This patchset includes edits to reach a more consistent style across approximately the first quarter of the content. It also includes a new transform to create a prose guide, which uses some very simple JavaScript (which works in any browser) to show the manual checking procedures included in the XCCDF content. The references stored inline in the XCCDF content still need QA work.
The new stylesheet wants some (very small) images, which I'll push into output/images, assuming this all receives a positive reception.
Jeffrey Blank (5): new transform to create custom HTML guide use new guide transform in Makefile, fixed filename mistake editing on prose text for software integrity/updating editing on prose for mounting,partitioning,permissions editing on ntp section prose
RHEL6/Makefile | 3 +- RHEL6/input/services/ntp.xml | 32 +- RHEL6/input/system/permissions/mounting.xml | 143 +++---- RHEL6/input/system/permissions/partitions.xml | 16 +- RHEL6/input/system/permissions/permissions.xml | 16 +- RHEL6/input/system/software/integrity.xml | 103 ++--- RHEL6/input/system/software/updating.xml | 31 +- RHEL6/transforms/xccdf-removeaux.xslt | 3 +- RHEL6/transforms/xccdf2html.xslt | 614 ++++++++++++++++++++++++ 9 files changed, 757 insertions(+), 204 deletions(-) create mode 100644 RHEL6/transforms/xccdf2html.xslt
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/transforms/xccdf-removeaux.xslt | 3 +- RHEL6/transforms/xccdf2html.xslt | 614 +++++++++++++++++++++++++++++++++ 2 files changed, 615 insertions(+), 2 deletions(-) create mode 100644 RHEL6/transforms/xccdf2html.xslt
diff --git a/RHEL6/transforms/xccdf-removeaux.xslt b/RHEL6/transforms/xccdf-removeaux.xslt index 788969e..62ad820 100644 --- a/RHEL6/transforms/xccdf-removeaux.xslt +++ b/RHEL6/transforms/xccdf-removeaux.xslt @@ -8,8 +8,7 @@
<!-- remove the srg_support Group from final output, as it exists only to support the OS SRG mapping --> - <xsl:template match="xccdf:Group[@id='srg_support']"> - </xsl:template> + <xsl:template match="xccdf:Group[@id='srg_support']" />
<!-- copy everything else through to final output --> diff --git a/RHEL6/transforms/xccdf2html.xslt b/RHEL6/transforms/xccdf2html.xslt new file mode 100644 index 0000000..82d1d16 --- /dev/null +++ b/RHEL6/transforms/xccdf2html.xslt @@ -0,0 +1,614 @@ +<?xml version="1.0" encoding="UTF-8" ?> + +<!-- + This stylesheet transforms a resolved XCCDF document into a nice + XHTML document, with table of contents, cross-links, and section + numbers. This stylesheet basically assumes that the document is + compliant with the XCCDF schema, so validation is probably + advisable. Note that this stylesheet completely ignores all + TestResult elements: they do not appear in the generated + XHTML document. + + The XCCDF document MUST be resolved before applying this + stylesheet. This stylesheet cannot deal with extension/inheritance + at all. + + Original version from: + Author: Neal Ziring (nziring@thecouch.ncsc.mil) + Version: 0.12.4 (for XCCDF schema version 1.0rc4 - 0.12.4) + Date: 13 Nov 04 + --> + +<!-- + THIS SOFTWARE WAS CREATED BY THE U.S. GOVERNMENT. + + SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER + EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. + IN NO EVENT SHALL THE NATIONAL SECURITY AGENCY OR ANY AGENT OR + REPRESENTATIVE THEREOF BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA OR PROFITS; OR BUSINESS INTERRUPTION), HOWEVER CAUSED, UNDER ANY + THEORY OF LIABILITY, ARISING IN ANY WAY OUT OF THE USE OF OR INABILITY + TO MAKE USE OF THIS SOFTWARE. +--> + +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:htm="http://www.w3.org/1999/xhtml" + xmlns:xhtml="http://www.w3.org/1999/xhtml" + xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" > + +<!-- Set output style: XHTML using xml output method. --> +<xsl:output method="xml" encoding="UTF-8" indent="yes"/> + +<!-- Set up an id key to match on against all Items --> +<xsl:key name="items" match="cdf:Group | cdf:Rule | cdf:Value" + use="@id"/> + +<!-- Set up an id key to match on Item clusters: Rule and Group, Value --> +<xsl:key name="clusters-rg" match="cdf:Group | cdf:Rule" + use="@cluster-id"/> +<xsl:key name="clusters-v" match="cdf:Value" + use="@cluster-id"/> + +<!-- Set up an id key to match on all Profiles --> +<xsl:key name="profiles" match="cdf:Profile" use="@id"/> + +<!-- TEMPLATE for cdf:Benchmark + - This template takes care of the top-level structure of the + - generated XHTML document. It handles the Benchmark element + - and all the content of the benchmark. + --> +<xsl:template match="/cdf:Benchmark"> + + <!-- First issue a warning if the Benchmark is not marked resolved. --> + <xsl:if test="not(@resolved)"> + xsl:message + Warning: benchmark <xsl:value-of select="@id"/> not resolved, formatted + output will be incomplete or corrupted. + </xsl:message> + </xsl:if> + + <!-- Define variables for section numbers. --> + <xsl:variable name="introSecNum" select="1"/> + <xsl:variable name="concSecNum" + select="2 + number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0) + number(count(./cdf:Profile)!=0)"/> + <xsl:variable name="refSecNum" + select="2 + number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0) + number(count(./cdf:Profile)!=0) + number(count(./cdf:rear-matter)!=0)"/> + +<!-- Begin the HTML/XHTML body --> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + <title>XCCDF Benchmark: <xsl:value-of select="./cdf:title/text()"/></title> + <meta name="identifier" content="{@id}"/> + <script type="text/javascript"> + function toggle(divID, imgID) { + var item = document.getElementById(divID); + var img = document.getElementById(imgID); + if (item) { + item.className = (item.className=='hiddencheck') ? 'check':'hiddencheck'; + } + if (img) { + var currimage = img.src.substring(img.src.lastIndexOf('/')+1); + img.src=(currimage=='collapsed.png')?'images/expanded.png':'images/collapsed.png'; + } + } + </script> + + <style type="text/css"> + /* { background-color: #FFFFFF; } */ + body { margin-left: 8%; margin-right: 8%; foreground: black; } + h1 { text-align: center; font-size: 200%; margin-top: 2em; margin-bottom: 2em; + font-family: verdana, arial, helvetica, sans-serif; + border-bottom: solid 2px gray; margin-bottom: 1.0em; + border-top: solid 2px gray; margin-bottom: 1.0em; } + h2 { margin-left: -2%; font-size: 125%; + border-bottom: solid 1px gray; margin-bottom: 1.0em; + margin-top: 2em; margin-bottom: 0.75em; + font-family: verdana, arial, helvetica, sans-serif; } + h3 { margin-left: 6%; font-size: 110%; margin-bottom: 0.25em; + font-family: verdana, arial, helvetica, sans-serif; } + h4 { margin-left: 10%; font-size: 100%; margin-bottom: 0.75em; + font-family: verdana, arial, helvetica, sans-serif; } + h5,h6 { margin-left: 10%; font-size: 90%; margin-bottom: 0.5em; + font-family: verdana, arial, helvetica, sans-serif; } + p { margin-bottom: 0.2em; margin-top: 0.2em; } + pre { margin-bottom: 0.5em; margin-top: 0.25em; margin-left: 3%; + font-family: monospace; font-size: 90%; } + ul { margin-bottom: 0.5em; margin-top: 0.25em; } + td { vertical-align: top; } + + *.simpleText { margin-left: 10%; } + *.propertyText { margin-left: 10%; margin-top: 0.2em; margin-bottom: 0.2em } + *.toc { background: #FFFFFF; } + *.toc2 { background: #FFFFFF; } + div { margin-top: 1em; margin-bottom: 1em; } + div.rule { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; } + div.hiddencheck { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: none; } + div.check { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: block; } + div.legal { margin-left: 10%; } + + div.toc { margin-left: 6%; margin-bottom: 4em; + padding-bottom: 0.75em; padding-top: 1em; + padding-left: 2em; padding-right: 2em; + } + h2.toc { border-bottom: none; margin-left: 0%; margin-top: 0em; } + p.toc { margin-left: 2em; margin-bottom: 0.2em; margin-top: 0.5em; } + p.toc2 { margin-left: 5em; margin-bottom: 0.1em; margin-top: 0.1em; } + ul.smallList { margin-bottom: 0.1em; margin-top: 0.1em; font-size: 85%; } + /* table.propertyTable { margin-left: 14%; width: 90%; margin-top: 0.5em; margin-bottom: 0.25em; } + th.propertyTableHead { font-size: 80%; background-color: #CCCCCC; } */ + table { border-collapse:collapse; /*border: 1px solid black;*/ } + table,th,td { text-align: left; padding: 8px 8px; } + table tr:nth-child(2n+2) { background-color: #F4F4F4; } + th { border-bottom: 3px solid gray; } + .expandstyle a { color: black; text-decoration: none; } + .expandstyle a:link { color: black; text-decoration: none; } + .expandstyle a:visited { color: black; text-decoration: none; } + .expandstyle a:hover { color: black; text-decoration: none; } + .expandstyle a:active { color: black; text-decoration: none; } + </style> +</head> +<body> + xsl:commentBenchmark id = <xsl:value-of select="./@id"/></xsl:comment> + xsl:comment + This XHTML output file + generated using the + <xsl:value-of select="system-property('xsl:vendor')"/> + XSLT processor. + </xsl:comment> + + <!-- BEGINNING OF BODY --> + <h1><xsl:value-of select="./cdf:title"/></h1> + + <xsl:if test="./cdf:status | ./cdf:version | ./cdf:platform"> + <div class="simpleText"> + <p>Status: <b><xsl:value-of select="./cdf:status/text()"/></b> + <xsl:if test="./cdf:status/@date"> + (as of <xsl:value-of select="./cdf:status/@date"/>) + </xsl:if> + </p> + <xsl:if test="./cdf:version"> + <p>Version: <xsl:value-of select="./cdf:version/text()"/></p> + </xsl:if> + <xsl:if test="./cdf:platform"> + <p>Applies to:<ul> + <xsl:apply-templates select="./cdf:platform" mode="list"/> + </ul></p> + </xsl:if> + </div> + </xsl:if> + + <!-- 1. Build the introduction --> + <!--<h2><a name="section-intro"></a>front-matter</h2> --> + <xsl:if test="./cdf:front-matter"> + <xsl:for-each select="./cdf:front-matter"> + <div class="propertyText"> + <xsl:apply-templates select="./text() | ./*" mode="text"/> + </div> + </xsl:for-each> + </xsl:if> + <xsl:if test="./cdf:description"> + <h3>Description</h3> + <xsl:for-each select="./cdf:description"> + <div class="propertyText"> + <xsl:apply-templates select="./text() | ./*" mode="text"/> + </div> + </xsl:for-each> + </xsl:if> + <xsl:if test="./cdf:notice"> + <xsl:for-each select="./cdf:notice"> + <h3>Notice</h3> + <div class="legal"><p><xsl:value-of select="text()"/></p></div> + </xsl:for-each> + </xsl:if> + + <!-- Build the Table of Contents --> + <br/> + <h3 class="toc">Contents</h3> + <div class="toc"> + <!-- rules and groups TOC --> + <xsl:if test="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]"> + <xsl:apply-templates mode="toc" + select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]"> + <xsl:with-param name="section-prefix" /> + </xsl:apply-templates> + </xsl:if> + + <!-- rear-matter TOC --> + <xsl:if test="./cdf:rear-matter"> + <p class="toc"> + <xsl:value-of select="$concSecNum"/>. + <a class="toc" href="#section---conc">Conclusions</a> + </p> + </xsl:if> + + <!-- references TOC --> + <xsl:if test="./cdf:reference"> + <p class="toc"> + <xsl:value-of select="$refSecNum"/>. <a class="toc" href="#section---references">References</a> + </p> + </xsl:if> + </div> + + <!-- Begin the main page content in the HTML body --> + + + <!-- Build the rules section (rules and groups) --> + <xsl:if test="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]"> + <xsl:apply-templates select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]" mode="body"> + <xsl:with-param name="section-prefix" /> + </xsl:apply-templates> + </xsl:if> + + + <!-- Build the conclusions section using Benchmark/rear-matter --> + <xsl:if test="./cdf:rear-matter"> + <h2><a name="section---conc"></a> + <xsl:value-of select="$concSecNum"/>. Conclusions + </h2> + <xsl:for-each select="./cdf:rear-matter"> + <div class="propertyText"> + <xsl:apply-templates select="./text() | ./*" mode="text"/> + </div> + </xsl:for-each> + </xsl:if> + + <!-- Build the references section using Benchmark/reference --> + <xsl:if test="./cdf:reference"> + <h2><a name="section---references"></a> + <xsl:value-of select="$refSecNum"/>. References + </h2> + <ol xmlns="http://www.w3.org/1999/xhtml" class="propertyText"> + <xsl:for-each select="./cdf:reference"> + <li><xsl:value-of select="text()"/> + <xsl:if test="@href"> + [<a href="{@href}">link</a>] + </xsl:if> + </li> + </xsl:for-each> + </ol> + </xsl:if> + + <!-- All done, close out the HTML --> + </body> +</html> + +</xsl:template> + + +<!-- Additional templates for a Value element; + - For TOC, we present a line with number, for body + - we present a numbered section with title, and then + - the fields of the Value with a dl list. + --> +<xsl:template match="cdf:Value" mode="toc"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!-- <xsl:message>In toc template for Value, id=<xsl:value-of select="@id"/>.</xsl:message> --> + <p xmlns="http://www.w3.org/1999/xhtml" class="toc2"> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + xsl:text. </xsl:text> + <a class="toc" href="#{@id}"><xsl:value-of select="./cdf:title/text()"/></a> + </p> +</xsl:template> + +<!