Generalising SSG ...

[Trey Henefield]

Just food for thought. Has there been any desire to make changes to SSG to accommodate building other (non-rhel6) SSGs?

I am getting up to speed on its processes, and for practice and actual need, was thinking of creating an SSG for Firefox and Java, and potentially webmin and apache. However, I noticed rhel6 is embedded all throughout.

I have noticed that most of the processes in place can be repurposed. With some changes to the makefile and a repurposed input folder, should this be possible?

I was just hoping to get some further insight before going down this long path.

Thanks in advance!

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-20 11:36:43 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

[Jeffrey Blank]

Yes, though I simply haven't had time to refactor the code to make it
easily portable.  And of course I'd welcome tooling improvements as
commits to SSG, for anyone similarly-minded.

A simplified version has already been dropped here, for another platform:
$ svn checkout https://svn.macosforge.org/repository/scap-on-apple

(This is also simpler, as there is no OVAL involved.)

On 08/20/2013 11:36 AM, Trey Henefield wrote:
> Just food for thought. Has there been any desire to make changes to SSG
> to accommodate building other (non-rhel6) SSGs?
>
> I am getting up to speed on its processes, and for practice and actual
> need, was thinking of creating an SSG for Firefox and Java, and
> potentially webmin and apache. However, I noticed rhel6 is embedded all
> throughout.
>
> I have noticed that most of the processes in place can be repurposed.
> With some changes to the makefile and a repurposed input folder, should
> this be possible?
>
> I was just hoping to get some further insight before going down this
> long path.
>
> Thanks in advance!
>
> Best regards,
>
> Trey Henefield, CISSP
>
> Senior IAVA Engineer
>
> Ultra Electronics
>
> Advanced Tactical Systems, Inc.
>
> 4101 Smith School Road
>
> Building IV, Suite 100
>
> Austin, TX 78744 USA
>
> [e-mail]
>
> Tel: [phone] ext. 647
>
> Fax: [phone]
>
> Mobile: [phone]
>
> www.ultra-ats.com
>
> *Disclaimer*
> The information contained in this communication from
> *[e-mail] * sent at 2013-08-20 11:36:43 is private
> and may be legally privileged or export controlled. It is intended
> solely for use by *[e-mail] * and
> others authorized to receive it. If you are not
> *[e-mail] * you are hereby notified
> that any disclosure, copying, distribution or taking action in reliance
> of the contents of this information is strictly prohibited and may be
> unlawful.
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

[Trey Henefield]

Thanks for the info.

In short, I created a variable named STIG and then referenced it throughout. Then I created a subfolder underneath the input folder with the same name as the STIG. This would allow me to have multiple SSG projects in the same repository without having to duplicate the entire repository for each SSG. I want to ensure that when changes are made to the files supporting the build process, that I don't have to update those changes for every project. This method would support that goal.

Now I just need a way to dynamically list each project folder under input and perform the make for each all from within the Makefile.

My thoughts were to include the following changes to the Makefile, as described above:

#################################

IN = input
OUT = output
TRANS = transforms
REFS = references
UTILS = utils
DIST = dist
STIG = rhel6

ID = ssg

all: shorthand2xccdf tables guide checks content dist

shorthand-guide:
    xsltproc -o $(OUT)/$(STIG)-shorthand.xml $(IN)/$(STIG)/guide.xslt $(IN)/$(STIG)/guide.xml
    xmllint --format --output $(OUT)/$(STIG)-shorthand.xml $(OUT)/$(STIG)-shorthand.xml

