[PATCH 0/7] ATTENTION: all output filenames changing

[Jeffrey Blank]

This patchset involves changing all output filenames so that their formatting 
agrees with NIST SP 800-126.  This is long overdue, but could cause 
disruption for anyone getting something based on its filename.

This patchset also involves the creation of a new Makerule called content-stig,
which is a first cut at assembling SCAP content for use as a specific baseline.
Note that it is all very pre-release and pre-draft (and clearly labelled as such).
But it demonstrates how easily (well, compared to other SCAP things anyway)
the content can be transformed into a specific structure or format, and demonstrates
how we can iterate forward.


Jeffrey Blank (7):
  new transform to add references to Rules (e.g. if a default ref
    needed)
  very rough first cut at producing XCCDF structured in the manner of a
    STIG
  minor typo fixups
  including dublin core namespace in input documents
  changed Makefile to create output filenames compliant with NIST
    800-126
  changed supporting transforms and scripts to support new filename
    format
  moving xccdf resolve operation to a Rule off the critical path (for
    now)

 RHEL6/Makefile                            |  122 ++++++++++++++++------------
 RHEL6/input/guide.xml                     |    2 +-
 RHEL6/input/guide.xslt                    |    2 +-
 RHEL6/transforms/cpe_generate.py          |    5 +-
 RHEL6/transforms/relabelids.py            |    9 +-
 RHEL6/transforms/shorthand2xccdf.xslt     |   15 ++--
 RHEL6/transforms/xccdf-addrefs.xslt       |   46 +++++++++++
 RHEL6/transforms/xccdf-ocilcheck2ref.xslt |    2 +-
 RHEL6/transforms/xccdf2stigformat.xslt    |   63 +++++++++++----
 9 files changed, 181 insertions(+), 85 deletions(-)
 create mode 100644 RHEL6/transforms/xccdf-addrefs.xslt

[PATCH 1/7] new transform to add references to Rules (e.g. if a default ref needed)

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/transforms/xccdf-addrefs.xslt |   46 +++++++++++++++++++++++++++++++++++
 1 files changed, 46 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/transforms/xccdf-addrefs.xslt

diff --git a/RHEL6/transforms/xccdf-addrefs.xslt b/RHEL6/transforms/xccdf-addrefs.xslt
new file mode 100644
index 0000000..0388be3
--- /dev/null
+++ b/RHEL6/transforms/xccdf-addrefs.xslt
@@ -0,0 +1,46 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:cdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
exclude-result-prefixes="cdf">
+
+<!-- This transform expects a stringparam "profile" specifying a particular
+     XCCDF profile.  It will add references (as defined below) to all Rules
+     included in the profile. -->
+
+<xsl:include href="constants.xslt"/>
+
+  <xsl:template match="cdf:Rule">
+	<xsl:copy>
+	<!-- deal with the fact that references must stand after some other nodes -->
+	<xsl:apply-templates select="@*" />
+	<xsl:apply-templates select="cdf:title"/>
+	<xsl:apply-templates select="cdf:description"/>
+	<xsl:apply-templates select="cdf:warning"/>
+
+	<xsl:if test="not(cdf:reference[@href=$disa-cciuri])"> 
+		<xsl:variable name="rule_id" select="@id"/>
+<!-- this can be uncommented when oscap xccdf resolve passes check-content through
-->
+<!--		<xsl:for-each
select="/cdf:Benchmark/cdf:Profile[@id=$profile]/cdf:select">
+			<xsl:if test="@idref=$rule_id"> -->
+			  <!-- this block is designed to add a reference to CCI 366 to Rules in a STIG
Profile as a default -->
+	          <xsl:element name="reference"
namespace="http://checklists.nist.gov/xccdf/1.1">
+		          <xsl:attribute name="href"><xsl:value-of
select="$disa-cciuri"/></xsl:attribute>
+		          <xsl:text>366</xsl:text>
+	          </xsl:element>
+<!--			</xsl:if>
+		</xsl:for-each> -->
+	</xsl:if> 
+	
+	<xsl:apply-templates
select="node()[not(self::cdf:title|self::cdf:description|self::cdf:warning)]"/>
+	</xsl:copy>
+  </xsl:template>
+
+
+
+
+  <!-- copy everything else through to final output -->
+  <xsl:template match="@*|node()">
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+    </xsl:copy>
+  </xsl:template>
+
+</xsl:stylesheet>
-- 
1.7.1

