On 2/19/13 1:39 AM, Shawn Wells wrote:
On 2/18/13 2:48 PM, Brian Millett wrote:
On Sat, 16 Feb 2013 13:35:41 -0500
Shawn Wells <shawn.d.wells@gmail.com> wrote:

> 
Ok, so your idea is really good.  I've converted my "project" for the company I'm at and 
it works really nice.

Well.... It's a complete hack, until we can think of a clever/appropriate/scalable/non-sucky way to get the variable names into the fix content.


.......
[root@localhost RHEL6]# time transforms/combinefixes.sh input/fixes/bash/
output/bash-remediations2.xml

real	4m41.432s
user	0m5.427s
sys	0m53.876s

So I rewrote it in perl which took:

[root@localhost RHEL6]# time transforms/combinefixes.pl input/fixes/bash/
output/bash-remediations.xml

real	0m1.131s
user	0m0.095s
sys	0m0.184s

Hah, this is hilarious. Thank you for cleaning up my bilge quality bash script!

So here are the perl scripts.  One to break up a large bash-ks.xml file and
one to combinefixes.

__BEGIN__ parseFix.pl
#!/usr/bin/perl

use XML::Simple qw(:strict);
use Data::Dumper;

my $xmlFile = $ARGV[0];
my $xmlDir = $ARGV[1];

my $DEBUG=0;

my $config = XMLin($xmlFile,
                   KeyAttr => { fix => 'rule' },
                   ForceArray => [ 'fix' ]);

#print Dumper($config) if $DEBUG;

my $fixes = $config->{'fix'};

for my $rule (keys %{$fixes}) {
  printf "%s => %s\n", $rule, $fixes->{$rule}->{'content'} if $DEBUG;
  open my $fix, '>', $xmlDir."/". $rule.".sh";
  printf $fix "%s\n", $fixes->{$rule}->{'content'};
}
__END__
It seems like this would really be only needed a few developers end, to breakup your pre-existing scripts, vs something that should get dropped into the project.

Note to self: Stop doing EMails past 0130....

"It seems like this would really be only needed by a few developers to break up pre-existing scripts, vs something that should get dropped into the project"




__BEGIN__ combinefixes.pl
#!/usr/bin/perl

use Data::Dumper;
use File::Basename;

## First argument: directory with .sh scripts
## Second argument: where to put combined xml file

my $fixDir=$ARGV[0];
my $output=$ARGV[1];

sub encode {
  my($toencode) = @_;
  $toencode =~ s/\&/\&amp;/g;
  $toencode =~ s/>/\&gt;/g;
  $toencode =~ s/</\&lt;/g;
  return $toencode;
}

open my $XML, '>', $output;

print $XML "<fix-group id=\"bash\" system=\"urn:xccdf:fix:script:sh\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\">\n";

opendir(my $dh, $fixDir) || die "can't opendir $fixDir: $!";
@files = grep { !/^\./ && -f "$fixDir/$_" } readdir($dh);
closedir $dh;

for my $fixScript (@files) {
  my $fixName = basename($fixScript,".sh");
  open my $FIX,'<', $fixDir."/".$fixScript;
  my @lines = <$FIX>;
  close $FIX;
  @lines = map { encode($_) } @lines;
  print $XML "<fix rule=\"$fixName\">\n";
  print $XML (@lines);
  print $XML "</fix>\n";
}

print $XML "</fix-group>\n";
close $XML;
__END__
Running this locally:

$ make content
$ oscap xccdf eval --profile stig-rhel6-server --results /tmp/results.xml --cpe-dict output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
$ oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml >>/tmp/fixscript.sh
$ cat /tmp/fixscript.sh
#!/bin/bash
# OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure Configuration of Red Hat Enterprise Linux 6

# generated: 2013-02-19T01:37:13-05:00


Something appears to be off.... will look at this more tomorrow (err, later today?). Changed Makefile to run the pl script:
        ./$(TRANS)/combinefixes.pl $(IN)/fixes/bash/ $(OUT)/bash-remediations.xml



_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


-- 
Shawn Wells
Technical Director,
U.S. Intelligence Programs
(e) shawn@redhat.com
(c) 443.534.0130