From a5281d8361dd26217e6ee1c97d5beaae02af34bc Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 26 May 2020 17:49:21 +0200 Subject: [PATCH 1/2] Create macro for selinux ansible/bash remediation. Affected rules: - selinux_policytype - selinux_state --- .../selinux/selinux_policytype/ansible/shared.yml | 9 ++------- .../selinux/selinux_policytype/bash/shared.sh | 5 +++-- .../tests/selinuxtype_minimum.fail.sh | 10 ++++++++++ .../selinux/selinux_state/ansible/shared.yml | 9 ++------- .../system/selinux/selinux_state/bash/shared.sh | 5 +++-- .../selinux_state/tests/selinux_missing.fail.sh | 5 +++++ .../tests/selinux_permissive.fail.sh | 10 ++++++++++ shared/macros-ansible.jinja | 11 +++++++++++ shared/macros-bash.jinja | 15 +++++++++++++++ 9 files changed, 61 insertions(+), 18 deletions(-) create mode 100644 linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh create mode 100644 linux_os/guide/system/selinux/selinux_state/tests/selinux_missing.fail.sh create mode 100644 linux_os/guide/system/selinux/selinux_state/tests/selinux_permissive.fail.sh diff --git a/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml b/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml index 5c70cc9f7f..9f8cf66dfb 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml +++ b/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml @@ -3,11 +3,6 @@ # strategy = restrict # complexity = low # disruption = low - (xccdf-var var_selinux_policy_name) -- name: "{{{ rule_title }}}" - lineinfile: - path: /etc/sysconfig/selinux - regexp: '^SELINUXTYPE=' - line: "SELINUXTYPE={{ var_selinux_policy_name }}" - create: yes +{{{ ansible_selinux_config_set(parameter="SELINUXTYPE", value="{{ var_selinux_policy_name }}") }}} diff --git a/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh b/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh index d0fbbf4446..2b5ce31b12 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh +++ b/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh @@ -1,7 +1,8 @@ # platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -# + # Include source function library. . /usr/share/scap-security-guide/remediation_functions + populate var_selinux_policy_name -replace_or_append '/etc/sysconfig/selinux' '^SELINUXTYPE=' $var_selinux_policy_name '@CCENUM@' '%s=%s' +{{{ bash_selinux_config_set(parameter="SELINUXTYPE", value="$var_selinux_policy_name") }}} diff --git a/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh b/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh new file mode 100644 index 0000000000..1a6eb94953 --- /dev/null +++ b/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_C2S, xccdf_org.ssgproject.content_profile_ospp + +SELINUX_FILE='/etc/selinux/config' + +if grep -s '^[[:space:]]*SELINUXTYPE' $SELINUX_FILE; then + sed -i 's/^\([[:space:]]*SELINUXTYPE[[:space:]]*=[[:space:]]*\).*/\minimum/' $SELINUX_FILE +else + echo 'SELINUXTYPE=minimum' >> $SELINUX_FILE +fi diff --git a/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml b/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml index b465ac6729..1c1560a86c 100644 --- a/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml +++ b/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml @@ -3,11 +3,6 @@ # strategy = restrict # complexity = low # disruption = low - (xccdf-var var_selinux_state) -- name: "{{{ rule_title }}}" - lineinfile: - path: /etc/sysconfig/selinux - regexp: '^SELINUX=' - line: "SELINUX={{ var_selinux_state }}" - create: yes +{{{ ansible_selinux_config_set(parameter="SELINUX", value="{{ var_selinux_state }}") }}} diff --git a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh index 58193b5504..a402a861d7 100644 --- a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh +++ b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh @@ -1,10 +1,11 @@ # platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platorm_ol,multi_platform_rhv -# + # Include source function library. . /usr/share/scap-security-guide/remediation_functions + populate var_selinux_state -replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s' +{{{ bash_selinux_config_set(parameter="SELINUX", value="$var_selinux_state") }}} fixfiles onboot fixfiles -f relabel diff --git a/linux_os/guide/system/selinux/selinux_state/tests/selinux_missing.fail.sh b/linux_os/guide/system/selinux/selinux_state/tests/selinux_missing.fail.sh new file mode 100644 index 0000000000..180dd80791 --- /dev/null +++ b/linux_os/guide/system/selinux/selinux_state/tests/selinux_missing.fail.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_C2S, xccdf_org.ssgproject.content_profile_ospp + +SELINUX_FILE='/etc/selinux/config' +sed -i '/^[[:space:]]*SELINUX/d' $SELINUX_FILE diff --git a/linux_os/guide/system/selinux/selinux_state/tests/selinux_permissive.fail.sh b/linux_os/guide/system/selinux/selinux_state/tests/selinux_permissive.fail.sh new file mode 100644 index 0000000000..3db1e56b5f --- /dev/null +++ b/linux_os/guide/system/selinux/selinux_state/tests/selinux_permissive.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_C2S, xccdf_org.ssgproject.content_profile_ospp + +SELINUX_FILE='/etc/selinux/config' + +if grep -s '^[[:space:]]*SELINUX' $SELINUX_FILE; then + sed -i 's/^\([[:space:]]*SELINUX[[:space:]]*=[[:space:]]*\).