[PATCH 05/15] Updated RHEL6 OVAL create_services_enabled.py to create bash remediation
Shawn Wells
shawn at redhat.com
Fri Apr 18 03:28:13 UTC 2014
-------------- next part --------------
>From 75b285828e19c91f034c72b692b669005e4c27aa Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 20:03:24 -0400
Subject: [PATCH 05/15] Updated RHEL6 OVAL create_services_enabled.py to create bash remediation
Consolidating template processes.
Also, removed the manual specification of run levels in the bash scripts. This is taken care of by the various service scripts; no need for us to specify.
$ make clean ; ./create_services_enabled.py services_enabled.csv ; ls output/ ; cat output/service_auditd_enabled.sh
rm -f output/*.xml
rm -f output/*.sh
service_auditd_enabled.sh service_ip6tables_enabled.sh service_irqbalance_enabled.sh service_postfix_enabled.sh service_restorecond_enabled.sh
service_auditd_enabled.xml service_ip6tables_enabled.xml service_irqbalance_enabled.xml service_postfix_enabled.xml service_restorecond_enabled.xml
service_crond_enabled.sh service_iptables_enabled.sh service_ntpd_enabled.sh service_psacct_enabled.sh service_rsyslog_enabled.sh
service_crond_enabled.xml service_iptables_enabled.xml service_ntpd_enabled.xml service_psacct_enabled.xml service_rsyslog_enabled.xml
chkconfig auditd on
service auditd start
---
RHEL/6/input/checks/templates/bash/service_enabled | 9 ++
.../checks/templates/create_services_enabled.py | 12 ++-
RHEL/6/input/checks/templates/oval/service_enabled | 99 ++++++++++++++++++++
.../checks/templates/template_service_enabled | 99 --------------------
.../bash/templates/create_services_enabled.py | 40 --------
.../fixes/bash/templates/template_service_enabled | 9 --
6 files changed, 116 insertions(+), 152 deletions(-)
create mode 100644 RHEL/6/input/checks/templates/bash/service_enabled
create mode 100644 RHEL/6/input/checks/templates/oval/service_enabled
delete mode 100644 RHEL/6/input/checks/templates/template_service_enabled
delete mode 100755 RHEL/6/input/fixes/bash/templates/create_services_enabled.py
delete mode 100644 RHEL/6/input/fixes/bash/templates/template_service_enabled
diff --git a/RHEL/6/input/checks/templates/bash/service_enabled b/RHEL/6/input/checks/templates/bash/service_enabled
new file mode 100644
index 0000000..edc1d4a
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/service_enabled
@@ -0,0 +1,9 @@
+#
+# Enable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME on
+
+#
+# Start SERVICENAME if not currently running
+#
+service SERVICENAME start
diff --git a/RHEL/6/input/checks/templates/create_services_enabled.py b/RHEL/6/input/checks/templates/create_services_enabled.py
index edb606f..7a42d36 100755
--- a/RHEL/6/input/checks/templates/create_services_enabled.py
+++ b/RHEL/6/input/checks/templates/create_services_enabled.py
@@ -4,9 +4,6 @@
# create_services_enabled.py
# automatically generate checks for enabled services
#
-# NOTE: The file 'template_service_enabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the checks to work.
-#
# SERVICENAME - the name of the service that should be enabled
# PACKAGENAME - the name of the package that installs the service
#
@@ -16,7 +13,7 @@ import sys, csv, re
def output_checkfile(serviceinfo):
# get the items out of the list
servicename, packagename = serviceinfo
- with open("./template_service_enabled", 'r') as templatefile:
+ with open("./oval/service_enabled", 'r') as templatefile:
filestring = templatefile.read()
filestring = filestring.replace("SERVICENAME", servicename)
if packagename:
@@ -28,6 +25,13 @@ def output_checkfile(serviceinfo):
outputfile.write(filestring)
outputfile.close()
+ with open("./bash/service_enabled", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("SERVICENAME", servicename)
+ with open("./output/service_" + servicename + "_enabled.sh", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
def main():
if len(sys.argv) < 2:
print "Provide a CSV file containing lines of the format: servicename,packagename"
diff --git a/RHEL/6/input/checks/templates/oval/service_enabled b/RHEL/6/input/checks/templates/oval/service_enabled
new file mode 100644
index 0000000..e1fd447
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/service_enabled
@@ -0,0 +1,99 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_services_enabled.py. DO NOT EDIT. -->
+ <definition class="compliance" id="service_SERVICENAME_enabled"
+ version="1">
+ <metadata>
+ <title>Service SERVICENAME Enabled</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The SERVICENAME service should be enabled if possible.</description>
+ </metadata>
+ <criteria comment="package PACKAGENAME installed and service SERVICENAME is configured to start" operator="AND">
+ <extend_definition comment="PACKAGENAME installed" definition_ref="package_PACKAGENAME_installed" />
+ <criteria operator="OR" comment="service SERVICENAME is configured to start">
+ <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
+ <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
+ </criteria>
+ </criteria>
+ </definition>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel0_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel0_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel1_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel1_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel2_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel2_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel3_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel3_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel4_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel4_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel5_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel5_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_test check="all" check_existence="any_exist"
