Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix grub2_argument bash remediation #4891

Merged
merged 2 commits into from
Oct 3, 2019

Conversation

vojtapolasek
Copy link
Collaborator

Description:

Fixed the bash remediation for grub2_argument template by removing "audit=1" and replacing it with proper Jinja macro.

Also wrote tests for the grub2_pti_argument rule.

Rationale:

It was found that in the Bash remediation for the grub2_argument template specifically for rhel8, there was hardcoded "audit=1" instead of proper Jinja macro. This caused wrong remediations for templated rules other than grub2_audit_argument.

@yuumasato yuumasato self-assigned this Oct 3, 2019
@yuumasato
Copy link
Member

@vojtapolasek Thank you for looking into this!

Test scenarios are passing:

$ python3 test_suite.py rule --libvirt qemu:///session rhel8.1-snap --profile ospp --datastream ../build/ssg-rhel8-ds.xml --debug grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/wsato/git/content/tests/logs/rule-custom-2019-10-03-1445/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
WARNING - Script wrong_value_rhel7.fail.sh is not applicable on given platform
WARNING - Script correct_grubby.pass.sh is not applicable on given platform
WARNING - Script arg_not_there_etcdefaultgrub_recovery_disabled.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh is not applicable on given platform
WARNING - Script correct_recovery_disabled.pass.sh is not applicable on given platform
WARNING - Script arg_not_there_rhel7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefaultgrub.fail.sh is not applicable on given platform
WARNING - Script arg_not_there_etcdefaultgrub.fail.sh is not applicable on given platform
INFO - Script wrong_value_rhel8.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script arg_not_there_rhel8.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script correct_value.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script correct_grubenv.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK

$ python3 test_suite.py rule --libvirt qemu:///session rhel8.1-snap --profile ospp --datastream ../build/ssg-rhel8-ds.xml --debug grub2_pti_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/wsato/git/content/tests/logs/rule-custom-2019-10-03-1448/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_grub2_pti_argument
INFO - Script correct.pass.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script arg_not_there.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - Script wrong_value.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK

@yuumasato yuumasato added Bash Bash remediation update. bugfix Fixes to reported bugs. labels Oct 3, 2019
@yuumasato yuumasato added this to the 0.1.47 milestone Oct 3, 2019
@yuumasato yuumasato merged commit 178dbdd into ComplianceAsCode:master Oct 3, 2019
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bash Bash remediation update. bugfix Fixes to reported bugs.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants