From ba5c8a62c194355a994407f8d6ff48f1b24e626f Mon Sep 17 00:00:00 2001 From: George M Dias Date: Wed, 13 Nov 2024 17:00:57 -0600 Subject: [PATCH 1/3] updated profile_inspec and update_controls4delta to use xccdf stub metadata Signed-off-by: George M Dias --- README.md | 8 +-- src/commands/generate/inspec_profile.ts | 51 +++++++++++++------ .../generate/update_controls4delta.ts | 32 +++++++----- 3 files changed, 59 insertions(+), 32 deletions(-) diff --git a/README.md b/README.md index ffe3bc0b4..c75684c6a 100644 --- a/README.md +++ b/README.md @@ -1572,7 +1572,7 @@ generate inspec_metadata Generate an InSpec metadata template for "saf conv generate inspec_profile Generate a new skeleton profile based on a XCCDF benchmark file USAGE - $ saf generate inspec_profile -i [-o ] [-h] [-m ] [-T (rule|group|cis|version)] [-s] [-L (info|warn|debug|verbose)] + $ saf generate inspec_profile -X [-o ] [-h] [-m ] [-T (rule|group|cis|version)] [-s] [-L (info|warn|debug|verbose)] FLAGS -O, --ovalDefinitions= Path to an OVAL definitions file to populate profile elements that reference OVAL definitions @@ -1580,7 +1580,7 @@ FLAGS Group IDs (ex. 'V-XXXXX'), 'cis' - CIS Rule IDs (ex. C-1.1.1.1), 'version' - Version IDs (ex. RHEL-07-010020 - also known as STIG IDs) - -i, --xccdfXmlFile= (required) Path to the XCCDF benchmark file + -X, --xccdfXmlFile= (required) Path to the XCCDF benchmark file -m, --metadata= Path to a JSON file with additional metadata for the inspec.yml The metadata Json is of the following format: {"maintainer": string, "copyright": string, "copyright_email": string, "license": string, "version": string} @@ -1597,8 +1597,8 @@ ALIASES $ saf generate xccdf_benchmark2inspec_stub EXAMPLES - $ saf generate xccdf_benchmark2inspec_stub -i ./U_RHEL_6_STIG_V2R2_Manual-xccdf.xml -T group --logLevel debug -r rhel-6-update-report.md - $ saf generate xccdf_benchmark2inspec_stub -i ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-xccdf.xml -O ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-oval.xml --logLevel debug + $ saf generate xccdf_benchmark2inspec_stub -X ./U_RHEL_6_STIG_V2R2_Manual-xccdf.xml -T group --logLevel debug -r rhel-6-update-report.md + $ saf generate xccdf_benchmark2inspec_stub -X ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-xccdf.xml -O ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-oval.xml --logLevel debug ``` [top](#generate-data-reports-and-more) #### Thresholds diff --git a/src/commands/generate/inspec_profile.ts b/src/commands/generate/inspec_profile.ts index 678c5c232..609cf04cb 100644 --- a/src/commands/generate/inspec_profile.ts +++ b/src/commands/generate/inspec_profile.ts @@ -13,7 +13,7 @@ import YAML from 'yaml' export default class InspecProfile extends BaseCommand { static readonly usage = - '<%= command.id %> -i [-o ] [-h] [-m ] ' + + '<%= command.id %> -X [-o ] [-h] [-m ] ' + '[-T (rule|group|cis|version)] [-s] [-L (info|warn|debug|verbose)]' static readonly description = @@ -22,11 +22,11 @@ export default class InspecProfile extends BaseCommand { static readonly examples = [ { description: '\x1B[93mRequired flag only\x1B[0m', - command: '<%= config.bin %> <%= command.id %> -i ./U_RHEL_6_STIG_V2R2_Manual-xccdf.xml', + command: '<%= config.bin %> <%= command.id %> -X ./U_RHEL_6_STIG_V2R2_Manual-xccdf.xml', }, { description: '\x1B[93mSpecifying OVAL and Output location\x1B[0m', - command: '<%= config.bin %> <%= command.id %> -i ./U_RHEL_9_STIG_V1R2_Manual-xccdf.xml -O ./RHEL_9_Benchmark-oval.xml -o ./output/directory', + command: '<%= config.bin %> <%= command.id %> -X ./U_RHEL_9_STIG_V1R2_Manual-xccdf.xml -O ./RHEL_9_Benchmark-oval.xml -o ./output/directory', }, ] @@ -34,7 +34,7 @@ export default class InspecProfile extends BaseCommand { static readonly flags = { xccdfXmlFile: Flags.string({ - char: 'i', + char: 'X', required: true, description: 'Path to the XCCDF benchmark file', }), @@ -206,6 +206,7 @@ export default class InspecProfile extends BaseCommand { generateLicense(outDir, logger) generateNotice(outDir, logger) generateRubocopYml(outDir, logger) + generateGemRc(outDir, logger) generateGemFile(outDir, logger) generateRakeFile(outDir, logger) generateGitIgnoreFile(outDir, logger) @@ -275,12 +276,12 @@ function generateReadme(contentObj: InspecReadme, outDir: string, logger: Logger const readmeContent = `# ${contentObj.profileTitle} This InSpec Profile was created to facilitate testing and auditing of \`${contentObj.profileShortName}\` -infrastructure and applications when validating compliancy with Department of [Defense (DoD) STIG](https://iase.disa.mil/stigs/) +infrastructure and applications when validating compliancy with [Department of Defense (DoD) STIG](https://public.cyber.mil/stigs/) requirements -- Profile Version: ${contentObj.profileVersion} -- STIG Date: ${contentObj.stigDate} -- STIG Version: ${contentObj.stigVersion} +- Profile Version: **${contentObj.profileVersion.trim()}** +- STIG Date: **${contentObj.stigDate.trim()}** +- STIG Version: **${contentObj.stigVersion.trim()}** This profile was developed to reduce the time it takes to perform a security checks based upon the @@ -609,6 +610,9 @@ Naming/FileName: Metrics/BlockLength: Max: 1000 +Layout/MultilineBlockLayout: + Enabled: true + Lint/ConstantDefinitionInBlock: Enabled: false @@ -768,17 +772,25 @@ Style/SwapValues: # new in 1.1 }) } +function generateGemRc(outDir: string, logger: Logger) { + const gemRc = +`gem: --no-document +` + fs.writeFile(path.join(outDir, '.gemrc'), gemRc, err => { + if (err) { + logger.error(`Error saving the .gemrc file to: ${outDir}. Cause: ${err}`) + } else { + logger.debug('.gemrc generated successfully!') + } + }) +} + function generateGemFile(outDir: string, logger: Logger) { const gemFileContent = `# frozen_string_literal: true source 'https://rubygems.org' - -gem 'cookstyle' gem 'highline' -gem 'inspec', '>= 6.6.0' -gem 'inspec-bin' -gem 'inspec-core' gem 'kitchen-ansible' gem 'kitchen-docker' gem 'kitchen-dokken' @@ -786,13 +798,20 @@ gem 'kitchen-ec2' gem 'kitchen-inspec' gem 'kitchen-sync' gem 'kitchen-vagrant' -gem 'parser', '3.3.0.5' gem 'pry-byebug' gem 'rake' gem 'rubocop' gem 'rubocop-rake' gem 'test-kitchen' gem 'train-awsssm' + +source 'https://rubygems.cinc.sh/' do + gem 'chef-config' + gem 'chef-utils' + gem 'cinc-auditor-bin' + gem 'inspec' + gem 'inspec-core' +end ` fs.writeFile(path.join(outDir, 'Gemfile'), gemFileContent, err => { if (err) { @@ -813,9 +832,9 @@ require 'rake/testtask' require 'rubocop/rake_task' namespace :inspec do - desc 'validate the inspec profile' + desc 'validate the profile' task :check do - system 'bundle exec inspec check .' + system 'bundle exec cinc-auditor check .' end end diff --git a/src/commands/generate/update_controls4delta.ts b/src/commands/generate/update_controls4delta.ts index 116005ffd..478c3aab0 100644 --- a/src/commands/generate/update_controls4delta.ts +++ b/src/commands/generate/update_controls4delta.ts @@ -6,9 +6,9 @@ import {Flags} from '@oclif/core' import {createWinstonLogger} from '../../utils/logging' import Profile from '@mitre/inspec-objects/lib/objects/profile' import { + getExistingDescribeFromControl, processInSpecProfile, processXCCDF, - updateControl, } from '@mitre/inspec-objects' import colors from 'colors' // eslint-disable-line no-restricted-imports import {BaseCommand} from '../../utils/oclif/baseCommand' @@ -100,9 +100,9 @@ export default class GenerateUpdateControls extends BaseCommand Date: Fri, 15 Nov 2024 22:21:56 -0600 Subject: [PATCH 2/3] update tests to comply with oclif 4.1.0 - 80% completed Signed-off-by: George M Dias --- README.md | 6 +- package-lock.json | 13 - package.json | 4 +- src/commands/generate/inspec_profile.ts | 267 +++-- src/types/inspec.d.ts | 10 +- test/commands/attest/apply.test.ts | 52 +- .../commands/convert/anchoregrype2hdf.test.ts | 338 +++--- test/commands/emasser/delete.test.ts | 77 +- test/commands/emasser/get.test.ts | 1008 ++++++++--------- test/commands/emasser/post.test.ts | 253 +++-- test/commands/emasser/put.test.ts | 105 +- test/commands/generate/delta.test.ts | 127 +-- test/commands/generate/inspec_profile.test.ts | 17 +- .../generate/spreadsheet2inspec_stub.test.ts | 20 +- test/commands/generate/threshold.test.ts | 33 +- test/commands/supplement/passthrough.test.ts | 103 +- test/commands/supplement/target.test.ts | 104 +- test/commands/validate/threshold.test.ts | 157 +-- test/commands/view/summary.test.ts | 105 +- 19 files changed, 1390 insertions(+), 1409 deletions(-) diff --git a/README.md b/README.md index c75684c6a..06f12e260 100644 --- a/README.md +++ b/README.md @@ -1569,18 +1569,18 @@ generate inspec_metadata Generate an InSpec metadata template for "saf conv #### Inspec Profile ``` -generate inspec_profile Generate a new skeleton profile based on a XCCDF benchmark file +generate inspec_profile Generate a new skeleton profile based on a (STIG or CIS) XCCDF benchmark file USAGE - $ saf generate inspec_profile -X [-o ] [-h] [-m ] [-T (rule|group|cis|version)] [-s] [-L (info|warn|debug|verbose)] + $ saf generate inspec_profile -X <[stig or cis]-xccdf-xml> [-O ] [-o ] [-m ] [-s] [-T rule|group|cis|version] [--interactive] [-L info|warn|debug|verbose] FLAGS + -X, --xccdfXmlFile= (required) Path to the XCCDF benchmark file -O, --ovalDefinitions= Path to an OVAL definitions file to populate profile elements that reference OVAL definitions -T, --idType=