[PATCH] [Fedora] Apply further changes motivated by scap-security-guide Fedora RPM review request (RH BZ#1018905, c#8)

Jan Lieskovsky jlieskov at redhat.com
Thu Oct 17 15:23:42 UTC 2013


Hello Shawn, 

----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Wednesday, October 16, 2013 9:55:09 PM
> Subject: Re: [PATCH] [Fedora] Apply further changes motivated by	scap-security-guide Fedora RPM review request (RH
> BZ#1018905, c#8)
> 
> On 10/16/13 12:16 PM, Jan Lieskovsky wrote:
> 
> 
> 
> This patch applies fixes for second round of Fedora RPM package
> review objections raised within:
>   [1] https://bugzilla.redhat.com/show_bug.cgi?id=1018905#c8 Has pushed it
>   already (again mainly *.spec file changes, and
> confirmed relevant tests still work) to get another version of
> review opinion.
> 
> 
> Your focus on packaging has been really great! Thank you! Two comments
> in-line below.
> 
> 
> 
> 
> 
> 0001-Fedora-Apply-further-changes-motivated-by-scap-secur.patch
> From 56364b5154988d998b5cc025d2623b1f031cd870 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Wed, 16 Oct 2013 16:24:08
> +0200
> Subject: [PATCH] [Fedora] Apply further changes motivated by
>  scap-security-guide Fedora RPM review request (RH BZ#1018905, c#8)
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  Fedora/Makefile                                    |  7 ++---
>  Fedora/input/auxiliary/scap-security-guide.8       | 18 +++++------
>  .../checks/platform/fedora-cpe-dictionary.xml      | 10 ++++++
>  .../checks/platform/fedora19-cpe-dictionary.xml    | 10 ------
>  Fedora/scap-security-guide.spec                    | 36
>  +++++++++++++++-------
>  Fedora/transforms/shorthand2xccdf.xslt             |  2 +-
>  6 files changed, 48 insertions(+), 35 deletions(-)
>  create mode 100644 Fedora/input/checks/platform/fedora-cpe-dictionary.xml
>  delete mode 100644 Fedora/input/checks/platform/fedora19-cpe-dictionary.xml
> 
> diff --git a/Fedora/Makefile b/Fedora/Makefile
> index e608354..1a35677 100644
> --- a/Fedora/Makefile
> +++ b/Fedora/Makefile
> @@ -5,7 +5,7 @@ UTILS = utils
>  DIST = dist
>  
>  ID = ssg
> -PROD = fedora19
> +PROD = fedora
> 
> Changing this will alter filenames, such as the XCCDF and OVAL, which could
> create the impression content works on *all* versions of Fedora. Is this
> intended?

Yes. The current content should basically work on Fedora 18 too already.

It still needs couple of adjustments though - this is next on my plate.

Will submit Fedora SCM request only in moment Fedora 18 has been tested
and recognized as working properly too (=> in 1-2 days).

> 
> 
> 
> 
> 
> all: shorthand2xccdf guide content dist
>  
> @@ -44,8 +44,7 @@ validate: validate-xml
>  
>  # items in dist are expected for distribution in an rpm
>  dist: guide content
> -	mkdir -p $(DIST)/guide $(DIST)/content
> -	cp $(OUT)/*-guide.html $(DIST)/guide
> 
> As there is not much Fedora content yet, was the dropping of the HTML guide
> intended to reflect how content is still emerging, or was this requested for
> package shipping?

The HTML version / form of the guide wasn't dropped. It's still shipped
within the package. Just the file location changed. Before it was:

/usr/share/xml/scap/ssg/fedora/guide/ssg-{fedora | fedora19}-xccdf.xml,   /* Inspired by RHEL-6 SSG */

now it is (got just placed into proper documentation directory):

$ rpm -ql scap-security-guide | grep html
/usr/share/doc/scap-security-guide-0.1/ssg-fedora-guide.html

I simultaneously need to say that I don't consider the HTML version
of the guide to be "just documentation" in the sense of documentation
being just listing / additional explanation of further package's / binaries'
options and their syntax.

The case of SSG content seems to be a bit special in the sense that
not-experienced Fedora system administrators might want to read
the guide ahead (yet before performing any scan first) just to
understand, what system features would be checked / scanned (or
what system characteristics to focus at when taking system security
into account as primary focus).

But it was moved better to comply with packaging guidelines.

> I ask because many find the RHEL6 HTML guide incredibly
> useful and not shipping it could cause concerns.

See above. It's still shipped. Just got moved to proper documentation
directory (as recommended by packaging guide).

