[PATCH 1/2] Added bash remediation check to verify-input-sanity.py

Shawn Wells shawn at redhat.com
Tue Aug 6 17:09:31 UTC 2013


On 7/31/13 2:45 AM, Shawn Wells wrote:
>
> 0001-Added-bash-remediation-check-to-verify-input-sanity..patch
>
>
>  From 39f450cba9b2c9e0db994cb1703b9e13770cbfa3 Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Mon, 15 Jul 2013 21:27:04 -0400
> Subject: [PATCH 1/2] Added bash remediation check to verify-input-sanity.py
>   BEFORE PATCH:
>
> $ ./verify-input-sanity.py
>
>    WARNING: XCCDF Rule "disable_logwatch_for_logserver" references OVAL check "logwatch_disabled_for_logserver" which does not exist
>             problem occurs in file: src/input/system/logging.xml
>
>    WARNING: XCCDF Rule "deny_password_attempts_unlock_time" references OVAL check "accounts_passwords_pam_faillock_unlock_time" which does not exist
>             problem occurs in file: src/input/system/accounts/pam.xml
>
>    WARNING: XCCDF Rule "deny_password_attempts_fail_interval" references OVAL check "accounts_passwords_pam_fail_interval" which does not exist
>             problem occurs in file: src/input/system/accounts/pam.xml
>
>    WARNING: XCCDF Rule "set_gdm_login_banner_text" references OVAL check "banner_gui_text_set" which does not exist
>             problem occurs in file: src/input/system/accounts/banners.xml
>
>    WARNING: XCCDF Rule "no_shelllogin_for_systemaccounts" references OVAL check "no_shelllogin_for_systemaccounts" which does not exist
>             problem occurs in file: src/input/system/accounts/restrictions/root_logins.xml
>
> Traceback (most recent call last):
>    File "./verify-input-sanity.py", line 130, in <module>
>      tree = ET.fromstring(xccdf_xml_contents)
>    File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48270)
>    File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:71812)
>    File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:70673)
>    File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67442)
>    File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:63824)
>    File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:64745)
>    File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64088)
> lxml.etree.XMLSyntaxError: Comment not terminated
> <!-- , line 8, column 6
>
> AFTER PATCH:
> $ ./verify-input-sanity.py
>
>    WARNING: XCCDF Rule "uninstall_vsftpd" has no bash remediation file
>
>    WARNING: XCCDF Rule "install_vsftpd" has no bash remediation file
>
> ..........
>    WARNING: XCCDF Rule "disable_logwatch_for_logserver" has no bash remediation file
>
>    WARNING: XCCDF Rule "disable_logwatch_for_logserver" references OVAL check "logwatch_disabled_for_logserver" which does not exist
>             problem occurs in file: src/input/system/logging.xml
>
>    WARNING: XCCDF Rule "enable_auditd_bootloader" has no bash remediation file
>
>    WARNING: XCCDF Rule "configure_auditd_num_logs" has no bash remediation file
> ---
>   RHEL6/utils/verify-input-sanity.py |    9 +++++++++
>   1 files changed, 9 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/utils/verify-input-sanity.py b/RHEL6/utils/verify-input-sanity.py
> index 13046b6..f16ee84 100755
> --- a/RHEL6/utils/verify-input-sanity.py
> +++ b/RHEL6/utils/verify-input-sanity.py
> @@ -99,6 +99,9 @@ for oval_check in oval_file_list:
>   # want to make sure that a corresponding OVAL check exists in the src/input/checks directory. We print a relatively polite
>   # warning if a XCCDF Rule references an OVAL check that does not exist.
>   #
> +# Additionally, this section will compare the XCCDF ID name to scan for a corresponding bash remediation script. If
> +# a bash remediation script is not found, a notification will be printed to the screen.
> +#
>   # Again, lots of regex-fu here. In their raw state the XCCDF files are not valid XML. The next iteration of this file may
>   # add all of the XML complexity so that we can perform these validations by parsing XML.  That would form a more complete
>   # solution.
> @@ -130,6 +133,12 @@ for xccdf_file in xccdf_xml_files:
>           tree = ET.fromstring(xccdf_xml_contents)
>           # extract all of the rules that are defined within the XCCDF
>           xccdf_rules = tree.findall(".//Rule")
> +	# check that every XCCDF has matching bash remediation
> +	for xccdf_rule in xccdf_rules:
> +	    file_name = "./fixes/bash/" + xccdf_rule.get("id") + ".sh"
> +	    if (not os.access(file_name, os.F_OK)):
> +		print "  WARNING: XCCDF Rule \"" + xccdf_rule.get("id") + "\" has no bash remediation file\n"
> +	# check that every XCCDF has matching OVAL
>           for xccdf_rule in xccdf_rules:
>               # extract any reference to an OVAL check
>               oval_check_refs = xccdf_rule.findall(".//oval")
> -- 1.7.1
bump
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130806/a9fb7b81/attachment.html>


More information about the scap-security-guide mailing list