Skip to content

Commit 642aefd

Browse files
jan-cernyjan-cerny
authored
Merge pull request #13841 from vojtapolasek/stab_fix_auditd_freq
[stabilization]: auditd_lineinfile: allow specifying data type of XCCDF variable
2 parents 80a48cb + 1051449 commit 642aefd

10 files changed

Lines changed: 49 additions & 23 deletions

File tree

‎docs/templates/template_reference.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,17 @@
3131
- **xccdf_variable** - specifies an XCCDF variable to use as a value for the specified **parameter**.
3232
This parameter conflicts with the **value** parameter.
3333

34+
- **variable_datatype** - data type of the XCCDF variable specified by the xccdf_variable parameter, optional, default is string
35+
36+
- **test_correct_value** - optional. If set, it will be used in test scenarios as a correct value.
37+
If not set, the "value" parameter of the template will be used.
38+
If XCCDF variable is used and this option is not set, then a string "corect_value" will be used.
39+
This parameter should be used in case the value is defined by an XCCDF variable and the value must be chosen from a strictly defined set of options.
40+
41+
- **test_wrong_value** - optional. If set, this value will be used in test scenarios as an incorrect value.
42+
If not set, a string "wrong_value" will be used.
43+
This parameter can be used in case that the value has to be chosen from strictly defined set of options.
44+
3445
- **missing_parameter_pass** - effective only in OVAL checks, if
3546
set to `"false"` and the parameter is not present in the
3647
configuration file, the OVAL check will return false (default value: `"false"`).
@@ -619,10 +630,10 @@ When the remediation is applied duplicate occurrences of `key` are removed.
619630

620631
- **test_correct_value** - optional. If set, it will be used in test scenarios as a correct value.
621632
If not set, the "value" parameter of the template will be used.
622-
If XCCDF variable is used and the this option is not set, then a string "corect_value" will be used.
633+
If XCCDF variable is used and this option is not set, then a string "corect_value" will be used.
623634
This parameter should be used in case the value is defined by an XCCDF variable and the value must be chosen from a strictly defined set of options.
624635

625-
- **test_wrong_value** - optional. If set, this value will be used test scenarios as a incorrect value.
636+
- **test_wrong_value** - optional. If set, this value will be used in test scenarios as an incorrect value.
626637
If not set, a string "wrong_value" will be used.
627638
This parameter can be used in case that the value has to be chosen from strictly defined set of options.
628639

‎linux_os/guide/auditing/configure_auditd_data_retention/auditd_freq/rule.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,3 +47,6 @@ template:
4747
parameter: freq
4848
rule_id: auditd_freq
4949
xccdf_variable: var_auditd_freq
50+
variable_datatype: int
51+
test_correct_value: 50
52+
test_wrong_value: 1

‎shared/macros/10-oval.jinja‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -671,6 +671,8 @@ Generates the :code:`<affected>` tag for OVAL check using correct product platfo
671671
:type value: str
672672
:param xccdf_variable: the name of an XCCDF variable carrying the value, this conflicts with the value parameter
673673
:type xccdf_variable: str
674+
:param variable_datatype: data type of the XCCDF variable specified by the xccdf_variable parameter, optional, default is string
675+
:type variable_datatype: str
674676
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
675677
:type missing_parameter_pass: bool
676678
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
@@ -679,8 +681,8 @@ Generates the :code:`<affected>` tag for OVAL check using correct product platfo
679681
:type missing_config_file_fail: bool
680682

681683
#}}
682-
{{%- macro oval_auditd_config(parameter='', value='', xccdf_variable='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false, rule_id=None, rule_title=None) %}}
683-
{{{ oval_check_config_file("/etc/audit/auditd.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", xccdf_variable=xccdf_variable, missing_parameter_pass=missing_parameter_pass, application="auditd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, rule_id=rule_id, rule_title=rule_title) }}}
684+
{{%- macro oval_auditd_config(parameter='', value='', xccdf_variable='', variable_datatype='string', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false, rule_id=None, rule_title=None) %}}
685+
{{{ oval_check_config_file("/etc/audit/auditd.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", xccdf_variable=xccdf_variable, variable_datatype=variable_datatype, missing_parameter_pass=missing_parameter_pass, application="auditd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, rule_id=rule_id, rule_title=rule_title) }}}
684686
{{%- endmacro %}}
685687

