>From ba5122ffe83391ae267d20e8906bcef8082e6200 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 7 Jul 2013 02:32:48 -0400 Subject: [PATCH 2/3] Added remediation template: create_file_ownership_bash --- RHEL6/input/fixes/bash/templates/Makefile | 3 ++ .../bash/templates/create_file_ownership_bash.py | 38 ++++++++++++++++++++ .../bash/templates/template_file_ownership_bash | 1 + 3 files changed, 42 insertions(+), 0 deletions(-) create mode 100755 RHEL6/input/fixes/bash/templates/create_file_ownership_bash.py create mode 100644 RHEL6/input/fixes/bash/templates/template_file_ownership_bash diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile index fe3f855..42fa3d9 100644 --- a/RHEL6/input/fixes/bash/templates/Makefile +++ b/RHEL6/input/fixes/bash/templates/Makefile @@ -5,6 +5,9 @@ sysctls: services: ./create_services_disabled.py ../../../checks/templates/services_disabled.csv + +permissions: + ./create_file_ownership_bash.py ../../../checks/templates/file_dir_permissions.csv compare: diff output/ ../ | grep -v "Only in ../" diff --git a/RHEL6/input/fixes/bash/templates/create_file_ownership_bash.py b/RHEL6/input/fixes/bash/templates/create_file_ownership_bash.py new file mode 100755 index 0000000..867d47a --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/create_file_ownership_bash.py @@ -0,0 +1,38 @@ +#!/usr/bin/python + +import sys, csv, re + +def output_checkfile(fileinfo): + # get the items out of the list + objpath, objfilename, userid, groupid, fileperms = fileinfo + + # convert directory path variable name to a format suitable for 'id' tags + objfullpath = re.sub('[-\/]', '_', objpath) + + # open the template and perform the conversions + with open("template_file_ownership_bash", 'r') as templatefile: + filestring = templatefile.read() + filestring = filestring.replace("OBJPATH", objpath) + filestring = filestring.replace("OBJFILENAME", objfilename) + filestring = filestring.replace("USERID", userid) + filestring = filestring.replace("OBJFULLPATH", objfullpath) + # write the check + with open("./output/file_ownership" + objfullpath + "_" + objfilename +".sh", 'wb+') as outputfile: + outputfile.write(filestring) + outputfile.close() + +def main(): + if len(sys.argv) < 2: + print "Provide a CSV file containing lines of the format: objpath, pbjfilename, userid, groupid, fileperms" + sys.exit(1) + with open(sys.argv[1], 'r') as f: + # put the CSV line's items into a list + sysctl_lines = csv.reader(f) + for line in sysctl_lines: + output_checkfile(line) + + sys.exit(0) + +if __name__ == "__main__": + main() + diff --git a/RHEL6/input/fixes/bash/templates/template_file_ownership_bash b/RHEL6/input/fixes/bash/templates/template_file_ownership_bash new file mode 100644 index 0000000..11fd327 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/template_file_ownership_bash @@ -0,0 +1 @@ +chown USERID OBJPATH/OBJFILENAME -- 1.7.1