Re: Problems with adding custom checks

Thursday, 8 December 2016

Hello,

Sorry for such a delay in reponse.

On Thu, Dec 1, 2016 at 9:54 PM, Michael Ward <
Michael.Ward(a)melbourneit.com.au&gt; wrote:

...
 Hey,

 I’m hoping someone on this list can point me in the direction of what I’m
 doing wrong..

 We would like to add some custom checks specific to our environment to the
 scap-security-guide content.

 Since this is the first time I’ve tried to write any OVAL or XCCDF
 content, I thought I’d start with a nice simple package installed check for
 RHEL 6 (vmware-tools-core) as a method of learning more about how it all
 hangs together.

 So I created an OVAL file based on some of the other package installed
 ones:

 $ cat RHEL/6/input/oval/package_vmware-tools-core_installed.xml

 <def-group>

   <definition class="compliance"
id="package_vmware-tools-core_installed"

   version="1">

     <metadata>

       <title>Package vmware-tools-core Installed</title>

       <affected family="unix">

         <platform>Red Hat Enterprise Linux 6</platform>

       </affected>

       <description>The RPM package vmware-tools-core should be
 installed.</description>

     </metadata>

     <criteria>

       <criterion comment="package vmware-tools-core is installed"

       test_ref="test_package_vmware-tools-core_installed" />

     </criteria>

   </definition>

   <linux:rpminfo_test check="all" check_existence="all_exist"

   id="test_package_vmware-tools-core_installed" version="1"

   comment="package vmware-tools-core is installed">

     <linux:object object_ref="obj_package_vmware-tools-core_installed"
/>

   </linux:rpminfo_test>

   <linux:rpminfo_object id="obj_package_vmware-tools-core_installed"
 version="1">

     <linux:name>vmware-tools-core</linux:name>

   </linux:rpminfo_object>

 </def-group>

 And created a group / rule for it in xccdf:

 $ cat RHEL/6/input/xccdf/system/test.xml

 <Group id="test">

 <title>Test Checks</title>

 <description>Test Checks stuff..

 and stuff...</description>

 <Rule id="package_vmware-tools-core_installed"
severity="medium">

 <title>VMWare Tools must be installed</title>

 <description>

 VMWare Tools must be installed on all VMware based VM's.

 <yum-macro install="true" package="vmware-tools-core"/>

 </description>

 <ocil clause="the package is not installed" >

 <package-check-macro package="vmware-tools-core" />

 <br /><br />

 If the system isn't a VMWare Based VM, this isn't applicable.

 </ocil>

 <rationale>Required package for operational support.</rationale>

 <oval id="package_vmware-tools-core_installed" />

 </Rule>

 </Group>

 Added a line into the common profile (RHEL/6/input/profiles/common.xml:

 <select idref="package_vmware-tools-core_installed"
selected="true" />

 And finally, an entry in the RHEL/6/input/guide.xslt

 <xsl:template match="Group[@id='test']">

     <xsl:copy>

       <xsl:copy-of select="@*|node()" />

       <xsl:apply-templates
select="document('xccdf/services/test.xml')" />

     </xsl:copy>

   </xsl:template>

This should be: <xsl:apply-templates
select="document('xccdf/system/test.xml')"
/>
Also, for some reason, and not really looking into it, having a custom
group seems to not work when guide.xslt is processed;
however if you add <xsl:apply-templates
select="document('xccdf/system/test.xml')"
/> to an existing group, it should work.

...

 However, attempting to make just the RHEL6 content fails:

 $ make

 xsltproc -stringparam ref "nist" -o output/table-rhel6-nistrefs.html
 transforms/xccdf2table-byref.xslt output/xccdf-unlinked-empty-groups.xml

 xsltproc -stringparam profile "common" -o
output/table-rhel6-nistrefs-common.html
 \

                 transforms/xccdf2table-profilenistrefs.xslt
 output/xccdf-unlinked-empty-groups.xml

 xsltproc -o output/table-rhel6-cces.html transforms/xccdf2table-cce.xslt
 output/xccdf-unlinked-empty-groups.xml

 xsltproc -stringparam map-to-items "../output/xccdf-unlinked-empty-groups.xml"
 -o output/table-rhel6-srgmap.html \

                 transforms/table-srgmap.xslt ../../shared/references/disa-
 os-srg-v1r4.xml

 xsltproc -stringparam flat "y" -stringparam map-to-items
 "../output/xccdf-unlinked-empty-groups.xml" -o
output/table-rhel6-srgmap-flat.html
 \

                 transforms/table-srgmap.xslt ../../shared/references/disa-
 os-srg-v1r4.xml

 xmllint --xmlout --html --output output/table-rhel6-srgmap-flat.xhtml
 output/table-rhel6-srgmap-flat.html

 # If openscap on the system supports OVAL-5.11 language version, include
 also OVAL-5.11 checks

 # into final list of OVAL checks

 # RHEL/6/input/oval/oval_5.11 is empty for now!!! Uncomment the next
 statement once required

 # find input/oval/oval_5.11 -maxdepth 1 -type f -name '*.xml' -exec cp {}
 ';'

 # System supports OVAL-5.11 => propagate 'RUNTIME_OVAL_VERSION' variable
 into the environment

 find ../../shared/oval input/oval ../../shared/oval/oval_5.11 -name
 "*.xml" | xargs xmlwf

 env RUNTIME_OVAL_VERSION='5.11' ../../shared/utils/combine-ovals.py
 ../../shared/../config rhel6 ../../shared/oval input/oval
 ../../shared/oval/oval_5.11 > output/unlinked-rhel6-oval.xml

 Merged 499 OVAL checks.

 WARNING: OVAL ID 'variable_cd_dvd_drive_alternative_names' is used
 multiple times and should represent the same elements.