From 30ad9f95ef5256fea1844d2240b19eb2d717ee4e Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 19 Oct 2020 16:34:06 +0200
Subject: [PATCH 1/3] Remove extra single quote from OVAL macros.

---
 shared/macros-oval.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
index 47033bedbe..5ea97c7537 100644
--- a/shared/macros-oval.jinja
+++ b/shared/macros-oval.jinja
@@ -25,7 +25,7 @@
 {{%- endif -%}}
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="1">
-    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in '" + path) }}}
+    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
     {{%- if missing_config_file_fail %}}
     <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
     operator="AND">

From 973a52024c21c3c2a97e8f159e53849eadc11285 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 19 Oct 2020 16:50:39 +0200
Subject: [PATCH 2/3] Create custom OVAL check for uefi_no_removeable_media.

Include the extended definition to check if the system is a UEFI system
or not.
---
 .../uefi_no_removeable_media/oval/shared.xml  | 36 ++++++++++++++++++-
 .../tests/hard_disk_set.pass.sh               | 12 +++++++
 .../tests/removable_media_set.fail.sh         | 12 +++++++
 tests/shared/grub2.sh                         |  6 ++++
 4 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/hard_disk_set.pass.sh
 create mode 100644 linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/removable_media_set.fail.sh

diff --git a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
index fd482a3d9d..44e54538c8 100644
--- a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
+++ b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
@@ -1 +1,35 @@
-{{{ oval_check_config_file(path='/boot/efi/EFI/redhat/grub.cfg', prefix_regex='^[ \\t]*', parameter='set root', separator_regex='=', value="'(?!fd)(?!cd)(?!usb).*'", missing_parameter_pass=false, missing_config_file_fail=true) }}}
+{{% if product == "fedora" %}}
+{{% set grub_cfg_prefix = "/boot/efi/EFI/fedora" %}}
+{{% else %}}
+{{% set grub_cfg_prefix = "/boot/efi/EFI/redhat" %}}
+{{% endif %}}
+
+<def-group>
+  <definition class="compliance" id="uefi_no_removeable_media" version="1">
+    {{{ oval_metadata("Ensure 'set root' is configured with value '(?!fd)(?!cd)(?!usb).*' in /boot/efi/EFI/redhat/grub.cfg") }}}
+    <criteria comment="The respective application or service is configured correctly or system boot mode is not UEFI" operator="OR">
+      <extend_definition definition_ref="system_boot_mode_is_uefi" negate="true" comment="Pass if system boot mode is not UEFI" />
+      <criterion comment="Check the set root in {{{ grub_cfg_prefix + "/grub.cfg" }}}" test_ref="test_uefi_no_removeable_media" />
+      {{{ oval_file_absent_criterion(grub_cfg_prefix + "/grub.cfg") }}}
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+  comment="tests the value of set root setting in the {{{ grub_cfg_prefix + "/grub.cfg" }}} file"
+  id="test_uefi_no_removeable_media" version="1">
+  <ind:object object_ref="obj_uefi_no_removeable_media" />
+  <ind:state state_ref="state_uefi_no_removeable_media" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_uefi_no_removeable_media" version="1">
+    <ind:filepath>{{{ grub_cfg_prefix + "/grub.cfg" }}}</ind:filepath>
+    <ind:pattern operation="pattern match">^[ \t]*set root=(.+?)[ \t]*(?:$|#)</ind:pattern>
+    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_uefi_no_removeable_media" version="1">
+    <ind:subexpression datatype="string" operation="pattern match">^'(?!fd)(?!cd)(?!usb).*'$</ind:subexpression>
+  </ind:textfilecontent54_state>
+
+  {{{ oval_file_absent(grub_cfg_prefix + "/grub.cfg") }}}
+</def-group>
diff --git a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/hard_disk_set.pass.sh b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/hard_disk_set.pass.sh
new file mode 100644
index 0000000000..afe131c417
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/hard_disk_set.pass.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# remediation = none
+
+. $SHARED/grub2.sh
+
+set_grub_uefi_root
+
+# make the check applicable since it tries to detect this directory first
+# mkdir -p /sys/firmware/efi
+
+set_root_unquoted "'hd0,msdos1'"
diff --git a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/removable_media_set.fail.sh b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/removable_media_set.fail.sh
new file mode 100644
index 0000000000..92499094c1
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/tests/removable_media_set.fail.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# remediation = none
+
+. $SHARED/grub2.sh
+
+set_grub_uefi_root
+
+# make the check applicable since it tries to detect this directory first
+# mkdir -p /sys/firmware/efi
+
+set_root_unquoted "'usb0,msdos1'"
diff --git a/tests/shared/grub2.sh b/tests/shared/grub2.sh
index ce1943349e..bce7683a7c 100644
--- a/tests/shared/grub2.sh
+++ b/tests/shared/grub2.sh
@@ -25,3 +25,9 @@ function set_superusers_unquoted {
 	mkdir -p "$GRUB_CFG_ROOT"
 	echo "set superusers=$1" > "$GRUB_CFG_ROOT/grub.cfg"
 }
+
+
+function set_root_unquoted {
+	mkdir -p "$GRUB_CFG_ROOT"
+	echo "set root=$1" > "$GRUB_CFG_ROOT/grub.cfg"
+}

From fc2b030015317ad465b9dd8c9d9e9714de9c8ac8 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Tue, 20 Oct 2020 16:30:10 +0200
Subject: [PATCH 3/3] Update
 linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml

Co-authored-by: Gabe Alford <redhatrises@gmail.com>
---
 .../bootloader-grub2/uefi_no_removeable_media/oval/shared.xml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
index 44e54538c8..5ae57cbfa6 100644
--- a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
+++ b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/oval/shared.xml
@@ -6,7 +6,7 @@
 
 <def-group>
   <definition class="compliance" id="uefi_no_removeable_media" version="1">
-    {{{ oval_metadata("Ensure 'set root' is configured with value '(?!fd)(?!cd)(?!usb).*' in /boot/efi/EFI/redhat/grub.cfg") }}}
+    {{{ oval_metadata("Ensure the system is not configured to use a boot loader on removable media.") }}}
     <criteria comment="The respective application or service is configured correctly or system boot mode is not UEFI" operator="OR">
       <extend_definition definition_ref="system_boot_mode_is_uefi" negate="true" comment="Pass if system boot mode is not UEFI" />
       <criterion comment="Check the set root in {{{ grub_cfg_prefix + "/grub.cfg" }}}" test_ref="test_uefi_no_removeable_media" />