adding "fix"es to the xccdf

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Jan 31 21:36:00 UTC 2013


Hi Brian,

Yeah.  I'd try to leverage secstate -- you may find that a lot of the
work has already been done for you.

Merger or formal interoperation of the multiple projects involved is on
the radar, but it's not there yet.  Meetings among the various
stakeholders is probably called for before too long.

Jeff



On 01/31/2013 03:18 PM, Brian Millett wrote:
> On Thu, 31 Jan 2013 13:56:41 -0500
> Mike Palmiotto <mpalmiotto at tresys.com> wrote:
> 
>> On 1/31/2013 11:20 AM, Brian Millett wrote:
>>> On Thu, Jan 31, 2013 at 9:49 AM, Mike Palmiotto
>>> <mpalmiotto at tresys.com>wrote:
>>>
>>>> On 1/31/2013 9:38 AM, Brian Millett wrote:
>>>>
>>>>> I'm really interested in adding fixes, or having a set of fixes I can
>>>>> apply to
>>>>> the xccdf for rhel6.  I've looked at the line in the Makefile:
>>>>>
>>>>> xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o
>>>>> $(OUT)/unlinked-rhel6-xccdf.**xml $(TRANS)/xccdf-addfixes.xslt
>>>>> $(OUT)/unlinked-rhel6-xccdf.**xml
>>>>>
>>>>> and it looks like, following the bas-ks.xml, I can create a file with
>>>>> each fix
>>>>> as long as each fix-id is the same as the rule-id so that the fix can be
>>>>> merged with the appropriate rule into a final xccdf.xml file.
>>>>>
>>>>
>>>> When you say fix-id, do you mean the rule attribute for each fix tag?
>>>>
>>>
>>> Ok, silly me, I went back and looked at the bash-ks.xml and I had totally
>>> miss read the fix.
>>>
>>> In the bash-ks.xml a fix is as
>>>
>>>   <fix rule="disable_vsftp">service vsftpd stop</fix>
>>>
>>> while in a xccdf Rule tag, the fix is as
>>>
>>> <fix id="service_restorecond_enabled" reboot="false" platform=""
>>> system="">chkconfig restorecond on</fix>
>>>
>>>
>>> So, I didn't grok the "id=" vs the "rule=".
>>>
>>> That makes sense.
>>>
>>> So the bash-ks.xml is
>>>
>>> <fix-group id="bash" system="urn:xccdf:fix:script:bash" xmlns="
>>
>> <snip>
>>
>>>    fi</fix>
>>> </fix-group>
>>
>> You've got it.
>>
> 
> <snip if really good info >
> 
> Good stuff.  Thanks
> 
> I've been trying to get the sample bash-ks.xml to work, but when I run
> 
> make
> 
> no fixes referenced in the bask-ks.xml gets added to the
> finalized xccdf.xml file.
> 
> I removed the comment in the Makefile so the xccdf-addfixes.xslt is fired, but
> not output.
> 
> Kind of wanted to take baby steps with just the supplied before I dive into
> other projects/efforts to add fixes.
> 
> Thanks.


More information about the scap-security-guide mailing list