-- Significant code for displaying Value text is in + the original version of this file, at + http://nvd.nist.gov/scap/xccdf/docs/xccdf2xhtml-1.0.xsl --> + +<!-- Template for toc entries for both rules and groups --> +<xsl:template match="cdf:Group | cdf:Rule" mode="toc"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!-- <xsl:message>In toc template for Group|Rule, id=<xsl:value-of select="@id"/>.</xsl:message> --> + <p xmlns="http://www.w3.org/1999/xhtml" class="toc2"> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + xsl:text. </xsl:text> + <a class="toc" href="#{@id}"><xsl:value-of select="./cdf:title/text()"/></a> + </p> + <xsl:if test="./cdf:Group | ./cdf:Rule"> + <xsl:apply-templates mode="toc" + select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]"> + <xsl:with-param name="section-prefix" + select="concat($section-prefix,$section-num,'.')"/> + </xsl:apply-templates> + </xsl:if> +</xsl:template> + + +<!-- Template for toc entries for Profiles --> +<xsl:template match="cdf:Profile" mode="toc"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!-- <xsl:message>In toc template for Profile, id=<xsl:value-of select="@id"/>.</xsl:message> --> + <p xmlns="http://www.w3.org/1999/xhtml" class="toc2"> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + xsl:text. </xsl:text> + <a class="toc" href="#profile-{@id}"><xsl:value-of select="./cdf:title/text()"/></a> + </p> + +</xsl:template> + +<!-- template for body elements for Profiles --> +<xsl:template match="cdf:Profile" mode="body"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!-- <xsl:message>In body template for Profile, id=<xsl:value-of select="@id"/>.</xsl:message> --> + xsl:commentProfile id = <xsl:value-of select="./@id"/></xsl:comment> + <div xmlns="http://www.w3.org/1999/xhtml"> + <h3><a name="profile-{@id}"></a> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + xsl:text. Profile: </xsl:text> + <i><xsl:value-of select="./cdf:title/text()"/></i> + </h3> + + <div class="simpleText"> + <xsl:if test="@extends"> + <p>Extends: + <xsl:apply-templates select="key('profiles',@extends)" mode="prof-ref"/> + </p> + </xsl:if> + <xsl:if test="./cdf:status"> + <p>Status: <xsl:value-of select="./cdf:status/text()"/> + <xsl:if test="./cdf:status/@date"> + (as of <xsl:value-of select="./cdf:status/@date"/>) + </xsl:if> + </p> + </xsl:if> + <xsl:if test="./cdf:platform"> + <p>Applies only to:<ul> + <xsl:apply-templates select="./cdf:platform" mode="list"/> + </ul></p> + </xsl:if> + </div> + + <xsl:if test="./cdf:description"> + <h4>Description</h4> + <xsl:for-each select="./cdf:description"> + <div class="propertyText"> + <xsl:apply-templates select="./text() | ./*" mode="text"/> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:select"> + <h4>Item Selections</h4> + <div class="propertyText"> + <p>Rules and Groups explicitly selected and deselected for this profile.</p> + <ul> + <xsl:apply-templates select="." mode="sel-list"/> + </ul> + </div> + </xsl:if> + + <xsl:if test="./cdf:set-value | ./cdf:refine-value"> + <h4>Value Settings</h4> + <div class="propertyText"> + <p>Tailoring value adjustments explicitly set for this profile:</p> + <ul> + <xsl:apply-templates select="." mode="set-list"/> + </ul> + </div> + </xsl:if> + + <xsl:if test="./cdf:reference"> + <h4>References: + <xsl:for-each select="./cdf:reference"> + <xsl:if test="@href"> + <a href="{@href}"><xsl:value-of select="text()"/></a> + </xsl:if> + </xsl:for-each> + </h4> + </xsl:if> + </div> +</xsl:template> + +<xsl:template match="cdf:Profile" mode="sel-list"> + <xsl:apply-templates select="./cdf:select" mode="sel-list"/> +</xsl:template> + +<xsl:template match="cdf:Profile" mode="set-list"> + <xsl:apply-templates select="./cdf:set-value" mode="set-list"/> + <xsl:apply-templates select="./cdf:refine-value" mode="set-list"/> +</xsl:template> + +<xsl:template match="cdf:select" mode="sel-list"> + <li xmlns="http://www.w3.org/1999/xhtml"> + <xsl:if test="number(./@selected)">Included: </xsl:if> + <xsl:if test="not(number(./@selected))">Excluded: </xsl:if> + <xsl:if test="count(key('items',@idref))"> + <a href="#{@idref}"> + <xsl:value-of select="key('items', @idref)/cdf:title/text()"/> + </a> + </xsl:if> + <xsl:if test="not(count(key('items',@idref)))"> + (cluster) + <xsl:for-each select="key('clusters-rg',@idref)"> + <a href="#{./@id}"> + <xsl:value-of select="./cdf:title/text()"/> + </a> + </xsl:for-each> + </xsl:if> + </li> +</xsl:template> + +<xsl:template match="cdf:set-value" mode="set-list"> + <li xmlns="http://www.w3.org/1999/xhtml"> + <a href="#{@idref}"><xsl:value-of select="key('items', @idref)/cdf:title/text()"/></a><br/>xsl:text set to value: </xsl:text><b><xsl:value-of select="./text()"/></b> + </li> +</xsl:template> + +<xsl:template match="cdf:refine-value" mode="set-list"> + <li xmlns="http://www.w3.org/1999/xhtml"> + <a href="#{@idref}"><xsl:value-of select="key('items', @idref)/cdf:title/text()"/></a><br/>xsl:text refinement selector: </xsl:text><b><xsl:value-of select="./@selector"/></b> + </li> +</xsl:template> + +<xsl:template match="cdf:Profile" mode="prof-ref"> + <a href="#profile-{@id}"><xsl:value-of select="./cdf:title/text()"/></a> +</xsl:template> + + +<!-- Additional template for a Group element; + - we present a numbered section with title, and then + - the fields of the Group with a dl list, then the + - enclosed items as subsections. + --> +<xsl:template match="cdf:Group" mode="body"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!--<xsl:message>In body template for Group, id=<xsl:value-of select="@id"/>.</xsl:message>--> + xsl:commentGroup id = <xsl:value-of select="./@id"/></xsl:comment> + <div xmlns="http://www.w3.org/1999/xhtml"> + <h2><a name="{@id}"></a> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + <xsl:value-of select="concat(' ', ./cdf:title/text())"/> + </h2> + + <xsl:if test="./cdf:description"> + <xsl:for-each select="./cdf:description"> + <div class="propertyText"> + <xsl:apply-templates select="node()"/> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:rationale"> + <xsl:for-each select="./cdf:rationale"> + <div class="propertyText"> + <xsl:apply-templates select="node()"/> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:warning"> + <h4>Warning</h4> + <xsl:for-each select="./cdf:warning"> + <div class="propertyText"> + <xsl:apply-templates select="node()"/> + </div> + </xsl:for-each> + </xsl:if> + + + <xsl:if test="./cdf:reference"> + <h4>References: + <xsl:for-each select="./cdf:reference"> + <xsl:if test="@href"> + <a href="{@href}"><xsl:value-of select="text()"/> </a> + </xsl:if> + </xsl:for-each> + </h4> + </xsl:if> + + <xsl:if test="./cdf:Group | ./cdf:Rule"> + <xsl:apply-templates mode="body" select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]"> + <xsl:with-param name="section-prefix" + select="concat($section-prefix,$section-num,'.')"/> + </xsl:apply-templates> + </xsl:if> + </div> +</xsl:template> + +<!-- Additional template for a Rule element in body; + - we present a numbered section with title, and then + - the fields of the Rule with a dl list. + --> +<xsl:template match="cdf:Rule" mode="body"> + <xsl:param name="section-prefix"/> + <xsl:param name="section-num" select="position()"/> + + <!-- <xsl:message>In body template for Rule, id=<xsl:value-of select="@id"/>.</xsl:message> --> + xsl:commentRule id = <xsl:value-of select="./@id"/></xsl:comment> + <div xmlns="http://www.w3.org/1999/xhtml"> + <h3> + <a name="{@id}"></a> + <xsl:value-of select="$section-prefix"/> + <xsl:value-of select="$section-num"/> + <i><xsl:value-of select="concat(' ', ./cdf:title/text())"/></i> + </h3> + + + <xsl:if test="./cdf:description"> + <!-- <h4>Description</h4> --> + <xsl:for-each select="./cdf:description"> + <div class="rule"> + <xsl:apply-templates select="node()" /> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:rationale"> + <xsl:for-each select="./cdf:rationale"> + <div class="propertyText"> + <xsl:apply-templates select="node()" /> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:warning"> + <h4>Warning</h4> + <xsl:for-each select="./cdf:warning"> + <div class="propertyText"> + <xsl:apply-templates select="node()" /> + </div> + </xsl:for-each> + </xsl:if> + + + <xsl:if test="./cdf:check[@system='ocil-transitional']"> + <xsl:variable name="manualcheck" select="concat('manualcheck-', @id)"/> + <xsl:for-each select="./cdf:check[@system='ocil-transitional']/cdf:check-content"> + <h4 class="expandstyle"> + <a href="javascript:toggle('{$manualcheck}', 'link-{$manualcheck}');"> + <img id="link-{$manualcheck}" src="images/collapsed.png" height="20" width="20"/> Check Procedure + </a> + </h4> + <div id="{$manualcheck}" class="hiddencheck"> + <xsl:apply-templates select="node()" /> + </div> + </xsl:for-each> + </xsl:if> + + <xsl:if test="./cdf:reference"> + <h4>References: + <xsl:for-each select="./cdf:reference"> + <xsl:if test="@href"> + <a href="{@href}" style="padding-right:15px"><xsl:value-of select="text()"/></a> + </xsl:if> + </xsl:for-each> + </h4> + </xsl:if> + </div> +</xsl:template> + +<!-- templates in mode "text", for processing text with + markup and substitutions. --> + + <!-- getting rid of XHTML namespace --> + <xsl:template match="xhtml:*"> + <xsl:element name="{local-name()}"> + <xsl:apply-templates select="node()|@*"/> + </xsl:element> + </xsl:template> + + <xsl:template match="@*|node()"> + xsl:copy + <xsl:apply-templates select="@*|node()" /> + </xsl:copy> + </xsl:template> + +</xsl:stylesheet>
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/transforms/xccdf-removeaux.xslt | 3 +- RHEL6/transforms/xccdf2html.xslt | 614 +++++++++++++++++++++++++++++++++ 2 files changed, 615 insertions(+), 2 deletions(-) create mode 100644 RHEL6/transforms/xccdf2html.xslt
diff --git a/RHEL6/transforms/xccdf-removeaux.xslt b/RHEL6/transforms/xccdf-removeaux.xslt index 788969e..62ad820 100644 --- a/RHEL6/transforms/xccdf-removeaux.xslt +++ b/RHEL6/transforms/xccdf-removeaux.xslt @@ -8,8 +8,7 @@
<!-- remove the srg_support Group from final output, as it exists only to support the OS SRG mapping -->
- <xsl:template match="xccdf:Group[@id='srg_support']">
- </xsl:template>
<xsl:template match="xccdf:Group[@id='srg_support']" />
<!-- copy everything else through to final output -->
diff --git a/RHEL6/transforms/xccdf2html.xslt b/RHEL6/transforms/xccdf2html.xslt new file mode 100644 index 0000000..82d1d16 --- /dev/null +++ b/RHEL6/transforms/xccdf2html.xslt @@ -0,0 +1,614 @@ +<?xml version="1.0" encoding="UTF-8" ?>
+<!--
- This stylesheet transforms a resolved XCCDF document into a nice
- XHTML document, with table of contents, cross-links, and section
- numbers. This stylesheet basically assumes that the document is
- compliant with the XCCDF schema, so validation is probably
- advisable. Note that this stylesheet completely ignores all
- TestResult elements: they do not appear in the generated
- XHTML document.
- The XCCDF document MUST be resolved before applying this
- stylesheet. This stylesheet cannot deal with extension/inheritance
- at all.
- Original version from:
- Author: Neal Ziring (nziring@thecouch.ncsc.mil)
- Version: 0.12.4 (for XCCDF schema version 1.0rc4 - 0.12.4)
- Date: 13 Nov 04
- -->
I just peed a little. This is awesome.
+<!--
- THIS SOFTWARE WAS CREATED BY THE U.S. GOVERNMENT.
- SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
- EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- IN NO EVENT SHALL THE NATIONAL SECURITY AGENCY OR ANY AGENT OR
- REPRESENTATIVE THEREOF BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- DATA OR PROFITS; OR BUSINESS INTERRUPTION), HOWEVER CAUSED, UNDER ANY
- THEORY OF LIABILITY, ARISING IN ANY WAY OUT OF THE USE OF OR INABILITY
- TO MAKE USE OF THIS SOFTWARE.
+-->
+<xsl:stylesheet version="1.0"
- xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
- xmlns:htm="http://www.w3.org/1999/xhtml"
- xmlns:xhtml="http://www.w3.org/1999/xhtml"
- xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" >
+<!-- Set output style: XHTML using xml output method. --> +<xsl:output method="xml" encoding="UTF-8" indent="yes"/>
+<!-- Set up an id key to match on against all Items --> +<xsl:key name="items" match="cdf:Group | cdf:Rule | cdf:Value"
use="@id"/>
+<!-- Set up an id key to match on Item clusters: Rule and Group, Value --> +<xsl:key name="clusters-rg" match="cdf:Group | cdf:Rule"
use="@cluster-id"/>
+<xsl:key name="clusters-v" match="cdf:Value"
use="@cluster-id"/>
+<!-- Set up an id key to match on all Profiles --> +<xsl:key name="profiles" match="cdf:Profile" use="@id"/>
+<!-- TEMPLATE for cdf:Benchmark
- This template takes care of the top-level structure of the
- generated XHTML document. It handles the Benchmark element
- and all the content of the benchmark.
- -->
+<xsl:template match="/cdf:Benchmark">
<!-- First issue a warning if the Benchmark is not marked resolved. -->
- <xsl:if test="not(@resolved)">
<xsl:message>
Warning: benchmark <xsl:value-of select="@id"/> not resolved, formatted
output will be incomplete or corrupted.
