openscap 0.4.9 → 0.5.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +7 -18
- data/Rakefile +2 -2
- data/lib/openscap/all.rb +1 -1
- data/lib/openscap/ds/arf.rb +3 -3
- data/lib/openscap/ds/sds.rb +8 -2
- data/lib/openscap/openscap.rb +9 -0
- data/lib/openscap/source.rb +10 -4
- data/lib/openscap/text.rb +34 -5
- data/lib/openscap/version.rb +1 -1
- data/lib/openscap/xccdf/benchmark.rb +64 -12
- data/lib/openscap/xccdf/fix.rb +4 -4
- data/lib/openscap/xccdf/group.rb +32 -0
- data/lib/openscap/xccdf/item.rb +33 -61
- data/lib/openscap/xccdf/item_common.rb +40 -0
- data/lib/openscap/xccdf/policy.rb +10 -0
- data/lib/openscap/xccdf/policy_model.rb +15 -6
- data/lib/openscap/xccdf/profile.rb +9 -9
- data/lib/openscap/xccdf/reference.rb +3 -3
- data/lib/openscap/xccdf/rule.rb +10 -14
- data/lib/openscap/xccdf/session.rb +18 -20
- data/lib/openscap/xccdf/status.rb +35 -0
- data/lib/openscap/xccdf/tailoring.rb +3 -6
- data/lib/openscap/xccdf/testresult.rb +10 -16
- data/lib/openscap/xccdf.rb +1 -1
- data/test/data/xccdf.xml +2 -1
- data/test/ds/arf_test.rb +9 -9
- data/test/ds/sds_test.rb +23 -5
- data/test/integration/arf_waiver_test.rb +5 -5
- data/test/source_test.rb +13 -13
- data/test/xccdf/arf_test.rb +1 -2
- data/test/xccdf/benchmark_test.rb +96 -10
- data/test/xccdf/item_test.rb +82 -0
- data/test/xccdf/policy_test.rb +35 -7
- data/test/xccdf/profile_test.rb +50 -8
- data/test/xccdf/session_ds_test.rb +13 -13
- data/test/xccdf/session_test.rb +2 -2
- data/test/xccdf/testresult_test.rb +9 -9
- data/test/xccdf/value_test.rb +67 -0
- metadata +16 -27
@@ -1,10 +1,12 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
3
|
require 'openscap/text'
|
4
|
+
require 'openscap/xccdf/item_common'
|
4
5
|
|
5
6
|
module OpenSCAP
|
6
7
|
module Xccdf
|
7
8
|
class Profile
|
9
|
+
include ItemCommon
|
8
10
|
attr_reader :raw
|
9
11
|
|
10
12
|
def initialize(p)
|
@@ -16,19 +18,17 @@ module OpenSCAP
|
|
16
18
|
end
|
17
19
|
end
|
18
20
|
|
19
|
-
def
|
20
|
-
OpenSCAP.
|
21
|
+
def status_current
|
22
|
+
pointer = OpenSCAP.xccdf_profile_get_status_current @raw
|
23
|
+
Status.new pointer unless pointer.null?
|
21
24
|
end
|
22
25
|
|
23
|
-
def
|
24
|
-
|
25
|
-
title = textlist.plaintext(prefered_lang)
|
26
|
-
textlist.destroy
|
27
|
-
title
|
26
|
+
def abstract?
