[PATCH 1/4] added Makerule, transform to create table for RHEL 6 STIG Profile (Pre-release Draft)
Jeffrey Blank
blank at eclipse.ncsc.mil
Sun Jun 24 20:41:03 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
rhel6/src/Makefile | 8 +-
rhel6/src/input/profiles/STIG-server.xml | 5 +-
rhel6/src/transforms/xccdf-addprofiles.xslt | 1 +
.../src/transforms/xccdf2table-profileccirefs.xslt | 170 ++++++++++++++++++++
4 files changed, 179 insertions(+), 5 deletions(-)
create mode 100644 rhel6/src/transforms/xccdf2table-profileccirefs.xslt
diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
index 6443905..bb94dec 100644
--- a/rhel6/src/Makefile
+++ b/rhel6/src/Makefile
@@ -74,12 +74,14 @@ guide: shorthand-guide shorthand2xccdf
# tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml
table-profilenistrefs: shorthand-guide shorthand2xccdf
-# xsltproc -o $(POLICYMAPPING_OUTPUT_DIR)/rhel6-table-nistrefs.html $(TRANS)/xccdf2table-nistrefs.xslt $(XCCDF_OUTPUT_DIR)/rhel6-xccdf.xml
xsltproc -stringparam profile "desktop" -o $(OUT)/rhel6-table-nistrefs-desktop.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
xsltproc -stringparam profile "server" -o $(OUT)/rhel6-table-nistrefs-server.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
xsltproc -stringparam profile "common" -o $(OUT)/rhel6-table-nistrefs-common.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
xsltproc -stringparam profile "ftp" -o $(OUT)/rhel6-table-nistrefs-ftp.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
+table-profileccirefs: shorthand-guide shorthand2xccdf
+ xsltproc -stringparam profile "stig-server" -o $(OUT)/rhel6-table-stig-server.html $(TRANS)/xccdf2table-profileccirefs.xslt $(OUT)/rhel6-xccdf.xml
+
table-refs: shorthand-guide shorthand2xccdf
xsltproc -stringparam ref "nist" -o $(OUT)/rhel6-table-nistrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/rhel6-xccdf.xml
xsltproc -stringparam ref "cnss" -o $(OUT)/rhel6-table-cnssrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/rhel6-xccdf.xml
@@ -93,11 +95,11 @@ table-srgmap: shorthand-guide shorthand2xccdf
# the map-to-items filename must be provided relative to the root of the main document being processed
xsltproc -stringparam map-to-items "../$(OUT)/rhel6-xccdf.xml" -o $(OUT)/rhel6-table-srgmap.html $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
-table-stig:
+table-stig-rhel5:
xsltproc -o $(OUT)/rhel5-table-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml
xsltproc -o $(OUT)/rhel5-table-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
-tables: table-refs table-profilenistrefs table-srgmap
+tables: table-profilenistrefs table-profileccirefs table-refs table-srgmap table-stig-rhel5
content: shorthand-guide shorthand2xccdf guide checks
# the relabelids.py script chdirs to ./output, so refer to files from there.
diff --git a/rhel6/src/input/profiles/STIG-server.xml b/rhel6/src/input/profiles/STIG-server.xml
index 3a7e4a1..5ccf94c 100644
--- a/rhel6/src/input/profiles/STIG-server.xml
+++ b/rhel6/src/input/profiles/STIG-server.xml
@@ -1,6 +1,7 @@
<Profile id="stig-server" extends="common" xmlns="http://checklists.nist.gov/xccdf/1.1" >
-<title>Draft STIG (RHEL 6 Server)</title>
-<description>This profile represents a RHEL 6 Server STIG.</description>
+<title>Pre-release Draft STIG for RHEL 6 Server</title>
+<description>This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
+<select idref="rpm_verify_permissions" selected="true"/>
<select idref="disable_xwindows_with_runlevel" selected="true"/>
<select idref="packagegroup_xwindows_remove" selected="true"/>
<select idref="disable_dhcp_client" selected="true"/>
diff --git a/rhel6/src/transforms/xccdf-addprofiles.xslt b/rhel6/src/transforms/xccdf-addprofiles.xslt
index 0041dcd..1d3dadc 100644
--- a/rhel6/src/transforms/xccdf-addprofiles.xslt
+++ b/rhel6/src/transforms/xccdf-addprofiles.xslt
@@ -12,6 +12,7 @@
<xsl:apply-templates select="document('../input/profiles/desktop.xml')" />
<xsl:apply-templates select="document('../input/profiles/server.xml')" />
<xsl:apply-templates select="document('../input/profiles/ftp.xml')" />
+ <xsl:apply-templates select="document('../input/profiles/STIG-server.xml')" />
</xsl:if>
</xsl:template>
diff --git a/rhel6/src/transforms/xccdf2table-profileccirefs.xslt b/rhel6/src/transforms/xccdf2table-profileccirefs.xslt
new file mode 100644
index 0000000..94197b3
--- /dev/null
+++ b/rhel6/src/transforms/xccdf2table-profileccirefs.xslt
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<!-- this style sheet expects parameter $profile, which is the id of the Profile to be shown -->
+
+<xsl:include href="constants.xslt"/>
+
+ <xsl:template match="/">
+ <html>
+ <head>
+ <title><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:title" /></title>
+ </head>
+ <body>
+ <br/>
+ <br/>
