Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jinja macro doc fixes #10599

Merged
merged 97 commits into from
May 23, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
97 commits
Select commit Hold shift + click to select a range
625d8d1
style: jinja: ws cleanup
maage May 20, 2023
e3cb928
style: jinja macros: add/remove newlines
maage May 20, 2023
4412c41
fix: ansible_audit_augenrules_add_syscall_rule/doc: add types, fix name
maage May 20, 2023
4a323c5
fix: ansible_audit_auditctl_add_syscall_rule/doc: add types, fix name…
maage May 20, 2023
de2c78b
fix: ansible_pkg_conditional/doc: add types
maage May 20, 2023
31738da
fix: ansible_apply_authselect_changes/doc: add type
maage May 20, 2023
84780bf
fix: ansible_pam_pwhistory_enable/doc: add types
maage May 20, 2023
d16c3d6
fix: ansible_pam_pwhistory_parameter_value/doc: add types
maage May 20, 2023
00e8d24
fix: ansible_pam_faillock_parameter_value/doc: add types
maage May 20, 2023
ef06d11
fix: ansible_ensure_pam_module_line/doc: add types
maage May 20, 2023
537505f
fix: ansible_ensure_pam_module_option/doc: add types
maage May 20, 2023
d6ad525
fix: ansible_remove_pam_module_option/doc: add types
maage May 20, 2023
f6296e6
fix: ansible_ensure_pam_facts_and_authselect_profile/doc: add type
maage May 20, 2023
b1fc1f6
fix: ansible_ensure_pam_module_configuration/doc: add types
maage May 20, 2023
7a72606
fix: ansible_remove_pam_module_option_configuration/doc: add types
maage May 20, 2023
b8321c5
fix: ansible_instantiate_variables/doc: fix format
maage May 20, 2023
8e15b79
fix: ansible_grub2_bootloader_argument/doc: fix type format
maage May 20, 2023
d9e474f
fix: ansible_grub2_bootloader_argument_absent/doc: fix type format
maage May 20, 2023
d0822db
fix: bash_pam_pwhistory_enable/doc: param must start line, add types
maage May 20, 2023
62ae116
fix: bash_ensure_nl_at_eof/doc: param must start line, add types
maage May 20, 2023
30f8329
fix: bash_ensure_mount_option_in_fstab/doc: param must start line, ad…
maage May 20, 2023
01b6666
fix: bash_ensure_pam_module_options/doc: add types
maage May 20, 2023
7d12c17
fix: bash_provide_pam_module_options/doc: add types
maage May 20, 2023
5a30bb9
fix: bash_ensure_pam_variables_and_authselect_profile/doc: add type
maage May 20, 2023
a79d48f
fix: bash_service_command/doc: add types, indent
maage May 20, 2023
5becc3a
fix: bash_perform_audit_rules_privileged_commands_remediation/doc: ad…
maage May 20, 2023
d4baa5d
fix: bash_fix_audit_watch_rule/doc: add types, move right place
maage May 20, 2023
e4e1e6f
fix: bash_firefox_js_setting/doc: add types, add missing param
maage May 20, 2023
e11c355
fix: bash_firefox_cfg_setting/doc: add types, add missing params
maage May 20, 2023
444ee9b
fix: bash_ensure_there_are_servers_in_ntp_compatible_config_file/doc:…
maage May 20, 2023
03c1ac9
fix: bash_apply_authselect_changes/doc: add type
maage May 20, 2023
b97a6dd
fix: bash_pam_pwhistory_parameter_value/doc: add types
maage May 20, 2023
f8f7186
fix: bash_pam_faillock_parameter_value/doc: add types
maage May 20, 2023
d7e2735
fix: bash_file_contents/doc: add types
maage May 20, 2023
c796c63
fix: bash_replace_or_append/doc: add types
maage May 20, 2023
b23f127
fix: bash_ensure_mount_option_for_vfstype/doc: add types
maage May 20, 2023
57e8c08
fix: bash_pkg_conditional/doc: add types
maage May 20, 2023
100d56e
fix: bash_get_rpm_package_version/doc: add type
maage May 20, 2023
ee9b030
fix: bash_pkg_conditional_compare/doc: add types, fix sphinx format
maage May 20, 2023
4ee12e5
fix: bash_compare_version/doc: add types, fix sphinx format
maage May 20, 2023
4904851
fix: bash_pkg_conditional_rpm/doc: add types
maage May 20, 2023
c47c235
fix: bash_get_dpkg_package_version/doc: add type
maage May 20, 2023
6be0746
fix: bash_compare_version_dpkg/doc: add types
maage May 20, 2023
767c133
fix: bash_pkg_conditional_dpkg/doc: add types
maage May 20, 2023
2dd248a
fix: bash_chromium_pol_setting/doc: add types
maage May 20, 2023
69e5fcf
fix: bash_ensure_ini_config/doc: add types, fix format
maage May 20, 2023
0ee5dfb
fix: bash_ensure_pam_module_line/doc: add types, fix format
maage May 20, 2023
965b138
fix: bash_ensure_pam_module_option/doc: add types
maage May 20, 2023
b80f589
fix: bash_remove_pam_module_option/doc: add types
maage May 20, 2023
a5ad341
fix: bash_ensure_pam_module_configuration/doc: add types
maage May 20, 2023
10e69db
fix: bash_remove_pam_module_option_configuration/doc: add types
maage May 20, 2023
db33bcd
