<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 9/13/13 1:33 AM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:2043463409.12439929.1379054005823.JavaMail.root@redhat.com"
      type="cite">
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0003-Add-Fedora-19-basic-guide-XML-and-corresponding-XSLT.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From 0c41ca1ca9736f24517737578ac3debb981e4e5b Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 12 Sep 2013 17:19:45 +0200
Subject: [PATCH 3/8] Add Fedora-19 basic guide XML (and corresponding XSLT)
 files.


Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 FEDORA/input/guide.xml  |  40 +++++++++++++
 FEDORA/input/guide.xslt | 148 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 188 insertions(+)
 create mode 100644 FEDORA/input/guide.xml
 create mode 100644 FEDORA/input/guide.xslt

diff --git a/FEDORA/input/guide.xml b/FEDORA/input/guide.xml
new file mode 100644
index 0000000..0b92540
--- /dev/null
+++ b/FEDORA/input/guide.xml
@@ -0,0 +1,40 @@
+&lt;?xml version="1.0"?&gt;
+&lt;Benchmark xmlns:xsi=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a> xmlns:xhtml=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.w3.org/1999/xhtml">"http://www.w3.org/1999/xhtml"</a> xmlns:dc=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://purl.org/dc/elements/1.1/">"http://purl.org/dc/elements/1.1/"</a> id="FEDORA-19" xsi:schemaLocation=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://checklists.nist.gov/xccdf/1.1xccdf-1.1.4.xsd">"http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd"</a> resolved="false" xml:lang="en-US" &gt;
+
+&lt;status date="2011-12-20"&gt;draft&lt;/status&gt;
+&lt;title&gt;Guide to the Secure Configuration of Fedora release 19 (Schrödinger's Cat)&lt;/title&gt;
+&lt;description&gt;This guide presents a catalog of security-relevant
+configuration settings for Fedora release 19 (Schrödinger's Cat) formatted in the
+eXtensible Configuration Checklist Description Format (XCCDF).
+&lt;br/&gt;
+&lt;br/&gt;
+Providing system administrators with such guidance informs them how to securely
+configure systems under their control in a variety of network roles.  Policy
+makers and baseline creators can use this catalog of settings, with its
+associated references to higher-level security control catalogs, in order to
+assist them in security baseline creation.  This guide is a &lt;i&gt;catalog, not a
+checklist,&lt;/i&gt; and satisfaction of every item is not likely to be possible or
+sensible in many operational scenarios.  However, the XCCDF format enables
+granular selection and adjustment of settings, and their association with OVAL
+and OCIL content provides an automated checking capability.  Transformations of
+this document, and its associated automated checking content, are capable of
+providing baselines that meet a diverse set of policy objectives.  Some example
+XCCDF &lt;i&gt;Profiles&lt;/i&gt;, which are selections of items that form checklists and
+can be used as baselines, are available with this guide.  They can be
+processed, in an automated fashion, with tools that support the Security
+Content Automation Protocol (SCAP).
+&lt;/description&gt;
+&lt;notice id="terms_of_use"&gt;Do not attempt to implement any of the settings in
+this guide without first testing them in a non-operational environment. The
+creators of this guidance assume no responsibility whatsoever for its use by
+other parties, and makes no guarantees, expressed or implied, about its
+quality, reliability, or any other characteristic.&lt;/notice&gt;
+
+&lt;front-matter&gt;The SCAP Security Guide Project&lt;br/&gt;<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedorahosted.org/scap-security-guide">https://fedorahosted.org/scap-security-guide</a>&lt;/front-matter&gt;
+&lt;rear-matter&gt;Red Hat and Fedora are either registered
+trademarks or trademarks of Red Hat, Inc. in the United States and other
+countries. All other names are registered trademarks or trademarks of their
+respective companies.&lt;/rear-matter&gt;
+&lt;platform idref="cpe:/o:fedoraproject:fedora:19" /&gt;
+&lt;version&gt;0.0.1&lt;/version&gt;
+&lt;/Benchmark&gt;
diff --git a/FEDORA/input/guide.xslt b/FEDORA/input/guide.xslt
new file mode 100644
index 0000000..3ac59e9
--- /dev/null
+++ b/FEDORA/input/guide.xslt
@@ -0,0 +1,148 @@
+&lt;?xml version="1.0"?&gt;
+&lt;xsl:stylesheet version="1.0" xmlns:xsl=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.w3.org/1999/XSL/Transform">"http://www.w3.org/1999/XSL/Transform"</a> xmlns:xccdf=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://checklists.nist.gov/xccdf/1.1">"http://checklists.nist.gov/xccdf/1.1"</a> xmlns:xhtml=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.w3.org/1999/xhtml">"http://www.w3.org/1999/xhtml"</a> xmlns:dc=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://purl.org/dc/elements/1.1/">"http://purl.org/dc/elements/1.1/"</a>&gt;
+
+&lt;!-- This transform assembles all fragments into one "shorthand" XCCDF document --&gt;
+
+  &lt;xsl:template match="Benchmark"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+
+       &lt;!-- adding profiles here --&gt;
+       &lt;!-- Relevant (currently commented-out) document files below to be included
+            later once there is a requirement them to be included (in order to the final
+            XCCDF / OVAL files generation to work properly). For now only those, included
+            below are sufficient. --&gt;
+                &lt;xsl:apply-templates select="document('profiles/test.xml')" /&gt;
+                &lt;!--
+                &lt;xsl:apply-templates select="document('profiles/CS2.xml')" /&gt;
+                &lt;xsl:apply-templates select="document('profiles/common.xml')" /&gt;
+                &lt;xsl:apply-templates select="document('profiles/desktop.xml')" /&gt;
+                &lt;xsl:apply-templates select="document('profiles/server.xml')" /&gt;
+                &lt;xsl:apply-templates select="document('profiles/ftp.xml')" /&gt;
+                &lt;xsl:apply-templates select="document('profiles/stig-rhel6-server.xml')" /&gt;