+ <div style="text-align: center; font-size: x-large; font-weight:bold"><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:title" /></div>
+ <div style="text-align: center; font-size: normal "><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:description" /></div>
+ <br/>
+ <br/>
+ <xsl:apply-templates select="cdf:Benchmark"/>
+ </body>
+ </html>
+ </xsl:template>
+
+
+ <xsl:template match="cdf:Benchmark">
+ <style type="text/css">
+ table
+ {
+ border-collapse:collapse;
+ }
+ table,th, td
+ {
+ border: 1px solid black;
+ vertical-align: top;
+ padding: 3px;
+ }
+ thead
+ {
+ display: table-header-group;
+ font-weight: bold;
+ }
+ </style>
+ <table>
+ <thead>
+ <td>Vuln ID</td>
+ <td>GEN ID</td>
+ <td>Title</td>
+ <td>Discussion (Rationale)</td>
+ <td>Fix Text (Description)</td>
+ <!-- <td>Variable Setting</td> -->
+ <td>CCI Ref</td>
+ </thead>
+
+ <xsl:call-template name="profileplate">
+ <xsl:with-param name="profileid" select="$profile" />
+ </xsl:call-template>
+ </table>
+ </xsl:template>
+
+ <!-- recursively-called, to handle Profile "extends" behavior -->
+ <xsl:template match="cdf:Profile" name="profileplate">
+ <xsl:param name="profileid" />
+ <xsl:comment> Entered Profile: <xsl:value-of select="$profileid" /> </xsl:comment>
+
+ <xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profileid]">
+ <xsl:if test="@extends">
+ <xsl:variable name="extendedprofile" select="@extends" />
+ <xsl:call-template name="profileplate">
+ <xsl:with-param name="profileid" select="$extendedprofile" />
+ </xsl:call-template>
+ </xsl:if>
+ </xsl:for-each>
+
+ <xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profileid]/cdf:select">
+ <xsl:variable name="idrefer" select="@idref" />
+ <xsl:variable name="enabletest" select="@selected" />
+ <xsl:for-each select="/cdf:Benchmark/cdf:Group">
+ <xsl:call-template name="groupplate">
+ <xsl:with-param name="idreference" select="$idrefer" />
+ <xsl:with-param name="enabletest" select="$enabletest" />
+ </xsl:call-template>
+ </xsl:for-each>
+ </xsl:for-each>
+
+ </xsl:template>
+
+ <xsl:template match="cdf:Group" name="groupplate">
+ <xsl:param name="idreference" />
+ <xsl:param name="enabletest" />
+ <!-- Group cdf:title -->
+ <xsl:for-each select="cdf:Group">
+ <xsl:call-template name="groupplate">
+ <xsl:with-param name="idreference" select="$idreference" />
+ <xsl:with-param name="enabletest" select="$enabletest" />
+ </xsl:call-template>
+ </xsl:for-each>
+
+ <xsl:for-each select="cdf:Rule">
+ <xsl:call-template name="ruleplate">
+ <xsl:with-param name="idreference" select="$idreference" />
+ <xsl:with-param name="enabletest" select="$enabletest" />
+ </xsl:call-template>
+ </xsl:for-each>
+ </xsl:template>
+
+
+ <xsl:template match="cdf:Rule" name="ruleplate">
+ <xsl:param name="idreference" />
+ <xsl:param name="enabletest" />
+ <xsl:if test="@id=$idreference and $enabletest='true'">
+ <tr>
+ <td> TBD<!--extract value of Vuln-ID (stored as reference or note or ident) when mapping is available --></td>
+ <td> TBD<!--extract value of GEN-ID (stored as reference or note or ident) when mapping is available --></td>
+ <td> <xsl:value-of select="cdf:title" /></td>
+ <!-- call template to grab text and also child nodes (which should all be xhtml) -->
+ <td> <xsl:apply-templates select="cdf:rationale"/> </td>
+ <td> <xsl:apply-templates select="cdf:description"/> </td>
+ <!-- need to resolve <sub idref=""> here -->
+ <!-- <td> TODO: print refine-value from profile associated with rule </td> -->
+ <td>
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+ <xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)" />
+ <xsl:value-of select="$cci_expanded"/>
+ <br/>
+ </xsl:for-each>
+ </td>
+ </tr>
+ </xsl:if>
+ </xsl:template>
+
+
+ <xsl:template match="cdf:check">
+ <xsl:for-each select="cdf:check-export">
+ <xsl:variable name="rulevar" select="@value-id" />
+ <!--<xsl:value-of select="$rulevar" />:-->
+ <xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:refine-value">
+ <xsl:if test="@idref=$rulevar">
+ <xsl:value-of select="@selector" />
+ </xsl:if>
+ </xsl:for-each>
+ </xsl:for-each>
+ </xsl:template>
+
+
+ <!-- getting rid of XHTML namespace -->
+ <xsl:template match="xhtml:*">
+ <xsl:element name="{local-name()}">
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:element>
+ </xsl:template>
+
+ <xsl:template match="@*|node()">
+ <xsl:copy>
+ <xsl:apply-templates select="@*|node()"/>
+ </xsl:copy>
+ </xsl:template>
+
+ <xsl:template match="cdf:description">
+ <!-- print all the text and children (xhtml elements) of the description -->
+ <xsl:apply-templates select="@*|node()" />
+ </xsl:template>
+
+ <xsl:template match="cdf:rationale">
+ <!-- print all the text and children (xhtml elements) of the description -->
+ <xsl:apply-templates select="@*|node()" />
+ </xsl:template>
+
+</xsl:stylesheet>
--
1.7.1
More information about the scap-security-guide
mailing list