template for file entries

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Apr 5 13:37:05 UTC 2012


A few things (and changing subject properly):

1) Is this solving a problem we really have right now?  I don't really 
think it is, but I'm open to being corrected.

2) This is also too clever.  The clean_line function (in the patch) has 
regexes to edit regexes.  The script is also doing its own parsing of 
its own format (instead of using existing parsers for JSON or XML or CSV 
or whatever).

For now I don't see this simplifying the creation of content more than 
it complicates the maintenance/comprehension overhead.  If we suddenly 
need to do more line edits, let's revisit.  I also have a draft XSLT 
that might fit the bill (but I'm also not convinced it solves more 
problems than it creates).



On 03/30/2012 02:48 PM, Michael Palmiotto wrote:
> To aid in the automation of OVAL checks, I've written a script that
> generates the check.xmls to test for lines being properly added to
> config files.
>
> Attached you'll find the example template and the output for 2.6.2.4.6 Record Attempts
> to Alter Process and Session Initiation Information.
>
> The file "test_input_1_entry" has the relevant lines for the addition of a test:
> oval_id:
>      title: "Title of Check"
>      cces: "CCE-#, CCE-#"
>      desc: "Description of check"
>      tests:
>          test_name_1:
>              filepath: "Path of file to be checked"
>              filename: "Name of file to be checked"
>              line: "Text that needs to be added to the file"
>
> The template file, "template_file_entries" is similar to the current template files,
> with tags for oval_id, title, cces, desc, tests, etc:
> <def-group>
>   <!-- THIS FILE IS GENERATED by create_file_entries.py.  DO NOT EDIT.  -->
>    <definition class="compliance" id="TESTID" version="1">
>      <metadata>
>        <title>TESTTITLE</title>
>        <affected family="unix">
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
>        <reference ref_id="CCE_ID" source="CCE" />
>        <description>DESC</description>
>      </metadata>
>      <criteria operator = "AND">
>        <criterion comment="" test_ref="test_TESTID_TESTNAME" />
>      </criteria>
>    </definition>
>    <ind:textfilecontent54_test check="all" comment="" id="test_TESTID_TESTNAME" version="1">
>      <ind:object object_ref="object_TESTID_TESTNAME" />
>    </ind:textfilecontent54_test>
>    <ind:textfilecontent54_object id="object_TESTID_TESTNAME" version="1">
>      <ind:filepath>FILEPATH</ind:filepath>
>      <ind:filename>FILENAME</ind:filename>
>      <ind:pattern operation="pattern match">FILE_LINE</ind:pattern>
>      <ind:instance datatype="int">1</ind:instance>
>    </ind:textfilecontent54_object>
> </def-group>
>
>
> Any feedback on this would be greatly appreciated.  I've attached the script and a test input file.
>
> --Mike
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list