[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation

Jeffrey Blank blank at eclipse.ncsc.mil
Sun Jun 2 19:05:18 UTC 2013


This is a step along the path toward support for remediation content
development, but it is only one step.

This patchset also cleans up some other code.  It has not been tested, but it
appears to emit "<sub>" elements in the manner OpenSCAP can process, so that
parameters can be provided to remediation scripts.

Documentation/instructions are still needed.  It should be apparent from the
example that scripts which use parameters will need to "source" a support file
and also declare which environment variables they expect to have populated by
XCCDF values (using the "populate" function).
 
This patch is only to enable example remediation content, which may be suitable
for testing.  The SSG project/community will be ready for remediation content
en masse when there is evidence of sufficient interest in the checking
mechanisms, upon which any remediation effort would naturally depend.

Jeffrey Blank (4):
  example remediation script which takes a parameter
  incomplete support file for bash remediations      * does at least
    warn when undefined variable exists
  rewrite of combinefixes.py to handle parameters for OpenSCAP
    remedation generation
  made xccdf-addfixes insert all text and child nodes of a fix

 RHEL6/input/fixes/bash/set_system_login_banner.sh |    6 ++
 RHEL6/input/fixes/bash/templates/support.sh       |    9 ++
 RHEL6/transforms/combinefixes.py                  |   97 +++++++++-----------
 RHEL6/transforms/xccdf-addfixes.xslt              |    2 +-
 4 files changed, 60 insertions(+), 54 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh
 create mode 100644 RHEL6/input/fixes/bash/templates/support.sh



More information about the scap-security-guide mailing list