scap-security-guide June 2013

scap-security-guide@lists.fedorahosted.org

20 participants
35 discussions

Start a nNew thread

[PATCH 0/5] Various OVAL cleanups
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 3/4] Created remediation template
by Shawn Wells 09 Jun '13

09 Jun '13

3 5

[PATCH 4/4] Created service_*_disabled remediation scripts
by Shawn Wells 09 Jun '13

09 Jun '13

3 3

[PATCH] Module is freevxfs, not freevsfs
by Maura Dailey 07 Jun '13

07 Jun '13

Tiny typo fix. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/system/permissions/mounting.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 6180b48..897d45f 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -168,7 +168,7 @@ local system should be disabled.</rationale> <Rule id="disable_module_freevxfs"> <title>Disable Mounting of <tt>freevxfs</tt></title> <description> -<module-disable-macro module="freevsfs" /> +<module-disable-macro module="freevxfs" /> This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the -- 1.7.1

2 1

[PATCH] Fix build of OpenStack and RHEVM3 parts on Fedora 18+
by Šimon Lukašík 07 Jun '13

07 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> --- OpenStack/Makefile | 3 ++- OpenStack/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ OpenStack/transforms/shorthand2xccdf.xslt | 3 --- RHEVM3/Makefile | 3 ++- RHEVM3/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ RHEVM3/transforms/shorthand2xccdf.xslt | 3 --- 6 files changed, 34 insertions(+), 8 deletions(-) create mode 100644 OpenStack/transforms/add_xccdf_namespace.xslt create mode 100644 RHEVM3/transforms/add_xccdf_namespace.xslt diff --git a/OpenStack/Makefile b/OpenStack/Makefile index f1c49b2..69280a1 100644 --- a/OpenStack/Makefile +++ b/OpenStack/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/openstack-shorthand.xml $(OUT)/openstack-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-openstack-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-openstack-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-openstack-xccdf-prerefs.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-openstack-xccdf.xml xsltproc -stringparam profile "stig-openstack-server" -o $(OUT)/unlinked-openstack-xccdf.xml \ diff --git a/OpenStack/transforms/add_xccdf_namespace.xslt b/OpenStack/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/OpenStack/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/OpenStack/transforms/shorthand2xccdf.xslt b/OpenStack/transforms/shorthand2xccdf.xslt index c25323d..ef6be4b 100644 --- a/OpenStack/transforms/shorthand2xccdf.xslt +++ b/OpenStack/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> diff --git a/RHEVM3/Makefile b/RHEVM3/Makefile index c5d1c29..9f523ed 100644 --- a/RHEVM3/Makefile +++ b/RHEVM3/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/rhevm3-shorthand.xml $(OUT)/rhevm3-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhevm3-xccdf-prerefs.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml xsltproc -stringparam profile "stig-rhevm3-server" -o $(OUT)/unlinked-rhevm3-xccdf.xml \ diff --git a/RHEVM3/transforms/add_xccdf_namespace.xslt b/RHEVM3/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/RHEVM3/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/RHEVM3/transforms/shorthand2xccdf.xslt b/RHEVM3/transforms/shorthand2xccdf.xslt index aa50713..54a0d68 100644 --- a/RHEVM3/transforms/shorthand2xccdf.xslt +++ b/RHEVM3/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> -- 1.8.2.1

2 1

[PATCH] Fix build on Fedora 18+ and the upcoming RHEL release
by Šimon Lukašík 07 Jun '13

07 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> Previously, the xccdf namespace has been added to the shorthand document by <xsl:attribute>. Newer libxml releases are more strict and do not allow attributes named "xmlns". Which is explicitly forbiden by XSLT specification. http://www.w3.org/TR/xslt#creating-attributes Addressing: xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error --- RHEL6/Makefile | 3 ++- RHEL6/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 3 --- 3 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 RHEL6/transforms/add_xccdf_namespace.xslt diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 9214ce9..d34b127 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml + xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml + xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml oscap xccdf resolve -o $(OUT)/unlinked-rhel6-xccdf.xml $(OUT)/unlinked-unresolved-rhel6-xccdf.xml diff --git a/RHEL6/transforms/add_xccdf_namespace.xslt b/RHEL6/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/RHEL6/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index 1a849e2..39f6741 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> -- 1.8.2.1

