Hello Oliver,
thank you for checking with us.
----- Original Message -----
From: "oliver skiebe"
<oliver.skiebe(a)uniqpartners.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Tuesday, January 12, 2016 8:04:29 AM
Subject: Adding Custom "ident" Sources in shorthand XCCDFs
Hi all,
as briefly mentioned already in yesterdays’ Contributor Workshop,
our customer wants to enrich the SSG content by adding references to their
internal security requirements.
I wonder how I could add my own Security Identifiers, because when trying to
simply add e.g. a „customerident“ attribute into the shorthand XCCDF as per
below,
my build fails with:
There's a need to define "an action" for the newly / to be added
"customerident" attribute in the particular XSLT transformation
of a concrete product, e.g. should we suppose the case of
RHEL/6 product the code responsible to expanding the attribute
('cce', 'stig') values of the "ident" attribute is defined
here:
[1]
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/transf...
So in short a new code block fro 'customerident' should be added
there (of course should the customer be interested in different
product, also to 'shorthand2xccdf.xslt' transformation of that
product).
For example if the intention is to rewrite the value of
'customerident' attribute to an actual URL of the internal
document, the underlying code might look like in the similar
'pcidss' attribute case of the 'ref' attribute.
The particular patches that have added PCI-DSS support
('pcidss' attribute support for the 'ref' element) are as
follows:
[2]
https://github.com/ybznek/scap-security-guide/commit/7b6abe98b9557417f35f...
(define the new constant)
[3]
https://github.com/ybznek/scap-security-guide/commit/cb3d7c7c47aeb7be17ff...
(define the action to perform when the 'pcidssuri' reference
is provided)
So hopefully something similar could be implemented for the
<ident> element's 'customerident' attribute case?
For further information about the expected format of the
<xccdf:reference> element type, see:
[4]
http://scap.nist.gov/specifications/xccdf/xccdf_element_dictionary.html#r...
[...]
xmllint --format --output output/shorthand.xml output/shorthand.xml
xsltproc --stringparam ssg_version "0.1.27" -o
output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt
output/shorthand.xml
oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml
output/xccdf-unlinked-unresolved.xml
File 'output/xccdf-unlinked-unresolved.xml' line 153: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 167: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 182: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 190: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml.
../../shared/product-make.include:60: recipe for target
'output/xccdf-unlinked-empty-groups.xml' failed
make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1
Do I have to „register“/„declare“ the new identifier type, and if so where
and how?
See above.
Example of what I'm trying to achieve:
<Rule id="sshd_allow_only_protocol2">
<title>My Title</title>
<description>My description</description>
<rationale>My rationale</rationale>
<ident cce="27072-8" customerident="1234"
stig="RHEL-06-000227"/>
<oval id="sshd_allow_only_protocol2"/>
<ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/>
</Rule>
Any pointers highly appreciated :-) !
Hope this helps. Let us know if we can be of any further assistance.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> Thanks & regards
> Oliver
> --
> SCAP Security Guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
>
https://github.com/OpenSCAP/scap-security-guide/
>