|
 |
7629ac |
From fde8c630799aee5339076355be0812b64f89c733 Mon Sep 17 00:00:00 2001
|
|
|
7629ac |
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
|
|
7629ac |
Date: Tue, 11 Sep 2018 10:27:48 +0200
|
|
|
7629ac |
Subject: [PATCH 1/3] Add bash for rule grub2_audit_argument
|
|
|
7629ac |
|
|
|
7629ac |
---
|
|
|
7629ac |
.../auditing/grub2_audit_argument/bash/shared.sh | 13 +++++++++++++
|
|
|
7629ac |
1 file changed, 13 insertions(+)
|
|
|
7629ac |
create mode 100644 shared/fixes/bash/grub2_audit_argument.sh
|
|
|
7629ac |
|
|
|
7629ac |
diff --git a/shared/fixes/bash/grub2_audit_argument.sh b/shared/fixes/bash/grub2_audit_argument.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..913ebd6788
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/shared/fixes/bash/grub2_audit_argument.sh
|
|
|
7629ac |
@@ -0,0 +1,13 @@
|
|
|
7629ac |
+# platform = Red Hat Enterprise Linux 7, multi_platform_fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
+ # modify the GRUB command-line if an audit= arg already exists
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 audit=1 \2/' '/etc/default/grub'
|
|
|
7629ac |
+else
|
|
|
7629ac |
+ # no audit=arg is present, append it
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 audit=1"/' '/etc/default/grub'
|
|
|
7629ac |
+fi
|
|
|
7629ac |
+
|
|
|
7629ac |
+# Correct the form of kernel command line for each installed kernel in the bootloader
|
|
|
7629ac |
+grubby --update-kernel=ALL --args="audit=1"
|
|
|
7629ac |
|
|
|
7629ac |
From 3cb4d82b850c6b8a29a449a68ce30254508a6fd6 Mon Sep 17 00:00:00 2001
|
|
|
7629ac |
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
|
|
7629ac |
Date: Tue, 11 Sep 2018 10:28:15 +0200
|
|
|
7629ac |
Subject: [PATCH 2/3] Add tests for grub2_audit_argument
|
|
|
7629ac |
|
|
|
7629ac |
---
|
|
|
7629ac |
.../rule_grub2_audit_argument/arg_not_there.fail.sh | 9 +++++++++
|
|
|
7629ac |
.../rule_grub2_audit_argument/correct_value.pass.sh | 11 +++++++++++
|
|
|
7629ac |
.../rule_grub2_audit_argument/wrong_value.fail.sh | 11 +++++++++++
|
|
|
7629ac |
3 files changed, 31 insertions(+)
|
|
|
7629ac |
create mode 100644 tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
create mode 100644 tests/data/group_system/group_auditing/rule_grub2_audit_argument/correct_value.pass.sh
|
|
|
7629ac |
create mode 100644 tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..04f07457b0
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
@@ -0,0 +1,9 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
+ # Remove the audit arg from the GRUB command-line if an audit arg already exists
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 \2/' '/etc/default/grub'
|
|
|
7629ac |
+fi
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/correct_value.pass.sh b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/correct_value.pass.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..320d979a9b
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/correct_value.pass.sh
|
|
|
7629ac |
@@ -0,0 +1,11 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
+ # modify the GRUB command-line if an audit= arg already exists
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 audit=1 \2/' '/etc/default/grub'
|
|
|
7629ac |
+else
|
|
|
7629ac |
+ # no audit=arg is present, append it
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 audit=1"/' '/etc/default/grub'
|
|
|
7629ac |
+fi
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..4c3ce2c723
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
@@ -0,0 +1,11 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
+ # modify the GRUB command-line if an audit= arg already exists
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 audit=0 \2/' '/etc/default/grub'
|
|
|
7629ac |
+else
|
|
|
7629ac |
+ # no audit=arg is present, append it
|
|
|
7629ac |
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 audit=0"/' '/etc/default/grub'
|
|
|
7629ac |
+fi
|
|
|
7629ac |
|
|
|
7629ac |
From b0cf50b476bd626b7cbf60e18726e02a6282f977 Mon Sep 17 00:00:00 2001
|
|
|
7629ac |
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
|
|
7629ac |
Date: Tue, 11 Sep 2018 13:10:16 +0200
|
|
|
7629ac |
Subject: [PATCH 3/3] Improve comments
|
|
|
7629ac |
|
|
|
7629ac |
---
|
|
|
7629ac |
.../rule_grub2_audit_argument/arg_not_there.fail.sh | 3 +--
|
|
|
7629ac |
.../rule_grub2_audit_argument/wrong_value.fail.sh | 2 +-
|
|
|
7629ac |
2 files changed, 2 insertions(+), 3 deletions(-)
|
|
|
7629ac |
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
index 04f07457b0..0230da8045 100644
|
|
|
7629ac |
--- a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/arg_not_there.fail.sh
|
|
|
7629ac |
@@ -2,8 +2,7 @@
|
|
|
7629ac |
|
|
|
7629ac |
# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
|
|
|
7629ac |
-# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+# Removes audit argument from kernel command line
|
|
|
7629ac |
if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
- # Remove the audit arg from the GRUB command-line if an audit arg already exists
|
|
|
7629ac |
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 \2/' '/etc/default/grub'
|
|
|
7629ac |
fi
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
index 4c3ce2c723..21dc897d4a 100644
|
|
|
7629ac |
--- a/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/rule_grub2_audit_argument/wrong_value.fail.sh
|
|
|
7629ac |
@@ -1,7 +1,7 @@
|
|
|
7629ac |
#!/bin/bash
|
|
|
7629ac |
# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
|
|
|
7629ac |
-# Correct the form of default kernel command line in GRUB
|
|
|
7629ac |
+# Break the audit argument in kernel command line
|
|
|
7629ac |
if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"' '/etc/default/grub' ; then
|
|
|
7629ac |
# modify the GRUB command-line if an audit= arg already exists
|
|
|
7629ac |
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 audit=0 \2/' '/etc/default/grub'
|