[PATCH 03/15] Updated RHEL6 OVAL template create_kernel_modules_disabled.py to include bash remediation scripts

Shawn Wells shawn at redhat.com
Fri Apr 18 03:27:22 UTC 2014


-------------- next part --------------
>From a688ed82a73e82f03d14b6cd2dc1dac8f102863c Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 19:46:29 -0400
Subject: [PATCH 03/15] Updated RHEL6 OVAL template create_kernel_modules_disabled.py to include bash remediation scripts

Consolidating the bash + oval. Legacy setup was two different processes (bash/templates/ and checks/templates/)

TESTING:
$ make clean ; ./create_kernel_modules_disabled.py kernel_modules_disabled.csv ; ls output/
rm -f output/*.xml
rm -f output/*.sh
kernel_module_cramfs_disabled.sh     kernel_module_hfs_disabled.sh       kernel_module_rds_disabled.sh        kernel_module_tipc_disabled.sh
kernel_module_cramfs_disabled.xml    kernel_module_hfs_disabled.xml      kernel_module_rds_disabled.xml       kernel_module_tipc_disabled.xml
kernel_module_dccp_disabled.sh       kernel_module_hfsplus_disabled.sh   kernel_module_sctp_disabled.sh       kernel_module_udf_disabled.sh
kernel_module_dccp_disabled.xml      kernel_module_hfsplus_disabled.xml  kernel_module_sctp_disabled.xml      kernel_module_udf_disabled.xml
kernel_module_freevxfs_disabled.sh   kernel_module_jffs2_disabled.sh     kernel_module_squashfs_disabled.sh   kernel_module_usb-storage_disabled.sh
kernel_module_freevxfs_disabled.xml  kernel_module_jffs2_disabled.xml    kernel_module_squashfs_disabled.xml  kernel_module_usb-storage_disabled.xml
[shawn at SSG-RHEL6 templates]$ cat output/kernel_module_cramfs_disabled.sh
echo "install cramfs /bin/false" > /etc/modprobe.d/cramfs.conf
---
 .../checks/templates/bash/kernel_module_disabled   |    1 +
 .../templates/create_kernel_modules_disabled.py    |   13 ++++--
 .../checks/templates/oval/kernel_module_disabled   |   44 ++++++++++++++++++++
 .../templates/template_kernel_module_disabled      |   44 --------------------
 .../bash/templates/template_kernel_module_disabled |    1 -
 5 files changed, 53 insertions(+), 50 deletions(-)
 create mode 100644 RHEL/6/input/checks/templates/bash/kernel_module_disabled
 create mode 100644 RHEL/6/input/checks/templates/oval/kernel_module_disabled
 delete mode 100644 RHEL/6/input/checks/templates/template_kernel_module_disabled
 delete mode 100644 RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled

diff --git a/RHEL/6/input/checks/templates/bash/kernel_module_disabled b/RHEL/6/input/checks/templates/bash/kernel_module_disabled
new file mode 100644
index 0000000..9fbfcc1
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/kernel_module_disabled
@@ -0,0 +1 @@
+echo "install KERNMODULE /bin/false" > /etc/modprobe.d/KERNMODULE.conf
diff --git a/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py b/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
index 51dc812..b94cf8f 100755
--- a/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
+++ b/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
@@ -4,10 +4,6 @@
 # create_kernel_modules_disabled.py
 #   automatically generate checks for disabled kernel modules
 #
-# NOTE: The file 'template_kernel_module_disabled' should be located in the
-# same working directory as this script. The template contains the following
-# tags that *must* be replaced successfully in order for the checks to work.
-#
 # KERNMODULE - the name of the kernel module that should be disabled
 #
 
@@ -16,13 +12,20 @@ import sys, csv, re
 def output_checkfile(kerninfo):
     # get the items out of the list
     kernmod = kerninfo[0]
-    with open("./template_kernel_module_disabled", 'r') as templatefile:
+    with open("./oval/kernel_module_disabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("KERNMODULE", kernmod)
         with open("./output/kernel_module_" + kernmod + "_disabled.xml", 'wb+') as outputfile:
             outputfile.write(filestring)
             outputfile.close()
 
