openscap 0.4.9 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +7 -18
- data/Rakefile +2 -2
- data/lib/openscap/all.rb +1 -1
- data/lib/openscap/ds/arf.rb +3 -3
- data/lib/openscap/ds/sds.rb +8 -2
- data/lib/openscap/openscap.rb +9 -0
- data/lib/openscap/source.rb +10 -4
- data/lib/openscap/text.rb +34 -5
- data/lib/openscap/version.rb +1 -1
- data/lib/openscap/xccdf/benchmark.rb +64 -12
- data/lib/openscap/xccdf/fix.rb +4 -4
- data/lib/openscap/xccdf/group.rb +32 -0
- data/lib/openscap/xccdf/item.rb +33 -61
- data/lib/openscap/xccdf/item_common.rb +40 -0
- data/lib/openscap/xccdf/policy.rb +10 -0
- data/lib/openscap/xccdf/policy_model.rb +15 -6
- data/lib/openscap/xccdf/profile.rb +9 -9
- data/lib/openscap/xccdf/reference.rb +3 -3
- data/lib/openscap/xccdf/rule.rb +10 -14
- data/lib/openscap/xccdf/session.rb +18 -20
- data/lib/openscap/xccdf/status.rb +35 -0
- data/lib/openscap/xccdf/tailoring.rb +3 -6
- data/lib/openscap/xccdf/testresult.rb +10 -16
- data/lib/openscap/xccdf.rb +1 -1
- data/test/data/xccdf.xml +2 -1
- data/test/ds/arf_test.rb +9 -9
- data/test/ds/sds_test.rb +23 -5
- data/test/integration/arf_waiver_test.rb +5 -5
- data/test/source_test.rb +13 -13
- data/test/xccdf/arf_test.rb +1 -2
- data/test/xccdf/benchmark_test.rb +96 -10
- data/test/xccdf/item_test.rb +82 -0
- data/test/xccdf/policy_test.rb +35 -7
- data/test/xccdf/profile_test.rb +50 -8
- data/test/xccdf/session_ds_test.rb +13 -13
- data/test/xccdf/session_test.rb +2 -2
- data/test/xccdf/testresult_test.rb +9 -9
- data/test/xccdf/value_test.rb +67 -0
- metadata +16 -27
@@ -1,10 +1,12 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
3
|
require 'openscap/text'
|
4
|
+
require 'openscap/xccdf/item_common'
|
4
5
|
|
5
6
|
module OpenSCAP
|
6
7
|
module Xccdf
|
7
8
|
class Profile
|
9
|
+
include ItemCommon
|
8
10
|
attr_reader :raw
|
9
11
|
|
10
12
|
def initialize(p)
|
@@ -16,19 +18,17 @@ module OpenSCAP
|
|
16
18
|
end
|
17
19
|
end
|
18
20
|
|
19
|
-
def
|
20
|
-
OpenSCAP.
|
21
|
+
def status_current
|
22
|
+
pointer = OpenSCAP.xccdf_profile_get_status_current @raw
|
23
|
+
Status.new pointer unless pointer.null?
|
21
24
|
end
|
22
25
|
|
23
|
-
def
|
24
|
-
|
25
|
-
title = textlist.plaintext(prefered_lang)
|
26
|
-
textlist.destroy
|
27
|
-
title
|
26
|
+
def abstract?
|
27
|
+
OpenSCAP.xccdf_profile_get_abstract @raw
|
28
28
|
end
|
29
29
|
end
|
30
30
|
end
|
31
31
|
|
32
|
-
attach_function :
|
33
|
-
attach_function :
|
32
|
+
attach_function :xccdf_profile_get_status_current, [:pointer], :pointer
|
33
|
+
attach_function :xccdf_profile_get_abstract, [:pointer], :bool
|
34
34
|
end
|
data/lib/openscap/xccdf/rule.rb
CHANGED
@@ -11,33 +11,29 @@ module OpenSCAP
|
|
11
11
|
def severity
|
12
12
|
severity = OpenSCAP.xccdf_rule_get_severity(@raw)
|
13
13
|
severity_mapping = {
|
14
|
-
:
|
15
|
-
:
|
16
|
-
:
|
17
|
-
:
|
18
|
-
:
|
19
|
-
:
|
14
|
+
xccdf_level_not_defined: 'Not defined',
|
15
|
+
xccdf_unknown: 'Unknown',
|
16
|
+
xccdf_info: 'Info',
|
17
|
+
xccdf_low: 'Low',
|
18
|
+
xccdf_medium: 'Medium',
|
19
|
+
xccdf_high: 'High'
|
20
20
|
}
|
21
21
|
severity_mapping[severity] || severity_mapping[:xccdf_unknown]
|
22
22
|
end
|
23
23
|
|
24
24
|
def fixes
|
25
25
|
fixes = []
|
26
|
-
|
27
|
-
|
28
|
-
fixes << OpenSCAP::Xccdf::Fix.new(OpenSCAP.xccdf_fix_iterator_next(items_it))
|
26
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_rule_get_fixes(@raw), as: 'xccdf_fix' do |pointer|
|
27
|
+
fixes << OpenSCAP::Xccdf::Fix.new(pointer)
|
29
28
|
end
|
30
|
-
OpenSCAP.xccdf_fix_iterator_free items_it
|
31
29
|
fixes
|
32
30
|
end
|
33
31
|
|
34
32
|
def idents
|
35
33
|
idents = []
|
36
|
-
|
37
|
-
|
38
|
-
idents << OpenSCAP::Xccdf::Ident.new(OpenSCAP.xccdf_ident_iterator_next(idents_it))
|
34
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_rule_get_idents(@raw), as: 'xccdf_ident' do |pointer|
|
35
|
+
idents << OpenSCAP::Xccdf::Ident.new(pointer)
|
39
36
|
end
|
40
|
-
OpenSCAP.xccdf_ident_iterator_free idents_it
|
41
37
|
idents
|
42
38
|
end
|
43
39
|
end
|
@@ -17,8 +17,8 @@ module OpenSCAP
|
|
17
17
|
|
18
18
|
def load(opts = {})
|
19
19
|
o = {
|
20
|
-
:
|
21
|
-
:
|
20
|
+
datastream_id: nil,
|
21
|
+
component_id: nil
|
22
22
|
}.merge(opts)
|
23
23
|
if sds?
|
24
24
|
OpenSCAP.xccdf_session_set_datastream_id(@s, o[:datastream_id])
|
@@ -30,9 +30,7 @@ module OpenSCAP
|
|
30
30
|
|
31
31
|
def profile=(p)
|
32
32
|
@profile = p
|
33
|
-
if OpenSCAP.xccdf_session_set_profile_id(@s, p) == false
|
34
|
-
raise OpenSCAPError, "No profile '" + p + "' found"
|
35
|
-
end
|
33
|
+
raise OpenSCAPError, "No profile '#{p}' found" if OpenSCAP.xccdf_session_set_profile_id(@s, p) == false
|
36
34
|
end
|
37
35
|
|
38
36
|
def evaluate
|
@@ -45,12 +43,12 @@ module OpenSCAP
|
|
45
43
|
|
46
44
|
def export_results(opts = {})
|
47
45
|
o = {
|
48
|
-
:
|
49
|
-
:
|
50
|
-
:
|
51
|
-
:
|
52
|
-
:
|
53
|
-
:
|
46
|
+
rds_file: nil,
|
47
|
+
xccdf_file: nil,
|
48
|
+
report_file: nil,
|
49
|
+
oval_results: false,
|
50
|
+
oval_variables: false,
|
51
|
+
engines_results: false
|
54
52
|
}.merge!(opts)
|
55
53
|
export_targets o
|
56
54
|
export
|
@@ -94,13 +92,13 @@ module OpenSCAP
|
|
94
92
|
|
95
93
|
attach_function :xccdf_session_is_sds, [:pointer], :bool
|
96
94
|
|
97
|
-
attach_function :xccdf_session_set_profile_id, [
|
98
|
-
attach_function :xccdf_session_set_datastream_id, [
|
99
|
-
attach_function :xccdf_session_set_component_id, [
|
100
|
-
attach_function :xccdf_session_set_arf_export, [
|
101
|
-
attach_function :xccdf_session_set_xccdf_export, [
|
102
|
-
attach_function :xccdf_session_set_report_export, [
|
103
|
-
attach_function :xccdf_session_set_oval_variables_export, [
|
104
|
-
attach_function :xccdf_session_set_oval_results_export, [
|
105
|
-
