From c7eb8fafacbf7625e35b68d9934c98a1eb65ef65 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Mon, 13 Feb 2023 17:49:13 +0100 Subject: [PATCH 2/5] Extends rsyslog_logfiles_attributes_modify template for permissions Patch-name: scap-security-guide-0.1.67-rsyslog_files_permissions_template-PR_10139.patch Patch-status: Extends rsyslog_logfiles_attributes_modify template for permissions --- .../ansible/shared.yml | 59 -------- .../rsyslog_files_permissions/bash/shared.sh | 92 ------------ .../rsyslog_files_permissions/oval/shared.xml | 131 ----------------- .../rsyslog_files_permissions/rule.yml | 30 +++- .../IncludeConfig_glob_perms_0600.pass.sh | 40 ----- .../IncludeConfig_glob_perms_0601.fail.sh | 41 ------ .../tests/IncludeConfig_perms_0600.pass.sh | 39 ----- .../tests/IncludeConfig_perms_0601.fail.sh | 40 ----- .../include_config_syntax_perms_0600.pass.sh | 85 ----------- .../include_config_syntax_perms_0601.fail.sh | 86 ----------- .../include_multiline_perms_0600.pass.sh | 41 ------ .../tests/include_perms_0600.pass.sh | 39 ----- ...erms_0600_IncludeConfig_perms_0600.pass.sh | 52 ------- ...erms_0600_IncludeConfig_perms_0601.fail.sh | 53 ------- ...00_IncludeConfig_perms_0601_hidden.pass.sh | 53 ------- ...0_IncludeConfig_perms_0601_missing.pass.sh | 45 ------ .../include_perms_0600_cloudinit.pass.sh | 23 --- .../tests/include_perms_0601.fail.sh | 41 ------ .../include_perms_0601_cloudinit.fail.sh | 22 --- .../mixed_correct_attr_group_read.pass.sh | 25 ++++ .../tests/mixed_correct_attr_stricter.pass.sh | 25 ++++ .../tests/perms_0600.pass.sh | 35 ----- .../tests/perms_0601.fail.sh | 34 ----- .../ansible.template | 7 +- .../bash.template | 33 ++--- .../oval.template | 138 +++++++++--------- .../template.py | 18 +++ .../tests/IncludeConfig_is_other.fail.sh | 50 ------- .../tests/include_is_other.fail.sh | 50 ------- ...udeConfig_is_other_RainerLogClause.fail.sh | 75 ---------- .../tests/include_is_root.pass.sh | 46 ------ ...ude_is_root_IncludeConfig_is_other.fail.sh | 63 -------- ...lude_is_root_IncludeConfig_is_root.pass.sh | 58 -------- ...ludeConfig_is_root_RainerLogClause.pass.sh | 59 -------- .../tests/include_multiline_is_root.pass.sh | 47 ------ .../tests/is_root.pass.sh | 30 ---- ...er.fail.sh => legacy_correct_attr.pass.sh} | 26 ++-- ...sh => legacy_include_correct_attr.pass.sh} | 32 ++-- .../legacy_include_incorrect_attr.fail.sh | 50 +++++++ .../tests/legacy_incorrect_attr.fail.sh | 33 +++++ .../tests/mixed_correct_attr.pass.sh | 33 +++++ .../tests/mixed_include_correct_attr.pass.sh | 58 ++++++++ ...ixed_include_incorrect_attr_legacy.fail.sh | 63 ++++++++ ...ixed_include_incorrect_attr_rainer.fail.sh | 63 ++++++++ .../mixed_incorrect_attr_cloudinit.fail.sh | 38 +++++ .../tests/mixed_incorrect_attr_legacy.fail.sh | 38 +++++ .../tests/mixed_incorrect_attr_rainer.fail.sh | 38 +++++ .../tests/rainer_correct_attr.pass.sh | 31 ++++ .../tests/rainer_include_correct_attr.pass.sh | 45 ++++++ .../rainer_include_incorrect_attr.fail.sh | 50 +++++++ ...ner_include_multiline_correct_attr.pass.sh | 47 ++++++ ...r_include_multiline_incorrect_attr.fail.sh | 52 +++++++ .../tests/rainer_incorrect_attr.fail.sh | 33 +++++ 53 files changed, 875 insertions(+), 1660 deletions(-) delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/template.py delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh delete mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{is_other.fail.sh => legacy_correct_attr.pass.sh} (53%) rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{IncludeConfig_is_root.pass.sh => legacy_include_correct_attr.pass.sh} (51%) create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml deleted file mode 100644 index ae8bbe3302..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml +++ /dev/null @@ -1,59 +0,0 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle -# reboot = false -# strategy = configure -# complexity = low -# disruption = medium - -- name: "Set rsyslog logfile configuration facts" - set_fact: - rsyslog_etc_config: "/etc/rsyslog.conf" -{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} - desired_perm_mode: "640" -{{% else %}} - desired_perm_mode: "600" -{{% endif %}} - -# * And also the log file paths listed after rsyslog's $IncludeConfig directive -# (store the result into array for the case there's shell glob used as value of IncludeConfig) -- name: "Get IncludeConfig directive" - shell: | - set -o pipefail - grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true - register: rsyslog_old_inc - changed_when: False - -- name: "Get include files directives" - shell: | - set -o pipefail - grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\"" -f 2 || true - register: rsyslog_new_inc - changed_when: False - -- name: "Expand glob expressions" - shell: | - set -o pipefail - eval printf '%s\\n' {{ item }} - register: include_config_output - loop: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}" - -- name: "List all config files" - shell: find {{ item }} -not -path "*/.*" -type f - loop: "{{ include_config_output.results|map(attribute='stdout_lines')|list|flatten }}" - register: rsyslog_config_files - failed_when: False - changed_when: False - -- name: "Extract log files" - shell: | - set -o pipefail - grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }} |awk '{print $NF}'|sed -e 's/^-//' || true - loop: "{{ rsyslog_config_files.results|map(attribute='stdout_lines')|list|flatten|unique + [ rsyslog_etc_config ] }}" - register: log_files - changed_when: False - -- name: "Setup log files permissions" - ignore_errors: yes - file: - path: "{{ item }}" - mode: "{{ desired_perm_mode }}" - loop: "{{ log_files.results|map(attribute='stdout_lines')|list|flatten|unique }}" diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh deleted file mode 100644 index e4e2ade29e..