|
27
|
+
OpenSCAP.xccdf_profile_get_abstract @raw
|
28
28
|
end
|
29
29
|
end
|
30
30
|
end
|
31
31
|
|
32
|
-
attach_function :
|
33
|
-
attach_function :
|
32
|
+
attach_function :xccdf_profile_get_status_current, [:pointer], :pointer
|
33
|
+
attach_function :xccdf_profile_get_abstract, [:pointer], :bool
|
34
34
|
end
|
data/lib/openscap/xccdf/rule.rb
CHANGED
@@ -11,33 +11,29 @@ module OpenSCAP
|
|
11
11
|
def severity
|
12
12
|
severity = OpenSCAP.xccdf_rule_get_severity(@raw)
|
13
13
|
severity_mapping = {
|
14
|
-
:
|
15
|
-
:
|
16
|
-
:
|
17
|
-
:
|
18
|
-
:
|
19
|
-
:
|
14
|
+
xccdf_level_not_defined: 'Not defined',
|
15
|
+
xccdf_unknown: 'Unknown',
|
16
|
+
xccdf_info: 'Info',
|
17
|
+
xccdf_low: 'Low',
|
18
|
+
xccdf_medium: 'Medium',
|
19
|
+
xccdf_high: 'High'
|
20
20
|
}
|
21
21
|
severity_mapping[severity] || severity_mapping[:xccdf_unknown]
|
22
22
|
end
|
23
23
|
|
24
24
|
def fixes
|
25
25
|
fixes = []
|
26
|
-
|
27
|
-
|
28
|
-
fixes << OpenSCAP::Xccdf::Fix.new(OpenSCAP.xccdf_fix_iterator_next(items_it))
|
26
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_rule_get_fixes(@raw), as: 'xccdf_fix' do |pointer|
|
27
|
+
fixes << OpenSCAP::Xccdf::Fix.new(pointer)
|
29
28
|
end
|
30
|
-
OpenSCAP.xccdf_fix_iterator_free items_it
|
31
29
|
fixes
|
32
30
|
end
|
33
31
|
|
34
32
|
def idents
|
35
33
|
idents = []
|
36
|
-
|
37
|
-
|
38
|
-
idents << OpenSCAP::Xccdf::Ident.new(OpenSCAP.xccdf_ident_iterator_next(idents_it))
|
34
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_rule_get_idents(@raw), as: 'xccdf_ident' do |pointer|
|
35
|
+
idents << OpenSCAP::Xccdf::Ident.new(pointer)
|
39
36
|
end
|
40
|
-
OpenSCAP.xccdf_ident_iterator_free idents_it
|
41
37
|
idents
|
42
38
|
end
|
43
39
|
end
|
@@ -17,8 +17,8 @@ module OpenSCAP
|
|
17
17
|
|
18
18
|
def load(opts = {})
|
19
19
|
o = {
|
20
|
-
:
|
21
|
-
:
|
20
|
+
datastream_id: nil,
|
21
|
+
component_id: nil
|
22
22
|
}.merge(opts)
|
23
23
|
if sds?
|
24
24
|
OpenSCAP.xccdf_session_set_datastream_id(@s, o[:datastream_id])
|
@@ -30,9 +30,7 @@ module OpenSCAP
|
|
30
30
|
|
31
31
|
def profile=(p)
|
32
32
|
@profile = p
|
33
|
-
if OpenSCAP.xccdf_session_set_profile_id(@s, p) == false
|
34
|
-
raise OpenSCAPError, "No profile '" + p + "' found"
|
35
|
-
end
|
33
|
+
raise OpenSCAPError, "No profile '#{p}' found" if OpenSCAP.xccdf_session_set_profile_id(@s, p) == false
|
36
34
|
end
|
37
35
|
|
38
36
|
def evaluate
|
@@ -45,12 +43,12 @@ module OpenSCAP
|
|
45
43
|
|
46
44
|
def export_results(opts = {})
|
47
45
|
o = {
|
48
|
-
:
|
49
|
-
:
|
50
|
-
:
|
51
|
-
:
|
52
|
-
:
|
53
|
-
:
|
46
|
+
rds_file: nil,
|
47
|
+
xccdf_file: nil,
|
48
|
+
report_file: nil,
|
49
|
+
oval_results: false,
|
50
|
+
oval_variables: false,
|
51
|
+
engines_results: false
|
54
52
|
}.merge!(opts)
|
55
53
|
export_targets o
|
56
54
|
export
|
@@ -94,13 +92,13 @@ module OpenSCAP
|
|
94
92
|
|
95
93
|
attach_function :xccdf_session_is_sds, [:pointer], :bool
|
96
94
|
|
97
|
-
attach_function :xccdf_session_set_profile_id, [
|
98
|
-
attach_function :xccdf_session_set_datastream_id, [
|
99
|
-
attach_function :xccdf_session_set_component_id, [
|
100
|
-
attach_function :xccdf_session_set_arf_export, [
|
101
|
-
attach_function :xccdf_session_set_xccdf_export, [
|
102
|
-
attach_function :xccdf_session_set_report_export, [
|
103
|
-
attach_function :xccdf_session_set_oval_variables_export, [
|
104
|
-
attach_function :xccdf_session_set_oval_results_export, [
|
105
|
-
