[PATCH] added support for Groups that exist only for some outputs * this is intended to allow documentation of SRG satisfaction, for that table (but not final XCCDF output)

Jeffrey Blank blank at eclipse.ncsc.mil
Sun May 6 18:33:05 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/Makefile                        |    2 +-
 rhel6/src/input/auxiliary/srg_support.xml |   37 +++++++++++++++++++++++++++++
 rhel6/src/input/guide.xslt                |    2 +
 rhel6/src/transforms/xccdf-removeaux.xslt |   22 +++++++++++++++++
 4 files changed, 62 insertions(+), 1 deletions(-)
 create mode 100644 rhel6/src/input/auxiliary/srg_support.xml
 create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt

diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
index 9d75999..0afe594 100644
--- a/rhel6/src/Makefile
+++ b/rhel6/src/Makefile
@@ -112,7 +112,7 @@ eval-ftp:
 eval-common:
 	oscap xccdf eval --profile common --results /tmp/results-test.xml $(OUT)/rhel6-xccdf-scap-security-guide.xml
 
-dist: content guide tables
+dist: tables guide content
 	$(call MKDIR,$(DIST)/guide)
 	$(call MKDIR,$(DIST)/content)
 	$(call MKDIR,$(DIST)/policytables)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
new file mode 100644
index 0000000..de24ea5
--- /dev/null
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -0,0 +1,37 @@
+<Group id="srg_support" hidden="true">
+<title>Documentation to Support DISA OS SRG Mapping</title>
+<description>These groups exist to document how the Red Hat Enterprise Linux
+product meets (or does not meet) requirements listed in the DISA OS SRG, for
+those cases where Groups or Rules elsewhere in scap-security-guide do
+not clearly relate.
+</description>
+
+<Group id="met_inherently" hidden="true">
+<title>Product Meets this Requirement</title>
+<description>
+Red Hat Enterprise Linux meets this requirement by design.
+<!-- We could include discussion of Common Criteria Testing if so 
+     desired here. -->
+</description>
+<ref disa="131" />
+</Group>
+
+<Group id="unmet_impractical_guidance" hidden="true">
+<title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
+<description>
+The guidance does not meet this requirement.
+The requirement is impractical or out of scope.
+</description>
+<ref disa="354,1094" />
+</Group>
+
+<Group id="unmet_impractical_product" hidden="true">
+<title>Product Does Not Meet this Requirement Due to Impracticality or Scope</title>
+<description>
+The product does not meet this requirement.
+The requirement is impractical or out of scope.
+</description>
+<ref disa="" />
+</Group>
+
+</Group>
diff --git a/rhel6/src/input/guide.xslt b/rhel6/src/input/guide.xslt
index bdba280..ee40446 100644
--- a/rhel6/src/input/guide.xslt
+++ b/rhel6/src/input/guide.xslt
@@ -7,6 +7,8 @@
       <xsl:apply-templates select="document('intro/intro.xml')" />
       <xsl:apply-templates select="document('system/system.xml')" />
       <xsl:apply-templates select="document('services/services.xml')" />
+      <!-- the auxiliary Groups here will be removed prior to some outputs -->
+      <xsl:apply-templates select="document('auxiliary/srg_support.xml')" />
     </xsl:copy>
   </xsl:template>
 
diff --git a/rhel6/src/transforms/xccdf-removeaux.xslt b/rhel6/src/transforms/xccdf-removeaux.xslt
new file mode 100644
index 0000000..788969e
--- /dev/null
+++ b/rhel6/src/transforms/xccdf-removeaux.xslt
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
+
+<!-- This transform removes Groups from the XCCDF document.  In general, these
+     are expected to be Groups added from files in the inputs/auxiliary
+     directory.  -->
+
+
+  <!-- remove the srg_support Group from final output, as it exists only to
+       support the OS SRG mapping -->
+  <xsl:template match="xccdf:Group[@id='srg_support']">
+  </xsl:template>
+
+
+  <!-- copy everything else through to final output -->
+  <xsl:template match="@*|node()">
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+    </xsl:copy>
+  </xsl:template>
+
+</xsl:stylesheet>
-- 
1.7.1



More information about the scap-security-guide mailing list