Hello Shawn,
thank you for your review.
On 9/17/13 11:39 AM, Jan Lieskovsky wrote:
0001-Add-FEDORA-Makefile-README-and-scap-security-guide.s.patch
From cdb777a21d597945269c855f4d40c867749e0ab9 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Tue, 17 Sep 2013 16:20:23
+0200
Subject: [PATCH 1/8] Add FEDORA Makefile, README, and
scap-security-guide.spec files.
Signed-off-by: Jan Lieskovsky <jlieskov(a)redhat.com> ---
FEDORA/Makefile | 58
+++++++++++++++++++++++++++++++++++++++++
FEDORA/README | 30 +++++++++++++++++++++
FEDORA/scap-security-guide.spec | 53 +++++++++++++++++++++++++++++++++++++
3 files changed, 141 insertions(+)
create mode 100644 FEDORA/Makefile
create mode 100644 FEDORA/README
create mode 100644 FEDORA/scap-security-guide.spec
For the directory structure, use Fedora19 vs FEDORA
We would like to avoid explicit Fedora version in the main subdirectory
yet =>
As of right now it's not clear / agreed yet (we will need to agree
on this within our team yet), if in six months when Fedora-20 will
be released it will get its own subdirectory, or till that time we
will come with scripts which would just replace 'fedora19',
Fedora-19's name, Fedora-19 CPE etc. in the content with their
Fedora-20 counterparts in the repository, and deal with the need
of two packages on the srpm / rpm level only.
Evaluating pros and cons of each of the approach right now.
But replaced it with 'Fedora' for now at least.
diff --git a/FEDORA/Makefile b/FEDORA/Makefile
new file mode 100644
index 0000000..be0086d
--- /dev/null
+++ b/FEDORA/Makefile
@@ -0,0 +1,58 @@
+IN = input
+OUT = output
+TRANS = transforms
+UTILS = utils
+DIST = dist
+
+ID = fedora-19
ID = ssg
ID is used to identify the content provider, which in the Makefile, generates
the ssg-${os}-xccdf.xml files. In the various make commands, 'fedora' should
be changed to 'fedora19'
Oh, didn't know the ID stands for content provider.
Anyway, updated the third version below it to reflect ssg at the beginning
(and added just PROD variable [PRODUCT]) to identify Fedora-19.
+
+all: shorthand2xccdf guide content dist
+
+shorthand-guide:
+ xsltproc -o $(OUT)/$(ID)-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml
+ xmllint --format --output $(OUT)/$(ID)-shorthand.xml
$(OUT)/$(ID)-shorthand.xml
+
+shorthand2xccdf: shorthand-guide
+ xsltproc -o $(OUT)/unlinked-unresolved-fedora-xccdf.xml
$(TRANS)/shorthand2xccdf.xslt $(OUT)/$(ID)-shorthand.xml
+ oscap xccdf resolve -o $(OUT)/unlinked-fedora-xccdf.xml
$(OUT)/unlinked-unresolved-fedora-xccdf.xml
as an example, the above should be:
+shorthand2xccdf: shorthand-guide
+ xsltproc -o $(OUT)/unlinked-unresolved-fedora19-xccdf.xml
$(TRANS)/shorthand2xccdf.xslt $(OUT)/$(ID)-shorthand.xml
+ oscap xccdf resolve -o $(OUT)/unlinked-fedora19-xccdf.xml
$(OUT)/unlinked-unresolved-fedora-xccdf.xml
Right, updated the Fedora Makefile it to result into the form recommended
above.
+
+checks:
+ xmlwf $(IN) / checks / *.xml
+ $(TRANS)/combinechecks.py $(IN)/checks > $(OUT)/unlinked-fedora-oval.xml
+ xmllint --format --output $(OUT)/unlinked-fedora-oval.xml
$(OUT)/unlinked-fedora-oval.xml
+
+guide: shorthand2xccdf
+# remove auxiliary Groups which are only for use in tables, and not
guide output.
+# specifying a nonexistent profile, "allrules," to make oscap print
all Rules
+ xsltproc -o $(OUT)/unlinked-fedora-xccdf-guide.xml
$(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-fedora-xccdf.xml
+ xsltproc -o $(OUT)/unlinked-notest-fedora-xccdf-guide.xml
$(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-fedora-xccdf.xml
+ oscap xccdf generate guide --profile allrules
$(OUT)/unlinked-notest-fedora-xccdf-guide.xml > $(OUT)/$(ID)-guide.html
+
+content: shorthand2xccdf guide checks
+ $(TRANS)/cpe_generate.py $(OUT)/unlinked-fedora-oval.xml
$(IN)/checks/platform/fedora-cpe-dictionary.xml $(ID)
+ $(TRANS)/relabelids.py unlinked-fedora-xccdf.xml $(ID)
+
+validate-xml:
+ oscap xccdf validate-xml $(OUT)/$(ID)-xccdf.xml
+ oscap oval validate-xml $(OUT)/$(ID)-oval.xml
+ oscap oval validate-xml $(OUT)/$(ID)-cpe-oval.xml
here we'd want ssg-$(ID)-xccdf.xml
Updated too.