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh +++ /dev/null @@ -1,92 +0,0 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle - -# List of log file paths to be inspected for correct permissions -# * Primarily inspect log file paths listed in /etc/rsyslog.conf -RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf" -# * And also the log file paths listed after rsyslog's $IncludeConfig directive -# (store the result into array for the case there's shell glob used as value of IncludeConfig) -readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2) -readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done) -readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf) -readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done) - -# Declare an array to hold the final list of different log file paths -declare -a LOG_FILE_PATHS - -# Array to hold all rsyslog config entries -RSYSLOG_CONFIGS=() -RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}") - -# Get full list of files to be checked -# RSYSLOG_CONFIGS may contain globs such as -# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule -# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files. -RSYSLOG_CONFIG_FILES=() -for ENTRY in "${RSYSLOG_CONFIGS[@]}" -do - # If directory, rsyslog will search for config files in recursively. - # However, files in hidden sub-directories or hidden files will be ignored. - if [ -d "${ENTRY}" ] - then - readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f) - RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}") - elif [ -f "${ENTRY}" ] - then - RSYSLOG_CONFIG_FILES+=("${ENTRY}") - else - echo "Invalid include object: ${ENTRY}" - fi -done - -# Browse each file selected above as containing paths of log files -# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration) -for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}" -do - # From each of these files extract just particular log file path(s), thus: - # * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters, - # * Ignore empty lines, - # * Strip quotes and closing brackets from paths. - # * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files - # * From the remaining valid rows select only fields constituting a log file path - # Text file column is understood to represent a log file path if and only if all of the following are met: - # * it contains at least one slash '/' character, - # * it is preceded by space - # * it doesn't contain space (' '), colon (':'), and semicolon (';') characters - # Search log file for path(s) only in case it exists! - if [[ -f "${LOG_FILE}" ]] - then - NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}") - LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}") - FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}") - CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}") - MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}") - # Since above sed command might return more than one item (delimited by newline), split the particular - # matches entries into new array specific for this log file - readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS" - # Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with - # items from newly created array for this log file - LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}") - # Delete the temporary array - unset ARRAY_FOR_LOG_FILE - fi -done -{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} -DESIRED_PERM_MOD=640 -{{% else %}} -DESIRED_PERM_MOD=600 -{{% endif %}} -# Correct the form o -for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}" -do - # Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing - if [ -z "$LOG_FILE_PATH" ] - then - continue - fi - - # Also for each log file check if its permissions differ from 600. If so, correct them - if [ -f "$LOG_FILE_PATH" ] && [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne $DESIRED_PERM_MOD ] - then - /bin/chmod $DESIRED_PERM_MOD "$LOG_FILE_PATH" - fi -done diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml deleted file mode 100644 index 559d5fb101..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml +++ /dev/null @@ -1,131 +0,0 @@ - - - {{{ oval_metadata("File permissions for all syslog log files should be set correctly.") }}} - - - {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804"] %}} - - {{% endif %}} - - - - - - - - /etc/rsyslog.conf - ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ - 1 - state_permissions_ignore_hidden_paths - - - - - ^.*\/\..*$ - - - - - - - - - - - - - - var_rfp_include_config_regex - - - - ^/etc/rsyslog.conf$ - - - - var_rfp_syslog_config - - - - - - object_var_rfp_include_config_regex - object_var_rfp_syslog_config - - - - - - - - - - - - - ^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ - 1 - state_permissions_ignore_include_paths - - - - - (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) - - - - - - - - - - - - - - - - - - - regular - false - {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} - true - {{% else %}} - false - {{% endif %}} - false - false - false - false - false - - diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml index 508ff73cde..042c35362d 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml @@ -1,18 +1,24 @@ +{{%- if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} + {{%- set rsyslog_perm='640' %}} +{{%- else %}} + {{%- set rsyslog_perm='600' %}} +{{%- endif %}} + documentation_complete: true title: 'Ensure System Log Files Have Correct Permissions' description: |- The file permissions for all log files written by rsyslog should - be set to 600, or more restrictive. These log files are determined by the + be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's permissions: 
