-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
xccdf_org.ssgproject.content_rule_accounts_tmout: replace 'declare' by 'typeset' #11289
Conversation
Hi @rmetrich. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout'.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -10,7 +10,10 @@
setting in a file loaded by /etc/profile, e.g.
/etc/profile.d/tmout.sh should read as follows:
+typeset -xr TMOUT='xccdf_org.ssgproject.content_value_var_accounts_tmout'
+or
declare -xr TMOUT='xccdf_org.ssgproject.content_value_var_accounts_tmout'
+Using the typeset keyword is preferred for wider compatibility with ksh and other shells.
[reference]:
BP28(R29)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout' differs.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -11,16 +11,14 @@
for f in /etc/profile /etc/profile.d/*.sh; do
if grep --silent '^[^#].*TMOUT' $f; then
- sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/declare -xr TMOUT=$var_accounts_tmout\3/g" $f
+ sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/typeset -xr TMOUT=$var_accounts_tmout\3/g" $f
tmout_found=1
fi
done
if [ $tmout_found -eq 0 ]; then
echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" >> /etc/profile.d/tmout.sh
- echo "declare -xr TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
- echo "readonly TMOUT" >> /etc/profile.d/tmout.sh
- echo "export TMOUT" >> /etc/profile.d/tmout.sh
+ echo "typeset -xr TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
fi
else
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout' differs.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -8,7 +8,7 @@
replace:
path: /etc/profile
regexp: ^[^#].*TMOUT=.*
- replace: declare -xr TMOUT={{ var_accounts_tmout }}
+ replace: typeset -xr TMOUT={{ var_accounts_tmout }}
register: profile_replaced
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
@@ -31,7 +31,7 @@
path: /etc/profile.d/tmout.sh
create: true
regexp: TMOUT=
- line: declare -xr TMOUT={{ var_accounts_tmout }}
+ line: typeset -xr TMOUT={{ var_accounts_tmout }}
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags: |
@@ -40,7 +40,7 @@ | |||
{{% if product in ['sle12', 'sle15'] or "ubuntu" in product %}} | |||
<ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+)[\s]*readonly TMOUT[\s]*export TMOUT$</ind:pattern> | |||
{{% else %}} | |||
<ind:pattern operation="pattern match">^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern> | |||
<ind:pattern operation="pattern match">^[\s]*typeset[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To keep more compatibility, please keep both "declare" and "typeset" acceptable in the OVAL check.
…y 'typeset' On bash and zsh, these are synonyms, but 'declare' is not known to ksh, causing an error message when having /etc/profile.d/tmout.sh loaded: -------- 8< ---------------- 8< ---------------- 8< -------- /etc/profile[68]: .: line 731: declare: not found -------- 8< ---------------- 8< ---------------- 8< -------- 'typeset' works on every known sh shell, including ksh.
To keep backwards compatibility we will allow also the `declare` keyword alongside to the `typeset` keyword by the OVAL checks. The remediations will still insert `typeset`. This commit also adds a small test scenario to account for this situation.
I have rebased the PR on the top of the master and linked the Jira bug. I have allowed the declare keyword. I have add a small test scenario. I have add a note to the description. |
Code Climate has analyzed commit 9d6a742 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. All tests were green in my local VMs.
I agree this looks good. Merging. |
Description:
On bash and zsh, these are synonyms, but declare is not known to ksh, causing an error message when having /etc/profile.d/tmout.sh loaded:
Rationale:
typeset works on every known sh shell, including ksh.
Resolves: https://issues.redhat.com/browse/RHEL-1811