[PATCH] [RHEL/6] [RHEL/7] [shared] When checking for static IP address configuration in network scripts allow BOOTPROTO to match also "none" (since that's what system-config-network / nm-connection-editor do when creating static IP connection)

Shawn Wells shawn at redhat.com
Fri May 30 15:55:52 UTC 2014


On 5/30/14, 9:51 AM, Jan Lieskovsky wrote:
> As noted in:
>    [1]https://github.com/cobbler/cobbler/issues/361
>    [2]https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-networkscripts-interfaces.html
>
> BOOTPROTO variable in /etc/sysconfig/network-scripts can have just one of (none|bootp|dhcp) values.
>
> Initscripts knowns also only these three:
>    [3]https://git.fedorahosted.org/cgit/initscripts.git/tree/sysconfig.txt
>
> meaning when 'bootp' or 'dhcp' options are used, the DHCP client is run on the device. Any other
> option is dealt with / considered to mean static configuration.
>
> When system-config-network / system-config-network-tui / nm-connection-editor creates new connection
> with static IP configuration, it uses BOOTPROTO=none in the particular /etc/sysconfig/network-scripts/ifcfg-conn-name
> script (can be verified by creating sample connection).
>
> Based on bug:
>    [4]https://bugzilla.redhat.com/show_bug.cgi?id=528068
>
> and resulting patch:
>    [5]http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c31b3e455414a5a7bf57d9fed1442367e9e4c917
>
> NetworkManager (starting from NetworkManager-0.7.996-5.git20091021.fc12) treats BOOTPROTO=static as an
> alias for BOOTPROTO=none (doesn't complain when 'static' is used as BOOTPROTO specification).
>
> But since RHEL-6 Deployment guide [2] and initscripts code [3] know / suggest use of 'none', enhance
> the sysconfig_networking_bootproto_ifcfg OVAL check to allow test success also in case 'none' is used
> as BOOTPROTO specification (since that actually is what is used, when new static IP using connection
> is created e.g. via system-config-network or nm-connection-editor).
>
> Besides that (support also for 'none' in BOOTPROTO specification), the patch starts to recommend to use
> 'none' on appropriate places (RHEL/6, RHEL/7 XCCDF rules description, stig reference) & moves originally
> RHEL-6 specific sysconfig_networking_bootproto_ifcfg OVAL check to be shared one.
>
> The change has been tested on both of RHEL/6 & RHEL/7, rpm(s) build correctly, the change seems to be
> working as expected (on both products).
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-RHEL-6-When-checking-for-static-IP-address-configura.patch
>
>
>  From 31ea21e1fa0cdf75f26dafc50c409cbcedb4ef16 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Fri, 30 May 2014 15:31:30 +0200
> Subject: [PATCH] [RHEL/6] When checking for static IP address configuration,
>   check also for BOOTPROTO=none          in network-scripts (since that's what
>   system-config-network or nm-connection-editor          creates when
>   requesting static IP configuration for connection) [RHEL/7] Update
>   sysconfig_networking_bootproto_ifcfg rule to recommend BOOTPROTO=none instead
>            of BOOTPROTO=static [shared] Move RHEL-6
>   sysconfig_networking_bootproto_ifcfg specific check to be shared one
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   .../sysconfig_networking_bootproto_ifcfg.xml       | 35 +---------------------
>   RHEL/6/input/services/dhcp.xml                     |  4 +--
>   .../sysconfig_networking_bootproto_ifcfg.xml       |  1 +
>   RHEL/7/input/services/dhcp.xml                     |  4 +--
>   .../oval/sysconfig_networking_bootproto_ifcfg.xml  | 35 ++++++++++++++++++++++
>   .../disa-stig-rhel5-v1r0.6-xccdf-manual.xml        |  2 +-
>   6 files changed, 42 insertions(+), 39 deletions(-)
>   mode change 100644 => 120000 RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml
>   create mode 120000 RHEL/7/input/checks/sysconfig_networking_bootproto_ifcfg.xml
