[PATCH 07/15] Updated RHEL6 OVAL templates

Shawn Wells shawn at redhat.com
Fri Apr 18 03:28:58 UTC 2014


-------------- next part --------------
>From 7725a1d4bffae211f4bf5359ebff584f36cb63f7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 22:05:11 -0400
Subject: [PATCH 07/15] Updated RHEL6 OVAL templates
 - Creates new checks/templates/{oval bash} directories to structure things a bit
 - removed executable bit on OVAL and bash templates
 - All tempaltes now consolidated into one place, which will make (future) template migration to shared/ easier

---
 .../input/checks/templates/bash/package_installed  |    1 +
 RHEL/6/input/checks/templates/bash/package_removed |    1 +
 RHEL/6/input/checks/templates/bash/service_enabled |    2 +-
 RHEL/6/input/checks/templates/bash/support.sh      |    9 ++++
 .../checks/templates/create_package_installed.py   |    4 +-
 .../checks/templates/create_permission_checks.py   |    4 +-
 .../input/checks/templates/oval/package_installed  |   26 +++++++++++++
 RHEL/6/input/checks/templates/oval/package_removed |   26 +++++++++++++
 RHEL/6/input/checks/templates/oval/permissions     |   35 +++++++++++++++++
 RHEL/6/input/checks/templates/sysctl_values.csv    |    1 +
 .../templates/template_BASH_package_installed      |    1 -
 .../templates/template_OVAL_package_installed      |   26 -------------
 .../checks/templates/template_package_removed      |   26 -------------
 RHEL/6/input/checks/templates/template_permissions |   35 -----------------
 RHEL/6/input/fixes/bash/templates/Makefile         |   20 ----------
 .../templates/create_kernel_module_disabled.py     |   40 --------------------
 .../6/input/fixes/bash/templates/output/.gitignore |    2 -
 RHEL/6/input/fixes/bash/templates/support.sh       |    9 ----
 18 files changed, 104 insertions(+), 164 deletions(-)
 create mode 100644 RHEL/6/input/checks/templates/bash/package_installed
 create mode 100644 RHEL/6/input/checks/templates/bash/package_removed
 create mode 100644 RHEL/6/input/checks/templates/bash/support.sh
 create mode 100644 RHEL/6/input/checks/templates/oval/package_installed
 create mode 100644 RHEL/6/input/checks/templates/oval/package_removed
 create mode 100644 RHEL/6/input/checks/templates/oval/permissions
 delete mode 100644 RHEL/6/input/checks/templates/template_BASH_package_installed
 delete mode 100644 RHEL/6/input/checks/templates/template_OVAL_package_installed
 delete mode 100644 RHEL/6/input/checks/templates/template_package_removed
 delete mode 100644 RHEL/6/input/checks/templates/template_permissions
 delete mode 100644 RHEL/6/input/fixes/bash/templates/Makefile
 delete mode 100755 RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
 delete mode 100644 RHEL/6/input/fixes/bash/templates/output/.gitignore
 delete mode 100644 RHEL/6/input/fixes/bash/templates/support.sh

diff --git a/RHEL/6/input/checks/templates/bash/package_installed b/RHEL/6/input/checks/templates/bash/package_installed
new file mode 100644
index 0000000..1ea466e
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/package_installed
@@ -0,0 +1 @@
+yum -y install PKGNAME
diff --git a/RHEL/6/input/checks/templates/bash/package_removed b/RHEL/6/input/checks/templates/bash/package_removed
new file mode 100644
index 0000000..9caa788
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/package_removed
@@ -0,0 +1 @@
+yum -y erase PKGNAME
diff --git a/RHEL/6/input/checks/templates/bash/service_enabled b/RHEL/6/input/checks/templates/bash/service_enabled
index edc1d4a..d4a1b6f 100644
--- a/RHEL/6/input/checks/templates/bash/service_enabled
+++ b/RHEL/6/input/checks/templates/bash/service_enabled
@@ -1,7 +1,7 @@
 #
 # Enable SERVICENAME for all run levels
 #
-chkconfig --level 0123456 SERVICENAME on
+chkconfig SERVICENAME on
 