$ ls -l LOGFILE
- If the permissions are not 600 or more restrictive, run the following + If the permissions are not {{{ rsyslog_perm }}} or more restrictive, run the following command to correct this: - 
$ sudo chmod 0600 LOGFILE
" + 
$ sudo chmod {{{ rsyslog_perm }}} LOGFILE
" rationale: |- Log files can contain valuable information regarding system @@ -46,9 +52,23 @@ ocil_clause: 'the permissions are not correct' ocil: |- The file permissions for all log files written by rsyslog should - be set to 600, or more restrictive. These log files are determined by the + be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. To see the permissions of a given log file, run the following command: 
$ ls -l LOGFILE
- The permissions should be 600, or more restrictive. + The permissions should be {{{ rsyslog_perm }}}, or more restrictive. + +template: + name: rsyslog_logfiles_attributes_modify + vars: + attribute: permissions + value: '0600' + value@debian10: '0640' + value@debian11: '0640' + value@sle12: '0640' + value@sle15: '0640' + value@ubuntu1604: '0640' + value@ubuntu1804: '0640' + value@ubuntu2004: '0640' + value@ubuntu2204: '0640' diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh deleted file mode 100755 index c27e7874d9..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0600 from $IncludeConfig passes. -# test $IncludeConfig with wildcard (*.conf) - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh deleted file mode 100755 index 124b5e863e..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0601 from $IncludeConfig fails. -# test $IncludeConfig with wildcard (*.conf) - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh deleted file mode 100755 index a6ff6a1109..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0600 from $IncludeConfig passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -\$IncludeConfig ${test_conf} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh deleted file mode 100755 index 2ae5c89a4e..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0601 from $IncludeConfig fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -\$IncludeConfig ${test_conf} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh deleted file mode 100755 index a5a2f67fad..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh +++ /dev/null @@ -1,85 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0600 from $IncludeConfig passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 5 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[2]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[3]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[4]} - -# create test configuration files -conf_subdir=${RSYSLOG_TEST_DIR}/subdir -conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir -mkdir ${conf_subdir} -mkdir ${conf_hiddir} - -test_conf_in_subdir=${conf_subdir}/in_subdir.conf -test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak - -test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf -test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf - -cat << EOF > ${test_conf_in_subdir} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -cat << EOF > ${test_conf_name_bak} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -cat << EOF > ${test_conf_in_hiddir} -# rsyslog configuration file -# not used - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[3]} -EOF - -cat << EOF > ${test_conf_dot_name} -# rsyslog configuration file -# not used - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[4]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional") -include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional") -include(file="${RSYSLOG_TEST_DIR}" mode="optional") - -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf -\$IncludeConfig ${RSYSLOG_TEST_DIR} - -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh deleted file mode 100755 index fe4db0a3c9..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0601 from $IncludeConfig fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 5 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[3]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[4]} - -# create test configuration files -conf_subdir=${RSYSLOG_TEST_DIR}/subdir -conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir -mkdir ${conf_subdir} -mkdir ${conf_hiddir} - -test_conf_in_subdir=${conf_subdir}/in_subdir.conf -test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak - -test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf -test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf - -cat << EOF > ${test_conf_in_subdir} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -cat << EOF > ${test_conf_name_bak} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -cat << EOF > ${test_conf_in_hiddir} -# rsyslog configuration file -# not used - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[3]} -EOF - -cat << EOF > ${test_conf_dot_name} -# rsyslog configuration file -# not used - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[4]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional") -include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional") -include(file="${RSYSLOG_TEST_DIR}" mode="optional") - -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf -\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf -\$IncludeConfig ${RSYSLOG_TEST_DIR} - -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh deleted file mode 100755 index eabcb21956..