This simplifies (maybe) the translation of the fragments into XCCDF.
Now: Assembly of the fragments happens in one place: guide.xslt. Translation of the shorthand into XCCDF happens in one place: shorthand2xccdf.xslt.
Basically, adding Profiles and resolving namespaces have been folded into those transforms.
Jeffrey Blank (3): removing calls to now-unnecessary transforms added comment, added calls to insert Profiles moved namespace assignment into shorthand2xccdf.xslt transform
RHEL6/Makefile | 5 +-- RHEL6/input/guide.xslt | 13 ++++- RHEL6/transforms/shorthand2xccdf.xslt | 84 ++++++++++++++++++++++------- RHEL6/transforms/xccdf-addnamespaces.xslt | 49 ----------------- RHEL6/transforms/xccdf-addprofiles.xslt | 37 ------------- 5 files changed, 78 insertions(+), 110 deletions(-) delete mode 100644 RHEL6/transforms/xccdf-addnamespaces.xslt delete mode 100644 RHEL6/transforms/xccdf-addprofiles.xslt
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/Makefile | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 9515051..40aa322 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -14,10 +14,7 @@ shorthand-guide: xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml
shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml - xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml \ - $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml - xsltproc -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml $(TRANS)/xccdf-addnamespaces.xslt $(OUT)/unlinked-unresolved-rhel6-xccdf.xml + xsltproc -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml oscap xccdf resolve -o $(OUT)/unlinked-rhel6-xccdf.xml $(OUT)/unlinked-unresolved-rhel6-xccdf.xml # xsltproc -stringparam profile "stig-rhel6-server" -o $(OUT)/unlinked-rhel6-xccdf.xml \ # $(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/guide.xslt | 13 ++++++++++++- 1 files changed, 12 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/guide.xslt b/RHEL6/input/guide.xslt index 4944f0d..f2e1ae6 100644 --- a/RHEL6/input/guide.xslt +++ b/RHEL6/input/guide.xslt @@ -1,15 +1,26 @@ <?xml version="1.0"?> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/%22%3E
+<!-- This transform assembles all fragments into one "shorthand" XCCDF document --> + <xsl:template match="Benchmark"> xsl:copy <xsl:copy-of select="@*|node()" /> + + <!-- adding profiles here --> + <xsl:apply-templates select="document('profiles/test.xml')" /> + <xsl:apply-templates select="document('profiles/CS2.xml')" /> + <xsl:apply-templates select="document('profiles/common.xml')" /> + <xsl:apply-templates select="document('profiles/desktop.xml')" /> + <xsl:apply-templates select="document('profiles/server.xml')" /> + <xsl:apply-templates select="document('profiles/ftp.xml')" /> + <xsl:apply-templates select="document('profiles/stig-rhel6-server.xml')" /> + <Value id="conditional_clause" type="string" operator="equals"> <title>A conditional clause for check statements.</title> <description>A conditional clause for check statements.</description> <value>This is a placeholder.</value> </Value> - <xsl:apply-templates select="document('intro/intro.xml')" /> <xsl:apply-templates select="document('system/system.xml')" /> <xsl:apply-templates select="document('services/services.xml')" />
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/transforms/shorthand2xccdf.xslt | 84 ++++++++++++++++++++++------- RHEL6/transforms/xccdf-addnamespaces.xslt | 49 ----------------- RHEL6/transforms/xccdf-addprofiles.xslt | 37 ------------- 3 files changed, 65 insertions(+), 105 deletions(-) delete mode 100644 RHEL6/transforms/xccdf-addnamespaces.xslt delete mode 100644 RHEL6/transforms/xccdf-addprofiles.xslt
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index 2b47121..84a68ed 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -6,15 +6,28 @@ xmlns:date="http://exslt.org/dates-and-times" extension-element-prefixes="date" exclude-result-prefixes="xccdf xhtml dc">
+ <!-- This transform takes a "shorthand" variant of XCCDF + and expands its elements into proper XCCDF elements. + It also assigns all elements into the proper namespace, + whether it be xccdf, xhtml, or simply maintained from the + input. --> + <xsl:include href="constants.xslt"/>
<xsl:variable name="ovalfile">unlinked-rhel6-oval.xml</xsl:variable> <xsl:variable name="defaultseverity" select="'low'" />
