Hi, Thank you for a detailed explanation of your use case. I have a couple of ideas:
You don't need `oscap` to run a XSLT transformation. You can just run `xsltproc` with the template. OpenSCAP can generate XCCDF results (add --results results.xml). You can then process the XCCDF results in arbitrary way. XCCDF results is a normal XML file. You can write XSLTs and use them to extract the snippets or do any other transformation as with normal XML. Even better, you can have a Python or Perl (or whatever) script that processes the XCCDF results. That script can generates your code snippets, it can have more complex logic. I guess it would be easier to write this logic in a scripting language. The XCCDF results is a standard format, specified by NIST. It includes the input XCCDF inside, so you have all the data to be able to process (it contains CCEs, rule IDs, etc.) I'm not sure if this feature could be a good fit for OpenSCAP or if we should develop something like that in OpenSCAP, because it seems to me as a very custom thing and every user will have different needs. If you envision something, any contributions are welcome. People are already collaborating on the fixes within SSG, which was renamed to ComplianceAsCode, on GitHub. https://github.com/ComplianceAsCode/content Regards Jan Černý Security Technologies | Red Hat, Inc. ----- Original Message ----- > From: "Boyd Ako" <boyd.hanalei....@gmail.com> > To: "Jan Cerny" <jce...@redhat.com> > Cc: open-scap-list@redhat.com > Sent: Saturday, January 12, 2019 2:05:21 AM > Subject: Re: [Open-scap] Making Fix Templates > > What do you mean by "map" the XCCDFs of SSG and DISA? I've looked into the > the DISA Vunerability IDs referenceing the CCI/CCEs that it's for. I > haven't checked it against the SSG XCCDF though. > > Yeah... I know the "generate fix" thing is muck. I'm actually having to > rebuild a system because the script killed my bootloader. > > I'm essentially trying to use the "generate fix" functionality using > external snippets. It's pretty obvious the snippets and the results are not > that dependable to use on production systems. It's what the template used > to do. It finds CCI XXX as open and searches the template for function CCI > XXX and adds the snippet to script. The snippet it's self would also > "double check" the finding and "fix" the finding in means that you could > run it over and over again and it'd only do something when the snippet > actually finds the finding as open. > > I get why the snippets are included into the XCCDF. However, it doesn't > have the ability to take in logic and conditions on a "per system" basis. I > know that's where the "tailoring" comes in. But that's also to "static". By > using a template, in the PRE section I can state that "if 3rd IP octet is > 130 do not run fix for CCI XXX or use value of blah for CCI XXX setting" > noting some official documentation for exception. > > That all being said, all Open SCAP then does is essentially just scan the > system. And in my work environment the SPAWAR SCC is the more approved > scanner. And I could make a script to read the results XML and generate a > fix script like Open SCAP would do. But, that would imply that we don't > need Open SCAP to begin with and remove a justification for the department > to purchase Red Hat Satellite. ... However, if I can use the Open SCAP to > use the stated authorized and approved DISA XCCDF and then use a template > to fill in the blanks for the finding snippets that would be a means more > likely to be approved. > > > All the XCCDFs are good for scanning. But, the fixing and remediation is > where most of the Sys Ads complain. And the XCCDF code snippets are not > reliable because only a really tiny group of people are able to update the > XCCDF files; officially. If the template function worked, I'd imagine a > bunch of people collaborating on making fix templates on GITHUB or where > ever. The XCCDF file needs to be official and authorized. The fix templates > do not. > > > ------------------------------ > Thank you for your time, > > Boyd H. Ako > > boyd.hanalei....@gmail.com > https://www.boydhanaleiako.me > Cell Phone: (424) 244-9653PGP/GPG Public Key: > https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 > ------------------------------ > > > On Thu, Jan 10, 2019 at 9:27 PM Jan Cerny <jce...@redhat.com> wrote: > > > Hi, > > > > I have looked into this quickly. But I haven't able to get that working. I > > haven't found > > anything in the source code that uses it. It seems to me that the feature > > has been removed > > without changing the documentation. I'm not sure if the removal was > > intended or if it is > > a regression. > > > > The "oscap xccdf generate fix" command only extracts the code snippets > > from the input > > XCCDF or DS file. There is no magic logic behind that, it is a very simple > > transformation. > > It doesn't understand or doesn't analyze the rules that are there. > > > > It isn't clear to me what you need. Do you try to map SSG XCCDF to XCCDF > > provided by DISA? > > > > Regards > > > > Jan Černý > > Security Technologies | Red Hat, Inc. > > > > ----- Original Message ----- > > > From: "Boyd Ako" <boyd.hanalei....@gmail.com> > > > To: open-scap-list@redhat.com > > > Sent: Wednesday, January 9, 2019 1:32:48 AM > > > Subject: [Open-scap] Making Fix Templates > > > > > > Aloha, > > > > > > So I had a couple questions. > > > > > > A) Is using the Fix Template function still being supported? > > > > > > B) Is there more detailed documentation on creating the template? I'm > > already > > > aware of the XSL "legacy" files in /usr/share/openscap/xsl. I seem to be > > > having issues with openscap outputing anything from the > > > legacy-fixtpl-bash.xml as it is or when I try to modify the "fixentry" to > > > map to a rule. > > > > > > C) If the Fix Template function is more or less dead in the water, is > > there a > > > way I can "convey" fixes for the remediation script generation that's > > either > > > local or on premise? I know that OpenSCAP does have a bunch of fixes for > > the > > > SSGs. But I can't really reach them due to isolation and even if I could > > it > > > wouldn't be permitted since it's "external" to "DISA Approved" stuff. > > > > > > > > > My environment: As awesome as it is that there's SSGs for DISA RHEL 7, I > > > can't use it because it doesn't have the MAC and Sensitivity profiles in > > the > > > actual RHEL 7 Benchmark from the DISA XCCDF. So, I'm using the the XCCDF > > > from DISA with the appropriate profile and none of the "rules" seem to > > match > > > any of the remediation fixes for the failed rules. Also due to networking > > > infrastructure, I'm more or less isoalted so fetching remote resources is > > > out. > > > > > > > > > > > > > > > Thank you for your time, > > > > > > Boyd H. Ako > > > > > > boyd.hanalei....@gmail.com > > > https://www.boydhanaleiako.me > > > > > > > > > Cell Phone: (424) 244-9653 PGP/GPG Public Key: > > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 > > > > > > > > > _______________________________________________ > > > Open-scap-list mailing list > > > Open-scap-list@redhat.com > > > https://www.redhat.com/mailman/listinfo/open-scap-list > > > _______________________________________________ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
