[PATCH 3/4] Created remediation template

Shawn Wells shawn.d.wells at gmail.com
Sat Jun 1 21:20:27 UTC 2013


-------------- next part --------------
>From d11a0c296055bfdeefaffd41b6671bb9d23933fd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 1 Jun 2013 17:10:12 -0400
Subject: [PATCH 3/4] Created remediation template: create_services_disabled.py
 - Based off OVAL services file

---
 RHEL6/input/fixes/bash/templates/Makefile          |    5 ++-
 .../bash/templates/create_services_disabled.py     |   45 ++++++++++++++++++++
 .../fixes/bash/templates/template_service_disabled |    9 ++++
 3 files changed, 58 insertions(+), 1 deletions(-)
 create mode 100755 RHEL6/input/fixes/bash/templates/create_services_disabled.py
 create mode 100644 RHEL6/input/fixes/bash/templates/template_service_disabled

diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile
index a4643d2..fe3f855 100644
--- a/RHEL6/input/fixes/bash/templates/Makefile
+++ b/RHEL6/input/fixes/bash/templates/Makefile
@@ -1,7 +1,10 @@
-templates: sysctls
+templates: sysctls services
 
 sysctls:
 	./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv
+
+services:
+	./create_services_disabled.py ../../../checks/templates/services_disabled.csv
 	
 compare:
 	diff output/ ../ | grep -v "Only in ../"
diff --git a/RHEL6/input/fixes/bash/templates/create_services_disabled.py b/RHEL6/input/fixes/bash/templates/create_services_disabled.py
new file mode 100755
index 0000000..25af608
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/create_services_disabled.py
@@ -0,0 +1,45 @@
+#!/usr/bin/python
+
+#
+# create_services_disabled.py
+#   automatically generate fixes for disabled services
+#
+# NOTE: The file 'template_service_disabled' should be located in the same working directory as this script. The
+# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
+#
+# SERVICENAME - the name of the service that should be disabled
+# PACKAGENAME - the name of the package that installs the service
+#
+
+import sys, csv, re
+
+def output_checkfile(serviceinfo):
+    # get the items out of the list
+    servicename, packagename = serviceinfo
+    with open("./template_service_disabled", 'r') as templatefile:
+        filestring = templatefile.read()
+        filestring = filestring.replace("SERVICENAME", servicename)
+        if packagename:
+            filestring = filestring.replace("PACKAGENAME", packagename)
+        else:
+            filestring = re.sub("\n\s*<criteria.*>\n\s*<extend_definition.*/>", "", filestring)
+            filestring = re.sub("\s*</criteria>\n\s*</criteria>", "\n    </criteria>", filestring)
+        with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
+            outputfile.write(filestring)
+            outputfile.close()
+
+def main():
+    if len(sys.argv) < 2:
+        print "Provide a CSV file containing lines of the format: servicename,packagename"
+        sys.exit(1)
+    with open(sys.argv[1], 'r') as f:
+        # put the CSV line's items into a list
+        servicelines = csv.reader(f)
+        for line in servicelines:
+            output_checkfile(line)
+
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
+
diff --git a/RHEL6/input/fixes/bash/templates/template_service_disabled b/RHEL6/input/fixes/bash/templates/template_service_disabled
new file mode 100644
index 0000000..d38a703
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/template_service_disabled
@@ -0,0 +1,9 @@
+#
+# Disable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME off
+
+#
+# Stop SERVICENAME if currently running
+#
+service SERVICENAME stop
-- 
1.7.1



More information about the scap-security-guide mailing list