Added support scripts. #452
Conversation
Update branch
|
Just added one small change to check the IACONTROLS variable. The IA Controls get pulled properly from the RHEL 5 STIG. However the IA Controls in the RHEL6 STIG are managed differently and don't resolve. Applying this script without the last change would effectively remove all IA Control references in the RHEL6 SCAP content. |
|
|
Isn't that awesome! So much visibility! This has been a great help for me BTW, I just committed a couple updates to the stig_refs.sh script. I am Once I get all the dust settled from these initial changes, I will help out On Wed, Feb 25, 2015 at 12:07 PM, Shawn Wells notifications@github.com
|
shared/transforms/stig_refs.sh
Outdated
There was a problem hiding this comment.
this actually inserts two spaces before the stig=$val, e.g.:
<ident cce="26910-0" stig="RHEL-06-000282" />
There was a problem hiding this comment.
Will fix. Standby.
On Wed, Feb 25, 2015 at 12:16 PM, Shawn Wells notifications@github.com
wrote:
In shared/transforms/stig_refs.sh
#452 (comment)
:
# CCEif [ ! -z "${CCE}" ]; thenif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep -c "<ident ")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<\/Rule>)/<ident cce=\"${CCE}\" \/>\n\1/" ${FILE}elif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep "<ident " | grep -c "cce=")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident .*\)\/>/\1 cce=\"${CCE}\" \/>/" ${FILE}elsesed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident ._)cce=\"[a-zA-Z0-9-_.]_\"/\1cce=\"${CCE}\"/" ${FILE}fifi# STIG IDif [ ! -z "${STIG_ID}" ]; thenif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep -c "<ident ")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<\/Rule>)/<ident stig=\"${STIG_ID}\" \/>\n\1/" ${FILE}elif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep "<ident " | grep -c "stig=")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident .*\)\/>/\1 stig=\"${STIG_ID}\" \/>/" ${FILE}this actually inserts two spaces before the stig=$val, e.g.:
—
Reply to this email directly or view it on GitHub
https://github.com/OpenSCAP/scap-security-guide/pull/452/files#r25363784
.
There was a problem hiding this comment.
So I checked in a fix. It will no longer create the double spacing when
defining new values. However, running it won't fix the double spacing for
the ones already done. I do have a quick fix for that though. Since I need
to commit some additional changes for the RHEL6 STIG refs, I will also
commit the change to remove the double spacing added.
On Wed, Feb 25, 2015 at 12:17 PM, Trey Henefield thenefield@gmail.com
wrote:
Will fix. Standby.
On Wed, Feb 25, 2015 at 12:16 PM, Shawn Wells notifications@github.com
wrote:In shared/transforms/stig_refs.sh
#452 (comment)
:
# CCEif [ ! -z "${CCE}" ]; thenif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep -c "<ident ")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<\/Rule>)/<ident cce=\"${CCE}\" \/>\n\1/" ${FILE}elif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep "<ident " | grep -c "cce=")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident .*\)\/>/\1 cce=\"${CCE}\" \/>/" ${FILE}elsesed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident ._)cce=\"[a-zA-Z0-9-_.]_\"/\1cce=\"${CCE}\"/" ${FILE}fifi# STIG IDif [ ! -z "${STIG_ID}" ]; thenif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep -c "<ident ")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<\/Rule>)/<ident stig=\"${STIG_ID}\" \/>\n\1/" ${FILE}elif [ "$(awk "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/" ${FILE} | grep "<ident " | grep -c "stig=")" = "0" ]; thensed -i "/<Rule id=\"${RULE_ID}\"/,/<\/Rule>/s/(<ident .*\)\/>/\1 stig=\"${STIG_ID}\" \/>/" ${FILE}this actually inserts two spaces before the stig=$val, e.g.:
—
Reply to this email directly or view it on GitHub
https://github.com/OpenSCAP/scap-security-guide/pull/452/files#r25363784
.
thenefield
force-pushed
the
support_scripts2
branch
from
f69e5d3 to
e9dccb6
Compare
thenefield
force-pushed
the
support_scripts2
branch
from
e9dccb6 to
ab99df8
Compare
|
[test this please] mr. jenkins Thanks Trey, for this contribution. This seems to me, that it can be merged. What am I missing? |
|
Absolutely! I am not aware of any issues that need to be resolved before On Wed, Dec 9, 2015 at 5:33 AM Šimon Lukašík notifications@github.com
|
|
Ok, Trey, then please accept my sincere apology that this hasn't been merged in timely manner. |
7 participants
Two scripts are being added to facilitate some useful functions.
Both scripts should be executed from within the root folder of a given project (e.g. RHEL\6).
shared\transforms\stats.sh
The above script provides useful statistics based on the information presented in 'auxiliary\stig_overlay.xml'. It will identify the number of checks included, the number of fixes included, an overall number of STIG requirements indicated in the stig_overlay, and the number of STIG requirements in the XCCDF STIG document. This is useful for providing an overview of how much STIG coverage is accounted for. It is also useful for comparison against newly released STIGs to support identifying new requirements and deprecated requirements to ensure complete alignment.
shared\transforms\stig_refs.sh
The above script facilitates automating the updating of STIG information within the SCAP content. It will initially use 'auxiliary\stig_overlay.xml' to provide a mapping of STIG ID to SCAP RULE. Once that mapping has been created, it will update the 'auxiliary\stig_overlay.xml' data and the XML data associated with each rule in the 'services' and 'system' sub-folders. The script is also dependent on the XCCDF STIG document being located within the references folder of the project folder (e.g. RHEL\6\references).
The following data is updated in each location:
CCI
CCE
SEVERITY
SVKEY
VRELEASE
IA CONTROLS
TITLE
In addition it also includes a 'stig=' reference in the 'ident' section of each rule with the STIG ID. This will support a separate change to be committed, that will help identifying the appropriate STIG ID for each rule within the scan report.