attach_function :xccdf_session_set_check_engine_plugins_results_export, [
|
95
|
+
attach_function :xccdf_session_set_profile_id, %i[pointer string], :bool
|
96
|
+
attach_function :xccdf_session_set_datastream_id, %i[pointer string], :void
|
97
|
+
attach_function :xccdf_session_set_component_id, %i[pointer string], :void
|
98
|
+
attach_function :xccdf_session_set_arf_export, %i[pointer string], :bool
|
99
|
+
attach_function :xccdf_session_set_xccdf_export, %i[pointer string], :bool
|
100
|
+
attach_function :xccdf_session_set_report_export, %i[pointer string], :bool
|
101
|
+
attach_function :xccdf_session_set_oval_variables_export, %i[pointer bool], :void
|
102
|
+
attach_function :xccdf_session_set_oval_results_export, %i[pointer bool], :void
|
103
|
+
attach_function :xccdf_session_set_check_engine_plugins_results_export, %i[pointer bool], :void
|
106
104
|
end
|
@@ -0,0 +1,35 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module OpenSCAP
|
4
|
+
module Xccdf
|
5
|
+
class Status
|
6
|
+
def initialize(raw)
|
7
|
+
raise OpenSCAP::OpenSCAPError, "Cannot initialize #{self.class.name} with '#{raw}'" \
|
8
|
+
unless raw.is_a?(FFI::Pointer)
|
9
|
+
|
10
|
+
@raw = raw
|
11
|
+
end
|
12
|
+
|
13
|
+
def status
|
14
|
+
OpenSCAP.xccdf_status_get_status @raw
|
15
|
+
end
|
16
|
+
|
17
|
+
def date
|
18
|
+
unix_t = OpenSCAP.xccdf_status_get_date @raw
|
19
|
+
Time.at unix_t
|
20
|
+
end
|
21
|
+
end
|
22
|
+
end
|
23
|
+
|
24
|
+
enum :xccdf_status_type_t, [
|
25
|
+
:not_specified, # empty value
|
26
|
+
:accepted,
|
27
|
+
:deprecated,
|
28
|
+
:draft,
|
29
|
+
:incomplete,
|
30
|
+
:interim
|
31
|
+
]
|
32
|
+
|
33
|
+
attach_function :xccdf_status_get_status, [:pointer], :xccdf_status_type_t
|
34
|
+
attach_function :xccdf_status_get_date, [:pointer], :time_t
|
35
|
+
end
|
@@ -31,19 +31,16 @@ module OpenSCAP
|
|
31
31
|
|
32
32
|
def profiles_init
|
33
33
|
profiles = {}
|
34
|
-
|
35
|
-
|
36
|
-
profile_p = OpenSCAP.xccdf_profile_iterator_next profit
|
37
|
-
profile = OpenSCAP::Xccdf::Profile.new profile_p
|
34
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_tailoring_get_profiles(@raw), as: 'xccdf_profile' do |pointer|
|
35
|
+
profile = OpenSCAP::Xccdf::Profile.new pointer
|
38
36
|
profiles[profile.id] = profile
|
39
37
|
end
|
40
|
-
OpenSCAP.xccdf_profile_iterator_free profit
|
41
38
|
profiles
|
42
39
|
end
|
43
40
|
end
|
44
41
|
end
|
45
42
|
|
46
|
-
attach_function :xccdf_tailoring_import_source, [
|
43
|
+
attach_function :xccdf_tailoring_import_source, %i[pointer pointer], :pointer
|
47
44
|
attach_function :xccdf_tailoring_free, [:pointer], :void
|
48
45
|
|
49
46
|
attach_function :xccdf_tailoring_get_profiles, [:pointer], :pointer
|
@@ -8,8 +8,7 @@ require 'openscap/xccdf/ruleresult'
|
|
8
8
|
module OpenSCAP
|
9
9
|
module Xccdf
|
10
10
|
class TestResult
|
11
|
-
attr_reader :rr
|
12
|
-
attr_reader :raw
|
11
|
+
attr_reader :rr, :raw
|
13
12
|
|
14
13
|
def initialize(t)
|
15
14
|
case t
|
@@ -58,27 +57,22 @@ module OpenSCAP
|
|
58
57
|
|
59
58
|
def init_ruleresults
|
60
59
|
@rr = {}
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
rr = OpenSCAP::Xccdf::RuleResult.new rr_raw
|
60
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_result_get_rule_results(@raw),
|
61
|
+
as: 'xccdf_rule_result' do |pointer|
|
62
|
+
rr = OpenSCAP::Xccdf::RuleResult.new pointer
|
65
63
|
@rr[rr.id] = rr
|
66
64
|
end
|
67
|
-
OpenSCAP.xccdf_rule_result_iterator_free(rr_it)
|
68
65
|
end
|
69
66
|
|
70
67
|
def score_init
|
71
68
|
scores = {}
|
72
|
-
