-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use opening parenthesis in the switch case condition of RHEL-08-020041 #10472
Use opening parenthesis in the switch case condition of RHEL-08-020041 #10472
Conversation
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_bashrc_tmux' differs.
--- xccdf_org.ssgproject.content_rule_configure_bashrc_tmux
+++ xccdf_org.ssgproject.content_rule_configure_bashrc_tmux
@@ -1,12 +1,12 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q tmux; then
-if ! grep -x ' case "$name" in sshd|login) tmux ;; esac' /etc/bashrc /etc/profile.d/*.sh; then
+if ! grep -x ' case "$name" in (sshd|login) tmux ;; esac' /etc/bashrc /etc/profile.d/*.sh; then
cat >> /etc/profile.d/tmux.sh <<'EOF'
if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
- case "$name" in sshd|login) tmux ;; esac
+ case "$name" in (sshd|login) tmux ;; esac
fi
EOF
chmod 0644 /etc/profile.d/tmux.sh
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_bashrc_tmux' differs.
--- xccdf_org.ssgproject.content_rule_configure_bashrc_tmux
+++ xccdf_org.ssgproject.content_rule_configure_bashrc_tmux
@@ -16,7 +16,7 @@
ansible.builtin.find:
paths: /etc
patterns: bashrc
- contains: .*case "$name" in sshd|login) tmux ;; esac.*
+ contains: .*case "$name" in (sshd|login) tmux ;; esac.*
register: tmux_in_bashrc
when: '"tmux" in ansible_facts.packages'
tags:
@@ -34,7 +34,7 @@
ansible.builtin.find:
paths: /etc/profile.d
patterns: '*.sh'
- contains: .*case "$name" in sshd|login) tmux ;; esac.*
+ contains: .*case "$name" in (sshd|login) tmux ;; esac.*
register: tmux_in_profile_d
when: '"tmux" in ansible_facts.packages'
tags:
@@ -55,7 +55,7 @@
if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
- case "$name" in sshd|login) tmux ;; esac
+ case "$name" in (sshd|login) tmux ;; esac
fi
create: true
when: |
1a22414
to
d35d9f9
Compare
@ggbecker After testing, it's unfortunately still misaligned. Not because the string, but because of not running OVAL test results details/etc/profile.d/*.sh contains a shell script to initialize the tmux terminal multiplexer as each shell is called. oval:mil.disa.stig.rhel8:tst:19400 trueFollowing items have been found on the system:
The tmux process is running. oval:mil.disa.stig.rhel8:tst:19401 falseNo items have been found conforming to the following objects:Object oval:mil.disa.stig.rhel8:obj:19401 of type process58_object
|
Okay, but I'm not sure if running tmux in the remediation would be the correct approach. Furthermore, the only change we requested DISA was to change the parenthesis thing, I don't recall anything about the running tmux, so I'm not sure exactly what to do here. Is it the case that a reboot would fix the misalignment? Because new shells would spawn tmux and then the requirement would be met for example. |
This change is to align with DISA STIG since it's also a valid syntax and they have not changed their SCAP content. The OVAL file should still accept a configuration without the opening parenthesis by making it optional in the regex.
d35d9f9
to
97fa904
Compare
Code Climate has analyzed commit 97fa904 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 52.4% (0.0% change). View more on Code Climate. |
The Line 3 in 3d9b19c
So it should be safe to ignore. |
@mildas @yuumasato PING |
This should be quite safe to merge IMO. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for this patch, indeed the opening parenthesis is allowed:
https://www.gnu.org/software/bash/manual/bash.html#index-case
Description:
Rationale:
With this change we will be able to remove the waiver from the STIG alignment test: https://gitlab.com/redhat/rhel/tests/scap-security-guide/-/blob/master/Library/ssg-test-suite/disa_alignment_waivers/rhel8#L2
@mildas See the above.
Fixes: #9309