[PATCH] Module is freevxfs, not freevsfs
by Maura Dailey
Tiny typo fix.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/system/permissions/mounting.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 6180b48..897d45f 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -168,7 +168,7 @@ local system should be disabled.</rationale>
<Rule id="disable_module_freevxfs">
<title>Disable Mounting of <tt>freevxfs</tt></title>
<description>
-<module-disable-macro module="freevsfs" />
+<module-disable-macro module="freevxfs" />
This effectively prevents usage of this uncommon filesystem.
</description>
<rationale>Linux kernel modules which implement filesystems that are not needed by the
--
1.7.1
10 years, 10 months
[PATCH] Fix build of OpenStack and RHEVM3 parts on Fedora 18+
by Šimon Lukašík
From: Simon Lukasik <slukasik(a)redhat.com>
---
OpenStack/Makefile | 3 ++-
OpenStack/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++
OpenStack/transforms/shorthand2xccdf.xslt | 3 ---
RHEVM3/Makefile | 3 ++-
RHEVM3/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++
RHEVM3/transforms/shorthand2xccdf.xslt | 3 ---
6 files changed, 34 insertions(+), 8 deletions(-)
create mode 100644 OpenStack/transforms/add_xccdf_namespace.xslt
create mode 100644 RHEVM3/transforms/add_xccdf_namespace.xslt
diff --git a/OpenStack/Makefile b/OpenStack/Makefile
index f1c49b2..69280a1 100644
--- a/OpenStack/Makefile
+++ b/OpenStack/Makefile
@@ -14,7 +14,8 @@ shorthand-guide:
xmllint --format --output $(OUT)/openstack-shorthand.xml $(OUT)/openstack-shorthand.xml
shorthand2xccdf: shorthand-guide
- xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-noprofiles-openstack-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-openstack-shorthand.xml
xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-openstack-xccdf-prerefs.xml \
$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-openstack-xccdf.xml
xsltproc -stringparam profile "stig-openstack-server" -o $(OUT)/unlinked-openstack-xccdf.xml \
diff --git a/OpenStack/transforms/add_xccdf_namespace.xslt b/OpenStack/transforms/add_xccdf_namespace.xslt
new file mode 100644
index 0000000..3acd511
--- /dev/null
+++ b/OpenStack/transforms/add_xccdf_namespace.xslt
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <!-- Add the XCCDF 1.1 namespace to all elements without namespace. -->
+ <xsl:template match="node()|@*">
+ <xsl:copy>
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="*[namespace-uri()='']">
+ <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1">
+ <xsl:apply-templates select="node()|@*" />
+ </xsl:element>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/OpenStack/transforms/shorthand2xccdf.xslt b/OpenStack/transforms/shorthand2xccdf.xslt
index c25323d..ef6be4b 100644
--- a/OpenStack/transforms/shorthand2xccdf.xslt
+++ b/OpenStack/transforms/shorthand2xccdf.xslt
@@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">
<!-- Content:template -->
<xsl:template match="Benchmark">
<xsl:copy>
- <xsl:attribute name="xmlns">
- <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text>
- </xsl:attribute>
<xsl:apply-templates select="@*|node()" />
</xsl:copy>
</xsl:template>
diff --git a/RHEVM3/Makefile b/RHEVM3/Makefile
index c5d1c29..9f523ed 100644
--- a/RHEVM3/Makefile
+++ b/RHEVM3/Makefile
@@ -14,7 +14,8 @@ shorthand-guide:
xmllint --format --output $(OUT)/rhevm3-shorthand.xml $(OUT)/rhevm3-shorthand.xml
shorthand2xccdf: shorthand-guide
- xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml
xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhevm3-xccdf-prerefs.xml \
$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml
xsltproc -stringparam profile "stig-rhevm3-server" -o $(OUT)/unlinked-rhevm3-xccdf.xml \
diff --git a/RHEVM3/transforms/add_xccdf_namespace.xslt b/RHEVM3/transforms/add_xccdf_namespace.xslt
new file mode 100644
index 0000000..3acd511
--- /dev/null
+++ b/RHEVM3/transforms/add_xccdf_namespace.xslt
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <!-- Add the XCCDF 1.1 namespace to all elements without namespace. -->
+ <xsl:template match="node()|@*">
+ <xsl:copy>
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="*[namespace-uri()='']">
+ <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1">
+ <xsl:apply-templates select="node()|@*" />
+ </xsl:element>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/RHEVM3/transforms/shorthand2xccdf.xslt b/RHEVM3/transforms/shorthand2xccdf.xslt
index aa50713..54a0d68 100644
--- a/RHEVM3/transforms/shorthand2xccdf.xslt
+++ b/RHEVM3/transforms/shorthand2xccdf.xslt
@@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">
<!-- Content:template -->
<xsl:template match="Benchmark">
<xsl:copy>
- <xsl:attribute name="xmlns">
- <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text>
- </xsl:attribute>
<xsl:apply-templates select="@*|node()" />
</xsl:copy>
</xsl:template>
--
1.8.2.1
10 years, 10 months
[PATCH] Fix build on Fedora 18+ and the upcoming RHEL release
by Šimon Lukašík
From: Simon Lukasik <slukasik(a)redhat.com>
Previously, the xccdf namespace has been added to the shorthand
document by <xsl:attribute>. Newer libxml releases are more strict
and do not allow attributes named "xmlns". Which is explicitly
forbiden by XSLT specification.
