patch to the xccdf-addfixes.xslt to get it to work

Shawn Wells shawn at redhat.com
Sat Feb 2 04:32:18 UTC 2013


On 2/1/13 3:44 PM, Brian Millett wrote:
> RHEL-6, libxslt-1.1.26
>
> Ok, so now when I try to make with fixes, the following errors happen:
>
> Attribute nodes must be added before any child nodes to an element.
> runtime error: file transforms/xccdf-addfixes.xslt line 37 element copy
>
> The patch is
>
> [root at localhost transforms]# diff -wruN xccdf-addfixes.xslt.orig 
> xccdf-addfixes.xslt
> --- xccdf-addfixes.xslt.orig    2013-02-01 14:40:40.580808238 -0600
> +++ xccdf-addfixes.xslt    2013-02-01 14:35:31.607797643 -0600
> @@ -11,7 +11,8 @@
>    <xsl:template match="xccdf:Rule">
>      <xsl:copy>
>        <!-- deal with the fact that oscap demands fixes stand only 
> before checks -->
> -      <xsl:apply-templates select="@*|node()[not(self::xccdf:check)]"/>
> +      <xsl:copy-of select="@*" />
> +      <xsl:apply-templates select="node()[not(self::xccdf:check)]"/>
>
>        <xsl:variable name="rule_id" select="@id"/>
>        <xsl:for-each select="$fixgroup/xccdf:fix">
>
>
> And it works.
>
> Nice way to end the week!

Hmm, I think we're still missing something here. Here is everything I do 
when running a build with fixes.... can you outline where we differ?

On my system:
$ cat /etc/redhat-release;rpm -qv openscap openscap-utils libxslt 
libxslt-python
Red Hat Enterprise Linux Server release 6.3 (Santiago)
openscap-0.9.2-1.el6.x86_64
openscap-utils-0.9.2-1.el6.x86_64
libxslt-1.1.26-2.el6_3.1.x86_64
libxslt-python-1.1.26-2.el6_3.1.x86_64

Blow away my repo and reclone:
$ rm -Rf scap-security-guide/
$ git clone ssh://git.fedorahosted.org/git/scap-security-guide.git

Run make:
$ cd scap-security-guide/RHEL6/; make content
(no errors)

Change the build process to include fixes in the XCCDF content by 
editing the Makefile:
@@ -23,7 +23,7 @@
      xsltproc -o $(OUT)/unlinked-rhel6-ocil.xml 
$(TRANS)/xccdf-create-ocil.xslt $(OUT)/unlinked-rhel6-xccdf.xml
      xmllint --format --output $(OUT)/unlinked-rhel6-ocil.xml 
$(OUT)/unlinked-rhel6-ocil.xml
      xsltproc -o $(OUT)/unlinked-ocilrefs-rhel6-xccdf.xml 
$(TRANS)/xccdf-ocilcheck2ref.xslt $(OUT)/unlinked-rhel6-xccdf.xml
-#    xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o 
$(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt 
$(OUT)/unlinked-rhel6-xccdf.xml
+    xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o 
$(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt 
$(OUT)/unlinked-rhel6-xccdf.xml
      xmllint --format --output $(OUT)/unlinked-rhel6-xccdf.xml 
$(OUT)/unlinked-rhel6-xccdf.xml


Rerun the build:
$ make clean; make content
....
xsltproc -stringparam fixes "../input/fixes/bash-ks.xml" -o 
output/unlinked-rhel6-xccdf.xml transforms/xccdf-addfixes.xslt 
output/unlinked-rhel6-xccdf.xml
......
(no errors)

Verify the fix content is within ssg-rhel6-xccdf.xml:
<Rule id="install_aide" severity="medium" selected="false">
.......
<fix system="urn:xccdf:fix:script:bash">yum install aide</fix>


Run a scan:
oscap xccdf eval --profile stig-rhel6-server \
--results /tmp/stig-results.xml \
--report /tmp/stig-results.html \
--oval-results \
--cpe 
/var/www/html/scap-security-guide/RHEL6/output/ssg-rhel6-cpe-dictionary.xml 
\
/var/www/html/scap-security-guide/RHEL6/output/ssg-rhel6-xccdf.xml
...........
(no errors)


Double check /tmp/stig-results.xml to ensure it has the remediation script:
<rule-result idref="install_aide" time="2013-02-01T16:51:03" 
severity="medium" weight="1.000000">
       <result>pass</result>
       <ident system="http://cce.mitre.org">CCE-27024-9</ident>
       <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" 
system="urn:xccdf:fix:script:bash">yum install aide</fix>
       <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
         <check-content-ref name="oval:ssg:def:1331" 
href="ssg-rhel6-oval.xml"/>
       </check>
     </rule-result>


Seems all is well. Where are you differing in your process?


More information about the scap-security-guide mailing list