[PATCH 2/7] very rough first cut at producing XCCDF structured in the manner of a STIG

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/transforms/xccdf2stigformat.xslt |   63 ++++++++++++++++++++++++--------
 1 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/RHEL6/transforms/xccdf2stigformat.xslt
b/RHEL6/transforms/xccdf2stigformat.xslt
index 4f472c2..23abe7e 100644
--- a/RHEL6/transforms/xccdf2stigformat.xslt
+++ b/RHEL6/transforms/xccdf2stigformat.xslt
@@ -4,32 +4,63 @@
 <!-- This transform transforms that project's main XCCDF content 
      into the format expected in a DISA STIG. -->
 
-
 <xsl:include href="constants.xslt"/>
 
+  <xsl:template match="xccdf:Benchmark">
+	<Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:cpe="http://cpe.mitre.org/language/2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
+xmlns="http://checklists.nist.gov/xccdf/1.1" id="RHEL_6_STIG"
xml:lang="en"
+xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1
http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0
http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
+	<status date="2012-10-01">pre-draft</status>
+	<title>Pre-Draft Red Hat Enterprise Linux 6 Security Technical Implementation
Guide</title>
+	<description>The Red Hat Enterprise Linux 6 Security Technical Implementation
Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD)
information systems. Comments or proposed revisions to this document should be sent via
e-mail to the following address: fso_spt(a)disa.mil.&lt;/description&gt;
+	<notice id="terms-of-use" xml:lang="en" />
+	<!-- this is here as a placeholder, prior to any publication.  this is PRE-DRAFT,
NON-RELEASE material. -->
+	<reference href="http://iase.disa.mil">
+         <dc:publisher>DISA, Field Security Operations</dc:publisher>
+         <dc:source>iase.disa.mil</dc:source>
+	</reference>
+	<version>0.7</version>
+
+	<!-- retain desired Profile -->
+	<xsl:apply-templates select="xccdf:Profile" />
+	<!-- retain all Values -->
+	<xsl:apply-templates select=".//xccdf:Value" />
+	<!-- retain Rules only from the selected Profile -->
+	<xsl:apply-templates select=".//xccdf:Rule" />
+	</Benchmark>
+  </xsl:template>
+
+
+  <xsl:template match="xccdf:Profile">
+  	<xsl:if test="@id=$profile">
+		<xsl:copy>
+			<xsl:apply-templates select="@*|node()"/>
+		</xsl:copy>
+	</xsl:if>
+  </xsl:template>
+
+
+  <xsl:template match="xccdf:Value">
+	<xsl:copy>
+		<xsl:apply-templates select="@*|node()"/>
+	</xsl:copy>
+  </xsl:template>
+
 
   <xsl:template match="xccdf:Rule">
+    <Group>
+    <xsl:attribute name="id">groupid</xsl:attribute>
     <xsl:copy>
-	  <!-- deal with oscap element ordering pickiness -->
-      <xsl:apply-templates
select="@*|node()[not(self::xccdf:rationale|self::xccdf:ident|self::xccdf:check|self::xccdf:fix)]"/>
-	    <!-- insert CCI 336 if no other CCI is referenced --> 
-        <xsl:if test="not(xccdf:reference[@href=$disa-cciuri])">
-          <xsl:element name="reference"
namespace="http://checklists.nist.gov/xccdf/1.1">
-          <xsl:attribute name="href"><xsl:value-of
select="$disa-cciuri"/></xsl:attribute>
-          <xsl:text>366</xsl:text>
-          </xsl:element>
-        </xsl:if>
-
-      <xsl:apply-templates
select="node()[self::xccdf:rationale|self::xccdf:ident|self::xccdf:check|self::xccdf:fix]"/>
+      <xsl:apply-templates select="@*|node()"/>
     </xsl:copy>
+    </Group>
   </xsl:template>
 
 
-  <!-- copy everything else through to final output -->
   <xsl:template match="@*|node()">
-    <xsl:copy>
-      <xsl:apply-templates select="@*|node()" />
-    </xsl:copy>
+	<xsl:copy>
+		<xsl:apply-templates select="@*|node()" />
+	</xsl:copy>
   </xsl:template>
 