shorthand2xccdf: shorthand-guide
    xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/$(STIG)-shorthand.xml
    xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-shorthand.xml
    xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml \
    	$(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-$(STIG)-xccdf.xml
    oscap xccdf resolve -o $(OUT)/unlinked-$(STIG)-xccdf.xml $(OUT)/unlinked-unresolved-$(STIG)-xccdf.xml
#	xsltproc -stringparam profile "stig-$(STIG)-server" -o $(OUT)/unlinked-$(STIG)-xccdf.xml \
#		$(TRANS)/xccdf-addrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
#   extract manual check instructions from xccdf into an ocil file
    xsltproc -o $(OUT)/unlinked-$(STIG)-ocil.xml $(TRANS)/xccdf-create-ocil.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    xmllint --format --output $(OUT)/unlinked-$(STIG)-ocil.xml $(OUT)/unlinked-$(STIG)-ocil.xml 
    xsltproc -o $(OUT)/unlinked-ocilrefs-$(STIG)-xccdf.xml $(TRANS)/xccdf-ocilcheck2ref.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    ./$(TRANS)/combinefixes.py $(IN)/$(STIG)/fixes/bash/ $(OUT)/bash-remediations.xml
    xsltproc -stringparam fixes "../$(OUT)/bash-remediations.xml" -o $(OUT)/unlinked-$(STIG)-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    xmllint --format --output $(OUT)/unlinked-$(STIG)-xccdf.xml $(OUT)/unlinked-$(STIG)-xccdf.xml

checks:
    xmlwf $(IN)/$(STIG)/checks/*.xml
    $(TRANS)/combinechecks.py $(IN)/$(STIG)/checks > $(OUT)/unlinked-$(STIG)-oval.xml
    xmllint --format --output $(OUT)/unlinked-$(STIG)-oval.xml $(OUT)/unlinked-$(STIG)-oval.xml

guide: shorthand2xccdf
#	remove auxiliary Groups which are only for use in tables, and not guide output.
#	specifying a nonexistent profile, "allrules," to make oscap print all Rules
    xsltproc -o $(OUT)/unlinked-$(STIG)-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    xsltproc -o $(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-$(STIG)-xccdf-guide.xml > $(OUT)/$(STIG)-guide.html

# example, if needed: for converting XCCDF into shorthand
#xccdf2shorthand:
#	xsltproc -o $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml $(TRANS)/xccdf2shorthand.xslt $(REFS)/usgcb-rhel5desktop-xccdf.xml
#	tidy -m -xml -utf8 --indent-spaces=0 $(XCCDF_OUTPUT_DIR)/rhel5-shorthand.xml

table-refs: shorthand2xccdf
    xsltproc -stringparam ref "nist" -o $(OUT)/table-$(STIG)-nistrefs.html $(TRANS)/xccdf2table-byref.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml
    xsltproc -stringparam profile "common" -o $(OUT)/table-$(STIG)-nistrefs-common.html \
    	$(TRANS)/xccdf2table-profilenistrefs.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml

table-idents: shorthand2xccdf
    xsltproc -o $(OUT)/table-$(STIG)-cces.html $(TRANS)/xccdf2table-cce.xslt $(OUT)/unlinked-$(STIG)-xccdf.xml

table-srgmap: shorthand2xccdf
# the map-to-items filename must be provided relative to the root of the main document being processed
    xsltproc -stringparam map-to-items "../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o $(OUT)/table-$(STIG)-srgmap.html \
    	$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
    xsltproc -stringparam flat "y" -stringparam map-to-items "../$(OUT)/unlinked-$(STIG)-xccdf.xml" -o $(OUT)/table-$(STIG)-srgmap-flat.html \
    	$(TRANS)/table-srgmap.xslt $(REFS)/disa-os-srg-v1r1.xml
    xmllint --xmlout --html --output $(OUT)/table-$(STIG)-srgmap-flat.xhtml $(OUT)/table-$(STIG)-srgmap-flat.html

table-stigs: shorthand2xccdf table-srgmap
    xsltproc -o $(OUT)/table-rhel5-stig.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf.xml  
    xsltproc -o $(OUT)/table-rhel5-stig-manual.html $(TRANS)/xccdf2table-stig.xslt $(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml  
#	xsltproc -stringparam notes "../$(IN)/$(STIG)/auxiliary/transition_notes.xml" -o $(OUT)/table-rhel5-stig-manual-withnotes.html \
#		$(TRANS)/xccdf2table-stig.xslt \
#		$(REFS)/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
#	temporarily retain an output file showing the short titles as well
    xsltproc -stringparam profile "stig-$(STIG)-server" -stringparam testinfo "y" -o $(OUT)/table-stig-$(STIG)-shorttitles.html \
    	$(TRANS)/xccdf2table-profileccirefs.xslt \
    	$(OUT)/unlinked-$(STIG)-xccdf.xml
    xsltproc -stringparam profile "rht-ccp" -stringparam testinfo "y" -o $(OUT)/table-stig-$(STIG)-shorttitles.html \
    	$(TRANS)/xccdf2table-profileccirefs.xslt \
    	$(OUT)/unlinked-$(STIG)-xccdf.xml
    xsltproc -stringparam overlay "../$(IN)/$(STIG)/auxiliary/stig_overlay.xml" -o $(OUT)/unlinked-stig-$(STIG)-xccdf.xml \
    	$(TRANS)/xccdf-apply-overlay-stig.xslt \
    	$(OUT)/unlinked-$(STIG)-xccdf.xml
    xsltproc -o $(OUT)/table-stig-$(STIG).html $(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-$(STIG)-xccdf.xml

