SSGTS-specific Jinja templates #7295

cipherboy · 2021-07-27T19:16:39Z

Description:

Introduces the infrastructure to have a SSGTS-specific file for jinja templates. As we get more usage of Jinja macros in SSGTS cases, we'll probably want this. For now, we introduce a single rule to get the package name, resolving for product specific differences.

Also updates Avahi to use this macro and then uses it in the various libpam-pwquality tests (which Ubuntu doesn't have installed by default).

Depends on SSGTS: tests for shared/templates #7211.

jan-cerny · 2021-07-29T07:14:53Z

I have some problem that it can't find the new macro:

[jcerny@thinkpad tests{pr/7295}]$ python3 test_suite.py rule --libvirt qemu:///system ssgts_rhel8 accounts_password_pam_minclass 
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/tests/logs/rule-custom-2021-07-29-0910/test_suite.log
ERROR - Nothing has been tested!
Traceback (most recent call last):
  File "/home/jcerny/work/git/scap-security-guide/tests/test_suite.py", line 388, in <module>
    main()
  File "/home/jcerny/work/git/scap-security-guide/tests/test_suite.py", line 384, in main
    options.func(options)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/rule.py", line 455, in perform_rule_check
    checker.test_target(options.target)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/oscap.py", line 654, in test_target
    self._test_target(target)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/rule.py", line 286, in _test_target
    self._prepare_environment(scenarios_by_rule)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/rule.py", line 244, in _prepare_environment
    self.remote_dir = common.send_scripts(self.test_env)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/common.py", line 399, in send_scripts
    archive_file = create_tarball(test_env.product)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/common.py", line 367, in create_tarball
    templated_tests = template_tests(product=product)
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/common.py", line 357, in template_tests
    raise exp
  File "/home/jcerny/work/git/scap-security-guide/tests/ssg_test_suite/common.py", line 351, in template_tests
    parsed_test = process_file(src_test_path, local_env_yaml)
  File "/home/jcerny/work/git/scap-security-guide/tests/../ssg/jinja.py", line 137, in process_file
    return template.render(substitutions_dict)
  File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 1090, in render
    self.environment.handle_exception()
  File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 832, in handle_exception
    reraise(*rewrite_traceback_stack(source=source))
  File "/usr/lib/python3.9/site-packages/jinja2/_compat.py", line 28, in reraise
    raise value.with_traceback(tb)
  File "/home/jcerny/work/git/scap-security-guide/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/tests/service_disabled.pass.sh", line 2, in top-level template code
    # packages = {{{- ssgts_package("avahi") -}}}
jinja2.exceptions.UndefinedError: 'ssgts_package' is undefined

cipherboy · 2021-07-29T11:32:37Z

Ah sorry @jan-cerny, this actually depends on #7211 -- where we added a new commit to switch from process_file to process_file_with_macros.

cipherboy · 2021-08-17T14:46:26Z

@jan-cerny This should be ready for review now.

cipherboy · 2021-08-17T17:51:02Z

/retest

richardmaciel-canonical · 2021-08-20T23:19:28Z

/retest

dodys · 2021-08-31T07:27:26Z

...vices/avahi/disable_avahi_group/service_avahi-daemon_disabled/tests/service_disabled.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# packages = avahi
+# packages = {{{- ssgts_package("avahi") -}}}


To actually make this work, I had to remove the '-'. So something like:
# packages = {{{ ssgts_package("avahi") }}}

Not truly sure why, since the '-' seems to be related to whitespace. Could it be a difference in jinja versions?

@dodys Yes, {{{- -}}} is supposed to remove whitespace before/after the macro expansion. Otherwise, I'd get results like:

... # packages = avahi-daemon ...

(on two separate lines) and the test suite wouldn't run. What Jinja version are you using?

@dodys Did you ever get this working? I've gone ahead and rebased the PR. :-)

only worked without the '-'
I haven't done anything else

The dash at the end is wrong - it results in concatenation of the first line of the test scenario with the package list. Just removing that dash should work just fine.

This introduces ssgts_package(...) to get the correct package name for a specific product. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Also introduces Ubuntu-specific package name and uses shared Jinja template for this. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Ubuntu calls the audit package auditd, reflecting its status as a daemon. Update the tests installing the audit package to use the new Jinja macro to handle the differences. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

github-actions · 2022-01-28T02:53:46Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

Rule 'xccdf_org.ssgproject.content_rule_security_patches_up_to_date' points to 'security-data-oval-com.redhat.rhsa-RHEL8.xml' which isn't a part of the old datastream

openshift-ci · 2022-03-21T11:31:41Z

@cipherboy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ocp4-pci-dss	`ce1db14`	link	true	`/test e2e-aws-ocp4-pci-dss`
ci/prow/e2e-aws-ocp4-cis	`ce1db14`	link	true	`/test e2e-aws-ocp4-cis`
ci/prow/e2e-aws-ocp4-moderate	`ce1db14`	link	true	`/test e2e-aws-ocp4-moderate`
ci/prow/e2e-aws-ocp4-moderate-node	`ce1db14`	link	true	`/test e2e-aws-ocp4-moderate-node`
ci/prow/e2e-aws-ocp4-cis-node	`ce1db14`	link	true	`/test e2e-aws-ocp4-cis-node`
ci/prow/e2e-aws-rhcos4-high	`ce1db14`	link	true	`/test e2e-aws-rhcos4-high`
ci/prow/e2e-aws-ocp4-high-node	`ce1db14`	link	true	`/test e2e-aws-ocp4-high-node`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci · 2022-04-15T09:19:59Z

