[PATCH] Update to put fix content common functions into plain-text elements

Shawn Wells shawn at redhat.com
Tue Apr 9 01:06:33 UTC 2013


On 4/7/13 3:44 PM, Francisco Slavin wrote:
> As per Simon Lukasik's suggestion, pulling common bash functions into XCCDF <plain-text> elements for use by various <fix> elements using <sub> references.
>
> Francisco Slavin (1):
>    Infrastructure: Update fix transform handling to put common functions
>      into <plain-text> elements for easy code reuse.
>
>   RHEL6/transforms/combinefixes.py     |   25 +++++++++++++++++++++++--
>   RHEL6/transforms/xccdf-addfixes.xslt |   30 +++++++++++++++++++++++++++++-
>   2 files changed, 52 insertions(+), 3 deletions(-)


I like this. Here's how I tested:

(1) Create a common function, package_install, and update the 
install_aide.sh file to use it:

> $ cat <<EOF>/input/fixes/bash/package_install.common
> #!/bin/bash
> function package_install {
>     yum -y install -bash
> }
>
> $ cat "package_install(aide)" >/input/fixes/bash/install_aide.sh


(2) Run make, ensure the <plain-text> elements showup under the benchmark.
> $ make clean; make content
> $ grep -4 package_install output/ssg-rhel6-xccdf.xml
> .....
> <plain-text id="package_install">
> #!/bin/bash
> function package_install {
>     yum -y install -bash
> }
>
> </plain-text>
> .....


(3) Run a scan, check for proper function substitution
> $ oscap xccdf eval --profile stig-rhel6-server --results 
> /tmp/results.xml --cpe output/ssg-rhel6-cpe-dictionary.xml 
> output/ssg-rhel6-xccdf.xml
> $ grep -2 "yum -y install aide" /tmp/results.xml
>             <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>             <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" 
> system="urn:xccdf:fix:script:sh">
> yum -y install aide
>
> </fix>
> --
>       <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>       <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" 
> system="urn:xccdf:fix:script:sh">
> yum -y install aide
>
> </fix>

(4) Generate remediation scripts, to check expansion in the 'oscap 
generate fix' process (yes, redundant from step #3....). Moved 
everything to 'fail' state to get full output
> $ sed -e 's/pass/fail/g' -i /tmp/results.xml
> $ oscap xccdf generate fix --result-id 
> xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
> .....
> # XCCDF rule: package_aide_installed
> # CCE-27024-9
>
> yum -y install aide
>
> ....,

Looks like we have a very manageable approach to remediation code! Ack


More information about the scap-security-guide mailing list