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0600 from multiline include() passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include( - file="${test_conf}" -) -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh deleted file mode 100755 index 32cd4c334a..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0600 from include() passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh deleted file mode 100755 index 357d4f9718..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 - -# Check rsyslog.conf with log file permisssions 0600 from rules and -# log file permissions 0600 from include() passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh deleted file mode 100755 index 7bdb830c00..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 - -# Check rsyslog.conf with log file permisssions 0600 from rules and -# log file permissions 0601 from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh deleted file mode 100644 index 9b0185c6b2..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 - -# Check rsyslog.conf with log file permisssions 0600 from rules and -# log file permissions 0601 from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create hidden test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/.test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh deleted file mode 100644 index b929f2a94a..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 - -# Check rsyslog.conf with log file permisssions 0600 from rules and -# log file permissions 0601 from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_PASS=0600 -PERMS_FAIL=0601 - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# Skip creation test2 configuration file - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh deleted file mode 100644 index 2eb515a43e..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[@]} - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} -:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} -EOF - diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh deleted file mode 100755 index fd3f9e92ec..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 - -# Check rsyslog.conf with log file permissions 0600 from rules and -# log file permissions 0601 from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS_FAIL=0601 - -PERMS_PASS=0600 - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} -chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh deleted file mode 100644 index 7a598626d0..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -source $SHARED/rsyslog_log_utils.sh - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files and permissions -chmod 0600 ${RSYSLOG_TEST_LOGS[0]} -chmod 0601 ${RSYSLOG_TEST_LOGS[1]} - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} -:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} -EOF - diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh new file mode 100755 index 0000000000..b3846fec47 --- /dev/null +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# platform = multi_platform_sle,multi_platform_ubuntu + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +CHATTR="chmod" +ATTR_VALUE="0640" + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh new file mode 100755 index 0000000000..0b4cb5dce0 --- /dev/null +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# platform = multi_platform_all + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +CHATTR="chmod" +ATTR_VALUE="0400" + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh deleted file mode 100755 index fbdcd18f77..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check if log file with permissions 0600 in rsyslog.conf passes. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0600 - -# setup test data -create_rsyslog_test_logs 4 - -# setup all files with incorrect permission -chmod 0601 "${RSYSLOG_TEST_LOGS[@]}" - -# setup the real logfile with correct permissions -chmod $PERMS "${RSYSLOG_TEST_LOGS[0]}" - -# add rule with 0600 permissions log file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - - *.* ${RSYSLOG_TEST_LOGS[1]} - -authpriv.* /nonexistent_file - -# *.* /irrelevant_file - -\$something /irrelevant_file - -EOF diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh deleted file mode 100755 index 75e9558c63..0000000000 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check if log file with permissions 0601 in rsyslog.conf fails. - -source $SHARED/rsyslog_log_utils.sh - -PERMS=0601 - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log file and permissions -chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} - -# add rule with 0601 permissions log file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -cron.* /nonexistent_file - - authpriv.* /irrelevant_file - -# *.* /irrelevant_file - -\$something /irrelevant_file - -something.