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> 
> 
> 
> 
> +	mkdir -p $(DIST)/content
>  	cp $(OUT)/$(ID)-$(PROD)-xccdf.xml $(DIST)/content
>  	cp $(OUT)/$(ID)-$(PROD)-oval.xml $(DIST)/content
>  	cp $(OUT)/$(ID)-$(PROD)-cpe-dictionary.xml $(DIST)/content
> @@ -56,4 +55,4 @@ eval-common: content
>  
>  clean:
>  	rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf  $(OUT)/*.spec
>  	$(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
> -	rm -rf $(DIST)/content $(DIST)/guide
> +	rm -rf $(DIST)/content
> diff --git a/Fedora/input/auxiliary/scap-security-guide.8
> b/Fedora/input/auxiliary/scap-security-guide.8
> index ec46ca8..0e3cdd0 100644
> --- a/Fedora/input/auxiliary/scap-security-guide.8
> +++ b/Fedora/input/auxiliary/scap-security-guide.8
> @@ -39,15 +39,15 @@ common profile, run:
>  $ oscap  xccdf eval --profile common \
>  --results / tmp / `hostname`-ssg-results.xml \
>  --report / tmp / `hostname`-ssg-results.html \
> ---cpe /usr/share/xml/scap/ssg/fedora/content/ssg-fedora19-cpe-dictionary.xml
> \
> -/usr/share/xml/scap/ssg/fedora/content/ssg-fedora19-xccdf.xml
> +--cpe /usr/share/xml/scap/ssg/fedora/content/ssg-fedora-cpe-dictionary.xml \
> +/usr/share/xml/scap/ssg/fedora/content/ssg-fedora-xccdf.xml
>  
>  To scan your system utilizing the scap-workbench systems compliance
>  evaluation
>  GUI tool against the common profile, run:
>  
>  $ scap-workbench
>  
> -tool, select /usr/share/xml/scap/ssg/fedora/content/ssg-fedora19-xccdf.xml
> +tool, select /usr/share/xml/scap/ssg/fedora/content/ssg-fedora-xccdf.xml
>  as input file, and 'Common Profile for General-Purpose Fedora Systems' as
>  the
>  profile file.
>  
> @@ -62,26 +62,26 @@
> https://fedorahosted.org/scap-security-guide/wiki/usageguide Houses SCAP
> content utilizing the following naming conventions:
>  
>  .I CPE_Dictionaries:
> -ssg-fedora19-cpe-dictionary.xml
> +ssg-fedora-cpe-dictionary.xml
>  
>  .I CPE_OVAL_Content:
> -ssg-fedora19-cpe-oval.xml
> +ssg-fedora-cpe-oval.xml
>  
>  .I OVAL_Content:
> -ssg-fedora19-oval.xml
> +ssg-fedora-oval.xml
>  
>  .I XCCDF_Content:
> -ssg-fedora19-xccdf.xml
> +ssg-fedora-xccdf.xml
>  .RE
>  
> -.I / usr/share/xml/scap/ssg/fedora/guide / +.I
> /usr/share/doc/scap-security-guide-0.1/
>  .RS
>  HTML version of SSG profile.
>  .RE
>  
>  
>  .SH SEE ALSO
> -.B oscap(8)
> +.B oscap(8), scap-workbench(20)
>  
>  
>  .SH AUTHOR
> diff --git a/Fedora/input/checks/platform/fedora-cpe-dictionary.xml
> b/Fedora/input/checks/platform/fedora-cpe-dictionary.xml
> new file mode 100644
> index 0000000..b457e21
> --- /dev/null
> +++ b/Fedora/input/checks/platform/fedora-cpe-dictionary.xml
> @@ -0,0 +1,10 @@
> +<?xml version="1.0" encoding="UTF-8"?>
> +<cpe-list xmlns= "http://cpe.mitre.org/dictionary/2.0" +          xmlns:xsi=
> "http://www.w3.org/2001/XMLSchema-instance" +          xsi:schemaLocation=
> "http://cpe.mitre.org/dictionary/2.0
> http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" >
> +      <cpe-item name="cpe:/o:fedoraproject:fedora:19">
> +            <title xml:lang="en-us">Fedora release 19 (Schrödinger's
> Cat)</title>
> +            <!-- the check references an OVAL file that contains an
> inventory definition -->
> +            <check system=
> "http://oval.mitre.org/XMLSchema/oval-definitions-5"
> href="filename">installed_OS_is_fedora19</check>
> +      </cpe-item>
> +</cpe-list>
> diff --git a/Fedora/input/checks/platform/fedora19-cpe-dictionary.xml
> b/Fedora/input/checks/platform/fedora19-cpe-dictionary.xml
> deleted file mode 100644
> index b457e21..0000000
> --- a/Fedora/input/checks/platform/fedora19-cpe-dictionary.xml
> +++ /dev/null
> @@ -1,10 +0,0 @@
> -<?xml version="1.0" encoding="UTF-8"?>
> -<cpe-list xmlns= "http://cpe.mitre.org/dictionary/2.0" -          xmlns:xsi=
> "http://www.w3.org/2001/XMLSchema-instance" -          xsi:schemaLocation=
> "http://cpe.mitre.org/dictionary/2.0
> http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" >
> -      <cpe-item name="cpe:/o:fedoraproject:fedora:19">
> -            <title xml:lang="en-us">Fedora release 19 (Schrödinger's
> Cat)</title>
> -            <!-- the check references an OVAL file that contains an
> inventory definition -->
> -            <check system=