 </xsl:stylesheet>
-- 
1.7.1

[PATCH 3/7] minor typo fixups

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/transforms/shorthand2xccdf.xslt |   15 +++++++--------
 1 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/RHEL6/transforms/shorthand2xccdf.xslt
b/RHEL6/transforms/shorthand2xccdf.xslt
index 77b4587..be63c4f 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -4,12 +4,11 @@ xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
 xmlns:xhtml="http://www.w3.org/1999/xhtml" 
 xmlns:dc="http://purl.org/dc/elements/1.1/" 
 xmlns:date="http://exslt.org/dates-and-times"
extension-element-prefixes="date"
-exclude-result-prefixes="xccdf xhtml">
+exclude-result-prefixes="xccdf xhtml dc">
 
 <xsl:include href="constants.xslt"/>
 
-<xsl:variable
name="ovalpath">oval:org.scap-security-guide.rhel:def:</xsl:variable>
-<xsl:variable name="ovalfile">rhel6-oval.xml</xsl:variable>
+<xsl:variable
name="ovalfile">unlinked-rhel6-oval.xml</xsl:variable>
 
 <xsl:variable name="defaultseverity" select="'low'" />
 
@@ -239,19 +238,19 @@ exclude-result-prefixes="xccdf xhtml">
   <xsl:template match="sysctl-desc-macro">
     To set the runtime status of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter,
     run the following command:
-    <xhtml:pre># sysctl -w <xsl:value-of select="@sysctl"/>
<xsl:value-of select="@value"/></xhtml:pre>
+    <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of
select="@sysctl"/> <xsl:value-of
select="@value"/></xhtml:pre>
 
-    To persist this configuration, the following line must be added to
<tt>/etc/sysctl.conf</tt>:
-    <xhtml:pre><xsl:value-of select="@sysctl"/> <xsl:value-of
select="@value"/></xhtml:pre>
+    To persist this configuration, the following line must be added to
<xhtml:code>/etc/sysctl.conf</xhtml:code>:
+    <xhtml:pre xml:space="preserve"><xsl:value-of
select="@sysctl"/> <xsl:value-of
select="@value"/></xhtml:pre>
   </xsl:template>
 
   <xsl:template match="sysctl-check-macro">
     The runtime status of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter can be queried
     by running the following command:
     <xhtml:pre>$ sysctl <xsl:value-of
select="@sysctl"/></xhtml:pre>
-    The output of the command should indicate a value of
<xhtml:code><xsl:value-of
select="@value"/></xhtml:code>.<br />
+    The output of the command should indicate a value of
<xhtml:code><xsl:value-of
select="@value"/></xhtml:code>.<xhtml:br />
     To verify persistent configuration of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter, 
-    verify that the following line is present in <tt>/etc/sysctl.conf</tt>:
+    verify that the following line is present in
<xhtml:code>/etc/sysctl.conf</xhtml:code>:
     <xhtml:pre>$ sysctl <xsl:value-of
select="@sysctl"/></xhtml:pre>    
   </xsl:template>
 
-- 
1.7.1

[PATCH 4/7] including dublin core namespace in input documents

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/input/guide.xml  |    2 +-
 RHEL6/input/guide.xslt |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/guide.xml b/RHEL6/input/guide.xml
index 622b680..393de70 100644
--- a/RHEL6/input/guide.xml
+++ b/RHEL6/input/guide.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
id="RHEL-6" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1
xccdf-1.1.4.xsd" resolved="false" xml:lang="en-US" >
+<Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
xmlns:dc="http://purl.org/dc/elements/1.1/" id="RHEL-6"
xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd"
resolved="false" xml:lang="en-US" >
 
   <status date="2011-12-20">draft</status>
   <title>DRAFT Guide to the Secure Configuration of Red Hat Enterprise Linux
6</title>
diff --git a/RHEL6/input/guide.xslt b/RHEL6/input/guide.xslt
index 45793f0..4944f0d 100644
--- a/RHEL6/input/guide.xslt
+++ b/RHEL6/input/guide.xslt
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml">
+<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
xmlns:dc="http://purl.org/dc/elements/1.1/">
 
   <xsl:template match="Benchmark">
     <xsl:copy>
-- 
1.7.1

[PATCH 5/7] changed Makefile to create output filenames compliant with NIST 800-126