- <!-- This transform takes a "shorthand" variant of XCCDF - and expands its elements into proper XCCDF elements, - except (notably) it does not assign namespaces. This is handled - in another transform. --> +<!-- put elements created in this stylesheet into the xccdf namespace, + if no namespace explicitly indicated --> +<xsl:namespace-alias result-prefix="xccdf" stylesheet-prefix="#default" /> + + + <xsl:template match="Benchmark"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1%22%3E + <xsl:apply-templates select="node()|@*"/> + </xsl:element> + </xsl:template> +
<!-- insert current date --> <xsl:template match="Benchmark/status/@date"> @@ -25,7 +38,8 @@
<!-- hack for OpenSCAP validation quirk: must place reference after description/warning, but prior to others --> <xsl:template match="Rule"> - xsl:copy + <Rule selected="false"> + <!-- set selected attribute to false, to enable profile-driven evaluation --> <xsl:apply-templates select="@*" /> <!-- also: add severity of "low" to each Rule if otherwise unspecified --> <xsl:if test="not(@severity)"> @@ -43,12 +57,12 @@ <!-- order oval (shorthand tag) first, to indicate to tools to prefer its automated checks --> <xsl:apply-templates select="oval"/> <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::tested|self::rationale|self::ident|self::oval)]"/> - </xsl:copy> + </Rule> </xsl:template>
<xsl:template match="Group"> - xsl:copy + <Group> <xsl:apply-templates select="@*" /> <xsl:apply-templates select="title"/> <xsl:apply-templates select="description"/> @@ -56,7 +70,7 @@ <xsl:apply-templates select="ref"/> <xsl:apply-templates select="rationale"/> <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::rationale)]"/> - </xsl:copy> + </Group> </xsl:template>
<!-- XHTML, such as tt, is not allowed in titles --> @@ -141,9 +155,6 @@ <xsl:if test="$refsource = 'cnss'"> <xsl:value-of select="$cnss1253uri" /> </xsl:if> - <xsl:if test="$refsource = 'dcid'"> - <xsl:value-of select="$dcid63uri" /> - </xsl:if> <xsl:if test="$refsource = 'disa'"> <xsl:value-of select="$disa-cciuri" /> </xsl:if> @@ -223,8 +234,50 @@ </reference> </xsl:template>
+ <!-- The next set of templates places elements into the correct namespaces, + so that content authors never have to bother with them. + XHTML elements are explicitly identified and the xhtml + namespace is added. Any element with an empty namespace + is assigned to the xccdf namespace. --> + + <!-- put table and list-related xhtml tags into xhtml namespace --> + <xsl:template match="table | tr | th | td | ul | li | ol" > + <xsl:element name="{local-name()}" namespace="http://www.w3.org/1999/xhtml%22%3E + <xsl:apply-templates select="@*|node()"/> + </xsl:element> + </xsl:template> + + <!-- put general formatting xhtml into xhtml namespace --> + <xsl:template match="code | strong | b | em | i | pre | br | hr" > + <xsl:element name="{local-name()}" namespace="http://www.w3.org/1999/xhtml%22%3E + <xsl:apply-templates select="@*|node()"/> + </xsl:element> + </xsl:template> + + <!-- convert tt to code, which seems better-supported --> + <xsl:template match="tt"> + xhtml:code + <xsl:apply-templates select="@*|node()"/> + </xhtml:code> + </xsl:template>
- <!-- convenience macros for XCCDF prose --> + <!-- if no namespace is indicated, put into xccdf namespace--> + <xsl:template match="*[namespace-uri()='']" priority="-1"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1%22%3E + <xsl:apply-templates select="node()|@*"/> + </xsl:element> + </xsl:template> + + <!-- identity transform: pass anything else through --> + <xsl:template match="@*|node()" priority="-2"> + xsl:copy + <xsl:apply-templates select="@*|node()" /> + </xsl:copy> + </xsl:template> + + + + <!-- The next set of templates expand convenience macros for XCCDF prose --> <xsl:template match="sysctl-desc-macro"> To set the runtime status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter, run the following command: @@ -438,11 +491,4 @@ If the system is configured to audit this activity, it will return a line. </xsl:if> </xsl:template>
