[PATCH 1/4] Added bash templates directory, added sample sysctl script

Shawn Wells shawn.d.wells at gmail.com
Sat Jun 1 21:20:17 UTC 2013


-------------- next part --------------
>From 666130e8983addd878efe0eec3a50e3ffada2e7a Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 1 Jun 2013 15:43:44 -0400
Subject: [PATCH 1/4] Added bash templates directory, added sample sysctl script
 - Makefile based off OVAL, same usage
 - CVS files point to OVAL dir, no need to duplicate (at some point, we should combine oval/bash template dirs)
 - Added sample sysctl script

---
 RHEL6/input/fixes/bash/templates/Makefile          |   13 +++++++
 .../fixes/bash/templates/create_sysctl_bash.py     |   35 ++++++++++++++++++++
 RHEL6/input/fixes/bash/templates/output/.gitignore |    2 +
 RHEL6/input/fixes/bash/templates/template_sysctl   |   16 +++++++++
 4 files changed, 66 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/templates/Makefile
 create mode 100755 RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
 create mode 100644 RHEL6/input/fixes/bash/templates/output/.gitignore
 create mode 100644 RHEL6/input/fixes/bash/templates/template_sysctl

diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile
new file mode 100644
index 0000000..a4643d2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/Makefile
@@ -0,0 +1,13 @@
+templates: sysctls
+
+sysctls:
+	./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv
+	
+compare:
+	diff output/ ../ | grep -v "Only in ../"
+
+copy:
+	cp output/*.sh ../
+
+clean:
+	rm -f output/*.sh
diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
new file mode 100755
index 0000000..4d42ed3
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
@@ -0,0 +1,35 @@
+#!/usr/bin/python
+
+import sys, csv, re
+
+def output_checkfile(serviceinfo):
+    # get the items out of the list
+    sysctl_var, sysctl_val = serviceinfo
+    # convert variable name to a format suitable for 'id' tags
+    sysctl_var_id = re.sub('[-\.]', '_', sysctl_var)
+    # open the template and perform the conversions
+    with open("template_sysctl", 'r') as templatefile:
+        filestring = templatefile.read()
+        filestring = filestring.replace("SYSCTLID", sysctl_var_id)
+        filestring = filestring.replace("SYSCTLVAR", sysctl_var)
+        filestring = filestring.replace("SYSCTLVAL", sysctl_val)
+        # write the check
+        with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile:
+            outputfile.write(filestring)
+            outputfile.close()
+
+def main():
+    if len(sys.argv) < 2:
+        print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
+        sys.exit(1)
+    with open(sys.argv[1], 'r') as f:
+        # put the CSV line's items into a list
+        sysctl_lines = csv.reader(f)
+        for line in sysctl_lines:
+            output_checkfile(line)
+
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
+
diff --git a/RHEL6/input/fixes/bash/templates/output/.gitignore b/RHEL6/input/fixes/bash/templates/output/.gitignore
new file mode 100644
index 0000000..041cc36
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/output/.gitignore
@@ -0,0 +1,2 @@
+# files to ignore
+*.sh
diff --git a/RHEL6/input/fixes/bash/templates/template_sysctl b/RHEL6/input/fixes/bash/templates/template_sysctl
new file mode 100644
index 0000000..e654ee3
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/template_sysctl
@@ -0,0 +1,16 @@
+#
+# Set runtime for SYSCTLVAR
+#
+sysctl -q -n -w SYSCTLVAR=SYSCTLVAL
+
+#
+# If SYSCTLVAR present in /etc/sysctl.conf, change value to "SYSCTLVAL"
+#	else, add "SYSCTLVAR = SYSCTLVAL" to /etc/sysctl.conf
+#
+if grep --silent ^SYSCTLVAR /etc/sysctl.conf ; then
+	sed -i 's/^SYSCTLVAR.*/SYSCTLVAR = SYSCTLVAL/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set SYSCTLVAR to SYSCTLVAL per security requirements" >> /etc/sysctl.conf
+	echo "SYSCTLVAR = SYSCTLVAL" >> /etc/sysctl.conf
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list