2 1

[PATCH] Subexpression datatype shall equal to the variable datatype
by Šimon Lukašík 06 Jun '13

06 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> Default datatype is string. Addressing: $ make validate oval:ssg:var:2115 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2117 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2122 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2126 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2127 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2130 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2135 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2139 - inconsistent datatype between the variable and an associated var_ref --- RHEL6/input/checks/accounts_disable_post_pw_expiration.xml | 2 +- RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml | 2 +- RHEL6/input/checks/accounts_maximum_age_login_defs.xml | 2 +- RHEL6/input/checks/accounts_minimum_age_login_defs.xml | 2 +- RHEL6/input/checks/accounts_password_minlen_login_defs.xml | 2 +- RHEL6/input/checks/accounts_password_warn_age_login_defs.xml | 2 +- RHEL6/input/checks/auditd_data_retention_max_log_file.xml | 2 +- RHEL6/input/checks/auditd_data_retention_num_logs.xml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml index b93ee63..429e9db 100644 --- a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml +++ b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_default_useradd_inactive" version="1"> - <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" /> + <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" datatype="int" /> </ind:textfilecontent54_state> <ind:textfilecontent54_state id="state_etc_default_useradd_inactive_nonnegative" version="1"> diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml index 53a9d13..eda8052 100644 --- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml +++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_maxlogins" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" /> + <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" /> diff --git a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml index 0640a3e..090435a 100644 --- a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_password_max_age" version="1"> - <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" /> + <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="maximum password age" datatype="int" id="var_password_max_age" version="1" /> diff --git a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml index 21b02af..6de9779 100644 --- a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="minimum password age in days" datatype="int" id="var_password_min_age" version="1" /> diff --git a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml index 76d2132..4dd66c8 100644 --- a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml +++ b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml @@ -37,7 +37,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_password_min_len" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="password minimum length" datatype="int" id="var_password_min_len" version="1" /> diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml index ed4fb8f..7c153e7 100644 --- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml @@ -27,7 +27,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="password expiration warning age in days" datatype="int" id="var_password_warn_age" version="1" /> diff --git a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml index b8aba36..7087e7a 100644 --- a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml +++ b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" /> + <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="audit max_log_file settting" datatype="int" id="var_auditd_max_log_file" version="1" /> diff --git a/RHEL6/input/checks/auditd_data_retention_num_logs.xml b/RHEL6/input/checks/auditd_data_retention_num_logs.xml index ad2fc7e..b46e734 100644 --- a/RHEL6/input/checks/auditd_data_retention_num_logs.xml +++ b/RHEL6/input/checks/auditd_data_retention_num_logs.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_auditd_data_retention_num_logs" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" /> + <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="audit num_logs settting" datatype="int" id="var_auditd_num_logs" version="1" /> -- 1.8.2.1

2 1

[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation
by Jeffrey Blank 06 Jun '13

06 Jun '13

This is a step along the path toward support for remediation content development, but it is only one step. This patchset also cleans up some other code. It has not been tested, but it appears to emit "<sub>" elements in the manner OpenSCAP can process, so that parameters can be provided to remediation scripts. Documentation/instructions are still needed. It should be apparent from the example that scripts which use parameters will need to "source" a support file and also declare which environment variables they expect to have populated by XCCDF values (using the "populate" function). This patch is only to enable example remediation content, which may be suitable for testing. The SSG project/community will be ready for remediation content en masse when there is evidence of sufficient interest in the checking mechanisms, upon which any remediation effort would naturally depend. Jeffrey Blank (4): example remediation script which takes a parameter incomplete support file for bash remediations * does at least warn when undefined variable exists rewrite of combinefixes.py to handle parameters for OpenSCAP remedation generation made xccdf-addfixes insert all text and child nodes of a fix RHEL6/input/fixes/bash/set_system_login_banner.sh | 6 ++ RHEL6/input/fixes/bash/templates/support.sh | 9 ++ RHEL6/transforms/combinefixes.py | 97 +++++++++----------- RHEL6/transforms/xccdf-addfixes.xslt | 2 +- 4 files changed, 60 insertions(+), 54 deletions(-) create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh create mode 100644 RHEL6/input/fixes/bash/templates/support.sh

3 8

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

[PATCH 0/4] Remediation Templates
by Shawn Wells 04 Jun '13

04 Jun '13

6 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2013