On 7/31/13 2:45 AM, Shawn Wells wrote:
0001-Added-bash-remediation-check-to-verify-input-sanity..patch From 39f450cba9b2c9e0db994cb1703b9e13770cbfa3 Mon Sep 17 00:00:00 2001 From: Shawn Wells<[email protected]> Date: Mon, 15 Jul 2013 21:27:04 -0400 Subject: [PATCH 1/2] Added bash remediation check to verify-input-sanity.py BEFORE PATCH: $ ./verify-input-sanity.py WARNING: XCCDF Rule "disable_logwatch_for_logserver" references OVAL check "logwatch_disabled_for_logserver" which does not exist problem occurs in file: src/input/system/logging.xml WARNING: XCCDF Rule "deny_password_attempts_unlock_time" references OVAL check "accounts_passwords_pam_faillock_unlock_time" which does not exist problem occurs in file: src/input/system/accounts/pam.xml WARNING: XCCDF Rule "deny_password_attempts_fail_interval" references OVAL check "accounts_passwords_pam_fail_interval" which does not exist problem occurs in file: src/input/system/accounts/pam.xml WARNING: XCCDF Rule "set_gdm_login_banner_text" references OVAL check "banner_gui_text_set" which does not exist problem occurs in file: src/input/system/accounts/banners.xml WARNING: XCCDF Rule "no_shelllogin_for_systemaccounts" references OVAL check "no_shelllogin_for_systemaccounts" which does not exist problem occurs in file: src/input/system/accounts/restrictions/root_logins.xml Traceback (most recent call last): File "./verify-input-sanity.py", line 130, in <module> tree = ET.fromstring(xccdf_xml_contents) File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48270) File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:71812) File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:70673) File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67442) File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:63824) File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:64745) File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64088) lxml.etree.XMLSyntaxError: Comment not terminated <!-- , line 8, column 6 AFTER PATCH: $ ./verify-input-sanity.py WARNING: XCCDF Rule "uninstall_vsftpd" has no bash remediation file WARNING: XCCDF Rule "install_vsftpd" has no bash remediation file .......... WARNING: XCCDF Rule "disable_logwatch_for_logserver" has no bash remediation file WARNING: XCCDF Rule "disable_logwatch_for_logserver" references OVAL check "logwatch_disabled_for_logserver" which does not exist problem occurs in file: src/input/system/logging.xml WARNING: XCCDF Rule "enable_auditd_bootloader" has no bash remediation file WARNING: XCCDF Rule "configure_auditd_num_logs" has no bash remediation file --- RHEL6/utils/verify-input-sanity.py | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/RHEL6/utils/verify-input-sanity.py b/RHEL6/utils/verify-input-sanity.py index 13046b6..f16ee84 100755 --- a/RHEL6/utils/verify-input-sanity.py +++ b/RHEL6/utils/verify-input-sanity.py @@ -99,6 +99,9 @@ for oval_check in oval_file_list: # want to make sure that a corresponding OVAL check exists in the src/input/checks directory. We print a relatively polite # warning if a XCCDF Rule references an OVAL check that does not exist. # +# Additionally, this section will compare the XCCDF ID name to scan for a corresponding bash remediation script. If +# a bash remediation script is not found, a notification will be printed to the screen. +# # Again, lots of regex-fu here. In their raw state the XCCDF files are not valid XML. The next iteration of this file may # add all of the XML complexity so that we can perform these validations by parsing XML. That would form a more complete # solution. @@ -130,6 +133,12 @@ for xccdf_file in xccdf_xml_files: tree = ET.fromstring(xccdf_xml_contents) # extract all of the rules that are defined within the XCCDF xccdf_rules = tree.findall(".//Rule") + # check that every XCCDF has matching bash remediation + for xccdf_rule in xccdf_rules: + file_name = "./fixes/bash/" + xccdf_rule.get("id") + ".sh" + if (not os.access(file_name, os.F_OK)): + print " WARNING: XCCDF Rule \"" + xccdf_rule.get("id") + "\" has no bash remediation file\n" + # check that every XCCDF has matching OVAL for xccdf_rule in xccdf_rules: # extract any reference to an OVAL check oval_check_refs = xccdf_rule.findall(".//oval") -- 1.7.1
bump
_______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