</xsl:message>
- </xsl:if>
<!-- Define variables for section numbers. -->
- <xsl:variable name="introSecNum" select="1"/>
- <xsl:variable name="concSecNum"
select="2 + number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0) + number(count(./cdf:Profile)!=0)"/>
- <xsl:variable name="refSecNum"
select="2 + number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0) + number(count(./cdf:Profile)!=0) + number(count(./cdf:rear-matter)!=0)"/>
+<!-- Begin the HTML/XHTML body --> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head>
<title>XCCDF Benchmark: <xsl:value-of select="./cdf:title/text()"/></title>
<meta name="identifier" content="{@id}"/>
<script type="text/javascript">
- function toggle(divID, imgID) {
var item = document.getElementById(divID);
var img = document.getElementById(imgID);
if (item) {
item.className = (item.className=='hiddencheck') ? 'check':'hiddencheck';
}
if (img) {
var currimage = img.src.substring(img.src.lastIndexOf('/')+1);
img.src=(currimage=='collapsed.png')?'images/expanded.png':'images/collapsed.png';
}
- }
- </script>
<style type="text/css">
/* { background-color: #FFFFFF; } */
body { margin-left: 8%; margin-right: 8%; foreground: black; }
h1 { text-align: center; font-size: 200%; margin-top: 2em; margin-bottom: 2em;
font-family: verdana, arial, helvetica, sans-serif;
border-bottom: solid 2px gray; margin-bottom: 1.0em;
border-top: solid 2px gray; margin-bottom: 1.0em; }
h2 { margin-left: -2%; font-size: 125%;
border-bottom: solid 1px gray; margin-bottom: 1.0em;
margin-top: 2em; margin-bottom: 0.75em;
font-family: verdana, arial, helvetica, sans-serif; }
h3 { margin-left: 6%; font-size: 110%; margin-bottom: 0.25em;
font-family: verdana, arial, helvetica, sans-serif; }
h4 { margin-left: 10%; font-size: 100%; margin-bottom: 0.75em;
font-family: verdana, arial, helvetica, sans-serif; }
h5,h6 { margin-left: 10%; font-size: 90%; margin-bottom: 0.5em;
font-family: verdana, arial, helvetica, sans-serif; }
p { margin-bottom: 0.2em; margin-top: 0.2em; }
pre { margin-bottom: 0.5em; margin-top: 0.25em; margin-left: 3%;
font-family: monospace; font-size: 90%; }
ul { margin-bottom: 0.5em; margin-top: 0.25em; }
td { vertical-align: top; }
*.simpleText { margin-left: 10%; }
*.propertyText { margin-left: 10%; margin-top: 0.2em; margin-bottom: 0.2em }
*.toc { background: #FFFFFF; }
*.toc2 { background: #FFFFFF; }
div { margin-top: 1em; margin-bottom: 1em; }
div.rule { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; }
div.hiddencheck { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: none; }
div.check { margin-left: 10%; border: 1px solid; padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: block; }
div.legal { margin-left: 10%; }
div.toc { margin-left: 6%; margin-bottom: 4em;
padding-bottom: 0.75em; padding-top: 1em;
padding-left: 2em; padding-right: 2em;
}
h2.toc { border-bottom: none; margin-left: 0%; margin-top: 0em; }
p.toc { margin-left: 2em; margin-bottom: 0.2em; margin-top: 0.5em; }
p.toc2 { margin-left: 5em; margin-bottom: 0.1em; margin-top: 0.1em; }
ul.smallList { margin-bottom: 0.1em; margin-top: 0.1em; font-size: 85%; }
/* table.propertyTable { margin-left: 14%; width: 90%; margin-top: 0.5em; margin-bottom: 0.25em; }
th.propertyTableHead { font-size: 80%; background-color: #CCCCCC; } */
table { border-collapse:collapse; /*border: 1px solid black;*/ }
table,th,td { text-align: left; padding: 8px 8px; }
table tr:nth-child(2n+2) { background-color: #F4F4F4; }
th { border-bottom: 3px solid gray; }
.expandstyle a { color: black; text-decoration: none; }
.expandstyle a:link { color: black; text-decoration: none; }
.expandstyle a:visited { color: black; text-decoration: none; }
.expandstyle a:hover { color: black; text-decoration: none; }
.expandstyle a:active { color: black; text-decoration: none; }
- </style>
+</head> +<body>
- xsl:commentBenchmark id = <xsl:value-of select="./@id"/></xsl:comment>
- xsl:comment
This XHTML output file
generated using the
<xsl:value-of select="system-property('xsl:vendor')"/>
XSLT processor.
- </xsl:comment>
<!-- BEGINNING OF BODY -->
<h1><xsl:value-of select="./cdf:title"/></h1>
- <xsl:if test="./cdf:status | ./cdf:version | ./cdf:platform">
<div class="simpleText">
<p>Status: <b><xsl:value-of select="./cdf:status/text()"/></b>
<xsl:if test="./cdf:status/@date">
(as of <xsl:value-of select="./cdf:status/@date"/>)
</xsl:if>
</p>
<xsl:if test="./cdf:version">
<p>Version: <xsl:value-of select="./cdf:version/text()"/></p>
</xsl:if>
<xsl:if test="./cdf:platform">
<p>Applies to:<ul>
<xsl:apply-templates select="./cdf:platform" mode="list"/>
</ul></p>
</xsl:if>
</div>
- </xsl:if>
<!-- 1. Build the introduction -->
<!--<h2><a name="section-intro"></a>front-matter</h2> -->
- <xsl:if test="./cdf:front-matter">
<xsl:for-each select="./cdf:front-matter">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:description">
<h3>Description</h3>
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:notice">
<xsl:for-each select="./cdf:notice">
<h3>Notice</h3>
<div class="legal"><p><xsl:value-of select="text()"/></p></div>
</xsl:for-each>
- </xsl:if>
<!-- Build the Table of Contents -->
<br/>
<h3 class="toc">Contents</h3>
<div class="toc">
<!-- rules and groups TOC -->
<xsl:if test="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
- <xsl:apply-templates mode="toc"
select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix" />
- </xsl:apply-templates>
</xsl:if>
<!-- rear-matter TOC -->
<xsl:if test="./cdf:rear-matter">
<p class="toc">
<xsl:value-of select="$concSecNum"/>.
<a class="toc" href="#section---conc">Conclusions</a>
</p>
</xsl:if>
<!-- references TOC -->
<xsl:if test="./cdf:reference">
<p class="toc">
<xsl:value-of select="$refSecNum"/>. <a class="toc" href="#section---references">References</a>
</p>
</xsl:if>
</div>
<!-- Begin the main page content in the HTML body -->
<!-- Build the rules section (rules and groups) -->
- <xsl:if test="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:apply-templates select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]" mode="body">
<xsl:with-param name="section-prefix" />
</xsl:apply-templates>
- </xsl:if>
<!-- Build the conclusions section using Benchmark/rear-matter -->
- <xsl:if test="./cdf:rear-matter">
<h2><a name="section---conc"></a>
<xsl:value-of select="$concSecNum"/>. Conclusions
</h2>
<xsl:for-each select="./cdf:rear-matter">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
<!-- Build the references section using Benchmark/reference -->
- <xsl:if test="./cdf:reference">
<h2><a name="section---references"></a>
<xsl:value-of select="$refSecNum"/>. References
</h2>
<ol xmlns="http://www.w3.org/1999/xhtml" class="propertyText">
- <xsl:for-each select="./cdf:reference">
<li><xsl:value-of select="text()"/>
<xsl:if test="@href">
[<a href="{@href}">link</a>]
</xsl:if>
</li>
- </xsl:for-each>
</ol>
- </xsl:if>
<!-- All done, close out the HTML -->
</body>
+</html>
+</xsl:template>
+<!-- Additional templates for a Value element;
- For TOC, we present a line with number, for body
- we present a numbered section with title, and then
- the fields of the Value with a dl list.
- -->
+<xsl:template match="cdf:Value" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!-- <xsl:message>In toc template for Value, id=<xsl:value-of select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#{@id}"><xsl:value-of select="./cdf:title/text()"/></a>
</p>
+</xsl:template>
+<!-- Significant code for displaying Value text is in
the original version of this file, at
http://nvd.nist.gov/scap/xccdf/docs/xccdf2xhtml-1.0.xsl -->
+<!-- Template for toc entries for both rules and groups --> +<xsl:template match="cdf:Group | cdf:Rule" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!-- <xsl:message>In toc template for Group|Rule, id=<xsl:value-of select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#{@id}"><xsl:value-of select="./cdf:title/text()"/></a>
</p>
- <xsl:if test="./cdf:Group | ./cdf:Rule">
- <xsl:apply-templates mode="toc"
select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix"
select="concat($section-prefix,$section-num,'.')"/>
- </xsl:apply-templates>
- </xsl:if>
+</xsl:template>
+<!-- Template for toc entries for Profiles --> +<xsl:template match="cdf:Profile" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!-- <xsl:message>In toc template for Profile, id=<xsl:value-of select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#profile-{@id}"><xsl:value-of select="./cdf:title/text()"/></a>
</p>
+</xsl:template>
+<!-- template for body elements for Profiles --> +<xsl:template match="cdf:Profile" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!-- <xsl:message>In body template for Profile, id=<xsl:value-of select="@id"/>.</xsl:message> -->
- xsl:commentProfile id = <xsl:value-of select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h3><a name="profile-{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. Profile: </xsl:text>
<i><xsl:value-of select="./cdf:title/text()"/></i>
</h3>
<div class="simpleText">
- <xsl:if test="@extends">
<p>Extends:
<xsl:apply-templates select="key('profiles',@extends)" mode="prof-ref"/>
</p>
- </xsl:if>
- <xsl:if test="./cdf:status">
<p>Status: <xsl:value-of select="./cdf:status/text()"/>
<xsl:if test="./cdf:status/@date">
(as of <xsl:value-of select="./cdf:status/@date"/>)
- </xsl:if>
</p>
- </xsl:if>
- <xsl:if test="./cdf:platform">
<p>Applies only to:<ul>
<xsl:apply-templates select="./cdf:platform" mode="list"/>
</ul></p>
- </xsl:if>
</div>
- <xsl:if test="./cdf:description">
<h4>Description</h4>
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:select">
<h4>Item Selections</h4>
<div class="propertyText">
<p>Rules and Groups explicitly selected and deselected for this profile.</p>
<ul>
<xsl:apply-templates select="." mode="sel-list"/>
</ul>
</div>
- </xsl:if>
- <xsl:if test="./cdf:set-value | ./cdf:refine-value">
<h4>Value Settings</h4>
<div class="propertyText">
<p>Tailoring value adjustments explicitly set for this profile:</p>
<ul>
<xsl:apply-templates select="." mode="set-list"/>
</ul>
</div>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
- <xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}"><xsl:value-of select="text()"/></a>
</xsl:if>
- </xsl:for-each>
</h4>
- </xsl:if>
</div>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="sel-list">
- <xsl:apply-templates select="./cdf:select" mode="sel-list"/>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="set-list">
- <xsl:apply-templates select="./cdf:set-value" mode="set-list"/>
- <xsl:apply-templates select="./cdf:refine-value" mode="set-list"/>
+</xsl:template>
+<xsl:template match="cdf:select" mode="sel-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<xsl:if test="number(./@selected)">Included: </xsl:if>
<xsl:if test="not(number(./@selected))">Excluded: </xsl:if>
<xsl:if test="count(key('items',@idref))">
<a href="#{@idref}">
<xsl:value-of select="key('items', @idref)/cdf:title/text()"/>
</a>
</xsl:if>
<xsl:if test="not(count(key('items',@idref)))">
(cluster)
<xsl:for-each select="key('clusters-rg',@idref)">
<a href="#{./@id}">
<xsl:value-of select="./cdf:title/text()"/>
</a>
</xsl:for-each>
</xsl:if>
</li>
+</xsl:template>
+<xsl:template match="cdf:set-value" mode="set-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<a href="#{@idref}"><xsl:value-of select="key('items', @idref)/cdf:title/text()"/></a><br/><xsl:text> set to value: </xsl:text><b><xsl:value-of select="./text()"/></b>
</li>
+</xsl:template>
+<xsl:template match="cdf:refine-value" mode="set-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<a href="#{@idref}"><xsl:value-of select="key('items', @idref)/cdf:title/text()"/></a><br/><xsl:text> refinement selector: </xsl:text><b><xsl:value-of select="./@selector"/></b>
</li>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="prof-ref">
- <a href="#profile-{@id}"><xsl:value-of select="./cdf:title/text()"/></a>
+</xsl:template>
+<!-- Additional template for a Group element;
- we present a numbered section with title, and then
- the fields of the Group with a dl list, then the
- enclosed items as subsections.
- -->
+<xsl:template match="cdf:Group" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!--<xsl:message>In body template for Group, id=<xsl:value-of select="@id"/>.</xsl:message>-->
- xsl:commentGroup id = <xsl:value-of select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h2><a name="{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:value-of select="concat(' ', ./cdf:title/text())"/>
</h2>
- <xsl:if test="./cdf:description">
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:rationale">
<xsl:for-each select="./cdf:rationale">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:warning">
<h4>Warning</h4>
<xsl:for-each select="./cdf:warning">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
<xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}"><xsl:value-of select="text()"/> </a>
</xsl:if>
</xsl:for-each>
</h4>
- </xsl:if>
- <xsl:if test="./cdf:Group | ./cdf:Rule">
<xsl:apply-templates mode="body" select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix"
select="concat($section-prefix,$section-num,'.')"/>
</xsl:apply-templates>
- </xsl:if>
</div>
+</xsl:template>
+<!-- Additional template for a Rule element in body;
- we present a numbered section with title, and then
- the fields of the Rule with a dl list.
