[PATCH 03/15] Updated RHEL6 OVAL template create_kernel_modules_disabled.py to include bash remediation scripts
Shawn Wells
shawn at redhat.com
Fri Apr 18 03:27:22 UTC 2014
-------------- next part --------------
>From a688ed82a73e82f03d14b6cd2dc1dac8f102863c Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 19:46:29 -0400
Subject: [PATCH 03/15] Updated RHEL6 OVAL template create_kernel_modules_disabled.py to include bash remediation scripts
Consolidating the bash + oval. Legacy setup was two different processes (bash/templates/ and checks/templates/)
TESTING:
$ make clean ; ./create_kernel_modules_disabled.py kernel_modules_disabled.csv ; ls output/
rm -f output/*.xml
rm -f output/*.sh
kernel_module_cramfs_disabled.sh kernel_module_hfs_disabled.sh kernel_module_rds_disabled.sh kernel_module_tipc_disabled.sh
kernel_module_cramfs_disabled.xml kernel_module_hfs_disabled.xml kernel_module_rds_disabled.xml kernel_module_tipc_disabled.xml
kernel_module_dccp_disabled.sh kernel_module_hfsplus_disabled.sh kernel_module_sctp_disabled.sh kernel_module_udf_disabled.sh
kernel_module_dccp_disabled.xml kernel_module_hfsplus_disabled.xml kernel_module_sctp_disabled.xml kernel_module_udf_disabled.xml
kernel_module_freevxfs_disabled.sh kernel_module_jffs2_disabled.sh kernel_module_squashfs_disabled.sh kernel_module_usb-storage_disabled.sh
kernel_module_freevxfs_disabled.xml kernel_module_jffs2_disabled.xml kernel_module_squashfs_disabled.xml kernel_module_usb-storage_disabled.xml
[shawn at SSG-RHEL6 templates]$ cat output/kernel_module_cramfs_disabled.sh
echo "install cramfs /bin/false" > /etc/modprobe.d/cramfs.conf
---
.../checks/templates/bash/kernel_module_disabled | 1 +
.../templates/create_kernel_modules_disabled.py | 13 ++++--
.../checks/templates/oval/kernel_module_disabled | 44 ++++++++++++++++++++
.../templates/template_kernel_module_disabled | 44 --------------------
.../bash/templates/template_kernel_module_disabled | 1 -
5 files changed, 53 insertions(+), 50 deletions(-)
create mode 100644 RHEL/6/input/checks/templates/bash/kernel_module_disabled
create mode 100644 RHEL/6/input/checks/templates/oval/kernel_module_disabled
delete mode 100644 RHEL/6/input/checks/templates/template_kernel_module_disabled
delete mode 100644 RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled
diff --git a/RHEL/6/input/checks/templates/bash/kernel_module_disabled b/RHEL/6/input/checks/templates/bash/kernel_module_disabled
new file mode 100644
index 0000000..9fbfcc1
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/kernel_module_disabled
@@ -0,0 +1 @@
+echo "install KERNMODULE /bin/false" > /etc/modprobe.d/KERNMODULE.conf
diff --git a/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py b/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
index 51dc812..b94cf8f 100755
--- a/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
+++ b/RHEL/6/input/checks/templates/create_kernel_modules_disabled.py
@@ -4,10 +4,6 @@
# create_kernel_modules_disabled.py
# automatically generate checks for disabled kernel modules
#
-# NOTE: The file 'template_kernel_module_disabled' should be located in the
-# same working directory as this script. The template contains the following
-# tags that *must* be replaced successfully in order for the checks to work.
