-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add bash and ansible remediation for rsyslog_remote_tls #9484
Add bash and ansible remediation for rsyslog_remote_tls #9484
Conversation
Hi @teacup-on-rockingchair. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
This datastream diff is auto generated by the check Click here to see the full diffNew datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls'. |
# strategy = configure | ||
# complexity = low | ||
# disruption = low | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The CI fail looks legit:
116/274 Test #117: fedora-bash-shellcheck ................................................***Failed 15.90 sec
In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 9:
rsyslog_remote_loghost_address='(bash-populate rsyslog_remote_loghost_address)'
^----------------------------^ SC2034: rsyslog_remote_loghost_address appears unused. Verify use (or export if used externally).
In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 16:
if [! -z "$OMFWD_CONFIG" ]; then
^-- SC1035: You need a space after the [ and before the ].
In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 17:
OMFWD_TLS_STREAM=`grep ' StreamDriver="gtls" ' "$OMFWD_CONFIG"`
^--------------^ SC2034: OMFWD_TLS_STREAM appears unused. Verify use (or export if used externally).
In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 18:
if [! -z "!OMFWD_TLS_STREAM" ]; then
^-- SC1035: You need a space after the [ and before the ].
^---------------^ SC2157: Argument to -z is always false due to literal strings.
For more information:
https://www.shellcheck.net/wiki/SC1035 -- You need a space after the [ and ...
https://www.shellcheck.net/wiki/SC2157 -- Argument to -z is always false du...
https://www.shellcheck.net/wiki/SC2034 -- OMFWD_TLS_STREAM appears unused. ...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should be ok in 79dfba1
sed -i 's/action\s*(\s*type\s*=\s*"omfwd"/action(type="omfwd"\ StreamDriver="gtls"\ /' $OMFWD_CONFIG_FILE | ||
fi | ||
else | ||
echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"{{ rsyslog_remote_loghost_address }}\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Instead of Jinja variable here you need to use the bash variable that you created by Jinja macro on line 7.
echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"{{ rsyslog_remote_loghost_address }}\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf | |
echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"$rsyslog_remote_loghost_address\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thx should be ok in 6453b4d
# Get omfwd configuration directive | ||
OMFWD_CONFIG_OUTPUT=`grep -Pzo '(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf` | ||
OMFWD_CONFIG=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $2}'` | ||
OMFWD_CONFIG_FILE=`echo OMFWD_CONFIG_OUTPUT| awk 'BEGIN {FS=":"; RS=")\n"}; {print $1}'` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
probably a missing $ before OFMD_CONFIG_OUTPUT
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🙇 should be ok in 79dfba1
9be15a5
to
79dfba1
Compare
register: include_omfwd_config_output | ||
|
||
- name: "Get include files directives" | ||
shell: "echo \"{{ include_omfwd_config_output.stdout }}\"|grep 'StreamDriver=\"gtls\"'" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It should probably be:
shell: >
set -o pipefail
echo \"{{ include_omfwd_config_output.stdout }}\" | grep 'StreamDriver=\"gtls\"'
because there is this in Ansible lint:
risky-shell-pipe: Shells that use pipes should set the pipefail option
build/ansible_roles/rhel8_anssi_bp28_intermediary/tasks/main.yml:5832 Task/Handler: Get include files directives
Error: risky-shell-pipe Shells that use pipes should set the pipefail option
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should be ok in 8e4a9f8
6453b4d
to
8e4a9f8
Compare
Code Climate has analyzed commit 8e4a9f8 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 40.5% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The CI fail isn't happening anymore.
Description:
Add bash and ansible remediation scripts for rsyslog_remote_tls rule
Rationale:
StreamDriver=gtls