6:39 p.m.
This transform adds rows from an SRG mapping table to the STIG rules table, so
that the resulting table includes information for every SRG item.
It is incomplete: it still needs to grab the correct "check" text which
describes how the RHEL product satisfies (or cannot satisfy) a particular
SRG requirement. In some cases, this text still needs to be
written.
This can be resolved in short order through changes to the output in the SRG mapping
table.
Jeffrey Blank (4):
added xhtml files to gitignore in output
new transform to add items from an SRG mapping table to a Rule table
added new Rules to create Rule table, including any SRG items not
tied to specific configuration action
fixed characters to escape ampersand
RHEL6/Makefile | 4 ++-
RHEL6/input/system/software/integrity.xml | 2 +-
RHEL6/output/.gitignore | 1 +
RHEL6/transforms/table-add-srgitems.xslt | 56 +++++++++++++++++++++++++++++
4 files changed, 61 insertions(+), 2 deletions(-)
create mode 100644 RHEL6/transforms/table-add-srgitems.xslt
6:39 p.m.
New subject: [PATCH 1/4] added xhtml files to gitignore in output
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/output/.gitignore | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/RHEL6/output/.gitignore b/RHEL6/output/.gitignore
index 97ea8ba..2fdb145 100644
--- a/RHEL6/output/.gitignore
+++ b/RHEL6/output/.gitignore
@@ -1,6 +1,7 @@
# files not to track in git
*.xml
*.html
+*.xhtml
*.pdf
*.ini
*.spec
--
1.7.1
6:39 p.m.
New subject: [PATCH 2/4] new transform to add items from an SRG mapping table to a Rule table
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/transforms/table-add-srgitems.xslt | 56 ++++++++++++++++++++++++++++++
1 files changed, 56 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/transforms/table-add-srgitems.xslt
diff --git a/RHEL6/transforms/table-add-srgitems.xslt
b/RHEL6/transforms/table-add-srgitems.xslt
new file mode 100644
index 0000000..af40bb4
--- /dev/null
+++ b/RHEL6/transforms/table-add-srgitems.xslt
@@ -0,0 +1,56 @@
+<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
xmlns:cci="http://iase.disa.mil/cci">
+
+<!-- this transform "fills out" a table of Rules with any SRG items (from an
SRG mapping table)
+ that are not already included -->
+
+<xsl:variable name="srgtable"
select="document('../output/table-rhel6-srgmap-flat.xhtml')/html/body/table"
/>
+<xsl:variable name="cci_list"
select="document('../references/disa-cci-list.xml')/cci:cci_list" />
+
+
+<xsl:template match="table">
+ <xsl:variable name="ruletable" select="." />
+ <table>
+ <!-- copy the existing table in -->
+ <xsl:apply-templates />
+ <!-- then copy any SRG items not already included -->
+ <xsl:for-each select="$srgtable/tr">
+ <xsl:variable name="srg_id" select="td[1]"/>
+ <xsl:variable name="cci_id" select="td[2]"/>
+ <xsl:variable name="title" select="td[3]"/>
+
+ <xsl:if test="not($ruletable/tr[td[7]=$srg_id])" >
+ <tr>
+ <td>TBD</td>
+ <td>medium</td> <!-- based ONLY on the fact that all OS SRG
items have "medium" severity -->
+ <td> <xsl:value-of select="$title" /> </td>
+ <td> <xsl:value-of select="td[4]" /> </td>
+ <td> <xsl:value-of select="td[7]" /> </td>
+ <td> <xsl:value-of select="td[7]" /> </td>
+ <td> <xsl:value-of select="$srg_id" /> </td>
+ <td> <xsl:value-of select="$cci_id" /> </td>
+ <td>
+ <xsl:for-each select="$cci_list/cci:cci_items/cci:cci_item">
+ <xsl:if test="@id=$cci_id">
+ <xsl:for-each select="cci:references/cci:reference">
+ <xsl:if test="@title='NIST SP 800-53'">
+ <xsl:value-of select="@index"/>
+ </xsl:if>
+ </xsl:for-each>
+ </xsl:if>
+ </xsl:for-each>
+ </td>
+ </tr>
+ </xsl:if>
+
+ </xsl:for-each>
+ </table>
+</xsl:template>
+
+
+<xsl:template match="@*|node()" >
+ <xsl:copy>
+ <xsl:apply-templates select="@*|node()"/>
+ </xsl:copy>
+</xsl:template>
+
+</xsl:stylesheet>
--
1.7.1
6:39 p.m.