- -->
+<xsl:template match="cdf:Rule" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
<!-- <xsl:message>In body template for Rule, id=<xsl:value-of select="@id"/>.</xsl:message> -->
- xsl:commentRule id = <xsl:value-of select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h3>
<a name="{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<i><xsl:value-of select="concat(' ', ./cdf:title/text())"/></i>
</h3>
- <xsl:if test="./cdf:description">
<!-- <h4>Description</h4> -->
<xsl:for-each select="./cdf:description">
<div class="rule">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:rationale">
<xsl:for-each select="./cdf:rationale">
<div class="propertyText">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:warning">
<h4>Warning</h4>
<xsl:for-each select="./cdf:warning">
<div class="propertyText">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:check[@system='ocil-transitional']">
- <xsl:variable name="manualcheck" select="concat('manualcheck-', @id)"/>
<xsl:for-each select="./cdf:check[@system='ocil-transitional']/cdf:check-content">
<h4 class="expandstyle">
<a href="javascript:toggle('{$manualcheck}', 'link-{$manualcheck}');">
<img id="link-{$manualcheck}" src="images/collapsed.png" height="20" width="20"/> Check Procedure
</a>
</h4>
<div id="{$manualcheck}" class="hiddencheck">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
<xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}" style="padding-right:15px"><xsl:value-of select="text()"/></a>
</xsl:if>
</xsl:for-each>
</h4>
- </xsl:if>
</div>
+</xsl:template>
+<!-- templates in mode "text", for processing text with
markup and substitutions. -->
<!-- getting rid of XHTML namespace -->
- <xsl:template match="xhtml:*">
<xsl:element name="{local-name()}">
<xsl:apply-templates select="node()|@*"/>
</xsl:element>
- </xsl:template>
- <xsl:template match="@*|node()">
- xsl:copy
<xsl:apply-templates select="@*|node()" />
- </xsl:copy>
- </xsl:template>
+</xsl:stylesheet>
Ack
On 10/9/13 11:13 PM, Shawn Wells wrote:
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/transforms/xccdf-removeaux.xslt | 3 +- RHEL6/transforms/xccdf2html.xslt | 614 +++++++++++++++++++++++++++++++++ 2 files changed, 615 insertions(+), 2 deletions(-) create mode 100644 RHEL6/transforms/xccdf2html.xslt
diff --git a/RHEL6/transforms/xccdf-removeaux.xslt b/RHEL6/transforms/xccdf-removeaux.xslt index 788969e..62ad820 100644 --- a/RHEL6/transforms/xccdf-removeaux.xslt +++ b/RHEL6/transforms/xccdf-removeaux.xslt @@ -8,8 +8,7 @@ <!-- remove the srg_support Group from final output, as it exists only to support the OS SRG mapping -->
- <xsl:template match="xccdf:Group[@id='srg_support']">
- </xsl:template>
- <xsl:template match="xccdf:Group[@id='srg_support']" /> <!-- copy everything else through to final output -->
diff --git a/RHEL6/transforms/xccdf2html.xslt b/RHEL6/transforms/xccdf2html.xslt new file mode 100644 index 0000000..82d1d16 --- /dev/null +++ b/RHEL6/transforms/xccdf2html.xslt @@ -0,0 +1,614 @@ +<?xml version="1.0" encoding="UTF-8" ?>
+<!--
- This stylesheet transforms a resolved XCCDF document into a nice
- XHTML document, with table of contents, cross-links, and section
- numbers. This stylesheet basically assumes that the document is
- compliant with the XCCDF schema, so validation is probably
- advisable. Note that this stylesheet completely ignores all
- TestResult elements: they do not appear in the generated
- XHTML document.
- The XCCDF document MUST be resolved before applying this
- stylesheet. This stylesheet cannot deal with extension/inheritance
- at all.
- Original version from:
- Author: Neal Ziring (nziring@thecouch.ncsc.mil)
- Version: 0.12.4 (for XCCDF schema version 1.0rc4 - 0.12.4)
- Date: 13 Nov 04
- -->
I just peed a little. This is awesome.
+<!--
- THIS SOFTWARE WAS CREATED BY THE U.S. GOVERNMENT.
- SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
- EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- IN NO EVENT SHALL THE NATIONAL SECURITY AGENCY OR ANY AGENT OR
- REPRESENTATIVE THEREOF BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- DATA OR PROFITS; OR BUSINESS INTERRUPTION), HOWEVER CAUSED, UNDER ANY
- THEORY OF LIABILITY, ARISING IN ANY WAY OUT OF THE USE OF OR INABILITY
- TO MAKE USE OF THIS SOFTWARE.
+-->
+<xsl:stylesheet version="1.0"
- xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
- xmlns:htm="http://www.w3.org/1999/xhtml"
- xmlns:xhtml="http://www.w3.org/1999/xhtml"
- xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" >
+<!-- Set output style: XHTML using xml output method. --> +<xsl:output method="xml" encoding="UTF-8" indent="yes"/>
+<!-- Set up an id key to match on against all Items --> +<xsl:key name="items" match="cdf:Group | cdf:Rule | cdf:Value"
use="@id"/>
+<!-- Set up an id key to match on Item clusters: Rule and Group, Value --> +<xsl:key name="clusters-rg" match="cdf:Group | cdf:Rule"
use="@cluster-id"/>
+<xsl:key name="clusters-v" match="cdf:Value"
use="@cluster-id"/>
+<!-- Set up an id key to match on all Profiles --> +<xsl:key name="profiles" match="cdf:Profile" use="@id"/>
+<!-- TEMPLATE for cdf:Benchmark
- This template takes care of the top-level structure of the
- generated XHTML document. It handles the Benchmark element
- and all the content of the benchmark.
- -->
+<xsl:template match="/cdf:Benchmark">
- <!-- First issue a warning if the Benchmark is not marked
resolved. -->
- <xsl:if test="not(@resolved)">
<xsl:message>
Warning: benchmark <xsl:value-of select="@id"/> not
resolved, formatted
output will be incomplete or corrupted.
</xsl:message>
- </xsl:if>
<!-- Define variables for section numbers. -->
- <xsl:variable name="introSecNum" select="1"/>
- <xsl:variable name="concSecNum"
select="2 +
number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0)
- number(count(./cdf:Profile)!=0)"/>
- <xsl:variable name="refSecNum"
select="2 +
number(count(./cdf:Rule[not(number(@hidden)+number(@abstract))] | ./cdf:Group[not(number(@hidden)+number(@abstract))])!=0) + number(count(//cdf:Value[not(number(@hidden)+number(@abstract))])!=0)
- number(count(./cdf:Profile)!=0) +
number(count(./cdf:rear-matter)!=0)"/>
+<!-- Begin the HTML/XHTML body --> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head>
<title>XCCDF Benchmark: <xsl:value-of
select="./cdf:title/text()"/></title>
<meta name="identifier" content="{@id}"/>
<script type="text/javascript">
- function toggle(divID, imgID) {
var item = document.getElementById(divID);
var img = document.getElementById(imgID);
if (item) {
item.className = (item.className=='hiddencheck') ?
'check':'hiddencheck';
}
if (img) {
var currimage =
img.src.substring(img.src.lastIndexOf('/')+1);
img.src=(currimage=='collapsed.png')?'images/expanded.png':'images/collapsed.png';
}
- }
- </script>
<style type="text/css">
/* { background-color: #FFFFFF; } */
body { margin-left: 8%; margin-right: 8%; foreground: black; }
h1 { text-align: center; font-size: 200%; margin-top: 2em;
margin-bottom: 2em;
font-family: verdana, arial, helvetica, sans-serif;
border-bottom: solid 2px gray; margin-bottom: 1.0em;
border-top: solid 2px gray; margin-bottom: 1.0em; }
h2 { margin-left: -2%; font-size: 125%;
border-bottom: solid 1px gray; margin-bottom: 1.0em;
margin-top: 2em; margin-bottom: 0.75em;
font-family: verdana, arial, helvetica, sans-serif; }
h3 { margin-left: 6%; font-size: 110%; margin-bottom: 0.25em;
font-family: verdana, arial, helvetica, sans-serif; }
h4 { margin-left: 10%; font-size: 100%; margin-bottom: 0.75em;
font-family: verdana, arial, helvetica, sans-serif; }
h5,h6 { margin-left: 10%; font-size: 90%; margin-bottom: 0.5em;
font-family: verdana, arial, helvetica, sans-serif; }
p { margin-bottom: 0.2em; margin-top: 0.2em; }
pre { margin-bottom: 0.5em; margin-top: 0.25em; margin-left: 3%;
font-family: monospace; font-size: 90%; }
ul { margin-bottom: 0.5em; margin-top: 0.25em; }
td { vertical-align: top; }
*.simpleText { margin-left: 10%; }
*.propertyText { margin-left: 10%; margin-top: 0.2em;
margin-bottom: 0.2em }
*.toc { background: #FFFFFF; }
*.toc2 { background: #FFFFFF; }
div { margin-top: 1em; margin-bottom: 1em; }
div.rule { margin-left: 10%; border: 1px solid;
padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; }
div.hiddencheck { margin-left: 10%; border: 1px solid;
padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: none; }
div.check { margin-left: 10%; border: 1px solid;
padding: 10px 10px 10px 10px; margin-top: 1em; margin-bottom: 1em; display: block; }
div.legal { margin-left: 10%; }
div.toc { margin-left: 6%; margin-bottom: 4em;
padding-bottom: 0.75em; padding-top: 1em;
padding-left: 2em; padding-right: 2em;
}
h2.toc { border-bottom: none; margin-left: 0%;
margin-top: 0em; }
p.toc { margin-left: 2em; margin-bottom: 0.2em;
margin-top: 0.5em; }
p.toc2 { margin-left: 5em; margin-bottom: 0.1em;
margin-top: 0.1em; }
ul.smallList { margin-bottom: 0.1em; margin-top: 0.1em;
font-size: 85%; }
/* table.propertyTable { margin-left: 14%; width: 90%;
margin-top: 0.5em; margin-bottom: 0.25em; }
th.propertyTableHead { font-size: 80%; background-color:
#CCCCCC; } */
table { border-collapse:collapse; /*border: 1px solid
black;*/ }
table,th,td { text-align: left; padding: 8px 8px; }
table tr:nth-child(2n+2) { background-color: #F4F4F4; }
th { border-bottom: 3px solid gray; }
.expandstyle a { color: black; text-decoration: none; }
.expandstyle a:link { color: black; text-decoration: none; }
.expandstyle a:visited { color: black; text-decoration: none; }
.expandstyle a:hover { color: black; text-decoration: none; }
.expandstyle a:active { color: black; text-decoration: none; }
- </style>
+</head> +<body>
- xsl:commentBenchmark id = <xsl:value-of
select="./@id"/></xsl:comment>
- xsl:comment
This XHTML output file
generated using the
<xsl:value-of select="system-property('xsl:vendor')"/>
XSLT processor.
- </xsl:comment>
<!-- BEGINNING OF BODY -->
<h1><xsl:value-of select="./cdf:title"/></h1>
- <xsl:if test="./cdf:status | ./cdf:version | ./cdf:platform">
<div class="simpleText">
<p>Status: <b><xsl:value-of select="./cdf:status/text()"/></b>
<xsl:if test="./cdf:status/@date">
(as of <xsl:value-of select="./cdf:status/@date"/>)
</xsl:if>
</p>
<xsl:if test="./cdf:version">
<p>Version: <xsl:value-of select="./cdf:version/text()"/></p>
</xsl:if>
<xsl:if test="./cdf:platform">
<p>Applies to:<ul>
<xsl:apply-templates select="./cdf:platform" mode="list"/>
</ul></p>
</xsl:if>
</div>
- </xsl:if>
<!-- 1. Build the introduction -->
<!--<h2><a name="section-intro"></a>front-matter</h2> -->
- <xsl:if test="./cdf:front-matter">
<xsl:for-each select="./cdf:front-matter">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:description">
<h3>Description</h3>
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:notice">
<xsl:for-each select="./cdf:notice">
<h3>Notice</h3>
<div class="legal"><p><xsl:value-of
select="text()"/></p></div>
</xsl:for-each>
- </xsl:if>
<!-- Build the Table of Contents -->
<br/>
<h3 class="toc">Contents</h3>
<div class="toc">
<!-- rules and groups TOC -->
<xsl:if
test="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
- <xsl:apply-templates mode="toc"
- select="./cdf:Group[not(number(@hidden)+number(@abstract))] |
./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix" />
- </xsl:apply-templates>
</xsl:if>
<!-- rear-matter TOC -->
<xsl:if test="./cdf:rear-matter">
<p class="toc">
<xsl:value-of select="$concSecNum"/>.
<a class="toc" href="#section---conc">Conclusions</a>
</p>
</xsl:if>
<!-- references TOC -->
<xsl:if test="./cdf:reference">
<p class="toc">
<xsl:value-of select="$refSecNum"/>. <a class="toc"
href="#section---references">References</a>
</p>
</xsl:if>
</div>
<!-- Begin the main page content in the HTML body -->
<!-- Build the rules section (rules and groups) -->
- <xsl:if test="./cdf:Group[not(number(@hidden)+number(@abstract))]
| ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:apply-templates
select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]" mode="body">
<xsl:with-param name="section-prefix" />
</xsl:apply-templates>
- </xsl:if>
<!-- Build the conclusions section using Benchmark/rear-matter -->
- <xsl:if test="./cdf:rear-matter">
<h2><a name="section---conc"></a>
<xsl:value-of select="$concSecNum"/>. Conclusions
</h2>
<xsl:for-each select="./cdf:rear-matter">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
<!-- Build the references section using Benchmark/reference -->
- <xsl:if test="./cdf:reference">
<h2><a name="section---references"></a>
<xsl:value-of select="$refSecNum"/>. References
</h2>
<ol xmlns="http://www.w3.org/1999/xhtml" class="propertyText">
- <xsl:for-each select="./cdf:reference">
<li><xsl:value-of select="text()"/>
<xsl:if test="@href">
[<a href="{@href}">link</a>]
</xsl:if>
</li>
- </xsl:for-each>
</ol>
- </xsl:if>
<!-- All done, close out the HTML -->
</body>
+</html>
+</xsl:template>
+<!-- Additional templates for a Value element;
- For TOC, we present a line with number, for body
- we present a numbered section with title, and then
- the fields of the Value with a dl list.
