adding fixes -- a proposed patch
by Jeffrey Blank
Attached is a patch that demonstrates a method for adding fixes in a
modular way.
It should allow fixes from different "systems" (bash, puppet, chef(?),
well whatever) and even different sets of fixes from the same "system"
(such as different sets of Puppet modules designed for different use
cases) to be linked into XCCDF output easily, and also would keep
remediation resources discrete from both each other and the main
project. It depends on linkage to Rules via id.
Comments are solicited.
10 years, 11 months
httpd related patches
by Willy Santos
All,
Attached you will find the httpd patches I've been working on for the
Team's review. Forgive the amount of files, there was a lot of content
to be added and some changes done after further review of the initial
commits, brief description below. Feel free to contact me if you have
any questions.
0001,0002,0004,0017 - Prose content for http.xml
0003,0005,0006,0007, 0008, 0009, 0010, 0011, 0018 - OVAL checks related
to httpd
-Willy
--
Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos(a)redhat.com
10 years, 11 months
[PATCH] added transform to map SRG elements to guidance Rules
by Jeffrey Blank
---
rhel6/src/transforms/table-srgmap.xslt | 117 ++++++++++++++++++++++++++++++++
1 files changed, 117 insertions(+), 0 deletions(-)
create mode 100644 rhel6/src/transforms/table-srgmap.xslt
diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt
new file mode 100644
index 0000000..a502d24
--- /dev/null
+++ b/rhel6/src/transforms/table-srgmap.xslt
@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG),
+ and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents).
+ The output shows how a body of XCCDF meets SRG requirements. -->
+
+<xsl:include href="constants.xslt"/>
+
+<xsl:variable name="rules" select="document($map-to-rules)//cdf:Rule" />
+<!-- expecting external variable "map-to-rules" is filename to an XCCDF document with Rules -->
+<xsl:variable name="title" select="document($map-to-rules)/cdf:Benchmark/cdf:title" />
+
+ <xsl:template match="/">
+ <html>
+ <head>
+ <title>
+ CCIs from <xsl:value-of select="cdf:Benchmark/cdf:title"/> Mapped to <xsl:value-of select="$title"/>
+ </title>
+ </head>
+ <body>
+ <br/> <br/>
+ <div style="text-align: center; font-size: x-large; font-weight:bold">
+ CCIs from <xsl:value-of select="cdf:Benchmark/cdf:title"/> Mapped to <xsl:value-of select="$title"/>
+ </div>
+ <br/> <br/>
+ <xsl:apply-templates select="cdf:Benchmark"/>
+ </body>
+ </html>
+ </xsl:template>
+
+
+ <xsl:template match="cdf:Benchmark">
+ <style type="text/css">
+ table
+ {
+ border-collapse:collapse;
+ }
+ table,th, td
+ {
+ border: 1px solid black;
+ vertical-align: top;
+ padding: 3px;
+ }
+ thead
+ {
+ display: table-header-group;
+ font-weight: bold;
+ }
+ </style>
+ <table>
+ <thead>
+ <td>SRG ID</td>
+ <td>CCI ID</td>
+ <td>SRG Title</td>
+ <td>SRG Description</td>
+ <td>Rules Mapped</td>
+ </thead>
+ <xsl:for-each select=".//cdf:Rule">
+ <xsl:sort select="cdf:version"/>
+ <xsl:call-template name="output-rule-info">
+ <xsl:with-param name="srg_id"><xsl:value-of select="cdf:version"/></xsl:with-param>
+ <xsl:with-param name="srg_cci"><xsl:value-of select="cdf:ident"/></xsl:with-param>
+ <xsl:with-param name="srg_title"><xsl:value-of select="cdf:title"/></xsl:with-param>
+ <xsl:with-param name="srg_desc"><xsl:value-of select="cdf:description"/></xsl:with-param>
+ </xsl:call-template>
+ </xsl:for-each>
+ </table>
+ </xsl:template>
+
+ <xsl:template name="output-rule-info">
+ <xsl:param name="srg_id" />
+ <xsl:param name="srg_cci" />
+ <xsl:param name="srg_title" />
+ <xsl:param name="srg_desc" />
+ <tr>
+ <td> <xsl:value-of select="$srg_id"/> </td>
+ <td> <xsl:value-of select="$srg_cci"/> </td>
