink" selected="false"/>
  </xccdf:Profile>
</cdf-11-tailoring:Tailoring>

Then the oscap command I tried:
oscap xccdf eval --remediate --tailoring-file tailor.xml --profile pci-dss
--fetch-remote-resources
/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml

It is my debut on the list, thank you for your consideration :-)



More information about the CentOS mailing list