> "http://oval.mitre.org/XMLSchema/oval-definitions-5"
> href="filename">installed_OS_is_fedora19</check>
> -      </cpe-item>
> -</cpe-list>
> diff --git a/Fedora/scap-security-guide.spec
> b/Fedora/scap-security-guide.spec
> index f59e45a..cd7aee7 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>  # file one level up - in the main scap-security-guide directory (instead of
>  # this one).
>  
> -%global	fedorassgrelease	3.rc1
> +%global	fedorassgrelease	3.rc2
>  
>  Name:		scap-security-guide
>  Version:	0.1
> @@ -17,15 +17,19 @@ URL: https://fedorahosted.org/scap-security-guide/
> Source0: http://fedorapeople.org/~jlieskov/%
> {name}-%{version}-%{fedorassgrelease}.tar.gz
>  BuildArch:	noarch
>  BuildRequires:	libxslt, expat, python, openscap-utils >= 0.9.1, python-lxml
> -Requires:	openscap-utils >= 0.9.1
> +Requires:	xml-common, openscap-utils >= 0.9.1
>  
>  %description
> -The scap-security-guide project provides guide for configuration of the
> -system from final system's security point of view. The guidance is specified
> -in the Security Content Automation Protocol (SCAP) format and consitutes
> -a catalog of practical hardening advice linked to government requirements
> +The scap-security-guide project provides a guide for configuration of the
> +system from the final system's security point of view. The guidance is
> specified
> +in the Security Content Automation Protocol (SCAP) format and constitutes
> +a catalog of practical hardening advice, linked to government requirements
>  where applicable. The project bridges the gap between generalized policy
> -requirements and specific implementation guidelines.
> +requirements and specific implementation guidelines. The Fedora system
> +administrator can use the oscap CLI tool from openscap-utils package, or the
> +scap-workbench GUI tool from scap-workbench package to verify that the
> system
> +conforms to provided guideline. Refer to scap-security-guide(8) manual page
> for
> +further information.
>  
>  %prep
>  %setup -q -n %{name}-%{version}-%{fedorassgrelease}
> @@ -37,18 +41,28 @@ cd Fedora && make dist
>  mkdir -p %{buildroot}%{_datadir}/xml/scap/ssg/fedora
>  mkdir -p %{buildroot}%{_mandir}/en/man8/
>  
> -# Add in core content (SCAP, guide)
> -cp -a Fedora/dist/* %{buildroot}%{_datadir}/xml/scap/ssg/fedora
> +# Add in core content (SCAP XCCDF and OVAL content)
> +cp -a Fedora/dist/content/* %{buildroot}%{_datadir}/xml/scap/ssg/fedora
>  
>  # Add in manpage
>  cp -a Fedora/input/auxiliary/scap-security-guide.8
>  %{buildroot}%{_mandir}/en/man8/scap-security-guide.8
>  
>  %files
> -%{_datadir} / xml/scap/ssg/fedora / *
> +%{_datadir}/xml/scap
>  %lang(en) %{_mandir}/en/man8/scap-security-guide.8.*
> -%doc Fedora/LICENSE
> +%doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html
>  
>  %changelog
> +* Wed Oct 16 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1-3.rc2
> +- Apply further changes motivated by scap-security-guide Fedora RPM review
> +  request (RH BZ#1018905, c#8):
> +  * update package description,
> +  * make content files to be owned by the scap-security-guide package,
> +  * remove Fedora release number from generated content files,
> +  * move HTML form of the guide under the doc directory (together
> +    with that drop fedora/content subdir and place the content
> +    directly under fedora/ subdir).
> +
>  * Tue Oct 15 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1-3.rc1
>  - Fixes for scap-security-guide Fedora RPM review request (RH BZ#1018905):
>    * drop Fedora release from package provided files' final path (c#5),
> diff --git a/Fedora/transforms/shorthand2xccdf.xslt
> b/Fedora/transforms/shorthand2xccdf.xslt
> index b804153..e2d0a16 100644
> --- a/Fedora/transforms/shorthand2xccdf.xslt
> +++ b/Fedora/transforms/shorthand2xccdf.xslt
> @@ -14,7 +14,7 @@
>  
>  <xsl:include href="constants.xslt"/>
>  
> -<xsl:variable name="ovalfile">unlinked-fedora19-oval.xml</xsl:variable>
> +<xsl:variable name="ovalfile">unlinked-fedora-oval.xml</xsl:variable>
>  <xsl:variable name="defaultseverity" select="'low'" />
>  
>  <!-- put elements created in this stylesheet into the xccdf namespace,
> --
> 1.8.3.1
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list