On 08/01/2013 06:44 PM, Truhn, Chad M CTR NSWCDD, CXA30 wrote: >> And here is my take: There might be organization which will need to have a >> package (like acpid) installed (for some inevitable monthly use-case) but >> they would agree that it should not be run by deafult. Such organization >> could easily use tailoring feature to turn-off the `uninstall` check. > > +1 > > I tried to come up with a way of saying this earlier, but couldn't figure out > a good way. I do know that people do use these guides for some in-house > policy creation stuff. > > That being said - I don't know if I am convinced the good (rare cases like > this) outweighs the harm (false positives and redundancy to the masses). >
The false positives can be easily avoided: Add a criterion to the `disabled` definition. That will point out to the test of `uninstalled` test. > - Chad > > > _______________________________________________ > scap-security-guide mailing list > [email protected] > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
