[PATCH] [RFC] Modularized the fix scripts
Brian Millett
bmillett at gmail.com
Mon Feb 18 01:08:31 UTC 2013
On Sun, 17 Feb 2013 01:41:06 -0500
Shawn Wells <shawn at redhat.com> wrote:
> On 2/16/13 1:35 PM, Shawn Wells wrote:
> > EXAMPLE USAGE:
> >
> > (since generate fix only produces scripts for failed rules, change all
> > results to fail)
> >
> > if ! rpm -qa | grep -q aide; then
> > yum -y install aide
> > fi
> >
> > if rpm -qa | grep -q xinetd; then
> > yum -y remove xinetd
> > fi
> >
> > if rpm -qa | grep -q telnet-server; then
> > yum -y remove telnet-server
> > fi
> >
> > if rpm -qa | grep -q ypserv; then
> > yum -y remove ypserv
> > fi
>
> My patch-push script keeps dropping things it thinks are comments.
> Here's the full example workflow:
>
> # oscap xccdf eval --profile stig-rhel6-server --results
> /tmp/results.xml --oval-results --cpe-dict
> output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
>
> since `generate fix` only does so for failed rules, change everything to
> failed to get sample output:
> # sed -i 's/<result>pass<\/result>/<result>fail<\/result>/g'
> /tmp/results.xml
>
> # oscap xccdf generate fix --result-id
> xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
> #!/bin/bash
> # OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure
> Configuration of Red Hat Enterprise Linux 6
>
> # XCCDF rule: install_aide
> # CCE-27024-9
>
> if ! rpm -qa | grep -q aide; then
> yum -y install aide
> fi
>
>
> # XCCDF rule: uninstall_xinetd
> # CCE-27005-8
>
> if rpm -qa | grep -q xinetd; then
> yum -y remove xinetd
> fi
>
>
> # XCCDF rule: uninstall_telnet_server
> # CCE-27073-6
>
> if rpm -qa | grep -q telnet-server; then
> yum -y remove telnet-server
> fi
>
>
> # XCCDF rule: uninstall_ypserv
> # CCE-27079-3
>
> if rpm -qa | grep -q ypserv; then
> yum -y remove ypserv
> fi
>
>
> # generated: 2013-02-16T13:40:22-05:00
> # END OF SCRIPT
This looks really good. I'm ready to implement this tomorrow. I've got +-
400 "fix"es that need to be broke out so they can be maintained a bit more
easily. This is awesome.
I've been looking at the XCCDF spec, and I wish that there was a means of
having a "value-id" (as in the check-export) for a "fix". That would allow a
remediation truly be based on a profile. The checks allow refine-values to be
adapted for each profile, but I see no way to do the same for the fixes. So I
guess a limitation to the fix is that it is a one size fits all. Unless you
all (who really know this stuff) knows of a way to add a value to a fix??
Thanks Shawn.
--
Brian Millett
"And if someone is living there?"
'Then all our races stand on the end of extinction.'
-- [ Sheridan and G'Kar (re: Z'ha'dum), "Revelations"]
More information about the scap-security-guide
mailing list