[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation
Shawn Wells
shawn at redhat.com
Mon Jun 3 02:54:55 UTC 2013
On 6/2/13 3:05 PM, Jeffrey Blank wrote:
> This is a step along the path toward support for remediation content
> development, but it is only one step.
>
> This patchset also cleans up some other code. It has not been tested, but it
> appears to emit "<sub>" elements in the manner OpenSCAP can process, so that
> parameters can be provided to remediation scripts.
>
> Documentation/instructions are still needed. It should be apparent from the
> example that scripts which use parameters will need to "source" a support file
> and also declare which environment variables they expect to have populated by
> XCCDF values (using the "populate" function).
>
> This patch is only to enable example remediation content, which may be suitable
> for testing. The SSG project/community will be ready for remediation content
> en masse when there is evidence of sufficient interest in the checking
> mechanisms, upon which any remediation effort would naturally depend.
>
> Jeffrey Blank (4):
> example remediation script which takes a parameter
> incomplete support file for bash remediations * does at least
> warn when undefined variable exists
> rewrite of combinefixes.py to handle parameters for OpenSCAP
> remedation generation
> made xccdf-addfixes insert all text and child nodes of a fix
>
> RHEL6/input/fixes/bash/set_system_login_banner.sh | 6 ++
> RHEL6/input/fixes/bash/templates/support.sh | 9 ++
> RHEL6/transforms/combinefixes.py | 97 +++++++++-----------
> RHEL6/transforms/xccdf-addfixes.xslt | 2 +-
> 4 files changed, 60 insertions(+), 54 deletions(-)
> create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh
> create mode 100644 RHEL6/input/fixes/bash/templates/support.sh
This is very clever. In the XCCDF it renders as:
> <fix system="urn:xccdf:fix:script:sh">login_banner_text="<sub
> idref="login_banner_text"/>"
> cat <<EOF >/etc/issue
> $login_banner_text
> EOF
> </fix>
Then in the bash remediation scripts:
> # XCCDF rule: set_system_login_banner
> # CCE-26974-6
> login_banner_text="You are accessing a U.S. Government \(USG\)
> Information System \(IS\) that is provided for USG-authorized use
> only.[\s\n]*By using this IS \(which includes any device attached to
> this IS\), you consent to the following conditions\:[\s\n]*-[\s\n]*The
> USG routinely intercepts and monitors communications on this IS for
> purposes including, but not limited to, penetration testing, COMSEC
> monitoring, network operations and defense, personnel misconduct
> \(PM\), law enforcement \(LE\), and counterintelligence \(CI\)
> investigations.[\s\n]*-[\s\n]*At any time, the USG may inspect and
> seize data stored on this IS.[\s\n]*-[\s\n]*Communications using, or
> data stored on, this IS are not private, are subject to routine
> monitoring, interception, and search, and may be disclosed or used for
> any USG-authorized purpose.[\s\n]*-[\s\n]*This IS includes security
> measures \(e.g., authentication and access controls\) to protect USG
> interests -- not for your personal benefit or
> privacy.[\s\n]*-[\s\n]*Notwithstanding the above, using this IS does
> not constitute consent to PM, LE or CI investigative searching or
> monitoring of the content of privileged communications, or work
> product, related to personal representation or services by attorneys,
> psychotherapists, or clergy, and their assistants. Such communications
> and work product are private and confidential. See User Agreement for
> details."
> cat <<EOF >/etc/issue
> $login_banner_text
> EOF
This is a *fantastic* approach. I'll see what I can do around generating
a doc that transforms refine values that people can source as variable
names, likely won't have anything until Thurs.
Ack!
More information about the scap-security-guide
mailing list