On 4/27/17 1:01 AM, 面和毅 wrote:
Folks,

I'm not sure this ML is correct place to ask or not, but
I'm wondering the status of CCE.

https://nvd.nist.gov/config/cce/index

It seems these CCE quite old, so does somebody know
how is the status for new version of CCE?

I had a phone call with our friends at NIST in January about this.

In short, an XSLT needs to be created that transforms our CCE data and creates an XML file formatted like this:
https://nvd.nist.gov/static/feeds/xml/cce/cce-COMBINED-5.20130214.xml

<cce cce_id="CCE-XXXX-Y" platform="rhel7" modified="YYYY-MM-DD">
<description>
Rule title
</description>
<parameters>
<parameter>enabled / disabled</parameter>
</parameters>
<technical_mechanisms>
<technical_mechanism>via chkconfig</technical_mechanism>
</technical_mechanisms>
<references>
<reference resource_id="NIST 800-53 control">AU-6</reference>
<reference resource_id="DISA SRG">RHEL-07-00000</reference>
</references>
</cce>

That listing can then be submitted to NIST.

Challenges:
- The <parameter> tag does not cleanly map to configuration checks. Most things are not just "enabled" or "disabled," they're configured (e.g. password lengths via refine-value elements).
- How can we identify (in code) whether a check is enabling or disabling something? Some rules follow a naming scheme, like service_XX_enabled and sysctl checks. Others are more nebulous.
- How do we automate <technical_mechanism>? The means to evaluate a check vary per rule, and are not always machine-identifiable.

Generating a CCE list keeps getting delayed because the challenges above. There have been much larger problems users have identified that need fixing first.

That said - if a CCE list is something you feel would be valuable, patches more than welcome!