686688

‎shared/templates/auditd_lineinfile/oval.template‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,18 @@
33
oval_auditd_config(
44
parameter=PARAMETER,
55
xccdf_variable=XCCDF_VARIABLE,
6-
missing_parameter_pass=MISSING_PARAMETER_PASS, rule_id=rule_id, rule_title=rule_title)
6+
variable_datatype=VARIABLE_DATATYPE,
7+
missing_parameter_pass=MISSING_PARAMETER_PASS,
8+
rule_id=rule_id,
9+
rule_title=rule_title)
710
}}}
811
{{%- else -%}}
912
{{{
1013
oval_auditd_config(
1114
parameter=PARAMETER,
1215
value=VALUE,
13-
missing_parameter_pass=MISSING_PARAMETER_PASS, rule_id=rule_id, rule_title=rule_title)
16+
missing_parameter_pass=MISSING_PARAMETER_PASS,
17+
rule_id=rule_id,
18+
rule_title=rule_title)
1419
}}}
1520
{{%- endif -%}}

‎shared/templates/auditd_lineinfile/template.py‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,20 @@ def preprocess(data, lang):
1010
raise ValueError(errmsg)
1111
data["missing_parameter_pass"] = parse_template_boolean_value(
1212
data, parameter="missing_parameter_pass", default_value=False)
13+
if "variable_datatype" not in data:
14+
data["variable_datatype"] = "string"
1315
return set_variables_for_test_scenarios(data)
1416

1517

1618
def set_variables_for_test_scenarios(data):
17-
if not data.get("value"):
18-
# this implies XCCDF variable is used
19-
data["wrong_value"] = "wrong_value"
20-
data["correct_value"] = "correct_value"
21-
else:
22-
data["wrong_value"] = "wrong_value"
23-
data["correct_value"] = str(data["value"])
19+
# if no correct value is specified, we will create one for testing purposes
20+
if not data.get("test_correct_value"):
21+
if not data.get("value"):
22+
# this implies XCCDF variable is used
23+
data["test_correct_value"] = "test_correct_value"
24+
else:
25+
data["test_correct_value"] = str(data["value"])
26+
# if no wrong value is provided, we will create one for testing purposes
27+
if not data.get("test_wrong_value"):
28+
data["test_wrong_value"] = "test_wrong_value"
2429
return data

‎shared/templates/auditd_lineinfile/tests/commented.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
{{% endif%}}
55
# packages = audit
66
{{% if XCCDF_VARIABLE %}}
7-
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
7+
# variables = {{{ XCCDF_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
88
{{% endif %}}
9-
echo "#{{{ PARAMETER }}} = {{{ CORRECT_VALUE }}}" > "/etc/audit/auditd.conf"
9+
echo "#{{{ PARAMETER }}} = {{{ TEST_CORRECT_VALUE }}}" > "/etc/audit/auditd.conf"

‎shared/templates/auditd_lineinfile/tests/correct_value.pass.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# packages = audit
33
{{% if XCCDF_VARIABLE %}}
4-
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
4+
# variables = {{{ XCCDF_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
55
{{% endif %}}
6-
echo "{{{ PARAMETER }}} = {{{ CORRECT_VALUE }}}" > "/etc/audit/auditd.conf"
6+
echo "{{{ PARAMETER }}} = {{{ TEST_CORRECT_VALUE }}}" > "/etc/audit/auditd.conf"

‎shared/templates/auditd_lineinfile/tests/double_assignment.fail.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22
# packages = audit
33
{{% if XCCDF_VARIABLE %}}
4-
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
4+
# variables = {{{ XCCDF_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
55
{{% endif %}}
6-
echo "{{{ PARAMETER }}} = {{{ CORRECT_VALUE }}}" >> "/etc/audit/auditd.conf"
7-
echo "{{{ PARAMETER }}} = wrong_value" >> "/etc/audit/auditd.conf"
6+
echo "{{{ PARAMETER }}} = {{{ TEST_CORRECT_VALUE }}}" >> "/etc/audit/auditd.conf"
7+
echo "{{{ PARAMETER }}} = {{{ TEST_WRONG_VALUE }}}" >> "/etc/audit/auditd.conf"

‎shared/templates/auditd_lineinfile/tests/wrong_value.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# packages = audit
33
{{% if XCCDF_VARIABLE %}}
4-
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
4+
# variables = {{{ XCCDF_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
55
{{% endif %}}
6-
echo "{{{ PARAMETER }}} = {{{ WRONG_VALUE | upper }}}" > "/etc/audit/auditd.conf"
6+
echo "{{{ PARAMETER }}} = {{{ TEST_WRONG_VALUE }}}" > "/etc/audit/auditd.conf"

‎shared/templates/auditd_lineinfile/tests/wrong_value_capital.fail.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# packages = audit
33
{{% if XCCDF_VARIABLE %}}
4-
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
4+
# platform = Not Applicable
55
{{% endif %}}
66
echo "{{{ PARAMETER | upper }}} = {{{ WRONG_VALUE | upper }}}" > "/etc/audit/auditd.conf"

0 commit comments

Comments
 (0)