+    with open("./bash/kernel_module_disabled", 'r') as templatefile:
+	filestring = templatefile.read()
+	filestring = filestring.replace("KERNMODULE", kernmod)
+	with open("./output/kernel_module_" + kernmod + "_disabled.sh", 'wb+') as outputfile:
+		outputfile.write(filestring)
+		outputfile.close()
+
 def main():
     if len(sys.argv) < 2:
         print "Provide a CSV file containing lines of the format: kernmod"
diff --git a/RHEL/6/input/checks/templates/oval/kernel_module_disabled b/RHEL/6/input/checks/templates/oval/kernel_module_disabled
new file mode 100644
index 0000000..316965f
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/kernel_module_disabled
@@ -0,0 +1,44 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_kernel_modules_disabled.py.  DO NOT EDIT.  -->
+  <definition class="compliance"
+  id="kernel_module_KERNMODULE_disabled" version="1">
+    <metadata>
+      <title>Disable KERNMODULE Kernel Module</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The kernel module KERNMODULE should be disabled.</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
+    </metadata>
+    <criteria operator="OR">
+      <criterion test_ref="test_kernmod_KERNMODULE_disabled" comment="kernel module KERNMODULE disabled in /etc/modprobe.d" />
+      <criterion test_ref="test_kernmod_KERNMODULE_modprobeconf" comment="kernel module KERNMODULE disabled in /etc/modprobe.conf" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_disabled" version="1" check="all"
+  comment="kernel module KERNMODULE disabled">
+    <ind:object object_ref="obj_kernmod_KERNMODULE_disabled" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_modprobeconf" version="1" check="all"
+  comment="kernel module KERNMODULE disabled in /etc/modprobe.conf">
+    <ind:object object_ref="obj_kernmod_KERNMODULE_modprobeconf" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_disabled"
+  version="1" comment="kernel module KERNMODULE disabled">
+    <ind:path>/etc/modprobe.d</ind:path>
+    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
+    <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_modprobeconf"
+  version="1" comment="Check depricated /etc/modprobe.conf for disablement of KERNMODULE">
+    <ind:filepath>/etc/modprobe.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_kernel_module_disabled b/RHEL/6/input/checks/templates/template_kernel_module_disabled
deleted file mode 100644
index 316965f..0000000
--- a/RHEL/6/input/checks/templates/template_kernel_module_disabled
+++ /dev/null
@@ -1,44 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_kernel_modules_disabled.py.  DO NOT EDIT.  -->
-  <definition class="compliance"
-  id="kernel_module_KERNMODULE_disabled" version="1">
-    <metadata>
-      <title>Disable KERNMODULE Kernel Module</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel module KERNMODULE should be disabled.</description>
-      <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
-    </metadata>
-    <criteria operator="OR">
-      <criterion test_ref="test_kernmod_KERNMODULE_disabled" comment="kernel module KERNMODULE disabled in /etc/modprobe.d" />
-      <criterion test_ref="test_kernmod_KERNMODULE_modprobeconf" comment="kernel module KERNMODULE disabled in /etc/modprobe.conf" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_disabled" version="1" check="all"
-  comment="kernel module KERNMODULE disabled">
-    <ind:object object_ref="obj_kernmod_KERNMODULE_disabled" />
-  </ind:textfilecontent54_test>
-
-  <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_modprobeconf" version="1" check="all"
-  comment="kernel module KERNMODULE disabled in /etc/modprobe.conf">
-    <ind:object object_ref="obj_kernmod_KERNMODULE_modprobeconf" />
-  </ind:textfilecontent54_test>
-
-  <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_disabled"
-  version="1" comment="kernel module KERNMODULE disabled">
-    <ind:path>/etc/modprobe.d</ind:path>
-    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
-    <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_modprobeconf"
-  version="1" comment="Check depricated /etc/modprobe.conf for disablement of KERNMODULE">
-    <ind:filepath>/etc/modprobe.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled b/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled
deleted file mode 100644
index 9fbfcc1..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled
+++ /dev/null
@@ -1 +0,0 @@
-echo "install KERNMODULE /bin/false" > /etc/modprobe.d/KERNMODULE.conf
-- 
1.7.1



More information about the scap-security-guide mailing list