On 6/2/13 3:05 PM, Jeffrey Blank wrote:
This is a step along the path toward support for remediation content
development, but it is only one step.
This patchset also cleans up some other code. It has not been tested, but it
appears to emit "<sub>" elements in the manner OpenSCAP can process, so
that
parameters can be provided to remediation scripts.
Documentation/instructions are still needed. It should be apparent from the
example that scripts which use parameters will need to "source" a support file
and also declare which environment variables they expect to have populated by
XCCDF values (using the "populate" function).
This patch is only to enable example remediation content, which may be suitable
for testing. The SSG project/community will be ready for remediation content
en masse when there is evidence of sufficient interest in the checking
mechanisms, upon which any remediation effort would naturally depend.
Jeffrey Blank (4):
example remediation script which takes a parameter
incomplete support file for bash remediations * does at least
warn when undefined variable exists
rewrite of combinefixes.py to handle parameters for OpenSCAP
remedation generation
made xccdf-addfixes insert all text and child nodes of a fix
RHEL6/input/fixes/bash/set_system_login_banner.sh | 6 ++
RHEL6/input/fixes/bash/templates/support.sh | 9 ++
RHEL6/transforms/combinefixes.py | 97 +++++++++-----------
RHEL6/transforms/xccdf-addfixes.xslt | 2 +-
4 files changed, 60 insertions(+), 54 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh
create mode 100644 RHEL6/input/fixes/bash/templates/support.sh
This is very clever. In the XCCDF it renders as:
<fix
system="urn:xccdf:fix:script:sh">login_banner_text="<sub
idref="login_banner_text"/>"
cat <<EOF >/etc/issue
$login_banner_text
EOF
</fix>
Then in the bash remediation scripts:
# XCCDF rule: set_system_login_banner
# CCE-26974-6
login_banner_text="You are accessing a U.S. Government \(USG\)
Information System \(IS\) that is provided for USG-authorized use
only.[\s\n]*By using this IS \(which includes any device attached to
this IS\), you consent to the following conditions\:[\s\n]*-[\s\n]*The
USG routinely intercepts and monitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct
\(PM\), law enforcement \(LE\), and counterintelligence \(CI\)
investigations.[\s\n]*-[\s\n]*At any time, the USG may inspect and
seize data stored on this IS.[\s\n]*-[\s\n]*Communications using, or
data stored on, this IS are not private, are subject to routine
monitoring, interception, and search, and may be disclosed or used for
any USG-authorized purpose.[\s\n]*-[\s\n]*This IS includes security
measures \(e.g., authentication and access controls\) to protect USG
interests -- not for your personal benefit or
privacy.[\s\n]*-[\s\n]*Notwithstanding the above, using this IS does
not constitute consent to PM, LE or CI investigative searching or
monitoring of the content of privileged communications, or work
product, related to personal representation or services by attorneys,
psychotherapists, or clergy, and their assistants. Such communications
and work product are private and confidential. See User Agreement for
details."
cat <<EOF >/etc/issue
$login_banner_text
EOF
This is a *fantastic* approach. I'll see what I can do around generating
a doc that transforms refine values that people can source as variable
names, likely won't have anything until Thurs.
Ack!