* ${RSYSLOG_TEST_LOGS[2]} - -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template index fc9e8844b6..81d6220415 100644 --- a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template +++ b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template @@ -20,7 +20,7 @@ - name: '{{{ rule_title }}} - Get include files directives' ansible.builtin.shell: | set -o pipefail - grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\"" -f 2 || true + awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' {{ rsyslog_etc_config }} || true register: rsyslog_new_inc changed_when: False @@ -61,8 +61,9 @@ - name: '{{{ rule_title }}} -Setup log files attribute' ansible.builtin.file: path: "{{ item }}" - owner: '{{ ( "{{{ ATTRIBUTE }}}" is match("owner")) | ternary({{{ VALUE }}}, omit) }}' - group: '{{ ( "{{{ ATTRIBUTE }}}" is match("groupowner")) | ternary({{{ VALUE }}} , omit) }}' + {{{ 'owner: ' ~ VALUE if ATTRIBUTE == "owner" }}} + {{{- 'group: ' ~ VALUE if ATTRIBUTE == "groupowner" }}} + {{{- 'mode: ' ~ VALUE if ATTRIBUTE == "permissions" }}} state: file loop: "{{ log_files | list | flatten | unique }}" failed_when: false diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template index ab4a563dc5..d6755d5692 100644 --- a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template +++ b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template @@ -48,7 +48,8 @@ do # * Strip quotes and closing brackets from paths. # * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files # * From the remaining valid rows select only fields constituting a log file path - # Text file column is understood to represent a log file path if and only if all of the following are met: + # Text file column is understood to represent a log file path if and only if all of the + # following are met: # * it contains at least one slash '/' character, # * it is preceded by space # * it doesn't contain space (' '), colon (':'), and semicolon (';') characters @@ -60,8 +61,8 @@ do FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}") CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}") MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}") - # Since above sed command might return more than one item (delimited by newline), split the particular - # matches entries into new array specific for this log file + # Since above sed command might return more than one item (delimited by newline), split + # the particular matches entries into new array specific for this log file readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS" # Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with # items from newly created array for this log file @@ -71,7 +72,8 @@ do fi done -# Check for RainerScript action log format which might be also multiline so grep regex is a bit curly +# Check for RainerScript action log format which might be also multiline so grep regex is a bit +# curly: # extract possibly multiline action omfile expressions # extract File="logfile" expression # match only "logfile" expression @@ -82,22 +84,10 @@ do LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")") done -FILE_PARAM="{{{ ATTRIBUTE }}}" -FILE_CMD="" -case "$FILE_PARAM" in - "groupowner") - FILE_CMD=$(which chgrp) - ;; - "owner") - FILE_CMD=$(which chown) - ;; - *) - echo -n "Not supported file attribute! " - exit 1 - ;; -esac - -# Correct the form o +# Ensure the correct attribute if file exists +{{{ 'FILE_CMD="chown"' if ATTRIBUTE == "owner" }}} +{{{- 'FILE_CMD="chgrp"' if ATTRIBUTE == "groupowner" }}} +{{{- 'FILE_CMD="chmod"' if ATTRIBUTE == "permissions" }}} for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}" do # Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing @@ -105,6 +95,5 @@ do then continue fi - - $FILE_CMD "+{{{ VALUE }}}" "$LOG_FILE_PATH" + $FILE_CMD "{{{ VALUE }}}" "$LOG_FILE_PATH" done diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template index 4f288df1c9..243d678852 100644 --- a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template +++ b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template @@ -3,59 +3,57 @@ {{{ oval_metadata("All syslog log files should have appropriate ownership.") }}} {{% if product in ["debian10", "debian11", "ubuntu1604"] %}} - + {{% endif %}} - + - - - - + + /etc/rsyslog.conf ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ + operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ 1 + comment="rsyslog's include config values converted to regex."> + object_ref="object_{{{ _RULE_ID }}}_include_config_value"/> - - + + var_{{{ _RULE_ID }}}_include_config_regex - + ^/etc/rsyslog.conf$ - + var_{{{ _RULE_ID }}}_syslog_config - - + + object_var_{{{ _RULE_ID }}}_include_config_regex object_var_{{{ _RULE_ID }}}_syslog_config @@ -64,74 +62,72 @@ - - + + - - - - - ^\s*[^(\s|#|\$)]+\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$ + + + + + ^\s*[^(\s|#|\$)]+\s+.*\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$ 1 - state_{{{ _RULE_ID }}}_ownership_ignore_include_paths + state_{{{ _RULE_ID }}}_ignore_include_paths - - + + (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) + retrieved from the different rsyslog configuration files. --> - + comment="File paths of all rsyslog log files"> + - - - + + + - - + + regular {{% if ATTRIBUTE == "groupowner" %}} {{{ VALUE }}} - {{% else %}} + {{% elif ATTRIBUTE == "owner" %}} {{{ VALUE }}} + {{% else %}} + {{{ STATEMODE | indent(4) }}} {{% endif %}} - diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/template.py b/shared/templates/rsyslog_logfiles_attributes_modify/template.py new file mode 100644 index 0000000000..9ea31c9a6b --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/template.py @@ -0,0 +1,18 @@ +def preprocess(data, lang): + if lang == "oval" and data["attribute"] == 'permissions': + # create STATEMODE used in the OVAL template by processing the octal permission and + # creating the equivalent permission fields of "unix:file_state" element. + mode = data["value"] + fields = [ + 'oexec', 'owrite', 'oread', 'gexec', 'gwrite', 'gread', + 'uexec', 'uwrite', 'uread', 'sticky', 'sgid', 'suid'] + mode_int = int(mode, 8) + mode_str = "" + for field in fields: + if mode_int & 0x01 == 0: + mode_str = ( + "false\n{mode_str}".format( + field=field, mode_str=mode_str)) + mode_int = mode_int >> 1 + data["statemode"] = mode_str.rstrip("\n") + return data diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh deleted file mode 100755 index db7e5261eb..