New subject: [PATCH 3/4] added new Rules to create Rule table, including any SRG items not tied to specific configuration action
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/Makefile | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 1e59adf..f805db7 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -69,8 +69,9 @@ table-srgmap: shorthand2xccdf
$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
xsltproc -stringparam flat "y" -stringparam map-to-items
"../$(OUT)/unlinked-rhel6-xccdf.xml" -o $(OUT)/table-rhel6-srgmap-flat.html \
$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
+ xmllint --xmlout --html --output $(OUT)/table-rhel6-srgmap-flat.xhtml
$(OUT)/table-rhel6-srgmap-flat.html
-table-stigs: shorthand2xccdf
+table-stigs: shorthand2xccdf table-srgmap
xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml
xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
xsltproc --html -o $(OUT)/table-rhel5-stig-manual-ccisorted.html
$(TRANS)/table-sortbyref.xslt $(OUT)/table-rhel5-stig-manual.html
@@ -91,6 +92,7 @@ table-stigs: shorthand2xccdf
xsltproc -stringparam profile "stig-rhel6-server" -stringparam format
"flat" -o $(OUT)/table-stig-rhel6-server-flat.html \
$(TRANS)/xccdf2table-profileccirefs.xslt \
$(OUT)/unlinked-stig-rhel6-xccdf.xml
+ xsltproc --novalid --html -o $(OUT)/table-stig-rhel6-server-flat-srgs.html
$(TRANS)/table-add-srgitems.xslt $(OUT)/table-stig-rhel6-server-flat.html
xsltproc --html -o $(OUT)/table-stig-rhel6-server-flat.html
$(TRANS)/table-add-vulnids.xslt $(OUT)/table-stig-rhel6-server-flat.html
tables: table-refs table-idents table-profilenistrefs table-srgmap table-stigs
--
1.7.1
6:39 p.m.
New subject: [PATCH 4/4] fixed characters to escape ampersand
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/system/software/integrity.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/software/integrity.xml
b/RHEL6/input/system/software/integrity.xml
index 54c106c..2aa54a2 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -181,7 +181,7 @@ OR
</description>
<ocil clause="there is output"> The following command will list which
files on the system
have file hashes different from what is expected by the RPM database.
-<pre># rpm -Va | grep '$1 ~ /..5/ && $2 !=
"c"'</pre>
+<pre># rpm -Va | grep '$1 ~ /..5/ && $2 !=
"c"'</pre>
</ocil>
<rationale>
The hash on important files like system executables should match the information given
--
1.7.1
6:43 p.m.
Ack & pushed.
There is no time to wait.
On 12/07/2012 07:39 PM, Jeffrey Blank wrote:
This transform adds rows from an SRG mapping table to the STIG rules
table, so
that the resulting table includes information for every SRG item.
It is incomplete: it still needs to grab the correct "check" text which
describes how the RHEL product satisfies (or cannot satisfy) a particular
SRG requirement. In some cases, this text still needs to be
written.
This can be resolved in short order through changes to the output in the SRG mapping
table.
Jeffrey Blank (4):
added xhtml files to gitignore in output
new transform to add items from an SRG mapping table to a Rule table
added new Rules to create Rule table, including any SRG items not
tied to specific configuration action
fixed characters to escape ampersand
RHEL6/Makefile | 4 ++-
RHEL6/input/system/software/integrity.xml | 2 +-
RHEL6/output/.gitignore | 1 +
RHEL6/transforms/table-add-srgitems.xslt | 56 +++++++++++++++++++++++++++++
4 files changed, 61 insertions(+), 2 deletions(-)
create mode 100644 RHEL6/transforms/table-add-srgitems.xslt
4166
days inactive
4166
days old
scap-security-guide@lists.fedorahosted.org
5 comments
1 participants
participants (1)
-
Jeffrey Blank