Re: [PATCH] [Fedora] Revert 4ee9b7 (Set up Fedora release name and CPE based on build system properties)

[Shawn Wells]

On 12/9/13, 10:31 AM, Jan Lieskovsky wrote:
> This patch reverts the Fedora change performed by:
>    https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=4ee9b7b...
>
> commit.

My original interpretation was that you pushed this, hence the delay. Ack.
> At our internal meeting it has been suggested to me we don't want
> direct Fedora release name in the HTML version of the guide, and
> want supported CPEs listed under "Applicable platforms" section
> of the guide instead.
>
> So make it to follow that requirement.
> Thank you && Regards, Jan.
>
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-Fedora-Revert-4ee9b7-Set-up-Fedora-release-name-and-.patch
>
> From 7d74194c1e7ca76617faba3bfca68f7ba9d55b73 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky
> Date: Mon, 9 Dec 2013 16:22:21 +0100
> Subject: [PATCH] [Fedora] Revert 4ee9b7 (Set up Fedora release name and CPE
>   based on build system properties)
> Signed-off-by: Jan Lieskovsky
>
> Fedora/Makefile                   |  14 +----
>   Fedora/input/guide.xml            |  14 +++--
>   Fedora/scap-security-guide.spec   |   1 +
>   Fedora/transforms/genguidexslt.py | 115 --------------------------------------
>   4 files changed, 11 insertions(+), 133 deletions(-)
>   delete mode 100755 Fedora/transforms/genguidexslt.py
>
> diff --git a/Fedora/Makefile b/Fedora/Makefile
> index 0072a67..1dee3a0 100644
> --- a/Fedora/Makefile
> +++ b/Fedora/Makefile
> @@ -7,19 +7,10 @@ DIST = dist
>   ID = ssg
>   PROD = fedora
>
> -FEDORA_GUIDE_XSLT = fedora_guide.xslt
> -FEDORA_GUIDE_XML = fedora_guide.xml
> all: shorthand2xccdf guide content dist
>
> -set-fedora-release:
> -#	obtain full Fedora release name and CPE from the system
> $(TRANS)/genguidexslt.py $(OUT)/$(FEDORA_GUIDE_XSLT)
>
> -#	update Fedora/input/guide.xml based on retrieved values
> xsltproc -o $(OUT)/$(FEDORA_GUIDE_XML) $(OUT)/$(FEDORA_GUIDE_XSLT) $(IN)/guide.xml
>
> -shorthand-guide: set-fedora-release
> xsltproc -o $(OUT)/$(ID)-$(PROD)-shorthand.xml $(IN)/guide.xslt $(OUT)/$(FEDORA_GUIDE_XML)
>
> +shorthand-guide:
>
> xsltproc -o $(OUT)/$(ID)-$(PROD)-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml
> xmllint --format --output $(OUT)/$(ID)-$(PROD)-shorthand.xml $(OUT)/$(ID)-$(PROD)-shorthand.xml
>
> shorthand2xccdf: shorthand-guide
>
> @@ -68,6 +59,5 @@ eval-common: content
>
> clean:
>    rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf  $(OUT)/*.spec $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
> rm -f $(OUT)/$(FEDORA_GUIDE_XSLT)
> rm -f $(IN)/fixes/bash/templates/output/*.sh
> rm -rf $(DIST)/content
>
> diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
> index ddc6904..c440e6f 100644
> --- a/Fedora/input/guide.xml
> +++ b/Fedora/input/guide.xml
> @@ -1,11 +1,11 @@
>
>   <?xml version="1.0"?>
>
> -<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns:xhtml="http://www.w3.org/1999/xhtml"  xmlns:dc="http://purl.org/dc/elements/1.1/"  id="FEDORA-19" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd"  resolved="false" xml:lang="en-US" >
> +<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns:xhtml="http://www.w3.org/1999/xhtml"  xmlns:dc="http://purl.org/dc/elements/1.1/"  id="FEDORA" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd"  resolved="false" xml:lang="en-US" >
>
> <status date="2011-12-20">draft</status>
> -<title>Guide to the Secure Configuration of <fedora_release/></title>
> -<description>This guide presents a catalog of security-relevant
> -configuration settings for <fedora_release/> formatted in the
> -eXtensible Configuration Checklist Description Format (XCCDF).
> +<title>Guide to the Secure Configuration of Fedora</title>
> +<description>This guide presents a catalog of security-relevant configuration
> +settings for Fedora operating system formatted in the eXtensible Configuration
> +Checklist Description Format (XCCDF).
>
>   <br/>
>   <br/>
>   Providing system administrators with such guidance informs them how to securely
> @@ -35,6 +35,8 @@ quality, reliability, or any other characteristic.</notice>
>   trademarks or trademarks of Red Hat, Inc. in the United States and other