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/Makefile |  122 ++++++++++++++++++++++++++++++++------------------------
 1 files changed, 70 insertions(+), 52 deletions(-)

diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index f2c5923..12e8369 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -4,7 +4,8 @@ TRANS = transforms
 REFS = references
 UTILS = utils
 DIST = dist
-ID = scap-security-guide
+
+ID = ssg
 
 all: shorthand-guide shorthand2xccdf tables guide checks content dist
 
@@ -13,26 +14,29 @@ shorthand-guide:
 	xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml
 
 shorthand2xccdf: shorthand-guide
-	xsltproc -o $(OUT)/rhel6-xccdf-noprofiles.xml $(TRANS)/shorthand2xccdf.xslt
$(OUT)/rhel6-shorthand.xml
-	xsltproc -stringparam profile "allprofiles" -o $(OUT)/rhel6-xccdf.xml
$(TRANS)/xccdf-addprofiles.xslt $(OUT)/rhel6-xccdf-noprofiles.xml
+	xsltproc -o $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt
$(OUT)/rhel6-shorthand.xml
+	xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhel6-xccdf.xml
\
+		$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml
+	oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml
$(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-rhel6-xccdf.xml
\
+		$(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
 #   extract manual check instructions from xccdf into an ocil file
-	xsltproc -o $(OUT)/rhel6-ocil.xml $(TRANS)/xccdf-create-ocil.xslt
$(OUT)/rhel6-xccdf.xml
-	xmllint --format --output $(OUT)/rhel6-ocil.xml $(OUT)/rhel6-ocil.xml 
-	xsltproc -o $(OUT)/rhel6-xccdf-ocilrefs.xml $(TRANS)/xccdf-ocilcheck2ref.xslt
$(OUT)/rhel6-xccdf.xml
-#	xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o
$(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/rhel6-xccdf.xml
-	xmllint --format --output $(OUT)/rhel6-xccdf.xml $(OUT)/rhel6-xccdf.xml
+	xsltproc -o $(OUT)/unlinked-rhel6-ocil.xml $(TRANS)/xccdf-create-ocil.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
+	xmllint --format --output $(OUT)/unlinked-rhel6-ocil.xml $(OUT)/unlinked-rhel6-ocil.xml

+	xsltproc -o $(OUT)/unlinked-ocilrefs-rhel6-xccdf.xml $(TRANS)/xccdf-ocilcheck2ref.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
+#	xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o
$(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
+	xmllint --format --output $(OUT)/unlinked-rhel6-xccdf.xml
$(OUT)/unlinked-rhel6-xccdf.xml
 
 checks:
 	xmlwf $(IN)/checks/*.xml
-	$(TRANS)/combinechecks.py $(IN)/checks > $(OUT)/rhel6-oval.xml
-	xmllint --format --output $(OUT)/rhel6-oval.xml $(OUT)/rhel6-oval.xml
-
+	$(TRANS)/combinechecks.py $(IN)/checks > $(OUT)/unlinked-rhel6-oval.xml
+	xmllint --format --output $(OUT)/unlinked-rhel6-oval.xml $(OUT)/unlinked-rhel6-oval.xml
 
 guide: shorthand-guide shorthand2xccdf
 #	remove auxiliary Groups which are only for use in tables, and not guide output.
 #	specifying a nonexistent profile, "allrules," to make oscap print all Rules
-	xsltproc -o $(OUT)/rhel6-xccdf.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/rhel6-xccdf.xml
-	oscap xccdf generate guide --profile allrules $(OUT)/rhel6-xccdf.xml >
$(OUT)/rhel6-guide.html
+	xsltproc -o $(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-removeaux.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
+	oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf.xml >
$(OUT)/rhel6-guide.html
 
 # example, if needed: for converting XCCDF into shorthand
 #xccdf2shorthand:
@@ -40,68 +44,82 @@ guide: shorthand-guide shorthand2xccdf
 #	tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml
 
 table-profilenistrefs: shorthand-guide shorthand2xccdf
-	xsltproc -stringparam profile "desktop" -o
$(OUT)/rhel6-table-nistrefs-desktop.html $(TRANS)/xccdf2table-profilenistrefs.xslt
$(OUT)/rhel6-xccdf.xml
-	xsltproc -stringparam profile "server" -o
$(OUT)/rhel6-table-nistrefs-server.html $(TRANS)/xccdf2table-profilenistrefs.xslt
$(OUT)/rhel6-xccdf.xml
-	xsltproc -stringparam profile "common" -o
$(OUT)/rhel6-table-nistrefs-common.html $(TRANS)/xccdf2table-profilenistrefs.xslt
$(OUT)/rhel6-xccdf.xml
-	xsltproc -stringparam profile "ftp" -o $(OUT)/rhel6-table-nistrefs-ftp.html
$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/rhel6-xccdf.xml
+	xsltproc -stringparam profile "desktop" -o
$(OUT)/table-rhel6-nistrefs-desktop.html \
+		$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam profile "server" -o
$(OUT)/table-rhel6-nistrefs-server.html \
+		$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam profile "common" -o
$(OUT)/table-rhel6-nistrefs-common.html \
+		$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam profile "ftp" -o $(OUT)/table-rhel6-nistrefs-ftp.html \
+		$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
 
