[PATCH 04/15] Updated RHEL6 OVAL template create_services_disabled.py to generate bash remediation

Shawn Wells shawn at redhat.com
Fri Apr 18 03:27:43 UTC 2014


-------------- next part --------------
>From dd6bbad43b3d29f4e9a7e9ca07f9aedeebb6fb60 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 19:56:49 -0400
Subject: [PATCH 04/15] Updated RHEL6 OVAL template create_services_disabled.py to generate bash remediation

Consolidating the OVAL + bash template generation into single script.

$ make clean ; ./create_services_disabled.py services_disabled.csv ; ls output/ ; cat output/service_abrtd_disabled.sh
rm -f output/*.xml
rm -f output/*.sh
service_abrtd_disabled.sh          service_dhcpd_disabled.sh        service_nfslock_disabled.sh       service_saslauthd_disabled.sh
service_abrtd_disabled.xml         service_dhcpd_disabled.xml       service_nfslock_disabled.xml      service_saslauthd_disabled.xml
service_acpid_disabled.sh          service_dovecot_disabled.sh      service_oddjobd_disabled.sh       service_smartd_disabled.sh
service_acpid_disabled.xml         service_dovecot_disabled.xml     service_oddjobd_disabled.xml      service_smartd_disabled.xml
service_atd_disabled.sh            service_haldaemon_disabled.sh    service_portreserve_disabled.sh   service_smb_disabled.sh
service_atd_disabled.xml           service_haldaemon_disabled.xml   service_portreserve_disabled.xml  service_smb_disabled.xml
service_autofs_disabled.sh         service_httpd_disabled.sh        service_qpidd_disabled.sh         service_snmpd_disabled.sh
service_autofs_disabled.xml        service_httpd_disabled.xml       service_qpidd_disabled.xml        service_snmpd_disabled.xml
service_avahi-daemon_disabled.sh   service_kdump_disabled.sh        service_quota_nld_disabled.sh     service_squid_disabled.sh
service_avahi-daemon_disabled.xml  service_kdump_disabled.xml       service_quota_nld_disabled.xml    service_squid_disabled.xml
service_bluetooth_disabled.sh      service_mdmonitor_disabled.sh    service_rdisc_disabled.sh         service_sshd_disabled.sh
service_bluetooth_disabled.xml     service_mdmonitor_disabled.xml   service_rdisc_disabled.xml        service_sshd_disabled.xml
service_certmonger_disabled.sh     service_messagebus_disabled.sh   service_rhnsd_disabled.sh         service_sysstat_disabled.sh
service_certmonger_disabled.xml    service_messagebus_disabled.xml  service_rhnsd_disabled.xml        service_sysstat_disabled.xml
service_cgconfig_disabled.sh       service_named_disabled.sh        service_rhsmcertd_disabled.sh     service_tftp_disabled.sh
service_cgconfig_disabled.xml      service_named_disabled.xml       service_rhsmcertd_disabled.xml    service_tftp_disabled.xml
service_cgred_disabled.sh          service_netconsole_disabled.sh   service_rpcgssd_disabled.sh       service_vsftpd_disabled.sh
service_cgred_disabled.xml         service_netconsole_disabled.xml  service_rpcgssd_disabled.xml      service_vsftpd_disabled.xml
service_cpuspeed_disabled.sh       service_netfs_disabled.sh        service_rpcidmapd_disabled.sh     service_xinetd_disabled.sh
service_cpuspeed_disabled.xml      service_netfs_disabled.xml       service_rpcidmapd_disabled.xml    service_xinetd_disabled.xml
service_cups_disabled.sh           service_nfs_disabled.sh          service_rpcsvcgssd_disabled.sh    service_ypbind_disabled.sh
service_cups_disabled.xml          service_nfs_disabled.xml         service_rpcsvcgssd_disabled.xml   service_ypbind_disabled.xml
chkconfig --level 0123456 abrtd off

service abrtd stop
---
 .../6/input/checks/templates/bash/service_disabled |    9 ++
 .../checks/templates/create_services_disabled.py   |    9 ++-
 .../6/input/checks/templates/oval/service_disabled |   99 ++++++++++++++++++++
 .../checks/templates/template_service_disabled     |   99 --------------------
 .../bash/templates/create_services_disabled.py     |   40 --------
 .../fixes/bash/templates/template_service_disabled |    9 --
 6 files changed, 116 insertions(+), 149 deletions(-)
 create mode 100644 RHEL/6/input/checks/templates/bash/service_disabled
 create mode 100644 RHEL/6/input/checks/templates/oval/service_disabled
 delete mode 100644 RHEL/6/input/checks/templates/template_service_disabled
 delete mode 100755 RHEL/6/input/fixes/bash/templates/create_services_disabled.py
 delete mode 100644 RHEL/6/input/fixes/bash/templates/template_service_disabled

diff --git a/RHEL/6/input/checks/templates/bash/service_disabled b/RHEL/6/input/checks/templates/bash/service_disabled
new file mode 100644
index 0000000..d38a703
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/service_disabled
@@ -0,0 +1,9 @@
+#
+# Disable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME off
+
+#
+# Stop SERVICENAME if currently running
+#
+service SERVICENAME stop
diff --git a/RHEL/6/input/checks/templates/create_services_disabled.py b/RHEL/6/input/checks/templates/create_services_disabled.py
index b500a92..14bab12 100755
--- a/RHEL/6/input/checks/templates/create_services_disabled.py
+++ b/RHEL/6/input/checks/templates/create_services_disabled.py
@@ -16,7 +16,7 @@ import sys, csv, re
 def output_checkfile(serviceinfo):
     # get the items out of the list
     servicename, packagename = serviceinfo
-    with open("./template_service_disabled", 'r') as templatefile:
+    with open("./oval/service_disabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("SERVICENAME", servicename)
         if packagename:
@@ -28,6 +28,13 @@ def output_checkfile(serviceinfo):
             outputfile.write(filestring)
             outputfile.close()
 
+    with open("./bash/service_disabled", 'r') as templatefile:
+	filestring = templatefile.read()
+	filestring = filestring.replace("SERVICENAME", servicename)
+	with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
+		outputfile.write(filestring)
+		outputfile.close()
+
 def main():
     if len(sys.argv) < 2:
         print "Provide a CSV file containing lines of the format: servicename,packagename"
diff --git a/RHEL/6/input/checks/templates/oval/service_disabled b/RHEL/6/input/checks/templates/oval/service_disabled
new file mode 100644
index 0000000..ed6a491
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/service_disabled
@@ -0,0 +1,99 @@
+<def-group>
+  <!-- THIS FILE IS GENERATED by create_services_disabled.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="service_SERVICENAME_disabled"
+  version="1">
+    <metadata>
+      <title>Service SERVICENAME Disabled</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The SERVICENAME service should be disabled if possible.</description>
+    </metadata>
+   <criteria comment="package PACKAGENAME removed or service SERVICENAME is not configured to start" operator="OR">
+    <extend_definition comment="PACKAGENAME removed" definition_ref="package_PACKAGENAME_removed" />
+    <criteria operator="AND" comment="service SERVICENAME is not configured to start">
+      <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
+    </criteria>
+    </criteria>
+  </definition>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel0_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel0_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel1_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel1_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel2_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel2_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel3_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel3_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel4_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel4_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel5_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel5_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel6_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel6_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_off" />
+  </unix:runlevel_test>
+  <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">0</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">1</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">2</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">3</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">4</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">5</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">6</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_state comment="not configured to start" id="state_service_SERVICENAME_off" version="1">
+    <unix:start datatype="boolean">false</unix:start>
+    <unix:kill datatype="boolean">true</unix:kill>
+  </unix:runlevel_state>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_service_disabled b/RHEL/6/input/checks/templates/template_service_disabled
deleted file mode 100644
index ed6a491..0000000
--- a/RHEL/6/input/checks/templates/template_service_disabled
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
-  <!-- THIS FILE IS GENERATED by create_services_disabled.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="service_SERVICENAME_disabled"
-  version="1">
-    <metadata>
-      <title>Service SERVICENAME Disabled</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The SERVICENAME service should be disabled if possible.</description>
-    </metadata>
-   <criteria comment="package PACKAGENAME removed or service SERVICENAME is not configured to start" operator="OR">
-    <extend_definition comment="PACKAGENAME removed" definition_ref="package_PACKAGENAME_removed" />
-    <criteria operator="AND" comment="service SERVICENAME is not configured to start">
-      <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
-    </criteria>
-    </criteria>
-  </definition>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel0_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel0_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel1_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel1_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel2_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel2_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel3_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel3_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel4_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel4_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel5_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel5_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel6_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel6_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">0</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">1</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">2</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">3</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">4</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">5</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">6</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_state comment="not configured to start" id="state_service_SERVICENAME_off" version="1">
-    <unix:start datatype="boolean">false</unix:start>
-    <unix:kill datatype="boolean">true</unix:kill>
-  </unix:runlevel_state>
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/create_services_disabled.py b/RHEL/6/input/fixes/bash/templates/create_services_disabled.py
deleted file mode 100755
index c2b384a..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_services_disabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_services_disabled.py
-#   automatically generate fixes for disabled services
-#
-# NOTE: The file 'template_service_disabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
-#
-# SERVICENAME - the name of the service that should be disabled
-# PACKAGENAME - the name of the package that installs the service
-#
-
-import sys, csv, re
-
-def output_checkfile(serviceinfo):
-    # get the items out of the list
-    servicename, packagename = serviceinfo
-    with open("./template_service_disabled", 'r') as templatefile:
-        filestring = templatefile.read()
-        filestring = filestring.replace("SERVICENAME", servicename)
-        with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
-            outputfile.write(filestring)
-            outputfile.close()
-
-def main():
-    if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: servicename,packagename"
-        sys.exit(1)
-    with open(sys.argv[1], 'r') as f:
-        # put the CSV line's items into a list
-        servicelines = csv.reader(f)
-        for line in servicelines:
-            output_checkfile(line)
-
-    sys.exit(0)
-
-if __name__ == "__main__":
-    main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/template_service_disabled b/RHEL/6/input/fixes/bash/templates/template_service_disabled
deleted file mode 100644
index d38a703..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_service_disabled
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# Disable SERVICENAME for all run levels
-#
-chkconfig --level 0123456 SERVICENAME off
-
-#
-# Stop SERVICENAME if currently running
-#
-service SERVICENAME stop
-- 
1.7.1



More information about the scap-security-guide mailing list