[PATCH 5/8] added Makerules and updated transforms to create STIG-specific content
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Oct 9 15:09:34 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/Makefile | 12 +++++-
RHEL6/transforms/constants.xslt | 1 +
RHEL6/transforms/xccdf-addrefs.xslt | 21 +++++++++
RHEL6/transforms/xccdf2csv-stig.py | 4 --
RHEL6/transforms/xccdf2stigformat.xslt | 73 ++++++++++++++++++++++++--------
5 files changed, 88 insertions(+), 23 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 0bb2238..371d38a 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -102,12 +102,22 @@ content: shorthand-guide shorthand2xccdf guide checks
# not ready until oscap resolve behavior resolved
content-stig: shorthand-guide shorthand2xccdf guide checks
+ xsltproc -stringparam alttitles "../$(IN)/auxiliary/alt-titles-stig.xml" -o $(OUT)/unlinked-rhel6-xccdf.xml \
+ $(TRANS)/xccdf-alt-titles.xslt \
+ $(OUT)/unlinked-rhel6-xccdf.xml
oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml $(OUT)/unlinked-rhel6-xccdf.xml
- xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml $(TRANS)/xccdf2stigformat.xslt $(OUT)/unlinked-resolved-rhel6-xccdf.xml
+ xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \
+ $(TRANS)/xccdf2stigformat.xslt $(OUT)/unlinked-resolved-rhel6-xccdf.xml
+ xsltproc -o $(OUT)/table-rhel6-stig-server-stigformat.html \
+ $(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-rhel6-xccdf.xml
+ xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml $(OUT)/unlinked-stig
$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml disa-predraft
$(TRANS)/relabelids.py unlinked-stig-rhel6-xccdf.xml disa-predraft
xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml $(OUT)/disa-predraft-stig-rhel6-xccdf.xml
+submission-stig: content-stig
+ $(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-rhel6-xccdf.xml > $(OUT)/table-rhel6-stig.csv
+
# content-usgcb: coming soon
validate:
diff --git a/RHEL6/transforms/constants.xslt b/RHEL6/transforms/constants.xslt
index 7289561..afe719b 100644
--- a/RHEL6/transforms/constants.xslt
+++ b/RHEL6/transforms/constants.xslt
@@ -11,6 +11,7 @@
<xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
<xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
+<xsl:variable name="disa-srguri">http://iase.disa.mil/srgs</xsl:variable>
<xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
diff --git a/RHEL6/transforms/xccdf-addrefs.xslt b/RHEL6/transforms/xccdf-addrefs.xslt
index 0388be3..b1d191d 100644
--- a/RHEL6/transforms/xccdf-addrefs.xslt
+++ b/RHEL6/transforms/xccdf-addrefs.xslt
@@ -7,6 +7,8 @@
<xsl:include href="constants.xslt"/>
+<xsl:variable name="os_srg" select="document('../references/disa-os-srg-v1r1.xml')/cdf:Benchmark" />
+
<xsl:template match="cdf:Rule">
<xsl:copy>
<!-- deal with the fact that references must stand after some other nodes -->
@@ -15,6 +17,21 @@
<xsl:apply-templates select="cdf:description"/>
<xsl:apply-templates select="cdf:warning"/>
+
+<!-- if a CCI is found, add corresponding SRG ID -->
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+ <xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)" />
+ <xsl:for-each select="$os_srg/cdf:Group">
+ <xsl:if test="cdf:Rule/cdf:ident=$cci_expanded">
+ <xsl:element name="reference" namespace="http://checklists.nist.gov/xccdf/1.1">
+ <xsl:attribute name="href"><xsl:value-of select="$disa-srguri"/></xsl:attribute>
+ <xsl:value-of select="cdf:title"/>
+ </xsl:element>
+ </xsl:if>
+ </xsl:for-each>
+ </xsl:for-each>
+
<xsl:if test="not(cdf:reference[@href=$disa-cciuri])">
<xsl:variable name="rule_id" select="@id"/>
<!-- this can be uncommented when oscap xccdf resolve passes check-content through -->
@@ -25,6 +42,10 @@
<xsl:attribute name="href"><xsl:value-of select="$disa-cciuri"/></xsl:attribute>
<xsl:text>366</xsl:text>
</xsl:element>
+ <xsl:element name="reference" namespace="http://checklists.nist.gov/xccdf/1.1">
+ <xsl:attribute name="href"><xsl:value-of select="$disa-srguri"/></xsl:attribute>
+ <xsl:text>SRG-OS-000999</xsl:text>
+ </xsl:element>
<!-- </xsl:if>
</xsl:for-each> -->
</xsl:if>
diff --git a/RHEL6/transforms/xccdf2csv-stig.py b/RHEL6/transforms/xccdf2csv-stig.py
index 816b1ad..aece10e 100755
--- a/RHEL6/transforms/xccdf2csv-stig.py
+++ b/RHEL6/transforms/xccdf2csv-stig.py
@@ -33,12 +33,8 @@ def main():
sys.exit(1)
xccdffile = sys.argv[1]
-
- # step over xccdf file, and find referenced check files
xccdftree = parse_xml_file(xccdffile)
-
rules = xccdftree.findall(".//{%s}Rule" % xccdf_ns)
-
rulewriter = csv.writer(sys.stdout, quoting=csv.QUOTE_ALL)
for rule in rules:
diff --git a/RHEL6/transforms/xccdf2stigformat.xslt b/RHEL6/transforms/xccdf2stigformat.xslt
index 23abe7e..057bddc 100644
--- a/RHEL6/transforms/xccdf2stigformat.xslt
+++ b/RHEL6/transforms/xccdf2stigformat.xslt
@@ -1,12 +1,18 @@
<?xml version="1.0"?>
-<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" exclude-result-prefixes="cdf">
-<!-- This transform transforms that project's main XCCDF content
- into the format expected in a DISA STIG. -->
+<!-- This transforms a body of XCCDF content into the format expected in a DISA
+ STIG. It expects an XCCDF file with exactly one Profile.