+
+validate: validate-xml
+ cd $(OUT); ../$(UTILS)/verify-references.py --rules-with-invalid-checks
--ovaldefs-unused $(ID)-xccdf.xml
+ oscap oval validate-xml --schematron $(OUT)/$(ID)-oval.xml
+
+# items in dist are expected for distribution in an rpm
+dist: guide content
+ mkdir -p $(DIST)/guide $(DIST)/content
+ cp $(OUT)/*-guide.html $(DIST)/guide
+ cp $(OUT)/$(ID)-xccdf.xml $(DIST)/content
+ cp $(OUT)/$(ID)-oval.xml $(DIST)/content
+ cp $(OUT)/$(ID)-cpe-dictionary.xml $(DIST)/content
+ cp $(OUT)/$(ID)-cpe-oval.xml $(DIST)/content
+
+eval-common: content
+ oscap xccdf eval --profile common $(OUT)/$(ID)-xccdf.xml
+
+clean:
+ rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf $(OUT)/*.spec
$(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
+ rm -rf $(DIST)/content $(DIST)/guide
diff --git a/FEDORA/README b/FEDORA/README
new file mode 100644
index 0000000..c3c94db
--- /dev/null
+++ b/FEDORA/README
@@ -0,0 +1,30 @@
+Directory Structure of scap-security-guide
+------------------------------------------
+
+The input directory contains source files that generate SCAP content, such
as
+XCCDF and OVAL. Since a single large XML file is an impractical format for
+multiple authors to collaborate on editing SCAP content, efforts are made to
+keep logically related guidance and checking content in individual files.
+
+The transforms directory contains resources that enable the files inside the
+input directory (or output directory) to be combined and reformatted into
+valid SCAP formats or human-readable formats.
+
+The output directory is used as a storage area for items generated by the
files
+in the inputs directory. It should be empty in the repository, and built on
+users' individual systems (and rely on its .gitignore file to keep such
files
+out). The output directory contains transitional output (which may only
exist
+in order to be further transformed) as well as final output.
+
+The references directory should contain documents which are specified as
+references from within the SCAP content, or documents that are "seeds," viz.
+documents whose prose will be translated into SCAP formats, as well as other
+examples of SCAP content.
+
+The utils directory contains helper scripts and other items that are useful
to
+developers but are not essential to producing the project's output.
+
+The dist directory contains final outputs, which could be shipped in an RPM
for
+consumption by end-users. Updating the Makefile to copy an item from the
+outputs directory to the dist directory indicates that an item is considered
a
+final output.
diff --git a/FEDORA/scap-security-guide.spec
b/FEDORA/scap-security-guide.spec
new file mode 100644
index 0000000..6042ba6
--- /dev/null
+++ b/FEDORA/scap-security-guide.spec
@@ -0,0 +1,53 @@
+
+# IMPORTANT NOTE: This spec file is solely dedicated to make changes to the
+# Fedora's scap-security-guide package. If you want to apply changes against
+# the main RHEL-6 scap-security-guide RPM content, use
scap-security-guide.spec
+# file one level up - in the main scap-security-guide directory (instead of
+# this one).
+
+Name: scap-security-guide
+Version: 0.1
+Release: 1.fc19
+Summary: Security guidance and baselines in SCAP formats
+Group: Applications/System
+License: Public Domain
+URL:
https://fedorahosted.org/scap-security-guide/ +Source0:
http://fedorapeople.org/~jlieskov/% {name}-%{version}.tar.gz
+BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
+BuildArch: noarch
+BuildRequires: coreutils, libxslt, expat, python, openscap-utils >= 0.9.1,
python-lxml
+Requires: filesystem, openscap-utils >= 0.9.1
+
+%description
+The scap-security-guide project provides security configuration guidance in
+formats of the Security Content Automation Protocol (SCAP). It provides a
+catalog of practical hardening advice and links it to government
requirements
+where applicable. The project bridges the gap between generalized policy
+requirements and specific implementation guidance.
+%prep
+%setup -q
+
+
+%build
+cd FEDORA && make dist
+
+
+%install
+rm -rf $RPM_BUILD_ROOT
+mkdir -p $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19
+
+# Add in core content (SCAP, guide)
+cp -r FEDORA/dist/* $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19
+
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+
+%files
+%defattr(-,root,root,-)
+/usr/share/xml/scap/ssg/fedora/19/*
+
+%changelog
+* Tue Sep 17 2013 Jan iankko Lieskovsky <jlieskov(a)redhat.com> 0.1-1
+- Initial Fedora SSG RPM.
--
1.7.11.7
Attached below is (all-in-one-form since I don't want to spam SSG ML
with all the patches again) third version of the patch, which:
- includes the changes from version #2, namely:
Second version:
* included testcheck.py and utils/verify-input-sanity.py scripts,
* removed attestation parts and CCE definitions:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
* updated FEDORA rpm license to be just Public Domain:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
- and adds the following:
Third version:
* rename main subdirectory from 'FEDORA' to 'Fedora',
* preserve original SSG id, introduce new PROD variable to track Fedora version,
* make the XML output files format to be: ssg-${os}-xccdf.xml:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
Also tested:
* Fedora make {content, dist, validate, checks, eval-common, clean} rules to work
properly,
* Fedora tarball / srpm / rpm generation to work properly,
* for the common profile content confirmed the tests still work properly (return
particular
result on F-19, notapplicable on F-17),
* confirmed ./testcheck.py script works and returns reasonable results.
Please review && let me know.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team