[PATCH 07/15] Updated RHEL6 OVAL templates
Shawn Wells
shawn at redhat.com
Fri Apr 18 03:28:58 UTC 2014
-------------- next part --------------
>From 7725a1d4bffae211f4bf5359ebff584f36cb63f7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 22:05:11 -0400
Subject: [PATCH 07/15] Updated RHEL6 OVAL templates
- Creates new checks/templates/{oval bash} directories to structure things a bit
- removed executable bit on OVAL and bash templates
- All tempaltes now consolidated into one place, which will make (future) template migration to shared/ easier
---
.../input/checks/templates/bash/package_installed | 1 +
RHEL/6/input/checks/templates/bash/package_removed | 1 +
RHEL/6/input/checks/templates/bash/service_enabled | 2 +-
RHEL/6/input/checks/templates/bash/support.sh | 9 ++++
.../checks/templates/create_package_installed.py | 4 +-
.../checks/templates/create_permission_checks.py | 4 +-
.../input/checks/templates/oval/package_installed | 26 +++++++++++++
RHEL/6/input/checks/templates/oval/package_removed | 26 +++++++++++++
RHEL/6/input/checks/templates/oval/permissions | 35 +++++++++++++++++
RHEL/6/input/checks/templates/sysctl_values.csv | 1 +
.../templates/template_BASH_package_installed | 1 -
.../templates/template_OVAL_package_installed | 26 -------------
.../checks/templates/template_package_removed | 26 -------------
RHEL/6/input/checks/templates/template_permissions | 35 -----------------
RHEL/6/input/fixes/bash/templates/Makefile | 20 ----------
.../templates/create_kernel_module_disabled.py | 40 --------------------
.../6/input/fixes/bash/templates/output/.gitignore | 2 -
RHEL/6/input/fixes/bash/templates/support.sh | 9 ----
18 files changed, 104 insertions(+), 164 deletions(-)
create mode 100644 RHEL/6/input/checks/templates/bash/package_installed
create mode 100644 RHEL/6/input/checks/templates/bash/package_removed
create mode 100644 RHEL/6/input/checks/templates/bash/support.sh
create mode 100644 RHEL/6/input/checks/templates/oval/package_installed
create mode 100644 RHEL/6/input/checks/templates/oval/package_removed
create mode 100644 RHEL/6/input/checks/templates/oval/permissions
delete mode 100644 RHEL/6/input/checks/templates/template_BASH_package_installed
delete mode 100644 RHEL/6/input/checks/templates/template_OVAL_package_installed
delete mode 100644 RHEL/6/input/checks/templates/template_package_removed
delete mode 100644 RHEL/6/input/checks/templates/template_permissions
delete mode 100644 RHEL/6/input/fixes/bash/templates/Makefile
delete mode 100755 RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
delete mode 100644 RHEL/6/input/fixes/bash/templates/output/.gitignore
delete mode 100644 RHEL/6/input/fixes/bash/templates/support.sh
diff --git a/RHEL/6/input/checks/templates/bash/package_installed b/RHEL/6/input/checks/templates/bash/package_installed
new file mode 100644
index 0000000..1ea466e
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/package_installed
@@ -0,0 +1 @@
+yum -y install PKGNAME
diff --git a/RHEL/6/input/checks/templates/bash/package_removed b/RHEL/6/input/checks/templates/bash/package_removed
new file mode 100644
index 0000000..9caa788
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/package_removed
@@ -0,0 +1 @@
+yum -y erase PKGNAME
diff --git a/RHEL/6/input/checks/templates/bash/service_enabled b/RHEL/6/input/checks/templates/bash/service_enabled
index edc1d4a..d4a1b6f 100644
--- a/RHEL/6/input/checks/templates/bash/service_enabled
+++ b/RHEL/6/input/checks/templates/bash/service_enabled
@@ -1,7 +1,7 @@
#
# Enable SERVICENAME for all run levels
#
-chkconfig --level 0123456 SERVICENAME on
+chkconfig SERVICENAME on
#
# Start SERVICENAME if not currently running
diff --git a/RHEL/6/input/checks/templates/bash/support.sh b/RHEL/6/input/checks/templates/bash/support.sh
new file mode 100644
index 0000000..e25ce4d
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/support.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+function populate {
+# code to populate environment variables needed (for unit testing)
+if [ -z "${!1}" ]; then
+ echo "$1 is not defined. Exiting."
