[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation

Shawn Wells shawn at redhat.com
Mon Jun 3 02:54:55 UTC 2013


On 6/2/13 3:05 PM, Jeffrey Blank wrote:
> This is a step along the path toward support for remediation content
> development, but it is only one step.
>
> This patchset also cleans up some other code.  It has not been tested, but it
> appears to emit "<sub>" elements in the manner OpenSCAP can process, so that
> parameters can be provided to remediation scripts.
>
> Documentation/instructions are still needed.  It should be apparent from the
> example that scripts which use parameters will need to "source" a support file
> and also declare which environment variables they expect to have populated by
> XCCDF values (using the "populate" function).
>   
> This patch is only to enable example remediation content, which may be suitable
> for testing.  The SSG project/community will be ready for remediation content
> en masse when there is evidence of sufficient interest in the checking
> mechanisms, upon which any remediation effort would naturally depend.
>
> Jeffrey Blank (4):
>    example remediation script which takes a parameter
>    incomplete support file for bash remediations      * does at least
>      warn when undefined variable exists
>    rewrite of combinefixes.py to handle parameters for OpenSCAP
>      remedation generation
>    made xccdf-addfixes insert all text and child nodes of a fix
>
>   RHEL6/input/fixes/bash/set_system_login_banner.sh |    6 ++
>   RHEL6/input/fixes/bash/templates/support.sh       |    9 ++
>   RHEL6/transforms/combinefixes.py                  |   97 +++++++++-----------
>   RHEL6/transforms/xccdf-addfixes.xslt              |    2 +-
>   4 files changed, 60 insertions(+), 54 deletions(-)
>   create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh
>   create mode 100644 RHEL6/input/fixes/bash/templates/support.sh

This is very clever. In the XCCDF it renders as:
> <fix system="urn:xccdf:fix:script:sh">login_banner_text="<sub 
> idref="login_banner_text"/>"
> cat &lt;&lt;EOF &gt;/etc/issue
> $login_banner_text
> EOF
> </fix>

Then in the bash remediation scripts:
> # XCCDF rule: set_system_login_banner
> # CCE-26974-6
> login_banner_text="You are accessing a U.S. Government \(USG\) 
> Information System \(IS\) that is provided for USG-authorized use 
> only.[\s\n]*By using this IS \(which includes any device attached to 
> this IS\), you consent to the following conditions\:[\s\n]*-[\s\n]*The 
> USG routinely intercepts and monitors communications on this IS for 
> purposes including, but not limited to, penetration testing, COMSEC 
> monitoring, network operations and defense, personnel misconduct 
> \(PM\), law enforcement \(LE\), and counterintelligence \(CI\) 
> investigations.[\s\n]*-[\s\n]*At any time, the USG may inspect and 
> seize data stored on this IS.[\s\n]*-[\s\n]*Communications using, or 
> data stored on, this IS are not private, are subject to routine 
> monitoring, interception, and search, and may be disclosed or used for 
> any USG-authorized purpose.[\s\n]*-[\s\n]*This IS includes security 
> measures \(e.g., authentication and access controls\) to protect USG 
> interests -- not for your personal benefit or 
> privacy.[\s\n]*-[\s\n]*Notwithstanding the above, using this IS does 
> not constitute consent to PM, LE or CI investigative searching or 
> monitoring of the content of privileged communications, or work 
> product, related to personal representation or services by attorneys, 
> psychotherapists, or clergy, and their assistants. Such communications 
> and work product are private and confidential. See User Agreement for 
> details."
> cat <<EOF >/etc/issue
> $login_banner_text
> EOF

This is a *fantastic* approach. I'll see what I can do around generating 
a doc that transforms refine values that people can source as variable 
names, likely won't have anything until Thurs.

Ack!


More information about the scap-security-guide mailing list