8000 Handle XCCDF variable in key_value_pair_in_file template by vojtapolasek · Pull Request #13051 · ComplianceAsCode/content · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Handle XCCDF variable in key_value_pair_in_file template #13051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 8 commits into from
Mar 26, 2025
Merged

Handle XCCDF variable in key_value_pair_in_file template #13051

merged 8 commits into from
Mar 26, 2025

Conversation

vojtapolasek
Copy link
Collaborator

Description:

  • modify the template so that it can handle also XCCDF variables
  • demonstrate that it works on the rule selinux_policytype
  • also switch the rule configure_usbguard_auditbackend to the template... because I chose it first and realized too late that it does not use XCCDF variable

Rationale:

  • this removes duplicate code and makes future rule authoring easier

Review Hints:

  • I recommend building the content without this PR and comparing ovals and remediations of two rules mentioned above with the content built with this PR

@vojtapolasek vojtapolasek added Update Rule Issues or pull requests related to Rules updates. Update Template Issues or pull requests related to Templates updates. labels Feb 14, 2025
@vojtapolasek vojtapolasek added this to the 0.1.77 milestone Feb 14, 2025
@vojtapolasek vojtapolasek mentioned this pull request Feb 14, 2025
Closed
@github-actions GitHub Actions
Copy link

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff 
OVAL for rule 'xccdf_org.ssgproject.content_rule_selinux_policytype' differs.
--- oval:ssg-selinux_policytype:def:1
+++ oval:ssg-selinux_policytype:def:1
@@ -1,2 +1,4 @@
 criteria AND
-criterion oval:ssg-test_selinux_policy:tst:1
+criteria OR
+criterion oval:ssg-test_selinux_policytype:tst:1
+criterion oval:ssg-test_selinux_policytype_config_file_exists:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_selinux_policytype' differs.
--- xccdf_org.ssgproject.content_rule_selinux_policytype
+++ xccdf_org.ssgproject.content_rule_selinux_policytype
@@ -2,7 +2,6 @@
 if rpm --quiet -q kernel; then
 
 var_selinux_policy_name=''
-
 
 if [ -e "/etc/selinux/config" ] ; then
     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_selinux_policytype' differs.
--- xccdf_org.ssgproject.content_rule_selinux_policytype
+++ xccdf_org.ssgproject.content_rule_selinux_policytype
@@ -12,11 +12,11 @@
   - NIST-800-53-SC-7(21)
   - PCI-DSSv4-1.2
   - PCI-DSSv4-1.2.6
+  - configure_strategy
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
   - selinux_policytype
 - name: XCCDF Value var_selinux_policy_name # promote to variable
   set_fact:
@@ -64,9 +64,9 @@
   - NIST-800-53-SC-7(21)
   - PCI-DSSv4-1.2
   - PCI-DSSv4-1.2.6
+  - configure_strategy
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
   - selinux_policytype

bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend' differs.
--- xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
+++ xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
@@ -3,7 +3,7 @@
 
 if [ -e "/etc/usbguard/usbguard-daemon.conf" ] ; then
     
-    LC_ALL=C sed -i "/^\s*AuditBackend=/d" "/etc/usbguard/usbguard-daemon.conf"
+    LC_ALL=C sed -i "/^[ \\t]*AuditBackend=/Id" "/etc/usbguard/usbguard-daemon.conf"
 else
     touch "/etc/usbguard/usbguard-daemon.conf"
 fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend' differs.
--- xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
+++ xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
@@ -7,12 +7,12 @@
   - NIST-800-53-AU-2
   - NIST-800-53-CM-8(3)
   - NIST-800-53-IA-3
+  - configure_strategy
   - configure_usbguard_auditbackend
   - low_complexity
   - low_disruption
   - low_severity
   - no_reboot_needed
-  - restrict_strategy
 
 - name: Log USBGuard daemon audit events using Linux Audit
   block:
@@ -21,7 +21,7 @@
     lineinfile:
       path: /etc/usbguard/usbguard-daemon.conf
       create: true
-      regexp: (?i)^\s*AuditBackend=
+      regexp: (?i)^[ \\t]*AuditBackend=
       state: absent
     check_mode: true
     changed_when: false
@@ -31,7 +31,7 @@
     lineinfile:
       path: /etc/usbguard/usbguard-daemon.conf
       create: true
-      regexp: (?i)^\s*AuditBackend=
+      regexp: (?i)^[ \\t]*AuditBackend=
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -39,7 +39,7 @@
     lineinfile:
       path: /etc/usbguard/usbguard-daemon.conf
       create: true
-      regexp: (?i)^\s*AuditBackend=
+      regexp: (?i)^[ \\t]*AuditBackend=
       line: AuditBackend=LinuxAudit
       state: present
   when:
@@ -51,9 +51,9 @@
   - NIST-800-53-AU-2
   - NIST-800-53-CM-8(3)
   - NIST-800-53-IA-3
+  - configure_strategy
   - configure_usbguard_auditbackend
   - low_complexity
   - low_disruption
   - low_severity
   - no_reboot_needed
-  - restrict_strategy

