[PATCH 1/4] new helper scripts for making/verifying/installing templated files
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Sep 4 17:31:23 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/checks/templates/Makefile | 30 +++++++++++++++++++++
RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++++++++++++++++++
2 files changed, 61 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/templates/Makefile
create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
diff --git a/RHEL6/input/checks/templates/Makefile b/RHEL6/input/checks/templates/Makefile
new file mode 100644
index 0000000..c17bfc2
--- /dev/null
+++ b/RHEL6/input/checks/templates/Makefile
@@ -0,0 +1,30 @@
+templates: services packages kernel_modules permissions sysctls
+
+services:
+ ./create_services_disabled.py services_disabled.csv
+ ./create_services_enabled.py services_enabled.csv
+
+packages:
+ ./create_package_installed.py packages_installed.csv
+ ./create_package_removed.py packages_removed.csv
+
+kernel_modules:
+ ./create_kernel_modules_disabled.py kernel_modules_disabled.csv
+
+permissions:
+ ./create_permission_checks.py file_dir_permissions.csv
+
+sysctls:
+ ./create_sysctl_checks.py sysctl_values.csv
+
+compare:
+ diff output/ ../ | grep -v "Only in ../"
+
+copy:
+ cp output/*.xml ../
+
+find-untemplated: templates
+ ./find_untemplated.py
+
+clean:
+ rm output/*.xml
diff --git a/RHEL6/input/checks/templates/find_untemplated.py b/RHEL6/input/checks/templates/find_untemplated.py
new file mode 100755
index 0000000..222d105
--- /dev/null
+++ b/RHEL6/input/checks/templates/find_untemplated.py
@@ -0,0 +1,31 @@
+#!/usr/bin/python
+
+import sys, os, glob
+
+# locate files in the parent directory that match a certain filename pattern and thus
+# should be templated, and compare to currently templated files.
+
+def main():
+ prefixsearchlist = [ 'package_' , 'service_', 'sysctl_', 'kernel_module_' ]
+ # the directory/file permission situation still needs to be sorted out, then we should add file_permissions etc
+
+ templatable_files = []
+ for prefix in prefixsearchlist:
+ foundfiles = glob.glob("../"+prefix+"*.xml")
+ templatable_files.extend(foundfiles)
+
+ templatable = set([os.path.basename(file) for file in templatable_files ])
+ templated = set([os.path.basename(file) for file in glob.glob("./output/*.xml")])
+
+ untemplated = templatable.difference(templated)
+
+ print "\nThe following files' names suggest they could be templated, though they might be intentionally edited:"
+ for file in untemplated:
+ print file
+ print "\nA typical reason for hand-editing a file is to gracefully handle situations where the test should pass."
+
+ sys.exit(0)
+
+if __name__ == "__main__":
+ main()
+
--
1.7.1
More information about the scap-security-guide
mailing list