*/\permissive/' $SELINUX_FILE +else + echo 'SELINUX=permissive' >> $SELINUX_FILE +fi diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 6798a25d1f..01d3155b37 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -217,6 +217,17 @@ value: "Setting={{ varname1 }}" {{{ ansible_set_config_file(msg, "/etc/systemd/coredump.conf", parameter=parameter, value=value, create="no", separator="=", separator_regex="\s*=\s*") }}} {{%- endmacro %}} +{{# + High level macro to set a parameter in /etc/selinux/config. + Parameters: + - msg: the name for the Ansible task + - parameter: parameter to be set in the configuration file + - value: value of the parameter +#}} +{{%- macro ansible_selinux_config_set(msg='', parameter='', value='') %}} +{{{ ansible_set_config_file(msg, "/etc/selinux/config", parameter=parameter, value=value, create="no", separator="=", separator_regex="\s*=\s*") }}} +{{%- endmacro %}} + {{# Generates an Ansible task that puts 'contents' into a file at 'filepath' Parameters: diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja index 3a94fe5dd8..2531d1c52d 100644 --- a/shared/macros-bash.jinja +++ b/shared/macros-bash.jinja @@ -86,6 +86,21 @@ populate {{{ name }}} }}} {{%- endmacro -%}} +{{%- macro bash_selinux_config_set(parameter, value) -%}} +{{{ set_config_file( + path="/etc/selinux/config", + parameter=parameter, + value=value, + create=true, + insert_after="", + insert_before="", + insensitive=true, + separator="=", + separator_regex="\s*=\s*", + prefix_regex="^\s*") + }}} +{{%- endmacro -%}} + {{# # Install a package # Uses the right command based on pkg_manger proprerty defined in product.yaml. From 24c3c92007e6d3f8a684282b1351703523441389 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Wed, 27 May 2020 18:48:57 +0200 Subject: [PATCH 2/2] Remediation requires reboot. Update OVAL check to disallow spaces. Removed selinuxtype_minimum test scenario since breaks the system. --- .../selinux/selinux_policytype/ansible/shared.yml | 2 +- .../system/selinux/selinux_policytype/bash/shared.sh | 4 ++++ .../system/selinux/selinux_policytype/oval/shared.xml | 2 +- .../tests/selinuxtype_minimum.fail.sh | 10 ---------- .../guide/system/selinux/selinux_state/bash/shared.sh | 4 ++++ .../guide/system/selinux/selinux_state/oval/shared.xml | 2 +- shared/macros-ansible.jinja | 2 +- shared/macros-bash.jinja | 4 ++-- 8 files changed, 14 insertions(+), 16 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh diff --git a/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml b/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml index 9f8cf66dfb..73e6ec7cd4 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml +++ b/linux_os/guide/system/selinux/selinux_policytype/ansible/shared.yml @@ -1,5 +1,5 @@ # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -# reboot = false +# reboot = true # strategy = restrict # complexity = low # disruption = low diff --git a/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh b/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh index 2b5ce31b12..b4f79c97f9 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh +++ b/linux_os/guide/system/selinux/selinux_policytype/bash/shared.sh @@ -1,4 +1,8 @@ # platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +# reboot = true +# strategy = restrict +# complexity = low +# disruption = low # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/selinux/selinux_policytype/oval/shared.xml b/linux_os/guide/system/selinux/selinux_policytype/oval/shared.xml index f1840a1290..3d69fff07f 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/oval/shared.xml +++ b/linux_os/guide/system/selinux/selinux_policytype/oval/shared.xml @@ -27,7 +27,7 @@ /etc/selinux/config - ^[\s]*SELINUXTYPE[\s]*=[\s]*([^\s]*) + ^SELINUXTYPE=(.*)$ 1 diff --git a/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh b/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh deleted file mode 100644 index 1a6eb94953..0000000000 --- a/linux_os/guide/system/selinux/selinux_policytype/tests/selinuxtype_minimum.fail.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# profiles = xccdf_org.ssgproject.content_profile_C2S, xccdf_org.ssgproject.content_profile_ospp - -SELINUX_FILE='/etc/selinux/config' - -if grep -s '^[[:space:]]*SELINUXTYPE' $SELINUX_FILE; then - sed -i 's/^\([[:space:]]*SELINUXTYPE[[:space:]]*=[[:space:]]*\).*/\minimum/' $SELINUX_FILE -else - echo 'SELINUXTYPE=minimum' >> $SELINUX_FILE -fi diff --git a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh index a402a861d7..645a7acab4 100644 --- a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh +++ b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh @@ -1,4 +1,8 @@ # platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platorm_ol,multi_platform_rhv +# reboot = true +# strategy = restrict +# complexity = low +# disruption = low # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/selinux/selinux_state/oval/shared.xml b/linux_os/guide/system/selinux/selinux_state/oval/shared.xml index c0881696e1..8c328060af 100644 --- a/linux_os/guide/system/selinux/selinux_state/oval/shared.xml +++ b/linux_os/guide/system/selinux/selinux_state/oval/shared.xml @@ -18,7 +18,7 @@ /etc/selinux/config - ^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$ + ^SELINUX=(.*)$ 1 diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 01d3155b37..580a0b948e 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -225,7 +225,7 @@ value: "Setting={{ varname1 }}" - value: value of the parameter #}} {{%- macro ansible_selinux_config_set(msg='', parameter='', value='') %}} -{{{ ansible_set_config_file(msg, "/etc/selinux/config", parameter=parameter, value=value, create="no", separator="=", separator_regex="\s*=\s*") }}} +{{{ ansible_set_config_file(msg, "/etc/selinux/config", parameter=parameter, value=value, create="yes", separator="=", separator_regex="=", prefix_regex='^') }}} {{%- endmacro %}} {{# diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja index 2531d1c52d..8abcc914d3 100644 --- a/shared/macros-bash.jinja +++ b/shared/macros-bash.jinja @@ -96,8 +96,8 @@ populate {{{ name }}} insert_before="", insensitive=true, separator="=", - separator_regex="\s*=\s*", - prefix_regex="^\s*") + separator_regex="=", + prefix_regex="^") }}} {{%- endmacro -%}}