|
73
|
-
while OpenSCAP.xccdf_score_iterator_has_more(scorit)
|
74
|
-
s = OpenSCAP.xccdf_score_iterator_next(scorit)
|
69
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_result_get_scores(@raw), as: 'xccdf_score' do |s|
|
75
70
|
scores[OpenSCAP.xccdf_score_get_system(s)] = {
|
76
|
-
:
|
77
|
-
:
|
78
|
-
:
|
71
|
+
system: OpenSCAP.xccdf_score_get_system(s),
|
72
|
+
value: OpenSCAP.xccdf_score_get_score(s),
|
73
|
+
max: OpenSCAP.xccdf_score_get_maximum(s)
|
79
74
|
}
|
80
75
|
end
|
81
|
-
OpenSCAP.xccdf_score_iterator_free(scorit)
|
82
76
|
scores
|
83
77
|
end
|
84
78
|
end
|
@@ -88,8 +82,8 @@ module OpenSCAP
|
|
88
82
|
attach_function :xccdf_result_free, [:pointer], :void
|
89
83
|
attach_function :xccdf_result_get_id, [:pointer], :string
|
90
84
|
attach_function :xccdf_result_get_profile, [:pointer], :string
|
91
|
-
attach_function :xccdf_result_recalculate_scores, [
|
92
|
-
attach_function :xccdf_result_export_source, [
|
85
|
+
attach_function :xccdf_result_recalculate_scores, %i[pointer pointer], :int
|
86
|
+
attach_function :xccdf_result_export_source, %i[pointer string], :pointer
|
93
87
|
|
94
88
|
attach_function :xccdf_result_get_rule_results, [:pointer], :pointer
|
95
89
|
attach_function :xccdf_rule_result_iterator_has_more, [:pointer], :bool
|
data/lib/openscap/xccdf.rb
CHANGED
data/test/data/xccdf.xml
CHANGED
@@ -71,6 +71,7 @@ respective companies.</rear-matter>
|
|
71
71
|
<version>0.0.4</version>
|
72
72
|
<model system="urn:xccdf:scoring:default"/>
|
73
73
|
<Profile id="xccdf_org.ssgproject.content_profile_common">
|
74
|
+
<version>3.2.1</version>
|
74
75
|
<title xml:lang="en-US">Common Profile for General-Purpose Fedora Systems</title>
|
75
76
|
<description xml:lang="en-US">This profile contains items common to general-purpose Fedora installations.</description>
|
76
77
|
<select idref="xccdf_org.ssgproject.content_rule_disable_prelink" selected="true"/>
|
@@ -461,7 +462,7 @@ If this check produces any unexpected output, investigate.
|
|
461
462
|
<reference href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf">SC-28</reference>
|
462
463
|
<reference href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf">SI-7</reference>
|
463
464
|
<rationale xml:lang="en-US">
|
464
|
-
For AIDE to be effective, an initial database of "known-good" information about files
|
465
|
+
For AIDE to be effective, an initial database of <i xmlns="http://www.w3.org/1999/xhtml">"known-good"</i> information about files
|
465
466
|
must be captured and it should be able to be verified against the installed files.
|
466
467
|
</rationale>
|
467
468
|
</Rule>
|
data/test/ds/arf_test.rb
CHANGED
@@ -15,7 +15,7 @@ class TestArf < OpenSCAP::TestCase
|
|
15
15
|
rescue OpenSCAP::OpenSCAPError => e
|
16
16
|
msg = e.to_s
|
17
17
|
end
|
18
|
-
assert msg.start_with?("Cannot initialize OpenSCAP::DS::Arf with ''"),
|
18
|
+
assert msg.start_with?("Cannot initialize OpenSCAP::DS::Arf with ''"), "Message was: #{msg}"
|
19
19
|
end
|
20
20
|
|
21
21
|
def test_arf_new_wrong_format
|
@@ -27,7 +27,7 @@ class TestArf < OpenSCAP::TestCase
|
|
27
27
|
msg = e.to_s
|
28
28
|
end
|
29
29
|
assert msg.include?('Could not create Result DataStream session: File is not Result DataStream.'),
|
30
|
-
|
30
|
+
"Message was: #{msg}"
|
31
31
|
end
|
32
32
|
|
33
33
|
def test_create_arf_and_get_html
|
@@ -52,17 +52,17 @@ class TestArf < OpenSCAP::TestCase
|
|
52
52
|
create_arf
|
53
53
|
raw_data = File.read(REPORT)
|
54
54
|
refute raw_data.empty?
