[PATCH 04/15] Updated RHEL6 OVAL template create_services_disabled.py to generate bash remediation
Shawn Wells
shawn at redhat.com
Fri Apr 18 03:27:43 UTC 2014
-------------- next part --------------
>From dd6bbad43b3d29f4e9a7e9ca07f9aedeebb6fb60 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 19:56:49 -0400
Subject: [PATCH 04/15] Updated RHEL6 OVAL template create_services_disabled.py to generate bash remediation
Consolidating the OVAL + bash template generation into single script.
$ make clean ; ./create_services_disabled.py services_disabled.csv ; ls output/ ; cat output/service_abrtd_disabled.sh
rm -f output/*.xml
rm -f output/*.sh
service_abrtd_disabled.sh service_dhcpd_disabled.sh service_nfslock_disabled.sh service_saslauthd_disabled.sh
service_abrtd_disabled.xml service_dhcpd_disabled.xml service_nfslock_disabled.xml service_saslauthd_disabled.xml
service_acpid_disabled.sh service_dovecot_disabled.sh service_oddjobd_disabled.sh service_smartd_disabled.sh
service_acpid_disabled.xml service_dovecot_disabled.xml service_oddjobd_disabled.xml service_smartd_disabled.xml
service_atd_disabled.sh service_haldaemon_disabled.sh service_portreserve_disabled.sh service_smb_disabled.sh
service_atd_disabled.xml service_haldaemon_disabled.xml service_portreserve_disabled.xml service_smb_disabled.xml
service_autofs_disabled.sh service_httpd_disabled.sh service_qpidd_disabled.sh service_snmpd_disabled.sh
service_autofs_disabled.xml service_httpd_disabled.xml service_qpidd_disabled.xml service_snmpd_disabled.xml
service_avahi-daemon_disabled.sh service_kdump_disabled.sh service_quota_nld_disabled.sh service_squid_disabled.sh
service_avahi-daemon_disabled.xml service_kdump_disabled.xml service_quota_nld_disabled.xml service_squid_disabled.xml
service_bluetooth_disabled.sh service_mdmonitor_disabled.sh service_rdisc_disabled.sh service_sshd_disabled.sh
service_bluetooth_disabled.xml service_mdmonitor_disabled.xml service_rdisc_disabled.xml service_sshd_disabled.xml
service_certmonger_disabled.sh service_messagebus_disabled.sh service_rhnsd_disabled.sh service_sysstat_disabled.sh
service_certmonger_disabled.xml service_messagebus_disabled.xml service_rhnsd_disabled.xml service_sysstat_disabled.xml
service_cgconfig_disabled.sh service_named_disabled.sh service_rhsmcertd_disabled.sh service_tftp_disabled.sh
service_cgconfig_disabled.xml service_named_disabled.xml service_rhsmcertd_disabled.xml service_tftp_disabled.xml
service_cgred_disabled.sh service_netconsole_disabled.sh service_rpcgssd_disabled.sh service_vsftpd_disabled.sh
service_cgred_disabled.xml service_netconsole_disabled.xml service_rpcgssd_disabled.xml service_vsftpd_disabled.xml
service_cpuspeed_disabled.sh service_netfs_disabled.sh service_rpcidmapd_disabled.sh service_xinetd_disabled.sh
service_cpuspeed_disabled.xml service_netfs_disabled.xml service_rpcidmapd_disabled.xml service_xinetd_disabled.xml
service_cups_disabled.sh service_nfs_disabled.sh service_rpcsvcgssd_disabled.sh service_ypbind_disabled.sh
service_cups_disabled.xml service_nfs_disabled.xml service_rpcsvcgssd_disabled.xml service_ypbind_disabled.xml
chkconfig --level 0123456 abrtd off
service abrtd stop
---
.../6/input/checks/templates/bash/service_disabled | 9 ++
.../checks/templates/create_services_disabled.py | 9 ++-
.../6/input/checks/templates/oval/service_disabled | 99 ++++++++++++++++++++
.../checks/templates/template_service_disabled | 99 --------------------
.../bash/templates/create_services_disabled.py | 40 --------
.../fixes/bash/templates/template_service_disabled | 9 --
6 files changed, 116 insertions(+), 149 deletions(-)
create mode 100644 RHEL/6/input/checks/templates/bash/service_disabled
create mode 100644 RHEL/6/input/checks/templates/oval/service_disabled
delete mode 100644 RHEL/6/input/checks/templates/template_service_disabled
delete mode 100755 RHEL/6/input/fixes/bash/templates/create_services_disabled.py
delete mode 100644 RHEL/6/input/fixes/bash/templates/template_service_disabled
diff --git a/RHEL/6/input/checks/templates/bash/service_disabled b/RHEL/6/input/checks/templates/bash/service_disabled
new file mode 100644
index 0000000..d38a703
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/service_disabled
@@ -0,0 +1,9 @@
+#
+# Disable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME off
+
+#
+# Stop SERVICENAME if currently running
+#
+service SERVICENAME stop
diff --git a/RHEL/6/input/checks/templates/create_services_disabled.py b/RHEL/6/input/checks/templates/create_services_disabled.py
index b500a92..14bab12 100755
--- a/RHEL/6/input/checks/templates/create_services_disabled.py
+++ b/RHEL/6/input/checks/templates/create_services_disabled.py
@@ -16,7 +16,7 @@ import sys, csv, re
def output_checkfile(serviceinfo):
# get the items out of the list
servicename, packagename = serviceinfo
- with open("./template_service_disabled", 'r') as templatefile:
+ with open("./oval/service_disabled", 'r') as templatefile:
filestring = templatefile.read()
filestring = filestring.replace("SERVICENAME", servicename)
if packagename:
@@ -28,6 +28,13 @@ def output_checkfile(serviceinfo):
outputfile.write(filestring)
outputfile.close()
+ with open("./bash/service_disabled", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("SERVICENAME", servicename)
+ with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
def main():
if len(sys.argv) < 2:
print "Provide a CSV file containing lines of the format: servicename,packagename"
diff --git a/RHEL/6/input/checks/templates/oval/service_disabled b/RHEL/6/input/checks/templates/oval/service_disabled
new file mode 100644
index 0000000..ed6a491
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/service_disabled
@@ -0,0 +1,99 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. -->
+ <definition class="compliance" id="service_SERVICENAME_disabled"
+ version="1">
+ <metadata>
+ <title>Service SERVICENAME Disabled</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The SERVICENAME service should be disabled if possible.</description>
+ </metadata>
+ <criteria comment="package PACKAGENAME removed or service SERVICENAME is not configured to start" operator="OR">
+ <extend_definition comment="PACKAGENAME removed" definition_ref="package_PACKAGENAME_removed" />
