Policy interface to Extensible Configuration Checklist Description Format.
More...
|
typedef void *(* | xccdf_policy_engine_query_fn )(void *, xccdf_policy_engine_query_t, void *) |
| Type of function which implements queries defined within xccdf_policy_engine_query_t.
|
|
typedef xccdf_test_result_type_t(* | xccdf_policy_engine_eval_fn )(struct xccdf_policy *policy, const char *rule_id, const char *definition_id, const char *href_if, struct xccdf_value_binding_iterator *value_binding_it, struct xccdf_check_import_iterator *check_imports_it, void *user_data) |
| Type of function which implements OpenSCAP checking engine.
|
|
typedef int(* | policy_reporter_output )(struct xccdf_rule_result *, void *) |
|
typedef int(* | policy_reporter_start )(struct xccdf_rule *, void *) |
|
|
bool | xccdf_policy_model_add_cpe_dict (struct xccdf_policy_model *model, const char *cpe_dict) |
| Registers an additional CPE dictionary for applicability testing The one embedded in the evaluated XCCDF take precedence!
|
|
bool | xccdf_policy_model_add_cpe_lang_model (struct xccdf_policy_model *model, const char *cpe_lang) |
| Registers an additional CPE lang model for applicability testing The one embedded in the evaluated XCCDF take precedence!
|
|
bool | xccdf_policy_model_add_cpe_autodetect (struct xccdf_policy_model *model, const char *filepath) |
| Registers an additional CPE resource (either dictionary or language) Autodetects given file and acts accordingly.
|
|
struct xccdf_policy_model * | xccdf_policy_model::xccdf_policy_model_new (struct xccdf_benchmark *benchmark) |
| Constructor of Policy Model structure.
|
|
struct xccdf_policy * | xccdf_policy::xccdf_policy_new (struct xccdf_policy_model *model, struct xccdf_profile *profile) |
| Constructor of Policy structure.
|
|
struct xccdf_value_binding * | xccdf_value_binding::xccdf_value_binding_new (void) |
| Constructor of structure with profile bindings - refine_rules, refine_values and set_values.
|
|
void | xccdf_policy_model::xccdf_policy_model_free (struct xccdf_policy_model *) |
| Destructor of Policy Model structure.
|
|
void | xccdf_policy::xccdf_policy_free (struct xccdf_policy *) |
| Destructor of Policy structure.
|
|
void | xccdf_value_binding::xccdf_value_binding_free (struct xccdf_value_binding *) |
| Destructor of Value binding structure.
|
|
bool | xccdf_policy_model::xccdf_policy_model_register_engine_and_query_callback (struct xccdf_policy_model *model, char *sys, xccdf_policy_engine_eval_fn eval_fn, void *usr, xccdf_policy_engine_query_fn query_fn) |
| Function to register callback for checking system.
|
|
bool | xccdf_policy_model::xccdf_policy_model_register_output_callback (struct xccdf_policy_model *model, policy_reporter_output func, void *usr) |
| Function to register output callback for checking system that will be called AFTER each rule evaluation.
|
|
bool | xccdf_policy_model::xccdf_policy_model_register_start_callback (struct xccdf_policy_model *model, policy_reporter_start func, void *usr) |
| Function to register start callback for checking system that will be called BEFORE each rule evaluation.
|
|
Policy interface to Extensible Configuration Checklist Description Format.
Purpose of this layer is to separate the transport syntax of the XCCDF XML from the processes of evaluating and scoring the policy content comprised by the XCCDF documents. XCCDF Policy model performs the loading, evaluation and scoring tasks of XCCDF.
#define OSCAP_DEPRECATED |
( |
|
func | ) |
func |
Set a new selector to the Policy structure.
- Returns
- true if rule has been added succesfully
- Deprecated:
- This function is deprecated by xccdf_policy_add_select and might be dropped from future releases.
Type of function which implements OpenSCAP checking engine.
This function defines basic interface between XCCDF module and thee checking engine. For each checking engine required for evaluation there should be at least one such function registerd. The registered function is then used by xccdf_policy module to perform evaluation on the machine.
Type of function which implements queries defined within xccdf_policy_engine_query_t.
Each checking engine may register its own function of the xccdf_policy_engine_query_fn type. The registered function is then used by xccdf_policy module to acquire comprehensive info about the checking-engine itself or the data fed in. First argument of the function is always user data as registered. Second argument defines the query. Third argument is dependent on query and defined as follows:
- (const char *)href – for POLICY_ENGINE_QUERY_NAMES_FOR_HREF
Expected return type depends also on query as follows:
- (struct oscap_stringlists *) – for POLICY_ENGINE_QUERY_NAMES_FOR_HREF
- NULL shall be returned if the function doesn't understand the query.
Type of a query over checking-engine data.
This allows xccdf_policy module to query checking engine and acquire comprehensive info.
Return names of files that are used in checks of particular rules.
Every check needs this file to be evaluated properly. If this file will not be imported and bind to the XCCDF Policy system the result of rule after evaluation will be "Not checked"
Return names of files that are used in checks of particular rules.
Every check needs this file to be evaluated properly. If this file will not be imported and bind to the XCCDF Policy system the result of rule after evaluation will be "Not checked"
The resulting list should be freed with oscap_filelist_free.
Add rule to Policy.
- Returns
- true if rule has been added succesfully
Add value binding to the Policy structure.
- Returns
- true if rule has been added succesfully
Call the checking engine for each selected rule in given policy structure.
