[PATCH 2/4] removed CCE handling from scripts that create templated OVAL checks

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 4 17:31:24 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/checks/templates/README                |   32 ++++++++++++++++---
 .../templates/create_kernel_modules_disabled.py    |   15 ++++-----
 .../checks/templates/create_package_installed.py   |   11 ++----
 .../checks/templates/create_package_removed.py     |   10 ++----
 .../checks/templates/create_permission_checks.py   |    9 ++---
 .../checks/templates/create_services_disabled.py   |    6 +--
 .../checks/templates/create_services_enabled.py    |    6 +--
 .../input/checks/templates/create_sysctl_checks.py |    5 +--
 8 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/RHEL6/input/checks/templates/README b/RHEL6/input/checks/templates/README
index d131cb8..f028c5f 100644
--- a/RHEL6/input/checks/templates/README
+++ b/RHEL6/input/checks/templates/README
@@ -2,12 +2,34 @@ These templates are designed to make generation of OVAL tests
 which have repetitive structure easier.
 
 For example:
-
-./create_services_disabled.py services_disabled.csv
-
-Should produce all the OVAL checks (in a shorthand format)
-to disable services in the output folder.
+	$ ./create_services_disabled.py services_disabled.csv
+will produce all the OVAL checks (in a shorthand format)
+to disable services, and store them in the output directory.
 
 The CSV input files should contain all the relevant information
 for each check.  Files should be compared to existing OVAL checks
 for consistency before copying to the main checks directory.
+
+
+A Makefile exists to activate all the scripts here and ease comparison
+with existing checks. For example, to run all scripts to generate
+OVAL checks from the available templates:
+	$ make templates
+
+To compare the newly-generated files in the output directory to the existing
+checks, run:
+	$ make compare
+
+Then, if the changes are agreeable, the following command can be run to copy the
+newly generated files to the main checks directory:
+	$ make copy
+
+To list files that have been manually created (and may potentially be
+templated), run:
+	# make find-untemplated
+
+Note, however, that some checks may have been intentionally hand-edited.
+For example, some sysctl checks (such as for IPv6) may include additional
+tests so that they pass if the IPv6 module is disabled.  Never blindly
+copy over existing checks.
+
diff --git a/RHEL6/input/checks/templates/create_kernel_modules_disabled.py b/RHEL6/input/checks/templates/create_kernel_modules_disabled.py
index e2d9f49..51dc812 100755
--- a/RHEL6/input/checks/templates/create_kernel_modules_disabled.py
+++ b/RHEL6/input/checks/templates/create_kernel_modules_disabled.py
@@ -4,34 +4,33 @@
 # create_kernel_modules_disabled.py
 #   automatically generate checks for disabled kernel modules
 #
-# NOTE: The file 'template_kernel_module_disabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the checks to work.
+# NOTE: The file 'template_kernel_module_disabled' should be located in the
+# same working directory as this script. The template contains the following
+# tags that *must* be replaced successfully in order for the checks to work.
 #
 # KERNMODULE - the name of the kernel module that should be disabled
-# CCEID - the corresponding CCE reference (optional)
 #
 
 import sys, csv, re
 
 def output_checkfile(kerninfo):
     # get the items out of the list
-    kernmod, cce = kerninfo
+    kernmod = kerninfo[0]
     with open("./template_kernel_module_disabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("KERNMODULE", kernmod)
-        filestring = filestring.replace("CCEID", cce if cce else "TODO")
         with open("./output/kernel_module_" + kernmod + "_disabled.xml", 'wb+') as outputfile:
             outputfile.write(filestring)
             outputfile.close()
 
 def main():
     if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: kernmod,CCE"
+        print "Provide a CSV file containing lines of the format: kernmod"
         sys.exit(1)
     with open(sys.argv[1], 'r') as f:
         # put the CSV line's items into a list
-        servicelines = csv.reader(f)
-        for line in servicelines:
+        lines = csv.reader(f)
+        for line in lines:
             output_checkfile(line)
 
     sys.exit(0)
diff --git a/RHEL6/input/checks/templates/create_package_installed.py b/RHEL6/input/checks/templates/create_package_installed.py
index f36ba80..e227567 100755
--- a/RHEL6/input/checks/templates/create_package_installed.py
+++ b/RHEL6/input/checks/templates/create_package_installed.py
@@ -8,30 +8,27 @@
 # template contains the following tags that *must* be replaced successfully in order for the checks to work.
 #
 # PKGNAME - the name of the package that should be installed
-# PKGCCE - the corresponding CCE reference (optional)
 #
 