- -->
+<xsl:template match="cdf:Value" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!-- xsl:messageIn toc template for Value, id=<xsl:value-of
select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#{@id}"><xsl:value-of
select="./cdf:title/text()"/></a>
</p>
+</xsl:template>
+<!-- Significant code for displaying Value text is in
the original version of this file, at
http://nvd.nist.gov/scap/xccdf/docs/xccdf2xhtml-1.0.xsl -->
+<!-- Template for toc entries for both rules and groups --> +<xsl:template match="cdf:Group | cdf:Rule" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!-- xsl:messageIn toc template for Group|Rule, id=<xsl:value-of
select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#{@id}"><xsl:value-of
select="./cdf:title/text()"/></a>
</p>
- <xsl:if test="./cdf:Group | ./cdf:Rule">
- <xsl:apply-templates mode="toc"
- select="./cdf:Group[not(number(@hidden)+number(@abstract))] |
./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix"
- select="concat($section-prefix,$section-num,'.')"/>
- </xsl:apply-templates>
- </xsl:if>
+</xsl:template>
+<!-- Template for toc entries for Profiles --> +<xsl:template match="cdf:Profile" mode="toc">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!-- xsl:messageIn toc template for Profile, id=<xsl:value-of
select="@id"/>.</xsl:message> -->
<p xmlns="http://www.w3.org/1999/xhtml" class="toc2">
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. </xsl:text>
<a class="toc" href="#profile-{@id}"><xsl:value-of
select="./cdf:title/text()"/></a>
</p>
+</xsl:template>
+<!-- template for body elements for Profiles --> +<xsl:template match="cdf:Profile" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!-- xsl:messageIn body template for Profile, id=<xsl:value-of
select="@id"/>.</xsl:message> -->
- xsl:commentProfile id = <xsl:value-of
select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h3><a name="profile-{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:text>. Profile: </xsl:text>
<i><xsl:value-of select="./cdf:title/text()"/></i>
</h3>
<div class="simpleText">
- <xsl:if test="@extends">
<p>Extends:
<xsl:apply-templates select="key('profiles',@extends)"
mode="prof-ref"/>
</p>
- </xsl:if>
- <xsl:if test="./cdf:status">
<p>Status: <xsl:value-of select="./cdf:status/text()"/>
<xsl:if test="./cdf:status/@date">
(as of <xsl:value-of select="./cdf:status/@date"/>)
- </xsl:if>
</p>
- </xsl:if>
- <xsl:if test="./cdf:platform">
<p>Applies only to:<ul>
<xsl:apply-templates select="./cdf:platform" mode="list"/>
</ul></p>
- </xsl:if>
</div>
- <xsl:if test="./cdf:description">
<h4>Description</h4>
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="./text() | ./*" mode="text"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:select">
<h4>Item Selections</h4>
<div class="propertyText">
<p>Rules and Groups explicitly selected and deselected for this
profile.</p>
<ul>
<xsl:apply-templates select="." mode="sel-list"/>
</ul>
</div>
- </xsl:if>
- <xsl:if test="./cdf:set-value | ./cdf:refine-value">
<h4>Value Settings</h4>
<div class="propertyText">
<p>Tailoring value adjustments explicitly set for this profile:</p>
<ul>
<xsl:apply-templates select="." mode="set-list"/>
</ul>
</div>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
- <xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}"><xsl:value-of select="text()"/></a>
</xsl:if>
- </xsl:for-each>
</h4>
- </xsl:if>
</div>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="sel-list">
- <xsl:apply-templates select="./cdf:select" mode="sel-list"/>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="set-list">
- <xsl:apply-templates select="./cdf:set-value" mode="set-list"/>
- <xsl:apply-templates select="./cdf:refine-value" mode="set-list"/>
+</xsl:template>
+<xsl:template match="cdf:select" mode="sel-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<xsl:if test="number(./@selected)">Included: </xsl:if>
<xsl:if test="not(number(./@selected))">Excluded: </xsl:if>
<xsl:if test="count(key('items',@idref))">
<a href="#{@idref}">
<xsl:value-of select="key('items',
@idref)/cdf:title/text()"/>
</a>
</xsl:if>
<xsl:if test="not(count(key('items',@idref)))">
(cluster)
<xsl:for-each select="key('clusters-rg',@idref)">
<a href="#{./@id}">
<xsl:value-of select="./cdf:title/text()"/>
</a>
</xsl:for-each>
</xsl:if>
</li>
+</xsl:template>
+<xsl:template match="cdf:set-value" mode="set-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<a href="#{@idref}"><xsl:value-of select="key('items',
@idref)/cdf:title/text()"/></a><br/>xsl:text set to value: </xsl:text><b><xsl:value-of select="./text()"/></b>
</li>
+</xsl:template>
+<xsl:template match="cdf:refine-value" mode="set-list">
<li xmlns="http://www.w3.org/1999/xhtml">
<a href="#{@idref}"><xsl:value-of select="key('items',
@idref)/cdf:title/text()"/></a><br/>xsl:text refinement selector: </xsl:text><b><xsl:value-of select="./@selector"/></b>
</li>
+</xsl:template>
+<xsl:template match="cdf:Profile" mode="prof-ref">
- <a href="#profile-{@id}"><xsl:value-of
select="./cdf:title/text()"/></a> +</xsl:template>
+<!-- Additional template for a Group element;
- we present a numbered section with title, and then
- the fields of the Group with a dl list, then the
- enclosed items as subsections.
- -->
+<xsl:template match="cdf:Group" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!--xsl:messageIn body template for Group, id=<xsl:value-of
select="@id"/>.</xsl:message>-->
- xsl:commentGroup id = <xsl:value-of select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h2><a name="{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<xsl:value-of select="concat(' ', ./cdf:title/text())"/>
</h2>
- <xsl:if test="./cdf:description">
<xsl:for-each select="./cdf:description">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:rationale">
<xsl:for-each select="./cdf:rationale">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:warning">
<h4>Warning</h4>
<xsl:for-each select="./cdf:warning">
<div class="propertyText">
<xsl:apply-templates select="node()"/>
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
<xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}"><xsl:value-of select="text()"/> </a>
</xsl:if>
</xsl:for-each>
</h4>
- </xsl:if>
- <xsl:if test="./cdf:Group | ./cdf:Rule">
<xsl:apply-templates mode="body"
select="./cdf:Group[not(number(@hidden)+number(@abstract))] | ./cdf:Rule[not(number(@hidden)+number(@abstract))]">
<xsl:with-param name="section-prefix"
- select="concat($section-prefix,$section-num,'.')"/>
</xsl:apply-templates>
- </xsl:if>
</div>
+</xsl:template>
+<!-- Additional template for a Rule element in body;
- we present a numbered section with title, and then
- the fields of the Rule with a dl list.
- -->
+<xsl:template match="cdf:Rule" mode="body">
- <xsl:param name="section-prefix"/>
- <xsl:param name="section-num" select="position()"/>
- <!-- xsl:messageIn body template for Rule, id=<xsl:value-of
select="@id"/>.</xsl:message> -->
- xsl:commentRule id = <xsl:value-of select="./@id"/></xsl:comment>
<div xmlns="http://www.w3.org/1999/xhtml">
<h3>
<a name="{@id}"></a>
<xsl:value-of select="$section-prefix"/>
<xsl:value-of select="$section-num"/>
<i><xsl:value-of select="concat(' ', ./cdf:title/text())"/></i>
</h3>
- <xsl:if test="./cdf:description">
<!-- <h4>Description</h4> -->
<xsl:for-each select="./cdf:description">
<div class="rule">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:rationale">
<xsl:for-each select="./cdf:rationale">
<div class="propertyText">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:warning">
<h4>Warning</h4>
<xsl:for-each select="./cdf:warning">
<div class="propertyText">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:check[@system='ocil-transitional']">
- <xsl:variable name="manualcheck" select="concat('manualcheck-',
@id)"/>
<xsl:for-each
select="./cdf:check[@system='ocil-transitional']/cdf:check-content">
<h4 class="expandstyle">
<a href="javascript:toggle('{$manualcheck}',
'link-{$manualcheck}');">
<img id="link-{$manualcheck}" src="images/collapsed.png"
height="20" width="20"/> Check Procedure
</a>
</h4>
<div id="{$manualcheck}" class="hiddencheck">
<xsl:apply-templates select="node()" />
</div>
</xsl:for-each>
- </xsl:if>
- <xsl:if test="./cdf:reference">
<h4>References:
<xsl:for-each select="./cdf:reference">
<xsl:if test="@href">
<a href="{@href}"
style="padding-right:15px"><xsl:value-of select="text()"/></a>
</xsl:if>
</xsl:for-each>
</h4>
- </xsl:if>
</div>
+</xsl:template>
+<!-- templates in mode "text", for processing text with
markup and substitutions. -->
<!-- getting rid of XHTML namespace -->
- <xsl:template match="xhtml:*">
<xsl:element name="{local-name()}">
<xsl:apply-templates select="node()|@*"/>
</xsl:element>
- </xsl:template>
- <xsl:template match="@*|node()">
- xsl:copy
<xsl:apply-templates select="@*|node()" />
- </xsl:copy>
- </xsl:template>
+</xsl:stylesheet>
Ack
for those following at home, who don't want to clone source: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide...
very very improved!
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/Makefile | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 1c3d2a9..aa746ce 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -35,8 +35,9 @@ guide: shorthand2xccdf # remove auxiliary Groups which are only for use in tables, and not guide output. # specifying a nonexistent profile, "allrules," to make oscap print all Rules xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml - xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf.xml + xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf-guide.xml oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html + xsltproc -o $(OUT)/rhel6-guide-custom.html $(TRANS)/xccdf2html.xslt $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml
# example, if needed: for converting XCCDF into shorthand #xccdf2shorthand:
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/Makefile | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 1c3d2a9..aa746ce 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -35,8 +35,9 @@ guide: shorthand2xccdf # remove auxiliary Groups which are only for use in tables, and not guide output. # specifying a nonexistent profile, "allrules," to make oscap print all Rules xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml
- xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf.xml
xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf-guide.xml oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html
xsltproc -o $(OUT)/rhel6-guide-custom.html $(TRANS)/xccdf2html.xslt $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml
# example, if needed: for converting XCCDF into shorthand #xccdf2shorthand:
ack
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/system/software/integrity.xml | 103 ++++++++++------------------- RHEL6/input/system/software/updating.xml | 31 ++++----- 2 files changed, 50 insertions(+), 84 deletions(-)
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 6d91bfb..b706f90 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -10,8 +10,8 @@ The RPM package management system can conduct integrity checks by comparing information in its metadata database with files installed on the system. <br /><br /> -Integrity checking cannot <i>prevent</i> intrusions into your -system, but can detect that they have occurred. Requirements +Integrity checking cannot <i>prevent</i> intrusions, +but can detect that they have occurred. Requirements for software integrity checking may be highly dependent on the environment in which the system will be used. Snapshot-based approaches such as AIDE may induce considerable overhead @@ -21,8 +21,8 @@ in the presence of frequent software updates. <Group id="aide"> <title>Verify Integrity with AIDE</title> <description>AIDE conducts integrity checks by comparing information about -files with previously-gathered information. Ideally, the AIDE database should -be created immediately after your system is built, and then again after any +files with previously-gathered information. Ideally, the AIDE database is +created immediately after initial system configuration, and then again after any software update. AIDE is highly configurable, with further configuration information located in <tt>/usr/share/doc/aide-<i>VERSION</i></tt>. </description> @@ -86,7 +86,6 @@ must be captured and it should be able to be verified against the installed file <Rule id="aide_periodic_cron_checking" severity="medium"> <title>Configure Periodic Execution of AIDE</title> <description> -AIDE should be executed on a periodic basis to check for changes. To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>: <pre>05 4 * * * root /usr/sbin/aide --check</pre> AIDE can be executed periodically through other means; this is merely one example. @@ -97,38 +96,11 @@ To determine that periodic AIDE execution has been scheduled, run the following </ocil> <rationale> By default, AIDE does not install itself for periodic execution. Periodically -running AIDE may reveal unexpected changes in installed files. +running AIDE is necessary to reveal unexpected changes in installed files. </rationale> <ident cce="27222-9" /> <ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> -<!-- -<Group id="aide_verify_integrity_manually"> -<title>Manually Verify Integrity of AIDE</title> -<description> -Manually verify the integrity of the AIDE binaries, configuration file, and database. Possibilities for doing -so include: -<br /><br /> -1. Use sha1sum or md5sum to generate checksums on the files and then visually compare them to those -generated from the safely stored versions. This does not, of course, preclude the possibility that such -output could also be faked. -<br /><br /> -2. Mount the stored versions on read-only media and run <tt>/bin/diff</tt> to verify that there are no differences -between the files. -<br /><br /> -3. Copying the files to another system and performing the hash or file comparisons there may impart -additional confidence that the manual verification process is not being interfered with. -</description> -<rationale> -Because integrity checking is a means of intrusion detection and not intrusion prevention, it cannot be guaranteed -that the AIDE binaries, configuration files, or database have not been tampered with. An attacker could disable -or alter these files after a successful intrusion. Because of this, manual and frequent checks on these files is -recommended. The safely stored copies (or hashes) of the database, binary, and configuration file were created -earlier for this purpose. -</rationale> -<ref nist="SC-28, SI-7" /> -</Group> ---> </Group>
<Group id="rpm_verification"> @@ -145,12 +117,16 @@ See the man page for <tt>rpm</tt> to see a complete explanation of each column. </description>
<Rule id="rpm_verify_permissions"> -<title>Verify File Permissions with RPM</title> -<description>The RPM package management system can check file access +<title>Verify and Correct File Permissions with RPM</title> +<description> +The RPM package management system can check file access permissions of installed software packages, including many that are -important to system security. The following command will reset permissions to -their expected values: -<pre># rpm --setperms <i>package</i></pre> +important to system security. +After locating a file with incorrect permissions, run the following command to determine which package owns it: +<pre># rpm -qf <i>FILENAME</i></pre> +Next, run the following command to reset its permissions to +the correct values: +<pre># rpm --setperms <i>PACKAGENAME</i></pre> </description> <ocil clause="there is output"> The following command will list which files on the system have permissions different from what @@ -174,21 +150,25 @@ installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database: <pre># rpm -Va | grep '^..5'</pre> -A "c" in the second column indicates that a file is a configuration file, -which may appropriately be expected to change. -If the file that has changed was not expected to then refresh from distribution media or online repositories. -<pre>rpm -Uvh <i>affected_package</i></pre> -OR -<pre>yum reinstall <i>affected_package</i></pre> +A "c" in the second column indicates that a file is a configuration file, which +may appropriately be expected to change. If the file was not expected to +change, investigate the cause of the change using audit logs or other means. +The package can then be reinstalled to restore the file. +Run the following command to determine which package owns the file: +<pre># rpm -qf <i>FILENAME</i></pre> +The package can be reinstalled from a yum repository using the command: +<pre>yum reinstall <i>PACKAGENAME</i></pre> +Alternatively, the package can be reinstalled from trusted media using the command: +<pre>rpm -Uvh <i>PACKAGENAME</i></pre> </description> <ocil clause="there is output"> The following command will list which files on the system have file hashes different from what is expected by the RPM database. <pre># rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'</pre> </ocil> <rationale> -The hash on important files like system executables should match the information given -by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity -on the system.</rationale> +The hashes of important files like system executables should match the +information given by the RPM database. Executables with erroneous hashes could +be a sign of nefarious activity on the system.</rationale> <ident cce="27223-7" /> <oval id="rpm_verify_hashes" /> <ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" /> @@ -208,30 +188,17 @@ software may not be appropriate for some specialized systems. <Rule id="install_hids" severity="high"> <title>Install Intrusion Detection Software</title> <description> -The base Red Hat platform already includes a sophisticated auditing system that -can detect intruder activity, as well as SELinux, which provides host-based -intrusion prevention capabilities by confining privileged programs and user -sessions which may become compromised. -<br/> -<br/> -Install an additional intrusion detection tool to provide complementary or -duplicative monitoring, reporting, and reaction capabilities to those of the base -platform. For DoD systems, the McAfee Host Based Security System is provided -to fulfill this role. -<!-- provide link to cybercom site? --> -<!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux --> +The Red Hat platform includes a sophisticated auditing system +and SELinux, which provide host-based intrusion detection capabilities. </description> -<ocil clause="no host-based intrusion detection tools are installed"> -Inspect the system to determine if intrusion detection software has been installed. -Verify the intrusion detection software is active. -<!-- add instructions for HBSS? the text in the RHEL 5 STIG is wrong as usual --> +<ocil clause="SELinux is installed, this is not a finding. However, if neither SELinux nor HBSS is used on the system"> +Inspect the system to determine if intrusion detection software has been installed. +SELinux is the intrusion detection system included with RHEL. Another one is +McAfee HBSS, which is available through Cybercom. </ocil> <rationale> -Adding host-based intrusion detection tools can provide the capability to -automatically take actions in response to malicious behavior, which can provide -additional agility in reacting to network threats. These tools also often -include a reporting capability to provide network awareness of system, which -may not otherwise exist in an organization's systems management regime. +Host-based intrusion detection tools provide a system-level defense when an +intruder gains access to a system or network. </rationale> <ref nist="SC-7" disa="1263"/> </Rule> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index c441322..cccf5c2 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -6,10 +6,9 @@ software update tool in the <b>System</b> menu, in the <b>Administration</b> sub called <b>Software Update</b>. <br /><br /> Red Hat Enterprise Linux systems contain an installed software catalog called -the RPM database, which records metadata of installed packages. Tools such as -<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM -packages for software installation. This allows for insight into the current -inventory of installed software on the system, and is highly recommended. +the RPM database, which records metadata of installed packages. Consistently using +<tt>yum</tt> or the graphical <b>Software Update</b> for all software installation +allows for insight into the current inventory of installed software on the system. </description>