http://www.w3.org/TR/xslt#creating-attributes
Addressing:
xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml
compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute
xsl:attribute: The attribute name 'xmlns' is not allowed.
make: *** [shorthand2xccdf] Error
---
RHEL6/Makefile | 3 ++-
RHEL6/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++
RHEL6/transforms/shorthand2xccdf.xslt | 3 ---
3 files changed, 17 insertions(+), 4 deletions(-)
create mode 100644 RHEL6/transforms/add_xccdf_namespace.xslt
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 9214ce9..d34b127 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -14,7 +14,8 @@ shorthand-guide:
xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml
shorthand2xccdf: shorthand-guide
- xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml
+ xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml
xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml \
$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml
oscap xccdf resolve -o $(OUT)/unlinked-rhel6-xccdf.xml $(OUT)/unlinked-unresolved-rhel6-xccdf.xml
diff --git a/RHEL6/transforms/add_xccdf_namespace.xslt b/RHEL6/transforms/add_xccdf_namespace.xslt
new file mode 100644
index 0000000..3acd511
--- /dev/null
+++ b/RHEL6/transforms/add_xccdf_namespace.xslt
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <!-- Add the XCCDF 1.1 namespace to all elements without namespace. -->
+ <xsl:template match="node()|@*">
+ <xsl:copy>
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="*[namespace-uri()='']">
+ <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1">
+ <xsl:apply-templates select="node()|@*" />
+ </xsl:element>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index 1a849e2..39f6741 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">
<!-- Content:template -->
<xsl:template match="Benchmark">
<xsl:copy>
- <xsl:attribute name="xmlns">
- <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text>
- </xsl:attribute>
<xsl:apply-templates select="@*|node()" />
</xsl:copy>
</xsl:template>
--
1.8.2.1
10 years, 10 months
[PATCH] Subexpression datatype shall equal to the variable datatype
by Šimon Lukašík
From: Simon Lukasik <slukasik(a)redhat.com>
Default datatype is string.
