[PATCH 1/2] changes to support "transitional" OCIL content (which is what we're calling our manual check text)
Michael J. McConachie
michael at redhat.com
Fri Sep 14 19:38:31 UTC 2012
Jeff -- Please retract my last ACK.
I skimmed this for content the first time around, and never actually
applied the patch itself (doooh!) Just did, and it had errors.
JSYN -- Patch 2 applied cleanly.
When running a make clean; make eval-common on your recent branch, it
errors out.
Will look into it some more.
MM
On 09/13/2012 03:54 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
> RHEL6/Makefile | 2 +-
> RHEL6/transforms/constants.xslt | 1 +
> RHEL6/transforms/shorthand2xccdf.xslt | 33 ++++++++++++++++++----
> RHEL6/transforms/xccdf2table-profileccirefs.xslt | 2 +-
> 4 files changed, 30 insertions(+), 8 deletions(-)
>
> diff --git a/RHEL6/Makefile b/RHEL6/Makefile
> index 8049db1..27464bd 100644
> --- a/RHEL6/Makefile
> +++ b/RHEL6/Makefile
> @@ -95,7 +95,7 @@ eval-ftp:
> oscap xccdf eval --profile ftp $(OUT)/rhel6-xccdf-$(ID).xml
>
> eval-common:
> - oscap xccdf eval --profile common --results /tmp/results-test.xml $(OUT)/rhel6-xccdf-$(ID).xml
> + oscap xccdf eval --profile common --oval-results --results /tmp/results-test.xml $(OUT)/rhel6-xccdf-$(ID).xml
>
> # items in dist are expected for distribution in an rpm
> dist: tables guide content
> diff --git a/RHEL6/transforms/constants.xslt b/RHEL6/transforms/constants.xslt
> index 29ce690..3159cc9 100644
> --- a/RHEL6/transforms/constants.xslt
> +++ b/RHEL6/transforms/constants.xslt
> @@ -14,4 +14,5 @@
>
> <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
> <xsl:variable name="ociluri">http://www.mitre.org/ocil/2</xsl:variable>
> +<xsl:variable name="ociltransitional">ocil-transitional</xsl:variable>
> </xsl:stylesheet>
> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
> index 200fb37..d899f48 100644
> --- a/RHEL6/transforms/shorthand2xccdf.xslt
> +++ b/RHEL6/transforms/shorthand2xccdf.xslt
> @@ -166,12 +166,18 @@ exclude-result-prefixes="xccdf xhtml">
> </xsl:template>
>
>
> - <!-- expand reference to OCIL (inline) -->
> + <!-- expand reference to would-be OCIL (inline) -->
> <xsl:template match="Rule/ocil">
> <check>
> - <xsl:attribute name="system">
> - <xsl:value-of select="$ociluri" />
> - </xsl:attribute>
> + <xsl:attribute name="system">ocil-transitional</xsl:attribute>
> + <xsl:if test="@clause">
> + <check-export>
> + <xsl:attribute name="export-name">clause</xsl:attribute>
> + <xsl:attribute name="value-id">
> + <xsl:value-of select="@clause" />
> + </xsl:attribute>
> + </check-export>
> + </xsl:if>
> <check-content>
> <xsl:apply-templates select="node()"/>
> </check-content>
> @@ -205,10 +211,20 @@ exclude-result-prefixes="xccdf xhtml">
> <xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
> </xsl:template>
>
> + <xsl:template match="package-install-macro">
> + The <xhtml:code><xsl:value-of select="@package"/></xhtml:code> package can be installed with the following command:
> + <xhtml:pre># yum install <xsl:value-of select="@package"/></xhtml:pre>
> + </xsl:template>
> +
> + <xsl:template match="package-remove-macro">
> + The <xhtml:code><xsl:value-of select="@package"/></xhtml:code> package can be removed with the following command:
> + <xhtml:pre># yum erase <xsl:value-of select="@package"/></xhtml:pre>
> + </xsl:template>
> +
> <xsl:template match="partition-check-macro">
> Run the following command to verify that <xhtml:code><xsl:value-of select="@part"/></xhtml:code> lives on its own partition:
> - <xhtml:pre># df -h <xsl:value-of select="@part"/> | grep "<xsl:value-of select="@part"/>"</xhtml:pre>
> - It will return a line for "<xsl:value-of select="@part"/>" if it is on its own partition.
> + <xhtml:pre># df -h <xsl:value-of select="@part"/> </xhtml:pre>
> + It will return a line for <xhtml:code><xsl:value-of select="@part"/></xhtml:code> if it is on its own partition.
> </xsl:template>
>
> <xsl:template match="service-disable-check-macro">
> @@ -225,6 +241,11 @@ exclude-result-prefixes="xccdf xhtml">
> If the service is enabled, it should return: <xhtml:pre><xsl:value-of select="@service"/> is running...</xhtml:pre>
> </xsl:template>
>
> + <xsl:template match="package-check-macro">
> + Run the following command to determine if the <xhtml:code><xsl:value-of select="@package"/></xhtml:code> package is installed:
> + <xhtml:pre># rpm -q <xsl:value-of select="@package"/></xhtml:pre>
> + </xsl:template>
> +
> <!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
> <!-- (expanding xhtml tags back into the xhtml namespace) -->
> <xsl:template match="br">
> diff --git a/RHEL6/transforms/xccdf2table-profileccirefs.xslt b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
> index f5d22c1..1d9758f 100644
> --- a/RHEL6/transforms/xccdf2table-profileccirefs.xslt
> +++ b/RHEL6/transforms/xccdf2table-profileccirefs.xslt
> @@ -147,7 +147,7 @@
>
>
> <xsl:template match="cdf:check">
> - <xsl:if test="@system=$ociluri">
> + <xsl:if test="@system=$ociltransitional">
> <xsl:apply-templates select="cdf:check-content" />
> </xsl:if>
> <xsl:if test="@system=$ovaluri">
More information about the scap-security-guide
mailing list