Skip to content

Commit 8fedd96

Browse files
jan-cernyjan-cerny
authored
Merge pull request #2079 from evgenyz/add-json-to-autotailor
Introduce JSON tailoring import option for `autotailor`
2 parents 7b45a7e + dbab0f7 commit 8fedd96

File tree

7 files changed

+288
-59
lines changed

7 files changed

+288
-59
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ build/
1717
*.a
1818
*.la
1919
.cproject
20+
.idea
2021
.project
2122
.settings/language.settings.xml
2223

‎docs/manual/manual.adoc

+7
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
= OpenSCAP User Manual
22
:imagesdir: ./images
33
:workbench_url: https://www.open-scap.org/tools/scap-workbench/
4+
:json_tailoring_url: https://github.com/ComplianceAsCode/schemas/tree/main/tailoring
45
:sce_web: https://www.open-scap.org/features/other-standards/sce/
56
:openscap_web: https://open-scap.org/
67
:oscap_git: https://github.com/OpenSCAP/openscap
@@ -868,6 +869,12 @@ $ autotailor --unselect service_usbguard_enabled --output /tmp/tailoring.xml \
868869
--new-profile-id custom /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml ospp
869870
----
870871

872+
The `autotailor` tool can also consume {json_tailoring_url}[JSON tailoring] files and convert them into XCCDF Tailoring.
873+
874+
----
875+
$ autotailor --json-tailoring custom.json /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
876+
----
877+
871878
For more details about other options of the `autotailor` program please read the `autotailor(8)` man page or run `autotailor --help`.
872879

873880

‎tests/utils/autotailor_integration_test.sh

+24-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ set -e -o pipefail
77
autotailor="$top_srcdir/utils/autotailor"
88
tailoring="$(mktemp)"
99
ds="$srcdir/data_stream.xml"
10+
json_tailoring="$srcdir/custom.json"
1011
stdout="$(mktemp)"
1112
original_profile="P1"
1213
result="$(mktemp)"
@@ -93,11 +94,33 @@ assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www
9394
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="pass"]'
9495
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
9596

96-
# refine value v1 to 30
97+
# set value v1 to thirty
9798
python3 $autotailor --id-namespace "com.example.www" --var-value V1=thirty $ds $original_profile > $tailoring
9899
$OSCAP xccdf eval --profile P1_customized --progress --tailoring-file $tailoring --results $result $ds
99100
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V1" and text()="thirty"]'
100101
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R1"]/result[text()="pass"]'
101102
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R2"]/result[text()="pass"]'
102103
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="notselected"]'
103104
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
105+
106+
# refine value v1 to 'thirty' (30) and v2 to 'other' (Other Value)
107+
python3 $autotailor --id-namespace "com.example.www" --var-select V1=thirty --var-select V2=other $ds $original_profile > $tailoring
108+
$OSCAP xccdf eval --profile P1_customized --progress --tailoring-file $tailoring --results $result $ds
109+
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V1" and text()="30"]'
110+
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V2" and text()="Other Value"]'
111+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R1"]/result[text()="pass"]'
112+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R2"]/result[text()="pass"]'
113+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="notselected"]'
114+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
115+
116+
# use JSON tailoring
117+
python3 $autotailor $ds --id-namespace "com.example.www" --json-tailoring $json_tailoring > $tailoring
118+
$OSCAP xccdf eval --profile JSON_P1 --progress --tailoring-file $tailoring --results $result $ds
119+
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V1" and text()="New Value"]'
120+
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V2" and text()="Some Value"]'
121+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R1"]/result[text()="notselected"]'
122+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R2"]/result[text()="pass"]'
123+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="notselected"]'
124+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3" and @severity="unknown"]'
125+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
126+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4" and @role="unchecked"]'

‎tests/utils/custom.json

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"profiles": [
3+
{
4+
"id": "JSON_P1",
5+
"title": "JSON Tailored Profile P1",
6+
"base_profile_id": "P1",
7+
"groups": {
8+
"G34": {
9+
"evaluate": false
10+
}
11+
},
12+
"rules": {
13+
"R1": {
14+
"evaluate": false
15+
},
16+
"R3": {
17+
"evaluate": true,
18+
"severity": "unknown"
19+
},
20+
"R4": {
21+
"evaluate": true,
22+
"role": "unchecked"
23+
}
24+
},
25+
"variables": {
26+
"V1": {
27+
"value": "New Value"
28+
},
29+
"V2": {
30+
"option_id": "some"
31+
}
32+
}
33+
}
34+
]
35+
}

‎tests/utils/data_stream.xml

+28-16
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,20 @@
6565
<select idref="xccdf_com.example.www_rule_R2" selected="true"/>
6666
</Profile>
6767
<Value id="xccdf_com.example.www_value_V1" operator="equals" type="number">
68-
<title>value</title>
68+
<title>value 1</title>
6969
<description xml:lang="en">cccc</description>
7070
<question xml:lang="en">ssss</question>
7171
<value>5</value>
7272
<value selector="thirty">30</value>
7373
</Value>
74+
<Value id="xccdf_com.example.www_value_V2" operator="equals" type="string">
75+
<title>value 2</title>
76+
<description xml:lang="en">22222</description>
77+
<question xml:lang="en">Q2</question>
78+
<value>Default</value>
79+
<value selector="some">Some Value</value>
80+
<value selector="other">Other Value</value>
81+
</Value>
7482
<Rule selected="false" id="xccdf_com.example.www_rule_R1">
7583
<title>Rule R1</title>
7684
<description>Description</description>
@@ -85,20 +93,24 @@
8593
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
8694
</check>
8795
</Rule>
88-
<Rule selected="false" id="xccdf_com.example.www_rule_R3">
89-
<title>Rule R3</title>
90-
<description>Description</description>
91-
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
92-
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
93-
</check>
94-
</Rule>
95-
<Rule selected="false" id="xccdf_com.example.www_rule_R4">
96-
<title>Rule R4</title>
97-
<description>Description</description>
98-
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
99-
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
100-
</check>
101-
</Rule>
102-
</Benchmark>
96+
<Group selected="true" id="xccdf_com.example.www_group_G34">
97+
<title>group R3, R4</title>
98+
<description>description</description>
99+
<Rule selected="false" id="xccdf_com.example.www_rule_R3">
100+
<title>Rule R3</title>
101+
<description>Description</description>
102+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
103+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
104+
</check>
105+
</Rule>
106+
<Rule selected="false" id="xccdf_com.example.www_rule_R4">
107+
<title>Rule R4</title>
108+
<description>Description</description>
109+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
110+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
111+
</check>
112+
</Rule>
113+
</Group>
114+
</Benchmark>
103115
</ds:component>
104116
</ds:data-stream-collection>

0 commit comments

Comments
 (0)