+ exit
+fi
+}
diff --git a/RHEL/6/input/checks/templates/create_package_installed.py b/RHEL/6/input/checks/templates/create_package_installed.py
index b32e18c..9af30d3 100755
--- a/RHEL/6/input/checks/templates/create_package_installed.py
+++ b/RHEL/6/input/checks/templates/create_package_installed.py
@@ -15,13 +15,13 @@ import sys, csv, re
def output_check(package_info):
pkgname = package_info[0]
if pkgname:
- with open("./template_OVAL_package_installed", 'r') as OVALtemplatefile:
+ with open("./oval/package_installed", 'r') as OVALtemplatefile:
filestring = OVALtemplatefile.read()
filestring = filestring.replace("PKGNAME", pkgname)
with open("./output/package_" + pkgname + "_installed.xml", 'wb+') as OVALoutputfile:
OVALoutputfile.write(filestring)
OVALoutputfile.close()
- with open("./template_BASH_package_installed", 'r') as BASHtemplatefile:
+ with open("./bash/package_installed", 'r') as BASHtemplatefile:
filestring = BASHtemplatefile.read()
filestring = filestring.replace("PKGNAME", pkgname)
with open("./output/package_" + pkgname + "_installed.sh", 'wb+') as BASHoutputfile:
diff --git a/RHEL/6/input/checks/templates/create_permission_checks.py b/RHEL/6/input/checks/templates/create_permission_checks.py
index 70222fb..02d5904 100755
--- a/RHEL/6/input/checks/templates/create_permission_checks.py
+++ b/RHEL/6/input/checks/templates/create_permission_checks.py
@@ -4,7 +4,7 @@
# create_permission_checks.py
# generate template-based checks for file permissions/ownership
#
-# NOTE: The file 'template_permissions' should be located in the same working directory as this script. The
+# NOTE: The file 'oval/permissions' should be located in the same working directory as this script. The
# template contains tags that *must* be replaced successfully in order for the checks to work.
#
# directory path,file name,owner uid (numeric),group owner gid (numeric),mode
@@ -45,7 +45,7 @@ def output_check(path_info):
# we are ready to create the check
# open the template and perform the conversions
- with open("./template_permissions", 'r') as templatefile:
+ with open("./oval/permissions", 'r') as templatefile:
# replace the placeholders within the template with the actual values
filestring = templatefile.read()
filestring = filestring.replace("FILEID", path_id)
diff --git a/RHEL/6/input/checks/templates/oval/package_installed b/RHEL/6/input/checks/templates/oval/package_installed
new file mode 100644
index 0000000..240b2ba
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/package_installed
@@ -0,0 +1,26 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
+ <definition class="compliance" id="package_PKGNAME_installed"
+ version="1">
+ <metadata>
+ <title>Package PKGNAME Installed</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The RPM package PKGNAME should be installed.</description>
+ <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
+ </metadata>
+ <criteria>
+ <criterion comment="package PKGNAME is installed"
+ test_ref="test_package_PKGNAME_installed" />
+ </criteria>
+ </definition>
+ <linux:rpminfo_test check="all" check_existence="all_exist"
+ id="test_package_PKGNAME_installed" version="1"
+ comment="package PKGNAME is installed">
+ <linux:object object_ref="obj_package_PKGNAME_installed" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_object id="obj_package_PKGNAME_installed" version="1">
+ <linux:name>PKGNAME</linux:name>
+ </linux:rpminfo_object>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/oval/package_removed b/RHEL/6/input/checks/templates/oval/package_removed
new file mode 100644
index 0000000..9f3e850
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/package_removed
@@ -0,0 +1,26 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
+ <definition class="compliance" id="package_PKGNAME_removed"
+ version="1">
+ <metadata>
+ <title>Package PKGNAME Removed</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The RPM package PKGNAME should be removed.</description>
+ <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
+ </metadata>
+ <criteria>
+ <criterion comment="package PKGNAME is removed"
+ test_ref="test_package_PKGNAME_removed" />
+ </criteria>
+ </definition>
+ <linux:rpminfo_test check="all" check_existence="none_exist"
+ id="test_package_PKGNAME_removed" version="1"
+ comment="package PKGNAME is removed">
+ <linux:object object_ref="obj_package_PKGNAME_removed" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
+ <linux:name>PKGNAME</linux:name>