attach_function :xccdf_session_set_check_engine_plugins_results_export, [
|
95
|
+
attach_function :xccdf_session_set_profile_id, %i[pointer string], :bool
|
96
|
+
attach_function :xccdf_session_set_datastream_id, %i[pointer string], :void
|
97
|
+
attach_function :xccdf_session_set_component_id, %i[pointer string], :void
|
98
|
+
attach_function :xccdf_session_set_arf_export, %i[pointer string], :bool
|
99
|
+
attach_function :xccdf_session_set_xccdf_export, %i[pointer string], :bool
|
100
|
+
attach_function :xccdf_session_set_report_export, %i[pointer string], :bool
|
101
|
+
attach_function :xccdf_session_set_oval_variables_export, %i[pointer bool], :void
|
102
|
+
attach_function :xccdf_session_set_oval_results_export, %i[pointer bool], :void
|
103
|
+
attach_function :xccdf_session_set_check_engine_plugins_results_export, %i[pointer bool], :void
|
106
104
|
end
|
@@ -0,0 +1,35 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module OpenSCAP
|
4
|
+
module Xccdf
|
5
|
+
class Status
|
6
|
+
def initialize(raw)
|
7
|
+
raise OpenSCAP::OpenSCAPError, "Cannot initialize #{self.class.name} with '#{raw}'" \
|
8
|
+
unless raw.is_a?(FFI::Pointer)
|
9
|
+
|
10
|
+
@raw = raw
|
11
|
+
end
|
12
|
+
|
13
|
+
def status
|
14
|
+
OpenSCAP.xccdf_status_get_status @raw
|
15
|
+
end
|
16
|
+
|
17
|
+
def date
|
18
|
+
unix_t = OpenSCAP.xccdf_status_get_date @raw
|
19
|
+
Time.at unix_t
|
20
|
+
end
|
21
|
+
end
|
22
|
+
end
|
23
|
+
|
24
|
+
enum :xccdf_status_type_t, [
|
25
|
+
:not_specified, # empty value
|
26
|
+
:accepted,
|
27
|
+
:deprecated,
|
28
|
+
:draft,
|
29
|
+
:incomplete,
|
30
|
+
:interim
|
31
|
+
]
|
32
|
+
|
33
|
+
attach_function :xccdf_status_get_status, [:pointer], :xccdf_status_type_t
|
34
|
+
attach_function :xccdf_status_get_date, [:pointer], :time_t
|
35
|
+
end
|
@@ -31,19 +31,16 @@ module OpenSCAP
|
|
31
31
|
|
32
32
|
def profiles_init
|
33
33
|
profiles = {}
|
34
|
-
|
35
|
-
|
36
|
-
profile_p = OpenSCAP.xccdf_profile_iterator_next profit
|
37
|
-
profile = OpenSCAP::Xccdf::Profile.new profile_p
|
34
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_tailoring_get_profiles(@raw), as: 'xccdf_profile' do |pointer|
|
35
|
+
profile = OpenSCAP::Xccdf::Profile.new pointer
|
38
36
|
profiles[profile.id] = profile
|
39
37
|
end
|
40
|
-
OpenSCAP.xccdf_profile_iterator_free profit
|
41
38
|
profiles
|
42
39
|
end
|
43
40
|
end
|
44
41
|
end
|
45
42
|
|
46
|
-
attach_function :xccdf_tailoring_import_source, [
|
43
|
+
attach_function :xccdf_tailoring_import_source, %i[pointer pointer], :pointer
|
47
44
|
attach_function :xccdf_tailoring_free, [:pointer], :void
|
48
45
|
|
49
46
|
attach_function :xccdf_tailoring_get_profiles, [:pointer], :pointer
|
@@ -8,8 +8,7 @@ require 'openscap/xccdf/ruleresult'
|
|
8
8
|
module OpenSCAP
|
9
9
|
module Xccdf
|
10
10
|
class TestResult
|
11
|
-
attr_reader :rr
|
12
|
-
attr_reader :raw
|
11
|
+
attr_reader :rr, :raw
|
13
12
|
|
14
13
|
def initialize(t)
|
15
14
|
case t
|
@@ -58,27 +57,22 @@ module OpenSCAP
|
|
58
57
|
|
59
58
|
def init_ruleresults
|
60
59
|
@rr = {}
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
rr = OpenSCAP::Xccdf::RuleResult.new rr_raw
|
60
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_result_get_rule_results(@raw),
|
61
|
+
as: 'xccdf_rule_result' do |pointer|
|
62
|
+
rr = OpenSCAP::Xccdf::RuleResult.new pointer
|
65
63
|
@rr[rr.id] = rr
|
66
64
|
end
|
67
|
-
OpenSCAP.xccdf_rule_result_iterator_free(rr_it)
|
68
65
|
end
|
69
66
|
|
70
67
|
def score_init
|
71
68
|
scores = {}
|
72