tables: table-refs table-idents table-srgmap table-stigs

content: shorthand2xccdf guide checks
#	the relabelids.py script chdirs to ./output, so refer to files from there.
#	its second argument controls the IDs, as well as the output filenames.
#	thus, with ID set to ssg, this creates ssg-$(STIG)-xccdf.xml and ssg-$(STIG)-oval.xml.
    $(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml $(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml $(ID)
    $(TRANS)/relabelids.py unlinked-$(STIG)-xccdf.xml $(ID)
    $(TRANS)/relabelids.py unlinked-ocilrefs-$(STIG)-xccdf.xml $(ID)

content-stig: shorthand2xccdf guide checks
    xmllint --format --output $(OUT)/unlinked-stig-$(STIG)-xccdf.xml $(OUT)/unlinked-stig-$(STIG)-xccdf.xml 
    $(TRANS)/cpe_generate.py $(OUT)/unlinked-$(STIG)-oval.xml $(IN)/$(STIG)/checks/platform/$(STIG)-cpe-dictionary.xml disa-predraft
    $(TRANS)/relabelids.py unlinked-stig-$(STIG)-xccdf.xml disa-predraft
    xmllint --format --output $(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml $(OUT)/disa-predraft-stig-$(STIG)-xccdf.xml

submission-stig-check: table-stigs
    cd output; ../$(UTILS)/verify-references.py -p stig-$(STIG)-server --rules-with-disarefs-outside-profile unlinked-$(STIG)-xccdf-prerefs.xml
#	$(TRANS)/xccdf2csv-stig.py $(OUT)/unlinked-stig-$(STIG)-xccdf.xml > $(OUT)/table-stig.csv

# content-usgcb: coming soon

validate-xml:
    oscap xccdf validate-xml $(OUT)/$(ID)-$(STIG)-xccdf.xml
    oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-oval.xml
    oscap oval validate-xml $(OUT)/$(ID)-$(STIG)-cpe-oval.xml

validate: validate-xml
    cd output; ../$(UTILS)/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-$(STIG)-xccdf.xml
    oscap oval validate-xml --schematron $(OUT)/$(ID)-$(STIG)-oval.xml

eval-test:
    oscap xccdf eval --profile test $(OUT)/$(ID)-$(STIG)-xccdf.xml

eval-common:
    oscap xccdf eval --profile common --oval-results --results /tmp/results-test.xml $(OUT)/$(ID)-$(STIG)-xccdf.xml

# items in dist are expected for distribution in an rpm
dist: tables guide content
    mkdir -p $(DIST)/guide $(DIST)/content $(DIST)/policytables
    cp $(OUT)/*-guide.html $(DIST)/guide
    cp $(OUT)/$(ID)-$(STIG)-xccdf.xml $(DIST)/content
    cp $(OUT)/$(ID)-$(STIG)-oval.xml $(DIST)/content
    cp $(OUT)/$(ID)-$(STIG)-cpe-dictionary.xml $(DIST)/content
    cp $(OUT)/$(ID)-$(STIG)-cpe-oval.xml $(DIST)/content
    cp $(OUT)/table-$(STIG)-* $(DIST)/policytables

clean:
    rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf  $(OUT)/*.spec $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
    rm -rf $(DIST)/content $(DIST)/policytables $(DIST)/guide

#################################

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

[e-mail]
Tel: [phone] ext. 647
Fax: [phone]
Mobile: [phone]

www.ultra-ats.com

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Jeffrey Blank
Sent: Tuesday, August 20, 2013 10:50 AM
To: [e-mail]
Subject: Re: Generalising SSG ...