-#
# KERNMODULE - the name of the kernel module that should be disabled
#
@@ -16,13 +12,20 @@ import sys, csv, re
def output_checkfile(kerninfo):
# get the items out of the list
kernmod = kerninfo[0]
- with open("./template_kernel_module_disabled", 'r') as templatefile:
+ with open("./oval/kernel_module_disabled", 'r') as templatefile:
filestring = templatefile.read()
filestring = filestring.replace("KERNMODULE", kernmod)
with open("./output/kernel_module_" + kernmod + "_disabled.xml", 'wb+') as outputfile:
outputfile.write(filestring)
outputfile.close()
+ with open("./bash/kernel_module_disabled", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("KERNMODULE", kernmod)
+ with open("./output/kernel_module_" + kernmod + "_disabled.sh", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
def main():
if len(sys.argv) < 2:
print "Provide a CSV file containing lines of the format: kernmod"
diff --git a/RHEL/6/input/checks/templates/oval/kernel_module_disabled b/RHEL/6/input/checks/templates/oval/kernel_module_disabled
new file mode 100644
index 0000000..316965f
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/kernel_module_disabled
@@ -0,0 +1,44 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_kernel_modules_disabled.py. DO NOT EDIT. -->
+ <definition class="compliance"
+ id="kernel_module_KERNMODULE_disabled" version="1">
+ <metadata>
+ <title>Disable KERNMODULE Kernel Module</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The kernel module KERNMODULE should be disabled.</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
+ </metadata>
+ <criteria operator="OR">
+ <criterion test_ref="test_kernmod_KERNMODULE_disabled" comment="kernel module KERNMODULE disabled in /etc/modprobe.d" />
+ <criterion test_ref="test_kernmod_KERNMODULE_modprobeconf" comment="kernel module KERNMODULE disabled in /etc/modprobe.conf" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_disabled" version="1" check="all"
+ comment="kernel module KERNMODULE disabled">
+ <ind:object object_ref="obj_kernmod_KERNMODULE_disabled" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_modprobeconf" version="1" check="all"
+ comment="kernel module KERNMODULE disabled in /etc/modprobe.conf">
+ <ind:object object_ref="obj_kernmod_KERNMODULE_modprobeconf" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_disabled"
+ version="1" comment="kernel module KERNMODULE disabled">
+ <ind:path>/etc/modprobe.d</ind:path>
+ <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
+ <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_modprobeconf"
+ version="1" comment="Check depricated /etc/modprobe.conf for disablement of KERNMODULE">
+ <ind:filepath>/etc/modprobe.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_kernel_module_disabled b/RHEL/6/input/checks/templates/template_kernel_module_disabled
deleted file mode 100644
index 316965f..0000000
--- a/RHEL/6/input/checks/templates/template_kernel_module_disabled
+++ /dev/null
@@ -1,44 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_kernel_modules_disabled.py. DO NOT EDIT. -->
- <definition class="compliance"
- id="kernel_module_KERNMODULE_disabled" version="1">
- <metadata>
- <title>Disable KERNMODULE Kernel Module</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The kernel module KERNMODULE should be disabled.</description>
- <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
- </metadata>
- <criteria operator="OR">
- <criterion test_ref="test_kernmod_KERNMODULE_disabled" comment="kernel module KERNMODULE disabled in /etc/modprobe.d" />
- <criterion test_ref="test_kernmod_KERNMODULE_modprobeconf" comment="kernel module KERNMODULE disabled in /etc/modprobe.conf" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_disabled" version="1" check="all"
- comment="kernel module KERNMODULE disabled">
- <ind:object object_ref="obj_kernmod_KERNMODULE_disabled" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_test id="test_kernmod_KERNMODULE_modprobeconf" version="1" check="all"
- comment="kernel module KERNMODULE disabled in /etc/modprobe.conf">
- <ind:object object_ref="obj_kernmod_KERNMODULE_modprobeconf" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_disabled"
- version="1" comment="kernel module KERNMODULE disabled">
- <ind:path>/etc/modprobe.d</ind:path>
- <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
- <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_object id="obj_kernmod_KERNMODULE_modprobeconf"
- version="1" comment="Check depricated /etc/modprobe.conf for disablement of KERNMODULE">
- <ind:filepath>/etc/modprobe.conf</ind:filepath>
- <ind:pattern operation="pattern match">^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled b/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled
deleted file mode 100644
index 9fbfcc1..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_kernel_module_disabled
+++ /dev/null
@@ -1 +0,0 @@
-echo "install KERNMODULE /bin/false" > /etc/modprobe.d/KERNMODULE.conf
--
1.7.1
More information about the scap-security-guide
mailing list