Blob Blame History Raw
From bf018e9f8327b231b967db8ec74fabf01802b6a8 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:45:04 +0200
Subject: [PATCH 1/3] Add test for ansible files removed and readded

Check if any playbook removes a file and then add it back again.
The file removal is based on the 'file' module with 'state: absent', and
the reintroduction of the file is based on 'lineinfile', 'blockinfile'
and 'copy' modules.
---
 CMakeLists.txt                               |  2 +
 tests/CMakeLists.txt                         |  8 ++
 tests/test_ansible_file_removed_and_added.py | 97 ++++++++++++++++++++
 3 files changed, 107 insertions(+)
 create mode 100644 tests/test_ansible_file_removed_and_added.py

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 330b869d0f9..e41f2caa630 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -129,6 +129,7 @@ find_python_module(jinja2 REQUIRED)
 find_python_module(pytest)
 find_python_module(pytest_cov)
 find_python_module(json2html)
+find_python_module(yamlpath)
 
 # sphinx documentation requirements
 find_python_module(sphinx)
@@ -231,6 +232,7 @@ message(STATUS "python pytest module (optional): ${PY_PYTEST}")
 message(STATUS "ansible-playbook module (optional): ${ANSIBLE_PLAYBOOK_EXECUTABLE}")
 message(STATUS "ansible-lint module (optional): ${ANSIBLE_LINT_EXECUTABLE}")
 message(STATUS "yamllint module (optional): ${YAMLLINT_EXECUTABLE}")
+message(STATUS "yamlpath module (optional): ${PY_YAMLPATH}")
 message(STATUS "BATS framework (optional): ${BATS_EXECUTABLE}")
 message(STATUS "python sphinx module (optional): ${PY_SPHINX}")
 message(STATUS "python sphinxcontrib.autojinja module (optional): ${PY_SPHINXCONTRIB.AUTOJINJA}")
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 3e2d8a4ec31..739cc124035 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -121,3 +121,11 @@ add_test(
 )
 set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
 set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
+
+if (PY_YAMLPATH)
+    add_test(
+        NAME "ansible-file-removed-and-added"
+        COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
+    )
+    set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
+endif()
diff --git a/tests/test_ansible_file_removed_and_added.py b/tests/test_ansible_file_removed_and_added.py
new file mode 100644
index 00000000000..23f6f888bda
--- /dev/null
+++ b/tests/test_ansible_file_removed_and_added.py
@@ -0,0 +1,97 @@
+#!/usr/bin/python3
+
+import argparse
+import os
+import sys
+from types import SimpleNamespace
+from yamlpath import Processor
+from yamlpath import YAMLPath
+from yamlpath.common import Parsers
+from yamlpath.exceptions import YAMLPathException
+from yamlpath.wrappers import ConsolePrinter
+
+
+def parse_command_line_args():
+    parser = argparse.ArgumentParser(
+        description="Checks if an Ansible Playbook removes a file and then adds it again.")
+    parser.add_argument("--ansible_dir", required=True,
+                        help="Directory containing Ansible Playbooks")
+    args = parser.parse_args()
+    return args
+
+
+def check_playbook_file_removed_and_added(playbook_path):
+    playbook_ok = True
+
+    yaml_parser = Parsers.get_yaml_editor()
+
+    logging_args = SimpleNamespace(quiet=False, verbose=False, debug=False)
+    log = ConsolePrinter(logging_args)
+
+    # Find every path removed by a file Task (also matches tasks within blocks)
+    files_absent_string = "tasks.**.file[state=absent][parent()].path"
+    files_absent_yamlpath = YAMLPath(files_absent_string)
+    path_editing_tasks_yamlpath = ""
+
+    log.info("Info: Evaluating playbook '{}'".format(playbook_path))
+    (yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml_parser, log, playbook_path)
+    if not doc_loaded:
+        # There was an issue loading the file; an error message has already been
+        # printed via ConsolePrinter.
+        return False
+
+    processor = Processor(log, yaml_data)
+    try:
+        for node in processor.get_nodes(files_absent_yamlpath, mustexist=False):
+            path = str(node)
+            # 'node' is a NodeCoords.
+            if path == 'None':
+                continue
+            elif "{{" in path:
+                # Identified path is a Jinja expression, unfortunately there is no easy way to get
+                # the actual path without making this test very complicated
+                continue
+
+            # Check if this paths is used in any of the following ansible modules
+            ansible_modules = ["lineinfile", "blockinfile", "copy"]
+            path_editing_tasks_string = "tasks.**.[.=~/{modules}/][*='{path}'][parent()].name"
+            path_editing_tasks_yamlpath = YAMLPath(path_editing_tasks_string.format(
+                modules="|".join(ansible_modules),
+                path=node)
+                )
+            for task in processor.get_nodes(path_editing_tasks_yamlpath, mustexist=False):
+                log.info("Error: Task '{}' manipulates a file that is removed by another task"
+                         .format(task))
+                playbook_ok = False
+    except YAMLPathException as ex:
+        no_file_msg = ("Cannot add PathSegmentTypes.TRAVERSE subreference to lists at 'None' "
+                       "in '{}'.")
+        if str(ex) == no_file_msg.format(files_absent_string):
+            log.info("Info: Playbook {} has no 'file' tasks.".format(playbook_path))
+        elif path_editing_tasks_yamlpath and str(ex) == no_file_msg.format(
+                path_editing_tasks_yamlpath):
+            log.info("Info: Playbook {} has no '{}' tasks.".format(
+                playbook_path, " ".join(ansible_modules)))
+        else:
+            log.info("Error: {}.".format(ex))
+
+    return playbook_ok
+
+
+def main():
+    args = parse_command_line_args()
+
+    all_playbooks_ok = True
+    for dir_item in os.listdir(args.ansible_dir):
+        if dir_item.endswith(".yml"):
+            playbook_path = os.path.join(args.ansible_dir, dir_item)
+
+            if not check_playbook_file_removed_and_added(playbook_path):
+                all_playbooks_ok = False
+
+    if not all_playbooks_ok:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

From e6d727762ba446cad94f1e002fa7a7fef0f1a4cb Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:48:14 +0200
Subject: [PATCH 2/3] Unit tests the function for file removed and added

Add a unit test for the core function that checks if any playbook
removes a file and then reintroduces it back.
---
 tests/CMakeLists.txt                          |  6 ++
 .../file_block_removed_and_added.yml          | 69 +++++++++++++++++++
 .../file_not_removed_and_added.yml            | 49 +++++++++++++
 .../file_removed_and_added.yml                | 62 +++++++++++++++++
 .../file_removed_and_not_added.yml            | 46 +++++++++++++
 ...t_check_playbook_file_removed_and_added.py | 39 +++++++++++
 6 files changed, 271 insertions(+)
 create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
 create mode 100644 tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
 create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_added.yml
 create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
 create mode 100644 tests/test_check_playbook_file_removed_and_added.py

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 739cc124035..000a1b1385d 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -123,6 +123,12 @@ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
 set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
 
 if (PY_YAMLPATH)
+    if (PY_PYTEST)
+        add_test(
+            NAME "test-function-check_playbook_file_removed_and_added"
+            COMMAND "${PYTHON_EXECUTABLE}" -m pytest ${PYTEST_COVERAGE_OPTIONS} "${CMAKE_CURRENT_SOURCE_DIR}/test_check_playbook_file_removed_and_added.py"
+        )
+    endif()
     add_test(
         NAME "ansible-file-removed-and-added"
         COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
new file mode 100644
index 00000000000..8863b333129
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
@@ -0,0 +1,69 @@
+---
+
+- hosts: all
+  vars:
+    var_system_crypto_policy: !!str FUTURE
+    var_sudo_logfile: !!str /var/log/sudo.log
+
+  tasks:
+    - name: Modify the System Login Banner - add correct banner
+      lineinfile:
+        dest: /etc/issue
+        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+          "\n") | regex_replace("\\", "") | wordwrap() }}'
+        create: true
+      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+      tags:
+        - banner_etc_issue
+        - low_complexity
+        - medium_disruption
+        - medium_severity
+        - no_reboot_needed
+        - unknown_strategy
+
+    - name: Test for existence /etc/issue
+      stat:
+        path: /etc/issue
+      register: file_exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
+    - name: Ensure permission 0644 on /etc/issue
+      file:
+        path: /etc/issue
+        mode: '0644'
+      when: file_exists.stat is defined and file_exists.stat.exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
+    - block:
+
+        - name: Remove Rsh Trust Files
+          file:
+            path: /root/shosts.equiv
+            state: absent
+
+        - name: Add line to /root/shosts.equiv
+          lineinfile:
+            dest: /root/shosts.equiv
+            line: 'test host'
+            create: true
+      tags:
+        - high_severity
+        - low_complexity
+        - low_disruption
+        - no_reboot_needed
+        - no_rsh_trust_files
+        - restrict_strategy
+
diff --git a/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
new file mode 100644
index 00000000000..3d3e53b958f
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
@@ -0,0 +1,49 @@
+---
+
+- hosts: all
+  vars:
+    var_system_crypto_policy: !!str FUTURE
+    var_sudo_logfile: !!str /var/log/sudo.log
+
+  tasks:
+    - name: Modify the System Login Banner - add correct banner
+      lineinfile:
+        dest: /etc/issue
+        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+          "\n") | regex_replace("\\", "") | wordwrap() }}'
+        create: true
+      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+      tags:
+        - banner_etc_issue
+        - low_complexity
+        - medium_disruption
+        - medium_severity
+        - no_reboot_needed
+        - unknown_strategy
+
+    - name: Test for existence /etc/issue
+      stat:
+        path: /etc/issue
+      register: file_exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
+    - name: Ensure permission 0644 on /etc/issue
+      file:
+        path: /etc/issue
+        mode: '0644'
+      when: file_exists.stat is defined and file_exists.stat.exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
new file mode 100644
index 00000000000..a44c39a9db2
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
@@ -0,0 +1,62 @@
+---
+
+- hosts: all
+  vars:
+    var_system_crypto_policy: !!str FUTURE
+    var_sudo_logfile: !!str /var/log/sudo.log
+
+  tasks:
+    - name: Modify the System Login Banner - remove incorrect banner
+      file:
+        state: absent
+        path: /etc/issue
+      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+      tags:
+        - banner_etc_issue
+        - low_complexity
+        - medium_disruption
+        - medium_severity
+        - no_reboot_needed
+        - unknown_strategy
+
+    - name: Modify the System Login Banner - add correct banner
+      lineinfile:
+        dest: /etc/issue
+        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+          "\n") | regex_replace("\\", "") | wordwrap() }}'
+        create: true
+      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+      tags:
+        - banner_etc_issue
+        - low_complexity
+        - medium_disruption
+        - medium_severity
+        - no_reboot_needed
+        - unknown_strategy
+
+    - name: Test for existence /etc/issue
+      stat:
+        path: /etc/issue
+      register: file_exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
+    - name: Ensure permission 0644 on /etc/issue
+      file:
+        path: /etc/issue
+        mode: '0644'
+      when: file_exists.stat is defined and file_exists.stat.exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
new file mode 100644
index 00000000000..08cda7e5063
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
@@ -0,0 +1,46 @@
+---
+
+- hosts: all
+  vars:
+    var_system_crypto_policy: !!str FUTURE
+    var_sudo_logfile: !!str /var/log/sudo.log
+
+  tasks:
+    - name: Modify the System Login Banner - remove incorrect banner
+      file:
+        state: absent
+        path: /etc/issue
+      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+      tags:
+        - banner_etc_issue
+        - low_complexity
+        - medium_disruption
+        - medium_severity
+        - no_reboot_needed
+        - unknown_strategy
+
+    - name: Test for existence /etc/issue
+      stat:
+        path: /etc/issue
+      register: file_exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
+    - name: Ensure permission 0644 on /etc/issue
+      file:
+        path: /etc/issue
+        mode: '0644'
+      when: file_exists.stat is defined and file_exists.stat.exists
+      tags:
+        - configure_strategy
+        - file_permissions_etc_issue
+        - low_complexity
+        - low_disruption
+        - medium_severity
+        - no_reboot_needed
+
diff --git a/tests/test_check_playbook_file_removed_and_added.py b/tests/test_check_playbook_file_removed_and_added.py
new file mode 100644
index 00000000000..181bb14ed46
--- /dev/null
+++ b/tests/test_check_playbook_file_removed_and_added.py
@@ -0,0 +1,39 @@
+import os
+import pytest
+
+from .test_ansible_file_removed_and_added import check_playbook_file_removed_and_added
+
+
+def test_file_removed_and_added():
+    playbook_path = os.path.join(os.path.dirname(__file__),
+                                 "ansible_file_removed_and_added",
+                                 "file_removed_and_added.yml")
+    assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_removed_and_not_added():
+    playbook_path = os.path.join(os.path.dirname(__file__),
+                                 "ansible_file_removed_and_added",
+                                 "file_removed_and_not_added.yml")
+    assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_not_removed_and_added():
+    playbook_path = os.path.join(os.path.dirname(__file__),
+                                 "ansible_file_removed_and_added",
+                                 "file_not_removed_and_added.yml")
+    assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_added():
+    playbook_path = os.path.join(os.path.dirname(__file__),
+                                 "ansible_file_removed_and_added",
+                                 "file_block_removed_and_added.yml")
+    assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_not_added():
+    playbook_path = os.path.join(os.path.dirname(__file__),
+                                 "ansible_file_removed_and_added",
+                                 "file_block_removed_and_not_added.yml")
+    assert check_playbook_file_removed_and_added(playbook_path)

From 741ec823ac39341f8aa0649031b72d2ac36e8a64 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 12 Aug 2021 10:36:47 +0200
Subject: [PATCH 3/3] Mention Ansible static yamlpath test in docs

---
 .../developer/02_building_complianceascode.md      | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/manual/developer/02_building_complianceascode.md b/docs/manual/developer/02_building_complianceascode.md
index d536df0a259..87469bf5f9b 100644
--- a/docs/manual/developer/02_building_complianceascode.md
+++ b/docs/manual/developer/02_building_complianceascode.md
@@ -64,6 +64,20 @@ yum install yamllint ansible-lint
 apt-get install yamllint ansible-lint
 ```
 
+### Static Ansible Playbooks tests
+
+Install `yamlpath` and `pytest` to run tests cases that analyse the Ansible
+Playbooks' yaml nodes.
+```bash
+pip3 install yamlpath
+
+# Fedora/RHEL
+yum install python3-pytest
+
+# Ubuntu/Debian
+apt-get install python-pytest
+```
+
 ### Ninja (Faster Builds)
 
 Install the `ninja` build system if you want to use it instead of