- <!-- identity transform: pass anything else through --> - <xsl:template match="@*|node()"> - xsl:copy - <xsl:apply-templates select="@*|node()" /> - </xsl:copy> - </xsl:template> - </xsl:stylesheet> diff --git a/RHEL6/transforms/xccdf-addnamespaces.xslt b/RHEL6/transforms/xccdf-addnamespaces.xslt deleted file mode 100644 index b27dbb8..0000000 --- a/RHEL6/transforms/xccdf-addnamespaces.xslt +++ /dev/null @@ -1,49 +0,0 @@ -<?xml version="1.0"?> -<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" - xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" - xmlns:dc="http://purl.org/dc/elements/1.1/" - xmlns:xhtml="http://www.w3.org/1999/xhtml" - exclude-result-prefixes="xccdf dc xhtml"> - - <!-- This transform places elements into the correct namespaces, - so that content authors never have to bother with them. - XHTML elements are explicitly identified and the xhtml - namespace is added. Any element with an empty namespace - is assigned to the xccdf namespace. --> - - <!-- table and list-related xhtml --> - <xsl:template match="table | tr | th | td | ul | li | ol"> - <xsl:element name="{local-name()}" namespace="http://www.w3.org/1999/xhtml%22%3E - <xsl:apply-templates select="@*|node()"/> - </xsl:element> - </xsl:template> - - <!-- general formatting xhtml --> - <xsl:template match="code | strong | b | em | i | pre | br | hr"> - <xsl:element name="{local-name()}" namespace="http://www.w3.org/1999/xhtml%22%3E - <xsl:apply-templates select="@*|node()"/> - </xsl:element> - </xsl:template> - - <!-- convert tt to code, which seems better-supported --> - <xsl:template match="tt"> - xhtml:code - <xsl:apply-templates select="@*|node()"/> - </xhtml:code> - </xsl:template> - - <!-- if no namespace is indicated, put into xccdf namespace--> - <xsl:template match="*[namespace-uri()='']" priority="-1"> - <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1%22%3E - <xsl:apply-templates select="node()|@*"/> - </xsl:element> - </xsl:template> - - <!-- pass everything else through --> - <xsl:template match="@*|node()" priority="-2"> - xsl:copy - <xsl:apply-templates select="@*|node()"/> - </xsl:copy> - </xsl:template> - -</xsl:stylesheet> diff --git a/RHEL6/transforms/xccdf-addprofiles.xslt b/RHEL6/transforms/xccdf-addprofiles.xslt deleted file mode 100644 index e1358e8..0000000 --- a/RHEL6/transforms/xccdf-addprofiles.xslt +++ /dev/null @@ -1,37 +0,0 @@ -<?xml version="1.0"?> -<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" > - - <xsl:template match="Benchmark/version"> - xsl:copy - <xsl:copy-of select="@*" /> - <xsl:copy-of select="node()" /> - </xsl:copy> - <xsl:if test="'allprofiles'=$profile"> - <xsl:apply-templates select="document('../input/profiles/test.xml')" /> - <xsl:apply-templates select="document('../input/profiles/CS2.xml')" /> - <xsl:apply-templates select="document('../input/profiles/common.xml')" /> - <xsl:apply-templates select="document('../input/profiles/desktop.xml')" /> - <xsl:apply-templates select="document('../input/profiles/server.xml')" /> - <xsl:apply-templates select="document('../input/profiles/ftp.xml')" /> - <xsl:apply-templates select="document('../input/profiles/stig-rhel6-server.xml')" /> - </xsl:if> - </xsl:template> - - <!-- add attribute selected=false so that Profiles - can activate Rules as needed --> - <xsl:template match="Rule"> - xsl:copy - <xsl:apply-templates select="@*" /> - <xsl:attribute name="selected">false</xsl:attribute> - <xsl:apply-templates select="@*|node()" /> - </xsl:copy> - </xsl:template> - - - <!-- copy everything else through to final output --> - <xsl:template match="@*|node()"> - xsl:copy - <xsl:apply-templates select="@*|node()" /> - </xsl:copy> - </xsl:template> -</xsl:stylesheet>
On 8/2/13 10:33 AM, Jeffrey Blank wrote:
This simplifies (maybe) the translation of the fragments into XCCDF.
Now: Assembly of the fragments happens in one place: guide.xslt. Translation of the shorthand into XCCDF happens in one place: shorthand2xccdf.xslt.
Basically, adding Profiles and resolving namespaces have been folded into those transforms.
Jeffrey Blank (3): removing calls to now-unnecessary transforms added comment, added calls to insert Profiles moved namespace assignment into shorthand2xccdf.xslt transform
RHEL6/Makefile | 5 +-- RHEL6/input/guide.xslt | 13 ++++- RHEL6/transforms/shorthand2xccdf.xslt | 84 ++++++++++++++++++++++------- RHEL6/transforms/xccdf-addnamespaces.xslt | 49 ----------------- RHEL6/transforms/xccdf-addprofiles.xslt | 37 ------------- 5 files changed, 78 insertions(+), 110 deletions(-) delete mode 100644 RHEL6/transforms/xccdf-addnamespaces.xslt delete mode 100644 RHEL6/transforms/xccdf-addprofiles.xslt
This (oddly) is much cleaner & easier to follow. Ack!
scap-security-guide@lists.fedorahosted.org