>From 3ad8ce28808123fb2d66db09afb98a3b7fd105b4 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 29 Nov 2013 23:48:16 -0500 Subject: [PATCH] [RFC] Creating shared bash script directory As remediation content expands, many scripts will be repurposed across operating system releases. To reduce the maintanence burden of having the same script in multiple places, I propose to create a shared fix directory. A patch to demonstrate this concept is attached. combinefixes was modified to first look at input/fixes/bash, then ../shared/fixes/, else echo a "no fix exists" message. The downside to this approach is "exclusion" -- just because a script does not exist within RHEL6/fixes/bash does not automatically mean we want the ../shared/fixes/ version. Unsure how to handle this. One idea was to 'touch RHEL6/fixes/bash', and then delete that file if the shared version was to be inherited. --- .../input/fixes/bash/sysctl_net_ipv4_ip_forward.sh | 16 ------------ RHEL6/transforms/combinefixes.py | 25 ++++++++++++------- shared/bash/sysctl_net_ipv4_ip_forward.sh | 16 ++++++++++++ 3 files changed, 32 insertions(+), 25 deletions(-) delete mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh create mode 100644 shared/bash/sysctl_net_ipv4_ip_forward.sh diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh deleted file mode 100644 index 3292a63..0000000 --- a/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.ip_forward -# -sysctl -q -n -w net.ipv4.ip_forward=0 - -# -# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/transforms/combinefixes.py b/RHEL6/transforms/combinefixes.py index 71fbe6f..4f3ac9f 100755 --- a/RHEL6/transforms/combinefixes.py +++ b/RHEL6/transforms/combinefixes.py @@ -1,6 +1,7 @@ #!/usr/bin/python import sys, os, re, lxml.etree as etree +from os import path, access def substitute_vars(fix): # brittle and troubling code to assign environment vars to XCCDF values @@ -29,16 +30,22 @@ def main(): fixcontent = etree.Element("fix-content", system="urn:xccdf:fix:script:sh", xmlns="http://checklists.nist.gov/xccdf/1.1") fixgroup = etree.SubElement(fixcontent, "fix-group", id="bash", system="urn:xccdf:fix:script:sh", xmlns="http://checklists.nist.gov/xccdf/1.1") - for filename in os.listdir(fixdir): - if filename.endswith(".sh"): - # create and populate new fix element based on shell file - fixname = os.path.splitext(filename)[0] + for filename in os.listdir('input/checks/'): + if filename.endswith(".xml"): + fixname = os.path.splitext(filename)[0] fix = etree.SubElement(fixgroup, "fix", rule=fixname) - with open( fixdir + "/" + filename, 'r') as f: - # assignment automatically escapes shell characters for XML - fix.text = f.read() - # replace instance of bash function "populate" with XCCDF variable substitution - substitute_vars(fix) + + if path.isfile('input/fixes/bash/' + fixname + '.sh'): + with open( 'input/fixes/bash/' + fixname + '.sh', 'r') as f: + fix.text = f.read() + substitute_vars(fix) + elif path.isfile('../shared/bash/' + fixname + '.sh'): + with open( '../shared/bash/' + fixname + '.sh', 'r') as f: + fix.text = f.read() + substitute_vars(fix) + else: + fix.text = "# No bash script available for " + fixname + " yet.\n\ +# Interested in helping? https://fedorahosted.org/scap-security-guide/" tree = etree.ElementTree(fixcontent) tree.write(output, pretty_print=True) diff --git a/shared/bash/sysctl_net_ipv4_ip_forward.sh b/shared/bash/sysctl_net_ipv4_ip_forward.sh new file mode 100644 index 0000000..3292a63 --- /dev/null +++ b/shared/bash/sysctl_net_ipv4_ip_forward.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.ip_forward +# +sysctl -q -n -w net.ipv4.ip_forward=0 + +# +# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf +fi -- 1.7.1