Thanks for the info.
In short, I created a variable named STIG and then referenced it throughout. Then I
created a subfolder underneath the input folder with the same name as the STIG. This would
allow me to have multiple SSG projects in the same repository without having to duplicate
the entire repository for each SSG. I want to ensure that when changes are made to the
files supporting the build process, that I don't have to update those changes for
every project. This method would support that goal.
Now I just need a way to dynamically list each project folder under input and perform the
make for each all from within the Makefile.
My thoughts were to include the following changes to the Makefile, as described above:
#################################
IN = input
OUT = output
TRANS = transforms
REFS = references
UTILS = utils
DIST = dist
STIG = rhel6
ID = ssg
all: shorthand2xccdf tables guide checks content dist
shorthand-guide:
xsltproc -o $(OUT)/$(STIG)-shorthand.xml $(IN)/$(STIG)/guide.xslt
$(IN)/$(STIG)/guide.xml
xmllint --format --output $(OUT)/$(STIG)-shorthand.xml $(OUT)/$(STIG)-shorthand.xml
shorthand2xccdf: shorthand-guide
xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml
$(TRANS)/shorthand2xccdf.xslt $(OUT)/$(STIG)-shorthand.xml
xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml
$(TRANS)/add_xccdf_namespace.xslt
$(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml
xsltproc -stringparam profile "allprofiles" -o
$(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml \
$(TRANS)/xccdf-addprofiles.xslt
$(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml
oscap xccdf resolve -o $(OUT)/unlinked-$(STIG)-xccdf.xml
$(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml
# xsltproc -stringparam profile "stig-$(STIG)-server" -o
$(OUT)/unlinked-$(STIG)-xccdf.xml \
# $(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
# extract manual check instructions from xccdf into an ocil file
xsltproc -o $(OUT)/unlinked-$(STIG)-ocil.xml $(TRANS)/xccdf-create-ocil.xslt
$(OUT)/unlinked-$(STIG)-xccdf.xml
xmllint --format --output $(OUT)/unlinked-$(STIG)-ocil.xml
$(OUT)/unlinked-$(STIG)-ocil.xml
xsltproc -o $(OUT)/unlinked-ocilrefs-$(STIG)-xccdf.xml $(TRANS)/xccdf-ocilcheck2ref.xslt
$(OUT)/unlinked-$(STIG)-xccdf.xml
./$(TRANS)/combinefixes.py $(IN)/$(STIG)/fixes/bash/ $(OUT)/bash-remediations.xml
xsltproc -stringparam fixes "../$(OUT)/bash-remediations.xml" -o
$(OUT)/unlinked-$(STIG)-xccdf.xml $(TRANS)/xccdf-addfixes.xslt
$(OUT)/unlinked-$(STIG)-xccdf.xml
xmllint --format --output $(OUT)/unlinked-$(STIG)-xccdf.xml
$(OUT)/unlinked-$(STIG)-xccdf.xml
checks:
xmlwf $(IN)/$(STIG)/checks/*.xml
$(TRANS)/combinechecks.py $(IN)/$(STIG)/checks > $(OUT)/unlinked-$(STIG)-oval.xml
xmllint --format --output $(OUT)/unlinked-$(STIG)-oval.xml
$(OUT)/unlinked-$(STIG)-oval.xml
guide: shorthand2xccdf
# remove auxiliary Groups which are only for use in tables, and not guide output.
# specifying a nonexistent profile, "allrules," to make oscap print all Rules
xsltproc -o $(OUT)/unlinked-$(STIG)-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt
$(OUT)/unlinked-$(STIG)-xccdf.xml
xsltproc -o $(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml
$(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
oscap xccdf generate guide --profile allrules
$(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml > $(OUT)/$(STIG)-guide.html
# example, if needed: for converting XCCDF into shorthand
#xccdf2shorthand:
# xsltproc -o $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml $(TRANS)/xccdf2shorthand.xslt
$(REFS)/usgcb-rhel5desktop-xccdf.xml
# tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml
table-refs: shorthand2xccdf
xsltproc -stringparam ref "nist" -o $(OUT)/table-$(STIG)-nistrefs.html
$(TRANS)/xccdf2table-byref.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
xsltproc -stringparam profile "common" -o
$(OUT)/table-$(STIG)-nistrefs-common.html \
$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
table-idents: shorthand2xccdf
xsltproc -o $(OUT)/table-$(STIG)-cces.html $(TRANS)/xccdf2table-cce.xslt
$(OUT)/unlinked-$(STIG)-xccdf.xml
table-srgmap: shorthand2xccdf
# the map-to-items filename must be provided relative to the root of the main document
being processed
xsltproc -stringparam map-to-items "../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o
$(OUT)/table-$(STIG)-srgmap.html \
$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
xsltproc -stringparam flat "y" -stringparam map-to-items
"../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o $(OUT)/table-$(STIG)-srgmap-flat.html