+ </linux:rpminfo_object>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/oval/permissions b/RHEL/6/input/checks/templates/oval/permissions
new file mode 100644
index 0000000..9c92938
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/permissions
@@ -0,0 +1,35 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py. DO NOT EDIT. -->
+ <definition class="compliance" id="file_permissionsFILEID" version="1">
+ <metadata>
+ <title>Verify FILEPATH Permissions</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If
+ the target file or directory has an extended ACL then it will fail the mode check.</description>
+ <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
+ </metadata>
+ <criteria>
+ <criterion test_ref="testFILEID" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all" check_existence="all_exist" comment="FILEPATH mode and ownership" id="testFILEID" version="1">
+ <unix:object object_ref="objectFILEID" />
+ <unix:state state_ref="FILEID_state_uid_FILEUID" />
+ <unix:state state_ref="FILEID_state_gid_FILEGID" />
+ <unix:state state_ref="FILEID_state_mode_FILEMODE" />
+ </unix:file_test>
+ <unix:file_object comment="FILEPATH" id="objectFILEID" version="1">
+ <unix:path>FILEDIR</unix:path>
+ UNIX_FILENAME
+ </unix:file_object>
+ <unix:file_state id="FILEID_state_uid_FILEUID" version="1">
+ <unix:user_id datatype="int" operation="equals">FILEUID</unix:user_id>
+ </unix:file_state>
+ <unix:file_state id="FILEID_state_gid_FILEGID" version="1">
+ <unix:group_id datatype="int" operation="equals">FILEGID</unix:group_id>
+ </unix:file_state>
+ <unix:file_state id="FILEID_state_mode_FILEMODE" version="1">
+STATEMODE
+</def-group>
diff --git a/RHEL/6/input/checks/templates/sysctl_values.csv b/RHEL/6/input/checks/templates/sysctl_values.csv
index 2123847..3f4ad2b 100644
--- a/RHEL/6/input/checks/templates/sysctl_values.csv
+++ b/RHEL/6/input/checks/templates/sysctl_values.csv
@@ -17,4 +17,5 @@ net.ipv4.icmp_ignore_bogus_error_responses,1
net.ipv4.ip_forward,0
net.ipv4.tcp_syncookies,1
net.ipv6.conf.default.accept_ra,0
+net.ipv6.conf.all.accept_ra,0
fs.suid_dumpable,0
diff --git a/RHEL/6/input/checks/templates/template_BASH_package_installed b/RHEL/6/input/checks/templates/template_BASH_package_installed
deleted file mode 100644
index 1ea466e..0000000
--- a/RHEL/6/input/checks/templates/template_BASH_package_installed
+++ /dev/null
@@ -1 +0,0 @@
-yum -y install PKGNAME
diff --git a/RHEL/6/input/checks/templates/template_OVAL_package_installed b/RHEL/6/input/checks/templates/template_OVAL_package_installed
deleted file mode 100644
index 240b2ba..0000000
--- a/RHEL/6/input/checks/templates/template_OVAL_package_installed
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_PKGNAME_installed"
- version="1">
- <metadata>
- <title>Package PKGNAME Installed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package PKGNAME should be installed.</description>
- <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
- </metadata>
- <criteria>
- <criterion comment="package PKGNAME is installed"
- test_ref="test_package_PKGNAME_installed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="all_exist"
- id="test_package_PKGNAME_installed" version="1"
- comment="package PKGNAME is installed">
- <linux:object object_ref="obj_package_PKGNAME_installed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_PKGNAME_installed" version="1">
- <linux:name>PKGNAME</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL/6/input/checks/templates/template_package_removed b/RHEL/6/input/checks/templates/template_package_removed
deleted file mode 100644
index 9f3e850..0000000
--- a/RHEL/6/input/checks/templates/template_package_removed
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
- <definition class="compliance" id="package_PKGNAME_removed"
- version="1">
- <metadata>
- <title>Package PKGNAME Removed</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The RPM package PKGNAME should be removed.</description>
- <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
- </metadata>
- <criteria>
- <criterion comment="package PKGNAME is removed"
- test_ref="test_package_PKGNAME_removed" />
- </criteria>
- </definition>
- <linux:rpminfo_test check="all" check_existence="none_exist"
- id="test_package_PKGNAME_removed" version="1"
- comment="package PKGNAME is removed">
- <linux:object object_ref="obj_package_PKGNAME_removed" />
- </linux:rpminfo_test>
- <linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
- <linux:name>PKGNAME</linux:name>