 #
 # Start SERVICENAME if not currently running
diff --git a/RHEL/6/input/checks/templates/bash/support.sh b/RHEL/6/input/checks/templates/bash/support.sh
new file mode 100644
index 0000000..e25ce4d
--- /dev/null
+++ b/RHEL/6/input/checks/templates/bash/support.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+function populate {
+# code to populate environment variables needed (for unit testing)
+if [ -z "${!1}" ]; then
+	echo "$1 is not defined. Exiting."
+	exit
+fi
+}
diff --git a/RHEL/6/input/checks/templates/create_package_installed.py b/RHEL/6/input/checks/templates/create_package_installed.py
index b32e18c..9af30d3 100755
--- a/RHEL/6/input/checks/templates/create_package_installed.py
+++ b/RHEL/6/input/checks/templates/create_package_installed.py
@@ -15,13 +15,13 @@ import sys, csv, re
 def output_check(package_info):
     pkgname = package_info[0]
     if pkgname:
-        with open("./template_OVAL_package_installed", 'r') as OVALtemplatefile:
+        with open("./oval/package_installed", 'r') as OVALtemplatefile:
             filestring = OVALtemplatefile.read()
             filestring = filestring.replace("PKGNAME", pkgname)
             with open("./output/package_" + pkgname + "_installed.xml", 'wb+') as OVALoutputfile:
                 OVALoutputfile.write(filestring)
                 OVALoutputfile.close()
-	with open("./template_BASH_package_installed", 'r') as BASHtemplatefile:
+	with open("./bash/package_installed", 'r') as BASHtemplatefile:
 		filestring = BASHtemplatefile.read()
 		filestring = filestring.replace("PKGNAME", pkgname)
 		with open("./output/package_" + pkgname + "_installed.sh", 'wb+') as BASHoutputfile:
diff --git a/RHEL/6/input/checks/templates/create_permission_checks.py b/RHEL/6/input/checks/templates/create_permission_checks.py
index 70222fb..02d5904 100755
--- a/RHEL/6/input/checks/templates/create_permission_checks.py
+++ b/RHEL/6/input/checks/templates/create_permission_checks.py
@@ -4,7 +4,7 @@
 # create_permission_checks.py
 #	generate template-based checks for file permissions/ownership
 #
-# NOTE: The file 'template_permissions' should be located in the same working directory as this script. The
+# NOTE: The file 'oval/permissions' should be located in the same working directory as this script. The
 # template contains tags that *must* be replaced successfully in order for the checks to work.
 #
 #	  directory path,file name,owner uid (numeric),group owner gid (numeric),mode
@@ -45,7 +45,7 @@ def output_check(path_info):
 
