From 023412217f4a73e47a7b5d8786b2b10974015615 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 19 Mar 2020 16:55:29 +0100
Subject: [PATCH 1/4] Make banner_etc_motd like banner_etc_issue

Both rules source the banner from the same XCCDF variable.
---
 .../banner_etc_motd/bash/shared.sh             | 18 +++++++++++++-----
 .../banner_etc_motd/oval/shared.xml            |  8 +++++++-
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh
index ac04d93dd5..d731063b5a 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh
@@ -2,12 +2,20 @@
 . /usr/share/scap-security-guide/remediation_functions
 populate login_banner_text
 
-# There was a regular-expression matching various banners, needs to be expanded
-expanded=$(echo "$login_banner_text" | sed 's/(\\\\\x27)\*/\\\x27/g;s/(\\\x27)\*//g;s/(\^\(.*\)\$|.*$/\1/g;s/\[\\s\\n\][+*]/ /g;s/\\//g;s/[^-]- /\n\n-/g;s/(n)\**//g')
-formatted=$(echo "$expanded" | fold -sw 80)
+# Multiple regexes transform the banner regex into a usable banner
+# 0 - Remove anchors around the banner text
+{{{ bash_deregexify_banner_anchors("login_banner_text") }}}
+# 1 - Keep only the first banners if there are multiple
+#    (dod_banners contains the long and short banner)
+{{{ bash_deregexify_multiple_banners("login_banner_text") }}}
+# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
+{{{ bash_deregexify_banner_space("login_banner_text") }}}
+# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
+{{{ bash_deregexify_banner_newline("login_banner_text", "\\n") }}}
+# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
+{{{ bash_deregexify_banner_backslash("login_banner_text") }}}
+formatted=$(echo "$login_banner_text" | fold -sw 80)
 
 cat <<EOF >/etc/motd
 $formatted
 EOF
-
-printf "\n" >> /etc/motd
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml
index dfd3bb69c0..9b20ee032a 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml
@@ -18,14 +18,20 @@
 
   <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="correct banner in /etc/motd" id="test_banner_etc_motd" version="1">
     <ind:object object_ref="object_banner_etc_motd" />
+    <ind:state state_ref="state_banner_etc_motd" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_banner_etc_motd" version="1">
+    <ind:behaviors singleline="true" multiline="false" />
     <ind:filepath>/etc/motd</ind:filepath>
-    <ind:pattern var_ref="login_banner_text" operation="pattern match" />
+    <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
 
+  <ind:textfilecontent54_state id="state_banner_etc_motd" version="1">
+    <ind:subexpression datatype="string" var_ref="login_banner_text" operation="pattern match" />
+  </ind:textfilecontent54_state>
+
   <external_variable comment="warning banner text variable" datatype="string" id="login_banner_text" version="1" />
 
 </def-group>

From 38e7680395d78371a12d3afd2561533d9f1860c3 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 19 Mar 2020 16:59:45 +0100
Subject: [PATCH 2/4] Add Ansible for banner_etc_motd

---
 .../banner_etc_motd/ansible/shared.yml          | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml

diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
new file mode 100644
index 0000000000..dfc1c519b7
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
@@ -0,0 +1,17 @@
+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
+# reboot = false
+# strategy = unknown
+# complexity = low
+# disruption = medium
+- (xccdf-var login_banner_text)
+
+- name: "{{{ rule_title }}} - remove incorrect banner"
+  file:
+    state: absent
+    path: /etc/motd
+
+- name: "{{{ rule_title }}} - add correct banner"
+  lineinfile:
+    dest: /etc/motd
+    line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+    create: yes

From c6ea356cef8678cdf248fc8363767d8615fb7423 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 19 Mar 2020 17:20:38 +0100
Subject: [PATCH 3/4] Use profile "all" to test banner_etc_motd

When the profile doesn't do any selection, the default value is used.
When the variable doesn't define a default value, the first value is
considered the default.

The test scenarios of banner_etcmotd are aligned with the first value of
login_banner_text.
---
 .../tests/banner_etc_motd_disa_dod_default_banner.pass.sh       | 2 --
 .../tests/banner_etc_motd_disa_dod_short.pass.sh                | 2 --
 .../tests/banner_etc_motd_disa_double_banner.fail.sh            | 2 --
 .../tests/banner_etc_motd_disa_usgcb_banner.fail.sh             | 2 --
 .../tests/banner_etc_motd_ospp_usbcg_banner.fail.sh             | 2 --
 .../tests/banner_etc_motd_ospp_usbcg_banner.pass.sh             | 2 --
 6 files changed, 12 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh
index a926abd7dd..96e5e11e5b 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_stig
 
 # dod_default banner
 echo "You are accessing a U.S. Government (USG) Information System (IS) that is 
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh
index a2624e1066..ddf1efa43c 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_stig
 
 # dod_short banner
 echo "I've read & consent to terms in IS user agreem't." > /etc/motd
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh
index 93c00cfde7..8cd0d30fa9 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_stig
 
 # dod_default|dod_short banner
 echo "You are accessing a U.S. Government (USG) Information System (IS) that is 
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh
index 3878983a19..5abacbb535 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_stig
 
 # usgcb_default banner
 echo "-- WARNING -- This system is for the use of authorized users only. Individuals 
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh
index c82a8e39b2..43b2e0a2e9 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh
@@ -1,5 +1,3 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_ospp
 
 echo "This is not the expected banner" > /etc/motd
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh
index 41894c998b..5abacbb535 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-#
-# profiles = xccdf_org.ssgproject.content_profile_ospp
 
 # usgcb_default banner
 echo "-- WARNING -- This system is for the use of authorized users only. Individuals 

From 4cb5b1f167a1ac3de94626d82eb6d3779a443475 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 19 Mar 2020 18:04:14 +0100
Subject: [PATCH 4/4] Remove test that doesn't make sense

At the moment no profile selects this rules.
The value of the variable will be the default (first) value of
variable login_banner_text. Thus, second pass test doesn't make sense.
---
 .../tests/banner_etc_motd_ospp_usbcg_banner.pass.sh    | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh

diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh
deleted file mode 100644
index 5abacbb535..0000000000
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# usgcb_default banner
-echo "-- WARNING -- This system is for the use of authorized users only. Individuals 
-using this computer system without authority or in excess of their authority 
-are subject to having all their activities on this system monitored and 
-recorded by system personnel. Anyone using this system expressly consents to 
-such monitoring and is advised that if such monitoring reveals possible 
-evidence of criminal activity system personal may provide the evidence of such 
-monitoring to law enforcement officials." > /etc/motd