|
-
|
73
|
-
while OpenSCAP.xccdf_score_iterator_has_more(scorit)
|
74
|
-
s = OpenSCAP.xccdf_score_iterator_next(scorit)
|
69
|
+
OpenSCAP._iterate over: OpenSCAP.xccdf_result_get_scores(@raw), as: 'xccdf_score' do |s|
|
75
70
|
scores[OpenSCAP.xccdf_score_get_system(s)] = {
|
76
|
-
:
|
77
|
-
:
|
78
|
-
:
|
71
|
+
system: OpenSCAP.xccdf_score_get_system(s),
|
72
|
+
value: OpenSCAP.xccdf_score_get_score(s),
|
73
|
+
max: OpenSCAP.xccdf_score_get_maximum(s)
|
79
74
|
}
|
80
75
|
end
|
81
|
-
OpenSCAP.xccdf_score_iterator_free(scorit)
|
82
76
|
scores
|
83
77
|
end
|
84
78
|
end
|
@@ -88,8 +82,8 @@ module OpenSCAP
|
|
88
82
|
attach_function :xccdf_result_free, [:pointer], :void
|
89
83
|
attach_function :xccdf_result_get_id, [:pointer], :string
|
90
84
|
attach_function :xccdf_result_get_profile, [:pointer], :string
|
91
|
-
attach_function :xccdf_result_recalculate_scores, [
|
92
|
-
attach_function :xccdf_result_export_source, [
|
85
|
+
attach_function :xccdf_result_recalculate_scores, %i[pointer pointer], :int
|
86
|
+
attach_function :xccdf_result_export_source, %i[pointer string], :pointer
|
93
87
|
|
94
88
|
attach_function :xccdf_result_get_rule_results, [:pointer], :pointer
|
95
89
|
attach_function :xccdf_rule_result_iterator_has_more, [:pointer], :bool
|
data/lib/openscap/xccdf.rb
CHANGED
data/test/data/xccdf.xml
CHANGED
@@ -71,6 +71,7 @@ respective companies.</rear-matter>
|
|
71
71
|
<version>0.0.4</version>
|
72
72
|
<model system="urn:xccdf:scoring:default"/>
|
73
73
|
<Profile id="xccdf_org.ssgproject.content_profile_common">
|
74
|
+
<version>3.2.1</version>
|
74
75
|
<title xml:lang="en-US">Common Profile for General-Purpose Fedora Systems</title>
|
75
76
|
<description xml:lang="en-US">This profile contains items common to general-purpose Fedora installations.</description>
|
76
77
|
<select idref="xccdf_org.ssgproject.content_rule_disable_prelink" selected="true"/>
|
@@ -461,7 +462,7 @@ If this check produces any unexpected output, investigate.
|
|
461
462
|
<reference href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf">SC-28</reference>
|
462
463
|
<reference href="http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf">SI-7</reference>
|
463
464
|
<rationale xml:lang="en-US">
|
464
|
-
For AIDE to be effective, an initial database of "known-good" information about files
|
465
|
+
For AIDE to be effective, an initial database of <i xmlns="http://www.w3.org/1999/xhtml">"known-good"</i> information about files
|
465
466
|
must be captured and it should be able to be verified against the installed files.
|
466
467
|
</rationale>
|
467
468
|
</Rule>
|
data/test/ds/arf_test.rb
CHANGED
@@ -15,7 +15,7 @@ class TestArf < OpenSCAP::TestCase
|
|
15
15
|
rescue OpenSCAP::OpenSCAPError => e
|
16
16
|
msg = e.to_s
|
17
17
|
end
|
18
|
-
assert msg.start_with?("Cannot initialize OpenSCAP::DS::Arf with ''"),
|
18
|
+
assert msg.start_with?("Cannot initialize OpenSCAP::DS::Arf with ''"), "Message was: #{msg}"
|
19
19
|
end
|
20
20
|
|
21
21
|
def test_arf_new_wrong_format
|
@@ -27,7 +27,7 @@ class TestArf < OpenSCAP::TestCase
|
|
27
27
|
msg = e.to_s
|
28
28
|
end
|
29
29
|
assert msg.include?('Could not create Result DataStream session: File is not Result DataStream.'),
|
30
|
-
|
30
|
+
"Message was: #{msg}"
|
31
31
|
end
|
32
32
|
|
33
33
|
def test_create_arf_and_get_html
|
@@ -52,17 +52,17 @@ class TestArf < OpenSCAP::TestCase
|
|
52
52
|
create_arf
|
53
53
|
raw_data = File.read(REPORT)
|
54
54
|
refute raw_data.empty?
