[PATCH] Example remediation templates
Shawn Wells
shawn.d.wells at gmail.com
Sat Apr 6 02:59:00 UTC 2013
-------------- next part --------------
>From 333f8ca2790704c1a18bc73801fa7a10bb55a085 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 5 Apr 2013 22:54:57 -0400
Subject: [PATCH] Example remediation templates
Submitting for consideration of a bash 'templates' process, similar to OVAL templates. In this case:
- sysctl pairings are kept in templates/sysctl_values.csv
- Bash remediation template for sysctl kept in templates/template_sysctl.sh
- User runs templates/create_sysctl_checks.py which runs through the CSV file,
generating the needed bash remediation scripts.
This process would let us centralize (some) repeatable code segments.
---
RHEL6/input/fixes/bash/templates/Makefile | 8 +++
.../fixes/bash/templates/create_sysctl_checks.py | 35 +++++++++++
RHEL6/input/fixes/bash/templates/output/.gitignore | 2 +
RHEL6/input/fixes/bash/templates/sysctl_values.csv | 17 +++++
.../input/fixes/bash/templates/template_sysctl.sh | 65 ++++++++++++++++++++
5 files changed, 127 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/templates/Makefile
create mode 100755 RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
create mode 100644 RHEL6/input/fixes/bash/templates/output/.gitignore
create mode 100644 RHEL6/input/fixes/bash/templates/sysctl_values.csv
create mode 100755 RHEL6/input/fixes/bash/templates/template_sysctl.sh
diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile
new file mode 100644
index 0000000..81c89ef
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/Makefile
@@ -0,0 +1,8 @@
+templates:
+ ./create_sysctl_checks.py sysctl_values.csv
+
+copy:
+ cp output/*.sh ../
+
+clean:
+ rm output/*.sh
diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
new file mode 100755
index 0000000..b7c46b0
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py
@@ -0,0 +1,35 @@
+#!/usr/bin/python
+
+import sys, csv, re
+
+def output_checkfile(serviceinfo):
+ # get the items out of the list
+ sysctl_var, sysctl_val = serviceinfo
+ # convert variable name to a format suitable for 'id' tags
+ sysctl_var_id = re.sub('[-\.]', '_', sysctl_var)
+ # open the template and perform the conversions
+ with open("template_sysctl.sh", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("SYSCTLID", sysctl_var_id)
+ filestring = filestring.replace("SYSCTLVAR", sysctl_var)
+ filestring = filestring.replace("SYSCTLVAL", sysctl_val)
+ # write the check
+ with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
+def main():
+ if len(sys.argv) < 2:
+ print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
+ sys.exit(1)
+ with open(sys.argv[1], 'r') as f:
+ # put the CSV line's items into a list
+ sysctl_lines = csv.reader(f)
+ for line in sysctl_lines:
+ output_checkfile(line)
+
+ sys.exit(0)
+
+if __name__ == "__main__":
+ main()
+
diff --git a/RHEL6/input/fixes/bash/templates/output/.gitignore b/RHEL6/input/fixes/bash/templates/output/.gitignore
new file mode 100644
index 0000000..041cc36
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/output/.gitignore
@@ -0,0 +1,2 @@
+# files to ignore
+*.sh
diff --git a/RHEL6/input/fixes/bash/templates/sysctl_values.csv b/RHEL6/input/fixes/bash/templates/sysctl_values.csv
new file mode 100644
index 0000000..787aa5c
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/sysctl_values.csv
@@ -0,0 +1,17 @@
+kernel.exec-shield,1
+kernel.randomize_va_space,2
+net.ipv4.conf.all.accept_redirects,0
+net.ipv4.conf.all.accept_source_route,0
+net.ipv4.conf.all.log_martians,1
+net.ipv4.conf.all.rp_filter,1
+net.ipv4.conf.all.secure_redirects,0
+net.ipv4.conf.all.send_redirects,0
+net.ipv4.conf.default.accept_redirects,0
+net.ipv4.conf.default.accept_source_route,0
+net.ipv4.conf.default.rp_filter,1
+net.ipv4.conf.default.secure_redirects,0
+net.ipv4.conf.default.send_redirects,0
+net.ipv4.icmp_echo_ignore_broadcasts,1
+net.ipv4.icmp_ignore_bogus_error_responses,1
+net.ipv4.ip_forward,0
+net.ipv4.tcp_syncookies,1
diff --git a/RHEL6/input/fixes/bash/templates/template_sysctl.sh b/RHEL6/input/fixes/bash/templates/template_sysctl.sh
new file mode 100755
index 0000000..4c6bce2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/template_sysctl.sh
@@ -0,0 +1,65 @@
+#!/bin/bash -u
+set -e
+
+#
+# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA
+#
+# This software was developed by Tresys Technology LLC
+# with U.S. Government sponsorship.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+PARAM="SYSCTLVAR"
+DESIRED="SYSCTLVAL"
+DIR=${PARAM//\./\/}
+DIR="/proc/sys/"$DIR
+
+if [ -f $DIR ]; then
+ MODULE=`/bin/echo "${PARAM}"|/bin/sed -e "s/\./\//g"`
+
+ [ -f /etc/sysctl.conf ] || return 1
+
+ if /bin/grep -q "${PARAM}" /etc/sysctl.conf; then
+ /sbin/sysctl -q -p
+ else
+ /bin/echo "" >> /etc/sysctl.conf &&
+ /bin/echo "# Added by $(/bin/basename $0) on $(/bin/date -u)" >> /etc/sysctl.conf &&
+ /bin/echo "$PARAM = $DESIRED" >> /etc/sysctl.conf
+ fi
+
+ if ! /sbin/sysctl -q -w $PARAM=$DESIRED; then
+ /bin/echo "sysctl -w $PARAM=$DESIRED failed"
+ fi
+else
+ return 0
+fi
+
+SAFE_FIELD="($PARAM\s+=\s+).*"
+VAL=$DESIRED
+FILEDIR="/etc/sysctl.conf"
+
+F=` /bin/echo $FILEDIR|/bin/grep -Po "[^\/]*$" `
+FILEDIR=${FILEDIR%"/$F"}
+
+if /bin/grep -Pq "^(\s*)(\#*)(\s*)($SAFE_FIELD)" "$FILEDIR/$F"; then
+ /bin/sed -i -r -e "s!(\s*)(\#*)(\s*)$SAFE_FIELD!\3\4$VAL!g" "$FILEDIR/$F"
+else
+ OUT=` /bin/echo $SAFE_FIELD|/bin/grep -Po "\([^\(|^\)]*\)" `
+ OUT=` /bin/echo $OUT | /bin/grep -Po "[^\(|^\)]*"`$VAL
+ OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\+! !g" `
+ OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\*!!g" `
+ OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s! !g" `
+ OUT=` /bin/echo $OUT| /bin/grep -Po '[^\\\\]*'`
+ /bin/echo $OUT >> "$FILEDIR/$F"
+fi
+
+/sbin/sysctl -e -q -p
--
1.7.1
More information about the scap-security-guide
mailing list