fix: bash_os_linux_conditional/doc: add types
maage May 20, 2023
407b420
fix: bash_compare_version_os_linux/doc: add types
maage May 20, 2023
b44a113
fix: bash_get_version_os_linux/doc: add type
maage May 20, 2023
33a258c
fix: bash_fix_audit_syscall_rule/doc: fix names, add types
maage May 20, 2023
279c856
fix: bash_shell_file_set/doc: argument types
maage May 21, 2023
834aeb8
fix: fixtext_sshd_lineinfile/doc: add type
maage May 20, 2023
9f92474
fix: fixtext_audit_rules_unsuccessful_file_modification_rule_order/do…
maage May 20, 2023
b8c1230
fix: fixtext_audit_rules_unsuccessful_file_modification_o_trunc_write…
maage May 20, 2023
5cae887
fix: fixtext_audit_rules_unsuccessful_file_modification_o_creat/doc: …
maage May 20, 2023
d8e774d
fix: fixtext_audit_rules_unsuccessful_file_modification/doc: fix types
maage May 20, 2023
3ef8a4a
fix: fixtext_audit_rules_dac_modification_attr: fix types
maage May 20, 2023
ffb7ede
fix: fixtext_audit_rules_dac_modification_chmod/doc: fix type
maage May 20, 2023
e434556
fix: fixtext_audit_rules_file_deletion_events/doc: fix type
maage May 20, 2023
06a4c4d
fix: fixtext_file_group_owner/doc: parameter name
maage May 21, 2023
2c996da
fix: fixtext_socket_disabled/doc: parameter name
maage May 21, 2023
00ef07b
fix: fixtext_service_disabled/doc: parameter name
maage May 21, 2023
b43baef
fix: fixtext_service_enabled/doc: parameter name
maage May 21, 2023
5a32076
fix: ocil_cluster_logging_rbac_review/doc: fix types
maage May 20, 2023
1eb9a76
fix: ocil_clause_file_group_owner/doc: fix parameter name in doc
maage May 21, 2023
1f3d58c
fix: oval_check_config_file/doc: bool type as bool
maage May 20, 2023
62845cf
fix: oval_check_shell_file/doc: use jinja type names, fix type name
maage May 20, 2023
b70bc44
fix: oval_file_contents/doc: add type
maage May 20, 2023
4a21b2b
fix: oval_grub_config/doc: fix type
maage May 20, 2023
f6624c7
fix: oval_auditd_config/doc: fix types
maage May 20, 2023
5a4d651
fix: oval_argument_value_in_line/doc: fix types
maage May 20, 2023
c1a7ef4
fix: oval_check_dconf_ini_file/doc: fix types and add missing argument
maage May 20, 2023
c8dcba2
fix: oval_line_in_file_criterion/doc: fix parameters
maage May 21, 2023
4ebb1f0
fix: srg_requirement_directory_group_owner/doc: fix name in doc
maage May 21, 2023
98f60a6
fix: warning_ovirt_rule_notapplicable/doc: add type
maage May 20, 2023
3a0585a
fix: warning_rule_deprecated_by/doc: add types
maage May 20, 2023
76e8ffc
fix: create_interactive_users_list_object/doc: param/type must start …
maage May 20, 2023
82b6125
fix: die/doc: add types
maage May 20, 2023
b23b982
fix: fix_openshift_logging_rbac/doc: add type
maage May 20, 2023
1a6f88a
fix: grub_command/doc: arguments/types
maage May 20, 2023
890bbb3
fix: grub2_bootloader_argument_remediation/doc: fix type format
maage May 20, 2023
1f5a5f9
fix: grub2_bootloader_argument_absent_remediation/doc: fix type format
maage May 20, 2023
de54144
fix: openshift_cluster_setting_kubeletconfig/doc: bad doc
maage May 20, 2023
f22be78
fix: set_config_file/doc: add types, add missing argument
maage May 20, 2023
e1c020b
fix: systemd_ocil_timer_enabled/doc: fix parameter name
maage May 21, 2023
abdec9e
fix: update_etc_default_grub_manually/doc: add types
maage May 20, 2023
909ca3e
fix: update_etc_default_grub_manually_absent/doc: add type
maage May 20, 2023
a72ade2
fix: ocil_firefox_config/doc: add hint about accepted values for value
maage May 21, 2023
538743f
fix: ocil_firewalld_allow_access/doc: port is str
maage May 21, 2023
bf306d1
fix: fixtext_audit_rules_dac_modification_chown: type name
maage May 21, 2023
419154b
fix: oval_metadata/doc: affected_platforms is list[str]
maage May 21, 2023
1428ab1
fix: oval_line_in_file_object/doc: missing_parameter_pass is bool
maage May 21, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 11 additions & 6 deletions shared/macros/01-general.jinja
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,12 @@ This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the {{% if endpoint is string %}}<code class="ocp-api-endpoint">{{{ endpoint }}}</code> API endpoint to the local <code class="ocp-dump-location">{{{ xccdf_value("ocp_data_root") }}}/{{{ endpoint.lstrip("/") }}}</code> file.{{% else %}}{{% for item in endpoint %}}<code class="ocp-api-endpoint">{{{ item }}}</code> API endpoint to the local <code class="ocp-dump-location">{{{ xccdf_value("ocp_data_root") }}}/{{{ item.lstrip("/") }}}</code> file{{% endfor %}}.{{% endif %}}
{{%- endmacro %}}