|
55
|
-
arf = OpenSCAP::DS::Arf.new :
|
55
|
+
arf = OpenSCAP::DS::Arf.new content: raw_data, path: REPORT
|
56
56
|
arf.destroy
|
57
57
|
end
|
58
58
|
|
59
59
|
def test_new_bz_memory
|
60
60
|
bziped_file = new_arf_bz
|
61
|
-
raw_data = File.
|
61
|
+
raw_data = File.binread(bziped_file)
|
62
62
|
assert !raw_data.empty?
|
63
63
|
len = File.size(bziped_file)
|
64
64
|
FileUtils.rm bziped_file
|
65
|
-
arf = OpenSCAP::DS::Arf.new :
|
65
|
+
arf = OpenSCAP::DS::Arf.new content: raw_data, path: bziped_file, length: len
|
66
66
|
arf.destroy
|
67
67
|
end
|
68
68
|
|
@@ -77,8 +77,8 @@ class TestArf < OpenSCAP::TestCase
|
|
77
77
|
|
78
78
|
def new_arf_bz
|
79
79
|
create_arf
|
80
|
-
system(
|
81
|
-
REPORT
|
80
|
+
system("/usr/bin/bzip2 #{REPORT}")
|
81
|
+
"#{REPORT}.bz2"
|
82
82
|
end
|
83
83
|
|
84
84
|
def new_arf
|
@@ -88,9 +88,9 @@ class TestArf < OpenSCAP::TestCase
|
|
88
88
|
|
89
89
|
def create_arf
|
90
90
|
@s = OpenSCAP::Xccdf::Session.new('../data/sds-complex.xml')
|
91
|
-
@s.load(:
|
91
|
+
@s.load(component_id: 'scap_org.open-scap_cref_second-xccdf.xml')
|
92
92
|
@s.profile = 'xccdf_moc.elpmaxe.www_profile_1'
|
93
93
|
@s.evaluate
|
94
|
-
@s.export_results(:
|
94
|
+
@s.export_results(rds_file: 'report.rds.xml')
|
95
95
|
end
|
96
96
|
end
|
data/test/ds/sds_test.rb
CHANGED
@@ -6,6 +6,8 @@ require 'openscap/ds/sds'
|
|
6
6
|
require 'common/testcase'
|
7
7
|
|
8
8
|
class TestSds < OpenSCAP::TestCase
|
9
|
+
DS_FILE = '../data/sds-complex.xml'
|
10
|
+
|
9
11
|
def test_new
|
10
12
|
new_sds.destroy
|
11
13
|
end
|
@@ -16,7 +18,7 @@ class TestSds < OpenSCAP::TestCase
|
|
16
18
|
assert !@s.nil?
|
17
19
|
msg = nil
|
18
20
|
begin
|
19
|
-
OpenSCAP::DS::Sds.new :
|
21
|
+
OpenSCAP::DS::Sds.new source: @s
|
20
22
|
assert false
|
21
23
|
rescue OpenSCAP::OpenSCAPError => e
|
22
24
|
msg = e.to_s
|
@@ -48,7 +50,7 @@ class TestSds < OpenSCAP::TestCase
|
|
48
50
|
sds = new_sds
|
49
51
|
msg = nil
|
50
52
|
begin
|
51
|
-
benchmark = sds.select_checklist! :
|
53
|
+
benchmark = sds.select_checklist! datastream_id: 'wrong'
|
52
54
|
assert false
|
53
55
|
rescue OpenSCAP::OpenSCAPError => e
|
54
56
|
msg = e.to_s
|
@@ -58,13 +60,29 @@ class TestSds < OpenSCAP::TestCase
|
|
58
60
|
sds.destroy
|
59
61
|
end
|
60
62
|
|
63
|
+
def tests_use_through_yields
|
64
|
+
OpenSCAP::Source.new DS_FILE do |source|
|
65
|
+
assert_equal 'SCAP Source Datastream', source.type
|
66
|
+
OpenSCAP::DS::Sds.new source: do |sds|
|
67
|
+
benchmark_source = sds.select_checklist!
