This patch reverts the Fedora change performed by: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=4ee9b7b...
commit.
At our internal meeting it has been suggested to me we don't want direct Fedora release name in the HTML version of the guide, and want supported CPEs listed under "Applicable platforms" section of the guide instead.
So make it to follow that requirement.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
On 12/9/13, 10:31 AM, Jan Lieskovsky wrote:
This patch reverts the Fedora change performed by: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=4ee9b7b...
commit.
My original interpretation was that you pushed this, hence the delay. Ack.
At our internal meeting it has been suggested to me we don't want direct Fedora release name in the HTML version of the guide, and want supported CPEs listed under "Applicable platforms" section of the guide instead.
So make it to follow that requirement.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-Fedora-Revert-4ee9b7-Set-up-Fedora-release-name-and-.patch
From 7d74194c1e7ca76617faba3bfca68f7ba9d55b73 Mon Sep 17 00:00:00 2001 From: Jan Lieskovskyjlieskov@redhat.com Date: Mon, 9 Dec 2013 16:22:21 +0100 Subject: [PATCH] [Fedora] Revert 4ee9b7 (Set up Fedora release name and CPE based on build system properties)
Signed-off-by: Jan Lieskovskyjlieskov@redhat.com
Fedora/Makefile | 14 +---- Fedora/input/guide.xml | 14 +++-- Fedora/scap-security-guide.spec | 1 + Fedora/transforms/genguidexslt.py | 115 -------------------------------------- 4 files changed, 11 insertions(+), 133 deletions(-) delete mode 100755 Fedora/transforms/genguidexslt.py
diff --git a/Fedora/Makefile b/Fedora/Makefile index 0072a67..1dee3a0 100644 --- a/Fedora/Makefile +++ b/Fedora/Makefile @@ -7,19 +7,10 @@ DIST = dist ID = ssg PROD = fedora
-FEDORA_GUIDE_XSLT = fedora_guide.xslt -FEDORA_GUIDE_XML = fedora_guide.xml
- all: shorthand2xccdf guide content dist
-set-fedora-release: -# obtain full Fedora release name and CPE from the system
- $(TRANS)/genguidexslt.py $(OUT)/$(FEDORA_GUIDE_XSLT)
-# update Fedora/input/guide.xml based on retrieved values
- xsltproc -o $(OUT)/$(FEDORA_GUIDE_XML) $(OUT)/$(FEDORA_GUIDE_XSLT) $(IN)/guide.xml
-shorthand-guide: set-fedora-release
- xsltproc -o $(OUT)/$(ID)-$(PROD)-shorthand.xml $(IN)/guide.xslt $(OUT)/$(FEDORA_GUIDE_XML)
+shorthand-guide:
xsltproc -o $(OUT)/$(ID)-$(PROD)-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml xmllint --format --output $(OUT)/$(ID)-$(PROD)-shorthand.xml $(OUT)/$(ID)-$(PROD)-shorthand.xml
shorthand2xccdf: shorthand-guide
@@ -68,6 +59,5 @@ eval-common: content
clean: rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf $(OUT)/*.spec $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
- rm -f $(OUT)/$(FEDORA_GUIDE_XSLT) rm -f $(IN)/fixes/bash/templates/output/*.sh rm -rf $(DIST)/content
diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml index ddc6904..c440e6f 100644 --- a/Fedora/input/guide.xml +++ b/Fedora/input/guide.xml @@ -1,11 +1,11 @@
<?xml version="1.0"?>
-<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="FEDORA-19" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="false" xml:lang="en-US" > +<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="FEDORA" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="false" xml:lang="en-US" >
<status date="2011-12-20">draft</status> -<title>Guide to the Secure Configuration of <fedora_release/></title> -<description>This guide presents a catalog of security-relevant -configuration settings for <fedora_release/> formatted in the -eXtensible Configuration Checklist Description Format (XCCDF). +<title>Guide to the Secure Configuration of Fedora</title> +<description>This guide presents a catalog of security-relevant configuration +settings for Fedora operating system formatted in the eXtensible Configuration +Checklist Description Format (XCCDF).
