NIST Controls Assessment SKILL (plus rule to variable mapping)#14824
Open
ggbecker wants to merge 4 commits into
Open
NIST Controls Assessment SKILL (plus rule to variable mapping)#14824ggbecker wants to merge 4 commits into
ggbecker wants to merge 4 commits into
Conversation
ggbecker
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
ggbecker
changed the title
ggbecker
force-pushed
the
nist-group-enhancements-assess-skill
branch
from
f39837a to
4512f84
Compare
Adds extract_rule_variable_mapping.py which scans per-rule OVAL XML files in build/<product>/checks/oval/ and checks_from_templates/oval/ to produce build/<product>/rule_variable_mapping.json — a mapping of each rule ID to the XCCDF external variables it depends on. The script is wired into the CMake build via ssg_extract_rule_variable_mapping() and runs as part of every product build after OVAL compilation. Adds test_profile_variables.py which validates that every profile selects all variables required by the rules it includes, warning when a rule's variable dependency would silently fall back to the .var file default.
ggbecker
force-pushed
the
nist-group-enhancements-assess-skill
branch
from
4512f84 to
8d058bb
Compare
Mab879
requested changes
Jul 7, 2026
|
|
||
| # Process regular OVAL checks | ||
| if checks_dir.exists(): | ||
| # print(f"Processing OVAL checks in {checks_dir}") |
|
|
||
| # Process template-generated OVAL checks | ||
| if templates_dir.exists(): | ||
| # print(f"Processing template OVAL checks in {templates_dir}") |
| # Convert sets to sorted lists for JSON serialization | ||
| result = {rule_id: sorted(list(var_ids)) for rule_id, var_ids in all_mappings.items()} | ||
|
|
||
| # print(f"Found {len(result)} rules with variable dependencies") |
| with open(output_file, 'w', encoding='utf-8') as f: | ||
| json.dump(mapping, f, indent=2, sort_keys=True) | ||
|
|
||
| # print(f"Rule-variable mapping written to {output_file}") |
|
|
||
| # print(f"Rule-variable mapping written to {output_file}") | ||
|
|
||
| return 0 |
Member
There was a problem hiding this comment.
This script always returns 0, do want to do this for now, then later we can enforce this?
| """ | ||
| # Find all variable references via var_ref attributes | ||
| var_refs = set() | ||
| var_ref_pattern = r'var_ref="([^"]+)"' |
Member
There was a problem hiding this comment.
Please review this finding from the Automated review
File: build-scripts/extract_rule_variable_mapping.py:125
Severity: Low-to-medium — affects a small number of rules but the gap is real.
The extract_variables_from_oval_content function only captures variable references via the var_ref="..." attribute pattern (line 125: r'var_ref="([^"]+)"'). However, OVAL XML also uses a child element pattern: <ind:var_ref>variable_id</ind:var_ref> inside <ind:variable_object> elements.
This element pattern appears in ~5,592 built OVAL files across all products. Most of those reference local variables (which would be correctly filtered out), but at least 3 external variables (sshd_required, var_network_filtering_service, var_timesync_service) are referenced exclusively via this element pattern. This means rules that depend on these variables will be missing them from the mapping.
The practical impact is limited — sshd_required defaults to "unset" and most profiles don't explicitly set it — but it's a correctness gap. Adding a second regex to capture <ind:var_ref> element text content would close it:
var_ref_element_pattern = r'<(?:ind:)?var_ref>([^<]+)</(?:ind:)?var_ref>'
The existing internal-variable filtering logic would correctly handle the additional captures.
…pping - Remove four leftover commented-out debug print statements - Add <ind:var_ref> element text pattern to capture variable references that use child element syntax instead of var_ref="..." attribute syntax; affects at least sshd_required, var_network_filtering_service, and var_timesync_service which are referenced exclusively this way - Document the intentional always-zero exit code so build failures in individual OVAL files (logged as warnings) don't break the overall build
Member
|
That rpm-build CI fail looks valid. |
Thread an error count from process_oval_file through build_rule_variable_mapping to main(), and return 1 if any OVAL files could not be read. Validated against a full build of all 38 products — zero errors reported.
ggbecker
force-pushed
the
nist-group-enhancements-assess-skill
branch
from
e126d80 to
0218538
Compare
|
@ggbecker: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
assess-nist-controlClaude Code skill: OSCAL enrichment, CIS reverse lookup, automatability classification, rule selection, variable resolution, and YAML write-back for pending NIST 800-53 Rev 5 controls — base control and enhancements as a single unit.resolve-rule-variablessub-skill: looks up XCCDF variable dependencies frombuild/<product>/rule_variable_mapping.json, reads.varfiles, and collectsvar_name=keyselections interactively. Called byassess-nist-control; also usable standalone.build-scripts/extract_rule_variable_mapping.pyand CMake wiring to generaterule_variable_mapping.jsonat build time, mapping each rule ID to the XCCDF external variables it depends on.Rationale:
resolve-rule-variables) keeps the concern isolated: the key-vs-value distinction,.varfile lookup, deduplication across rules sharing a variable, and the planned future migration to a per-product variables file are all handled in one place.Review Hints:
/assess-nist-control ia-5 --product rhel9, this will trigger an assessment of the control which also contains the variable selections invocation.