>   countries. All other names are registered trademarks or trademarks of their
>   respective companies.</rear-matter>
> +<platform idref="cpe:/o:fedoraproject:fedora:20" />
>   <platform idref="cpe:/o:fedoraproject:fedora:19" />
> -<version>0.0.3</version>
> +<platform idref="cpe:/o:fedoraproject:fedora:18" />
> +<version>0.0.4</version>
>   </Benchmark>
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
> index c252535..eb04b6a 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -56,6 +56,7 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
>   %changelog
>   * Mon Dec 09 2013 Jan iankko Lieskovsky<[e-mail]>  0.1.4.rc12-1
>   - Rename XCCDF rules
> +- Revert Set up Fedora release name and CPE based on build system properties
> Fri Dec 06 2013 Jan iankko Lieskovsky  0.1.4.rc11-1
> Shared OVAL check for Verify that Shared Library Files Have Root Ownership
>
> diff --git a/Fedora/transforms/genguidexslt.py b/Fedora/transforms/genguidexslt.py
> deleted file mode 100755
> index 504e8d7..0000000
> --- a/Fedora/transforms/genguidexslt.py
> +++ /dev/null
> @@ -1,115 +0,0 @@
> -#!/usr/bin/python
>
> -# PURPOSE: Generate XSLT transform to adjust:
> -#
> -#   Fedora/input/guide.xml
> -#
> -# content (release name and CPE) based on underlying system's Fedora version
> -# (for now building on RHEL isn't supported)
>
> -from contextlib import contextmanager
> -import sys
>
> -# Script helper routines below
> -# ----------------------------
>
> -# Open a file (PEP 343 version)
> -@contextmanager
> -def pep_343_open_file(filename, mode="r"):
> try:
> f = open(filename, mode)
> except IOError, e:
> yield None, e
> else:
> try:
>  yield f, None
> finally:
>  f.close()
>
> -# Read one line from file
> -def read_file_line(filename):
> with pep_343_open_file(filename) as (f, e):
> if e:
>  return None
> else:
>  return f.readline().rstrip('\n')
>
> -# Constants for generated XSLT content below
> -# ------------------------------------------
>
> -XSLT_HEADER = '''<?xml version="1.0"?>
> -<xsl:stylesheet version="1.0"
> xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
> xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
> xmlns:xhtml="http://www.w3.org/1999/xhtml"
> xmlns:dc="http://purl.org/dc/elements/1.1/%22%3E'''
>
> -XSLT_TEMPLATES = '''
>
> -<!-- Copy children -->
> -<xsl:template match="@*|node()">
> xsl:copy
> <xsl:apply-templates select="@*|node()" />
> </xsl:copy>
>
> -</xsl:template>
> -<!-- Update full Fedora release name based on param value -->
> -<xsl:template match="fedora_release">
> <xsl:value-of select="$fedora_release" />
>
> -</xsl:template>
> -<!-- Update Fedora CPE based on param value -->
> -<xsl:template match="platform/@idref">
> <xsl:attribute name="idref">
> <xsl:value-of select="$fedora_cpe" />
> </xsl:attribute>
>
> -</xsl:template>
>
> -'''
>
> -XSLT_FOOTER = '</xsl:stylesheet>'
>
> -# Helper XSLT content routines below
> -# ----------------------------------
>
> -# Store retrieved values from the system
> -# into XSLT params
> -def create_fedora_xslt_params(xslt_file):
> release_xslt_param = "\n<xsl:param name="fedora_release" select="'%s'" />" % FEDORA_RELEASE
> cpe_xslt_param = "\n<xsl:param name="fedora_cpe" select="'%s'" />" % FEDORA_CPE
> xslt_file.write(NEW_LINE + release_xslt_param)
> xslt_file.write(cpe_xslt_param)
>
> -# Create final XSLT transform file
> -def create_xslt(filename):
> with pep_343_open_file(filename, "w") as (f, e):
> if e:
>  print "Error generating XSLT transform."
>  sys.exit(1)
> else:
>  print "Writing XSLT transform file into: %s" % filename
>  f.write(XSLT_HEADER)
>  create_fedora_xslt_params(f)
>  f.write(XSLT_TEMPLATES)
>  f.write(XSLT_FOOTER)
>
> -# Main section
> -# ------------
> -if __name__ == "__main__":
> if len(sys.argv) < 2:
> print "Provide filename for resulting XSLT file."
> sys.exit(1)
> NEW_LINE = '\n'
> XSLT_FILE = str(sys.argv[1])
> FEDORA_RELEASE = read_file_line('/etc/fedora-release')
> FEDORA_CPE = read_file_line('/etc/system-release-cpe')
> if FEDORA_RELEASE is None or FEDORA_CPE is None:
> print '''
>
> -Unable to determine version of Fedora at the system. Be sure to
> -build scap-security-guide (source) RPM either at Fedora 18 or at
> -Fedora 19.\n'''
> sys.exit(1)
> create_xslt(XSLT_FILE)
>
> -- 1.8.3.1
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide