-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fixes in file_groupownership template #10666
fixes in file_groupownership template #10666
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The PR looks good. However, there is a merge commit from another PR in it. Please take look. Also, I assume you want this to go to stabilization as well.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would rename the filegid
key to gid_or_name
or something, and not hesitate to mass-rename everything in the project. Changing meaning of a variable implies that you should also rename it if you can, and here, we can do that very easily. Documenting unexpected behavior is better than nothing, but let's follow "working software over comprehensive documentation".
I would also consider enhancing the Python template part to try to convert the gid_or_name
to int, and if it succeeds, indicate that we have indeed a gid
.
Moreover, constructs s.a. if FILEGID | int(-1) != -1
violate our guidelines.
90365c5
to
7bf892d
Compare
7bf892d
to
2295c80
Compare
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
@@ -1,9 +1,9 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
-find /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex '^audit(\.rules|d\.conf)$' -exec chgrp 0 {} \;
+find /etc/audit/ -maxdepth 1 -type f ! -group 0 -regex '^audit(\.rules|d\.conf)$' -exec chgrp 0 {} \;
-find /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex '^.*\.rules$' -exec chgrp 0 {} \;
+find /etc/audit/rules.d/ -maxdepth 1 -type f ! -group 0 -regex '^.*\.rules$' -exec chgrp 0 {} \;
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
@@ -10,7 +10,7 @@
- no_reboot_needed
- name: Find /etc/audit/ file(s) matching ^audit(\.rules|d\.conf)$
- command: find -H /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex "^audit(\.rules|d\.conf)$"
+ command: find -H /etc/audit/ -maxdepth 1 -type f ! -group 0 -regex "^audit(\.rules|d\.conf)$"
register: files_found
changed_when: false
failed_when: false
@@ -45,7 +45,7 @@
- no_reboot_needed
- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
- command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex "^.*\.rules$"
+ command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -group 0 -regex "^.*\.rules$"
register: files_found
changed_when: false
failed_when: false
bash remediation for rule 'xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files' differs.
--- xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
+++ xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
@@ -1,8 +1,8 @@
-find /lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
+find /lib/ -type f ! -group 0 -regex '^.*$' -exec chgrp 0 {} \;
-find /lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
+find /lib64/ -type f ! -group 0 -regex '^.*$' -exec chgrp 0 {} \;
-find /usr/lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
+find /usr/lib/ -type f ! -group 0 -regex '^.*$' -exec chgrp 0 {} \;
-find /usr/lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
+find /usr/lib64/ -type f ! -group 0 -regex '^.*$' -exec chgrp 0 {} \;
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files' differs.
--- xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
+++ xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
@@ -1,5 +1,5 @@
- name: Find /lib/ file(s) matching ^.*$ recursively
- command: find -H /lib/ -type f ! -gid 0 -regex "^.*$"
+ command: find -H /lib/ -type f ! -group 0 -regex "^.*$"
register: files_found
changed_when: false
failed_when: false
@@ -36,7 +36,7 @@
- root_permissions_syslibrary_files
- name: Find /lib64/ file(s) matching ^.*$ recursively
- command: find -H /lib64/ -type f ! -gid 0 -regex "^.*$"
+ command: find -H /lib64/ -type f ! -group 0 -regex "^.*$"
register: files_found
changed_when: false
failed_when: false
@@ -73,7 +73,7 @@
- root_permissions_syslibrary_files
- name: Find /usr/lib/ file(s) matching ^.*$ recursively
- command: find -H /usr/lib/ -type f ! -gid 0 -regex "^.*$"
+ command: find -H /usr/lib/ -type f ! -group 0 -regex "^.*$"
register: files_found
changed_when: false
failed_when: false
@@ -110,7 +110,7 @@
- root_permissions_syslibrary_files
- name: Find /usr/lib64/ file(s) matching ^.*$ recursively
- command: find -H /usr/lib64/ -type f ! -gid 0 -regex "^.*$"
+ command: find -H /usr/lib64/ -type f ! -group 0 -regex "^.*$"
register: files_found
changed_when: false
failed_when: false
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
@@ -1,7 +1,7 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-find /etc/ssh/ -maxdepth 1 -type f ! -gid ssh_keys -regex '^.*_key$' -exec chgrp ssh_keys {} \;
+find /etc/ssh/ -maxdepth 1 -type f ! -group ssh_keys -regex '^.*_key$' -exec chgrp ssh_keys {} \;
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
@@ -1,5 +1,5 @@
- name: Find /etc/ssh/ file(s) matching ^.*_key$
- command: find -H /etc/ssh/ -maxdepth 1 -type f ! -gid ssh_keys -regex "^.*_key$"
+ command: find -H /etc/ssh/ -maxdepth 1 -type f ! -group ssh_keys -regex "^.*_key$"
register: files_found
changed_when: false
failed_when: false
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
@@ -1,7 +1,7 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-find /etc/ssh/ -maxdepth 1 -type f ! -gid 0 -regex '^.*\.pub$' -exec chgrp 0 {} \;
+find /etc/ssh/ -maxdepth 1 -type f ! -group 0 -regex '^.*\.pub$' -exec chgrp 0 {} \;
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
@@ -1,5 +1,5 @@
- name: Find /etc/ssh/ file(s) matching ^.*\.pub$
- command: find -H /etc/ssh/ -maxdepth 1 -type f ! -gid 0 -regex "^.*\.pub$"
+ command: find -H /etc/ssh/ -maxdepth 1 -type f ! -group 0 -regex "^.*\.pub$"
register: files_found
changed_when: false
failed_when: false |
/retest |
bb1e8d8
to
6435e04
Compare
I like the style of changes introduced very much, great work! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR does improve the clarity around the GID or name parameter in the file_groupowner template. I agree with @matejak that test failures should be looked at. Also, please take look CodeClimate issues, the PEP8 issues need to be fixed before merging, but also take look at the other issues as well.
6b0b757
to
cb9ebce
Compare
change parameter filegid of file_groupownership template to gid_or_name explain its behavior
…rship template from filegid to gid_or_name
change the parameter name from filgeid to gid_or_name additionally, use the -group parameter instead of -gid parameter in find command invocation the -group parameter accepts both gid and group names, where the -gid parameter accepts only gid
establish a new variable which carries information if the parameter is a gid or a group name
decide if to use group ID or group name based on the variable declared in the preprocessing function change parameter name from file_gid to gid_or_name
…templates into shared module
The test did not account for a case when a filepath is a directory and it does not exist on the system. Also the test made use of is_directory parameter which is only available at runtime when building the template and it is not saved anywhere. Instead of this parameter, scenarios now check if the path ends with a slash. This signifies the filepath is a directory as mentioned in the tempate documentation.
…le_owner template These test scenarios would not work correctly if the filepath parameter was a directory.
This rule uses directory + regex, it needs a special test scenario because the template does only generic testing.
cb9ebce
to
d3dcd79
Compare
/packit build |
2fb2889
to
d3dcd79
Compare
…s exists before using it in test scenario it migt not exist in FEdora container which is used as test environment
the missing_file_test test scenario should fail, not pass. At the same time, we actually can't create a new failing test scenario - removing the ssh private key will break the testing workflow.
Code Climate has analyzed commit 7a3e7a1 and detected 2 issues on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 11.1% (50% is the threshold). This pull request will bring the total coverage in the repository to 52.8% (0.0% change). View more on Code Climate. |
I think this is ready to be merged. |
Description:
Please see commit messages.
Rationale:
Recent changes to the template made the OVAL check consider both GIDs and group names. But the parameter
filegid
was considered to be a numeric GID only in case it was equal to 0. This created a problem in case a content author tried to use a gid different than 0 - the result was incorrect, it tried to search for a group name instead of using the gid.This PR tries to fix the behavior - if the parameter is an integer, it is considered to be a gid. If it is a string, it is considered to be a group name.
This should not be a problem since group names can't be numeric.
Also as Automatus tests have been run on many rules, I have discovered two problems in test scenarios for file_groupownership, file_owner and file_permissions templates.
The first problem is that scenarios try to use the is_directory template variable, but this variable is never stored. It is created only at runtime when templates are used to render checks and remediations. This made test scenarios not working correctly in case the the filepath parameter was a directory.
Also I found out that test scenarios did not account for the case when the filepath parameter was a directory and it did not exist on the system prior the test run.
Review Hints:
You can run automatus on the file_groupownership template in template mode:
Or you can try for example these rules: