commit scap-security-guide for openSUSE:Factory

[Source-Sync]

Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package scap-security-guide for 
openSUSE:Factory checked in at 2022-06-28 15:22:59
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/scap-security-guide (Old)
 and      /work/SRC/openSUSE:Factory/.scap-security-guide.new.1548 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "scap-security-guide"

Tue Jun 28 15:22:59 2022 rev:17 rq:985543 version:0.1.62

Changes:
--------
--- /work/SRC/openSUSE:Factory/scap-security-guide/scap-security-guide.changes  
2022-06-10 15:58:02.816857868 +0200
+++ 
/work/SRC/openSUSE:Factory/.scap-security-guide.new.1548/scap-security-guide.changes
        2022-06-28 15:23:19.894028303 +0200
@@ -1,0 +2,6 @@
+Mon Jun 27 12:59:21 UTC 2022 - Marcus Meissner <meiss...@suse.com>
+
+- fix-bash-template.patch: convert one bash emitter to new jinja method.
+  (bsc#1200163)
+
+-------------------------------------------------------------------

New:
----
  fix-bash-template.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ scap-security-guide.spec ++++++
--- /var/tmp/diff_new_pack.qCsvvS/_old  2022-06-28 15:23:20.902029807 +0200
+++ /var/tmp/diff_new_pack.qCsvvS/_new  2022-06-28 15:23:20.906029814 +0200
@@ -53,6 +53,8 @@
 %endif
 Source:         
https://github.com/ComplianceAsCode/content/archive/v%{version}.tar.gz
 Patch0:         scap-security-guide-UnicodeEncodeError-character-fix.patch
+# upstream d9aa7a49d135be60e1a6f9d2ce4e29560482b3d0 and 
3485c8298957b24d97a563079fd648004a92822b
+Patch1:         fix-bash-template.patch
 BuildRequires:  cmake
 
 %if "%{_vendor}" == "debbuild"
@@ -178,6 +180,7 @@
 %prep
 %setup -n content-%version
 %patch0 -p0
+%patch1 -p1
 
 %build
 cd build

++++++ fix-bash-template.patch ++++++
diff --git a/shared/templates/audit_rules_syscall_events/bash.template 
b/shared/templates/audit_rules_syscall_events/bash.template
index 6532554875..bd5bb94cb9 100644
--- a/shared/templates/audit_rules_syscall_events/bash.template
+++ b/shared/templates/audit_rules_syscall_events/bash.template
@@ -1,19 +1,20 @@
 # platform = 
multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
 
-# Include source function library.
-. /usr/share/scap-security-guide/remediation_functions
-
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system
 [ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" 
"b64")
 
 for ARCH in "${RULE_ARCHS[@]}"
 do
-       PATTERN="-a always,exit -F arch=$ARCH -S {{{ ATTR }}}.*"
-       GROUP="perm_mod"
-       FULL_RULE="-a always,exit -F arch=$ARCH -S {{{ ATTR }}} -F auid>={{{ 
auid }}} -F auid!=4294967295 -F key=perm_mod"
+       # FULL_RULE="-a always,exit -F arch=$ARCH -S {{{ ATTR }}} -F auid>={{{ 
auid }}} -F auid!=4294967295 -F key=perm_mod"
+       ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
+       SYSCALL="{{{ ATTR }}}"
+       SYSCALL_GROUPING="{{{ ATTR }}}"
+       AUID_FILTERS="-F auid>={{{ auid }}} -F auid!=4294967295"
+       KEY="perm_mod"
+       OTHER_FILTERS=""
 
        # Perform the remediation for both possible tools: 'auditctl' and 
'augenrules'
-       fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" 
"$FULL_RULE"
-       fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" 
"$FULL_RULE"
+       {{{ bash_fix_audit_syscall_rule("augenrules","$ACTION_ARCH_FILTERS", 
"$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
+       {{{ bash_fix_audit_syscall_rule("auditctl",  "$ACTION_ARCH_FILTERS", 
"$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
 done