<Rule id="ensure_redhat_gpgkey_installed" severity="high"> @@ -17,15 +16,15 @@ inventory of installed software on the system, and is highly recommended. <description> To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to -receive them if desired), the Red Hat GPG key must properly be installed. -To ensure the GPG key is installed, run: +receive them), the Red Hat GPG key must properly be installed. +To install the Red Hat GPG key, run: <pre># rhn_register</pre> -If the system is not connected to the internet, or a local RHN Satellite, -then install the Red Hat GPG key from a secure, static location, such as +If the system is not connected to the Internet or an RHN Satellite, +then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted -in /mnt/cdrom, use the following command as the root user to import +in <tt>/media/cdrom</tt>, use the following command as the root user to import it into the keyring: -<pre># rpm --import /mnt/cdrom/RPM-GPG-KEY</pre> +<pre># rpm --import /media/cdrom/RPM-GPG-KEY</pre> </description> <ocil clause="the Red Hat GPG Key is not installed"> To ensure that the GPG key is installed, run: @@ -34,7 +33,7 @@ The command should return the string below: <pre>gpg(Red Hat, Inc. (release key 2) <security@redhat.com></pre> </ocil> <rationale> -This key is necessary to cryptographically verify packages +The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat. </rationale> <ident cce="26506-6"/> @@ -48,9 +47,9 @@ are from Red Hat. ensure they have configured an update source! --> <Rule id="ensure_gpgcheck_globally_activated" severity="high"> <title>Ensure gpgcheck Enabled In Main Yum Configuration</title> -<description>The <tt>gpgcheck</tt> option should be used to ensure -checking of an RPM package's signature always occurs prior to its -installation. To configure yum to check package signatures before installing +<description>The <tt>gpgcheck</tt> option controls whether +RPM packages' signatures are always checked prior to installation. +To configure yum to check package signatures before installing them, ensure the following line appears in <tt>/etc/yum.conf</tt> in the <tt>[main]</tt> section: <pre>gpgcheck=1</pre> @@ -66,7 +65,7 @@ disabled. </ocil> <rationale> Ensuring the validity of packages' cryptographic signatures prior to -installation ensures the provenance of the software and +installation ensures the authenticity of the software and protects against malicious tampering. </rationale> <ident cce="26709-6" /> @@ -91,7 +90,7 @@ A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for tha </ocil> <rationale> Ensuring all packages' cryptographic signatures are valid prior to -installation ensures the provenance of the software and +installation ensures the authenticity of the software and protects against malicious tampering. </rationale> <ident cce="26647-8" />
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/input/system/software/integrity.xml | 103 ++++++++++------------------- RHEL6/input/system/software/updating.xml | 31 ++++----- 2 files changed, 50 insertions(+), 84 deletions(-)
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 6d91bfb..b706f90 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -10,8 +10,8 @@ The RPM package management system can conduct integrity checks by comparing information in its metadata database with files installed on the system. <br /><br /> -Integrity checking cannot <i>prevent</i> intrusions into your -system, but can detect that they have occurred. Requirements +Integrity checking cannot <i>prevent</i> intrusions, +but can detect that they have occurred. Requirements for software integrity checking may be highly dependent on the environment in which the system will be used. Snapshot-based approaches such as AIDE may induce considerable overhead @@ -21,8 +21,8 @@ in the presence of frequent software updates.
<Group id="aide"> <title>Verify Integrity with AIDE</title> <description>AIDE conducts integrity checks by comparing information about -files with previously-gathered information. Ideally, the AIDE database should -be created immediately after your system is built, and then again after any +files with previously-gathered information. Ideally, the AIDE database is +created immediately after initial system configuration, and then again after any software update. AIDE is highly configurable, with further configuration information located in <tt>/usr/share/doc/aide-<i>VERSION</i></tt>. </description> @@ -86,7 +86,6 @@ must be captured and it should be able to be verified against the installed file <Rule id="aide_periodic_cron_checking" severity="medium"> <title>Configure Periodic Execution of AIDE</title> <description> -AIDE should be executed on a periodic basis to check for changes. To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>: <pre>05 4 * * * root /usr/sbin/aide --check</pre> AIDE can be executed periodically through other means; this is merely one example. @@ -97,38 +96,11 @@ To determine that periodic AIDE execution has been scheduled, run the following </ocil> <rationale> By default, AIDE does not install itself for periodic execution. Periodically -running AIDE may reveal unexpected changes in installed files. +running AIDE is necessary to reveal unexpected changes in installed files. </rationale> <ident cce="27222-9" /> <ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/> </Rule> -<!-- -<Group id="aide_verify_integrity_manually"> -<title>Manually Verify Integrity of AIDE</title> -<description> -Manually verify the integrity of the AIDE binaries, configuration file, and database. Possibilities for doing -so include: -<br /><br /> -1. Use sha1sum or md5sum to generate checksums on the files and then visually compare them to those -generated from the safely stored versions. This does not, of course, preclude the possibility that such -output could also be faked. -<br /><br /> -2. Mount the stored versions on read-only media and run <tt>/bin/diff</tt> to verify that there are no differences -between the files. -<br /><br /> -3. Copying the files to another system and performing the hash or file comparisons there may impart -additional confidence that the manual verification process is not being interfered with. -</description> -<rationale> -Because integrity checking is a means of intrusion detection and not intrusion prevention, it cannot be guaranteed -that the AIDE binaries, configuration files, or database have not been tampered with. An attacker could disable -or alter these files after a successful intrusion. Because of this, manual and frequent checks on these files is -recommended. The safely stored copies (or hashes) of the database, binary, and configuration file were created -earlier for this purpose. -</rationale> -<ref nist="SC-28, SI-7" /> -</Group> ---> </Group>
<Group id="rpm_verification"> @@ -145,12 +117,16 @@ See the man page for <tt>rpm</tt> to see a complete explanation of each column. </description>
<Rule id="rpm_verify_permissions"> -<title>Verify File Permissions with RPM</title> -<description>The RPM package management system can check file access +<title>Verify and Correct File Permissions with RPM</title> +<description> +The RPM package management system can check file access permissions of installed software packages, including many that are -important to system security. The following command will reset permissions to -their expected values: -<pre># rpm --setperms <i>package</i></pre> +important to system security. +After locating a file with incorrect permissions, run the following command to determine which package owns it: +<pre># rpm -qf <i>FILENAME</i></pre> +Next, run the following command to reset its permissions to +the correct values: +<pre># rpm --setperms <i>PACKAGENAME</i></pre> </description> <ocil clause="there is output"> The following command will list which files on the system have permissions different from what @@ -174,21 +150,25 @@ installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database: <pre># rpm -Va | grep '^..5'</pre> -A "c" in the second column indicates that a file is a configuration file, -which may appropriately be expected to change. -If the file that has changed was not expected to then refresh from distribution media or online repositories. -<pre>rpm -Uvh <i>affected_package</i></pre> -OR -<pre>yum reinstall <i>affected_package</i></pre> +A "c" in the second column indicates that a file is a configuration file, which +may appropriately be expected to change. If the file was not expected to +change, investigate the cause of the change using audit logs or other means. +The package can then be reinstalled to restore the file. +Run the following command to determine which package owns the file: +<pre># rpm -qf <i>FILENAME</i></pre> +The package can be reinstalled from a yum repository using the command: +<pre>yum reinstall <i>PACKAGENAME</i></pre> +Alternatively, the package can be reinstalled from trusted media using the command: +<pre>rpm -Uvh <i>PACKAGENAME</i></pre> </description> <ocil clause="there is output"> The following command will list which files on the system have file hashes different from what is expected by the RPM database. <pre># rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'</pre> </ocil> <rationale> -The hash on important files like system executables should match the information given -by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity -on the system.</rationale> +The hashes of important files like system executables should match the +information given by the RPM database. Executables with erroneous hashes could +be a sign of nefarious activity on the system.</rationale> <ident cce="27223-7" /> <oval id="rpm_verify_hashes" /> <ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" /> @@ -208,30 +188,17 @@ software may not be appropriate for some specialized systems. <Rule id="install_hids" severity="high"> <title>Install Intrusion Detection Software</title> <description> -The base Red Hat platform already includes a sophisticated auditing system that -can detect intruder activity, as well as SELinux, which provides host-based -intrusion prevention capabilities by confining privileged programs and user -sessions which may become compromised. -<br/> -<br/> -Install an additional intrusion detection tool to provide complementary or -duplicative monitoring, reporting, and reaction capabilities to those of the base -platform. For DoD systems, the McAfee Host Based Security System is provided -to fulfill this role. -<!-- provide link to cybercom site? --> -<!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux --> +The Red Hat platform includes a sophisticated auditing system +and SELinux, which provide host-based intrusion detection capabilities. </description> -<ocil clause="no host-based intrusion detection tools are installed"> -Inspect the system to determine if intrusion detection software has been installed. -Verify the intrusion detection software is active. -<!-- add instructions for HBSS? the text in the RHEL 5 STIG is wrong as usual --> +<ocil clause="SELinux is installed, this is not a finding. However, if neither SELinux nor HBSS is used on the system"> +Inspect the system to determine if intrusion detection software has been installed. +SELinux is the intrusion detection system included with RHEL. Another one is +McAfee HBSS, which is available through Cybercom. </ocil> <rationale> -Adding host-based intrusion detection tools can provide the capability to -automatically take actions in response to malicious behavior, which can provide -additional agility in reacting to network threats. These tools also often -include a reporting capability to provide network awareness of system, which -may not otherwise exist in an organization's systems management regime. +Host-based intrusion detection tools provide a system-level defense when an +intruder gains access to a system or network. </rationale> <ref nist="SC-7" disa="1263"/> </Rule> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index c441322..cccf5c2 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -6,10 +6,9 @@ software update tool in the <b>System</b> menu, in the <b>Administration</b> sub called <b>Software Update</b>. <br /><br /> Red Hat Enterprise Linux systems contain an installed software catalog called -the RPM database, which records metadata of installed packages. Tools such as -<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM -packages for software installation. This allows for insight into the current -inventory of installed software on the system, and is highly recommended. +the RPM database, which records metadata of installed packages. Consistently using +<tt>yum</tt> or the graphical <b>Software Update</b> for all software installation +allows for insight into the current inventory of installed software on the system. </description>
<Rule id="ensure_redhat_gpgkey_installed" severity="high"> @@ -17,15 +16,15 @@ inventory of installed software on the system, and is highly recommended. <description> To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to -receive them if desired), the Red Hat GPG key must properly be installed. -To ensure the GPG key is installed, run: +receive them), the Red Hat GPG key must properly be installed. +To install the Red Hat GPG key, run: <pre># rhn_register</pre> -If the system is not connected to the internet, or a local RHN Satellite, -then install the Red Hat GPG key from a secure, static location, such as +If the system is not connected to the Internet or an RHN Satellite, +then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted -in /mnt/cdrom, use the following command as the root user to import +in <tt>/media/cdrom</tt>, use the following command as the root user to import it into the keyring: -<pre># rpm --import /mnt/cdrom/RPM-GPG-KEY</pre> +<pre># rpm --import /media/cdrom/RPM-GPG-KEY</pre> </description> <ocil clause="the Red Hat GPG Key is not installed"> To ensure that the GPG key is installed, run: @@ -34,7 +33,7 @@ The command should return the string below: <pre>gpg(Red Hat, Inc. (release key 2) <security@redhat.com></pre> </ocil> <rationale> -This key is necessary to cryptographically verify packages +The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat. </rationale> <ident cce="26506-6"/> @@ -48,9 +47,9 @@ are from Red Hat. ensure they have configured an update source! --> <Rule id="ensure_gpgcheck_globally_activated" severity="high"> <title>Ensure gpgcheck Enabled In Main Yum Configuration</title> -<description>The <tt>gpgcheck</tt> option should be used to ensure -checking of an RPM package's signature always occurs prior to its -installation. To configure yum to check package signatures before installing +<description>The <tt>gpgcheck</tt> option controls whether +RPM packages' signatures are always checked prior to installation. +To configure yum to check package signatures before installing them, ensure the following line appears in <tt>/etc/yum.conf</tt> in the <tt>[main]</tt> section: <pre>gpgcheck=1</pre> @@ -66,7 +65,7 @@ disabled. </ocil> <rationale> Ensuring the validity of packages' cryptographic signatures prior to -installation ensures the provenance of the software and +installation ensures the authenticity of the software and protects against malicious tampering. </rationale> <ident cce="26709-6" /> @@ -91,7 +90,7 @@ A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for tha </ocil> <rationale> Ensuring all packages' cryptographic signatures are valid prior to -installation ensures the provenance of the software and +installation ensures the authenticity of the software and protects against malicious tampering. </rationale> <ident cce="26647-8" />