+ <criteria operator="AND" comment="service SERVICENAME is not configured to start">
+ <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
+ </criteria>
+ </criteria>
+ </definition>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel0_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel0_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel1_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel1_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel2_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel2_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel3_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel3_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel4_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel4_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel5_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel5_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel6_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel6_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_off" />
+ </unix:runlevel_test>
+ <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">0</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">1</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">2</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">3</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">4</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">5</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">6</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_state comment="not configured to start" id="state_service_SERVICENAME_off" version="1">
+ <unix:start datatype="boolean">false</unix:start>
+ <unix:kill datatype="boolean">true</unix:kill>
+ </unix:runlevel_state>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_service_disabled b/RHEL/6/input/checks/templates/template_service_disabled
deleted file mode 100644
index ed6a491..0000000
--- a/RHEL/6/input/checks/templates/template_service_disabled
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_services_disabled.py. DO NOT EDIT. -->
- <definition class="compliance" id="service_SERVICENAME_disabled"
- version="1">
- <metadata>
- <title>Service SERVICENAME Disabled</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The SERVICENAME service should be disabled if possible.</description>
- </metadata>
- <criteria comment="package PACKAGENAME removed or service SERVICENAME is not configured to start" operator="OR">
- <extend_definition comment="PACKAGENAME removed" definition_ref="package_PACKAGENAME_removed" />
- <criteria operator="AND" comment="service SERVICENAME is not configured to start">
- <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
- </criteria>
- </criteria>
- </definition>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel0_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel0_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel1_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel1_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel2_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel2_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel3_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel3_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel4_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel4_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel5_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel5_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel6_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel6_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_off" />
- </unix:runlevel_test>
- <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">0</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">1</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">2</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">3</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">4</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">5</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">6</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_state comment="not configured to start" id="state_service_SERVICENAME_off" version="1">
- <unix:start datatype="boolean">false</unix:start>
- <unix:kill datatype="boolean">true</unix:kill>
- </unix:runlevel_state>
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/create_services_disabled.py b/RHEL/6/input/fixes/bash/templates/create_services_disabled.py
deleted file mode 100755
index c2b384a..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_services_disabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_services_disabled.py
-# automatically generate fixes for disabled services
-#
-# NOTE: The file 'template_service_disabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
-#
-# SERVICENAME - the name of the service that should be disabled
-# PACKAGENAME - the name of the package that installs the service
-#
-
-import sys, csv, re
-
-def output_checkfile(serviceinfo):
- # get the items out of the list
- servicename, packagename = serviceinfo
- with open("./template_service_disabled", 'r') as templatefile:
- filestring = templatefile.read()
- filestring = filestring.replace("SERVICENAME", servicename)
- with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile:
- outputfile.write(filestring)
- outputfile.close()
-
-def main():
- if len(sys.argv) < 2:
- print "Provide a CSV file containing lines of the format: servicename,packagename"
- sys.exit(1)
- with open(sys.argv[1], 'r') as f:
- # put the CSV line's items into a list
- servicelines = csv.reader(f)
- for line in servicelines:
- output_checkfile(line)
-
- sys.exit(0)
-
-if __name__ == "__main__":
- main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/template_service_disabled b/RHEL/6/input/fixes/bash/templates/template_service_disabled
deleted file mode 100644
index d38a703..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_service_disabled
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# Disable SERVICENAME for all run levels
-#
-chkconfig --level 0123456 SERVICENAME off
-
-#
-# Stop SERVICENAME if currently running
-#
-service SERVICENAME stop
--
1.7.1
More information about the scap-security-guide
mailing list