 import sys, csv, re
 
 def output_check(package_info):
-    pkgname, pkgcce = package_info
-    if (pkgname):
+    pkgname = package_info[0]
+    if pkgname:
         with open("./template_package_installed", 'r') as templatefile:
             filestring = templatefile.read()
             filestring = filestring.replace("PKGNAME", pkgname)
-            filestring = filestring.replace("PKGCCE", pkgcce if pkgcce else "TODO")
             with open("./output/package_" + pkgname + "_installed.xml", 'wb+') as outputfile:
                 outputfile.write(filestring)
                 outputfile.close()
     else:
-        print("ERROR: input violation: the package name must be defined")
-        print("   pkgname --> \"%s\" pkgcce --> \"%s\"" % (pkgname, pkgcce))
+        print "ERROR: input violation: the package name must be defined"
 
 def main():
     if len(sys.argv) < 2:
         print("usage: %s <CSV_FILE_PATH>" % sys.argv[0])
         print("   the csv file should contain lines of the format:")
-        print("   PACKAGE_NAME,PACKAGE_CCE")
+        print("   PACKAGE_NAME")
         sys.exit(1)
     with open(sys.argv[1], 'r') as csv_file:
         csv_lines = csv.reader(csv_file)
diff --git a/RHEL6/input/checks/templates/create_package_removed.py b/RHEL6/input/checks/templates/create_package_removed.py
index e7f5c1e..f777cc1 100755
--- a/RHEL6/input/checks/templates/create_package_removed.py
+++ b/RHEL6/input/checks/templates/create_package_removed.py
@@ -8,31 +8,27 @@
 # template contains the following tags that *must* be replaced successfully in order for the checks to work.
 #
 # PKGNAME - the name of the package that should be removed
-# PKGCCE - the corresponding CCE reference (optional)
 #
 
 import sys, csv, re
 
 def output_check(package_info):
-    pkgname, pkgcce = package_info
+    pkgname = package_info[0]
     if (pkgname):
         with open("./template_package_removed", 'r') as templatefile:
             filestring = templatefile.read()
             filestring = filestring.replace("PKGNAME", pkgname)
-            filestring = filestring.replace("PKGCCE", pkgcce if pkgcce else "TODO")
             with open("./output/package_" + pkgname + "_removed.xml", 'wb+') as outputfile:
                 outputfile.write(filestring)
                 outputfile.close()
-    else:
-        print("ERROR: input violation: the package name must be defined")
-        print("   pkgname --> \"%s\" pkgcce --> \"%s\"" % (pkgname, pkgcce))
 
 def main():
     if len(sys.argv) < 2:
         print("usage: %s <CSV_FILE_PATH>" % sys.argv[0])
         print("   the csv file should contain lines of the format:")
-        print("   PACKAGE_NAME,PACKAGE_CCE")
+        print("   PACKAGE_NAME")
         sys.exit(1)
+
     with open(sys.argv[1], 'r') as csv_file:
         csv_lines = csv.reader(csv_file)
         for line in csv_lines:
diff --git a/RHEL6/input/checks/templates/create_permission_checks.py b/RHEL6/input/checks/templates/create_permission_checks.py
index e6b6547..70222fb 100755
--- a/RHEL6/input/checks/templates/create_permission_checks.py
+++ b/RHEL6/input/checks/templates/create_permission_checks.py
@@ -7,14 +7,14 @@
 # NOTE: The file 'template_permissions' should be located in the same working directory as this script. The
 # template contains tags that *must* be replaced successfully in order for the checks to work.
 #
-#	  directory path,file name,owner uid (numeric),group owner gid (numeric),mode,CCE
+#	  directory path,file name,owner uid (numeric),group owner gid (numeric),mode
 
 import sys, csv, re
 
 def output_check(path_info):
 	# the csv file contains lines that match the following layout:
-	#	directory,file_name,uid,gid,mode,cce
-	dir_path, file_name, uid, gid, mode, cce = path_info
+	#	directory,file_name,uid,gid,mode
+	dir_path, file_name, uid, gid, mode = path_info
 
 	# build a string out of the path that is suitable for use in id tags
 	# example:	/etc/resolv.conf --> _etc_resolv_conf
@@ -51,7 +51,6 @@ def output_check(path_info):
 		filestring = filestring.replace("FILEID", path_id)
 		filestring = filestring.replace("FILEPATH", full_path)
 		filestring = filestring.replace("FILEDIR", dir_path)
-		filestring = filestring.replace("CCEID", cce if cce else "TODO")
 		filestring = filestring.replace("FILEUID", uid)
 		filestring = filestring.replace("FILEGID", gid)
 		filestring = filestring.replace("FILEMODE", mode)
@@ -70,7 +69,7 @@ def output_check(path_info):
 def main():
 	if len(sys.argv) < 2:
 		print "\nERROR: you must provide the path to a CSV file that contains lines like so:"
-		print "   directory path,file name,owner uid (numeric),group owner gid (numeric),mode,CCE"
+		print "   directory path,file name,owner uid (numeric),group owner gid (numeric),mode"
 		sys.exit(1)
 
 	# open and read the csv file
diff --git a/RHEL6/input/checks/templates/create_services_disabled.py b/RHEL6/input/checks/templates/create_services_disabled.py
index ee7eee2..b500a92 100755
--- a/RHEL6/input/checks/templates/create_services_disabled.py
+++ b/RHEL6/input/checks/templates/create_services_disabled.py
@@ -9,18 +9,16 @@
 #
 # SERVICENAME - the name of the service that should be disabled
 # PACKAGENAME - the name of the package that installs the service
-# CCE_ID - the corresponding CCE reference (optional)
 #
 
 import sys, csv, re
 
 def output_checkfile(serviceinfo):
     # get the items out of the list
-    servicename, packagename, cce = serviceinfo
+    servicename, packagename = serviceinfo
     with open("./template_service_disabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("SERVICENAME", servicename)
-        filestring = filestring.replace("CCE_ID", cce if cce else "TODO")
         if packagename:
             filestring = filestring.replace("PACKAGENAME", packagename)
         else:
@@ -32,7 +30,7 @@ def output_checkfile(serviceinfo):
 
 def main():
     if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: servicename,packagename,CCE"
+        print "Provide a CSV file containing lines of the format: servicename,packagename"
         sys.exit(1)
     with open(sys.argv[1], 'r') as f:
         # put the CSV line's items into a list
diff --git a/RHEL6/input/checks/templates/create_services_enabled.py b/RHEL6/input/checks/templates/create_services_enabled.py
index 611bc14..edb606f 100755
--- a/RHEL6/input/checks/templates/create_services_enabled.py
+++ b/RHEL6/input/checks/templates/create_services_enabled.py
@@ -9,18 +9,16 @@
 #
 # SERVICENAME - the name of the service that should be enabled
 # PACKAGENAME - the name of the package that installs the service
-# CCE_ID - the corresponding CCE reference (optional)
 #
 
 import sys, csv, re
 
 def output_checkfile(serviceinfo):
     # get the items out of the list
-    servicename, packagename, cce = serviceinfo
+    servicename, packagename = serviceinfo
     with open("./template_service_enabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("SERVICENAME", servicename)
-        filestring = filestring.replace("CCE_ID", cce if cce else "TODO")
         if packagename:
             filestring = filestring.replace("PACKAGENAME", packagename)
         else:
@@ -32,7 +30,7 @@ def output_checkfile(serviceinfo):
 
 def main():
     if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: servicename,packagename,CCE"
+        print "Provide a CSV file containing lines of the format: servicename,packagename"
         sys.exit(1)
     with open(sys.argv[1], 'r') as f:
         # put the CSV line's items into a list
diff --git a/RHEL6/input/checks/templates/create_sysctl_checks.py b/RHEL6/input/checks/templates/create_sysctl_checks.py
index 3da896a..009df15 100755
--- a/RHEL6/input/checks/templates/create_sysctl_checks.py
+++ b/RHEL6/input/checks/templates/create_sysctl_checks.py
@@ -4,7 +4,7 @@ import sys, csv, re
 
 def output_checkfile(serviceinfo):
     # get the items out of the list
-    sysctl_var, sysctl_val, cce = serviceinfo
+    sysctl_var, sysctl_val = serviceinfo
     # convert variable name to a format suitable for 'id' tags
     sysctl_var_id = re.sub('[-\.]', '_', sysctl_var)
     # open the template and perform the conversions
@@ -13,7 +13,6 @@ def output_checkfile(serviceinfo):
         filestring = filestring.replace("SYSCTLID", sysctl_var_id)
         filestring = filestring.replace("SYSCTLVAR", sysctl_var)
         filestring = filestring.replace("SYSCTLVAL", sysctl_val)
-        filestring = filestring.replace("CCE_ID", cce if cce else "TODO")
         # write the check
         with open("./output/sysctl_" + sysctl_var_id + ".xml", 'wb+') as outputfile:
             outputfile.write(filestring)
@@ -21,7 +20,7 @@ def output_checkfile(serviceinfo):
 
 def main():
     if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue,CCE"
+        print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
         sys.exit(1)
     with open(sys.argv[1], 'r') as f:
         # put the CSV line's items into a list
-- 
1.7.1



More information about the scap-security-guide mailing list