[PATCH 1/4] added Makerule, transform to create table for RHEL 6 STIG Profile (Pre-release Draft)

Jeffrey Blank blank at eclipse.ncsc.mil
Sun Jun 24 20:41:03 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/Makefile                                 |    8 +-
 rhel6/src/input/profiles/STIG-server.xml           |    5 +-
 rhel6/src/transforms/xccdf-addprofiles.xslt        |    1 +
 .../src/transforms/xccdf2table-profileccirefs.xslt |  170 ++++++++++++++++++++
 4 files changed, 179 insertions(+), 5 deletions(-)
 create mode 100644 rhel6/src/transforms/xccdf2table-profileccirefs.xslt

diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
index 6443905..bb94dec 100644
--- a/rhel6/src/Makefile
+++ b/rhel6/src/Makefile
@@ -74,12 +74,14 @@ guide: shorthand-guide shorthand2xccdf
 #	tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml
 
 table-profilenistrefs: shorthand-guide shorthand2xccdf
-#	xsltproc -o $(POLICYMAPPING_OUTPUT_DIR)/rhel6-table-nistrefs.html $(TRANS)/xccdf2table-nistrefs.xslt $(XCCDF_OUTPUT_DIR)/rhel6-xccdf.xml
 	xsltproc -stringparam profile "desktop" -o $(OUT)/rhel6-table-nistrefs-desktop.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
 	xsltproc -stringparam profile "server" -o $(OUT)/rhel6-table-nistrefs-server.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
 	xsltproc -stringparam profile "common" -o $(OUT)/rhel6-table-nistrefs-common.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
 	xsltproc -stringparam profile "ftp" -o $(OUT)/rhel6-table-nistrefs-ftp.html $(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
 
+table-profileccirefs: shorthand-guide shorthand2xccdf
+	xsltproc -stringparam profile "stig-server" -o $(OUT)/rhel6-table-stig-server.html $(TRANS)/xccdf2table-profileccirefs.xslt $(OUT)/rhel6-xccdf.xml
+
 table-refs: shorthand-guide shorthand2xccdf
 	xsltproc -stringparam ref "nist" -o $(OUT)/rhel6-table-nistrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/rhel6-xccdf.xml
 	xsltproc -stringparam ref "cnss" -o $(OUT)/rhel6-table-cnssrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/rhel6-xccdf.xml
@@ -93,11 +95,11 @@ table-srgmap: shorthand-guide shorthand2xccdf
 # the map-to-items filename must be provided relative to the root of the main document being processed
 	xsltproc -stringparam map-to-items "../$(OUT)/rhel6-xccdf.xml" -o $(OUT)/rhel6-table-srgmap.html $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
 
-table-stig:
+table-stig-rhel5:
 	xsltproc -o $(OUT)/rhel5-table-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml  
 	xsltproc -o $(OUT)/rhel5-table-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml  
 
-tables: table-refs table-profilenistrefs table-srgmap
+tables: table-profilenistrefs table-profileccirefs table-refs table-srgmap table-stig-rhel5
 
 content: shorthand-guide shorthand2xccdf guide checks
 #	the relabelids.py script chdirs to ./output, so refer to files from there.
diff --git a/rhel6/src/input/profiles/STIG-server.xml b/rhel6/src/input/profiles/STIG-server.xml
index 3a7e4a1..5ccf94c 100644
--- a/rhel6/src/input/profiles/STIG-server.xml
+++ b/rhel6/src/input/profiles/STIG-server.xml
@@ -1,6 +1,7 @@
 <Profile id="stig-server" extends="common" xmlns="http://checklists.nist.gov/xccdf/1.1" >
-<title>Draft STIG (RHEL 6 Server)</title>
-<description>This profile represents a RHEL 6 Server STIG.</description>
+<title>Pre-release Draft STIG for RHEL 6 Server</title>
+<description>This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
+<select idref="rpm_verify_permissions" selected="true"/>
 <select idref="disable_xwindows_with_runlevel" selected="true"/>
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <select idref="disable_dhcp_client" selected="true"/>
diff --git a/rhel6/src/transforms/xccdf-addprofiles.xslt b/rhel6/src/transforms/xccdf-addprofiles.xslt
index 0041dcd..1d3dadc 100644
--- a/rhel6/src/transforms/xccdf-addprofiles.xslt
+++ b/rhel6/src/transforms/xccdf-addprofiles.xslt
@@ -12,6 +12,7 @@
           <xsl:apply-templates select="document('../input/profiles/desktop.xml')" />
           <xsl:apply-templates select="document('../input/profiles/server.xml')" />
           <xsl:apply-templates select="document('../input/profiles/ftp.xml')" />
+          <xsl:apply-templates select="document('../input/profiles/STIG-server.xml')" />
     </xsl:if>
   </xsl:template>
 