|
68
|
+
html = sds.html_guide
|
69
|
+
assert_include html, 'bootstrap'
|
70
|
+
|
71
|
+
OpenSCAP::Xccdf::Benchmark.new benchmark_source do |benchmark|
|
72
|
+
assert_empty benchmark.profiles
|
73
|
+
assert benchmark.items.length == 1
|
74
|
+
assert benchmark.items.keys.first == 'xccdf_moc.elpmaxe.www_rule_first'
|
75
|
+
end
|
76
|
+
end
|
77
|
+
end
|
78
|
+
end
|
79
|
+
|
61
80
|
private
|
62
81
|
|
63
82
|
def new_sds
|
64
|
-
|
65
|
-
@s = OpenSCAP::Source.new filename
|
83
|
+
@s = OpenSCAP::Source.new DS_FILE
|
66
84
|
assert !@s.nil?
|
67
|
-
sds = OpenSCAP::DS::Sds.new :
|
85
|
+
sds = OpenSCAP::DS::Sds.new source: @s
|
68
86
|
assert !sds.nil?
|
69
87
|
sds
|
70
88
|
end
|
@@ -14,10 +14,10 @@ class TestArfWaiver < OpenSCAP::TestCase
|
|
14
14
|
assert_default_score tr.score, -1, 1
|
15
15
|
assert_default_score tr.score!(benchmark), -1, 1
|
16
16
|
|
17
|
-
rr.override!(:
|
18
|
-
:
|
19
|
-
:
|
20
|
-
:
|
17
|
+
rr.override!(new_result: :pass,
|
18
|
+
time: 'yesterday',
|
19
|
+
authority: 'John Hacker',
|
20
|
+
raw_text: 'This should have passed')
|
21
21
|
assert rr.result == 'pass'
|
22
22
|
|
23
23
|
assert_default_score tr.score, -1, 1
|
@@ -85,7 +85,7 @@ class TestArfWaiver < OpenSCAP::TestCase
|
|
85
85
|
@s = OpenSCAP::Xccdf::Session.new('../data/sds-complex.xml')
|
86
86
|
@s.load
|
87
87
|
@s.evaluate
|
88
|
-
@s.export_results(:
|
88
|
+
@s.export_results(rds_file: 'report.rds.xml')
|
89
89
|
OpenSCAP::DS::Arf.new('report.rds.xml')
|
90
90
|
end
|
91
91
|
end
|
data/test/source_test.rb
CHANGED
@@ -13,7 +13,7 @@ class TestSource < OpenSCAP::TestCase
|
|
13
13
|
rescue OpenSCAP::OpenSCAPError => e
|
14
14
|
msg = e.to_s
|
15
15
|
end
|
16
|
-
assert msg.start_with?('No filename specified!'),
|
16
|
+
assert msg.start_with?('No filename specified!'), "Message was: #{msg}"
|
17
17
|
end
|
18
18
|
|
19
19
|
def test_source_new_ok
|
@@ -24,22 +24,22 @@ class TestSource < OpenSCAP::TestCase
|
|
24
24
|
def test_source_new_memory
|
25
25
|
raw_data = File.read('../data/xccdf.xml')
|
26
26
|
refute raw_data.empty?
|
27
|
-
s = OpenSCAP::Source.new(:
|
27
|
+
s = OpenSCAP::Source.new(content: raw_data, path: '/mytestpath')
|
28
28
|
s.destroy
|
29
29
|
end
|
30
30
|
|
31
31
|
def test_type_xccdf
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
32
|
+
OpenSCAP::Source.new('../data/xccdf.xml') do |s|
|
33
|
+
assert s.type == 'XCCDF Checklist', "Type was #{s.type}"
|
34
|
+
s.validate!
|
35
|
+
end
|
36
36
|
end
|
37
37
|
|
38
38
|
def test_type_sds
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
39
|
+
OpenSCAP::Source.new('../data/sds-complex.xml') do |s|
|
40
|
+
assert s.type == 'SCAP Source Datastream', "Type was #{s.type}"
|
41
|
+
s.validate!