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# non root user log from $IncludeConfig fails. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -ADDCOMMAND="useradd" -CHATTR="chown" -{{% else %}} -ADDCOMMAND="groupadd" -CHATTR="chgrp" -{{% endif %}} - -USER_TEST=testssg -$ADDCOMMAND $USER_TEST - -USER_ROOT=root - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files ownership -$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -\$IncludeConfig ${test_conf} -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh deleted file mode 100755 index d79ae23cfc..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# non root user log from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -ADDCOMMAND="useradd" -CHATTR="chown" -{{% else %}} -ADDCOMMAND="groupadd" -CHATTR="chgrp" -{{% endif %}} - -USER_TEST=testssg -$ADDCOMMAND $USER_TEST - -USER_ROOT=root - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files ownership -$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh deleted file mode 100644 index 7869a180a8..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh +++ /dev/null @@ -1,75 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# root user log from include() passes. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -ADDCOMMAND="useradd" -CHATTR="chown" -{{% else %}} -ADDCOMMAND="groupadd" -CHATTR="chgrp" -{{% endif %}} - -USER_TEST=testssg -$ADDCOMMAND $USER_TEST - -USER=root - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files ownership -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -{{% if ATTRIBUTE == "owner" %}} -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - - -*.* action(type="omfile" FileCreateMode="0640" fileOwner="$USER_TEST" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") -EOF -{{% else %}} -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - - -*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="$USER_TEST" File="${RSYSLOG_TEST_LOGS[2]}") -EOF -{{% endif %}} - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh deleted file mode 100755 index e80395ca99..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# root user log from include() passes. - -source $SHARED/rsyslog_log_utils.sh - - -{{% if ATTRIBUTE == "owner" %}} -CHATTR="chown" -{{% else %}} -CHATTR="chgrp" -{{% endif %}} - -USER=root - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh deleted file mode 100755 index e7b4905dc5..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# non root user log from include() fails. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -ADDCOMMAND="useradd" -CHATTR="chown" -{{% else %}} -ADDCOMMAND="groupadd" -CHATTR="chgrp" -{{% endif %}} - -USER_ROOT=root - -USER_TEST=testssg -$ADDCOMMAND $USER_TEST - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files ownership -$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[1]} -$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh deleted file mode 100755 index 6389e6ea3b..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# root user log from include() passes. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -CHATTR="chown" -{{% else %}} -CHATTR="chgrp" -{{% endif %}} - -USER=root - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[2]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh deleted file mode 100755 index 6b81a77c2f..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# root user log from include() passes. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -CHATTR="chown" -{{% else %}} -CHATTR="chgrp" -{{% endif %}} - -USER=root - -# setup test data -create_rsyslog_test_logs 3 - -# setup test log files ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create test2 configuration file -test_conf2=${RSYSLOG_TEST_DIR}/test2.conf -cat << EOF > ${test_conf2} -# rsyslog configuration file - -#### RULES #### - - -*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include(file="${test_conf}") - -\$IncludeConfig ${test_conf2} -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh deleted file mode 100755 index 78b105abf3..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle - -# Check rsyslog.conf with root user log from rules and -# root user log from multiline include() passes. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -CHATTR="chown" -{{% else %}} -CHATTR="chgrp" -{{% endif %}} - -USER=root - -# setup test data -create_rsyslog_test_logs 2 - -# setup test log files ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} - -# create test configuration file -test_conf=${RSYSLOG_TEST_DIR}/test1.conf -cat << EOF > ${test_conf} -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[1]} -EOF - -# create rsyslog.conf configuration file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -#### MODULES #### - -include( - file="${test_conf}" -) -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh deleted file mode 100755 index afce21fa27..0000000000 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle - -# Check if log file with root user in rsyslog.conf passes. - -source $SHARED/rsyslog_log_utils.sh - -{{% if ATTRIBUTE == "owner" %}} -CHATTR="chown" -{{% else %}} -CHATTR="chgrp" -{{% endif %}} - -USER=root - -# setup test data -create_rsyslog_test_logs 1 - -# setup test log file ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} - -# add rule with root user owned log file -cat << EOF > $RSYSLOG_CONF -# rsyslog configuration file - -#### RULES #### - -*.* ${RSYSLOG_TEST_LOGS[0]} - -EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh similarity index 53% rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh index 1afe20823c..dc362ae003 100755 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh @@ -1,33 +1,31 @@ #!