+ -->
<xsl:include href="constants.xslt"/>
- <xsl:template match="xccdf:Benchmark">
+<xsl:strip-space elements="*" />
+<xsl:output method="xml" indent="yes" />
+
+<xsl:param name="profile" select="''" />
+
+ <xsl:template match="cdf:Benchmark">
<Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns="http://checklists.nist.gov/xccdf/1.1" id="RHEL_6_STIG" xml:lang="en"
xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
@@ -14,24 +20,23 @@ xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/sch
<title>Pre-Draft Red Hat Enterprise Linux 6 Security Technical Implementation Guide</title>
<description>The Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: fso_spt at disa.mil.</description>
<notice id="terms-of-use" xml:lang="en" />
- <!-- this is here as a placeholder, prior to any publication. this is PRE-DRAFT, NON-RELEASE material. -->
<reference href="http://iase.disa.mil">
+ <!-- this is here as a placeholder, prior to any publication. this is PRE-DRAFT, NON-RELEASE material. -->
<dc:publisher>DISA, Field Security Operations</dc:publisher>
<dc:source>iase.disa.mil</dc:source>
</reference>
<version>0.7</version>
<!-- retain desired Profile -->
- <xsl:apply-templates select="xccdf:Profile" />
+ <xsl:apply-templates select="cdf:Profile" />
<!-- retain all Values -->
- <xsl:apply-templates select=".//xccdf:Value" />
- <!-- retain Rules only from the selected Profile -->
- <xsl:apply-templates select=".//xccdf:Rule" />
+ <xsl:apply-templates select=".//cdf:Value" />
+ <!-- retain all Values -->
+ <xsl:apply-templates select="//cdf:Rule" />
</Benchmark>
</xsl:template>
-
- <xsl:template match="xccdf:Profile">
+ <xsl:template match="cdf:Profile">
<xsl:if test="@id=$profile">
<xsl:copy>
<xsl:apply-templates select="@*|node()"/>
@@ -39,21 +44,53 @@ xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/sch
</xsl:if>
</xsl:template>
-
- <xsl:template match="xccdf:Value">
+ <xsl:template match="cdf:Value">
<xsl:copy>
<xsl:apply-templates select="@*|node()"/>
</xsl:copy>
</xsl:template>
- <xsl:template match="xccdf:Rule">
+ <xsl:template match="cdf:Rule">
+ <xsl:variable name="ruleid" select="@id"/>
+ <!-- process Rule only if it's in the selected Profile -->
+ <xsl:if test="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:select[@idref=$ruleid]">
+
<Group>
- <xsl:attribute name="id">groupid</xsl:attribute>
- <xsl:copy>
- <xsl:apply-templates select="@*|node()"/>
- </xsl:copy>
+ <xsl:attribute name="id">V-<xsl:value-of select="position()"/></xsl:attribute>
+ <title>GEN<xsl:value-of select="format-number(position(),'000000')"/></title>
+ <description>GroupDescription</description>
+ <!-- if desire exists to change id to format "SV-{position()}r0_rule", must also do so in Profile -->
+ <Rule id="{@id}" severity="{@severity}" weight="10.0">
+ <version>GroupTitle</version>
+ <title><xsl:value-of select="cdf:title"/></title>
+ <description>
+ <xsl:apply-templates select="cdf:rationale/node()"/>
+ </description>
+ <reference>
+ <dc:title>VMS Target Red Hat 6</dc:title>
+ <dc:publisher>DISA FSO</dc:publisher>
+ <dc:type>VMS Target</dc:type>
+ <dc:subject>Red Hat 6</dc:subject>
+ <dc:identifier>2400</dc:identifier>
+ </reference>
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <ident system="{$disa-cciuri}">CCI-<xsl:value-of select="format-number(text(),'000000')"/></ident>
+ </xsl:for-each>
+ <xsl:for-each select="cdf:reference[@href=$disa-srguri]">
+ <ident system="{$disa-srguri}"><xsl:value-of select="text()"/></ident>
+ </xsl:for-each>
+ <fixtext fixref="{@id}_fix">
+ <xsl:apply-templates select="cdf:description/node()"/>
+ </fixtext>
+ <check system="{concat('C-',position(),'_chk')}">
+ <check-content>
+ <xsl:value-of select="cdf:check[@system='ocil-transitional']/cdf:check-content"/>
+ </check-content>
+ </check>
+ </Rule>
</Group>
+ </xsl:if>
</xsl:template>
--
1.7.1
More information about the scap-security-guide
mailing list