[PATCH 1/4] new helper scripts for making/verifying/installing templated files

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 4 17:31:23 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/checks/templates/Makefile            |   30 +++++++++++++++++++++
 RHEL6/input/checks/templates/find_untemplated.py |   31 ++++++++++++++++++++++
 2 files changed, 61 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/templates/Makefile
 create mode 100755 RHEL6/input/checks/templates/find_untemplated.py

diff --git a/RHEL6/input/checks/templates/Makefile b/RHEL6/input/checks/templates/Makefile
new file mode 100644
index 0000000..c17bfc2
--- /dev/null
+++ b/RHEL6/input/checks/templates/Makefile
@@ -0,0 +1,30 @@
+templates: services packages kernel_modules permissions sysctls
+
+services:
+	./create_services_disabled.py services_disabled.csv
+	./create_services_enabled.py services_enabled.csv
+
+packages:
+	./create_package_installed.py packages_installed.csv
+	./create_package_removed.py packages_removed.csv
+
+kernel_modules:
+	./create_kernel_modules_disabled.py kernel_modules_disabled.csv
+
+permissions:
+	./create_permission_checks.py file_dir_permissions.csv
+
+sysctls:
+	./create_sysctl_checks.py sysctl_values.csv
+	
+compare:
+	diff output/ ../ | grep -v "Only in ../"
+
+copy:
+	cp output/*.xml ../
+
+find-untemplated: templates
+	./find_untemplated.py
+
+clean:
+	rm output/*.xml
diff --git a/RHEL6/input/checks/templates/find_untemplated.py b/RHEL6/input/checks/templates/find_untemplated.py
new file mode 100755
index 0000000..222d105
--- /dev/null
+++ b/RHEL6/input/checks/templates/find_untemplated.py
@@ -0,0 +1,31 @@
+#!/usr/bin/python
+
+import sys, os, glob
+
+# locate files in the parent directory that match a certain filename pattern and thus 
+# should be templated, and compare to currently templated files.
+
+def main():
+	prefixsearchlist = [ 'package_' , 'service_', 'sysctl_', 'kernel_module_' ] 
+	# the directory/file permission situation still needs to be sorted out, then we should add file_permissions etc
+
+	templatable_files = []
+	for prefix in prefixsearchlist:
+		foundfiles = glob.glob("../"+prefix+"*.xml")
+		templatable_files.extend(foundfiles)
+
+	templatable = set([os.path.basename(file) for file in templatable_files ])
+	templated = set([os.path.basename(file) for file in glob.glob("./output/*.xml")])
+
+	untemplated = templatable.difference(templated)	
+
+	print "\nThe following files' names suggest they could be templated, though they might be intentionally edited:"
+	for file in untemplated:
+		print file 
+	print "\nA typical reason for hand-editing a file is to gracefully handle situations where the test should pass."
+
+	sys.exit(0)
+
+if __name__ == "__main__":
+	main()
+
-- 
1.7.1



More information about the scap-security-guide mailing list