+ comment="Runlevel test" id="test_runlevel6_SERVICENAME"
+ version="2">
+ <unix:object object_ref="obj_runlevel6_SERVICENAME" />
+ <unix:state state_ref="state_service_SERVICENAME_on" />
+ </unix:runlevel_test>
+ <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">0</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">1</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">2</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">3</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">4</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">5</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
+ <unix:service_name>SERVICENAME</unix:service_name>
+ <unix:runlevel operation="equals">6</unix:runlevel>
+ </unix:runlevel_object>
+ <unix:runlevel_state comment="configured to start" id="state_service_SERVICENAME_on" version="1">
+ <unix:start datatype="boolean">true</unix:start>
+ <unix:kill datatype="boolean">false</unix:kill>
+ </unix:runlevel_state>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_service_enabled b/RHEL/6/input/checks/templates/template_service_enabled
deleted file mode 100644
index e1fd447..0000000
--- a/RHEL/6/input/checks/templates/template_service_enabled
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_services_enabled.py. DO NOT EDIT. -->
- <definition class="compliance" id="service_SERVICENAME_enabled"
- version="1">
- <metadata>
- <title>Service SERVICENAME Enabled</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The SERVICENAME service should be enabled if possible.</description>
- </metadata>
- <criteria comment="package PACKAGENAME installed and service SERVICENAME is configured to start" operator="AND">
- <extend_definition comment="PACKAGENAME installed" definition_ref="package_PACKAGENAME_installed" />
- <criteria operator="OR" comment="service SERVICENAME is configured to start">
- <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
- <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
- </criteria>
- </criteria>
- </definition>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel0_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel0_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel1_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel1_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel2_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel2_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel3_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel3_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel4_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel4_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel5_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel5_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_test check="all" check_existence="any_exist"
- comment="Runlevel test" id="test_runlevel6_SERVICENAME"
- version="2">
- <unix:object object_ref="obj_runlevel6_SERVICENAME" />
- <unix:state state_ref="state_service_SERVICENAME_on" />
- </unix:runlevel_test>
- <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">0</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">1</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">2</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">3</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">4</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">5</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
- <unix:service_name>SERVICENAME</unix:service_name>
- <unix:runlevel operation="equals">6</unix:runlevel>
- </unix:runlevel_object>
- <unix:runlevel_state comment="configured to start" id="state_service_SERVICENAME_on" version="1">
- <unix:start datatype="boolean">true</unix:start>
- <unix:kill datatype="boolean">false</unix:kill>
- </unix:runlevel_state>
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/create_services_enabled.py b/RHEL/6/input/fixes/bash/templates/create_services_enabled.py
deleted file mode 100755
index 9a9dac8..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_services_enabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_services_enabled.py
-# automatically generate fixes for enabled services
-#
-# NOTE: The file 'template_service_enabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
-#
-# SERVICENAME - the name of the service that should be enabled
-# PACKAGENAME - the name of the package that installs the service
-#
-
-import sys, csv, re
-
-def output_checkfile(serviceinfo):
- # get the items out of the list
- servicename, packagename = serviceinfo
- with open("./template_service_enabled", 'r') as templatefile:
- filestring = templatefile.read()
- filestring = filestring.replace("SERVICENAME", servicename)
- with open("./output/service_" + servicename + "_enabled.sh", 'wb+') as outputfile:
- outputfile.write(filestring)
- outputfile.close()
-
-def main():
- if len(sys.argv) < 2:
- print "Provide a CSV file containing lines of the format: servicename,packagename"
- sys.exit(1)
- with open(sys.argv[1], 'r') as f:
- # put the CSV line's items into a list
- servicelines = csv.reader(f)
- for line in servicelines:
- output_checkfile(line)
-
- sys.exit(0)
-
-if __name__ == "__main__":
- main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/template_service_enabled b/RHEL/6/input/fixes/bash/templates/template_service_enabled
deleted file mode 100644
index edc1d4a..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_service_enabled
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# Enable SERVICENAME for all run levels
-#
-chkconfig --level 0123456 SERVICENAME on
-
-#
-# Start SERVICENAME if not currently running
-#
-service SERVICENAME start
--
1.7.1
More information about the scap-security-guide
mailing list