[PATCH] Update to put fix content common functions into plain-text elements

Shawn Wells shawn at redhat.com
Tue Apr 9 10:58:05 UTC 2013


On 4/9/13 4:34 AM, Simon Lukasik wrote:
> On 04/09/2013 03:06 AM, Shawn Wells wrote:
>> >On 4/7/13 3:44 PM, Francisco Slavin wrote:
>>> >>As per Simon Lukasik's suggestion, pulling common bash functions into
>>> >>XCCDF <plain-text> elements for use by various <fix> elements using
>>> >><sub> references.
>>> >>
>>> >>Francisco Slavin (1):
>>> >>    Infrastructure: Update fix transform handling to put common functions
>>> >>      into <plain-text> elements for easy code reuse.
>>> >>
>>> >>   RHEL6/transforms/combinefixes.py     |   25 +++++++++++++++++++++++--
>>> >>   RHEL6/transforms/xccdf-addfixes.xslt |   30
>>> >>+++++++++++++++++++++++++++++-
>>> >>   2 files changed, 52 insertions(+), 3 deletions(-)
>> >
>> >
>> >I like this. Here's how I tested:
>> >
>> >(1) Create a common function, package_install, and update the
>> >install_aide.sh file to use it:
>> >
>>> >>$ cat <<EOF>/input/fixes/bash/package_install.common
>>> >>#!/bin/bash
>>> >>function package_install {
>>> >>     yum -y install -bash
>>> >>}
>>> >>
>>> >>$ cat "package_install(aide)" >/input/fixes/bash/install_aide.sh
>> >
>> >
>> >(2) Run make, ensure the <plain-text> elements showup under the benchmark.
>>> >>$ make clean; make content
>>> >>$ grep -4 package_install output/ssg-rhel6-xccdf.xml
>>> >>.....
>>> >><plain-text id="package_install">
>>> >>#!/bin/bash
>>> >>function package_install {
>>> >>     yum -y install -bash
>>> >>}
>>> >>
>>> >></plain-text>
>>> >>.....
>> >
>> >
>> >(3) Run a scan, check for proper function substitution
>>> >>$ oscap xccdf eval --profile stig-rhel6-server --results
>>> >>/tmp/results.xml --cpe output/ssg-rhel6-cpe-dictionary.xml
>>> >>output/ssg-rhel6-xccdf.xml
>>> >>$ grep -2 "yum -y install aide" /tmp/results.xml
>>> >>             <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>>> >>             <fix xmlns:xhtml="http://www.w3.org/1999/xhtml"
>>> >>system="urn:xccdf:fix:script:sh">
>>> >>yum -y install aide
>>> >>
>>> >></fix>
>>> >>-- 
>>> >>       <ident system="http://cce.mitre.org">CCE-27024-9</ident>
>>> >>       <fix xmlns:xhtml="http://www.w3.org/1999/xhtml"
>>> >>system="urn:xccdf:fix:script:sh">
>>> >>yum -y install aide
>>> >>
>>> >></fix>
>> >
>> >(4) Generate remediation scripts, to check expansion in the 'oscap
>> >generate fix' process (yes, redundant from step #3....). Moved
>> >everything to 'fail' state to get full output
>>> >>$ sed -e 's/pass/fail/g' -i /tmp/results.xml
>>> >>$ oscap xccdf generate fix --result-id
>>> >>xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
>>> >>.....
>>> >># XCCDF rule: package_aide_installed
>>> >># CCE-27024-9
>>> >>
>>> >>yum -y install aide
>>> >>
>>> >>....,
>> >
>> >Looks like we have a very manageable approach to remediation code! Ack
>> >
> Hello guys,
>
> Could you please skip step (3) and use the 'generate' directly (without
> having the TestResult element)? Like:
>
>   $ oscap xccdf generate fix --profile stig-rhel6-server /tmp/results.xml

The function still resolves itself:

$ oscap xccdf generate fix --profile stig-rhel6-server /tmp/results.xml
#!/bin/bash
# OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure 
Configuration of Red Hat Enterprise Linux 6


# Generating fixes for all Rules that are selected in the default profile.

# XCCDF rule: package_aide_installed
# CCE-27024-9

yum -y install aide



> Here is why:
>
> Currently, the oscap-xccdf-generate-fix behaviour differs when used with
> --testresult option, then, the text substitution and CPE platform is not
> resolved. The oscap-xccdf-generate-fix--profile is more stable and has
> corner cases are treated better.
>
> That is due to the fact that, oscap-xccdf-generate-fix has historically
> used XSLT transformation. But that is no longer viable option. Some of
> the XCCDF algorithms, like XCCDF Processing and Text Substitution are
> hardly possible to implement in XSLT. Therefore the remediation is
> written in C as well as oscap-xccdf-generate-fix--profile. However, the
> legacy oscap-xccdf-generate-fix--testresult is still using XSLT.
>
> And here comes the problem, I am not sure if oscap can introduce subtle
> differences and slightly change behaviour of the legacy
> oscap-xccdf-generate-fix--testresult --- to support text substitution.
>
> Because things like
>
>> ># XCCDF rule: package_aide_installed
>> ># CCE-27024-9
> would go away.
Looks like this shouldn't be an issue. I'm using 
openscap-utils-0.9.3-1.el6.x86_64.



More information about the scap-security-guide mailing list