diff --git a/rhel6/src/transforms/xccdf2table-profileccirefs.xslt b/rhel6/src/transforms/xccdf2table-profileccirefs.xslt
new file mode 100644
index 0000000..94197b3
--- /dev/null
+++ b/rhel6/src/transforms/xccdf2table-profileccirefs.xslt
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<!-- this style sheet expects parameter $profile, which is the id of the Profile to be shown -->
+
+<xsl:include href="constants.xslt"/>
+
+	<xsl:template match="/">
+		<html>
+		<head>
+			<title><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:title" /></title>
+		</head>
+		<body>
+			<br/>
+			<br/>
+			<div style="text-align: center; font-size: x-large; font-weight:bold"><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:title" /></div>
+			<div style="text-align: center; font-size: normal "><xsl:value-of select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:description" /></div>
+			<br/>
+			<br/>
+			<xsl:apply-templates select="cdf:Benchmark"/>
+		</body>
+		</html>
+	</xsl:template>
+
+
+	<xsl:template match="cdf:Benchmark">
+		<style type="text/css">
+		table
+		{
+			border-collapse:collapse;
+		}
+		table,th, td
+		{
+			border: 1px solid black;
+			vertical-align: top;
+			padding: 3px;
+		}
+		thead
+		{
+			display: table-header-group;
+			font-weight: bold;
+		}
+		</style>
+		<table>
+			<thead>
+				<td>Vuln ID</td>
+				<td>GEN ID</td>
+				<td>Title</td>
+				<td>Discussion (Rationale)</td>
+				<td>Fix Text (Description)</td>
+				<!-- <td>Variable Setting</td> -->
+				<td>CCI Ref</td>
+			</thead>
+
+		<xsl:call-template name="profileplate">
+			<xsl:with-param name="profileid" select="$profile" />
+		</xsl:call-template>
+		</table>
+	</xsl:template>
+
+	<!-- recursively-called, to handle Profile "extends" behavior -->
+	<xsl:template match="cdf:Profile" name="profileplate">
+		<xsl:param name="profileid" />
+		<xsl:comment> Entered Profile: <xsl:value-of select="$profileid" />	 </xsl:comment>
+
+		<xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profileid]">
+		<xsl:if test="@extends">
+			<xsl:variable name="extendedprofile" select="@extends" />
+			<xsl:call-template name="profileplate">
+				<xsl:with-param name="profileid" select="$extendedprofile" />
+			</xsl:call-template>
+		</xsl:if>
+		</xsl:for-each>
+
+		<xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profileid]/cdf:select">
+			<xsl:variable name="idrefer" select="@idref" />
+			<xsl:variable name="enabletest" select="@selected" />
+			<xsl:for-each select="/cdf:Benchmark/cdf:Group">
+				<xsl:call-template name="groupplate">
+					<xsl:with-param name="idreference" select="$idrefer" />
+					<xsl:with-param name="enabletest" select="$enabletest" />
+				</xsl:call-template>
+			</xsl:for-each>
+		</xsl:for-each>
+
+	</xsl:template>
+
+	<xsl:template match="cdf:Group" name="groupplate">
+		<xsl:param name="idreference" />
+		<xsl:param name="enabletest" />
+		<!-- Group cdf:title -->
+		<xsl:for-each select="cdf:Group">
+			<xsl:call-template name="groupplate">
+				<xsl:with-param name="idreference" select="$idreference" />
+				<xsl:with-param name="enabletest" select="$enabletest" />
+			</xsl:call-template>
+		</xsl:for-each>
+
+		<xsl:for-each select="cdf:Rule">
+			<xsl:call-template name="ruleplate">
+				<xsl:with-param name="idreference" select="$idreference" />
+				<xsl:with-param name="enabletest" select="$enabletest" />
+			</xsl:call-template>
+		</xsl:for-each>
+	</xsl:template>
+
+
+	<xsl:template match="cdf:Rule" name="ruleplate">
+		<xsl:param name="idreference" />
+		<xsl:param name="enabletest" />
+		<xsl:if test="@id=$idreference and $enabletest='true'">
+		<tr>
+			<td> TBD<!--extract value of Vuln-ID (stored as reference or note or ident) when mapping is available --></td>
+			<td> TBD<!--extract value of GEN-ID (stored as reference or note or ident) when mapping is available --></td>
+			<td> <xsl:value-of select="cdf:title" /></td>
+			<!-- call template to grab text and also child nodes (which should all be xhtml)  -->
+			<td> <xsl:apply-templates select="cdf:rationale"/> </td>
+			<td> <xsl:apply-templates select="cdf:description"/> </td>
+			<!-- need to resolve <sub idref=""> here  -->
+			<!-- <td> TODO: print refine-value from profile associated with rule  </td> -->
+			<td> 
+			<xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+            	<xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+				<xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)"  />
+				<xsl:value-of select="$cci_expanded"/>
+				<br/>
+			</xsl:for-each>
+			</td> 
+		</tr>
+		</xsl:if>
+	</xsl:template>
+
+
+	<xsl:template match="cdf:check">
+		<xsl:for-each select="cdf:check-export">
+			<xsl:variable name="rulevar" select="@value-id" />
+				<!--<xsl:value-of select="$rulevar" />:-->
+				<xsl:for-each select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:refine-value">
+					<xsl:if test="@idref=$rulevar">
+						<xsl:value-of select="@selector" />
+					</xsl:if>
+				</xsl:for-each>
+		</xsl:for-each>
+	</xsl:template>
+
+
+    <!-- getting rid of XHTML namespace -->
+	<xsl:template match="xhtml:*">
+		<xsl:element name="{local-name()}">
+			<xsl:apply-templates select="node()|@*"/>
+		</xsl:element>
+	</xsl:template>
+
+    <xsl:template match="@*|node()">
+		<xsl:copy>
+			<xsl:apply-templates select="@*|node()"/>
+		</xsl:copy>
+	</xsl:template>
+
+    <xsl:template match="cdf:description">
+        <!-- print all the text and children (xhtml elements) of the description -->
+        <xsl:apply-templates select="@*|node()" />
+    </xsl:template>
+
+    <xsl:template match="cdf:rationale">
+        <!-- print all the text and children (xhtml elements) of the description -->
+        <xsl:apply-templates select="@*|node()" />
+    </xsl:template>
+
+</xsl:stylesheet>
-- 
1.7.1



More information about the scap-security-guide mailing list