 table-refs: shorthand-guide shorthand2xccdf
-	xsltproc -stringparam ref "nist" -o $(OUT)/rhel6-table-nistrefs.html
$(TRANS)/xccdf2table-byref.xslt $(OUT)/rhel6-xccdf.xml
+	xsltproc -stringparam ref "nist" -o $(OUT)/table-rhel6-nistrefs.html
$(TRANS)/xccdf2table-byref.xslt $(OUT)/unlinked-rhel6-xccdf.xml
 # break apart references by delimiter:
-	xsltproc -stringparam ref "nist" -stringparam delim "," -o
$(OUT)/rhel6-table-nistrefs-delim.html $(TRANS)/xccdf2table-byref.xslt
$(OUT)/rhel6-xccdf.xml
+	xsltproc -stringparam ref "nist" -stringparam delim "," -o
$(OUT)/table-rhel6-nistrefs-delim.html $(TRANS)/xccdf2table-byref.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
 # then sort them:
-	xsltproc --html -o $(OUT)/rhel6-table-nistrefs-delim-sorted.html
$(TRANS)/table-sortbyref.xslt $(OUT)/rhel6-table-nistrefs-delim.html
+	xsltproc --html -o $(OUT)/table-rhel6-nistrefs-delim-sorted.html
$(TRANS)/table-sortbyref.xslt $(OUT)/table-rhel6-nistrefs-delim.html
 
 table-idents: shorthand-guide shorthand2xccdf
-	xsltproc -o $(OUT)/rhel6-table-cces.html $(TRANS)/xccdf2table-cce.xslt
$(OUT)/rhel6-xccdf.xml
-	xsltproc -stringparam ref "../$(REFS)/cce-rhel5.xml" -o
$(OUT)/rhel6-table-cces-rhel5.html $(TRANS)/xccdf2table-cce.xslt $(OUT)/rhel6-xccdf.xml
-
+	xsltproc -o $(OUT)/table-rhel6-cces.html $(TRANS)/xccdf2table-cce.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam ref "../$(REFS)/cce-rhel5.xml" -o
$(OUT)/table-rhel6-cces-rhel5.html $(TRANS)/xccdf2table-cce.xslt
$(OUT)/unlinked-rhel6-xccdf.xml
 
 table-srgmap: shorthand-guide shorthand2xccdf
 # the map-to-items filename must be provided relative to the root of the main document
being processed
-	xsltproc -stringparam map-to-items "../$(OUT)/rhel6-xccdf.xml" -o
$(OUT)/rhel6-table-srgmap.html $(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
+	xsltproc -stringparam map-to-items "../$(OUT)/unlinked-rhel6-xccdf.xml" -o
$(OUT)/table-rhel6-srgmap.html \
+		$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
 
