[PATCH 3/4] Created remediation template
Shawn Wells
shawn.d.wells at gmail.com
Sat Jun 1 21:20:27 UTC 2013
-------------- next part --------------
>From d11a0c296055bfdeefaffd41b6671bb9d23933fd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 1 Jun 2013 17:10:12 -0400
Subject: [PATCH 3/4] Created remediation template: create_services_disabled.py
- Based off OVAL services file
---
RHEL6/input/fixes/bash/templates/Makefile | 5 ++-
.../bash/templates/create_services_disabled.py | 45 ++++++++++++++++++++
.../fixes/bash/templates/template_service_disabled | 9 ++++
3 files changed, 58 insertions(+), 1 deletions(-)
create mode 100755 RHEL6/input/fixes/bash/templates/create_services_disabled.py
create mode 100644 RHEL6/input/fixes/bash/templates/template_service_disabled
diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile
index a4643d2..fe3f855 100644
--- a/RHEL6/input/fixes/bash/templates/Makefile
+++ b/RHEL6/input/fixes/bash/templates/Makefile
@@ -1,7 +1,10 @@
-templates: sysctls
+templates: sysctls services
sysctls:
./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv
+
+services:
+ ./create_services_disabled.py ../../../checks/templates/services_disabled.csv
compare:
diff output/ ../ | grep -v "Only in ../"
diff --git a/RHEL6/input/fixes/bash/templates/create_services_disabled.py b/RHEL6/input/fixes/bash/templates/create_services_disabled.py
new file mode 100755
index 0000000..25af608
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/create_services_disabled.py
@@ -0,0 +1,45 @@
+#!/usr/bin/python
+
+#
+# create_services_disabled.py
+# automatically generate fixes for disabled services
+#
+# NOTE: The file 'template_service_disabled' should be located in the same working directory as this script. The
+# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
+#
+# SERVICENAME - the name of the service that should be disabled
+# PACKAGENAME - the name of the package that installs the service
+#
+
+import sys, csv, re
+
+def output_checkfile(serviceinfo):
+ # get the items out of the list
+ servicename, packagename = serviceinfo
+ with open("./template_service_disabled", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("SERVICENAME", servicename)
+ if packagename:
+ filestring = filestring.replace("PACKAGENAME", packagename)
+ else:
+ filestring = re.sub("\n\s*<criteria.*>\n\s*<extend_definition.*/>", "", filestring)
+ filestring = re.sub("\s*</criteria>\n\s*</criteria>", "\n </criteria>", filestring)
+ with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
+def main():
+ if len(sys.argv) < 2:
+ print "Provide a CSV file containing lines of the format: servicename,packagename"
+ sys.exit(1)
+ with open(sys.argv[1], 'r') as f:
+ # put the CSV line's items into a list
+ servicelines = csv.reader(f)
+ for line in servicelines:
+ output_checkfile(line)
+
+ sys.exit(0)
+
+if __name__ == "__main__":
+ main()
+
diff --git a/RHEL6/input/fixes/bash/templates/template_service_disabled b/RHEL6/input/fixes/bash/templates/template_service_disabled
new file mode 100644
index 0000000..d38a703
--- /dev/null
+++ b/RHEL6/input/fixes/bash/templates/template_service_disabled
@@ -0,0 +1,9 @@
+#
+# Disable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME off
+
+#
+# Stop SERVICENAME if currently running
+#
+service SERVICENAME stop
--
1.7.1
More information about the scap-security-guide
mailing list