/bin/bash # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle -# Check if log file with non root user in rsyslog.conf fails. - +# Declare variables used for the tests and define the create_rsyslog_test_logs function source $SHARED/rsyslog_log_utils.sh {{% if ATTRIBUTE == "owner" %}} -ADDCOMMAND="useradd" CHATTR="chown" -{{% else %}} -ADDCOMMAND="groupadd" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" {{% endif %}} -USER=testssg - -$ADDCOMMAND $USER - -# setup test data +# create one test log file create_rsyslog_test_logs 1 -# setup test log file ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} -# add rule with non-root user owned log file +# add rule with test log file cat << EOF > $RSYSLOG_CONF # rsyslog configuration file #### RULES #### - *.* ${RSYSLOG_TEST_LOGS[0]} + EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh similarity index 51% rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh index b03268fe3e..c742f41039 100755 --- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh @@ -1,45 +1,45 @@ #!/bin/bash # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle -# Check rsyslog.conf with root user log from rules and -# root user log from $IncludeConfig passes. - +# Declare variables used for the tests and define the create_rsyslog_test_logs function source $SHARED/rsyslog_log_utils.sh {{% if ATTRIBUTE == "owner" %}} CHATTR="chown" -{{% else %}} +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" {{% endif %}} -USER=root - -# setup test data +# create two test log file create_rsyslog_test_logs 2 -# setup test log files ownership -$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} -$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} -# create test configuration file +# create test configuration file with rule for second test log file test_conf=${RSYSLOG_TEST_DIR}/test1.conf cat << EOF > ${test_conf} -# rsyslog configuration file +# rsyslog test configuration file #### RULES #### - *.* ${RSYSLOG_TEST_LOGS[1]} + EOF -# create rsyslog.conf configuration file +# add rule with first test log file plus an include statement cat << EOF > $RSYSLOG_CONF # rsyslog configuration file #### RULES #### - *.* ${RSYSLOG_TEST_LOGS[0]} #### MODULES #### - \$IncludeConfig ${test_conf} + EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh new file mode 100755 index 0000000000..a12d0bc653 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create two test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# create test configuration file with rule for second test log file +test_conf=${RSYSLOG_TEST_DIR}/test1.conf +cat << EOF > ${test_conf} +# rsyslog test configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[1]} + +EOF + +# add rule with first test log file plus an include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} + +#### MODULES #### +\$IncludeConfig ${test_conf} + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh new file mode 100755 index 0000000000..25430db033 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh @@ -0,0 +1,33 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create one test log file +create_rsyslog_test_logs 1 + +# setup test log file property +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} + +# add rule with non-root user owned log file +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh new file mode 100755 index 0000000000..c1c5758d80 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh @@ -0,0 +1,33 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh new file mode 100755 index 0000000000..0235130534 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 3 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]} + +# create first test configuration file with legacy rule for second test log file +test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf +cat << EOF > ${test_conf1} +# rsyslog test configuration file with legacy syntax + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[1]} + +EOF + +# create second test configuration file with RainerScript rule for third test log file +test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf +cat << EOF > ${test_conf2} +# rsyslog test configuration file with RainerScript syntax + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") + +EOF + +# add rule with first test log file plus two mixed include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} + +#### MODULES #### +\$IncludeConfig ${test_conf1} + +include(file="${test_conf2}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh new file mode 100755 index 0000000000..bed0afaf5e --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh @@ -0,0 +1,63 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 3 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]} + +# create first test configuration file with legacy rule for second test log file +test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf +cat << EOF > ${test_conf1} +# rsyslog test configuration file with legacy syntax + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[1]} + +EOF + +# create second test configuration file with RainerScript rule for third test log file +test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf +cat << EOF > ${test_conf2} +# rsyslog test configuration file with RainerScript syntax + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") + +EOF + +# add rule with first test log file plus two mixed include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} + +#### MODULES #### +\$IncludeConfig ${test_conf1} + +include(file="${test_conf2}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh new file mode 100755 index 0000000000..83c69b3a17 