|
42
|
+
end
|
43
43
|
end
|
44
44
|
|
45
45
|
def test_type_test_result
|
@@ -59,11 +59,11 @@ class TestSource < OpenSCAP::TestCase
|
|
59
59
|
msg = e.to_s
|
60
60
|
end
|
61
61
|
assert msg.start_with?('Invalid XCCDF Checklist (1.2) content in ../data/invalid.xml.'),
|
62
|
-
|
62
|
+
"Message was: #{msg}"
|
63
63
|
assert msg.include?("../data/invalid.xml:3: Element '{http"),
|
64
|
-
|
64
|
+
"Message was: #{msg}"
|
65
65
|
assert msg.include?('This element is not expected. Expected is'),
|
66
|
-
|
66
|
+
"Message was: #{msg}"
|
67
67
|
s.destroy
|
68
68
|
end
|
69
69
|
|
data/test/xccdf/arf_test.rb
CHANGED
@@ -38,7 +38,6 @@ class TestArf < OpenSCAP::TestCase
|
|
38
38
|
_test_results = arf.test_result
|
39
39
|
source_datastream = arf.report_request
|
40
40
|
bench_source = source_datastream.select_checklist!
|
41
|
-
|
42
|
-
benchmark
|
41
|
+
OpenSCAP::Xccdf::Benchmark.new(bench_source)
|
43
42
|
end
|
44
43
|
end
|
@@ -78,12 +78,12 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
78
78
|
def test_items_references
|
79
79
|
b = benchmark_from_file
|
80
80
|
install_hids_rule = b.items['xccdf_org.ssgproject.content_rule_install_hids']
|
81
|
-
expected_references = [{ :
|
82
|
-
:
|
83
|
-
:
|
84
|
-
{ :
|
85
|
-
:
|
86
|
-
:
|
81
|
+
expected_references = [{ title: 'SC-7',
|
82
|
+
href: 'http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf',
|
83
|
+
html_link: "<a href='http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf'>SC-7</a>" },
|
84
|
+
{ title: '1263',
|
85
|
+
href: 'http://iase.disa.mil/cci/index.html',
|
86
|
+
html_link: "<a href='http://iase.disa.mil/cci/index.html'>1263</a>" }]
|
87
87
|
assert_equal(expected_references, install_hids_rule.references.map(&:to_hash), 'Install hids references should be equal')
|
88
88
|
b.destroy
|
89
89
|
end
|
@@ -93,16 +93,75 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
93
93
|
login_defs_rule = b.items['xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs']
|
94
94
|
expected_content = ["var_accounts_minimum_age_login_defs=\"<sub xmlns=\"http://checklists.nist.gov/xccdf/1.2\" idref=\"xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs\" use=\"legacy\"/>\"\ngrep -q ^PASS_MIN_DAYS /etc/login.defs && \\\nsed -i \"s/PASS_MIN_DAYS.*/PASS_MIN_DAYS\\t$var_accounts_minimum_age_login_defs/g\" /etc/login.defs\nif ! [ $? -eq 0 ]\nthen\n echo -e \"PASS_MIN_DAYS\\t$var_accounts_minimum_age_login_defs\" >> /etc/login.defs\nfi\n"]
|
95
95
|
expected_hashes = [{
|
96
|
-
:
|
97
|
-
:
|
98
|
-
:
|
99
|
-
:
|
96
|
+
id: nil,
|
97
|
+
platform: nil,
|
98
|
+
content: expected_content.first,
|
99
|
+
system: 'urn:xccdf:fix:script:sh'
|
100
100
|
}]
|
101
101
|
assert_equal(expected_content, login_defs_rule.fixes.map(&:content), 'Fix content should match')
|
102
102
|
assert_equal(expected_hashes, login_defs_rule.fixes.map(&:to_hash), 'Fix hash should match')
|
103
103
|
b.destroy
|
104
104
|
end
|
105
105
|
|
106
|
+
def test_benchamrk_id
|
107
|
+
with_benchmark do |b|
|
108
|
+
assert_equal b.id, 'xccdf_org.ssgproject.content_benchmark_FEDORA'
|
109
|
+
end
|
110
|
+
end
|
111
|
+
|
112
|
+
def test_status_current
|
113
|
+
with_benchmark do |b|
|
114
|
+
status = b.status_current
|
115
|
+
assert_equal status.status, :draft
|
116
|
+
release_date = status.date
|
117
|
+
assert_equal release_date.year, 2014
|
118
|
+
assert_equal release_date.month, 10
|
119
|
+
assert_equal release_date.day, 2
|
120
|
+
end
|
121
|
+
end
|
122
|
+
|
123
|
+
def test_title
|
124
|
+
with_benchmark do |b|
|
125
|
+
assert_equal b.title, 'Guide to the Secure Configuration of Fedora'
|
126
|
+
end
|
127
|
+
end
|
128
|
+
|
129
|
+
def test_description
|
130
|
+
with_benchmark do |b|
|
131
|
+
assert_equal b.description, DESCRIPTION
|
132
|
+
end
|
133
|
+
end
|
134
|
+
|
135
|
+
def test_version
|
136
|
+
with_benchmark do |b|
|
137
|
+
assert_equal b.version, '0.0.4'
|
138
|
+
end
|
139
|
+
end
|
140
|
+
|
141
|
+
def test_references
|
142
|
+
with_benchmark do |b|
|
143
|
+
assert_equal b.references, []
|
144
|
+
end
|
145
|
+
end
|
146
|
+
|
147
|
+
def test_resolved
|
148
|
+
with_benchmark do |b|
|
149
|
+
assert b.resolved?
