>From 01f8c68090a289bd254d82c8a7f9d596b5a8159a Mon Sep 17 00:00:00 2001
From: Jeffrey Blank <blank@eclipse.ncsc.mil>
Date: Fri, 13 Apr 2012 13:10:00 -0400
Subject: [PATCH] a transform for adding <fixes> and some example files

---
 rhel6/src/Makefile                       |    2 +
 rhel6/src/input/fixes/bash.xml           |    4 +++
 rhel6/src/input/fixes/puppet-clip.xml    |    4 +++
 rhel6/src/transforms/xccdf-addfixes.xslt |   38 ++++++++++++++++++++++++++++++
 4 files changed, 48 insertions(+), 0 deletions(-)
 create mode 100644 rhel6/src/input/fixes/bash.xml
 create mode 100644 rhel6/src/input/fixes/puppet-clip.xml
 create mode 100644 rhel6/src/transforms/xccdf-addfixes.xslt

diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
index 756f49f..cadafaf 100644
--- a/rhel6/src/Makefile
+++ b/rhel6/src/Makefile
@@ -13,6 +13,8 @@ shorthand-guide:
 shorthand2xccdf:
 	xsltproc -o ${OUT}/rhel6-xccdf-noprofiles.xml ${TRANS}/shorthand2xccdf.xslt ${OUT}/rhel6-shorthand.xml
 	xsltproc -stringparam profile "allprofiles" -o ${OUT}/rhel6-xccdf.xml ${TRANS}/xccdf-addprofiles.xslt ${OUT}/rhel6-xccdf-noprofiles.xml
+	xsltproc -stringparam fixes "../${IN}/fixes/bash.xml" -o ${OUT}/rhel6-xccdf.xml ${TRANS}/xccdf-addfixes.xslt ${OUT}/rhel6-xccdf.xml
+#	xsltproc -stringparam fixes "../${IN}/fixes/puppet-clip.xml" -o ${OUT}/rhel6-xccdf.html ${TRANS}/xccdf-addfixes.xslt ${OUT}/rhel6-xccdf.xml
 	xmllint --format --output ${OUT}/rhel6-xccdf.xml ${OUT}/rhel6-xccdf.xml 
 
 checks:
diff --git a/rhel6/src/input/fixes/bash.xml b/rhel6/src/input/fixes/bash.xml
new file mode 100644
index 0000000..7550b9f
--- /dev/null
+++ b/rhel6/src/input/fixes/bash.xml
@@ -0,0 +1,4 @@
+<fix-group id="bash" system="urn:xccdf:fix:script:bash" xmlns="http://checklists.nist.gov/xccdf/1.1">
+<fix rule="disable_vsftp">service vsftpd stop</fix>
+<fix rule="install_aide">yum install aide</fix>
+</fix-group>
diff --git a/rhel6/src/input/fixes/puppet-clip.xml b/rhel6/src/input/fixes/puppet-clip.xml
new file mode 100644
index 0000000..18046b1
--- /dev/null
+++ b/rhel6/src/input/fixes/puppet-clip.xml
@@ -0,0 +1,4 @@
+<fix-group id="puppet-clip" system="urn:xccdf:fix:script:puppet" xmlns="http://checklists.nist.gov/xccdf/1.1">
+<fix rule="disable_vsftp">class vsftp</fix>
+<fix rule="install_aide">class aide</fix>
+</fix-group>
diff --git a/rhel6/src/transforms/xccdf-addfixes.xslt b/rhel6/src/transforms/xccdf-addfixes.xslt
new file mode 100644
index 0000000..26a14bd
--- /dev/null
+++ b/rhel6/src/transforms/xccdf-addfixes.xslt
@@ -0,0 +1,38 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
+
+<!-- This transform expects a stringparam "fixes" specifying a filename
+     containing a list of fixes.  It inserts these into the Rules 
+     specified inside the fixes file. -->
+
+<xsl:variable name="fixgroup" select="document($fixes)/xccdf:fix-group" />
+<xsl:variable name="fixsystem" select="$fixgroup/@system"/>
+
+  <xsl:template match="xccdf:Rule">
+    <xsl:copy>
+	  <!-- deal with the fact that oscap demands fixes stand only before checks -->
+      <xsl:apply-templates select="@*|node()[not(self::xccdf:check)]"/>
+
+      <xsl:variable name="rule_id" select="@id"/>
+      <xsl:for-each select="$fixgroup/xccdf:fix"> 
+        <xsl:if test="@rule=$rule_id">
+          <xsl:element name="fix" namespace="http://checklists.nist.gov/xccdf/1.1">
+          <xsl:attribute name="system"><xsl:value-of select="$fixsystem"/></xsl:attribute>
+          <xsl:value-of select="text()"/>
+          </xsl:element>
+        </xsl:if>
+      </xsl:for-each> 
+      <xsl:apply-templates select="node()[self::xccdf:check]"/>
+
+    </xsl:copy>
+  </xsl:template>
+
+
+  <!-- copy everything else through to final output -->
+  <xsl:template match="@*|node()">
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+    </xsl:copy>
+  </xsl:template>
+
+</xsl:stylesheet>
-- 
1.7.1