 	# we are ready to create the check
 	# open the template and perform the conversions
-	with open("./template_permissions", 'r') as templatefile:
+	with open("./oval/permissions", 'r') as templatefile:
 		# replace the placeholders within the template with the actual values
 		filestring = templatefile.read()
 		filestring = filestring.replace("FILEID", path_id)
diff --git a/RHEL/6/input/checks/templates/oval/package_installed b/RHEL/6/input/checks/templates/oval/package_installed
new file mode 100644
index 0000000..240b2ba
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/package_installed
@@ -0,0 +1,26 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_PKGNAME_installed"
+  version="1">
+    <metadata>
+      <title>Package PKGNAME Installed</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The RPM package PKGNAME should be installed.</description>
+      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
+    </metadata>
+    <criteria>
+      <criterion comment="package PKGNAME is installed"
+      test_ref="test_package_PKGNAME_installed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="all_exist"
+  id="test_package_PKGNAME_installed" version="1"
+  comment="package PKGNAME is installed">
+    <linux:object object_ref="obj_package_PKGNAME_installed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_PKGNAME_installed" version="1">
+    <linux:name>PKGNAME</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/oval/package_removed b/RHEL/6/input/checks/templates/oval/package_removed
new file mode 100644
index 0000000..9f3e850
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/package_removed
@@ -0,0 +1,26 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_PKGNAME_removed"
+  version="1">
+    <metadata>
+      <title>Package PKGNAME Removed</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The RPM package PKGNAME should be removed.</description>
+      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
+    </metadata>
+    <criteria>
+      <criterion comment="package PKGNAME is removed"
+      test_ref="test_package_PKGNAME_removed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="none_exist"
+  id="test_package_PKGNAME_removed" version="1"
+  comment="package PKGNAME is removed">
+    <linux:object object_ref="obj_package_PKGNAME_removed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
+    <linux:name>PKGNAME</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/RHEL/6/input/checks/templates/oval/permissions b/RHEL/6/input/checks/templates/oval/permissions
new file mode 100644
index 0000000..9c92938
--- /dev/null
+++ b/RHEL/6/input/checks/templates/oval/permissions
@@ -0,0 +1,35 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="file_permissionsFILEID" version="1">
+    <metadata>
+      <title>Verify FILEPATH Permissions</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If
+      the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
+    </metadata>
+    <criteria>
+      <criterion test_ref="testFILEID" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist" comment="FILEPATH mode and ownership" id="testFILEID" version="1">
+    <unix:object object_ref="objectFILEID" />
+    <unix:state state_ref="FILEID_state_uid_FILEUID" />
+    <unix:state state_ref="FILEID_state_gid_FILEGID" />
+    <unix:state state_ref="FILEID_state_mode_FILEMODE" />
+  </unix:file_test>
+  <unix:file_object comment="FILEPATH" id="objectFILEID" version="1">
+    <unix:path>FILEDIR</unix:path>
+    UNIX_FILENAME
+  </unix:file_object>
+  <unix:file_state id="FILEID_state_uid_FILEUID" version="1">
+    <unix:user_id datatype="int" operation="equals">FILEUID</unix:user_id>
+  </unix:file_state>
+  <unix:file_state id="FILEID_state_gid_FILEGID" version="1">
+    <unix:group_id datatype="int" operation="equals">FILEGID</unix:group_id>
+  </unix:file_state>
+  <unix:file_state id="FILEID_state_mode_FILEMODE" version="1">
+STATEMODE
+</def-group>
diff --git a/RHEL/6/input/checks/templates/sysctl_values.csv b/RHEL/6/input/checks/templates/sysctl_values.csv
index 2123847..3f4ad2b 100644
--- a/RHEL/6/input/checks/templates/sysctl_values.csv
+++ b/RHEL/6/input/checks/templates/sysctl_values.csv
@@ -17,4 +17,5 @@ net.ipv4.icmp_ignore_bogus_error_responses,1
 net.ipv4.ip_forward,0
 net.ipv4.tcp_syncookies,1
 net.ipv6.conf.default.accept_ra,0
+net.ipv6.conf.all.accept_ra,0
 fs.suid_dumpable,0
diff --git a/RHEL/6/input/checks/templates/template_BASH_package_installed b/RHEL/6/input/checks/templates/template_BASH_package_installed
deleted file mode 100644
index 1ea466e..0000000
--- a/RHEL/6/input/checks/templates/template_BASH_package_installed
+++ /dev/null
@@ -1 +0,0 @@
-yum -y install PKGNAME
diff --git a/RHEL/6/input/checks/templates/template_OVAL_package_installed b/RHEL/6/input/checks/templates/template_OVAL_package_installed
deleted file mode 100644
index 240b2ba..0000000
--- a/RHEL/6/input/checks/templates/template_OVAL_package_installed
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_PKGNAME_installed"
-  version="1">
-    <metadata>
-      <title>Package PKGNAME Installed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package PKGNAME should be installed.</description>
-      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
-    </metadata>
-    <criteria>
-      <criterion comment="package PKGNAME is installed"
-      test_ref="test_package_PKGNAME_installed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="all_exist"
-  id="test_package_PKGNAME_installed" version="1"
-  comment="package PKGNAME is installed">
-    <linux:object object_ref="obj_package_PKGNAME_installed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_PKGNAME_installed" version="1">