 table-stigs: shorthand2xccdf
-	xsltproc -o $(OUT)/rhel5-table-stig.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml  
-	xsltproc -o $(OUT)/rhel5-table-stig-manual.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml  
-	xsltproc --html -o $(OUT)/rhel5-table-stig-manual-ccisorted.html
$(TRANS)/table-sortbyref.xslt $(OUT)/rhel5-table-stig-manual.html 
-	xsltproc -stringparam notes "../$(IN)/auxiliary/transition_notes.xml" -o
$(OUT)/rhel5-table-stig-manual-withnotes.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
-	xsltproc -o $(OUT)/rhel6-xccdf-stigformat.xml $(TRANS)/xccdf2stigformat.xslt
$(OUT)/rhel6-xccdf.xml 
-#	temporarily retain an output file showing the short titles as well, for convenience
-	xsltproc -stringparam profile "stig-server" -stringparam testinfo
"y" -o $(OUT)/rhel6-table-stig-server-shorttitles.html \
+	xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml  
+	xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt
$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml  
+	xsltproc --html -o $(OUT)/table-rhel5-stig-manual-ccisorted.html
$(TRANS)/table-sortbyref.xslt $(OUT)/table-rhel5-stig-manual.html 
+	xsltproc -stringparam notes "../$(IN)/auxiliary/transition_notes.xml" -o
$(OUT)/table-rhel5-stig-manual-withnotes.html \
+		$(TRANS)/xccdf2table-stig.xslt \
+		$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
+#	temporarily retain an output file showing the short titles as well
+	xsltproc -stringparam profile "stig-server" -stringparam testinfo
"y" -o $(OUT)/table-rhel6-stig-server-shorttitles.html \
 		$(TRANS)/xccdf2table-profileccirefs.xslt \
-		$(OUT)/rhel6-xccdf-stigformat.xml  
-	xsltproc -stringparam alttitles "../$(IN)/auxiliary/alt-titles-stig.xml" -o
$(OUT)/rhel6-xccdf-stigformat.xml \
+		$(OUT)/unlinked-rhel6-xccdf.xml  
+	xsltproc -stringparam alttitles "../$(IN)/auxiliary/alt-titles-stig.xml" -o
$(OUT)/unlinked-stig-rhel6-xccdf.xml \
 		$(TRANS)/xccdf-alt-titles.xslt \
-		$(OUT)/rhel6-xccdf-stigformat.xml  
-	xsltproc -stringparam profile "stig-server" -o
$(OUT)/rhel6-table-stig-server.html \
+		$(OUT)/unlinked-rhel6-xccdf.xml
+	xsltproc -stringparam profile "stig-server" -o
$(OUT)/table-rhel6-stig-server.html \
 		$(TRANS)/xccdf2table-profileccirefs.xslt \
-		$(OUT)/rhel6-xccdf-stigformat.xml  
+		$(OUT)/unlinked-rhel6-xccdf.xml  
 
-tables: table-idents table-refs table-profilenistrefs table-srgmap table-stigs
+tables: table-refs table-profilenistrefs table-srgmap table-stigs
 
 alt-titles: shorthand2xccdf
-	$(UTILS)/sync-alt-titles.py -p stig-server -f $(IN)/auxiliary/alt-titles-stig.xml
$(OUT)/rhel6-xccdf.xml
+	$(UTILS)/sync-alt-titles.py -p stig-server -f $(IN)/auxiliary/alt-titles-stig.xml
$(OUT)/unlinked-rhel6-xccdf.xml
 	XMLLINT_INDENT="" xmllint --format --output
$(IN)/auxiliary/alt-titles-stig.xml $(IN)/auxiliary/alt-titles-stig.xml 
 
 content: shorthand-guide shorthand2xccdf guide checks
 #	the relabelids.py script chdirs to ./output, so refer to files from there.
 #	its second argument controls the IDs, as well as the output filenames.
-#	thus, with ID set to scap-security-guide, this creates
rhel6-xccdf-scap-security-guide.xml and rhel6-oval-scap-security-guide.xml.
-	$(TRANS)/cpe_generate.py $(OUT)/rhel6-oval.xml
$(IN)/checks/platform/rhel6-cpe-dictionary.xml $(ID)
-	$(TRANS)/relabelids.py rhel6-xccdf.xml $(ID)
-	$(TRANS)/relabelids.py rhel6-xccdf-ocilrefs.xml $(ID)
+#	thus, with ID set to ssg, this creates ssg-rhel6-xccdf.xml and ssg-rhel6-oval.xml.
+	$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml
$(IN)/checks/platform/rhel6-cpe-dictionary.xml $(ID)
+	$(TRANS)/relabelids.py unlinked-rhel6-xccdf.xml $(ID)
+	$(TRANS)/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml $(ID)
+
+# not ready until oscap resolve behavior resolved
+content-stig: shorthand-guide shorthand2xccdf guide checks
+	xsltproc -stringparam profile "stig-server" -o
$(OUT)/unlinked-stig-rhel6-xccdf.xml $(TRANS)/xccdf2stigformat.xslt
$(OUT)/unlinked-resolved-rhel6-xccdf.xml 
+	$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml
$(IN)/checks/platform/rhel6-cpe-dictionary.xml disa-predraft
+	$(TRANS)/relabelids.py unlinked-stig-rhel6-xccdf.xml disa-predraft
+	xmllint --format --output $(OUT)/disa-predraft-stig-rhel6-xccdf.xml
$(OUT)/disa-predraft-stig-rhel6-xccdf.xml
+
+# content-usgcb: coming soon
 