|
55
|
-
arf = OpenSCAP::DS::Arf.new :
|
55
|
+
arf = OpenSCAP::DS::Arf.new content: raw_data, path: REPORT
|
56
56
|
arf.destroy
|
57
57
|
end
|
58
58
|
|
59
59
|
def test_new_bz_memory
|
60
60
|
bziped_file = new_arf_bz
|
61
|
-
raw_data = File.
|
61
|
+
raw_data = File.binread(bziped_file)
|
62
62
|
assert !raw_data.empty?
|
63
63
|
len = File.size(bziped_file)
|
64
64
|
FileUtils.rm bziped_file
|
65
|
-
arf = OpenSCAP::DS::Arf.new :
|
65
|
+
arf = OpenSCAP::DS::Arf.new content: raw_data, path: bziped_file, length: len
|
66
66
|
arf.destroy
|
67
67
|
end
|
68
68
|
|
@@ -77,8 +77,8 @@ class TestArf < OpenSCAP::TestCase
|
|
77
77
|
|
78
78
|
def new_arf_bz
|
79
79
|
create_arf
|
80
|
-
system(
|
81
|
-
REPORT
|
80
|
+
system("/usr/bin/bzip2 #{REPORT}")
|
81
|
+
"#{REPORT}.bz2"
|
82
82
|
end
|
83
83
|
|
84
84
|
def new_arf
|
@@ -88,9 +88,9 @@ class TestArf < OpenSCAP::TestCase
|
|
88
88
|
|
89
89
|
def create_arf
|
90
90
|
@s = OpenSCAP::Xccdf::Session.new('../data/sds-complex.xml')
|
91
|
-
@s.load(:
|
91
|
+
@s.load(component_id: 'scap_org.open-scap_cref_second-xccdf.xml')
|
92
92
|
@s.profile = 'xccdf_moc.elpmaxe.www_profile_1'
|
93
93
|
@s.evaluate
|
94
|
-
@s.export_results(:
|
94
|
+
@s.export_results(rds_file: 'report.rds.xml')
|
95
95
|
end
|
96
96
|
end
|
data/test/ds/sds_test.rb
CHANGED
@@ -6,6 +6,8 @@ require 'openscap/ds/sds'
|
|
6
6
|
require 'common/testcase'
|
7
7
|
|
8
8
|
class TestSds < OpenSCAP::TestCase
|
9
|
+
DS_FILE = '../data/sds-complex.xml'
|
10
|
+
|
9
11
|
def test_new
|
10
12
|
new_sds.destroy
|
11
13
|
end
|
@@ -16,7 +18,7 @@ class TestSds < OpenSCAP::TestCase
|
|
16
18
|
assert !@s.nil?
|
17
19
|
msg = nil
|
18
20
|
begin
|
19
|
-
OpenSCAP::DS::Sds.new :
|
21
|
+
OpenSCAP::DS::Sds.new source: @s
|
20
22
|
assert false
|
21
23
|
rescue OpenSCAP::OpenSCAPError => e
|
22
24
|
msg = e.to_s
|
@@ -48,7 +50,7 @@ class TestSds < OpenSCAP::TestCase
|
|
48
50
|
sds = new_sds
|
49
51
|
msg = nil
|
50
52
|
begin
|
51
|
-
benchmark = sds.select_checklist! :
|
53
|
+
benchmark = sds.select_checklist! datastream_id: 'wrong'
|
52
54
|
assert false
|
53
55
|
rescue OpenSCAP::OpenSCAPError => e
|
54
56
|
msg = e.to_s
|
@@ -58,13 +60,29 @@ class TestSds < OpenSCAP::TestCase
|
|
58
60
|
sds.destroy
|
59
61
|
end
|
60
62
|
|
63
|
+
def tests_use_through_yields
|
64
|
+
OpenSCAP::Source.new DS_FILE do |source|
|
65
|
+
assert_equal 'SCAP Source Datastream', source.type
|
66
|
+
OpenSCAP::DS::Sds.new source: do |sds|
|
67
|
+
benchmark_source = sds.select_checklist!