-    <linux:name>PKGNAME</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL/6/input/checks/templates/template_package_removed b/RHEL/6/input/checks/templates/template_package_removed
deleted file mode 100644
index 9f3e850..0000000
--- a/RHEL/6/input/checks/templates/template_package_removed
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_PKGNAME_removed"
-  version="1">
-    <metadata>
-      <title>Package PKGNAME Removed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package PKGNAME should be removed.</description>
-      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
-    </metadata>
-    <criteria>
-      <criterion comment="package PKGNAME is removed"
-      test_ref="test_package_PKGNAME_removed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="none_exist"
-  id="test_package_PKGNAME_removed" version="1"
-  comment="package PKGNAME is removed">
-    <linux:object object_ref="obj_package_PKGNAME_removed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
-    <linux:name>PKGNAME</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL/6/input/checks/templates/template_permissions b/RHEL/6/input/checks/templates/template_permissions
deleted file mode 100644
index 9c92938..0000000
--- a/RHEL/6/input/checks/templates/template_permissions
+++ /dev/null
@@ -1,35 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="file_permissionsFILEID" version="1">
-    <metadata>
-      <title>Verify FILEPATH Permissions</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If
-      the target file or directory has an extended ACL then it will fail the mode check.</description>
-      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
-    </metadata>
-    <criteria>
-      <criterion test_ref="testFILEID" />
-    </criteria>
-  </definition>
-  <unix:file_test check="all" check_existence="all_exist" comment="FILEPATH mode and ownership" id="testFILEID" version="1">
-    <unix:object object_ref="objectFILEID" />
-    <unix:state state_ref="FILEID_state_uid_FILEUID" />
-    <unix:state state_ref="FILEID_state_gid_FILEGID" />
-    <unix:state state_ref="FILEID_state_mode_FILEMODE" />
-  </unix:file_test>
-  <unix:file_object comment="FILEPATH" id="objectFILEID" version="1">
-    <unix:path>FILEDIR</unix:path>
-    UNIX_FILENAME
-  </unix:file_object>
-  <unix:file_state id="FILEID_state_uid_FILEUID" version="1">
-    <unix:user_id datatype="int" operation="equals">FILEUID</unix:user_id>
-  </unix:file_state>
-  <unix:file_state id="FILEID_state_gid_FILEGID" version="1">
-    <unix:group_id datatype="int" operation="equals">FILEGID</unix:group_id>
-  </unix:file_state>
-  <unix:file_state id="FILEID_state_mode_FILEMODE" version="1">
-STATEMODE
-</def-group>
diff --git a/RHEL/6/input/fixes/bash/templates/Makefile b/RHEL/6/input/fixes/bash/templates/Makefile
deleted file mode 100644
index 33a0ed1..0000000
--- a/RHEL/6/input/fixes/bash/templates/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-templates: sysctls services kernel_modules
-
-sysctls:
-	./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv
-
-services:
-	./create_services_disabled.py ../../../checks/templates/services_disabled.csv
-	./create_services_enabled.py ../../../checks/templates/services_enabled.csv
-	
-compare:
-	diff output/ ../ | grep -v "Only in ../"
-
-kernel_modules:
-	./create_kernel_module_disabled.py ../../../checks/templates/kernel_modules_disabled.csv
-
-copy:
-	cp output/*.sh ../
-
-clean:
-	rm -f output/*.sh
diff --git a/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py b/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
deleted file mode 100755
index 3f74a8d..0000000
--- a/RHEL/6/input/fixes/bash/templates/create_kernel_module_disabled.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/python
-
-#
-# create_kernel_modules_disabled.py
-#   automatically generate checks for disabled kernel modules
-#
-# NOTE: The file 'template_kernel_module_disabled' should be located in the
-# same working directory as this script. The template contains the following
-# tags that *must* be replaced successfully in order for the checks to work.
-#
-# KERNMODULE - the name of the kernel module that should be disabled
-#
-
-import sys, csv, re
-
-def output_checkfile(kerninfo):
-    # get the items out of the list
-    kernmod = kerninfo[0]
-    with open("./template_kernel_module_disabled", 'r') as templatefile:
-        filestring = templatefile.read()
-        filestring = filestring.replace("KERNMODULE", kernmod)
-        with open("./output/kernel_module_" + kernmod + "_disabled.sh", 'wb+') as outputfile:
-            outputfile.write(filestring)
-            outputfile.close()
-
-def main():
-    if len(sys.argv) < 2:
-        print "Provide a CSV file containing lines of the format: kernmod"
-        sys.exit(1)
-    with open(sys.argv[1], 'r') as f:
-        # put the CSV line's items into a list
-        lines = csv.reader(f)
-        for line in lines:
-            output_checkfile(line)
-
-    sys.exit(0)
-
-if __name__ == "__main__":
-    main()
-
diff --git a/RHEL/6/input/fixes/bash/templates/output/.gitignore b/RHEL/6/input/fixes/bash/templates/output/.gitignore
deleted file mode 100644
index 041cc36..0000000
--- a/RHEL/6/input/fixes/bash/templates/output/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-# files to ignore
-*.sh
diff --git a/RHEL/6/input/fixes/bash/templates/support.sh b/RHEL/6/input/fixes/bash/templates/support.sh
deleted file mode 100644
index e25ce4d..0000000
--- a/RHEL/6/input/fixes/bash/templates/support.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-function populate {
-# code to populate environment variables needed (for unit testing)
-if [ -z "${!1}" ]; then
-	echo "$1 is not defined. Exiting."
-	exit
-fi
-}
-- 
1.7.1



More information about the scap-security-guide mailing list