ack
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/system/permissions/mounting.xml | 143 ++++++++++------------- RHEL6/input/system/permissions/partitions.xml | 16 +-- RHEL6/input/system/permissions/permissions.xml | 16 +-- 3 files changed, 76 insertions(+), 99 deletions(-)
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 6191a0a..42c7318 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -1,23 +1,19 @@ <Group id="mounting"> <title>Restrict Dynamic Mounting and Unmounting of Filesystems</title> -<description>Linux includes a number of facilities for the -automated addition and removal of filesystems on a running system. -These facilities may increase convenience, but they all bring some -risk -- whether direct risk from allowing unprivileged users to -introduce arbitrary filesystems to a machine, or risk that software -flaws in the automated mount facility itself will allow an attacker -to compromise the system. +<description>Linux includes a number of facilities for the automated addition +and removal of filesystems on a running system. These facilities may be +necessary in many environments, but this capability also carries some risk -- whether direct +risk from allowing users to introduce arbitrary filesystems, +or risk that software flaws in the automated mount facility itself could +allow an attacker to compromise the system. <br /><br /> This command can be used to list the types of filesystems that are available to the currently executing kernel: <pre># find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</pre> -If these filesystems are not required then they should be explicitly disabled -in the appropriate <tt>/etc/modprobe.d</tt> configuration file. -<br /><br /> -Use caution when enabling any such facility, and find out -whether better configuration management or user education might -solve the same problem with less risk.</description> +If these filesystems are not required then they can be explicitly disabled +in a configuratio file in <tt>/etc/modprobe.d</tt>. +</description>
<Rule id="kernel_module_usb-storage_disabled"> <title>Disable Modprobe Loading of USB Storage Driver</title> @@ -31,66 +27,56 @@ module, but will not prevent an administrator (or another program) from using th <ocil> <module-disable-check-macro module="usb-storage" /> </ocil> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized -software and other vulnerabilities. Support for these devices should be disabled and -the devices themselves should be tightly controlled.</rationale> +<rationale>USB storage devices such as thumb drives can be used to introduce +malicious software.</rationale> <ident cce="27016-5" /> <oval id="kernel_module_usb-storage_disabled" /> <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> </Rule> -<!-- Considering removal of this entirely, in favor of previous Rule - -<Rule id="kernel_module_usb-storage_removed"> -<title>Remove USB Storage Driver</title> -<description>If your system never requires the use of USB storage devices, then the -supporting driver can be permanently removed. Though more effective than disabling the -module within modprobe, this solution is less elegant than the modprobe method described -in "Disable Modprobe Loading of USB". The technique described here will cause the -command <tt>rpm -V kernel</tt> to fail which may be an undesirable side effect. -<br /><br /> -To permanently remove the USB storage driver from the system execute this command: -<pre># rm /lib/modules/<i>KERNEL-VERSION</i>/kernel/drivers/usb/storage/usb-storage.ko</pre> -The variable <tt><i>KERNEL-VERSION</i></tt> can be determined using the <tt>uname -r</tt> -command which returns the version of the currently loaded kernel. The <tt>rm</tt> command -will need to be repeated every time the kernel is updated.</description> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized -software and other vulnerabilities. Support for these devices should be disabled and -the devices themselves should be tightly controlled.</rationale> -<ident cce="26970-4" /> -<oval id="kernel_module_usb-storage_removed" /> -<ref nist="" disa="1250,85" /> -</Rule> --->
<Rule id="bootloader_nousb_argument"> <title>Disable Kernel Support for USB via Bootloader Configuration</title> <description> -Another means of disabling USB storage is to disable all USB support provided -by the operating system. This can be accomplished by adding the <tt>nousb</tt> -argument to the kernel's boot loader configuration. To disable kernel support -for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows: +All USB support can be disabled by adding the <tt>nousb</tt> +argument to the kernel's boot loader configuration. To do so, +append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as shown: <pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre> -<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, -mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description> -<rationale>Disabling the USB subsystem within the Linux kernel at system boot will also -disable USB storage devices if they are plugged into the system. Support for these devices -should be disabled and the devices themselves should be tightly controlled.</rationale> +<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for +systems with USB-based keyboards, mice, or printers. This configuration is +infeasible for systems which require USB devices, which is common.</i></description> +<rationale>Disabling the USB subsystem within the Linux kernel at system boot will +protect against potentially malicious USB devices, although it is only practical +in specialized systems. +</rationale> <ident cce="27011-6" /> <oval id="bootloader_nousb_argument" /> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" /> </Rule>
<Rule id="bios_disable_usb_boot"> -<title>Disable Booting from USB Devices</title> -<description>An attacker with physical access could try to boot the system from a USB -flash drive and then access any data on the system's hard drive, circumventing the normal -operating system's access controls. To prevent this, configure the BIOS to disallow -booting from USB drives. Also configure the BIOS or firmware password as described in -the section titled "Set BIOS Password" to prevent unauthorized configuration changes.</description> -<rationale>Booting a system from a USB device would allow an attacker to circumvent -any security measures offered by the native OS. Attackers could mount partitions and modify the -configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<title>Disable Booting from USB Devices in Boot Firmware</title> +<description>Configure the system boot firmware (historically called BIOS on PC +systems) to disallow booting from USB drives. +</description> +<rationale>Booting a system from a USB device would allow an attacker to +circumvent any security measures provided by the operating system. Attackers +could mount partitions and modify the configuration of the OS.</rationale> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" /> +</Rule> + +<Rule id="bios_assign_password"> +<title>Assign Password to Prevent Changes to Boot Firmware Configuration</title> +<description>Assign a password to the system boot firmware (historically called BIOS on PC +systems) to require a password for any configuration changes. +</description> +<rationale>Assigning a password to the system boot firmware prevents anyone +with physical access from configuring the system to boot +from local media and circumvent the operating system's access controls. +For systems in physically secure locations, such as +a data center or Sensitive Compartmented Information Facility (SCIF), this risk must be weighed +against the risk of administrative personnel being unable to conduct recovery operations in +a timely fashion. +</rationale> </Rule>
<Rule id="service_autofs_disabled"> @@ -99,25 +85,18 @@ configuration of the native OS. The BIOS should be configured to disallow bootin home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>. However, this method of providing access to removable media is not common, so autofs -can almost always be disabled if NFS is not in use. Even if NFS is required, it is -almost always possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt> +can almost always be disabled if NFS is not in use. Even if NFS is required, it may be +possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt> rather than relying on the automounter. <br /><br /> -If the <tt>autofs</tt> service is not needed to dynamically mount NFS filesystems -or removable media, disable the service for all runlevels: -<pre># chkconfig --level 0123456 autofs off</pre> -Stop the service if it is already running: -<pre># service autofs stop</pre> +<service-disable-macro service="autofs" /> </description> -<ocil clause="it does not"> -To verify the <tt>autofs</tt> service is disabled, run the following command: -<pre>chkconfig --list autofs</pre> -If properly configured, the output should be the following: -<pre>autofs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre> +<ocil> +<service-disable-check-macro service="autofs" /> </ocil> -<rationale>All filesystems that are required for the successful operation of the system -should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should -not be arbitrarily introduced via the automounter.</rationale> +<rationale>Disabling the automounter permits the administrator to +statically control filesystem mounting through <tt>/etc/fstab</tt>. +</rationale> <ident cce="26976-1" /> <oval id="service_autofs_disabled" /> <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> @@ -125,7 +104,10 @@ not be arbitrarily introduced via the automounter.</rationale>
<Rule id="gconf_gnome_disable_automount"> <title>Disable GNOME Automounting</title> -<description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME by running the following: +<description>The system's default desktop environment, GNOME, will mount +devices and removable media (such as DVDs, CDs and USB flash drives) whenever +they are inserted into the system. Disable automount and autorun within GNOME +by running the following: <pre># gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ @@ -134,6 +116,8 @@ not be arbitrarily introduced via the automounter.</rationale> --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/nautilus/preferences/media_autorun_never true</pre> +</description> +<ocil clause="GNOME automounting is not disabled"> These settings can be verified by running the following: <pre>$ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ @@ -141,15 +125,12 @@ These settings can be verified by running the following: $ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ --get /apps/nautilus/preferences/media_autorun_never</pre> -</description> -<rationale>The system's capabilities for automatic mounting should be configured to match whatever is defined by security -policy. Disabling USB storage as described in the USB section will prevent the use of USB storage devices, but -this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and -DVDs. +</ocil> +<rationale>Disabling </rationale> <ident cce="27035-5" /> <oval id="gconf_gnome_disable_automount" /> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" /> </Rule>
<Rule id="kernel_module_cramfs_disabled"> diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml index d5b5da6..f74423b 100644 --- a/RHEL6/input/system/permissions/partitions.xml +++ b/RHEL6/input/system/permissions/partitions.xml @@ -54,12 +54,10 @@ filesystems. </rationale> <Rule id="mountopt_noexec_on_removable_partitions"> <title>Add noexec Option to Removable Media Partitions</title> <description>The <tt>noexec</tt> mount option prevents the direct -execution of binaries on the mounted filesystem. Users should not -be allowed to execute binaries that exist on partitions mounted -from removable media (such as a USB key). The <tt>noexec</tt> -option prevents code from being executed directly from the media -itself, and may therefore provide a line of defense against -certain types of worms or malicious code. +execution of binaries on the mounted filesystem. +Preventing the direct execution of binaries from removable media (such as a USB +key) provides a defense against malicious software that may be present on such +untrusted media. <mount-desc-macro option="noexec" part="any removable media partitions" /> </description> <rationale>Allowing users to execute binaries from removable media such as USB keys exposes @@ -85,9 +83,9 @@ of the file respectively. Users should not be allowed to introduce suid and guid files into the system via partitions mounted from removeable media. <mount-desc-macro option="nosuid" part="any removable media partitions" /> </description> -<rationale>The presence of suid and sgid executables should be tightly controlled. Users -should not be able to execute suid or sgid binaries from partitions mounted off of -removable media.</rationale> +<rationale>The presence of suid and sgid executables should be tightly controlled. Allowing +users to introduce suid or sgid binaries from partitions mounted off of +removable media would allow them to introduce their own highly-privileged programs.</rationale> <ident cce="27056-1" /> <oval id="mount_option_nosuid_removable_partitions" value="var_removable_partition" /> <ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/> diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml index 8e5e148..7f3302a 100644 --- a/RHEL6/input/system/permissions/permissions.xml +++ b/RHEL6/input/system/permissions/permissions.xml @@ -2,22 +2,20 @@ <title>File Permissions and Masks</title> <description>Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or -modifying files to which they should not have access. Adhere to the -principle of least privilege - configure each file, directory, and -filesystem to allow only the access needed in order for that file -to serve its purpose. +modifying files to which they should not have access. <br /><br /> -Note: Several of the commands in this section search filesystems +Several of the commands in this section search filesystems for files or directories with certain characteristics, and are intended to be run on every local partition on a given machine. When the variable <i>PART</i> appears in one of the commands below, it means that the command is intended to be run repeatedly, with the name of each local partition substituted for <i>PART</i> in turn. <br /><br /> -The following command prints a list of ext4 partitions on the local -machine, which is the default filesystem for Red Hat Enterprise Linux +The following command prints a list of all ext4 partitions on the local +system, which is the default filesystem for Red Hat Enterprise Linux 6 installations: <pre>$ mount -t ext4 | awk '{print $3}'</pre> -If your site uses a local filesystem type other than ext4, you -will need to modify this command.</description> +For any systems that use a different +local filesystem type, modify this command as appropriate. +</description> </Group>
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blankblank@eclipse.ncsc.mil
RHEL6/input/system/permissions/mounting.xml | 143 ++++++++++------------- RHEL6/input/system/permissions/partitions.xml | 16 +-- RHEL6/input/system/permissions/permissions.xml | 16 +-- 3 files changed, 76 insertions(+), 99 deletions(-)
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 6191a0a..42c7318 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -1,23 +1,19 @@
<Group id="mounting"> <title>Restrict Dynamic Mounting and Unmounting of Filesystems</title> -<description>Linux includes a number of facilities for the -automated addition and removal of filesystems on a running system. -These facilities may increase convenience, but they all bring some -risk -- whether direct risk from allowing unprivileged users to -introduce arbitrary filesystems to a machine, or risk that software -flaws in the automated mount facility itself will allow an attacker -to compromise the system. +<description>Linux includes a number of facilities for the automated addition +and removal of filesystems on a running system. These facilities may be +necessary in many environments, but this capability also carries some risk -- whether direct +risk from allowing users to introduce arbitrary filesystems, +or risk that software flaws in the automated mount facility itself could +allow an attacker to compromise the system. <br /><br /> This command can be used to list the types of filesystems that are available to the currently executing kernel: <pre># find/lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</pre> -If these filesystems are not required then they should be explicitly disabled -in the appropriate <tt>/etc/modprobe.d</tt> configuration file. -<br /><br /> -Use caution when enabling any such facility, and find out -whether better configuration management or user education might -solve the same problem with less risk.</description> +If these filesystems are not required then they can be explicitly disabled +in a configuratio file in <tt>/etc/modprobe.d</tt>. +</description>