\
$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
xmllint --xmlout --html --output $(OUT)/table-$(STIG)-srgmap-flat.xhtml
$(OUT)/table-$(STIG)-srgmap-flat.html
table-stigs: shorthand2xccdf table-srgmap
xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml
xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
# xsltproc -stringparam notes "../$(IN)/$(STIG)/auxiliary/transition_notes.xml"
-o $(OUT)/table-rhel5-stig-manual-withnotes.html \
# $(TRANS)/xccdf2table-stig.xslt \
# $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
# temporarily retain an output file showing the short titles as well
xsltproc -stringparam profile "stig-$(STIG)-server" -stringparam testinfo
"y" -o $(OUT)/table-stig-$(STIG)-shorttitles.html \
$(TRANS)/xccdf2table-profileccirefs.xslt \
$(OUT)/unlinked-$(STIG)-xccdf.xml
xsltproc -stringparam profile "rht-ccp" -stringparam testinfo "y" -o
$(OUT)/table-stig-$(STIG)-shorttitles.html \
$(TRANS)/xccdf2table-profileccirefs.xslt \
$(OUT)/unlinked-$(STIG)-xccdf.xml
xsltproc -stringparam overlay "../$(IN)/$(STIG)/auxiliary/stig_overlay.xml" -o
$(OUT)/unlinked-stig-$(STIG)-xccdf.xml \
$(TRANS)/xccdf-apply-overlay-stig.xslt \
$(OUT)/unlinked-$(STIG)-xccdf.xml
xsltproc -o $(OUT)/table-stig-$(STIG).html $(TRANS)/xccdf2table-stig.xslt
$(OUT)/unlinked-stig-$(STIG)-xccdf.xml
tables: table-refs table-idents table-srgmap table-stigs
content: shorthand2xccdf guide checks
# the relabelids.py script chdirs to ./output, so refer to files from there.
# its second argument controls the IDs, as well as the output filenames.
# thus, with ID set to ssg, this creates ssg-$(STIG)-xccdf.xml and ssg-$(STIG)-oval.xml.
$(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml
$(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml $(ID)
$(TRANS)/relabelids.py unlinked-$(STIG)-xccdf.xml $(ID)
$(TRANS)/relabelids.py unlinked-ocilrefs-$(STIG)-xccdf.xml $(ID)
content-stig: shorthand2xccdf guide checks
xmllint --format --output $(OUT)/unlinked-stig-$(STIG)-xccdf.xml
$(OUT)/unlinked-stig-$(STIG)-xccdf.xml
$(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml
$(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml disa-predraft
$(TRANS)/relabelids.py unlinked-stig-$(STIG)-xccdf.xml disa-predraft
xmllint --format --output $(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml
$(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml
submission-stig-check: table-stigs
cd output; ../$(UTILS)/verify-references.py -p stig-$(STIG)-server
--rules-with-disarefs-outside-profile unlinked-$(STIG)-xccdf-prerefs.xml
# $(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-$(STIG)-xccdf.xml >
$(OUT)/table-stig.csv
# content-usgcb: coming soon
validate-xml:
oscap xccdf validate-xml $(OUT)/$(ID)-$(STIG)-xccdf.xml
oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-oval.xml
oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-cpe-oval.xml
validate: validate-xml
cd output; ../$(UTILS)/verify-references.py --rules-with-invalid-checks --ovaldefs-unused
ssg-$(STIG)-xccdf.xml
oscap oval validate-xml --schematron $(OUT)/$(ID)-$(STIG)-oval.xml
eval-test:
oscap xccdf eval --profile test $(OUT)/$(ID)-$(STIG)-xccdf.xml
eval-common:
oscap xccdf eval --profile common --oval-results --results /tmp/results-test.xml
$(OUT)/$(ID)-$(STIG)-xccdf.xml
# items in dist are expected for distribution in an rpm
dist: tables guide content
mkdir -p $(DIST)/guide $(DIST)/content $(DIST)/policytables
cp $(OUT)/*-guide.html $(DIST)/guide
cp $(OUT)/$(ID)-$(STIG)-xccdf.xml $(DIST)/content
cp $(OUT)/$(ID)-$(STIG)-oval.xml $(DIST)/content
cp $(OUT)/$(ID)-$(STIG)-cpe-dictionary.xml $(DIST)/content
cp $(OUT)/$(ID)-$(STIG)-cpe-oval.xml $(DIST)/content
cp $(OUT)/table-$(STIG)-* $(DIST)/policytables
clean:
rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf $(OUT)/*.spec $(OUT)/*.tar
$(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
rm -rf $(DIST)/content $(DIST)/policytables $(DIST)/guide
#################################
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Jeffrey Blank
Sent: Tuesday, August 20, 2013 10:50 AM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: Generalising SSG ...
Yes, though I simply haven't had time to refactor the code to make it easily portable.
And of course I'd welcome tooling improvements as commits to SSG, for anyone
similarly-minded.
A simplified version has already been dropped here, for another platform:
$ svn checkout
https://svn.macosforge.org/repository/scap-on-apple
(This is also simpler, as there is no OVAL involved.)
On 08/20/2013 11:36 AM, Trey Henefield wrote:
Just food for thought. Has there been any desire to make changes to
SSG to accommodate building other (non-rhel6) SSGs?
I am getting up to speed on its processes, and for practice and actual
need, was thinking of creating an SSG for Firefox and Java, and
potentially webmin and apache. However, I noticed rhel6 is embedded
all throughout.
I have noticed that most of the processes in place can be repurposed.
With some changes to the makefile and a repurposed input folder,
should this be possible?
I was just hoping to get some further insight before going down this
long path.
Thanks in advance!
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
*Disclaimer*
The information contained in this communication from
*trey.henefield(a)ultra-ats.com * sent at 2013-08-20 11:36:43 is private
and may be legally privileged or export controlled. It is intended
solely for use by *scap-security-guide(a)lists.fedorahosted.org * and
others authorized to receive it. If you are not
*scap-security-guide(a)lists.fedorahosted.org * you are hereby notified
that any disclosure, copying, distribution or taking action in
reliance of the contents of this information is strictly prohibited
and may be unlawful.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at
2013-08-20 12:17:48 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others
authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you
are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this
information is strictly prohibited and may be unlawful.