[PATCH 3/3] support for handling new <ocil> tags for manual check info * also, support for displaying this manual check information in tables * definitions of new macros to make developing easier
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu Sep 6 21:14:09 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/transforms/constants.xslt | 1 +
RHEL6/transforms/relabelids.py | 6 ++-
RHEL6/transforms/shorthand2xccdf.xslt | 38 +++++++++++++++++++++-
RHEL6/transforms/xccdf2table-profileccirefs.xslt | 7 ++++
4 files changed, 49 insertions(+), 3 deletions(-)
diff --git a/RHEL6/transforms/constants.xslt b/RHEL6/transforms/constants.xslt
index a3b26b7..29ce690 100644
--- a/RHEL6/transforms/constants.xslt
+++ b/RHEL6/transforms/constants.xslt
@@ -13,4 +13,5 @@
<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
<xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
+<xsl:variable name="ociluri">http://www.mitre.org/ocil/2</xsl:variable>
</xsl:stylesheet>
diff --git a/RHEL6/transforms/relabelids.py b/RHEL6/transforms/relabelids.py
index 2ebea6e..966696c 100755
--- a/RHEL6/transforms/relabelids.py
+++ b/RHEL6/transforms/relabelids.py
@@ -28,8 +28,8 @@ def get_ovalfiles(checks):
if check.get("system") == oval_ns:
checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns)
ovalfiles.add(checkcontentref.get("href"))
- else:
- print "Non-OVAL checking system found: " + check.get("system")
+# else:
+# print "Non-OVAL checking system found: " + check.get("system")
return ovalfiles
@@ -64,6 +64,8 @@ def main():
# rename all IDs and file refs in the xccdf file
for check in checks:
checkcontentref = check.find("./{%s}check-content-ref" % xccdf_ns)
+ if checkcontentref is None:
+ continue
checkid = translator.assign_id("definition", checkcontentref.get("name"))
checkcontentref.set("name", checkid)
checkcontentref.set("href", newovalfile)
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index 9d0c083..200fb37 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -42,7 +42,9 @@ exclude-result-prefixes="xccdf xhtml">
<xsl:apply-templates select="description"/>
<xsl:apply-templates select="warning"/>
<xsl:apply-templates select="ref"/>
- <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref)]"/>
+ <xsl:apply-templates select="rationale"/>
+ <xsl:apply-templates select="ident"/>
+ <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::rationale|self::ident)]"/>
</xsl:copy>
</xsl:template>
@@ -163,6 +165,20 @@ exclude-result-prefixes="xccdf xhtml">
</check>
</xsl:template>
+
+ <!-- expand reference to OCIL (inline) -->
+ <xsl:template match="Rule/ocil">
+ <check>
+ <xsl:attribute name="system">
+ <xsl:value-of select="$ociluri" />
+ </xsl:attribute>
+ <check-content>
+ <xsl:apply-templates select="node()"/>
+ </check-content>
+ </check>
+ </xsl:template>
+
+
<xsl:template match="@*|node()">
<xsl:copy>
<xsl:apply-templates select="@*|node()" />
@@ -189,6 +205,26 @@ exclude-result-prefixes="xccdf xhtml">
<xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
</xsl:template>
+ <xsl:template match="partition-check-macro">
+ Run the following command to verify that <xhtml:code><xsl:value-of select="@part"/></xhtml:code> lives on its own partition:
+ <xhtml:pre># df -h <xsl:value-of select="@part"/> | grep "<xsl:value-of select="@part"/>"</xhtml:pre>
+ It will return a line for "<xsl:value-of select="@part"/>" if it is on its own partition.
+ </xsl:template>
+
+ <xsl:template match="service-disable-check-macro">
+ Run the following command to determine the current status of the
+<xhtml:code><xsl:value-of select="@service"/></xhtml:code> service:
+ <xhtml:pre># service <xsl:value-of select="@service"/> status</xhtml:pre>
+ If the service is disabled, it should return: <xhtml:pre><xsl:value-of select="@service"/> is stopped</xhtml:pre>
+ </xsl:template>
+
+ <xsl:template match="service-enable-check-macro">
+ Run the following command to determine the current status of the
+<xhtml:code><xsl:value-of select="@service"/></xhtml:code> service:
+ <xhtml:pre># service <xsl:value-of select="@service"/> status</xhtml:pre>
+ If the service is enabled, it should return: <xhtml:pre><xsl:value-of select="@service"/> is running...</xhtml:pre>
+ </xsl:template>
+
<!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
<!-- (expanding xhtml tags back into the xhtml namespace) -->
<xsl:template match="br">
diff --git a/RHEL6/transforms/xccdf2table-profileccirefs.xslt b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
index 0c0eb1e..f5d22c1 100644
--- a/RHEL6/transforms/xccdf2table-profileccirefs.xslt
+++ b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
@@ -50,6 +50,7 @@
<td>Title</td>
<td>Discussion (Rationale)</td>
<td>Fix Text (Description)</td>
+ <td>Check Text (OCIL Check)</td>
<!-- <td>Variable Setting</td> -->
<td>CCI Ref<br/>(800-53 Origin)</td>
</thead>
@@ -118,6 +119,7 @@
<!-- call template to grab text and also child nodes (which should all be xhtml) -->
<td> <xsl:apply-templates select="cdf:rationale"/> </td>
<td> <xsl:apply-templates select="cdf:description"/> </td>
+ <td> <xsl:apply-templates select="cdf:check" /> </td>
<!-- need to resolve <sub idref=""> here -->
<!-- <td> TODO: print refine-value from profile associated with rule </td> -->
<td>
@@ -145,6 +147,10 @@
<xsl:template match="cdf:check">
+ <xsl:if test="@system=$ociluri">
+ <xsl:apply-templates select="cdf:check-content" />
+ </xsl:if>
+ <xsl:if test="@system=$ovaluri">
<xsl:for-each select="cdf:check-export">
<xsl:variable name="rulevar" select="@value-id" />
<!--<xsl:value-of select="$rulevar" />:-->
@@ -154,6 +160,7 @@
</xsl:if>
</xsl:for-each>
</xsl:for-each>
+ </xsl:if>
</xsl:template>
--
1.7.1
More information about the scap-security-guide
mailing list