 validate:
-	oscap xccdf validate-xml $(OUT)/rhel6-xccdf-$(ID).xml
-	oscap oval validate-xml $(OUT)/rhel6-oval-$(ID).xml
-	oscap oval validate-xml $(OUT)/rhel6-cpe-oval-$(ID).xml
+	oscap xccdf validate-xml $(OUT)/$(ID)-rhel6-xccdf.xml
+	oscap oval validate-xml $(OUT)/$(ID)-rhel6-oval.xml
+	oscap oval validate-xml $(OUT)/$(ID)-rhel6-cpe-oval.xml
 
 eval-test:
-	oscap xccdf eval --profile test $(OUT)/rhel6-xccdf-$(ID).xml
+	oscap xccdf eval --profile test $(OUT)/$(ID)-rhel6-xccdf.xml
 
 eval-ftp:
-	oscap xccdf eval --profile ftp $(OUT)/rhel6-xccdf-$(ID).xml
+	oscap xccdf eval --profile ftp $(OUT)/$(ID)-rhel6-xccdf.xml
 
 eval-common:
 	oscap xccdf eval --profile common --oval-results --results /tmp/results-test.xml
$(OUT)/rhel6-xccdf-$(ID).xml
@@ -110,11 +128,11 @@ eval-common:
 dist: tables guide content
 	mkdir -p $(DIST)/guide $(DIST)/content $(DIST)/policytables
 	cp $(OUT)/rhel6-guide.html $(DIST)/guide
-	cp $(OUT)/rhel6-xccdf-$(ID).xml $(DIST)/content
-	cp $(OUT)/rhel6-oval-$(ID).xml $(DIST)/content
-	cp $(OUT)/rhel6-cpe-dictionary-$(ID).xml $(DIST)/content
-	cp $(OUT)/rhel6-cpe-oval-$(ID).xml $(DIST)/content
-	cp $(OUT)/rhel6-table-* $(DIST)/policytables
+	cp $(OUT)/$(ID)-rhel6-xccdf.xml $(DIST)/content
+	cp $(OUT)/$(ID)-rhel6-oval.xml $(DIST)/content
+	cp $(OUT)/$(ID)-rhel6-cpe-dictionary.xml $(DIST)/content
+	cp $(OUT)/$(ID)-rhel6-cpe-oval.xml $(DIST)/content
+	cp $(OUT)/table-rhel6-* $(DIST)/policytables
 
 #install:
 #	cp -r rhel6/src/dist/* /usr/share/scap-security-guide/rhel6
-- 
1.7.1

[PATCH 6/7] changed supporting transforms and scripts to support new filename format

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/transforms/cpe_generate.py          |    5 +++--
 RHEL6/transforms/relabelids.py            |    9 +++++----
 RHEL6/transforms/xccdf-ocilcheck2ref.xslt |    2 +-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/RHEL6/transforms/cpe_generate.py b/RHEL6/transforms/cpe_generate.py
index dcc1448..e33cf8b 100755
--- a/RHEL6/transforms/cpe_generate.py
+++ b/RHEL6/transforms/cpe_generate.py
@@ -91,12 +91,13 @@ def main():
 	translator = idtranslate.idtranslator("./output/"+idname+".ini",
idname)
 	ovaltree = translator.translate(ovaltree)
 
-	newovalfile = ovalfile.replace("oval", "cpe-oval-"+idname)
+	newovalfile = ovalfile.replace("oval", "cpe-oval")
+	newovalfile = newovalfile.replace("unlinked", idname)
 	ET.ElementTree(ovaltree).write(newovalfile)
 
 	# replace and sync IDs, href filenames in input cpe dictionary file
 	cpedicttree = parse_xml_file(cpedictfile)
-	newcpedictfile =
os.path.basename(cpedictfile).replace(".xml","-"+idname+".xml")
+	newcpedictfile = idname + "-" + os.path.basename(cpedictfile)
 	for check in cpedicttree.findall(".//{%s}check" % cpe_ns):
 		check.set("href",os.path.basename(newovalfile))
 		check.text = translator.assign_id("{" + oval_ns + "}definition",
check.text)	
diff --git a/RHEL6/transforms/relabelids.py b/RHEL6/transforms/relabelids.py
index 7068437..ad56fb5 100755
--- a/RHEL6/transforms/relabelids.py
+++ b/RHEL6/transforms/relabelids.py
@@ -4,11 +4,12 @@ import sys, os
 import idtranslate
 import lxml.etree as ET
 
-# This script requires two arguments: an XCCDF file and an ID name scheme.
+# This script requires two arguments: an "unlinked" XCCDF file and an ID name
scheme.
 # This script is designed to convert and synchronize check IDs referenced from
 # the XCCDF document for the supported checksystems, which are currently OVAL
 # and OCIL.  The IDs are to be converted from strings to meaningless numbers.
 
