clarify the unix-def:password_test and the unix-def:shadow_test documentation

[djhaynes]

There have been a few threads bringing up concerns with the existing unix-def:password_test and unix-def:shadow_test. To address this, it may just require documentation updates or it could require the development of new tests (e.g. a test for checking user accounts on UNIX systems). In doing so, we should make sure that we do not break any existing content that may already use the unix-def:password_test and unix-def:shadow_test.

Please see the following oval-developer-list posts for additional information.

http://making-security-measurable.1364806.n2.nabble.com/unix-password-and-unix-shadow-on-MacOS-X-tp7578477.html

http://making-security-measurable.1364806.n2.nabble.com/unix-password-test-tp7579458.html

http://making-security-measurable.1364806.n2.nabble.com/Does-ovaldi-implement-ObjectType-entity-var-check-tp7578413p7578426.html (search for "Potential issues with OVAL regarding UNIX and external authentication sources")

[djhaynes]

Based on further community discussion (http://making-security-measurable.1364806.n2.nabble.com/Documentation-update-for-unix-password-shadow-tests-tp7581069.html), we are going to hold off on making any changes to the password_test and shadow_test documentation until we make further progress with the generic UNIX account test (OVALProject/Sandbox#104). As a result, this tracker has been deferred to a later OVAL 5.11 draft.

[solind]

Punting to 5.12.

[zport]

Issue moved to OVAL-Community/OVAL #67 via ZenHub