[PATCH 0/4] new transforms to enable CCE display, correction, generation

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Aug 24 16:48:21 UTC 2012


(Note: If acknowledged, this push will also include a 280K file with the RHEL 5 CCE list.)

This patchset is designed to allow for display of the CCEs that are
currently included as idents in the the RHEL 6 XCCDF contents.
This will allow for easier identification of any incorrect CCE references in the XCCDF content.
It should also allow for easier request of CCEs for RHEL 6.

Technically, the (semantically identical) CCE references we are using are incorrect; the CCEs
are really only for RHEL 5.  Mitre have asked me not to do this and we will not release with these
CCEs.  However, we will need proper ones before a release is issued.


Jeffrey Blank (4):
  added support for generating CCE table (RHEL 5 vs RHEL 6)
  added NIST 800-53 ref origin to table with DISA CCI refs
  new transform to show CCE list (and compare RHEL 6 Rules with CCEs
    desc/mechanisms for RHEL 5)
  new script which extracts platform-specific CCEs from master CCE list
         * because apparently only the master list is provided in XML,
    and it's 10MB      * this gets us down to about 280K for the RHEL
    5-specific CCE list

 RHEL6/Makefile                                   |    8 +-
 RHEL6/transforms/cce_extract.py                  |   51 ++++++++++
 RHEL6/transforms/xccdf2table-cce.xslt            |  115 ++++++++++++++++++++++
 RHEL6/transforms/xccdf2table-profileccirefs.xslt |   17 +++-
 4 files changed, 187 insertions(+), 4 deletions(-)
 create mode 100755 RHEL6/transforms/cce_extract.py
 create mode 100644 RHEL6/transforms/xccdf2table-cce.xslt



More information about the scap-security-guide mailing list