[PATCH 05/15] Updated RHEL6 OVAL create_services_enabled.py to create bash remediation

Shawn Wells shawn at redhat.com
Fri Apr 18 03:28:13 UTC 2014


-------------- next part --------------
>From 75b285828e19c91f034c72b692b669005e4c27aa Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 20:03:24 -0400
Subject: [PATCH 05/15] Updated RHEL6 OVAL create_services_enabled.py to create bash remediation

Consolidating template processes.

Also, removed the manual specification of run levels in the bash scripts. This is taken care of by the various service scripts; no need for us to specify.

$ make clean ; ./create_services_enabled.py services_enabled.csv ; ls output/ ; cat output/service_auditd_enabled.sh
rm -f output/*.xml
rm -f output/*.sh
service_auditd_enabled.sh   service_ip6tables_enabled.sh   service_irqbalance_enabled.sh   service_postfix_enabled.sh   service_restorecond_enabled.sh
service_auditd_enabled.xml  service_ip6tables_enabled.xml  service_irqbalance_enabled.xml  service_postfix_enabled.xml  service_restorecond_enabled.xml
service_crond_enabled.sh    service_iptables_enabled.sh    service_ntpd_enabled.sh         service_psacct_enabled.sh    service_rsyslog_enabled.sh
service_crond_enabled.xml   service_iptables_enabled.xml   service_ntpd_enabled.xml        service_psacct_enabled.xml   service_rsyslog_enabled.xml
chkconfig auditd on

service auditd start
---
 RHEL/6/input/checks/templates/bash/service_enabled |    9 ++
 .../checks/templates/create_services_enabled.py    |   12 ++-
 RHEL/6/input/checks/templates/oval/service_enabled |   99 ++++++++++++++++++++
 .../checks/templates/template_service_enabled      |   99 --------------------
 .../bash/templates/create_services_enabled.py      |   40 --------
 .../fixes/bash/templates/template_service_enabled  |    9 --
 6 files changed, 116 insertions(+), 152 deletions(-)
 create mode 100644 RHEL/6/input/checks/templates/bash/service_enabled
 create mode 100644 RHEL/6/input/checks/templates/oval/service_enabled
 delete mode 100644 RHEL/6/input/checks/templates/template_service_enabled
 delete mode 100755 RHEL/6/input/fixes/bash/templates/create_services_enabled.py
 delete mode 100644 RHEL/6/input/fixes/bash/templates/template_service_enabled

diff --git a/RHEL/6/input/checks/templates/bash/service_enabled b/RHEL/6/input/checks/templates/bash/service_enabled
new file mode 100644
index 0000000..edc1d4a
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/service_enabled
@@ -0,0 +1,9 @@
+#
+# Enable SERVICENAME for all run levels
+#
+chkconfig --level 0123456 SERVICENAME on
+
+#
+# Start SERVICENAME if not currently running
+#
+service SERVICENAME start
diff --git a/RHEL/6/input/checks/templates/create_services_enabled.py b/RHEL/6/input/checks/templates/create_services_enabled.py
index edb606f..7a42d36 100755
--- a/RHEL/6/input/checks/templates/create_services_enabled.py
+++ b/RHEL/6/input/checks/templates/create_services_enabled.py
@@ -4,9 +4,6 @@
 # create_services_enabled.py
 #   automatically generate checks for enabled services
 #
-# NOTE: The file 'template_service_enabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the checks to work.
-#
 # SERVICENAME - the name of the service that should be enabled
 # PACKAGENAME - the name of the package that installs the service
 #
@@ -16,7 +13,7 @@ import sys, csv, re
 def output_checkfile(serviceinfo):
     # get the items out of the list
     servicename, packagename = serviceinfo
-    with open("./template_service_enabled", 'r') as templatefile:
+    with open("./oval/service_enabled", 'r') as templatefile:
         filestring = templatefile.read()
         filestring = filestring.replace("SERVICENAME", servicename)
         if packagename:
@@ -28,6 +25,13 @@ def output_checkfile(serviceinfo):
             outputfile.write(filestring)
             outputfile.close()
 