|
150
|
+
end
|
151
|
+
end
|
152
|
+
|
153
|
+
def test_policy_model
|
154
|
+
with_benchmark do |b|
|
155
|
+
assert b.policy_model.policies.keys == ['xccdf_org.ssgproject.content_profile_common']
|
156
|
+
end
|
157
|
+
end
|
158
|
+
|
159
|
+
def test_schema_version
|
160
|
+
with_benchmark do |b|
|
161
|
+
assert_equal b.schema_version, '1.2'
|
162
|
+
end
|
163
|
+
end
|
164
|
+
|
106
165
|
private
|
107
166
|
|
108
167
|
def benchmark_from_file
|
@@ -112,4 +171,31 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
112
171
|
assert !b.nil?
|
113
172
|
b
|
114
173
|
end
|
174
|
+
|
175
|
+
def with_benchmark(&)
|
176
|
+
OpenSCAP::Source.new '../data/xccdf.xml' do |source|
|
177
|
+
OpenSCAP::Xccdf::Benchmark.new(source, &)
|
178
|
+
end
|
179
|
+
end
|
180
|
+
|
181
|
+
DESCRIPTION = "This guide presents a catalog of security-relevant configuration\n" \
|
182
|
+
"settings for Fedora operating system formatted in the eXtensible Configuration\n" \
|
183
|
+
"Checklist Description Format (XCCDF).\n" \
|
184
|
+
"<br xmlns=\"http://www.w3.org/1999/xhtml\"/>\n" \
|
185
|
+
"<br xmlns=\"http://www.w3.org/1999/xhtml\"/>\n" \
|
186
|
+
"Providing system administrators with such guidance informs them how to securely\n" \
|
187
|
+
"configure systems under their control in a variety of network roles. Policy\n" \
|
188
|
+
"makers and baseline creators can use this catalog of settings, with its\n" \
|
189
|
+
"associated references to higher-level security control catalogs, in order to\n" \
|
190
|
+
"assist them in security baseline creation. This guide is a <i xmlns=\"http://www.w3.org/1999/xhtml\">catalog, not a\n" \
|
191
|
+
"checklist,</i> and satisfaction of every item is not likely to be possible or\n" \
|
192
|
+
"sensible in many operational scenarios. However, the XCCDF format enables\n" \
|
193
|
+
"granular selection and adjustment of settings, and their association with OVAL\n" \
|
194
|
+
"and OCIL content provides an automated checking capability. Transformations of\n" \
|
195
|
+
"this document, and its associated automated checking content, are capable of\n" \
|
196
|
+
"providing baselines that meet a diverse set of policy objectives. Some example\n" \
|
197
|
+
"XCCDF <i xmlns=\"http://www.w3.org/1999/xhtml\">Profiles</i>, which are selections of items that form checklists and\n" \
|
198
|
+
"can be used as baselines, are available with this guide. They can be\n" \
|
199
|
+
"processed, in an automated fashion, with tools that support the Security\n" \
|
200
|
+
"Content Automation Protocol (SCAP).\n"
|
115
201
|
end
|