[PATCH 0/5] cleanup of table transforms
by Jeffrey Blank
This removes XSLT code that is no longer necessary (due to improvements in
openscap's xccdf resolve functionality) and also refactors a common style
element to a shared file.
This also removes some table outputs altogether; the new "overlay" will take
care of some of these instead.
The overlay concept should enable more complete realization of vendor-provided
SCAP content in the future.
Jeffrey Blank (5):
removing unneeded outputs, commented lines * also some renaming
of some outputs
new file for common style element for all table transforms
simplification of profile-based table transforms * this is
possible due to oscap xccdf resolve working * now we don't need
recursion
cleanup and simplication of table transform with references
table transforms now use shared style element
RHEL6/Makefile | 42 ++-----
RHEL6/transforms/table-srgmap.xslt | 20 +---
RHEL6/transforms/table-style.xslt | 27 ++++
RHEL6/transforms/xccdf2table-byref.xslt | 100 ++++------------
RHEL6/transforms/xccdf2table-cce.xslt | 19 +---
RHEL6/transforms/xccdf2table-profileccirefs.xslt | 133 ++-------------------
RHEL6/transforms/xccdf2table-profilenistrefs.xslt | 78 ++-----------
RHEL6/transforms/xccdf2table-stig.xslt | 22 +---
8 files changed, 87 insertions(+), 354 deletions(-)
create mode 100644 RHEL6/transforms/table-style.xslt
11 years
Remediation Scripts
by Shawn Wells
I've been taking a few off-list questions around remediation lately,
namely from interested parties asking "where do we start?" Wanted to
move those conversations to on-list. Here's a few of the common
questions and my thoughts to get us started.
(1) What language(s) should be used?
IMO, bash. I'm leaning this way because it's included in *every* RHEL
release, whereas puppet modules would require the installation of 3rd
party software. I'd like to see as much done through 'native' tools as
possible. There's certainly advantages to Perl (e.g., potential speed)
however I don't think we want to assume Perl is installed on all RHEL
machines.
(2) Do we perform checking in the scripts?
Defined further, should the scripts contain conditional checks to see if
they should be ran?
IMO, no. That's what OVAL is for.
(3) Where do we begin?
- Name remediation scripts after corresponding XCCDF rule
- Build process includes them into final ssg-rhel6-xccdf.xml
Known challenge on passing XCCDF variables through to the scripts,
however I wouldn't let this hold us up. Still *tons* of work to be done
while this gets sorted.
There's a good bit of RHEL6 content in the Aqueduct project that (I
believe) Tresys committed. Perhaps we could reuse those scripts?
11 years
[PATCH 1/2] Bash Fix: Adding a common function for removing NIS inclusion lines
by Francisco Slavin
---
RHEL6/input/fixes/bash/no_nis_inclusions_common | 30 +++++++++++++++++++++++
1 files changed, 30 insertions(+), 0 deletions(-)
create mode 100755 RHEL6/input/fixes/bash/no_nis_inclusions_common
diff --git a/RHEL6/input/fixes/bash/no_nis_inclusions_common b/RHEL6/input/fixes/bash/no_nis_inclusions_common
new file mode 100755
index 0000000..b63e077
--- /dev/null
+++ b/RHEL6/input/fixes/bash/no_nis_inclusions_common
@@ -0,0 +1,30 @@
+# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA
+#
+# This software was developed by Tresys Technology LLC
+# with U.S. Government sponsorship.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# Delete entries that begin with the +: nis entry.
+#
+# arguments:
+# delete_nis_lines(FILE)
+# FILE - File to check for nis lines.
+#
+delete_nis_lines(){
+ FILE=$1
+
+ [ -f "$FILE" ] || exit 1
+
+ /bin/sed -i -e "/^\+\:.*/d" "$FILE"
+}
--
1.7.1
11 years
Signed content purpose question
by Matt Micene
A follow up from the SCAP workshops that Shawn and Jeff hosted this week
(great job guys) on the topic of signed content.
What is the intent for having DISA / NIST / AuthorityX signing SCAP
content for delivery? Are people looking for full attestation or
validation? Neither addresses the challenge of what to do with local
content for waivers, but each poses different options for the local
maintainer. The tooling also has different challenges if there's a need
to validate a digital signature versus verifying a digest.
Disjointed ancillary thought, is there an include function in the XCCDF?
I haven't been able to find one in the spec so far but it could be
useful for local waiver overrides while preserving the official content.
There's an obvious issue (as I type this) that any sort of standard
include statement would allow someone to completely override policy for
a scan while still mimicking the appropriate results. Having a
reporting tool that can do diffs of the results and the policy settings
could catch that, but that may not be sufficient for reporting or
detection time.
Regards,
Matt Micene
Engineering Team Lead
RHCA #100-002-435
DLT Solutions
Direct 703-773-1195
11 years
Polyinstantiation of /tmp and /var/tmp and CGroups....
by Trevor Vaughan
All,
Should we be requiring polyinstation of /tmp and /var/tmp for users via PAM?
I had forgotten about this until reading a recent post.
I feel that this would be a good idea in general, but may cause issues in
terms of legitimate file sharing and end up with more users making their
home directories 755 (or more ridiculous).
Also, should we be binding users to any particular CGroup limits by default?
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --
11 years
[PATCH 0/2] transform to create STIG tables based on overlay
by Jeffrey Blank
This is a first cut at adding a transform to apply an overlay that
carries its own IDs and titles (in this case, the STIG).
There is now a new table output
(which uses the existing transform that can turns any STIG into a table)
which presents the overlaid IDs and titles, in
output/table-stig-rhel6-overlay.html
Jeffrey Blank (2):
new transform to apply STIG overlay with IDs and alternate titles
rules to run the new STIG overlay and send its output through the
existing table generation transform for STIGs * also,
deactivation of old rules which should no longer be needed (will
remain as comments for now)
RHEL6/Makefile | 36 ++++++++++--------
RHEL6/transforms/xccdf-apply-overlay-stig.xslt | 46 ++++++++++++++++++++++++
2 files changed, 66 insertions(+), 16 deletions(-)
create mode 100644 RHEL6/transforms/xccdf-apply-overlay-stig.xslt
11 years
[PATCH 0/2] adding columns to output table
by Jeffrey Blank
Jeffrey Blank (2):
removed some unusued Make actions
deleted unused transform
RHEL6/Makefile | 5 ++---
RHEL6/transforms/table-add-vulnids.xslt | 24 ------------------------
RHEL6/transforms/xccdf-apply-overlay-stig.xslt | 2 ++
3 files changed, 4 insertions(+), 27 deletions(-)
delete mode 100644 RHEL6/transforms/table-add-vulnids.xslt
11 years
[PATCH] new overlay file
by Jeffrey Blank
This should allow for more elegant handling/coordination of STIG IDs.
It will create other complications (ID synchronization) but we will work through
those. Transform coming very soon for this.
Jeffrey Blank (1):
new stig_overlay file, to supercede alt-titles
RHEL6/input/auxiliary/stig_overlay.xml | 1338 ++++++++++++++++++++++++++++++++
1 files changed, 1338 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/auxiliary/stig_overlay.xml
11 years