[PATCH] Update to put fix content common functions into plain-text elements

Simon Lukasik slukasik at redhat.com
Tue Apr 9 08:34:44 UTC 2013


On 04/09/2013 03:06 AM, Shawn Wells wrote:
> On 4/7/13 3:44 PM, Francisco Slavin wrote:
>> As per Simon Lukasik's suggestion, pulling common bash functions into
>> XCCDF <plain-text> elements for use by various <fix> elements using
>> <sub> references.
>>
>> Francisco Slavin (1):
>>    Infrastructure: Update fix transform handling to put common functions
>>      into <plain-text> elements for easy code reuse.
>>
>>   RHEL6/transforms/combinefixes.py     |   25 +++++++++++++++++++++++--
>>   RHEL6/transforms/xccdf-addfixes.xslt |   30
>> +++++++++++++++++++++++++++++-
>>   2 files changed, 52 insertions(+), 3 deletions(-)
> 
> 
> I like this. Here's how I tested:
> 
> (1) Create a common function, package_install, and update the
> install_aide.sh file to use it:
> 
>> $ cat <<EOF>/input/fixes/bash/package_install.common
>> #!/bin/bash
>> function package_install {
>>     yum -y install -bash
>> }
>>
>> $ cat "package_install(aide)" >/input/fixes/bash/install_aide.sh
> 
> 
> (2) Run make, ensure the <plain-text> elements showup under the benchmark.
>> $ make clean; make content
>> $ grep -4 package_install output/ssg-rhel6-xccdf.xml
>> .....
>> <plain-text id="package_install">
>> #!/bin/bash
>> function package_install {
>>     yum -y install -bash
>> }
>>
>> </plain-text>
>> .....
> 
> 
> (3) Run a scan, check for proper function substitution
>> $ oscap xccdf eval --profile stig-rhel6-server --results
>> /tmp/results.xml --cpe output/ssg-rhel6-cpe-dictionary.xml
>> output/ssg-rhel6-xccdf.xml
>> $ grep -2 "yum -y install aide" /tmp/results.xml
>>             <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>>             <fix xmlns:xhtml="http://www.w3.org/1999/xhtml"
>> system="urn:xccdf:fix:script:sh">
>> yum -y install aide
>>
>> </fix>
>> -- 
>>       <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>>       <fix xmlns:xhtml="http://www.w3.org/1999/xhtml"
>> system="urn:xccdf:fix:script:sh">
>> yum -y install aide
>>
>> </fix>
> 
> (4) Generate remediation scripts, to check expansion in the 'oscap
> generate fix' process (yes, redundant from step #3....). Moved
> everything to 'fail' state to get full output
>> $ sed -e 's/pass/fail/g' -i /tmp/results.xml
>> $ oscap xccdf generate fix --result-id
>> xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
>> .....
>> # XCCDF rule: package_aide_installed
>> # CCE-27024-9
>>
>> yum -y install aide
>>
>> ....,
> 
> Looks like we have a very manageable approach to remediation code! Ack
>

Hello guys,

Could you please skip step (3) and use the 'generate' directly (without
having the TestResult element)? Like:

 $ oscap xccdf generate fix --profile stig-rhel6-server /tmp/results.xml

Here is why:

Currently, the oscap-xccdf-generate-fix behaviour differs when used with
--testresult option, then, the text substitution and CPE platform is not
resolved. The oscap-xccdf-generate-fix--profile is more stable and has
corner cases are treated better.

That is due to the fact that, oscap-xccdf-generate-fix has historically
used XSLT transformation. But that is no longer viable option. Some of
the XCCDF algorithms, like XCCDF Processing and Text Substitution are
hardly possible to implement in XSLT. Therefore the remediation is
written in C as well as oscap-xccdf-generate-fix--profile. However, the
legacy oscap-xccdf-generate-fix--testresult is still using XSLT.

And here comes the problem, I am not sure if oscap can introduce subtle
differences and slightly change behaviour of the legacy
oscap-xccdf-generate-fix--testresult --- to support text substitution.

Because things like

> # XCCDF rule: package_aide_installed
> # CCE-27024-9

would go away.

-- 
Simon Lukasik
Security Technologies


More information about the scap-security-guide mailing list