+    with open("./bash/service_enabled", 'r') as templatefile:
+	filestring = templatefile.read()
+	filestring = filestring.replace("SERVICENAME", servicename)
+	with open("./output/service_" + servicename + "_enabled.sh", 'wb+') as outputfile:
+		outputfile.write(filestring)
+		outputfile.close()
+
 def main():
     if len(sys.argv) < 2:
         print "Provide a CSV file containing lines of the format: servicename,packagename"
diff --git a/RHEL/6/input/checks/templates/oval/service_enabled b/RHEL/6/input/checks/templates/oval/service_enabled
new file mode 100644
index 0000000..e1fd447
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/service_enabled
@@ -0,0 +1,99 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_services_enabled.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="service_SERVICENAME_enabled"
+  version="1">
+    <metadata>
+      <title>Service SERVICENAME Enabled</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The SERVICENAME service should be enabled if possible.</description>
+    </metadata>
+    <criteria comment="package PACKAGENAME installed and service SERVICENAME is configured to start" operator="AND">
+    <extend_definition comment="PACKAGENAME installed" definition_ref="package_PACKAGENAME_installed" />
+    <criteria operator="OR" comment="service SERVICENAME is configured to start">
+      <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
+      <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
+    </criteria>
+    </criteria>
+  </definition>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel0_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel0_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel1_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel1_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel2_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel2_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel3_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel3_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel4_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel4_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel5_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel5_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_test check="all" check_existence="any_exist"
+  comment="Runlevel test" id="test_runlevel6_SERVICENAME"
+  version="2">
+    <unix:object object_ref="obj_runlevel6_SERVICENAME" />
+    <unix:state state_ref="state_service_SERVICENAME_on" />
+  </unix:runlevel_test>
+  <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">0</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">1</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">2</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">3</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">4</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">5</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
+    <unix:service_name>SERVICENAME</unix:service_name>
+    <unix:runlevel operation="equals">6</unix:runlevel>
+  </unix:runlevel_object>
+  <unix:runlevel_state comment="configured to start" id="state_service_SERVICENAME_on" version="1">
+    <unix:start datatype="boolean">true</unix:start>
+    <unix:kill datatype="boolean">false</unix:kill>
+  </unix:runlevel_state>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/template_service_enabled b/RHEL/6/input/checks/templates/template_service_enabled
deleted file mode 100644
index e1fd447..0000000
--- a/RHEL/6/input/checks/templates/template_service_enabled
+++ /dev/null
@@ -1,99 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_services_enabled.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="service_SERVICENAME_enabled"
-  version="1">
-    <metadata>
-      <title>Service SERVICENAME Enabled</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The SERVICENAME service should be enabled if possible.</description>
-    </metadata>
-    <criteria comment="package PACKAGENAME installed and service SERVICENAME is configured to start" operator="AND">
-    <extend_definition comment="PACKAGENAME installed" definition_ref="package_PACKAGENAME_installed" />
-    <criteria operator="OR" comment="service SERVICENAME is configured to start">
-      <criterion comment="SERVICENAME runlevel 0" test_ref="test_runlevel0_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 1" test_ref="test_runlevel1_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 2" test_ref="test_runlevel2_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 3" test_ref="test_runlevel3_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 4" test_ref="test_runlevel4_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 5" test_ref="test_runlevel5_SERVICENAME" />
-      <criterion comment="SERVICENAME runlevel 6" test_ref="test_runlevel6_SERVICENAME" />
-    </criteria>
-    </criteria>
-  </definition>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel0_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel0_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel1_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel1_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel2_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel2_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel3_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel3_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel4_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel4_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel5_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel5_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel6_SERVICENAME"
-  version="2">
-    <unix:object object_ref="obj_runlevel6_SERVICENAME" />
-    <unix:state state_ref="state_service_SERVICENAME_on" />
-  </unix:runlevel_test>
-  <unix:runlevel_object id="obj_runlevel0_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">0</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel1_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">1</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel2_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">2</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel3_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">3</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel4_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">4</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel5_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">5</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel6_SERVICENAME" version="1">
-    <unix:service_name>SERVICENAME</unix:service_name>
-    <unix:runlevel operation="equals">6</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_state comment="configured to start" id="state_service_SERVICENAME_on" version="1">
-    <unix:start datatype="boolean">true</unix:start>
-    <unix:kill datatype="boolean">false</unix:kill>
-  </unix:runlevel_state>
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/create_services_enabled.py b/RHEL/6/input/fixes/bash/templates/create_services_enabled.py
deleted file mode 100755
index 9a9dac8..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_services_enabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_services_enabled.py
-#   automatically generate fixes for enabled services
-#
-# NOTE: The file 'template_service_enabled' should be located in the same working directory as this script. The
-# template contains the following tags that *must* be replaced successfully in order for the fixes to work.
-#
-# SERVICENAME - the name of the service that should be enabled
-# PACKAGENAME - the name of the package that installs the service
-#
-
-import sys, csv, re
-
-def output_checkfile(serviceinfo):
-    # get the items out of the list
-    servicename, packagename = serviceinfo
-    with open("./template_service_enabled", 'r') as templatefile:
-        filestring = templatefile.read()
-        filestring = filestring.replace("SERVICENAME", servicename)
-        with open("./output/service_" + servicename + "_enabled.sh", 'wb+') as outputfile:
-            outputfile.write(filestring)
-            outputfile.close()
-
-def main():
-    if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: servicename,packagename"
-        sys.exit(1)
-    with open(sys.argv[1], 'r') as f:
-        # put the CSV line's items into a list
-        servicelines = csv.reader(f)
-        for line in servicelines:
-            output_checkfile(line)
-
-    sys.exit(0)
-
-if __name__ == "__main__":
-    main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/template_service_enabled b/RHEL/6/input/fixes/bash/templates/template_service_enabled
deleted file mode 100644
index edc1d4a..0000000
--- a/RHEL/6/input/fixes/bash/templates/template_service_enabled
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# Enable SERVICENAME for all run levels
-#
-chkconfig --level 0123456 SERVICENAME on
-
-#
-# Start SERVICENAME if not currently running
-#
-service SERVICENAME start
-- 
1.7.1



More information about the scap-security-guide mailing list