From 3cba3a59a004582c787cba725fee033c104bfe43 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 25 Jul 2018 18:02:01 +0200 Subject: [PATCH 1/4] Drop restrictions to build remediations for some sysctl rules Templated generation of remediations for these rules were restricted. I don't see the motivation to restrict them, besides to easy comparison of generated datastream in 9aa2184d8d0f866df3fb6f1ea1beeafb076b3be5. RHEL7 content build the OVAL just fine. --- rhel6/templates/csv/sysctl_values.csv | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/rhel6/templates/csv/sysctl_values.csv b/rhel6/templates/csv/sysctl_values.csv index ad0507a2f4..af321acde0 100644 --- a/rhel6/templates/csv/sysctl_values.csv +++ b/rhel6/templates/csv/sysctl_values.csv @@ -21,8 +21,8 @@ net.ipv4.ip_forward,0 net.ipv4.tcp_syncookies, net.ipv6.conf.default.accept_ra, net.ipv6.conf.default.accept_redirects, -net.ipv6.conf.all.accept_ra,#only-for:oval -net.ipv6.conf.all.accept_redirects,#only-for:oval -net.ipv6.conf.default.accept_source_route,#only-for:oval -net.ipv6.conf.all.accept_source_route,#only-for:oval -net.ipv6.conf.all.forwarding,#only-for:oval +net.ipv6.conf.all.accept_ra, +net.ipv6.conf.all.accept_redirects, +net.ipv6.conf.default.accept_source_route, +net.ipv6.conf.all.accept_source_route, +net.ipv6.conf.all.forwarding, From 574defca3e1559bb5b954e65763b5df542bfeb99 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 25 Jul 2018 18:08:12 +0200 Subject: [PATCH 2/4] Drop generation of kernel_dmesg_restrict Rule kernel_dmest_restrict is not selected by any sle12 Profile. And currently the rule is applicable for rhel6, rhel7 and fedora. I see this as a copy pasta legacy. --- sle12/templates/csv/sysctl_values.csv | 1 - 1 file changed, 1 deletion(-) diff --git a/sle12/templates/csv/sysctl_values.csv b/sle12/templates/csv/sysctl_values.csv index 9428bc8a9f..d9b34c9aad 100644 --- a/sle12/templates/csv/sysctl_values.csv +++ b/sle12/templates/csv/sysctl_values.csv @@ -1,7 +1,6 @@ # Add to generate hard-coded OVAL and remediation content. # Add to generate OVAL and remediation content that use the XCCDF value. fs.suid_dumpable,0 -kernel.dmesg_restrict,1#only-for:bash,ansible #kernel.exec-shield,1 kernel.randomize_va_space,2 net.ipv4.conf.all.accept_redirects, From 79166dab27c8f23e6918b675e126f473395bc70b Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 25 Jul 2018 18:27:08 +0200 Subject: [PATCH 3/4] Flip template restriction to exclude target languages It is more likely and easier that we want to generate content for all supported languages, and filter out the exceptions. --- shared/templates/template_common.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/shared/templates/template_common.py b/shared/templates/template_common.py index da746e0323..b0fdf5fcc9 100644 --- a/shared/templates/template_common.py +++ b/shared/templates/template_common.py @@ -36,7 +36,7 @@ def __init__(self, template, paths): TEMPLATED_LANGUAGES = ["bash", "ansible", "oval", "anaconda", "puppet"] -TARGET_REGEX = re.compile(r"#\s*only-for:([\s\w,]*)") +TARGET_EXCLUDE_REGEX = re.compile(r"#\s*except-for:([\s\w,]*)") class FilesGenerator(object): @@ -113,13 +113,13 @@ def process_csv_line(self, line, target): """ if target is not None: - match = TARGET_REGEX.search(line) + exclude_match = TARGET_EXCLUDE_REGEX.search(line) - if match: - # if line contains restriction to target, check it - supported_targets = \ - [x.strip() for x in match.group(1).split(",")] - if target not in supported_targets: + if exclude_match: + # Check if line contains restriction to target + unsupported_targets = \ + [x.strip() for x in exclude_match.group(1).split(",")] + if target in unsupported_targets: return None # get part before comment From 89a059d096641d8f971c9f2d9af903742d251083 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 25 Jul 2018 18:44:11 +0200 Subject: [PATCH 4/4] Dont generate fix for unavailable mount points Do not generate anaconda remediation for mount options of /dev/shm. These mount points are not there at install time. --- rhel7/templates/csv/mount_options.csv | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rhel7/templates/csv/mount_options.csv b/rhel7/templates/csv/mount_options.csv index 759e51b0fe..f5d9ed8cea 100644 --- a/rhel7/templates/csv/mount_options.csv +++ b/rhel7/templates/csv/mount_options.csv @@ -6,9 +6,11 @@ # '$' to reference a variable, e.g. var_removable_partition,nodev) # If the remediation can create (i.e. not just modify) an /etc/fstab line, # add the 'create_fstab_entry_if_needed' literal string as the third argument. -/dev/shm,nodev -/dev/shm,noexec -/dev/shm,nosuid + +# /dev/shm is created by systemd and is not available at install time +/dev/shm,nodev #except-for:anaconda +/dev/shm,noexec #except-for:anaconda +/dev/shm,nosuid #except-for:anaconda /home,nosuid /home,nodev /tmp,nodev