@jan-cerny jan-cerny self-assigned this Feb 17, 2025
@jan-cerny jan-cerny changed the title Handle XCCDF variable in key_value_in_file template Handle XCCDF variable in key_value_pair_in_file template Feb 17, 2025
jan-cerny
jan-cerny reviewed Feb 17, 2025
View reviewed changes
linux_os/guide/system/selinux/selinux_policytype/tests/test_config.yml
@@ -0,0 +1,6 @@
deny_templated_scenarios:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you disable the templated scenarios? I can see that you modified the templated scenarios to make them work also if the XCCDF value is provided, but on this rule where you want to demonstrate it you disabled them.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello.
This is a good point and it made me add some additional template options for providing correct and incorrect value which is later used in test scenarios.
See latest commits.
However, some scenarios have to be skipped because selinux is very picky about the configuration file. And if configured incorrectly, it will not allow me to continue.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

amazing!

shared/macros/10-oval.jinja
@@ -84,9 +91,19 @@ Generates the :code:`<affected>` tag for OVAL check using correct product platfo
</criteria>
{{%- endif %}}
</definition>

{{% if xccdf_variable %}}
{{{ oval_line_in_file_define_variable(xccdf_variable, datatype="string") }}}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like that this macro generates a local variable that references an external variable. Also, I don't like that the generated local variable has a comment: Regex that matches exact value represented by var_selinux_policy_name XCCDF variable. That is misleading, at least for the OVAL in rule selinux_policytype, the XCCDF value isn't a regular expression and the local variable isn't used in a pattern match operation but in a equals operation.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hope I resolved naming problems in 68a527c .
Regarding the usage of local variable... I always thought that you need a local variable to reference external variable and then the local variable can be used in OVAL state. Am I wrong?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use external variable directly in OVAL state. You don't need the interim local variable. See for example linux_os/guide/system/selinux/selinux_state/oval/shared.xml where in textfilecontent54_state the var_ref="var_selinux_state" references external_variable.

@jan-cerny
Copy link
Collaborator

/packit build

jan-cerny
jan-cerny requested changes Mar 18, 2025
View reviewed changes
Copy link
Collaborator
@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When testing rule selinux_policytype using Automatus against a RHEL 9 VM the test scenario missing_file.fail.sh errors for me in both Ansible and oscap remediations. The verbose log shows the following:

Warning: Permanently added '192.168.124.220' (ED25519) to the list of known hosts.
Connection closed by 192.168.124.220 port 22
Failed to connect!

I don't know what problem is this. I suggest adding the missing_file.fail.sh to linux_os/guide/system/selinux/selinux_policytype/tests/test_config.yml

vojtapolasek and others added 7 commits March 20, 2025 15:45
@vojtapolasek
modify the macro oval_check_config_file to be able to use XCCDF varia…
2573c6d 
…ble in the place of value
@vojtapolasek
update the key_value_pair_in_file to be able to use XCCDF variable in…
568584d 
…stead of hardcoded value
@vojtapolasek
switch the rule configure_usbguard_auditbackend to the newly modified…
751653c 
… template
@vojtapolasek
switch the rule selinux_policytype to the newly modified template
8152409 
This rule uses XCCDF variable.
@vojtapolasek
add two new parameters to the template to configure correct and wrong…
571c700 
… test value

See updated template documentation for explanation.
@vojtapolasek
selinux_policytype: allow more templated tests
71d2ffd 
Some tests still need to be excluded because selinux has apparently very strict configuration format.
In case the configuration is invalid, it is not possible to log into the test machine.
@vojtapolasek
oval line_in_file macros: get rid of intermediate local variable
4532fa5 
it is not needed
@vojtapolasek vojtapolasek force-pushed the add_xccdf_variable_handling_to_key_value_in_file_template branch from 68a527c to 4532fa5 Compare March 20, 2025 15:14
@vojtapolasek
Copy link
Collaborator Author

Hello @jan-cerny I think I solved all your feedback in latest commits.

@codeclimate CodeClimate
Copy link
codeclimate bot commented Mar 20, 2025

Code Climate has analyzed commit b048962 and detected 2 issues on this pull request.

Here's the issue category breakdown:

Category Count
Duplication 2

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

jan-cerny
jan-cerny approved these changes Mar 26, 2025
View reviewed changes
Copy link
Collaborator
@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TSs have passed locally on a RHEL 9 VM back end.

8000
jcerny@fedora:~/work/git/scap-security-guide (pr/13051)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 selinux_policytype
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-26-0945/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_selinux_policytype
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script selinuxtype_missing.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script selinuxtype_targeted.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script selinuxtype_targeted_additional_spaces.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13051)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible selinux_policytype
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-26-0948/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_selinux_policytype
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script selinuxtype_missing.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script selinuxtype_targeted.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script selinuxtype_targeted_additional_spaces.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13051)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 configure_usbguard_auditbackend
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-26-0951/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
INFO - Script conflicting_values.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script missing_file.fail.sh using profile (all) OK
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script commented.fail.sh using profile (all) OK
INFO - Script missing.fail.sh using profile (all) OK
INFO - Script present.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13051)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible configure_usbguard_auditbackend
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-26-0954/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script conflicting_values.fail.sh using profile (all) OK
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script missing_file.fail.sh using profile (all) OK
INFO - Script commented.fail.sh using profile (all) OK
INFO - Script missing.fail.sh using profile (all) OK
INFO - Script present.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK

@jan-cerny jan-cerny merged commit 95838f4 into ComplianceAsCode:master Mar 26, 2025
104 of 111 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes

Assignees

@jan-cerny jan-cerny

Labels
Update Rule Issues or pull requests related to Rules updates. Update Template Issues or pull requests related to Templates updates.
Projects
None yet
Milestone
0.1.77
Development

Successfully merging this pull request may close these issues.
2 participants
@vojtapolasek @jan-cerny
0