[PATCH 3/3] support for handling new <ocil> tags for manual check info * also, support for displaying this manual check information in tables * definitions of new macros to make developing easier

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Sep 6 21:14:09 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/transforms/constants.xslt                  |    1 +
 RHEL6/transforms/relabelids.py                   |    6 ++-
 RHEL6/transforms/shorthand2xccdf.xslt            |   38 +++++++++++++++++++++-
 RHEL6/transforms/xccdf2table-profileccirefs.xslt |    7 ++++
 4 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/RHEL6/transforms/constants.xslt b/RHEL6/transforms/constants.xslt
index a3b26b7..29ce690 100644
--- a/RHEL6/transforms/constants.xslt
+++ b/RHEL6/transforms/constants.xslt
@@ -13,4 +13,5 @@
 <xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
 
 <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
+<xsl:variable name="ociluri">http://www.mitre.org/ocil/2</xsl:variable>
 </xsl:stylesheet>
diff --git a/RHEL6/transforms/relabelids.py b/RHEL6/transforms/relabelids.py
index 2ebea6e..966696c 100755
--- a/RHEL6/transforms/relabelids.py
+++ b/RHEL6/transforms/relabelids.py
@@ -28,8 +28,8 @@ def get_ovalfiles(checks):
         if check.get("system") == oval_ns:
             checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns)
             ovalfiles.add(checkcontentref.get("href"))
-        else:
-            print "Non-OVAL checking system found: " + check.get("system")
+#        else:
+#            print "Non-OVAL checking system found: " + check.get("system")
     return ovalfiles
 
 
@@ -64,6 +64,8 @@ def main():
     # rename all IDs and file refs in the xccdf file
     for check in checks:
         checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns)
+        if checkcontentref is None:
+            continue
         checkid = translator.assign_id("definition", checkcontentref.get("name"))
         checkcontentref.set("name", checkid)
         checkcontentref.set("href", newovalfile)
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index 9d0c083..200fb37 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -42,7 +42,9 @@ exclude-result-prefixes="xccdf xhtml">
       <xsl:apply-templates select="description"/>
       <xsl:apply-templates select="warning"/> 
       <xsl:apply-templates select="ref"/> 
-      <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref)]"/>
+      <xsl:apply-templates select="rationale"/> 
+      <xsl:apply-templates select="ident"/> 
+      <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::rationale|self::ident)]"/>
     </xsl:copy>
   </xsl:template> 
 
@@ -163,6 +165,20 @@ exclude-result-prefixes="xccdf xhtml">
     </check>
   </xsl:template>
 
+
+  <!-- expand reference to OCIL (inline) -->
+  <xsl:template match="Rule/ocil">
+      <check>
+        <xsl:attribute name="system">
+            <xsl:value-of select="$ociluri" />
+        </xsl:attribute>
+        <check-content>
+        <xsl:apply-templates select="node()"/>
+        </check-content>
+      </check>
+   </xsl:template>
+
+
   <xsl:template match="@*|node()">
     <xsl:copy>
       <xsl:apply-templates select="@*|node()" />
@@ -189,6 +205,26 @@ exclude-result-prefixes="xccdf xhtml">
     <xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
   </xsl:template>
 
+  <xsl:template match="partition-check-macro">
+    Run the following command to verify that <xhtml:code><xsl:value-of select="@part"/></xhtml:code> lives on its own partition:
+  <xhtml:pre># df -h <xsl:value-of select="@part"/> | grep "<xsl:value-of select="@part"/>"</xhtml:pre>
+    It will return a line for "<xsl:value-of select="@part"/>" if it is on its own partition. 
+  </xsl:template>
+
+  <xsl:template match="service-disable-check-macro">
+    Run the following command to determine the current status of the
+<xhtml:code><xsl:value-of select="@service"/></xhtml:code> service:
+  <xhtml:pre># service <xsl:value-of select="@service"/> status</xhtml:pre>
+    If the service is disabled, it should return: <xhtml:pre><xsl:value-of select="@service"/> is stopped</xhtml:pre>
+  </xsl:template>
+
+  <xsl:template match="service-enable-check-macro">
+    Run the following command to determine the current status of the
+<xhtml:code><xsl:value-of select="@service"/></xhtml:code> service:
+  <xhtml:pre># service <xsl:value-of select="@service"/> status</xhtml:pre>
+    If the service is enabled, it should return: <xhtml:pre><xsl:value-of select="@service"/> is running...</xhtml:pre>
+  </xsl:template>
+
   <!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
   <!-- (expanding xhtml tags back into the xhtml namespace) -->
   <xsl:template match="br">
diff --git a/RHEL6/transforms/xccdf2table-profileccirefs.xslt b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
index 0c0eb1e..f5d22c1 100644
--- a/RHEL6/transforms/xccdf2table-profileccirefs.xslt
+++ b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
@@ -50,6 +50,7 @@
 				<td>Title</td>
 				<td>Discussion (Rationale)</td>
 				<td>Fix Text (Description)</td>
+				<td>Check Text (OCIL Check)</td>
 				<!-- <td>Variable Setting</td> -->
 				<td>CCI Ref<br/>(800-53 Origin)</td>
 			</thead>
@@ -118,6 +119,7 @@
 			<!-- call template to grab text and also child nodes (which should all be xhtml)  -->
 			<td> <xsl:apply-templates select="cdf:rationale"/> </td>
 			<td> <xsl:apply-templates select="cdf:description"/> </td>
+			<td> <xsl:apply-templates select="cdf:check" /> </td>
 			<!-- need to resolve <sub idref=""> here  -->
 			<!-- <td> TODO: print refine-value from profile associated with rule  </td> -->
 			<td> 
@@ -145,6 +147,10 @@
 
 
 	<xsl:template match="cdf:check">
+	    <xsl:if test="@system=$ociluri">
+			<xsl:apply-templates select="cdf:check-content" />
+		</xsl:if>
+	    <xsl:if test="@system=$ovaluri">
 		<xsl:for-each select="cdf:check-export">
 			<xsl:variable name="rulevar" select="@value-id" />
 				<!--<xsl:value-of select="$rulevar" />:-->
@@ -154,6 +160,7 @@
 					</xsl:if>
 				</xsl:for-each>
 		</xsl:for-each>
+		</xsl:if>
 	</xsl:template>
 
 
-- 
1.7.1



More information about the scap-security-guide mailing list