Addressing:
$ make validate
oval:ssg:var:2115 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2117 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2122 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2126 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2127 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2130 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2135 - inconsistent datatype between the variable and an associated var_ref
oval:ssg:var:2139 - inconsistent datatype between the variable and an associated var_ref
---
RHEL6/input/checks/accounts_disable_post_pw_expiration.xml | 2 +-
RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml | 2 +-
RHEL6/input/checks/accounts_maximum_age_login_defs.xml | 2 +-
RHEL6/input/checks/accounts_minimum_age_login_defs.xml | 2 +-
RHEL6/input/checks/accounts_password_minlen_login_defs.xml | 2 +-
RHEL6/input/checks/accounts_password_warn_age_login_defs.xml | 2 +-
RHEL6/input/checks/auditd_data_retention_max_log_file.xml | 2 +-
RHEL6/input/checks/auditd_data_retention_num_logs.xml | 2 +-
8 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml
index b93ee63..429e9db 100644
--- a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml
+++ b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml
@@ -26,7 +26,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_etc_default_useradd_inactive" version="1">
- <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" />
+ <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" datatype="int" />
</ind:textfilecontent54_state>
<ind:textfilecontent54_state id="state_etc_default_useradd_inactive_nonnegative" version="1">
diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
index 53a9d13..eda8052 100644
--- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -25,7 +25,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_maxlogins" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" />
+ <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
diff --git a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
index 0640a3e..090435a 100644
--- a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
@@ -25,7 +25,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_password_max_age" version="1">
- <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" />
+ <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="maximum password age" datatype="int" id="var_password_max_age" version="1" />
diff --git a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
index 21b02af..6de9779 100644
--- a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
@@ -26,7 +26,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" />
+ <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="minimum password age in days" datatype="int" id="var_password_min_age" version="1" />
diff --git a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
index 76d2132..4dd66c8 100644
--- a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
+++ b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
@@ -37,7 +37,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_password_min_len" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" />
+ <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="password minimum length" datatype="int" id="var_password_min_len" version="1" />
diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
index ed4fb8f..7c153e7 100644
--- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
@@ -27,7 +27,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" />
+ <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="password expiration warning age in days" datatype="int" id="var_password_warn_age" version="1" />
diff --git a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml
index b8aba36..7087e7a 100644
--- a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml
+++ b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml
@@ -26,7 +26,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" />
+ <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="audit max_log_file settting" datatype="int" id="var_auditd_max_log_file" version="1" />
diff --git a/RHEL6/input/checks/auditd_data_retention_num_logs.xml b/RHEL6/input/checks/auditd_data_retention_num_logs.xml
index ad2fc7e..b46e734 100644
--- a/RHEL6/input/checks/auditd_data_retention_num_logs.xml
+++ b/RHEL6/input/checks/auditd_data_retention_num_logs.xml
@@ -26,7 +26,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_auditd_data_retention_num_logs" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" />
+ <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" datatype="int" />
</ind:textfilecontent54_state>
<external_variable comment="audit num_logs settting" datatype="int" id="var_auditd_num_logs" version="1" />
--
1.8.2.1
10 years, 10 months
[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation
by Jeffrey Blank
This is a step along the path toward support for remediation content
development, but it is only one step.
This patchset also cleans up some other code. It has not been tested, but it
appears to emit "<sub>" elements in the manner OpenSCAP can process, so that
parameters can be provided to remediation scripts.
Documentation/instructions are still needed. It should be apparent from the
example that scripts which use parameters will need to "source" a support file
and also declare which environment variables they expect to have populated by
XCCDF values (using the "populate" function).
This patch is only to enable example remediation content, which may be suitable
for testing. The SSG project/community will be ready for remediation content
en masse when there is evidence of sufficient interest in the checking
mechanisms, upon which any remediation effort would naturally depend.
Jeffrey Blank (4):
example remediation script which takes a parameter
incomplete support file for bash remediations * does at least
warn when undefined variable exists
rewrite of combinefixes.py to handle parameters for OpenSCAP
remedation generation
made xccdf-addfixes insert all text and child nodes of a fix
RHEL6/input/fixes/bash/set_system_login_banner.sh | 6 ++
RHEL6/input/fixes/bash/templates/support.sh | 9 ++
RHEL6/transforms/combinefixes.py | 97 +++++++++-----------
RHEL6/transforms/xccdf-addfixes.xslt | 2 +-
4 files changed, 60 insertions(+), 54 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh
create mode 100644 RHEL6/input/fixes/bash/templates/support.sh
10 years, 10 months
xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett
Hello,
I'm trying to get started with making the latest clone from the git
repository and I get the following error:
[bpm]$ git clone
http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide
Cloning into 'scap-security-guide'...
remote: Counting objects: 14016, done.
remote: Compressing objects: 100% (5257/5257), done.
remote: Total 14016 (delta 10574), reused 10664 (delta 7718)
Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done.
Resolving deltas: 100% (10574/10574), done.
[bpm]$ cd scap-security-guide/RHEL6/
[bpm]$ make all
xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml
xmllint --format --output output/rhel6-shorthand.xml
output/rhel6-shorthand.xml
xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml
transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml
compilation error: file transforms/shorthand2xccdf.xslt line 19 element
attribute
xsl:attribute: The attribute name 'xmlns' is not allowed.
make: *** [shorthand2xccdf] Error 5
I've a fedora 18 , x86_64 installation.
Any ideas?
Thanks.
--
Brian Millett
"Shifts in paradigms
often cause nose bleeds."
Greg Glenn
10 years, 10 months