[PATCH 5/8] added Makerules and updated transforms to create STIG-specific content

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Oct 9 15:09:34 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/Makefile                         |   12 +++++-
 RHEL6/transforms/constants.xslt        |    1 +
 RHEL6/transforms/xccdf-addrefs.xslt    |   21 +++++++++
 RHEL6/transforms/xccdf2csv-stig.py     |    4 --
 RHEL6/transforms/xccdf2stigformat.xslt |   73 ++++++++++++++++++++++++--------
 5 files changed, 88 insertions(+), 23 deletions(-)

diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 0bb2238..371d38a 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -102,12 +102,22 @@ content: shorthand-guide shorthand2xccdf guide checks
 
 # not ready until oscap resolve behavior resolved
 content-stig: shorthand-guide shorthand2xccdf guide checks
+	xsltproc -stringparam alttitles "../$(IN)/auxiliary/alt-titles-stig.xml" -o $(OUT)/unlinked-rhel6-xccdf.xml \
+		$(TRANS)/xccdf-alt-titles.xslt \
+		$(OUT)/unlinked-rhel6-xccdf.xml
 	oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml $(OUT)/unlinked-rhel6-xccdf.xml
-	xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml $(TRANS)/xccdf2stigformat.xslt $(OUT)/unlinked-resolved-rhel6-xccdf.xml 
+	xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-stig-rhel6-xccdf.xml \
+		$(TRANS)/xccdf2stigformat.xslt $(OUT)/unlinked-resolved-rhel6-xccdf.xml 
+	xsltproc -o $(OUT)/table-rhel6-stig-server-stigformat.html \
+		$(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-rhel6-xccdf.xml
+	xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml $(OUT)/unlinked-stig
 	$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml disa-predraft
 	$(TRANS)/relabelids.py unlinked-stig-rhel6-xccdf.xml disa-predraft
 	xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml $(OUT)/disa-predraft-stig-rhel6-xccdf.xml
 
+submission-stig: content-stig
+	$(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-rhel6-xccdf.xml > $(OUT)/table-rhel6-stig.csv
+
 # content-usgcb: coming soon
 
 validate:
diff --git a/RHEL6/transforms/constants.xslt b/RHEL6/transforms/constants.xslt
index 7289561..afe719b 100644
--- a/RHEL6/transforms/constants.xslt
+++ b/RHEL6/transforms/constants.xslt
@@ -11,6 +11,7 @@
 <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
 <xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
 <xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
+<xsl:variable name="disa-srguri">http://iase.disa.mil/srgs</xsl:variable>
 
 <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
 
diff --git a/RHEL6/transforms/xccdf-addrefs.xslt b/RHEL6/transforms/xccdf-addrefs.xslt
index 0388be3..b1d191d 100644
--- a/RHEL6/transforms/xccdf-addrefs.xslt
+++ b/RHEL6/transforms/xccdf-addrefs.xslt
@@ -7,6 +7,8 @@
 
 <xsl:include href="constants.xslt"/>
 
+<xsl:variable name="os_srg" select="document('../references/disa-os-srg-v1r1.xml')/cdf:Benchmark" />
+
   <xsl:template match="cdf:Rule">
 	<xsl:copy>
 	<!-- deal with the fact that references must stand after some other nodes -->
@@ -15,6 +17,21 @@
 	<xsl:apply-templates select="cdf:description"/>
 	<xsl:apply-templates select="cdf:warning"/>
 
+
+<!-- if a CCI is found, add corresponding SRG ID -->
+	<xsl:for-each select="cdf:reference[@href=$disa-cciuri]"> 
+		<xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+		<xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)"  />
+			<xsl:for-each select="$os_srg/cdf:Group">
+				<xsl:if test="cdf:Rule/cdf:ident=$cci_expanded">
+					<xsl:element name="reference" namespace="http://checklists.nist.gov/xccdf/1.1">
+					<xsl:attribute name="href"><xsl:value-of select="$disa-srguri"/></xsl:attribute>
+		          	<xsl:value-of select="cdf:title"/>
+					</xsl:element>
+				</xsl:if>
+			</xsl:for-each>
+	</xsl:for-each> 
+
 	<xsl:if test="not(cdf:reference[@href=$disa-cciuri])"> 
 		<xsl:variable name="rule_id" select="@id"/>
 <!-- this can be uncommented when oscap xccdf resolve passes check-content through -->
@@ -25,6 +42,10 @@
 		          <xsl:attribute name="href"><xsl:value-of select="$disa-cciuri"/></xsl:attribute>
 		          <xsl:text>366</xsl:text>
 	          </xsl:element>
+	          <xsl:element name="reference" namespace="http://checklists.nist.gov/xccdf/1.1">
+		          <xsl:attribute name="href"><xsl:value-of select="$disa-srguri"/></xsl:attribute>
+		          <xsl:text>SRG-OS-000999</xsl:text>
+	          </xsl:element>
 <!--			</xsl:if>
 		</xsl:for-each> -->
 	</xsl:if> 
diff --git a/RHEL6/transforms/xccdf2csv-stig.py b/RHEL6/transforms/xccdf2csv-stig.py
index 816b1ad..aece10e 100755
--- a/RHEL6/transforms/xccdf2csv-stig.py
+++ b/RHEL6/transforms/xccdf2csv-stig.py
@@ -33,12 +33,8 @@ def main():
 		sys.exit(1)
 
 	xccdffile = sys.argv[1]
-
-	# step over xccdf file, and find referenced check files
 	xccdftree = parse_xml_file(xccdffile)
-
 	rules = xccdftree.findall(".//{%s}Rule" % xccdf_ns)
-
 	rulewriter = csv.writer(sys.stdout, quoting=csv.QUOTE_ALL)
 
 	for rule in rules:
diff --git a/RHEL6/transforms/xccdf2stigformat.xslt b/RHEL6/transforms/xccdf2stigformat.xslt
index 23abe7e..057bddc 100644
--- a/RHEL6/transforms/xccdf2stigformat.xslt
+++ b/RHEL6/transforms/xccdf2stigformat.xslt
@@ -1,12 +1,18 @@
 <?xml version="1.0"?>
-<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" exclude-result-prefixes="cdf">
 
