From shawn at redhat.com Thu Aug 20 11:31:06 2015
Content-Type: multipart/mixed; boundary="===============2649807049057804651=="
MIME-Version: 1.0
From: Shawn Wells <shawn at redhat.com>
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: [PATCH] added support for Groups that exist only for some outputs
 * this is intended to allow documentation of SRG satisfaction,
 for that table (but not final XCCDF output)
Date: Mon, 07 May 2012 10:04:24 -0400
Message-ID: <4FA7D668.1040704@redhat.com>
In-Reply-To: 1336329185-12253-2-git-send-email-blank@eclipse.ncsc.mil

--===============2649807049057804651==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

On 5/6/12 2:33 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank(a)eclipse.ncsc.mil>
> ---
>   rhel6/src/Makefile                        |    2 +-
>   rhel6/src/input/auxiliary/srg_support.xml |   37 ++++++++++++++++++++++=
+++++++
>   rhel6/src/input/guide.xslt                |    2 +
>   rhel6/src/transforms/xccdf-removeaux.xslt |   22 +++++++++++++++++
>   4 files changed, 62 insertions(+), 1 deletions(-)
>   create mode 100644 rhel6/src/input/auxiliary/srg_support.xml
>   create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt
>
> diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
> index 9d75999..0afe594 100644
> --- a/rhel6/src/Makefile
> +++ b/rhel6/src/Makefile
> @@ -112,7 +112,7 @@ eval-ftp:
>   eval-common:
>   	oscap xccdf eval --profile common --results /tmp/results-test.xml $(OU=
T)/rhel6-xccdf-scap-security-guide.xml
>
> -dist: content guide tables
> +dist: tables guide content
>   	$(call MKDIR,$(DIST)/guide)
>   	$(call MKDIR,$(DIST)/content)
>   	$(call MKDIR,$(DIST)/policytables)
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/=
auxiliary/srg_support.xml
> new file mode 100644
> index 0000000..de24ea5
> --- /dev/null
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -0,0 +1,37 @@
> +<Group id=3D"srg_support" hidden=3D"true">
> +<title>Documentation to Support DISA OS SRG Mapping</title>
> +<description>These groups exist to document how the Red Hat Enterprise L=
inux
> +product meets (or does not meet) requirements listed in the DISA OS SRG,=
 for
> +those cases where Groups or Rules elsewhere in scap-security-guide do
> +not clearly relate.
> +</description>
> +
> +<Group id=3D"met_inherently" hidden=3D"true">
> +<title>Product Meets this Requirement</title>
> +<description>
> +Red Hat Enterprise Linux meets this requirement by design.
> +<!-- We could include discussion of Common Criteria Testing if so
> +     desired here. -->
> +</description>
> +<ref disa=3D"131" />
> +</Group>
> +
> +<Group id=3D"unmet_impractical_guidance" hidden=3D"true">
> +<title>Guidance Does Not Meet this Requirement Due to Impracticality or =
Scope</title>
> +<description>
> +The guidance does not meet this requirement.
> +The requirement is impractical or out of scope.
> +</description>
> +<ref disa=3D"354,1094" />
> +</Group>
> +
> +<Group id=3D"unmet_impractical_product" hidden=3D"true">
> +<title>Product Does Not Meet this Requirement Due to Impracticality or S=
cope</title>
> +<description>
> +The product does not meet this requirement.
> +The requirement is impractical or out of scope.
> +</description>
> +<ref disa=3D"" />
> +</Group>
> +
> +</Group>
> diff --git a/rhel6/src/input/guide.xslt b/rhel6/src/input/guide.xslt
> index bdba280..ee40446 100644
> --- a/rhel6/src/input/guide.xslt
> +++ b/rhel6/src/input/guide.xslt
> @@ -7,6 +7,8 @@
>         <xsl:apply-templates select=3D"document('intro/intro.xml')" />
>         <xsl:apply-templates select=3D"document('system/system.xml')" />
>         <xsl:apply-templates select=3D"document('services/services.xml')"=
 />
> +<!-- the auxiliary Groups here will be removed prior to some outputs -->
> +<xsl:apply-templates select=3D"document('auxiliary/srg_support.xml')" />
>       </xsl:copy>
>     </xsl:template>
>
> diff --git a/rhel6/src/transforms/xccdf-removeaux.xslt b/rhel6/src/transf=
orms/xccdf-removeaux.xslt
> new file mode 100644
> index 0000000..788969e
> --- /dev/null
> +++ b/rhel6/src/transforms/xccdf-removeaux.xslt
> @@ -0,0 +1,22 @@
> +<?xml version=3D"1.0"?>
> +<xsl:stylesheet version=3D"1.0" xmlns:xsl=3D"http://www.w3.org/1999/XSL/=
Transform" xmlns:xccdf=3D"http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml=
=3D"http://www.w3.org/1999/xhtml" exclude-result-prefixes=3D"xccdf">
> +
> +<!-- This transform removes Groups from the XCCDF document.  In general,=
 these
> +     are expected to be Groups added from files in the inputs/auxiliary
> +     directory.  -->
> +
> +
> +<!-- remove the srg_support Group from final output, as it exists only to
> +       support the OS SRG mapping -->
> +<xsl:template match=3D"xccdf:Group[@id=3D'srg_support']">
> +</xsl:template>
> +
> +
> +<!-- copy everything else through to final output -->
> +<xsl:template match=3D"@*|node()">
> +<xsl:copy>
> +<xsl:apply-templates select=3D"@*|node()" />
> +</xsl:copy>
> +</xsl:template>
> +
> +</xsl:stylesheet>

Ack, but FYI:

[shawn(a)rhel6 scap-security-guide]$ git apply /tmp/scappatches/jeffaux.pat=
ch
/tmp/scappatches/jeffaux.patch:42: trailing whitespace.
<!-- We could include discussion of Common Criteria Testing if so
warning: 1 line adds whitespace errors.




--===============2649807049057804651==--