- </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL/6/input/checks/templates/template_permissions b/RHEL/6/input/checks/templates/template_permissions
deleted file mode 100644
index 9c92938..0000000
--- a/RHEL/6/input/checks/templates/template_permissions
+++ /dev/null
@@ -1,35 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_permission_checks.py. DO NOT EDIT. -->
- <definition class="compliance" id="file_permissionsFILEID" version="1">
- <metadata>
- <title>Verify FILEPATH Permissions</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If
- the target file or directory has an extended ACL then it will fail the mode check.</description>
- <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
- </metadata>
- <criteria>
- <criterion test_ref="testFILEID" />
- </criteria>
- </definition>
- <unix:file_test check="all" check_existence="all_exist" comment="FILEPATH mode and ownership" id="testFILEID" version="1">
- <unix:object object_ref="objectFILEID" />
- <unix:state state_ref="FILEID_state_uid_FILEUID" />
- <unix:state state_ref="FILEID_state_gid_FILEGID" />
- <unix:state state_ref="FILEID_state_mode_FILEMODE" />
- </unix:file_test>
- <unix:file_object comment="FILEPATH" id="objectFILEID" version="1">
- <unix:path>FILEDIR</unix:path>
- UNIX_FILENAME
- </unix:file_object>
- <unix:file_state id="FILEID_state_uid_FILEUID" version="1">
- <unix:user_id datatype="int" operation="equals">FILEUID</unix:user_id>
- </unix:file_state>
- <unix:file_state id="FILEID_state_gid_FILEGID" version="1">
- <unix:group_id datatype="int" operation="equals">FILEGID</unix:group_id>
- </unix:file_state>
- <unix:file_state id="FILEID_state_mode_FILEMODE" version="1">
-STATEMODE
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/Makefile b/RHEL/6/input/fixes/bash/templates/Makefile
deleted file mode 100644
index 33a0ed1..0000000
--- a/RHEL/6/input/fixes/bash/templates/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-templates: sysctls services kernel_modules
-
-sysctls:
- ./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv
-
-services:
- ./create_services_disabled.py ../../../checks/templates/services_disabled.csv
- ./create_services_enabled.py ../../../checks/templates/services_enabled.csv
-
-compare:
- diff output/ ../ | grep -v "Only in ../"
-
-kernel_modules:
- ./create_kernel_module_disabled.py ../../../checks/templates/kernel_modules_disabled.csv
-
-copy:
- cp output/*.sh ../
-
-clean:
- rm -f output/*.sh
diff --git a/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py b/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
deleted file mode 100755
index 3f74a8d..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_kernel_modules_disabled.py
-# automatically generate checks for disabled kernel modules
-#
-# NOTE: The file 'template_kernel_module_disabled' should be located in the
-# same working directory as this script. The template contains the following
-# tags that *must* be replaced successfully in order for the checks to work.
-#
-# KERNMODULE - the name of the kernel module that should be disabled
-#
-
-import sys, csv, re
-
-def output_checkfile(kerninfo):
- # get the items out of the list
- kernmod = kerninfo[0]
- with open("./template_kernel_module_disabled", 'r') as templatefile:
- filestring = templatefile.read()
- filestring = filestring.replace("KERNMODULE", kernmod)
- with open("./output/kernel_module_" + kernmod + "_disabled.sh", 'wb+') as outputfile:
- outputfile.write(filestring)
- outputfile.close()
-
-def main():
- if len(sys.argv) < 2:
- print "Provide a CSV file containing lines of the format: kernmod"
- sys.exit(1)
- with open(sys.argv[1], 'r') as f:
- # put the CSV line's items into a list
- lines = csv.reader(f)
- for line in lines:
- output_checkfile(line)
-
- sys.exit(0)
-
-if __name__ == "__main__":
- main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/output/.gitignore b/RHEL/6/input/fixes/bash/templates/output/.gitignore
deleted file mode 100644
index 041cc36..0000000
--- a/RHEL/6/input/fixes/bash/templates/output/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-# files to ignore
-*.sh
diff --git a/RHEL/6/input/fixes/bash/templates/support.sh b/RHEL/6/input/fixes/bash/templates/support.sh
deleted file mode 100644
index e25ce4d..0000000
--- a/RHEL/6/input/fixes/bash/templates/support.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-function populate {
-# code to populate environment variables needed (for unit testing)
-if [ -z "${!1}" ]; then
- echo "$1 is not defined. Exiting."
- exit
-fi
-}
--
1.7.1
More information about the scap-security-guide
mailing list