|
68
|
+
html = sds.html_guide
|
69
|
+
assert_include html, 'bootstrap'
|
70
|
+
|
71
|
+
OpenSCAP::Xccdf::Benchmark.new benchmark_source do |benchmark|
|
72
|
+
assert_empty benchmark.profiles
|
73
|
+
assert benchmark.items.length == 1
|
74
|
+
assert benchmark.items.keys.first == 'xccdf_moc.elpmaxe.www_rule_first'
|
75
|
+
end
|
76
|
+
end
|
77
|
+
end
|
78
|
+
end
|
79
|
+
|
61
80
|
private
|
62
81
|
|
63
82
|
def new_sds
|
64
|
-
|
65
|
-
@s = OpenSCAP::Source.new filename
|
83
|
+
@s = OpenSCAP::Source.new DS_FILE
|
66
84
|
assert !@s.nil?
|
67
|
-
sds = OpenSCAP::DS::Sds.new :
|
85
|
+
sds = OpenSCAP::DS::Sds.new source: @s
|
68
86
|
assert !sds.nil?
|
69
87
|
sds
|
70
88
|
end
|
@@ -14,10 +14,10 @@ class TestArfWaiver < OpenSCAP::TestCase
|
|
14
14
|
assert_default_score tr.score, -1, 1
|
15
15
|
assert_default_score tr.score!(benchmark), -1, 1
|
16
16
|
|
17
|
-
rr.override!(:
|
18
|
-
:
|
19
|
-
:
|
20
|
-
:
|
17
|
+
rr.override!(new_result: :pass,
|
18
|
+
time: 'yesterday',
|
19
|
+
authority: 'John Hacker',
|
20
|
+
raw_text: 'This should have passed')
|
21
21
|
assert rr.result == 'pass'
|
22
22
|
|
23
23
|
assert_default_score tr.score, -1, 1
|
@@ -85,7 +85,7 @@ class TestArfWaiver < OpenSCAP::TestCase
|
|
85
85
|
@s = OpenSCAP::Xccdf::Session.new('../data/sds-complex.xml')
|
86
86
|
@s.load
|
87
87
|
@s.evaluate
|
88
|
-
@s.export_results(:
|
88
|
+
@s.export_results(rds_file: 'report.rds.xml')
|
89
89
|
OpenSCAP::DS::Arf.new('report.rds.xml')
|
90
90
|
end
|
91
91
|
end
|
data/test/source_test.rb
CHANGED
@@ -13,7 +13,7 @@ class TestSource < OpenSCAP::TestCase
|
|
13
13
|
rescue OpenSCAP::OpenSCAPError => e
|
14
14
|
msg = e.to_s
|
15
15
|
end
|
16
|
-
assert msg.start_with?('No filename specified!'),
|
16
|
+
assert msg.start_with?('No filename specified!'), "Message was: #{msg}"
|
17
17
|
end
|
18
18
|
|
19
19
|
def test_source_new_ok
|
@@ -24,22 +24,22 @@ class TestSource < OpenSCAP::TestCase
|
|
24
24
|
def test_source_new_memory
|
25
25
|
raw_data = File.read('../data/xccdf.xml')
|
26
26
|
refute raw_data.empty?
|
27
|
-
s = OpenSCAP::Source.new(:
|
27
|
+
s = OpenSCAP::Source.new(content: raw_data, path: '/mytestpath')
|
28
28
|
s.destroy
|
29
29
|
end
|
30
30
|
|
31
31
|
def test_type_xccdf
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
32
|
+
OpenSCAP::Source.new('../data/xccdf.xml') do |s|
|
33
|
+
assert s.type == 'XCCDF Checklist', "Type was #{s.type}"
|
34
|
+
s.validate!
|
35
|
+
end
|
36
36
|
end
|
37
37
|
|
38
38
|
def test_type_sds
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
39
|
+
OpenSCAP::Source.new('../data/sds-complex.xml') do |s|
|
40
|
+
assert s.type == 'SCAP Source Datastream', "Type was #{s.type}"
|
41
|
+
s.validate!
