[PATCH] added support for Groups that exist only for some outputs * this is intended to allow documentation of SRG satisfaction, for that table (but not final XCCDF output)

Shawn Wells shawn at redhat.com
Mon May 7 14:04:24 UTC 2012


On 5/6/12 2:33 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   rhel6/src/Makefile                        |    2 +-
>   rhel6/src/input/auxiliary/srg_support.xml |   37 +++++++++++++++++++++++++++++
>   rhel6/src/input/guide.xslt                |    2 +
>   rhel6/src/transforms/xccdf-removeaux.xslt |   22 +++++++++++++++++
>   4 files changed, 62 insertions(+), 1 deletions(-)
>   create mode 100644 rhel6/src/input/auxiliary/srg_support.xml
>   create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt
>
> diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
> index 9d75999..0afe594 100644
> --- a/rhel6/src/Makefile
> +++ b/rhel6/src/Makefile
> @@ -112,7 +112,7 @@ eval-ftp:
>   eval-common:
>   	oscap xccdf eval --profile common --results /tmp/results-test.xml $(OUT)/rhel6-xccdf-scap-security-guide.xml
>
> -dist: content guide tables
> +dist: tables guide content
>   	$(call MKDIR,$(DIST)/guide)
>   	$(call MKDIR,$(DIST)/content)
>   	$(call MKDIR,$(DIST)/policytables)
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> new file mode 100644
> index 0000000..de24ea5
> --- /dev/null
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -0,0 +1,37 @@
> +<Group id="srg_support" hidden="true">
> +<title>Documentation to Support DISA OS SRG Mapping</title>
> +<description>These groups exist to document how the Red Hat Enterprise Linux
> +product meets (or does not meet) requirements listed in the DISA OS SRG, for
> +those cases where Groups or Rules elsewhere in scap-security-guide do
> +not clearly relate.
> +</description>
> +
> +<Group id="met_inherently" hidden="true">
> +<title>Product Meets this Requirement</title>
> +<description>
> +Red Hat Enterprise Linux meets this requirement by design.
> +<!-- We could include discussion of Common Criteria Testing if so
> +     desired here. -->
> +</description>
> +<ref disa="131" />
> +</Group>
> +
> +<Group id="unmet_impractical_guidance" hidden="true">
> +<title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
> +<description>
> +The guidance does not meet this requirement.
> +The requirement is impractical or out of scope.
> +</description>
> +<ref disa="354,1094" />
> +</Group>
> +
> +<Group id="unmet_impractical_product" hidden="true">
> +<title>Product Does Not Meet this Requirement Due to Impracticality or Scope</title>
> +<description>
> +The product does not meet this requirement.
> +The requirement is impractical or out of scope.
> +</description>
> +<ref disa="" />
> +</Group>
> +
> +</Group>
> diff --git a/rhel6/src/input/guide.xslt b/rhel6/src/input/guide.xslt
> index bdba280..ee40446 100644
> --- a/rhel6/src/input/guide.xslt
> +++ b/rhel6/src/input/guide.xslt
> @@ -7,6 +7,8 @@
>         <xsl:apply-templates select="document('intro/intro.xml')" />
>         <xsl:apply-templates select="document('system/system.xml')" />
>         <xsl:apply-templates select="document('services/services.xml')" />
> +<!-- the auxiliary Groups here will be removed prior to some outputs -->
> +<xsl:apply-templates select="document('auxiliary/srg_support.xml')" />
>       </xsl:copy>
>     </xsl:template>
>
> diff --git a/rhel6/src/transforms/xccdf-removeaux.xslt b/rhel6/src/transforms/xccdf-removeaux.xslt
> new file mode 100644
> index 0000000..788969e
> --- /dev/null
> +++ b/rhel6/src/transforms/xccdf-removeaux.xslt
> @@ -0,0 +1,22 @@
> +<?xml version="1.0"?>
> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
> +
> +<!-- This transform removes Groups from the XCCDF document.  In general, these
> +     are expected to be Groups added from files in the inputs/auxiliary
> +     directory.  -->
> +
> +
> +<!-- remove the srg_support Group from final output, as it exists only to
> +       support the OS SRG mapping -->
> +<xsl:template match="xccdf:Group[@id='srg_support']">
> +</xsl:template>
> +
> +
> +<!-- copy everything else through to final output -->
> +<xsl:template match="@*|node()">
> +<xsl:copy>
> +<xsl:apply-templates select="@*|node()" />
> +</xsl:copy>
> +</xsl:template>
> +
> +</xsl:stylesheet>

Ack, but FYI:

[shawn at rhel6 scap-security-guide]$ git apply /tmp/scappatches/jeffaux.patch
/tmp/scappatches/jeffaux.patch:42: trailing whitespace.
<!-- We could include discussion of Common Criteria Testing if so
warning: 1 line adds whitespace errors.





More information about the scap-security-guide mailing list