+
 oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
 oval_cs = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
 
@@ -64,14 +65,14 @@ def main():
 	if ovalfile:
 		ovaltree = parse_xml_file(ovalfile) 
 		ovaltree = translator.translate(ovaltree, store_defname=True)
-		newovalfile = ovalfile.replace(".xml", "-" + idname +
".xml")
+		newovalfile = ovalfile.replace("unlinked", idname)
 		ET.ElementTree(ovaltree).write(newovalfile)
 
 	# rename all IDs in the ocil file
 	if ocilfile:
 		ociltree = parse_xml_file(ocilfile) 
 		ociltree = translator.translate(ociltree)
-		newocilfile = ocilfile.replace(".xml", "-" + idname +
".xml")
+		newocilfile = ocilfile.replace("unlinked", idname)
 		ET.ElementTree(ociltree).write(newocilfile)
 
 	# rename all IDs and file refs in the xccdf file
@@ -98,7 +99,7 @@ def main():
 				newexportname = translator.assign_id("{"+ oval_ns + "}variable",
checkexport.get("export-name"))
 				checkexport.set("export-name", newexportname) 
 
-	newxccdffile = xccdffile.replace(".xml", "-" + idname +
".xml")
+	newxccdffile = xccdffile.replace("unlinked", idname)
 	#ET.dump(xccdftree)
 	ET.ElementTree(xccdftree).write(newxccdffile)
 	sys.exit(0)
diff --git a/RHEL6/transforms/xccdf-ocilcheck2ref.xslt
b/RHEL6/transforms/xccdf-ocilcheck2ref.xslt
index 396cab1..37c7ab4 100644
--- a/RHEL6/transforms/xccdf-ocilcheck2ref.xslt
+++ b/RHEL6/transforms/xccdf-ocilcheck2ref.xslt
@@ -19,7 +19,7 @@
        to create a reference name -->
   <xsl:template match="xccdf:check-content">
 	<xsl:element name="check-content-ref"
namespace="http://checklists.nist.gov/xccdf/1.1">
-		<xsl:attribute name="href">rhel6-ocil.xml</xsl:attribute>
+		<xsl:attribute
name="href">unlinked-rhel6-ocil.xml</xsl:attribute>
 		<xsl:attribute name="name"><xsl:value-of
select="../../@id"/>_ocil</xsl:attribute>
 	</xsl:element>
   </xsl:template>
-- 
1.7.1

[PATCH 7/7] moving xccdf resolve operation to a Rule off the critical path (for now)

[Jeffrey Blank]

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil&gt;
---
 RHEL6/Makefile |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 12e8369..39c68d8 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -17,7 +17,6 @@ shorthand2xccdf: shorthand-guide
 	xsltproc -o $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt
$(OUT)/rhel6-shorthand.xml
 	xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhel6-xccdf.xml
\
 		$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhel6-xccdf.xml
-	oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml
$(OUT)/unlinked-rhel6-xccdf.xml
 	xsltproc -stringparam profile "stig-server" -o $(OUT)/unlinked-rhel6-xccdf.xml
\
 		$(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-rhel6-xccdf.xml
 #   extract manual check instructions from xccdf into an ocil file
@@ -103,6 +102,7 @@ content: shorthand-guide shorthand2xccdf guide checks
 
 # not ready until oscap resolve behavior resolved
 content-stig: shorthand-guide shorthand2xccdf guide checks
+	oscap xccdf resolve -o $(OUT)/unlinked-resolved-rhel6-xccdf.xml
$(OUT)/unlinked-rhel6-xccdf.xml
 	xsltproc -stringparam profile "stig-server" -o
$(OUT)/unlinked-stig-rhel6-xccdf.xml $(TRANS)/xccdf2stigformat.xslt
$(OUT)/unlinked-resolved-rhel6-xccdf.xml 
 	$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml
$(IN)/checks/platform/rhel6-cpe-dictionary.xml disa-predraft
 	$(TRANS)/relabelids.py unlinked-stig-rhel6-xccdf.xml disa-predraft
-- 
1.7.1