[PATCH] [RFC] Modularized the fix scripts

Brian Millett bmillett at gmail.com
Mon Feb 18 01:08:31 UTC 2013


On Sun, 17 Feb 2013 01:41:06 -0500
Shawn Wells <shawn at redhat.com> wrote:

> On 2/16/13 1:35 PM, Shawn Wells wrote:
> > EXAMPLE USAGE:
> >
> > (since generate fix only produces scripts for failed rules, change all
> > results to fail)
> >
> > if ! rpm -qa | grep -q aide; then
> > yum -y install aide
> > fi
> >
> > if rpm -qa | grep -q xinetd; then
> > yum -y remove xinetd
> > fi
> >
> > if rpm -qa | grep -q telnet-server; then
> > yum -y remove telnet-server
> > fi
> >
> > if rpm -qa | grep -q ypserv; then
> > yum -y remove ypserv
> > fi
> 
> My patch-push script keeps dropping things it thinks are comments. 
> Here's the full example workflow:
> 
> # oscap xccdf eval --profile stig-rhel6-server --results 
> /tmp/results.xml --oval-results --cpe-dict 
> output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
> 
> since `generate fix` only does so for failed rules, change everything to 
> failed to get sample output:
> # sed -i 's/<result>pass<\/result>/<result>fail<\/result>/g' 
> /tmp/results.xml
> 
> # oscap xccdf generate fix --result-id 
> xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
> #!/bin/bash
> # OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure 
> Configuration of Red Hat Enterprise Linux 6
> 
> # XCCDF rule: install_aide
> # CCE-27024-9
> 
> if ! rpm -qa | grep -q aide; then
> yum -y install aide
> fi
> 
> 
> # XCCDF rule: uninstall_xinetd
> # CCE-27005-8
> 
> if rpm -qa | grep -q xinetd; then
> yum -y remove xinetd
> fi
> 
> 
> # XCCDF rule: uninstall_telnet_server
> # CCE-27073-6
> 
> if rpm -qa | grep -q telnet-server; then
> yum -y remove telnet-server
> fi
> 
> 
> # XCCDF rule: uninstall_ypserv
> # CCE-27079-3
> 
> if rpm -qa | grep -q ypserv; then
> yum -y remove ypserv
> fi
> 
> 
> # generated: 2013-02-16T13:40:22-05:00
> # END OF SCRIPT


This looks really good.  I'm ready to implement this tomorrow.  I've got +-
400 "fix"es that need to be broke out so they can be maintained a bit more
easily.  This is awesome.

I've been looking at the XCCDF spec, and I wish that there was a means of
having a "value-id" (as in the check-export) for a "fix". That would allow a
remediation truly be based on a profile.  The checks allow refine-values to be
adapted for each profile, but I see no way to do the same for the fixes.  So I
guess a limitation to the fix is that it is a one size fits all.  Unless you
all (who really know this stuff) knows of a way to add a value to a fix??

Thanks Shawn.


-- 
Brian Millett
"And if someone is living there?"
'Then all our races stand on the end of extinction.'
           -- [ Sheridan and G'Kar (re: Z'ha'dum), "Revelations"]


More information about the scap-security-guide mailing list