|
42
|
+
end
|
43
43
|
end
|
44
44
|
|
45
45
|
def test_type_test_result
|
@@ -59,11 +59,11 @@ class TestSource < OpenSCAP::TestCase
|
|
59
59
|
msg = e.to_s
|
60
60
|
end
|
61
61
|
assert msg.start_with?('Invalid XCCDF Checklist (1.2) content in ../data/invalid.xml.'),
|
62
|
-
|
62
|
+
"Message was: #{msg}"
|
63
63
|
assert msg.include?("../data/invalid.xml:3: Element '{http"),
|
64
|
-
|
64
|
+
"Message was: #{msg}"
|
65
65
|
assert msg.include?('This element is not expected. Expected is'),
|
66
|
-
|
66
|
+
"Message was: #{msg}"
|
67
67
|
s.destroy
|
68
68
|
end
|
69
69
|
|
data/test/xccdf/arf_test.rb
CHANGED
@@ -38,7 +38,6 @@ class TestArf < OpenSCAP::TestCase
|
|
38
38
|
_test_results = arf.test_result
|
39
39
|
source_datastream = arf.report_request
|
40
40
|
bench_source = source_datastream.select_checklist!
|
41
|
-
|
42
|
-
benchmark
|
41
|
+
OpenSCAP::Xccdf::Benchmark.new(bench_source)
|
43
42
|
end
|
44
43
|
end
|
@@ -78,12 +78,12 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
78
78
|
def test_items_references
|
79
79
|
b = benchmark_from_file
|
80
80
|
install_hids_rule = b.items['xccdf_org.ssgproject.content_rule_install_hids']
|
81
|
-
expected_references = [{ :
|
82
|
-
:
|
83
|
-
:
|
84
|
-
{ :
|
85
|
-
:
|
86
|
-
:
|
81
|
+
expected_references = [{ title: 'SC-7',
|
82
|
+
href: 'http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf',
|
83
|
+
html_link: "<a href='http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf'>SC-7</a>" },
|
84
|
+
{ title: '1263',
|
85
|
+
href: 'http://iase.disa.mil/cci/index.html',
|
86
|
+
html_link: "<a href='http://iase.disa.mil/cci/index.html'>1263</a>" }]
|
87
87
|
assert_equal(expected_references, install_hids_rule.references.map(&:to_hash), 'Install hids references should be equal')
|
88
88
|
b.destroy
|
89
89
|
end
|
@@ -93,16 +93,75 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
93
93
|
login_defs_rule = b.items['xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs']
|
94
94
|
expected_content = ["var_accounts_minimum_age_login_defs=\"<sub xmlns=\"http://checklists.nist.gov/xccdf/1.2\" idref=\"xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs\" use=\"legacy\"/>\"\ngrep -q ^PASS_MIN_DAYS /etc/login.defs && \\\nsed -i \"s/PASS_MIN_DAYS.*/PASS_MIN_DAYS\\t$var_accounts_minimum_age_login_defs/g\" /etc/login.defs\nif ! [ $? -eq 0 ]\nthen\n echo -e \"PASS_MIN_DAYS\\t$var_accounts_minimum_age_login_defs\" >> /etc/login.defs\nfi\n"]
|
95
95
|
expected_hashes = [{
|
96
|
-
:
|
97
|
-
:
|
98
|
-
:
|
99
|
-
:
|
96
|
+
id: nil,
|
97
|
+
platform: nil,
|
98
|
+
content: expected_content.first,
|
99
|
+
system: 'urn:xccdf:fix:script:sh'
|
100
100
|
}]
|
101
101
|
assert_equal(expected_content, login_defs_rule.fixes.map(&:content), 'Fix content should match')
|
102
102
|
assert_equal(expected_hashes, login_defs_rule.fixes.map(&:to_hash), 'Fix hash should match')
|
103
103
|
b.destroy
|
104
104
|
end
|
105
105
|
|
106
|
+
def test_benchamrk_id
|
107
|
+
with_benchmark do |b|
|
108
|
+
assert_equal b.id, 'xccdf_org.ssgproject.content_benchmark_FEDORA'
|
109
|
+
end
|
110
|
+
end
|
111
|
+
|
112
|
+
def test_status_current
|
113
|
+
with_benchmark do |b|
|
114
|
+
status = b.status_current
|
115
|
+
assert_equal status.status, :draft
|
116
|
+
release_date = status.date
|
117
|
+
assert_equal release_date.year, 2014
|
118
|
+
assert_equal release_date.month, 10
|
119
|
+
assert_equal release_date.day, 2
|
120
|
+
end
|
121
|
+
end
|
122
|
+
|
123
|
+
def test_title
|
124
|
+
with_benchmark do |b|
|
125
|
+
assert_equal b.title, 'Guide to the Secure Configuration of Fedora'
|
126
|
+
end
|
127
|
+
end
|
128
|
+
|
129
|
+
def test_description
|
130
|
+
with_benchmark do |b|
|
131
|
+
assert_equal b.description, DESCRIPTION
|
132
|
+
end
|
133
|
+
end
|
134
|
+
|
135
|
+
def test_version
|
136
|
+
with_benchmark do |b|
|
137
|
+
assert_equal b.version, '0.0.4'
|
138
|
+
end
|
139
|
+
end
|
140
|
+
|
141
|
+
def test_references
|
142
|
+
with_benchmark do |b|
|
143
|
+
assert_equal b.references, []
|
144
|
+
end
|
145
|
+
end
|
146
|
+
|
147
|
+
def test_resolved
|
148
|
+
with_benchmark do |b|
|
149
|
+
assert b.resolved?
