[PATCH] Infrastructure: Update fix transform handling to put common functions into <plain-text> elements for easy code reuse.

Francisco Slavin fslavin at tresys.com
Sun Apr 7 19:44:41 UTC 2013


---
 RHEL6/transforms/combinefixes.py     |   25 +++++++++++++++++++++++--
 RHEL6/transforms/xccdf-addfixes.xslt |   30 +++++++++++++++++++++++++++++-
 2 files changed, 52 insertions(+), 3 deletions(-)

diff --git a/RHEL6/transforms/combinefixes.py b/RHEL6/transforms/combinefixes.py
index 4c4bb55..307cac3 100755
--- a/RHEL6/transforms/combinefixes.py
+++ b/RHEL6/transforms/combinefixes.py
@@ -2,8 +2,12 @@
 
 import sys, os 
 
-header = '''<fix-group id="bash" system="urn:xccdf:fix:script:sh" xmlns="http://checklists.nist.gov/xccdf/1.1">\n'''
-footer = '</fix-group>\n'
+header = '''<fix-content system="urn:xccdf:fix:script:sh" xmlns="http://checklists.nist.gov/xccdf/1.1">\n'''
+footer = '</fix-content>\n'
+fixGroupHeader = '''<fix-group id="bash" system="urn:xccdf:fix:script:sh" xmlns="http://checklists.nist.gov/xccdf/1.1">\n'''
+fixGroupFooter = '</fix-group>\n'
+fixCommonGroupHeader = '''<fix-common-group id="bash-common" xmlns="http://checklists.nist.gov/xccdf/1.1">\n'''
+fixCommonGroupFooter = '</fix-common-group>\n'
 
 def encode(text):
     text = text.replace('&','&amp;')
@@ -20,6 +24,7 @@ def main():
     output = sys.argv[2]
     out = open(output,'w')
     out.write(header)
+    out.write(fixGroupHeader)
     for filename in os.listdir(fixDir):
         if filename.endswith(".sh"):
             body = ""
@@ -30,7 +35,23 @@ def main():
             out.write(body+"\n")
             out.write("</fix>\n")
 
+    out.write(fixGroupFooter)
+
+    out.write(fixCommonGroupHeader)
+    for filename in os.listdir(fixDir):
+        if filename.endswith("common"):
+            body = ""
+            with open( fixDir + "/" + filename, 'r') as f:
+                body = body + encode(f.read())
+            fixName = os.path.splitext(filename)[0]
+            out.write("<fix-common id=\""+fixName+"\">\n")
+            out.write(body+"\n")
+            out.write("</fix-common>\n")
+
+    out.write(fixCommonGroupFooter)
     out.write(footer)
+
+    out.close()
     sys.exit(0)
         
 if __name__ == "__main__":
diff --git a/RHEL6/transforms/xccdf-addfixes.xslt b/RHEL6/transforms/xccdf-addfixes.xslt
index 26a14bd..d3c4598 100644
--- a/RHEL6/transforms/xccdf-addfixes.xslt
+++ b/RHEL6/transforms/xccdf-addfixes.xslt
@@ -5,8 +5,9 @@
      containing a list of fixes.  It inserts these into the Rules 
      specified inside the fixes file. -->
 
-<xsl:variable name="fixgroup" select="document($fixes)/xccdf:fix-group" />
+<xsl:variable name="fixgroup" select="document($fixes)/xccdf:fix-content/xccdf:fix-group" />
 <xsl:variable name="fixsystem" select="$fixgroup/@system"/>
+<xsl:variable name="fixcommongroup" select="document($fixes)/xccdf:fix-content/xccdf:fix-common-group" />
 
   <xsl:template match="xccdf:Rule">
     <xsl:copy>
@@ -27,6 +28,33 @@
     </xsl:copy>
   </xsl:template>
 
+  <xsl:template match="xccdf:Benchmark">
+    <xsl:copy>
+
+      <!-- plain-text elements must appear in sequence -->
+      <xsl:apply-templates select="@*"/>
+      <xsl:apply-templates select="xccdf:status"/>
+      <xsl:apply-templates select="xccdf:dc-status"/>
+      <xsl:apply-templates select="xccdf:title"/>
+      <xsl:apply-templates select="xccdf:description"/>
+      <xsl:apply-templates select="xccdf:notice"/>
+      <xsl:apply-templates select="xccdf:front-matter"/>
+      <xsl:apply-templates select="xccdf:rear-matter"/>
+      <xsl:apply-templates select="xccdf:reference"/>
+
+      <xsl:for-each select="$fixcommongroup/xccdf:fix-common">
+        <xsl:variable name="fix_common_id" select="@id"/>
+        <xsl:element name="plain-text" namespace="http://checklists.nist.gov/xccdf/1.1">
+        <xsl:attribute name="id"><xsl:value-of select="$fix_common_id"/></xsl:attribute>
+        <xsl:value-of select="text()"/>
+        </xsl:element>
+      </xsl:for-each> 
+      <xsl:apply-templates select="node()[not(self::xccdf:status|self::xccdf:dc-title|self::xccdf:title|self::xccdf:description|self::xccdf:notice|self::xccdf:front-matter|self::xccdf:rear-matter|self::xccdf:reference)]"/>
+<!--
+      <xsl:apply-templates select="node()[not(self::xccdf:status)]"/>
+-->
+    </xsl:copy>
+  </xsl:template>
 
   <!-- copy everything else through to final output -->
   <xsl:template match="@*|node()">
-- 
1.7.1



More information about the scap-security-guide mailing list