[PATCH] [RFC] Creating shared bash script directory

Shawn Wells shawn at redhat.com
Sun Dec 1 06:07:34 UTC 2013


-------------- next part --------------
>From 3ad8ce28808123fb2d66db09afb98a3b7fd105b4 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 29 Nov 2013 23:48:16 -0500
Subject: [PATCH] [RFC] Creating shared bash script directory

As remediation content expands, many scripts will be repurposed across operating system releases. To reduce
the maintanence burden of having the same script in multiple places, I propose to create a shared fix directory. A patch to demonstrate this concept is attached.

combinefixes was modified to first look at input/fixes/bash, then ../shared/fixes/, else echo a "no fix exists" message.

The downside to this approach is "exclusion" -- just because a script does not exist within RHEL6/fixes/bash does not
automatically mean we want the ../shared/fixes/ version. Unsure how to handle this. One idea was to 'touch RHEL6/fixes/bash',
and then delete that file if the shared version was to be inherited.
---
 .../input/fixes/bash/sysctl_net_ipv4_ip_forward.sh |   16 ------------
 RHEL6/transforms/combinefixes.py                   |   25 ++++++++++++-------
 shared/bash/sysctl_net_ipv4_ip_forward.sh          |   16 ++++++++++++
 3 files changed, 32 insertions(+), 25 deletions(-)
 delete mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh
 create mode 100644 shared/bash/sysctl_net_ipv4_ip_forward.sh

diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh
deleted file mode 100644
index 3292a63..0000000
--- a/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#
-# Set runtime for net.ipv4.ip_forward
-#
-sysctl -q -n -w net.ipv4.ip_forward=0
-
-#
-# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
-#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
-#
-if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then
-	sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf
-else
-	echo "" >> /etc/sysctl.conf
-	echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf
-	echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf
-fi
diff --git a/RHEL6/transforms/combinefixes.py b/RHEL6/transforms/combinefixes.py
index 71fbe6f..4f3ac9f 100755
--- a/RHEL6/transforms/combinefixes.py
+++ b/RHEL6/transforms/combinefixes.py
@@ -1,6 +1,7 @@
 #!/usr/bin/python
 
 import sys, os, re, lxml.etree as etree
+from os import path, access
 
 def substitute_vars(fix):
 	# brittle and troubling code to assign environment vars to XCCDF values
@@ -29,16 +30,22 @@ def main():
 	fixcontent = etree.Element("fix-content", system="urn:xccdf:fix:script:sh", xmlns="http://checklists.nist.gov/xccdf/1.1")
 	fixgroup = etree.SubElement(fixcontent, "fix-group", id="bash", system="urn:xccdf:fix:script:sh", xmlns="http://checklists.nist.gov/xccdf/1.1")
 	
-	for filename in os.listdir(fixdir):
-		if filename.endswith(".sh"):
-			# create and populate new fix element based on shell file
-			fixname = os.path.splitext(filename)[0]
+	for filename in os.listdir('input/checks/'):
+		if filename.endswith(".xml"):
+			fixname =  os.path.splitext(filename)[0]
 			fix = etree.SubElement(fixgroup, "fix", rule=fixname)
-			with open( fixdir + "/" + filename, 'r') as f:
-				# assignment automatically escapes shell characters for XML
-				fix.text = f.read()
-				# replace instance of bash function "populate" with XCCDF variable substitution
-				substitute_vars(fix)
+				
+			if path.isfile('input/fixes/bash/' + fixname + '.sh'):
+				with open( 'input/fixes/bash/' + fixname + '.sh', 'r') as f:
+					fix.text = f.read()
+					substitute_vars(fix)
+			elif path.isfile('../shared/bash/' + fixname + '.sh'):
+				with open( '../shared/bash/' + fixname + '.sh', 'r') as f:
+					fix.text = f.read()
+					substitute_vars(fix)
+			else:
+				fix.text = "# No bash script available for " + fixname + " yet.\n\
+# Interested in helping? https://fedorahosted.org/scap-security-guide/"
 
 	tree = etree.ElementTree(fixcontent)
 	tree.write(output, pretty_print=True)
diff --git a/shared/bash/sysctl_net_ipv4_ip_forward.sh b/shared/bash/sysctl_net_ipv4_ip_forward.sh
new file mode 100644
index 0000000..3292a63
--- /dev/null
+++ b/shared/bash/sysctl_net_ipv4_ip_forward.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.ip_forward
+#
+sysctl -q -n -w net.ipv4.ip_forward=0
+
+#
+# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list