|
150
|
+
end
|
151
|
+
end
|
152
|
+
|
153
|
+
def test_policy_model
|
154
|
+
with_benchmark do |b|
|
155
|
+
assert b.policy_model.policies.keys == ['xccdf_org.ssgproject.content_profile_common']
|
156
|
+
end
|
157
|
+
end
|
158
|
+
|
159
|
+
def test_schema_version
|
160
|
+
with_benchmark do |b|
|
161
|
+
assert_equal b.schema_version, '1.2'
|
162
|
+
end
|
163
|
+
end
|
164
|
+
|
106
165
|
private
|
107
166
|
|
108
167
|
def benchmark_from_file
|
@@ -112,4 +171,31 @@ class TestBenchmark < OpenSCAP::TestCase
|
|
112
171
|
assert !b.nil?
|
113
172
|
b
|
114
173
|
end
|
174
|
+
|
175
|
+
def with_benchmark(&)
|
176
|
+
OpenSCAP::Source.new '../data/xccdf.xml' do |source|
|
177
|
+
OpenSCAP::Xccdf::Benchmark.new(source, &)
|
178
|
+
end
|
179
|
+
end
|
180
|
+
|
181
|
+
DESCRIPTION = "This guide presents a catalog of security-relevant configuration\n" \
|
182
|
+
"settings for Fedora operating system formatted in the eXtensible Configuration\n" \
|
183
|
+
"Checklist Description Format (XCCDF).\n" \
|
184
|
+
"<br xmlns=\"http://www.w3.org/1999/xhtml\"/>\n" \
|
185
|
+
"<br xmlns=\"http://www.w3.org/1999/xhtml\"/>\n" \
|
186
|
+
"Providing system administrators with such guidance informs them how to securely\n" \
|
187
|
+
"configure systems under their control in a variety of network roles. Policy\n" \
|
188
|
+
"makers and baseline creators can use this catalog of settings, with its\n" \
|
189
|
+
"associated references to higher-level security control catalogs, in order to\n" \
|
190
|
+
"assist them in security baseline creation. This guide is a <i xmlns=\"http://www.w3.org/1999/xhtml\">catalog, not a\n" \
|
191
|
+
"checklist,</i> and satisfaction of every item is not likely to be possible or\n" \
|
192
|
+
"sensible in many operational scenarios. However, the XCCDF format enables\n" \
|
193
|
+
"granular selection and adjustment of settings, and their association with OVAL\n" \
|
194
|
+
"and OCIL content provides an automated checking capability. Transformations of\n" \
|
195
|
+
"this document, and its associated automated checking content, are capable of\n" \
|
196
|
+
"providing baselines that meet a diverse set of policy objectives. Some example\n" \
|
197
|
+
"XCCDF <i xmlns=\"http://www.w3.org/1999/xhtml\">Profiles</i>, which are selections of items that form checklists and\n" \
|
198
|
+
"can be used as baselines, are available with this guide. They can be\n" \
|
199
|
+
"processed, in an automated fashion, with tools that support the Security\n" \
|
200
|
+
"Content Automation Protocol (SCAP).\n"
|
115
201
|
end
|