<Rule id="kernel_module_usb-storage_disabled"> <title>Disable Modprobe Loading of USB Storage Driver</title> @@ -31,66 +27,56 @@ module, but will not prevent an administrator (or another program) from using th <ocil> <module-disable-check-macro module="usb-storage" /> </ocil> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized -software and other vulnerabilities. Support for these devices should be disabled and -the devices themselves should be tightly controlled.</rationale> +<rationale>USB storage devices such as thumb drives can be used to introduce +malicious software.</rationale> <ident cce="27016-5" /> <oval id="kernel_module_usb-storage_disabled" /> <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> </Rule> -<!-- Considering removal of this entirely, in favor of previous Rule - -<Rule id="kernel_module_usb-storage_removed"> -<title>Remove USB Storage Driver</title> -<description>If your system never requires the use of USB storage devices, then the -supporting driver can be permanently removed. Though more effective than disabling the -module within modprobe, this solution is less elegant than the modprobe method described -in "Disable Modprobe Loading of USB". The technique described here will cause the -command <tt>rpm -V kernel</tt> to fail which may be an undesirable side effect. -<br /><br /> -To permanently remove the USB storage driver from the system execute this command: -<pre># rm/lib/modules/<i>KERNEL-VERSION</i>/kernel/drivers/usb/storage/usb-storage.ko</pre> -The variable <tt><i>KERNEL-VERSION</i></tt> can be determined using the <tt>uname -r</tt> -command which returns the version of the currently loaded kernel. The <tt>rm</tt> command -will need to be repeated every time the kernel is updated.</description> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized -software and other vulnerabilities. Support for these devices should be disabled and -the devices themselves should be tightly controlled.</rationale> -<ident cce="26970-4" /> -<oval id="kernel_module_usb-storage_removed" /> -<ref nist="" disa="1250,85" /> -</Rule> --->
<Rule id="bootloader_nousb_argument"> <title>Disable Kernel Support for USB via Bootloader Configuration</title> <description> -Another means of disabling USB storage is to disable all USB support provided -by the operating system. This can be accomplished by adding the <tt>nousb</tt> -argument to the kernel's boot loader configuration. To disable kernel support -for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows: +All USB support can be disabled by adding the <tt>nousb</tt> +argument to the kernel's boot loader configuration. To do so, +append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as shown: <pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre> -<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, -mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description> -<rationale>Disabling the USB subsystem within the Linux kernel at system boot will also -disable USB storage devices if they are plugged into the system. Support for these devices -should be disabled and the devices themselves should be tightly controlled.</rationale> +<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for +systems with USB-based keyboards, mice, or printers. This configuration is +infeasible for systems which require USB devices, which is common.</i></description> +<rationale>Disabling the USB subsystem within the Linux kernel at system boot will +protect against potentially malicious USB devices, although it is only practical +in specialized systems. +</rationale> <ident cce="27011-6" /> <oval id="bootloader_nousb_argument" /> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" /> </Rule>
<Rule id="bios_disable_usb_boot"> -<title>Disable Booting from USB Devices</title> -<description>An attacker with physical access could try to boot the system from a USB -flash drive and then access any data on the system's hard drive, circumventing the normal -operating system's access controls. To prevent this, configure the BIOS to disallow -booting from USB drives. Also configure the BIOS or firmware password as described in -the section titled "Set BIOS Password" to prevent unauthorized configuration changes.</description> -<rationale>Booting a system from a USB device would allow an attacker to circumvent -any security measures offered by the native OS. Attackers could mount partitions and modify the -configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<title>Disable Booting from USB Devices in Boot Firmware</title> +<description>Configure the system boot firmware (historically called BIOS on PC +systems) to disallow booting from USB drives. +</description> +<rationale>Booting a system from a USB device would allow an attacker to +circumvent any security measures provided by the operating system. Attackers +could mount partitions and modify the configuration of the OS.</rationale> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" /> +</Rule> + +<Rule id="bios_assign_password"> +<title>Assign Password to Prevent Changes to Boot Firmware Configuration</title> +<description>Assign a password to the system boot firmware (historically called BIOS on PC +systems) to require a password for any configuration changes. +</description> +<rationale>Assigning a password to the system boot firmware prevents anyone +with physical access from configuring the system to boot +from local media and circumvent the operating system's access controls. +For systems in physically secure locations, such as +a data center or Sensitive Compartmented Information Facility (SCIF), this risk must be weighed +against the risk of administrative personnel being unable to conduct recovery operations in +a timely fashion. +</rationale> </Rule>
<Rule id="service_autofs_disabled"> @@ -99,25 +85,18 @@ configuration of the native OS. The BIOS should be configured to disallow bootin home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>. However, this method of providing access to removable media is not common, so autofs -can almost always be disabled if NFS is not in use. Even if NFS is required, it is -almost always possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt> +can almost always be disabled if NFS is not in use. Even if NFS is required, it may be +possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt> rather than relying on the automounter. <br /><br /> -If the <tt>autofs</tt> service is not needed to dynamically mount NFS filesystems -or removable media, disable the service for all runlevels: -<pre># chkconfig --level 0123456 autofs off</pre> -Stop the service if it is already running: -<pre># service autofs stop</pre> +<service-disable-macro service="autofs" /> </description> -<ocil clause="it does not"> -To verify the <tt>autofs</tt> service is disabled, run the following command: -<pre>chkconfig --list autofs</pre> -If properly configured, the output should be the following: -<pre>autofs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre> +<ocil> +<service-disable-check-macro service="autofs" /> </ocil> -<rationale>All filesystems that are required for the successful operation of the system -should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should -not be arbitrarily introduced via the automounter.</rationale> +<rationale>Disabling the automounter permits the administrator to +statically control filesystem mounting through <tt>/etc/fstab</tt>. +</rationale> <ident cce="26976-1" /> <oval id="service_autofs_disabled" /> <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> @@ -125,7 +104,10 @@ not be arbitrarily introduced via the automounter.</rationale>
<Rule id="gconf_gnome_disable_automount"> <title>Disable GNOME Automounting</title> -<description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME by running the following: +<description>The system's default desktop environment, GNOME, will mount +devices and removable media (such as DVDs, CDs and USB flash drives) whenever +they are inserted into the system. Disable automount and autorun within GNOME +by running the following: <pre># gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ @@ -134,6 +116,8 @@ not be arbitrarily introduced via the automounter.</rationale> --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/nautilus/preferences/media_autorun_never true</pre> +</description> +<ocil clause="GNOME automounting is not disabled"> These settings can be verified by running the following: <pre>$ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ @@ -141,15 +125,12 @@ These settings can be verified by running the following: $ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ --get /apps/nautilus/preferences/media_autorun_never</pre> -</description> -<rationale>The system's capabilities for automatic mounting should be configured to match whatever is defined by security -policy. Disabling USB storage as described in the USB section will prevent the use of USB storage devices, but -this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and -DVDs. +</ocil> +<rationale>Disabling </rationale> <ident cce="27035-5" /> <oval id="gconf_gnome_disable_automount" /> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" /> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" /> </Rule>
<Rule id="kernel_module_cramfs_disabled"> diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml index d5b5da6..f74423b 100644 --- a/RHEL6/input/system/permissions/partitions.xml +++ b/RHEL6/input/system/permissions/partitions.xml @@ -54,12 +54,10 @@ filesystems. </rationale> <Rule id="mountopt_noexec_on_removable_partitions"> <title>Add noexec Option to Removable Media Partitions</title> <description>The <tt>noexec</tt> mount option prevents the direct -execution of binaries on the mounted filesystem. Users should not -be allowed to execute binaries that exist on partitions mounted -from removable media (such as a USB key). The <tt>noexec</tt> -option prevents code from being executed directly from the media -itself, and may therefore provide a line of defense against -certain types of worms or malicious code. +execution of binaries on the mounted filesystem. +Preventing the direct execution of binaries from removable media (such as a USB +key) provides a defense against malicious software that may be present on such +untrusted media. <mount-desc-macro option="noexec" part="any removable media partitions" /> </description> <rationale>Allowing users to execute binaries from removable media such as USB keys exposes @@ -85,9 +83,9 @@ of the file respectively. Users should not be allowed to introduce suid and guid files into the system via partitions mounted from removeable media. <mount-desc-macro option="nosuid" part="any removable media partitions" /> </description> -<rationale>The presence of suid and sgid executables should be tightly controlled. Users -should not be able to execute suid or sgid binaries from partitions mounted off of -removable media.</rationale> +<rationale>The presence of suid and sgid executables should be tightly controlled. Allowing +users to introduce suid or sgid binaries from partitions mounted off of +removable media would allow them to introduce their own highly-privileged programs.</rationale> <ident cce="27056-1" /> <oval id="mount_option_nosuid_removable_partitions" value="var_removable_partition" /> <ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/> diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml index 8e5e148..7f3302a 100644 --- a/RHEL6/input/system/permissions/permissions.xml +++ b/RHEL6/input/system/permissions/permissions.xml @@ -2,22 +2,20 @@ <title>File Permissions and Masks</title> <description>Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or -modifying files to which they should not have access. Adhere to the -principle of least privilege - configure each file, directory, and -filesystem to allow only the access needed in order for that file -to serve its purpose. +modifying files to which they should not have access. <br /><br /> -Note: Several of the commands in this section search filesystems +Several of the commands in this section search filesystems for files or directories with certain characteristics, and are intended to be run on every local partition on a given machine. When the variable <i>PART</i> appears in one of the commands below, it means that the command is intended to be run repeatedly, with the name of each local partition substituted for <i>PART</i> in turn. <br /><br /> -The following command prints a list of ext4 partitions on the local -machine, which is the default filesystem for Red Hat Enterprise Linux +The following command prints a list of all ext4 partitions on the local +system, which is the default filesystem for Red Hat Enterprise Linux 6 installations: <pre>$ mount -t ext4 | awk '{print $3}'</pre> -If your site uses a local filesystem type other than ext4, you -will need to modify this command.</description> +For any systems that use a different +local filesystem type, modify this command as appropriate. +</description> </Group> -- 1.7.1
ack
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/services/ntp.xml | 32 ++++++++++++++------------------ 1 files changed, 14 insertions(+), 18 deletions(-)
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml index 3a8aba2..ee6e6c2 100644 --- a/RHEL6/input/services/ntp.xml +++ b/RHEL6/input/services/ntp.xml @@ -7,20 +7,17 @@ protocols can be used both to ensure that time is consistent among a network of machines, and that their time is consistent with the outside world. <br /><br /> -Local time synchronization is recommended for all networks. -If every machine on your network reliably reports the same time as -every other machine, then it is much easier to correlate log -messages in case of an attack. In addition, a number of -cryptographic protocols (such as Kerberos) use timestamps to -prevent certain types of attacks. If your network does not have -synchronized time, these protocols may be unreliable or even -unusable. +If every system on a network reliably reports the same time, then it is much +easier to correlate log messages in case of an attack. In addition, a number of +cryptographic protocols (such as Kerberos) use timestamps to prevent certain +types of attacks. If your network does not have synchronized time, these +protocols may be unreliable or even unusable. <br /><br /> Depending on the specifics of the network, global time accuracy may be just as important as local synchronization, or not very important at all. If your -network is connected to the Internet, it is recommended that you make use of a -public timeserver or one provided by your enterprise or agency, since globally -accurate timestamps may be necessary if you need to investigate or respond to +network is connected to the Internet, using a +public timeserver (or one provided by your enterprise) provides globally +accurate timestamps which may be essential in investigating or responding to an attack which originated outside of your network. <br /><br /> A typical network setup involves a small number of internal systems operating as NTP @@ -65,17 +62,16 @@ This instructs the NTP software to contact that remote server to obtain time data. </description> <ocil clause="this is not the case"> -A remote NTP server should be configured for time synchronization. To verify -one is configured, open the following file: +To verify that a remote NTP service is configured for time synchronization, +open the following file: <pre>/etc/ntp.conf</pre> In the file, there should be a section similar to the following: -<pre># --- OUR TIMESERVERS ----- -server <i>ntpserver</i></pre> +<pre>server <i>ntpserver</i></pre> </ocil> -<rationale> Synchronizing with an NTP server makes it possible +<rationale>Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with -real time events. Using a trusted NTP server provided by your organization is -recommended.</rationale> +real time events. +</rationale> <ident cce="27098-3" /> <oval id="ntp_remote_server" /> <ref nist="AU-8(1)" disa="160" />
On 10/9/13 10:58 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/input/services/ntp.xml | 32 ++++++++++++++------------------ 1 files changed, 14 insertions(+), 18 deletions(-)
diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml index 3a8aba2..ee6e6c2 100644 --- a/RHEL6/input/services/ntp.xml +++ b/RHEL6/input/services/ntp.xml @@ -7,20 +7,17 @@ protocols can be used both to ensure that time is consistent among a network of machines, and that their time is consistent with the outside world. <br /><br /> -Local time synchronization is recommended for all networks. -If every machine on your network reliably reports the same time as -every other machine, then it is much easier to correlate log -messages in case of an attack. In addition, a number of -cryptographic protocols (such as Kerberos) use timestamps to -prevent certain types of attacks. If your network does not have -synchronized time, these protocols may be unreliable or even -unusable. +If every system on a network reliably reports the same time, then it is much +easier to correlate log messages in case of an attack. In addition, a number of +cryptographic protocols (such as Kerberos) use timestamps to prevent certain +types of attacks. If your network does not have synchronized time, these +protocols may be unreliable or even unusable. <br /><br /> Depending on the specifics of the network, global time accuracy may be just as important as local synchronization, or not very important at all. If your -network is connected to the Internet, it is recommended that you make use of a -public timeserver or one provided by your enterprise or agency, since globally -accurate timestamps may be necessary if you need to investigate or respond to +network is connected to the Internet, using a +public timeserver (or one provided by your enterprise) provides globally +accurate timestamps which may be essential in investigating or responding to an attack which originated outside of your network. <br /><br /> A typical network setup involves a small number of internal systems operating as NTP @@ -65,17 +62,16 @@ This instructs the NTP software to contact that remote server to obtain time data.
</description> <ocil clause="this is not the case"> -A remote NTP server should be configured for time synchronization. To verify -one is configured, open the following file: +To verify that a remote NTP service is configured for time synchronization, +open the following file: <pre>/etc/ntp.conf</pre> In the file, there should be a section similar to the following: -<pre># --- OUR TIMESERVERS ----- -server <i>ntpserver</i></pre> +<pre>server <i>ntpserver</i></pre> </ocil> -<rationale> Synchronizing with an NTP server makes it possible +<rationale>Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with -real time events. Using a trusted NTP server provided by your organization is -recommended.</rationale> +real time events. +</rationale> <ident cce="27098-3" /> <oval id="ntp_remote_server" /> <ref nist="AU-8(1)" disa="160" />
ack
scap-security-guide@lists.fedorahosted.org