>   create mode 100644 shared/oval/sysconfig_networking_bootproto_ifcfg.xml
>
> diff --git a/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml b/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> deleted file mode 100644
> index 6d2237e..0000000
> --- a/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> +++ /dev/null
> @@ -1,34 +0,0 @@
> -<def-group>
> -  <definition class="compliance" id="sysconfig_networking_bootproto_ifcfg"
> -  version="1">
> -    <metadata>
> -      <title>Disable DHCP Client</title>
> -      <affected family="unix">
> -        <platform>Red Hat Enterprise Linux 6</platform>
> -      </affected>
> -      <description>DHCP configuration should be static for all
> -      interfaces.</description>
> -      <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> -    </metadata>
> -    <criteria comment="Test for BOOTPROTO=static across all interfaces">
> -      <criterion test_ref="test_sysconfig_networking_bootproto_ifcfg" />
> -    </criteria>
> -  </definition>
> -  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> -  comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file"
> -  id="test_sysconfig_networking_bootproto_ifcfg" version="1">
> -    <ind:object object_ref="obj_sysconfig_networking_bootproto_ifcfg" />
> -    <ind:state state_ref="state_sysconfig_networking_bootproto_ifcfg" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_state id="state_sysconfig_networking_bootproto_ifcfg"
> -  version="1">
> -    <ind:subexpression operation="equals">static</ind:subexpression>
> -  </ind:textfilecontent54_state>
> -  <ind:textfilecontent54_object id="obj_sysconfig_networking_bootproto_ifcfg"
> -  version="1">
> -    <ind:path>/etc/sysconfig/network-scripts</ind:path>
> -    <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
> -    <ind:pattern operation="pattern match">^[\s]*BOOTPROTO[\s]*=[\s"]*([^#"\s]*)</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -</def-group>
> diff --git a/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml b/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> new file mode 120000
> index 0000000..a118ae3
> --- /dev/null
> +++ b/RHEL/6/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/sysconfig_networking_bootproto_ifcfg.xml
> \ No newline at end of file
> diff --git a/RHEL/6/input/services/dhcp.xml b/RHEL/6/input/services/dhcp.xml
> index 38d9770..4f64ed0 100644
> --- a/RHEL/6/input/services/dhcp.xml
> +++ b/RHEL/6/input/services/dhcp.xml
> @@ -192,7 +192,7 @@ For each interface on the system (e.g. eth0), edit
>   following changes:
>   <ul>
>   <li> Correct the BOOTPROTO line to read:
> -<pre>BOOTPROTO=static</pre>
> +<pre>BOOTPROTO=none</pre>
>   </li>
>   <li> Add or correct the following lines, substituting the appropriate
>   values based on your site's addressing scheme:
> @@ -206,7 +206,7 @@ GATEWAY=192.168.1.1</pre>
>   To verify that DHCP is not being used, examine the following file for each interface:
>   <pre># /etc/sysconfig/network-scripts/ifcfg-<i>interface</i></pre>
>   Look for the following:
> -<pre>BOOTPROTO=static</pre>
> +<pre>BOOTPROTO=none</pre>
>   and the following, substituting the appropriate values based on your site's addressing scheme:
>   <pre>NETMASK=255.255.255.0
>   IPADDR=192.168.1.2
> diff --git a/RHEL/7/input/checks/sysconfig_networking_bootproto_ifcfg.xml b/RHEL/7/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> new file mode 120000
> index 0000000..a118ae3
> --- /dev/null
> +++ b/RHEL/7/input/checks/sysconfig_networking_bootproto_ifcfg.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/sysconfig_networking_bootproto_ifcfg.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/services/dhcp.xml b/RHEL/7/input/services/dhcp.xml
> index 4c2bab7..997e550 100644
> --- a/RHEL/7/input/services/dhcp.xml
> +++ b/RHEL/7/input/services/dhcp.xml
> @@ -192,7 +192,7 @@ For each interface on the system (e.g. eth0), edit
>   following changes:
>   <ul>
>   <li> Correct the BOOTPROTO line to read:
> -<pre>BOOTPROTO=static</pre>
> +<pre>BOOTPROTO=none</pre>
>   </li>
>   <li> Add or correct the following lines, substituting the appropriate
>   values based on your site's addressing scheme:
> @@ -206,7 +206,7 @@ GATEWAY=192.168.1.1</pre>
>   To verify that DHCP is not being used, examine the following file for each interface:
>   <pre># /etc/sysconfig/network-scripts/ifcfg-<i>interface</i></pre>
>   Look for the following:
> -<pre>BOOTPROTO=static</pre>
> +<pre>BOOTPROTO=none</pre>
>   and the following, substituting the appropriate values based on your site's addressing scheme:
>   <pre>NETMASK=255.255.255.0
>   IPADDR=192.168.1.2
> diff --git a/shared/oval/sysconfig_networking_bootproto_ifcfg.xml b/shared/oval/sysconfig_networking_bootproto_ifcfg.xml
> new file mode 100644
> index 0000000..a597307
> --- /dev/null
> +++ b/shared/oval/sysconfig_networking_bootproto_ifcfg.xml
> @@ -0,0 +1,35 @@
> +<def-group>
> +  <definition class="compliance" id="sysconfig_networking_bootproto_ifcfg"
> +  version="2">
> +    <metadata>
> +      <title>Disable DHCP Client</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +        <platform>Red Hat Enterprise Linux 7</platform>
> +      </affected>
> +      <description>DHCP configuration should be static for all
> +      interfaces.</description>
> +      <reference source="JL" ref_id="20140530" ref_url="test_attestation" />
> +    </metadata>
> +    <criteria comment="Test for BOOTPROTO=(static|none) across all interfaces">
> +      <criterion test_ref="test_sysconfig_networking_bootproto_ifcfg" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> +  comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file"
> +  id="test_sysconfig_networking_bootproto_ifcfg" version="1">
> +    <ind:object object_ref="obj_sysconfig_networking_bootproto_ifcfg" />
> +    <ind:state state_ref="state_sysconfig_networking_bootproto_ifcfg" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_sysconfig_networking_bootproto_ifcfg"
> +  version="2">
> +    <ind:subexpression operation="pattern match">^(static|none)$</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="obj_sysconfig_networking_bootproto_ifcfg"
> +  version="1">
> +    <ind:path>/etc/sysconfig/network-scripts</ind:path>
> +    <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]*BOOTPROTO[\s]*=[\s"]*([^#"\s]*)</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/shared/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml b/shared/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
> index 4a0b8a4..8de9c0c 100644
> --- a/shared/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
> +++ b/shared/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
> @@ -17571,7 +17571,7 @@ xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1  http://nvd.nist.gov/sch
>           <dc:identifier>2154</dc:identifier>
>         </reference>
>         <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
> -      <fixtext fixref="F-24173r1_fix">Edit the "/etc/sysconfig/network-scripts/ifcfg-*" file(s) and change the "bootproto" setting to "static".</fixtext>
> +      <fixtext fixref="F-24173r1_fix">Edit the "/etc/sysconfig/network-scripts/ifcfg-*" file(s) and change the "bootproto" setting to "none".</fixtext>
>         <fix id="F-24173r1_fix" />
>         <check system="C-36811r1_chk">
>           <check-content-ref name="M" href="VMS_XCCDF_Benchmark_RHEL_5_STIG.xml" />
> -- 1.8.3.1

Absolutely the right call for OVAL to reflect static|none regex, while 
XCCDF updated for only none. Ack to those pieces.

  The disa-stig-rhel5-v1r0.6-xccdf-manual.xml file should remain 
unchanged (it's a referencable copy of the actual RHEL5 STIG, not 
something SSG generates/manipulates directly).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140530/a1ff590f/attachment.html>


More information about the scap-security-guide mailing list