+ <td> <xsl:value-of select="$srg_title"/> </td>
+ <td> <xsl:value-of select="$srg_desc"/> </td>
+ <td>
+ <!-- iterate over the Rules in the (externally-provided) XCCDF document -->
+ <xsl:for-each select="$rules">
+ <xsl:variable name="rule" select="."/>
+ <table>
+ <xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
+ <xsl:if test="self::node()[text()=$srg_cci]" >
+ <tr>
+ <td> <xsl:value-of select="$rule/cdf:title"/> </td>
+ <td> <xsl:apply-templates select="$rule/cdf:description"/> </td>
+ </tr>
+ </xsl:if>
+ </xsl:for-each>
+ </table>
+ </xsl:for-each>
+ </td>
+ </tr>
+ </xsl:template>
+
+ <!-- get rid of XHTML namespace since we're outputting to HTML -->
+ <xsl:template match="xhtml:*">
+ <xsl:element name="{local-name()}">
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:element>
+ </xsl:template>
+
+ <xsl:template match="@*|node()">
+ <xsl:copy>
+ <xsl:apply-templates select="@*|node()"/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="cdf:description">
+ <xsl:apply-templates select="@*|node()" />
+ </xsl:template>
+
+</xsl:stylesheet>
--
1.7.1
10 years, 11 months
SSG M1 Objectives
by Kevin Spargur
Hey all,
I've done a quick review of the SSG as far as were we stand in
comparison milestone 1 objectives. We are missing roughly 195/634 or
about 31% of the line items needed to meet milestone 1. The exact line
items missing are specified in the attached. I've opened tickets for
each piece up on the SSG site
(https://fedorahosted.org/scap-security-guide/report/2). If your
working on a section it would be great if you took the ticket so we can
try and avoid duplication of effort where possible.
Thanks,
Kevin Spargur
10 years, 11 months
the rules for adding Rules
by Jeffrey Blank
I've added some guidelines for what constitutes good Rule-writing to the
wiki at:
https://fedorahosted.org/scap-security-guide/wiki/newxccdf
(This is also linked from the main page in "How to Create a New Guidance
Item in XCCDF").
TLDR? Perhaps. But there are a few recent commits that provided
excellent content but which I may reformat to be consistent with these
guidelines.
10 years, 11 months
coming soon: consistency checking scripts
by Jeffrey Blank
We'll shortly be committing a script to do checking for consistency
between our OVAL and XCCDF. This should detect situations such as:
1)
a reference from an XCCDF rule to an OVAL definition that doesn't exist.
2)
an XCCDF rule exists (and is used in a profile) but doesn't include any
reference to a check.
3)
mismatch between filename and OVAL definition name (as this is an
important convention for our approach to modular definitions)
4)
others?
--
___________________________
Jeffrey Blank
410-854-8675
Global Mitigations
NSA Information Assurance
10 years, 11 months
[patch] Ident element should represent a single identifier.
by Šimon Lukašík
Attached please find a patch to split up multiple values within single
ident element. It avoids things like the following
<ident system="http://cce.mitre.org">
4360-4,4378-6,4492-5,4263-0,3502-2,4449-5,
4361-2,4427-1,4321-6,4339-8,4105-3,3718-4
</ident>
The separations will also help applications (Spacewalk for example) with
data processing, storing to database, etc.
Thank You.
--
Simon Lukasik
10 years, 11 months
Content of Ident elements
by Šimon Lukašík
Hello list,
In the current content there seems to be mixed two approaches how to
devise the ident:
(1) <ident system="http://cce.mitre.org">4365-3</ident>
(2) <ident system="http://cce.mitre.org">CCE-4112-9</ident>
I would like to not mix two. For instance usgsb-for-rhel5-desktop uses
exclusively the latter one. Even thought in the second approach there
seems to be kind of duplicity, I prefer it.
Would be a patch converting (1) to (2) acceptable for you?
--
Simon Lukasik
10 years, 11 months