I think it might make more sense to do it in XML instead of JSON.
Mixing JSON and XML makes one's eyes bleed in two different ways instead
of one way. But I suppose it's parseable and transformable either way.
Have you given though to making it look (a little bit) like what's in
the CRE spec for a cre_entry (pg 25)?
http://csrc.nist.gov/publications/drafts/nistir-7831/Draft-NISTIR-7831.pdf
But perhaps in a more-convenient-for-human-editing format (something for
which automated transformation may be possible to CRE)?
Structurally this is reminiscent of Apple's plist XML schema (as it is
also designed to hierarchically store arbitrary key-value pairs, and
directly in XML).
On 09/06/2012 06:25 PM, Francisco Slavin wrote:
Hello,
As you may be aware, one of the key use cases for SecState has been
automated remediation. We have shifted away from Puppet remediation
to BASH remediation in response to community input & direction. At
this time our core target is enabling users to use SSG content to
audit a system and Aqueduct content to remediate a system. As we
move forward with designing the "glue" to link the content together
we would appreciate input from the community about the approach we're
planning for this. We want to help find an approach for this which
is agreeable to the content maintainers and lets us meet our use
cases.
We are planning to continue using the <fix> tag with a custom system
attribute string to indicate that the <fix> tag contains BASH
remediation content. We are currently considering JSON notation as
the leading candidate for writing the <fix> content because it is
both easy to write and easy to parse. The information we want to
make sure we cover for running a remediation script is:
* Path to the script * Environment variables to define * Positional
arguments to pass in to the script
Using JSON notation in a <fix> tag, this would be the representation
of that info:
<fix system="urn:xccdf:fix:script:bash"> { "script" :
"/usr/libexec/ssg/scripts/remediate_foo.sh" "environment-variables"
:
{"FOO" : "12", "TEST" : "<sub
idref="xccdf_variable_foo" />"}
"positional-args" : ["test","<sub idref="
other_xccdf_variable" />"]
} </fix>
The array of positional-args would be assumed to be ordered. So this
example would call: FOO=12 TEST=<value of xccdf_variable_foo>
/bin/bash /usr/libexec/ssg/scripts/remediate_foo.sh test <value of
other_xccdf_variable>
We would appreciate any input & feedback regarding this approach.
Thank you - Francisco Slavin
_______________________________________________ scap-security-guide
mailing list scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide