Generalising SSG ...

Trey Henefield trey.henefield at ultra-ats.com
Tue Aug 20 16:17:45 UTC 2013


Thanks for the info.

In short, I created a variable named STIG and then referenced it throughout. Then I created a subfolder underneath the input folder with the same name as the STIG. This would allow me to have multiple SSG projects in the same repository without having to duplicate the entire repository for each SSG. I want to ensure that when changes are made to the files supporting the build process, that I don't have to update those changes for every project. This method would support that goal.

Now I just need a way to dynamically list each project folder under input and perform the make for each all from within the Makefile.

My thoughts were to include the following changes to the Makefile, as described above:

#################################

IN = input
OUT = output
TRANS = transforms
REFS = references
UTILS = utils
DIST = dist
STIG = rhel6

ID = ssg

all: shorthand2xccdf tables guide checks content dist

shorthand-guide:
	xsltproc -o $(OUT)/$(STIG)-shorthand.xml $(IN)/$(STIG)/guide.xslt $(IN)/$(STIG)/guide.xml
	xmllint --format --output $(OUT)/$(STIG)-shorthand.xml $(OUT)/$(STIG)-shorthand.xml

shorthand2xccdf: shorthand-guide
	xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/$(STIG)-shorthand.xml
	xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml
	xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml \
		$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml
	oscap xccdf resolve -o $(OUT)/unlinked-$(STIG)-xccdf.xml $(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml
#	xsltproc -stringparam profile "stig-$(STIG)-server" -o $(OUT)/unlinked-$(STIG)-xccdf.xml \
#		$(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
#   extract manual check instructions from xccdf into an ocil file
	xsltproc -o $(OUT)/unlinked-$(STIG)-ocil.xml $(TRANS)/xccdf-create-ocil.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	xmllint --format --output $(OUT)/unlinked-$(STIG)-ocil.xml $(OUT)/unlinked-$(STIG)-ocil.xml 
	xsltproc -o $(OUT)/unlinked-ocilrefs-$(STIG)-xccdf.xml $(TRANS)/xccdf-ocilcheck2ref.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	./$(TRANS)/combinefixes.py $(IN)/$(STIG)/fixes/bash/ $(OUT)/bash-remediations.xml
	xsltproc -stringparam fixes "../$(OUT)/bash-remediations.xml" -o $(OUT)/unlinked-$(STIG)-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	xmllint --format --output $(OUT)/unlinked-$(STIG)-xccdf.xml $(OUT)/unlinked-$(STIG)-xccdf.xml

checks:
	xmlwf $(IN)/$(STIG)/checks/*.xml
	$(TRANS)/combinechecks.py $(IN)/$(STIG)/checks > $(OUT)/unlinked-$(STIG)-oval.xml
	xmllint --format --output $(OUT)/unlinked-$(STIG)-oval.xml $(OUT)/unlinked-$(STIG)-oval.xml

guide: shorthand2xccdf
#	remove auxiliary Groups which are only for use in tables, and not guide output.
#	specifying a nonexistent profile, "allrules," to make oscap print all Rules
	xsltproc -o $(OUT)/unlinked-$(STIG)-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	xsltproc -o $(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml > $(OUT)/$(STIG)-guide.html

# example, if needed: for converting XCCDF into shorthand
#xccdf2shorthand:
#	xsltproc -o $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml $(TRANS)/xccdf2shorthand.xslt $(REFS)/usgcb-rhel5desktop-xccdf.xml
#	tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml

table-refs: shorthand2xccdf
	xsltproc -stringparam ref "nist" -o $(OUT)/table-$(STIG)-nistrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
	xsltproc -stringparam profile "common" -o $(OUT)/table-$(STIG)-nistrefs-common.html \
		$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml

table-idents: shorthand2xccdf
	xsltproc -o $(OUT)/table-$(STIG)-cces.html $(TRANS)/xccdf2table-cce.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml

table-srgmap: shorthand2xccdf
# the map-to-items filename must be provided relative to the root of the main document being processed
	xsltproc -stringparam map-to-items "../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o $(OUT)/table-$(STIG)-srgmap.html \
		$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
	xsltproc -stringparam flat "y" -stringparam map-to-items "../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o $(OUT)/table-$(STIG)-srgmap-flat.html \
		$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
	xmllint --xmlout --html --output $(OUT)/table-$(STIG)-srgmap-flat.xhtml $(OUT)/table-$(STIG)-srgmap-flat.html

table-stigs: shorthand2xccdf table-srgmap
	xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml  
	xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml  
#	xsltproc -stringparam notes "../$(IN)/$(STIG)/auxiliary/transition_notes.xml" -o $(OUT)/table-rhel5-stig-manual-withnotes.html \
#		$(TRANS)/xccdf2table-stig.xslt \
#		$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
#	temporarily retain an output file showing the short titles as well
	xsltproc -stringparam profile "stig-$(STIG)-server" -stringparam testinfo "y" -o $(OUT)/table-stig-$(STIG)-shorttitles.html \
		$(TRANS)/xccdf2table-profileccirefs.xslt \
		$(OUT)/unlinked-$(STIG)-xccdf.xml
	xsltproc -stringparam profile "rht-ccp" -stringparam testinfo "y" -o $(OUT)/table-stig-$(STIG)-shorttitles.html \
		$(TRANS)/xccdf2table-profileccirefs.xslt \
		$(OUT)/unlinked-$(STIG)-xccdf.xml
	xsltproc -stringparam overlay "../$(IN)/$(STIG)/auxiliary/stig_overlay.xml" -o $(OUT)/unlinked-stig-$(STIG)-xccdf.xml \
		$(TRANS)/xccdf-apply-overlay-stig.xslt \
		$(OUT)/unlinked-$(STIG)-xccdf.xml
	xsltproc -o $(OUT)/table-stig-$(STIG).html $(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-$(STIG)-xccdf.xml  

tables: table-refs table-idents table-srgmap table-stigs

content: shorthand2xccdf guide checks
#	the relabelids.py script chdirs to ./output, so refer to files from there.
#	its second argument controls the IDs, as well as the output filenames.
#	thus, with ID set to ssg, this creates ssg-$(STIG)-xccdf.xml and ssg-$(STIG)-oval.xml.
	$(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml $(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml $(ID)
	$(TRANS)/relabelids.py unlinked-$(STIG)-xccdf.xml $(ID)
	$(TRANS)/relabelids.py unlinked-ocilrefs-$(STIG)-xccdf.xml $(ID)

content-stig: shorthand2xccdf guide checks
	xmllint --format --output $(OUT)/unlinked-stig-$(STIG)-xccdf.xml $(OUT)/unlinked-stig-$(STIG)-xccdf.xml 
	$(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml $(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml disa-predraft
	$(TRANS)/relabelids.py unlinked-stig-$(STIG)-xccdf.xml disa-predraft
	xmllint --format --output $(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml $(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml

submission-stig-check: table-stigs
	cd output; ../$(UTILS)/verify-references.py -p stig-$(STIG)-server --rules-with-disarefs-outside-profile unlinked-$(STIG)-xccdf-prerefs.xml
#	$(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-$(STIG)-xccdf.xml > $(OUT)/table-stig.csv

# content-usgcb: coming soon

validate-xml:
	oscap xccdf validate-xml $(OUT)/$(ID)-$(STIG)-xccdf.xml
	oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-oval.xml
	oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-cpe-oval.xml

validate: validate-xml
	cd output; ../$(UTILS)/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-$(STIG)-xccdf.xml
	oscap oval validate-xml --schematron $(OUT)/$(ID)-$(STIG)-oval.xml

eval-test:
	oscap xccdf eval --profile test $(OUT)/$(ID)-$(STIG)-xccdf.xml

eval-common:
	oscap xccdf eval --profile common --oval-results --results /tmp/results-test.xml $(OUT)/$(ID)-$(STIG)-xccdf.xml

# items in dist are expected for distribution in an rpm
dist: tables guide content
	mkdir -p $(DIST)/guide $(DIST)/content $(DIST)/policytables
	cp $(OUT)/*-guide.html $(DIST)/guide
	cp $(OUT)/$(ID)-$(STIG)-xccdf.xml $(DIST)/content
	cp $(OUT)/$(ID)-$(STIG)-oval.xml $(DIST)/content
	cp $(OUT)/$(ID)-$(STIG)-cpe-dictionary.xml $(DIST)/content
	cp $(OUT)/$(ID)-$(STIG)-cpe-oval.xml $(DIST)/content
	cp $(OUT)/table-$(STIG)-* $(DIST)/policytables

clean:
	rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf  $(OUT)/*.spec $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
	rm -rf $(DIST)/content $(DIST)/policytables $(DIST)/guide

#################################

Best regards,
 

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com


-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Jeffrey Blank
Sent: Tuesday, August 20, 2013 10:50 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: Generalising SSG ...

Yes, though I simply haven't had time to refactor the code to make it easily portable.  And of course I'd welcome tooling improvements as commits to SSG, for anyone similarly-minded.

A simplified version has already been dropped here, for another platform:
$ svn checkout https://svn.macosforge.org/repository/scap-on-apple

(This is also simpler, as there is no OVAL involved.)



On 08/20/2013 11:36 AM, Trey Henefield wrote:
> 
> 
> Just food for thought. Has there been any desire to make changes to 
> SSG to accommodate building other (non-rhel6) SSGs?
> 
>  
> 
> I am getting up to speed on its processes, and for practice and actual 
> need, was thinking of creating an SSG for Firefox and Java, and 
> potentially webmin and apache. However, I noticed rhel6 is embedded 
> all throughout.
> 
>  
> 
> I have noticed that most of the processes in place can be repurposed.
> With some changes to the makefile and a repurposed input folder, 
> should this be possible?
> 
>  
> 
> I was just hoping to get some further insight before going down this 
> long path.
> 
>  
> 
> Thanks in advance!
> 
>  
> 
> Best regards,
> 
>  
> 
> Trey Henefield, CISSP
> 
> Senior IAVA Engineer
> 
>  
> 
> Ultra Electronics
> 
> Advanced Tactical Systems, Inc.
> 
> 4101 Smith School Road
> 
> Building IV, Suite 100
> 
> Austin, TX 78744 USA
> 
>  
> 
> Trey.Henefield at ultra-ats.com
> 
> Tel: +1 512 327 6795 ext. 647
> 
> Fax: +1 512 327 8043
> 
> Mobile: +1 512 541 6450
> 
>  
> 
> www.ultra-ats.com
> 
>  
> 
> 
> 
> *Disclaimer*
> The information contained in this communication from 
> *trey.henefield at ultra-ats.com * sent at 2013-08-20 11:36:43 is private 
> and may be legally privileged or export controlled. It is intended 
> solely for use by *scap-security-guide at lists.fedorahosted.org * and 
> others authorized to receive it. If you are not 
> *scap-security-guide at lists.fedorahosted.org * you are hereby notified 
> that any disclosure, copying, distribution or taking action in 
> reliance of the contents of this information is strictly prohibited 
> and may be unlawful.
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Disclaimer
The information contained in this communication from trey.henefield at ultra-ats.com sent at 2013-08-20 12:17:48 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide at lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide at lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130820/dc17ef69/attachment-0001.html>


More information about the scap-security-guide mailing list