@cipherboy: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

cipherboy · 2022-04-15T12:30:51Z

@matejak @Mab879 @jan-cerny I'm inclined to close this; feel free to pick it up if it is still of interest to you, I'll keep my branch around :-)

matejak · 2022-04-19T08:58:16Z

Thanks for the update. I think that this is not the best approach - packages overrides should be handled on the level of the test framework, so the package metadata remains clean, without weird macros. We could rebrand the package to package_spec, to emphasize that additional processing can occur between reading the list and interacting with packages.

cipherboy mentioned this pull request Jul 28, 2021

SSGTS: tests for shared/templates #7211

Merged

cipherboy added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 29, 2021

openshift-ci bot added the needs-rebase Used by openshift-ci bot. label Aug 9, 2021

cipherboy force-pushed the ssgts-jinja-templates branch from 054e053 to 4638f4e Compare August 17, 2021 14:46

openshift-ci bot removed the needs-rebase Used by openshift-ci bot. label Aug 17, 2021

dodys reviewed Aug 31, 2021

View reviewed changes

dodys mentioned this pull request Oct 7, 2021

UBTU-20-010300: Verify there is a script that offloads audit data and that script runs weekly #7700

Merged

openshift-ci bot added the needs-rebase Used by openshift-ci bot. label Oct 25, 2021

cipherboy added 4 commits January 27, 2022 21:49

Add support for SSGTS-specific Jinja macros

486fe13

This introduces ssgts_package(...) to get the correct package name for a specific product. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Switch package name for Ubuntu

75d52ee

Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Add packages = libpam-pwquality to relevant tests

4fcc65c

Also introduces Ubuntu-specific package name and uses shared Jinja template for this. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

Correct audit/auditd package name for Ubuntu

ce1db14

Ubuntu calls the audit package auditd, reflecting its status as a daemon. Update the tests installing the audit package to use the new Jinja macro to handle the differences. Signed-off-by: Alexander Scheel <alex.scheel@canonical.com>

cipherboy force-pushed the ssgts-jinja-templates branch from 4638f4e to ce1db14 Compare January 28, 2022 02:50

openshift-ci bot removed the needs-rebase Used by openshift-ci bot. label Jan 28, 2022

cipherboy removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jan 28, 2022

cipherboy requested review from jan-cerny and Mab879 January 28, 2022 02:51

openshift-ci bot added the needs-rebase Used by openshift-ci bot. label Apr 15, 2022

cipherboy closed this Apr 15, 2022

dodys mentioned this pull request Nov 24, 2022

platform_package_overrides not working with automatus #9869

Closed

litios mentioned this pull request Nov 28, 2022

Add automatic detection of platform_package_overrides when using automatus #9897

Merged

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SSGTS-specific Jinja templates #7295

SSGTS-specific Jinja templates #7295

cipherboy commented Jul 27, 2021 •

edited

Loading

jan-cerny commented Jul 29, 2021

cipherboy commented Jul 29, 2021

cipherboy commented Aug 17, 2021

cipherboy commented Aug 17, 2021

richardmaciel-canonical commented Aug 20, 2021

dodys Aug 31, 2021

cipherboy Sep 5, 2021

dodys Sep 6, 2021

cipherboy Jan 28, 2022

dodys Jan 28, 2022

matejak Apr 19, 2022

github-actions bot commented Jan 28, 2022

openshift-ci bot commented Mar 21, 2022

openshift-ci bot commented Apr 15, 2022

cipherboy commented Apr 15, 2022 •

edited

Loading

matejak commented Apr 19, 2022

SSGTS-specific Jinja templates #7295

SSGTS-specific Jinja templates #7295

Conversation

cipherboy commented Jul 27, 2021 • edited Loading

Description:

jan-cerny commented Jul 29, 2021

cipherboy commented Jul 29, 2021

cipherboy commented Aug 17, 2021

cipherboy commented Aug 17, 2021

richardmaciel-canonical commented Aug 20, 2021

dodys Aug 31, 2021

Choose a reason for hiding this comment

cipherboy Sep 5, 2021

Choose a reason for hiding this comment

dodys Sep 6, 2021

Choose a reason for hiding this comment

cipherboy Jan 28, 2022

Choose a reason for hiding this comment

dodys Jan 28, 2022

Choose a reason for hiding this comment

matejak Apr 19, 2022

Choose a reason for hiding this comment

github-actions bot commented Jan 28, 2022

openshift-ci bot commented Mar 21, 2022

openshift-ci bot commented Apr 15, 2022

cipherboy commented Apr 15, 2022 • edited Loading

matejak commented Apr 19, 2022

cipherboy commented Jul 27, 2021 •

edited

Loading

cipherboy commented Apr 15, 2022 •

edited

Loading