Woo Hoo! 2 for 1! 



I didn't dig into why oscap-anaconda-addon is not showing anything on SL Security Profiles, so you might need to do a bit more digging there. (Our patched version, which depends on your patch, shows everything I expected from the start.)



That may require more release-level jiggering than you want to do, at this time, but that's for you to figure out how to handle...



Sorry I didn't catch these in testing when I should have, but we were preoccupied with other things and couldn't get to 7.7 in time.



On 9/17/19, 8:58 AM, "[log in to unmask] on behalf of Pat Riehecky" <[log in to unmask] on behalf of [log in to unmask]> wrote:



    We talked about putting scap-security-guide into security, I'll drop it 

    there instead of fastbugs.

    

    Pat

    

    On 9/17/19 8:29 AM, Pat Riehecky wrote:

    > Thanks Dave!

    >

    > I'll see about getting this patched and staged for fastbugs.

    >

    > Pat

    >

    > On 9/16/19 5:25 PM, Kraus, Dave (GE Healthcare) wrote:

    >> So, after I stopped beating my head against the code and switched 

    >> directions, I found the commit commentary for enable_derivatives.py 

    >> in the upstream scap-security-guide package. Looking at that and the 

    >> patches that were made between 0.1.40 and 0.1.43 to that file and the 

    >> dependent library build_derivatives.py, it became clear that there 

    >> was effort made to remove profiles and other content "that CentOS and 

    >> derivatives don't need or shouldn't do..." That may make for some 

    >> discussion about non-CentOS needs or desires in the upstream, 

    >> unfortunately...

    >>

    >> Given the upstream commits, I came up with the following patch (also 

    >> attached) which seems to effectively disable the filtering and 

    >> restore the previous profiles to our lists. I don't think the 

    >> remaining additions from the commits are doing anything to impair the 

    >> functionality of what remains of the ds and oval files, but I don't 

    >> have a good regression test to run. My test runs with remediation 

    >> that I did today seem to indicate that things fundamentally work. 

    >> YMMV...

    >>

    >> ------------------- Cut Here -----------------------

    >> diff -Naur 

    >> scap-security-guide-0.1.43-orig/build-scripts/enable_derivatives.py 

    >> scap-security-guide-0.1.43-new/build-scripts/enable_derivatives.py

    >> --- 

    >> scap-security-guide-0.1.43-orig/build-scripts/enable_derivatives.py 

    >> 2019-02-18 08:15:54.000000000 -0500

    >> +++ 

    >> scap-security-guide-0.1.43-new/build-scripts/enable_derivatives.py 

    >> 2019-09-16 17:01:53.777616290 -0400

    >> @@ -95,7 +95,6 @@

    >>           raise RuntimeError("No Benchmark found!")

    >>         for namespace, benchmark in benchmarks:

    >> -        ssg.build_derivatives.profile_handling(benchmark, namespace)

    >>           if not ssg.build_derivatives.add_cpes(benchmark, namespace, 

    >> mapping):

    >>               raise RuntimeError(

    >>                   "Could not add derivative OS CPEs to Benchmark '%s'."

    >> diff -Naur scap-security-guide-0.1.43-orig/ssg/build_derivatives.py 

    >> scap-security-guide-0.1.43-new/ssg/build_derivatives.py

    >> --- scap-security-guide-0.1.43-orig/ssg/build_derivatives.py 

    >> 2019-02-18 08:15:54.000000000 -0500

    >> +++ scap-security-guide-0.1.43-new/ssg/build_derivatives.py 

    >> 2019-09-16 17:02:22.770616290 -0400

    >> @@ -97,8 +97,6 @@

    >>                       rule.remove(ref)

    >>             for fix in rule.findall(".//{%s}fix" % (namespace)):

    >> -            if "fips" in fix.get("id"):

    >> -                rule.remove(fix)

    >>               sub_elems = fix.findall(".//{%s}sub" % (namespace))

    >>               for sub_elem in sub_elems:

    >>                   sub_elem.tail = re.sub(r"[\s]+- CCE-.*", "", 

    >> sub_elem.tail)

    >> ------------------- Cut Here -----------------------

    >>

    >>

    >> On 9/13/19, 2:23 PM, "Pat Riehecky" <[log in to unmask]> wrote:

    >>

    >>      I'm in a similar boat.  I fear I've not spent much time looking 

    >> at the

    >>      SCAP stuff since 7.2....

    >>           Pat

    >>           On 9/13/19 2:14 PM, Kraus, Dave (GE Healthcare) wrote:

    >>      > Ok. I had a feeling that was the case.

    >>      >

    >>      > Anything in particular you'd like me to dig deeper into? Some 

    >> bits of the enable_derivatives.py seem to be where I'd suspect 

    >> breakage, but I haven't figured a way to tap into them easily...

    >>      >

    >>

    >

    

    -- 

    Pat Riehecky

    

    Fermi National Accelerator Laboratory

    http://www.fnal.gov

    https://urldefense.proofpoint.com/v2/url?u=http-3A__www.scientificlinux.org&d=DwIGaQ&c=gRgGjJ3BkIsb5y6s49QqsA&r=gd8BzeSQcySVxr0gDWSEbBYBgsCHS7vSr83lHQ-aa58eXICk1KkzZlAHgohLRRrX&m=OEx33Kr4yBDibUTAwIrvhfWI9f4iOmbrC5Y9vkxW4n8&s=BKkpTHgQni8kZzp4wM5a-7NY-WcSjrKtDxhlWindThE&e=