scap-security-guide January 2013

scap-security-guide@lists.fedorahosted.org

12 participants
74 discussions

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

[PATCH 5/6] Finished USGCB profile
by Shawn Wells 07 Feb '13

07 Feb '13

6 10

adding "fix"es to the xccdf
by Brian Millett 05 Feb '13

05 Feb '13

I'm really interested in adding fixes, or having a set of fixes I can apply to the xccdf for rhel6. I've looked at the line in the Makefile: xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o $(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/unlinked-rhel6-xccdf.xml and it looks like, following the bas-ks.xml, I can create a file with each fix as long as each fix-id is the same as the rule-id so that the fix can be merged with the appropriate rule into a final xccdf.xml file. At least, that is what it seems. I uncommented the line in the Makefile and remade it, however, nothing was added to the final xccdf.xml file, and there are not any make errors, so Any documentation or ideas where to look? Thanks. -- Brian Millett "My brain feels like its been sucked out through my ear." -- [ Londo, "Born to the Purple"]

4 8

[PATCH 6/6] Created SSG Manpage, shortened RPM "Description" text
by Shawn Wells 05 Feb '13

05 Feb '13

3 3

Initial setup
by Christopher Anderson 02 Feb '13

02 Feb '13

Walking through the initial setup was pretty quick an easy. I had no problems with the main wiki page and the usage guide page. I did find what appear to be small errors here and there, which I'll walk through. The page titled "Becoming an SCAP Security Guide Developer" (https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper) seems to have a few issues. First, under "Establishing your Accounts", there are three items all numbered 1. Second, under "Performing your first git clone", the command example shows acquiring the source via git and the ssh protocol. This should fail as the Fedora Account setup and request to join this group (and gaining ssh access) happens in step 6 of the next section. Consider changing the protocol to git: git clone git://git.fedorahosted.org/git/scap-security-guide.git Third, under "Submitting Proposed Changes" step 1, the command example asks the user to ensure their changes are valid by running "make; make validate" without specifying a directory. With a little experimentation it is easy to figure out that "make" will work from the top level directory in the source tree, but "make validate" must be run from the RHEL6 directory. I'm not sure if validate should be added to the top level Makefile, or if a rewording of the item to clarify would be better. With the exception of that page, I haven't found anything else. The pages are well thought out and I have yet to find even a spelling error in the wiki. Chris

2 1

patch to the RHEL6/Makefile
by Brian Millett 01 Feb '13

01 Feb '13

When running make, I get the following error Duplicate ID, which will not be added: state_mode_0000 Duplicate ID, which will not be added: state_uid_0 Duplicate ID, which will not be added: state_gid_0 xmllint --format --output output/unlinked-rhel6-oval.xml output/unlinked-rhel6-oval.xml transforms/cpe_generate.py output/unlinked-rhel6-oval.xml input/checks/platform/rhel6-cpe-dictionary.xml ssg transforms/relabelids.py unlinked-rhel6-xccdf.xml ssg transforms/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml ssg mkdir -p dist/guide dist/content dist/policytables cp output/rhel6-guide.html dist/guide cp output/ssg-rhel6-xccdf.xml dist/content cp output/ssg-rhel6-oval.xml dist/content cp: cannot stat ‘output/ssg-rhel6-oval.xml’: No such file or directory patch to get it to make correctly [bpm]$ diff -wruN Makefile.orig Makefile --- Makefile.orig 2013-01-30 13:47:55.554661112 -0600 +++ Makefile 2013-01-30 13:48:07.914662435 -0600 @@ -109,6 +109,7 @@ $(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml $(ID) $(TRANS)/relabelids.py unlinked-rhel6-xccdf.xml $(ID) $(TRANS)/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml $(ID) + $(TRANS)/relabelids.py unlinked-rhel6-oval.xml $(ID) # not ready until oscap resolve behavior resolved content-stig: shorthand2xccdf guide checks -- Brian Millett "I'd like to live just long enough to be there when they cut off your head and stick it on a pike as a warning to the next ten generations that some favors some with too high a price. I want to look up into your lifeless eyes and wave like this. Can you and your associates arrange that for me, Mr. Morden?" -- [ Vir (re: What do you want?), "In the Shadow of Z'Ha'Dum"]

2 2

[PATCH 4/6] Added value for var_account_disable_post_pw_expiration
by Shawn Wells 31 Jan '13

31 Jan '13

2 1

[PATCH 2/6] Creation of USGCB profile
by Shawn Wells 31 Jan '13

31 Jan '13

2 1

[PATCH] Consistent Mechanism for Kernel Module Disabling
by Mike Palmiotto 31 Jan '13

31 Jan '13

The community has decided to use a consistent mechanism for disabling kernel modules. Currently there is a mixture of `alias [kernel_module] off,` `install [kernel_module] /bin/true,` and `install [kernel_module] /bin/false.` This patch makes all instances of kernel module disabling consistently use: `install [kernel_module] /bin/false.` Mike Palmiotto (1): Change kernel module disabling to use /bin/false. RHEL6/input/checks/kernel_module_bluetooth_disabled.xml | 4 ++-- RHEL6/input/checks/kernel_module_cramfs_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_dccp_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_freevxfs_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_hfs_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_hfsplus_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_jffs2_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_rds_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_sctp_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_squashfs_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_tipc_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_udf_disabled.xml | 2 +- RHEL6/input/checks/kernel_module_usb-storage_disabled.xml | 2 +- RHEL6/input/checks/templates/template_kernel_module_disabled | 2 +- RHEL6/input/system/network/wireless.xml | 4 ++-- 15 files changed, 17 insertions(+), 17 deletions(-) -- 1.7.11.7

2 2

[PATCH 3/6] [bugfix]set_sysctl_net_ipv6_conf_default_accept_ra didn't have OVAL value passed through
by Shawn Wells 30 Jan '13

30 Jan '13

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2013