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh @@ -0,0 +1,63 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 3 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[2]} + +# create first test configuration file with legacy rule for second test log file +test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf +cat << EOF > ${test_conf1} +# rsyslog test configuration file with legacy syntax + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[1]} + +EOF + +# create second test configuration file with RainerScript rule for third test log file +test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf +cat << EOF > ${test_conf2} +# rsyslog test configuration file with RainerScript syntax + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") + +EOF + +# add rule with first test log file plus two mixed include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} + +#### MODULES #### +\$IncludeConfig ${test_conf1} + +include(file="${test_conf2}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh new file mode 100755 index 0000000000..43a6f2648d --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh new file mode 100755 index 0000000000..f459e7377b --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh new file mode 100755 index 0000000000..67193b69d8 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create three test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# add rules with both syntax for different test log files +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* ${RSYSLOG_TEST_LOGS[0]} +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh new file mode 100755 index 0000000000..abdb09c485 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +{{% endif %}} + +# create one test log file +create_rsyslog_test_logs 1 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} + +# add rule with test log file +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh new file mode 100755 index 0000000000..8b73578e39 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +{{% endif %}} + +# create two test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# create test configuration file with rule for second test log file +test_conf=${RSYSLOG_TEST_DIR}/test1.conf +cat << EOF > ${test_conf} +# rsyslog test configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF + +# add rule with first test log file plus an include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +#### MODULES #### +include(file="${test_conf}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh new file mode 100755 index 0000000000..4c25c09e2e --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create two test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# create test configuration file with rule for second test log file +test_conf=${RSYSLOG_TEST_DIR}/test1.conf +cat << EOF > ${test_conf} +# rsyslog test configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF + +# add rule with first test log file plus an include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +#### MODULES #### +include(file="${test_conf}") + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh new file mode 100755 index 0000000000..508a5cf6eb --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh @@ -0,0 +1,47 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +{{% endif %}} + +# create two test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# create test configuration file with rule for second test log file +test_conf=${RSYSLOG_TEST_DIR}/test1.conf +cat << EOF > ${test_conf} +# rsyslog test configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF + +# add rule with first test log file plus an include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +#### MODULES #### +include( + file="${test_conf}" +) + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh new file mode 100755 index 0000000000..49fada4cd4 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_VALUE="root" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_VALUE="0600" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create two test log file +create_rsyslog_test_logs 2 + +# setup test log file property +$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} + +# create test configuration file with rule for second test log file +test_conf=${RSYSLOG_TEST_DIR}/test1.conf +cat << EOF > ${test_conf} +# rsyslog test configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") + +EOF + +# add rule with first test log file plus an include statement +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +#### MODULES #### +include( + file="${test_conf}" +) + +EOF diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh new file mode 100755 index 0000000000..b17eb6b744 --- /dev/null +++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh @@ -0,0 +1,33 @@ +#!/bin/bash +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +# Declare variables used for the tests and define the create_rsyslog_test_logs function +source $SHARED/rsyslog_log_utils.sh + +{{% if ATTRIBUTE == "owner" %}} +CHATTR="chown" +ATTR_INCORRECT_VALUE="cac_testuser" +useradd $ATTR_INCORRECT_VALUE +{{% elif ATTRIBUTE == "groupowner" %}} +CHATTR="chgrp" +ATTR_INCORRECT_VALUE="cac_testgroup" +groupadd $ATTR_INCORRECT_VALUE +{{% else %}} +CHATTR="chmod" +ATTR_INCORRECT_VALUE="0666" +{{% endif %}} + +# create one test log file +create_rsyslog_test_logs 1 + +# setup test log file property +$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} + +# add rule with non-root user owned log file +cat << EOF > $RSYSLOG_CONF +# rsyslog configuration file + +#### RULES #### +*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") + +EOF -- 2.39.1