-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix rsyslog_remote_tls Remediations #9711
Conversation
Ensure that action is at the start of the line helps to reduce false positive findings.
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
@@ -5,7 +5,7 @@
# Get omfwd configuration directive
-OMFWD_CONFIG_OUTPUT=`grep -Pzo '(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`
+OMFWD_CONFIG_OUTPUT=`grep -Pzo '^(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`
OMFWD_CONFIG=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $2}'`
OMFWD_CONFIG_FILE=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $1}'`
if ! [ -z "$OMFWD_CONFIG" ]; then
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
@@ -5,7 +5,8 @@
- always
- name: Get omfwd configuration directive
- shell: sed -e '/action\s*(\s*type\s*=\s*"omfwd"/,/)/!d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
+ shell: sed -e '/^action\s*(\s*type\s*=\s*"omfwd"/,/)/!d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
+ || true
register: include_omfwd_config_output
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags: |
Code Climate has analyzed commit 85659bd and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 41.0% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have confirmed that it fixed #9631 on a RHEL 9.0 virtual machine
In the following paste, the ds-broken is built from a45b876 and ds-fixed is build from this PR.
[root@localhost ~]# oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-broken.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---
Title Configure TLS for rsyslog remote logging
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident CCE-83991-0
Result fail
--- Starting Remediation ---
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title Configure TLS for rsyslog remote logging
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident CCE-83991-0
Result error
[root@localhost ~]# oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-fixed.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---
Title Configure TLS for rsyslog remote logging
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident CCE-83991-0
Result fail
--- Starting Remediation ---
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title Configure TLS for rsyslog remote logging
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident CCE-83991-0
Result fixed
[root@localhost ~]# oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-fixed.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---
Title Configure TLS for rsyslog remote logging
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident CCE-83991-0
Result pass
Description:
Fix the Ansible and bash remediations for rsyslog_remote_tls.
Rationale:
Closes #9631
Closes #9623