[PATCH 0/4] removal of CCE information from OVAL templates

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 4 17:31:22 UTC 2012


This is being done in favor of storing CCE identifiers only in the
XCCDF Rules as idents (which made sense for a number of reasons).

Yes, these templates/scripts feel so very much like an undergraduate (or
possibly high-school) programming project.  But consider the superficiality of
their operation as a benefit.

If I were starting over, I might have instead created a small dictionary of
macros in XSLT to take care of generating the significant
non-information-bearing OVAL overhead instead.  This would allow for authors to
create extremely simple XML files to express the necessary information, and
also avoid the creation of any kind of parser.  Maybe for RHEL 7...


Jeffrey Blank (4):
  new helper scripts for making/verifying/installing templated files
  removed CCE handling from scripts that create templated OVAL checks
  removed CCE identifiers from template source-info files
  removal of CCE info from templates for kernelmods, packages, perms,
    services, sysctls

 RHEL6/input/checks/templates/Makefile              |   30 ++++++
 RHEL6/input/checks/templates/README                |   32 +++++-
 .../templates/create_kernel_modules_disabled.py    |   15 ++--
 .../checks/templates/create_package_installed.py   |   11 +--
 .../checks/templates/create_package_removed.py     |   10 +--
 .../checks/templates/create_permission_checks.py   |    9 +-
 .../checks/templates/create_services_disabled.py   |    6 +-
 .../checks/templates/create_services_enabled.py    |    6 +-
 .../input/checks/templates/create_sysctl_checks.py |    5 +-
 .../checks/templates/file_dir_permissions.csv      |    7 +-
 RHEL6/input/checks/templates/find_untemplated.py   |   31 ++++++
 .../checks/templates/kernel_modules_disabled.csv   |   24 ++--
 .../input/checks/templates/packages_installed.csv  |   34 ++++---
 RHEL6/input/checks/templates/packages_removed.csv  |  106 ++++++++++----------
 RHEL6/input/checks/templates/services_disabled.csv |  103 ++++++++++----------
 RHEL6/input/checks/templates/services_enabled.csv  |   24 ++--
 RHEL6/input/checks/templates/sysctl_values.csv     |   36 +++----
 .../templates/template_kernel_module_disabled      |    2 -
 .../checks/templates/template_package_installed    |    1 -
 .../checks/templates/template_package_removed      |    1 -
 RHEL6/input/checks/templates/template_permissions  |    1 -
 .../checks/templates/template_service_disabled     |    1 -
 .../checks/templates/template_service_enabled      |    1 -
 RHEL6/input/checks/templates/template_sysctl       |    1 -
 24 files changed, 281 insertions(+), 216 deletions(-)
 create mode 100644 RHEL6/input/checks/templates/Makefile
 create mode 100755 RHEL6/input/checks/templates/find_untemplated.py



More information about the scap-security-guide mailing list