<br/> <br/> Providing system administrators with such guidance informs them how to securely @@ -35,6 +35,8 @@ quality, reliability, or any other characteristic.</notice> trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.</rear-matter> +<platform idref="cpe:/o:fedoraproject:fedora:20" /> <platform idref="cpe:/o:fedoraproject:fedora:19" /> -<version>0.0.3</version> +<platform idref="cpe:/o:fedoraproject:fedora:18" /> +<version>0.0.4</version> </Benchmark> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec index c252535..eb04b6a 100644 --- a/Fedora/scap-security-guide.spec +++ b/Fedora/scap-security-guide.spec @@ -56,6 +56,7 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man %changelog * Mon Dec 09 2013 Jan iankko Lieskovsky<jlieskov@redhat.com> 0.1.4.rc12-1 - Rename XCCDF rules +- Revert Set up Fedora release name and CPE based on build system properties
- Fri Dec 06 2013 Jan iankko Lieskovskyjlieskov@redhat.com 0.1.4.rc11-1
- Shared OVAL check for Verify that Shared Library Files Have Root Ownership
diff --git a/Fedora/transforms/genguidexslt.py b/Fedora/transforms/genguidexslt.py deleted file mode 100755 index 504e8d7..0000000 --- a/Fedora/transforms/genguidexslt.py +++ /dev/null @@ -1,115 +0,0 @@ -#!/usr/bin/python
-# PURPOSE: Generate XSLT transform to adjust: -# -# Fedora/input/guide.xml -# -# content (release name and CPE) based on underlying system's Fedora version -# (for now building on RHEL isn't supported)
-from contextlib import contextmanager -import sys
-# Script helper routines below -# ----------------------------
-# Open a file (PEP 343 version) -@contextmanager -def pep_343_open_file(filename, mode="r"):
- try:
- f = open(filename, mode)
- except IOError, e:
- yield None, e
- else:
- try:
yield f, None
- finally:
f.close()
-# Read one line from file -def read_file_line(filename):
- with pep_343_open_file(filename) as (f, e):
- if e:
return None
- else:
return f.readline().rstrip('\n')
-# Constants for generated XSLT content below -# ------------------------------------------
-XSLT_HEADER = '''<?xml version="1.0"?> -<xsl:stylesheet version="1.0"
- xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
- xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
- xmlns:xhtml="http://www.w3.org/1999/xhtml"
- xmlns:dc="http://purl.org/dc/elements/1.1/%22%3E'''
-XSLT_TEMPLATES = '''
-<!-- Copy children --> -<xsl:template match="@*|node()">
- xsl:copy
- <xsl:apply-templates select="@*|node()" />
- </xsl:copy>
-</xsl:template> -<!-- Update full Fedora release name based on param value --> -<xsl:template match="fedora_release">
- <xsl:value-of select="$fedora_release" />
-</xsl:template> -<!-- Update Fedora CPE based on param value --> -<xsl:template match="platform/@idref">
- <xsl:attribute name="idref">
- <xsl:value-of select="$fedora_cpe" />
- </xsl:attribute>
-</xsl:template>
-'''
-XSLT_FOOTER = '</xsl:stylesheet>'
-# Helper XSLT content routines below -# ----------------------------------
-# Store retrieved values from the system -# into XSLT params -def create_fedora_xslt_params(xslt_file):
- release_xslt_param = "\n<xsl:param name="fedora_release" select="'%s'" />" % FEDORA_RELEASE
- cpe_xslt_param = "\n<xsl:param name="fedora_cpe" select="'%s'" />" % FEDORA_CPE
- xslt_file.write(NEW_LINE + release_xslt_param)
- xslt_file.write(cpe_xslt_param)
-# Create final XSLT transform file -def create_xslt(filename):
- with pep_343_open_file(filename, "w") as (f, e):
- if e:
print "Error generating XSLT transform."
sys.exit(1)
- else:
print "Writing XSLT transform file into: %s" % filename
f.write(XSLT_HEADER)
create_fedora_xslt_params(f)
f.write(XSLT_TEMPLATES)
f.write(XSLT_FOOTER)
-# Main section -# ------------ -if __name__ == "__main__":
- if len(sys.argv) < 2:
- print "Provide filename for resulting XSLT file."
- sys.exit(1)
- NEW_LINE = '\n'
- XSLT_FILE = str(sys.argv[1])
- FEDORA_RELEASE = read_file_line('/etc/fedora-release')
- FEDORA_CPE = read_file_line('/etc/system-release-cpe')
- if FEDORA_RELEASE is None or FEDORA_CPE is None:
- print '''
-Unable to determine version of Fedora at the system. Be sure to -build scap-security-guide (source) RPM either at Fedora 18 or at -Fedora 19.\n'''
- sys.exit(1)
- create_xslt(XSLT_FILE)
-- 1.8.3.1
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org