+                --&gt;</pre>
      </div>
    </blockquote>
    <br>
    Not all of these profiles (yet) exist within the Fedora content. I'd
    delete everything but "common" above.<br>
    <br>
    <br>
    <blockquote
      cite="mid:2043463409.12439929.1379054005823.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+
+
+       &lt;Value id="conditional_clause" type="string" operator="equals"&gt;
+                 &lt;title&gt;A conditional clause for check statements.&lt;/title&gt;
+                 &lt;description&gt;A conditional clause for check statements.&lt;/description&gt;
+                 &lt;value&gt;This is a placeholder.&lt;/value&gt;
+       &lt;/Value&gt;
+      &lt;xsl:apply-templates select="document('intro/intro.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/system.xml')" /&gt;
+        &lt;!--
+      &lt;xsl:apply-templates select="document('services/services.xml')" /&gt;
+        --&gt;
+      &lt;!-- the auxiliary Groups here will be removed prior to some outputs --&gt;
+        &lt;!--
+      &lt;xsl:apply-templates select="document('auxiliary/srg_support.xml')" /&gt;
+        --&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='system']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('system/software/software.xml')" /&gt;
+        &lt;!--
+      &lt;xsl:apply-templates select="document('system/permissions/permissions.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/selinux.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/accounts.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/network.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/logging.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/auditing.xml')" /&gt;</pre>
      </div>
    </blockquote>
    <br>
    These sections should match up to XCCDF files. Apologies if they're
    created in later patches. <br>
    <br>
    <blockquote
      cite="mid:2043463409.12439929.1379054005823.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+        --&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='software']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+        &lt;!--
+      &lt;xsl:apply-templates select="document('system/software/disk_partitioning.xml')" /&gt;
+        --&gt;
+      &lt;xsl:apply-templates select="document('system/software/updating.xml')" /&gt;
+        &lt;!--
+      &lt;xsl:apply-templates select="document('system/software/integrity.xml')" /&gt;
+        --&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+&lt;!--
+  &lt;xsl:template match="Group[@id='accounts']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/restrictions.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/pam.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/session.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/physical.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/banners.xml')" /&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='accounts-restrictions']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/root_logins.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/account_expiration.xml')" /&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='permissions']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('system/permissions/partitions.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/permissions/mounting.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/permissions/files.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/permissions/execution.xml')" /&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='network']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/kernel.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/wireless.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/ipv6.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/iptables.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/ssl.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/uncommon.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/network/ipsec.xml')" /&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+
+  &lt;xsl:template match="Group[@id='services']"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:copy-of select="@*|node()" /&gt;
+      &lt;xsl:apply-templates select="document('services/obsolete.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/base.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/cron.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/ssh.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/xorg.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/avahi.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/printing.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/dhcp.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/ntp.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/mail.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/ldap.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/nfs.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/dns.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/ftp.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/http.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/imap.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/smb.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/squid.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('services/snmp.xml')" /&gt;
+    &lt;/xsl:copy&gt;</pre>
      </div>
    </blockquote>
    <br>
    I'll work on documentation of the build process, and will add to the
    wiki. We can trim this file down some, but this is a GREAT start!<br>
    <br>
    <blockquote
      cite="mid:2043463409.12439929.1379054005823.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+  &lt;/xsl:template&gt;
+--&gt;
+
+  &lt;!-- copy everything else through to final output --&gt;
+  &lt;xsl:template match="@*|node()"&gt;
+    &lt;xsl:copy&gt;
+      &lt;xsl:apply-templates select="@*|node()" /&gt;
+    &lt;/xsl:copy&gt;
+  &lt;/xsl:template&gt;
+&lt;/xsl:stylesheet&gt;
<div class="moz-txt-sig">-- 
1.7.11.7

</div></pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>