Yes, though I simply haven't had time to refactor the code to make it easily portable.  And of course I'd welcome tooling improvements as commits to SSG, for anyone similarly-minded.

A simplified version has already been dropped here, for another platform:
$ svn checkout https://svn.macosforge.org/repository/scap-on-apple

(This is also simpler, as there is no OVAL involved.)

On 08/20/2013 11:36 AM, Trey Henefield wrote:
> Just food for thought. Has there been any desire to make changes to 
> SSG to accommodate building other (non-rhel6) SSGs?
>
> I am getting up to speed on its processes, and for practice and actual 
> need, was thinking of creating an SSG for Firefox and Java, and 
> potentially webmin and apache. However, I noticed rhel6 is embedded 
> all throughout.
>
> I have noticed that most of the processes in place can be repurposed.
> With some changes to the makefile and a repurposed input folder, 
> should this be possible?
>
> I was just hoping to get some further insight before going down this 
> long path.
>
> Thanks in advance!
>
> Best regards,
>
> Trey Henefield, CISSP
>
> Senior IAVA Engineer
>
> Ultra Electronics
>
> Advanced Tactical Systems, Inc.
>
> 4101 Smith School Road
>
> Building IV, Suite 100
>
> Austin, TX 78744 USA
>
> [e-mail]
>
> Tel: [phone] ext. 647
>
> Fax: [phone]
>
> Mobile: [phone]
>
> www.ultra-ats.com
>
> *Disclaimer*
> The information contained in this communication from 
> *[e-mail] * sent at 2013-08-20 11:36:43 is private 
> and may be legally privileged or export controlled. It is intended 
> solely for use by *[e-mail] * and 
> others authorized to receive it. If you are not 
> *[e-mail] * you are hereby notified 
> that any disclosure, copying, distribution or taking action in 
> reliance of the contents of this information is strictly prohibited 
> and may be unlawful.
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

_______________________________________________
scap-security-guide mailing list
[e-mail]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Disclaimer
The information contained in this communication from [e-mail] sent at 2013-08-20 12:17:48 is confidential and may be legally privileged.
It is intended solely for use by [e-mail] and others authorized to receive it. If you are not [e-mail] you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

[Shawn Wells]

On 8/20/13 11:49 AM, Jeffrey Blank wrote:
> Yes, though I simply haven't had time to refactor the code to make it
> easily portable.  And of course I'd welcome tooling improvements as
> commits to SSG, for anyone similarly-minded.
>
> A simplified version has already been dropped here, for another platform:
> $ svn checkout https://svn.macosforge.org/repository/scap-on-apple
>
> (This is also simpler, as there is no OVAL involved.)
>
> On 08/20/2013 11:36 AM, Trey Henefield wrote:
> > Just food for thought. Has there been any desire to make changes to SSG
> > to accommodate building other (non-rhel6) SSGs?
> >
> > I am getting up to speed on its processes, and for practice and actual
> > need, was thinking of creating an SSG for Firefox and Java, and
> > potentially webmin and apache. However, I noticed rhel6 is embedded all
> > throughout.
> >
> > I have noticed that most of the processes in place can be repurposed.
> > With some changes to the makefile and a repurposed input folder, should
> > this be possible?
> >
> > I was just hoping to get some further insight before going down this
> > long path.
> >
> > Thanks in advance!

A thousand yes'.

Orchestration has been a bit challenging, largely since vendors desire 
development to happen within their own communities (FedoraHosted for RH, 
MacOSForge for Apple, etc). Less about vendor control, more about what 
open source licenses various people are allowed to follow via their 
employers.

We registered http://www.scapsecurityguides.net thinking it could be a 
"community site" where interested parties could work off a single build 
system, single dissemination site.... though there didn't seem to be 
much community interest in that. What do you think of the idea?

Fortunately RH ships and supports firefox, apache, and kinda sorta Java. 
Patches welcome here for now :)