Hello,
As you may be aware, one of the key use cases for SecState has been automated remediation.
We have shifted away from Puppet remediation to BASH remediation in response to community
input & direction. At this time our core target is enabling users to use SSG content
to audit a system and Aqueduct content to remediate a system. As we move forward with
designing the "glue" to link the content together we would appreciate input from
the community about the approach we're planning for this. We want to help find an
approach for this which is agreeable to the content maintainers and lets us meet our use
cases.
We are planning to continue using the <fix> tag with a custom system attribute
string to indicate that the <fix> tag contains BASH remediation content. We are
currently considering JSON notation as the leading candidate for writing the <fix>
content because it is both easy to write and easy to parse. The information we want to
make sure we cover for running a remediation script is:
* Path to the script
* Environment variables to define
* Positional arguments to pass in to the script
Using JSON notation in a <fix> tag, this would be the representation of that info:
<fix system="urn:xccdf:fix:script:bash">
{
"script" : "/usr/libexec/ssg/scripts/remediate_foo.sh"
"environment-variables" : {"FOO" : "12",
"TEST" : "<sub idref="xccdf_variable_foo" />"}
"positional-args" : ["test","<sub idref="
other_xccdf_variable" />"]
}
</fix>
The array of positional-args would be assumed to be ordered. So this example would call:
FOO=12 TEST=<value of xccdf_variable_foo> /bin/bash
/usr/libexec/ssg/scripts/remediate_foo.sh test <value of other_xccdf_variable>
We would appreciate any input & feedback regarding this approach.
Thank you
- Francisco Slavin