(Note: If acknowledged, this push will also include a 280K file with the RHEL 5 CCE list.)
This patchset is designed to allow for display of the CCEs that are
currently included as idents in the the RHEL 6 XCCDF contents.
This will allow for easier identification of any incorrect CCE references in the XCCDF content.
It should also allow for easier request of CCEs for RHEL 6.
Technically, the (semantically identical) CCE references we are using are incorrect; the CCEs
are really only for RHEL 5. Mitre have asked me not to do this and we will not release with these
CCEs. However, we will need proper ones before a release is issued.
Jeffrey Blank (4):
added support for generating CCE table (RHEL 5 vs RHEL 6)
added NIST 800-53 ref origin to table with DISA CCI refs
new transform to show CCE list (and compare RHEL 6 Rules with CCEs
desc/mechanisms for RHEL 5)
new script which extracts platform-specific CCEs from master CCE list
* because apparently only the master list is provided in XML,
and it's 10MB * this gets us down to about 280K for the RHEL
5-specific CCE list
RHEL6/Makefile | 8 +-
RHEL6/transforms/cce_extract.py | 51 ++++++++++
RHEL6/transforms/xccdf2table-cce.xslt | 115 ++++++++++++++++++++++
RHEL6/transforms/xccdf2table-profileccirefs.xslt | 17 +++-
4 files changed, 187 insertions(+), 4 deletions(-)
create mode 100755 RHEL6/transforms/cce_extract.py
create mode 100644 RHEL6/transforms/xccdf2table-cce.xslt
I believe this puts the table at completion for noting current transition action.
Thanks Gary! And contributions via email are just fine from anybody if you have
contributions but aren't familiar with git yet.
(I'm also pushing since this already implies two-party agreeement.)
This allows firm understanding/documentation on the items that need to be
migrated into the project immediately to make it complete, versus the items
that still require discussion (which were not covered at the consensus meeting).
This means that a list of requirements for consideration is very close at hand
(and the current status is also fully visible).
Jeffrey Blank (1):
more transition notes help from Gary / Aqueduct
RHEL6/input/auxiliary/transition_notes.xml | 56 ++++++++++++++++++++++++++++
1 files changed, 56 insertions(+), 0 deletions(-)
Oops. I went ahead and pushed without notifying the list.
There were two br tags in system/auditing that were breaking make validate.
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index f94161d..8d14443 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -115,8 +115,6 @@ process during boot.
> <ref nist="AU-2" disa="1464,130" />
> -<br /><br />
> <Group id="configure_auditd_data_retention">
This is in line with the permissions checking strategy discussed here:
This page is meant to document development of a coherent strategy for file
permissions checking for baselines.
Jeffrey Blank (1):
added Rules for file permission checks. * This likely needs
further prose expansion, but captures intent for now * OVAL
RHEL6/input/system/permissions/files.xml | 102 ++++++++++++++++++++++++++++--
1 files changed, 97 insertions(+), 5 deletions(-)