-<!-- This transform transforms that project's main XCCDF content 
-     into the format expected in a DISA STIG. -->
+<!-- This transforms a body of XCCDF content into the format expected in a DISA
+     STIG. It expects an XCCDF file with exactly one Profile.
+     -->
 
 <xsl:include href="constants.xslt"/>
 
-  <xsl:template match="xccdf:Benchmark">
+<xsl:strip-space elements="*" />
+<xsl:output method="xml" indent="yes" />
+
+<xsl:param name="profile" select="''" />
+
+  <xsl:template match="cdf:Benchmark">
 	<Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/"
 xmlns="http://checklists.nist.gov/xccdf/1.1" id="RHEL_6_STIG" xml:lang="en"
 xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
@@ -14,24 +20,23 @@ xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/sch
 	<title>Pre-Draft Red Hat Enterprise Linux 6 Security Technical Implementation Guide</title>
 	<description>The Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: fso_spt at disa.mil.</description>
 	<notice id="terms-of-use" xml:lang="en" />
-	<!-- this is here as a placeholder, prior to any publication.  this is PRE-DRAFT, NON-RELEASE material. -->
 	<reference href="http://iase.disa.mil">
+	<!-- this is here as a placeholder, prior to any publication.  this is PRE-DRAFT, NON-RELEASE material. -->
          <dc:publisher>DISA, Field Security Operations</dc:publisher>
          <dc:source>iase.disa.mil</dc:source>
 	</reference>
 	<version>0.7</version>
 
 	<!-- retain desired Profile -->
-	<xsl:apply-templates select="xccdf:Profile" />
+	<xsl:apply-templates select="cdf:Profile" />
 	<!-- retain all Values -->
-	<xsl:apply-templates select=".//xccdf:Value" />
-	<!-- retain Rules only from the selected Profile -->
-	<xsl:apply-templates select=".//xccdf:Rule" />
+	<xsl:apply-templates select=".//cdf:Value" />
+	<!-- retain all Values -->
+	<xsl:apply-templates select="//cdf:Rule" />
 	</Benchmark>
   </xsl:template>
 
-
-  <xsl:template match="xccdf:Profile">
+  <xsl:template match="cdf:Profile">
   	<xsl:if test="@id=$profile">
 		<xsl:copy>
 			<xsl:apply-templates select="@*|node()"/>
@@ -39,21 +44,53 @@ xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/sch
 	</xsl:if>
   </xsl:template>
 
-
-  <xsl:template match="xccdf:Value">
+  <xsl:template match="cdf:Value">
 	<xsl:copy>
 		<xsl:apply-templates select="@*|node()"/>
 	</xsl:copy>
   </xsl:template>
 
 
-  <xsl:template match="xccdf:Rule">
+  <xsl:template match="cdf:Rule">
+	<xsl:variable name="ruleid" select="@id"/>
+	<!-- process Rule only if it's in the selected Profile -->
+	<xsl:if test="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:select[@idref=$ruleid]">
+
     <Group>
-    <xsl:attribute name="id">groupid</xsl:attribute>
-    <xsl:copy>
-      <xsl:apply-templates select="@*|node()"/>
-    </xsl:copy>
+    <xsl:attribute name="id">V-<xsl:value-of select="position()"/></xsl:attribute>
+    <title>GEN<xsl:value-of select="format-number(position(),'000000')"/></title>
+    <description>GroupDescription</description>
+	<!-- if desire exists to change id to format "SV-{position()}r0_rule", must also do so in Profile -->
+    <Rule id="{@id}" severity="{@severity}" weight="10.0">
+    	<version>GroupTitle</version>
+		<title><xsl:value-of select="cdf:title"/></title>
+		<description>
+			<xsl:apply-templates select="cdf:rationale/node()"/>
+		</description>
+		<reference>
+			<dc:title>VMS Target Red Hat 6</dc:title>
+			<dc:publisher>DISA FSO</dc:publisher>
+			<dc:type>VMS Target</dc:type>
+			<dc:subject>Red Hat 6</dc:subject>
+			<dc:identifier>2400</dc:identifier>
+		</reference>
+		<xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+			<ident system="{$disa-cciuri}">CCI-<xsl:value-of select="format-number(text(),'000000')"/></ident>
+		</xsl:for-each>
+		<xsl:for-each select="cdf:reference[@href=$disa-srguri]">
+			<ident system="{$disa-srguri}"><xsl:value-of select="text()"/></ident>
+		</xsl:for-each>
+		<fixtext fixref="{@id}_fix">
+			<xsl:apply-templates select="cdf:description/node()"/>
+		</fixtext>
+		<check system="{concat('C-',position(),'_chk')}">
+			<check-content>
+				<xsl:value-of select="cdf:check[@system='ocil-transitional']/cdf:check-content"/>
+			</check-content>
+		</check>
+    </Rule>
     </Group>
+    </xsl:if>
   </xsl:template>
 
 
-- 
1.7.1



More information about the scap-security-guide mailing list