- Parameters
-
policy | given Policy to evaluate |
- Returns
- true if evaluation pass or false in case of error
- Example
- Before each policy evaluation user has to register callback that will be called for each check. Every checking engine must have registered callback or the particular check will be skipped. In the code below is used the predefined function oval_agent_eval_rule for evaluation OVAL checks:
xccdf_policy_model_register_engine_oval(policy_mode, agent_session)
- If you use this predefined OVAL callback, user data structure (last parameter of register function) MUST be of type oval_agent_session_t:
const char * xccdf_policy_get_id |
( |
struct xccdf_policy * |
policy | ) |
|
Get ID of XCCDF Profile that is implemented by XCCDF Policy.
- Parameters
-
- Returns
- ID of Policy's Profile
Get model from Policy (parent structure of Policy to access the benchmark)
- Parameters
-
- Returns
- Policy model
Get XCCDF Profile from Policy.
- Returns
- XCCDF Profile
Get XCCDF Result structure by it's idetificator if there is one.
- Returns
- structure xccdf_result if found, NULL otherwise
Get score of the XCCDF Benchmark.
- Parameters
-
policy | XCCDF Policy |
test_result | Test Result model |
system | Score system |
- Returns
- XCCDF Score
Get select from policy by specified ID of XCCDF Item.
- Returns
- XCCDF Select
Get selected rules from policy.
- Returns
- Pointer to select iterator.
- Return values
-
bool xccdf_policy_is_item_selected |
( |
struct xccdf_policy * |
policy, |
|
|
const char * |
id |
|
) |
| |
Get the selection settings of the item.
- Returns
- true if the item is selected
bool xccdf_policy_model_add_cpe_autodetect |
( |
struct xccdf_policy_model * |
model, |
|
|
const char * |
filepath |
|
) |
| |
Registers an additional CPE resource (either dictionary or language) Autodetects given file and acts accordingly.
The one embedded in the evaluated XCCDF take precedence!
Add Policy to Policy Model.
- Returns
- true if policy has been added succesfully
Get Benchmark from Policy Model.
- Parameters
-
item | Policy model structure |
- Returns
- XCCDF Benchmark for given policy model
Return names of files that are used in checks of particular rules.
Every check needs this file to be evaluated properly. If this file will not be imported and bind to the XCCDF Policy system the result of rule after evaluation will be "Not checked"
Get policies from Policy Model.
Be aware, this function returns only a list of previously initialized policies. A policy can be initialized by xccdf_policy_model_get_policy_by_id.
- Parameters
-
- Returns
- Iterator for list of policies
Get XCCDF Policy from Policy model by speciefied ID of Profile.
- Parameters
-
policy_model | XCCDF Policy model |
id | ID of Profile |
- Returns
- XCCDF Policy
Return names of files that are used in checks of particular rules.
Every check needs this file to be evaluated properly. If this file will not be imported and bind to the XCCDF Policy system the result of rule after evaluation will be "Not checked"
The resulting list should be freed with oscap_filelist_free.
Function to register callback for checking system.
- Parameters
-
model | XCCDF Policy Model |
sys | String representing given checking system |
eval_fn | Callback - pointer to function called by XCCDF Policy system when rule parsed |
usr | optional parameter for passing user data to callback |
query_fn | - optional parameter for providing xccdf_policy_engine_query_fn implementation for given system. |
- Returns
- true if callback registered succesfully, false otherwise
bool xccdf_policy_model_register_output_callback |
( |
struct xccdf_policy_model * |
model, |
|
|
policy_reporter_output |
func, |
|
|
void * |
usr |
|
) |
| |
Function to register output callback for checking system that will be called AFTER each rule evaluation.
- Parameters
-
model | XCCDF Policy Model |
func | Callback - pointer to function called by XCCDF Policy system when rule parsed |
usr | optional parameter for passing user data to callback |
- Returns
- true if callback registered succesfully, false otherwise
bool xccdf_policy_model_register_start_callback |
( |
struct xccdf_policy_model * |
model, |
|
|
policy_reporter_start |
func, |
|
|
void * |
usr |
|
) |
| |
Function to register start callback for checking system that will be called BEFORE each rule evaluation.
- Parameters
-
model | XCCDF Policy Model |
func | Callback - pointer to function called by XCCDF Policy system when rule parsed |
usr | optional parameter for passing user data to callback |
- Returns
- true if callback registered succesfully, false otherwise
Constructor of Policy structure.
- Parameters
-
model | Policy model |
profile | Profile from XCCDF Benchmark |
Resolve benchmark by applying all refine_rules and refine_values to rules / values of benchmark.
All properties in benchmark will be irreversible changed and user has to load benchmark (from XML) again to discard these changes.
- Parameters
-
policy | XCCDF policy containing rules/values that will be applied to benchmark rules/values. |
- Returns
- true if process ends succesfuly or false in case of error
char* xccdf_policy_substitute |
( |
const char * |
text, |
|
|
struct xccdf_policy * |
policy |
|
) |
| |
Perform textual substitution of cdf:sub elements with respect to given XCCDF policy.
- Parameters
-
text | text to be substituted |
policy | policy to be used |
Clone the item and tailor it against given policy (profile)
- Parameters
-
policy | Policy with profile |
item | XCCDF item to be tailored |
- Returns
- new item that has to be freed by user
Return result of the AND operation for two given attributes.
For more details about the attributes A and B please consult 'Table 26: Possible Results for a Single Test' from NISTIR-7275r4. For more details about the AND operation please consult 'Table 12: Truth Table for AND' in the very same document.
Get variable name from value bindings.
- Returns
- String
get Value operator from value bindings
- Returns
- xccdf_operator_t
get Set Value from value bindings
- Returns
- String
get variable type from value bindings
- Returns
- xccdf_value_type_t
Get value from value bindings.
- Returns
- String
Constructor of structure with profile bindings - refine_rules, refine_values and set_values.
- Returns
- new structure of xccdf_value_binding