SSG Audit + Aqueduct Remediation Linking

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Sep 27 22:22:02 UTC 2012


I think it might make more sense to do it in XML instead of JSON.
Mixing JSON and XML makes one's eyes bleed in two different ways instead
of one way.  But I suppose it's parseable and transformable either way.

Have you given though to making it look (a little bit) like what's in
the CRE spec for a cre_entry (pg 25)?
http://csrc.nist.gov/publications/drafts/nistir-7831/Draft-NISTIR-7831.pdf

But perhaps in a more-convenient-for-human-editing format (something for
which automated transformation may be possible to CRE)?

Structurally this is reminiscent of Apple's plist XML schema (as it is
also designed to hierarchically store arbitrary key-value pairs, and
directly in XML).






On 09/06/2012 06:25 PM, Francisco Slavin wrote:
> Hello,
> 
> As you may be aware, one of the key use cases for SecState has been
> automated remediation.  We have shifted away from Puppet remediation
> to BASH remediation in response to community input & direction.  At
> this time our core target is enabling users to use SSG content to
> audit a system and Aqueduct content to remediate a system.  As we
> move forward with designing the "glue" to link the content together
> we would appreciate input from the community about the approach we're
> planning for this.  We want to help find an approach for this which
> is agreeable to the content maintainers and lets us meet our use
> cases.
> 
> We are planning to continue using the <fix> tag with a custom system
> attribute string to indicate that the <fix> tag contains BASH
> remediation content.  We are currently considering JSON notation as
> the leading candidate for writing the <fix> content because it is
> both easy to write and easy to parse.  The information we want to
> make sure we cover for running a remediation script is:
> 
> * Path to the script * Environment variables to define * Positional
> arguments to pass in to the script
> 
> Using JSON notation in a <fix> tag, this would be the representation
> of that info:
> 
> <fix system="urn:xccdf:fix:script:bash"> { "script" :
> "/usr/libexec/ssg/scripts/remediate_foo.sh" "environment-variables" :
> {"FOO" : "12", "TEST" : "<sub idref="xccdf_variable_foo" />"} 
> "positional-args" : ["test","<sub idref=" other_xccdf_variable" />"] 
> } </fix>
> 
> The array of positional-args would be assumed to be ordered.  So this
> example would call: FOO=12 TEST=<value of xccdf_variable_foo>
> /bin/bash /usr/libexec/ssg/scripts/remediate_foo.sh test <value of
> other_xccdf_variable>
> 
> We would appreciate any input & feedback regarding this approach.
> 
> Thank you - Francisco Slavin
> 
> _______________________________________________ scap-security-guide
> mailing list scap-security-guide at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list