#}}
{{% macro openshift_cluster_setting_kubeletconfig() -%}}
This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes.
Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through <code class="ocp-api-endpoint-kubeletconfig">"/api/v1/nodes/NODE_NAME/proxy/configz"</code> API endpoint to the local <code class="ocp-dump-location-kubeletconfig">{{{ xccdf_value("ocp_data_root") }}}"/kubeletconfig/role/role"</code> file.
{{%- endmacro %}}



{{#
Macro which generates a warning indicating how to make use of a
Kubernetes/OpenShift-related rule as well as how to filter it. This
Expand Down Expand Up @@ -91,6 +89,7 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo
</ul>
{{%- endmacro %}}


{{#
Macro which generates a unique identifier for Compliance Operator, this will hide the rule from ComplianceCheckResult

Expand All @@ -100,6 +99,7 @@ This rule will be a hidden rule
<code class="ocp-hide-rule" id="ocp-hide-rule">true</code>
{{%- endmacro %}}


{{% macro openshift_filtered_version(path_filter_pairs) -%}}
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
Expand All @@ -122,7 +122,6 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo
{{%- endmacro %}}



{{#
Macro which generates a unique path for a filtered Kubernetes
resource. The path and the filter are used to generate a unique
Expand Down Expand Up @@ -1029,6 +1028,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
{{% endif %}}
{{%- endmacro %}}


{{#
Adds a default "no easy remediation" warning for kernel_build_config warning.

Expand All @@ -1038,6 +1038,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.
{{% endmacro %}}


{{#
OCIL for a kernel build config rule.

Expand All @@ -1062,6 +1063,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
{{% endif %}}
{{%- endmacro %}}


{{#
Returns the AIDE strings based on the current product

Expand All @@ -1074,6 +1076,7 @@ p+i+n+u+g+s+b+acl+xattrs+sha512
{{%- endif -%}}
{{%- endmacro -%}}


{{#
Lists the files need for the rule aide_check_audit_tools with the AIDE string

Expand All @@ -1097,9 +1100,9 @@ Generates a correct command based on the product (grubby, grub2-mkconfig, update
Part of the grub2_bootloader_argument(_absent) templates.

:param action: What to do with the argument, must be one of: "update", "add", "remove".
:type action str:
:param arg_name: :type arg_name str: :param arg_name_value: If action is "add", it's kernel command line argument concatenated with the value of this argument using an equal sign, eg. "audit=1". If action is "remove", it's only the kernel command line argument name, eg. "audit".
:type arg_name_value str:
:type action: str
:param arg_name_value: If action is "add", it's kernel command line argument concatenated with the value of this argument using an equal sign, eg. "audit=1". If action is "remove", it's only the kernel command line argument name, eg. "audit".
:type arg_name_value: str

#}}
{{% macro grub_command(action, arg_name_value=None) -%}}
Expand Down Expand Up @@ -1128,6 +1131,7 @@ Part of the grub2_bootloader_argument(_absent) templates.
{{{ grub_helper_executable }}} {{{ " ".join(grub_helper_args) }}}
{{%- endmacro %}}


{{%- macro audit_remediation_unsuccessful_file_modification_detailed_audit_file_content() -%}}
## This content is a section of an Audit config snapshot recommended for linux systems that target OSPP compliance.
## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules
Expand Down Expand Up @@ -1171,6 +1175,7 @@ Part of the grub2_bootloader_argument(_absent) templates.
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
{{%- endmacro -%}}


{{#
Join list of items to create a human readable list in which the last item is
separated by an and and others are separated by a comma.
Expand Down
Loading