|
 |
f89c37 |
From 1c403af00f39fcfa3c7cf898b1e832d4580cfb59 Mon Sep 17 00:00:00 2001
|
|
|
f89c37 |
From: Watson Sato <wsato@redhat.com>
|
|
|
f89c37 |
Date: Thu, 5 May 2022 10:28:34 +0200
|
|
|
f89c37 |
Subject: [PATCH] PR #8704 edited manually
|
|
|
f89c37 |
|
|
|
f89c37 |
- Restrict test to sysctl.conf and /usr/sysctl.d
|
|
|
f89c37 |
- Separate the state from the object and check it
|
|
|
f89c37 |
---
|
|
|
f89c37 |
.../tests/wrong_value_d_directory.fail.sh | 12 ++++++------
|
|
|
f89c37 |
shared/templates/sysctl/oval.template | 18 ++++++++++--------
|
|
|
f89c37 |
2 files changed, 16 insertions(+), 14 deletions(-)
|
|
|
f89c37 |
|
|
|
f89c37 |
diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/tests/wrong_value_d_directory.fail.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/tests/wrong_value_d_directory.fail.sh
|
|
|
f89c37 |
index 48a2665..5fb8ddc 100644
|
|
|
f89c37 |
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/tests/wrong_value_d_directory.fail.sh
|
|
|
f89c37 |
+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/tests/wrong_value_d_directory.fail.sh
|
|
|
f89c37 |
@@ -5,19 +5,19 @@
|
|
|
f89c37 |
setting_name="kernel.randomize_va_space"
|
|
|
f89c37 |
setting_value="2"
|
|
|
f89c37 |
# sysctl -w "$setting_name=$setting_value"
|
|
|
f89c37 |
-if grep -q "^$setting_name" /usr/lib/sysctl.d/50-sysctl.conf; then
|
|
|
f89c37 |
- sed -i "s/^$setting_name.*/$setting_name = $setting_value/" /usr/lib/sysctl.d/50-sysctl.conf
|
|
|
f89c37 |
+if grep -q "^$setting_name" /etc/sysctl.conf; then
|
|
|
f89c37 |
+ sed -i "s/^$setting_name.*/$setting_name = $setting_value/" /etc/sysctl.conf
|
|
|
f89c37 |
else
|
|
|
f89c37 |
- echo "$setting_name = $setting_value" >> /usr/lib/sysctl.d/50-sysctl.conf
|
|
|
f89c37 |
+ echo "$setting_name = $setting_value" >> /etc/sysctl.conf
|
|
|
f89c37 |
fi
|
|
|
f89c37 |
|
|
|
f89c37 |
setting_name="kernel.randomize_va_space"
|
|
|
f89c37 |
setting_value="0"
|
|
|
f89c37 |
# sysctl -w "$setting_name=$setting_value"
|
|
|
f89c37 |
-if grep -q "^$setting_name" /etc/sysctl.d/99-sysctl.conf; then
|
|
|
f89c37 |
- sed -i "s/^$setting_name.*/$setting_name = $setting_value/" /etc/sysctl.d/99-sysctl.conf
|
|
|
f89c37 |
+if grep -q "^$setting_name" /etc/sysctl.d/98-sysctl.conf; then
|
|
|
f89c37 |
+ sed -i "s/^$setting_name.*/$setting_name = $setting_value/" /etc/sysctl.d/98-sysctl.conf
|
|
|
f89c37 |
else
|
|
|
f89c37 |
- echo "$setting_name = $setting_value" >> /etc/sysctl.d/99-sysctl.conf
|
|
|
f89c37 |
+ echo "$setting_name = $setting_value" >> /etc/sysctl.d/98-sysctl.conf
|
|
|
f89c37 |
fi
|
|
|
f89c37 |
|
|
|
f89c37 |
sysctl --system
|
|
|
f89c37 |
diff --git a/shared/templates/sysctl/oval.template b/shared/templates/sysctl/oval.template
|
|
|
f89c37 |
index 564cc33..97f1e05 100644
|
|
|
f89c37 |
--- a/shared/templates/sysctl/oval.template
|
|
|
f89c37 |
+++ b/shared/templates/sysctl/oval.template
|
|
|
f89c37 |
@@ -6,21 +6,15 @@
|
|
|
f89c37 |
|
|
|
f89c37 |
{{% macro state_static_sysctld(prefix) -%}}
|
|
|
f89c37 |
<ind:object object_ref="object_static_{{{ prefix }}}_{{{ SYSCTLID }}}" />
|
|
|
f89c37 |
-{{%- if SYSCTLVAL == "" %}}
|
|
|
f89c37 |
<ind:state state_ref="state_static_sysctld_{{{ SYSCTLID }}}" />
|
|
|
f89c37 |
-{{%- endif -%}}
|
|
|
f89c37 |
{{%- endmacro -%}}
|
|
|
f89c37 |
{{%- macro sysctl_match() -%}}
|
|
|
f89c37 |
{{%- if SYSCTLVAL == "" -%}}
|
|
|
f89c37 |
<ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
|
|
|
f89c37 |
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
f89c37 |
{{%- else -%}}
|
|
|
f89c37 |
-{{% if OPERATION == "pattern match" %}}
|
|
|
f89c37 |
- <ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*{{{ SYSCTLVAL_REGEX }}}[\s]*$</ind:pattern>
|
|
|
f89c37 |
-{{% else %}}
|
|
|
f89c37 |
- <ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*{{{ SYSCTLVAL }}}[\s]*$</ind:pattern>
|
|
|
f89c37 |
-{{% endif %}}
|
|
|
f89c37 |
- <ind:instance datatype="int">1</ind:instance>
|
|
|
f89c37 |
+ <ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
|
|
|
f89c37 |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
f89c37 |
{{%- endif -%}}
|
|
|
f89c37 |
{{%- endmacro -%}}
|
|
|
f89c37 |
{{%- if "P" in FLAGS -%}}
|
|
|
f89c37 |
@@ -258,6 +252,14 @@
|
|
|
f89c37 |
</ind:textfilecontent54_state>
|
|
|
f89c37 |
|
|
|
f89c37 |
<external_variable comment="External variable for {{{ SYSCTLVAR }}}" datatype="{{{ DATATYPE }}}" id="sysctl_{{{ SYSCTLID }}}_value" version="1" />
|
|
|
f89c37 |
+{{% else %}}
|
|
|
f89c37 |
+ <ind:textfilecontent54_state id="state_static_sysctld_{{{ SYSCTLID }}}" version="1">
|
|
|
f89c37 |
+{{% if OPERATION == "pattern match" %}}
|
|
|
f89c37 |
+ <ind:subexpression operation="{{{ OPERATION }}}" datatype="{{{ DATATYPE }}}">{{{ SYSCTLVAL_REGEX }}}</ind:subexpression>
|
|
|
f89c37 |
+{{% else %}}
|
|
|
f89c37 |
+ <ind:subexpression operation="{{{ OPERATION }}}" datatype="{{{ DATATYPE }}}">{{{ SYSCTLVAL }}}</ind:subexpression>
|
|
|
f89c37 |
+{{% endif %}}
|
|
|
f89c37 |
+ </ind:textfilecontent54_state>
|
|
|
f89c37 |
{{% endif %}}
|
|
|
f89c37 |
</def-group>
|
|
|
f89c37 |
{{%- endif -%}}
|
|
|
f89c37 |
--
|
|
|
f89c37 |
2.34.1
|
|
|
f89c37 |
|