A few things (and changing subject properly):
1) Is this solving a problem we really have right now? I don't really
think it is, but I'm open to being corrected.
2) This is also too clever. The clean_line function (in the patch) has
regexes to edit regexes. The script is also doing its own parsing of
its own format (instead of using existing parsers for JSON or XML or CSV
or whatever).
For now I don't see this simplifying the creation of content more than
it complicates the maintenance/comprehension overhead. If we suddenly
need to do more line edits, let's revisit. I also have a draft XSLT
that might fit the bill (but I'm also not convinced it solves more
problems than it creates).
On 03/30/2012 02:48 PM, Michael Palmiotto wrote:
To aid in the automation of OVAL checks, I've written a script
that
generates the check.xmls to test for lines being properly added to
config files.
Attached you'll find the example template and the output for 2.6.2.4.6 Record
Attempts
to Alter Process and Session Initiation Information.
The file "test_input_1_entry" has the relevant lines for the addition of a
test:
oval_id:
title: "Title of Check"
cces: "CCE-#, CCE-#"
desc: "Description of check"
tests:
test_name_1:
filepath: "Path of file to be checked"
filename: "Name of file to be checked"
line: "Text that needs to be added to the file"
The template file, "template_file_entries" is similar to the current template
files,
with tags for oval_id, title, cces, desc, tests, etc:
<def-group>
<!-- THIS FILE IS GENERATED by create_file_entries.py. DO NOT EDIT. -->
<definition class="compliance" id="TESTID"
version="1">
<metadata>
<title>TESTTITLE</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE_ID" source="CCE" />
<description>DESC</description>
</metadata>
<criteria operator = "AND">
<criterion comment="" test_ref="test_TESTID_TESTNAME"
/>
</criteria>
</definition>
<ind:textfilecontent54_test check="all" comment=""
id="test_TESTID_TESTNAME" version="1">
<ind:object object_ref="object_TESTID_TESTNAME" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_TESTID_TESTNAME"
version="1">
<ind:filepath>FILEPATH</ind:filepath>
<ind:filename>FILENAME</ind:filename>
<ind:pattern operation="pattern
match">FILE_LINE</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
Any feedback on this would be greatly appreciated. I've attached the script and a
test input file.
--Mike
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide