[PATCH] Example remediation templates

Shawn Wells shawn.d.wells at gmail.com
Sat Apr 6 02:59:00 UTC 2013


-------------- next part --------------
>From 333f8ca2790704c1a18bc73801fa7a10bb55a085 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 5 Apr 2013 22:54:57 -0400
Subject: [PATCH] Example remediation templates
 Submitting for consideration of a bash 'templates' process, similar to OVAL templates. In this case:

- sysctl pairings are kept in templates/sysctl_values.csv
- Bash remediation template for sysctl kept in templates/template_sysctl.sh
- User runs templates/create_sysctl_checks.py which runs through the CSV file,
  generating the needed bash remediation scripts.

This process would let us centralize (some) repeatable code segments.
---
 RHEL6/input/fixes/bash/templates/Makefile          |    8 +++
 .../fixes/bash/templates/create_sysctl_checks.py   |   35 +++++++++++
 RHEL6/input/fixes/bash/templates/output/.gitignore |    2 +
 RHEL6/input/fixes/bash/templates/sysctl_values.csv |   17 +++++
 .../input/fixes/bash/templates/template_sysctl.sh  |   65 ++++++++++++++++++++
 5 files changed, 127 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/templates/Makefile
 create mode 100755 RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
 create mode 100644 RHEL6/input/fixes/bash/templates/output/.gitignore
 create mode 100644 RHEL6/input/fixes/bash/templates/sysctl_values.csv
 create mode 100755 RHEL6/input/fixes/bash/templates/template_sysctl.sh

diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile
new file mode 100644
index 0000000..81c89ef
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/Makefile
@@ -0,0 +1,8 @@
+templates: 
+	./create_sysctl_checks.py sysctl_values.csv
+
+copy:
+	cp output/*.sh ../
+
+clean:
+	rm output/*.sh
diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
new file mode 100755
index 0000000..b7c46b0
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
@@ -0,0 +1,35 @@
+#!/usr/bin/python
+
+import sys, csv, re
+
+def output_checkfile(serviceinfo):
+    # get the items out of the list
+    sysctl_var, sysctl_val = serviceinfo
+    # convert variable name to a format suitable for 'id' tags
+    sysctl_var_id = re.sub('[-\.]', '_', sysctl_var)
+    # open the template and perform the conversions
+    with open("template_sysctl.sh", 'r') as templatefile:
+        filestring = templatefile.read()
+        filestring = filestring.replace("SYSCTLID", sysctl_var_id)
+        filestring = filestring.replace("SYSCTLVAR", sysctl_var)
+        filestring = filestring.replace("SYSCTLVAL", sysctl_val)
+        # write the check
+        with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile:
+            outputfile.write(filestring)
+            outputfile.close()
+
+def main():
+    if len(sys.argv) < 2:
+        print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
+        sys.exit(1)
+    with open(sys.argv[1], 'r') as f:
+        # put the CSV line's items into a list
+        sysctl_lines = csv.reader(f)
+        for line in sysctl_lines:
+            output_checkfile(line)
+
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
+
diff --git a/RHEL6/input/fixes/bash/templates/output/.gitignore b/RHEL6/input/fixes/bash/templates/output/.gitignore
new file mode 100644
index 0000000..041cc36
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/output/.gitignore
@@ -0,0 +1,2 @@
+# files to ignore
+*.sh
diff --git a/RHEL6/input/fixes/bash/templates/sysctl_values.csv b/RHEL6/input/fixes/bash/templates/sysctl_values.csv
new file mode 100644
index 0000000..787aa5c
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/sysctl_values.csv
@@ -0,0 +1,17 @@
+kernel.exec-shield,1
+kernel.randomize_va_space,2
+net.ipv4.conf.all.accept_redirects,0
+net.ipv4.conf.all.accept_source_route,0
+net.ipv4.conf.all.log_martians,1
+net.ipv4.conf.all.rp_filter,1
+net.ipv4.conf.all.secure_redirects,0
+net.ipv4.conf.all.send_redirects,0
+net.ipv4.conf.default.accept_redirects,0
+net.ipv4.conf.default.accept_source_route,0
+net.ipv4.conf.default.rp_filter,1
+net.ipv4.conf.default.secure_redirects,0
+net.ipv4.conf.default.send_redirects,0
+net.ipv4.icmp_echo_ignore_broadcasts,1
+net.ipv4.icmp_ignore_bogus_error_responses,1
+net.ipv4.ip_forward,0
+net.ipv4.tcp_syncookies,1
diff --git a/RHEL6/input/fixes/bash/templates/template_sysctl.sh b/RHEL6/input/fixes/bash/templates/template_sysctl.sh
new file mode 100755
index 0000000..4c6bce2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/template_sysctl.sh
@@ -0,0 +1,65 @@
+#!/bin/bash -u
+set -e
+
+#
+# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA
+#
+# This software was developed by Tresys Technology LLC
+# with U.S. Government sponsorship.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+PARAM="SYSCTLVAR"
+DESIRED="SYSCTLVAL"
+DIR=${PARAM//\./\/}
+DIR="/proc/sys/"$DIR
+
+if [ -f $DIR ]; then
+	MODULE=`/bin/echo "${PARAM}"|/bin/sed -e "s/\./\//g"`
+
+	[ -f /etc/sysctl.conf ] || return 1
+
+	if /bin/grep -q "${PARAM}" /etc/sysctl.conf; then
+		/sbin/sysctl -q -p
+	else
+		/bin/echo ""                                 >> /etc/sysctl.conf &&
+		/bin/echo "# Added by $(/bin/basename $0) on $(/bin/date -u)" >> /etc/sysctl.conf &&
+		/bin/echo "$PARAM = $DESIRED"                       >> /etc/sysctl.conf
+	fi
+
+	if ! /sbin/sysctl -q -w $PARAM=$DESIRED; then
+		/bin/echo "sysctl -w $PARAM=$DESIRED failed"
+	fi
+else
+	return 0
+fi
+
+SAFE_FIELD="($PARAM\s+=\s+).*"
+VAL=$DESIRED
+FILEDIR="/etc/sysctl.conf"
+
+F=` /bin/echo $FILEDIR|/bin/grep -Po "[^\/]*$" `
+FILEDIR=${FILEDIR%"/$F"}
+
+if /bin/grep -Pq "^(\s*)(\#*)(\s*)($SAFE_FIELD)" "$FILEDIR/$F"; then
+	/bin/sed -i -r -e "s!(\s*)(\#*)(\s*)$SAFE_FIELD!\3\4$VAL!g" "$FILEDIR/$F"
+else
+	OUT=` /bin/echo $SAFE_FIELD|/bin/grep -Po "\([^\(|^\)]*\)" `
+	OUT=` /bin/echo $OUT | /bin/grep -Po "[^\(|^\)]*"`$VAL
+	OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\+! !g" `
+	OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\*!!g" `
+	OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s! !g" `
+	OUT=` /bin/echo $OUT| /bin/grep -Po '[^\\\\]*'`        
+	/bin/echo $OUT >> "$FILEDIR/$F"
+fi
+
+/sbin/sysctl -e -q -p
-- 
1.7.1



More information about the scap-security-guide mailing list