Skip to content

Commit b938dd6

Browse files
Mab879Mab879
authored
Merge pull request #14535 from jan-cerny/rhel8_cloud
Support RHEL 8 cloud images in GRUB 2 rules
2 parents e6fd405 + 8a11579 commit b938dd6

7 files changed

Lines changed: 116 additions & 15 deletions

File tree

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/oval/shared.xml‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,15 @@
77
<criterion comment="Superuser is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg and it
88
isn't root, admin, administrator nor equal to any system username"
99
test_ref="test_bootloader_uefi_superuser_differ_from_other_users"/>
10+
{{% if product in ["rhel8"] %}}
11+
<!-- In RHEL 8 cloud images (eg. AWS) the /boot/efi/EFI/redhat/grub.cfg contains a stub pointing to /boot/grub2/grub.cfg -->
12+
<criteria operator="AND" comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg is a stub pointing to {{{ grub2_boot_path }}}/grub.cfg">
13+
<criterion comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg contains a configfile directive" test_ref="test_grub2_uefi_admin_username_stub" />
14+
<criterion comment="Superuser is defined in {{{ grub2_boot_path }}}/grub.cfg and it
15+
isn't root, admin, administrator nor equal to any system username"
16+
test_ref="test_bootloader_uefi_boot_superuser_differ_from_other_users"/>
17+
</criteria>
18+
{{% endif %}}
1019
</criteria>
1120
</definition>
1221

@@ -33,10 +42,36 @@
3342
<ind:state state_ref="state_bootloader_uefi_superuser_differ_from_other_users" />
3443
</ind:textfilecontent54_test>
3544

45+
{{% set superusers_regex = '^[\\s]*set[\\s]+superusers="(?i)\\b(?!(?:root|admin|administrator)\\b)(\\w+)".*\\n[\\s]*export[\\s]+superusers[\\s]*$' %}}
46+
3647
<ind:textfilecontent54_object id="object_bootloader_uefi_unique_superuser" version="1">
3748
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
38-
<ind:pattern operation="pattern match"
39-
>^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)".*\n[\s]*export[\s]+superusers[\s]*$</ind:pattern>
49+
<ind:pattern operation="pattern match">{{{ superusers_regex }}}</ind:pattern>
50+
<ind:instance datatype="int">1</ind:instance>
51+
</ind:textfilecontent54_object>
52+
{{% if product in ["rhel8"] %}}
53+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg contains a configfile directive" id="test_grub2_uefi_admin_username_stub" version="1">
54+
<ind:object object_ref="object_grub2_uefi_admin_username_stub" />
55+
</ind:textfilecontent54_test>
56+
<ind:textfilecontent54_object id="object_grub2_uefi_admin_username_stub" version="1">
57+
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
58+
<ind:pattern operation="pattern match">^[\s]*configfile\b.*$</ind:pattern>
59+
<ind:instance datatype="int">1</ind:instance>
60+
</ind:textfilecontent54_object>
61+
62+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser
63+
is defined in {{{ grub2_boot_path }}}/grub.cfg. Superuser is not
64+
equal to other system account nor root, admin, administrator"
65+
id="test_bootloader_uefi_boot_superuser_differ_from_other_users" version="1">
66+
<ind:object object_ref="object_bootloader_uefi_boot_unique_superuser" />
67+
<ind:state state_ref="state_bootloader_uefi_superuser_differ_from_other_users" />
68+
</ind:textfilecontent54_test>
69+
70+
<ind:textfilecontent54_object id="object_bootloader_uefi_boot_unique_superuser" version="1">
71+
<ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
72+
<ind:pattern operation="pattern match">{{{ superusers_regex }}}</ind:pattern>
4073
<ind:instance datatype="int">1</ind:instance>
4174
</ind:textfilecontent54_object>
75+
{{% endif %}}
76+
4277
</def-group>

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/tests/stub.fail.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
# platform = Red Hat Enterprise Linux 8
3+
4+
. $SHARED/grub2.sh
5+
6+
cat <<'EOF' >/boot/efi/EFI/redhat/grub.cfg
7+
search --no-floppy --set prefix --file /boot/grub2/grub.cfg
8+
set prefix=($prefix)/boot/grub2
9+
configfile $prefix/grub.cfg
10+
EOF
11+
12+
GRUB_CFG_ROOT="/boot/grub2"
13+
set_superusers "root"

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/tests/stub.pass.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
# platform = Red Hat Enterprise Linux 8
3+
4+
. $SHARED/grub2.sh
5+
6+
cat <<'EOF' >/boot/efi/EFI/redhat/grub.cfg
7+
search --no-floppy --set prefix --file /boot/grub2/grub.cfg
8+
set prefix=($prefix)/boot/grub2
9+
configfile $prefix/grub.cfg
10+
EOF
11+
12+
GRUB_CFG_ROOT="/boot/grub2"
13+
set_superusers "koskic"

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval/shared.xml‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,16 @@
44

55
<criteria operator="OR">
66
<criterion comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/user.cfg" test_ref="test_grub2_uefi_password_usercfg" />
7+
{{% if product in ["rhel8"] %}}
8+
<!-- In RHEL 8 cloud images (eg. AWS) the /boot/efi/EFI/redhat/grub.cfg contains a stub pointing to /boot/grub2/grub.cfg -->
9+
<criteria operator="AND" comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg is a stub pointing to {{{ grub2_boot_path }}}/grub.cfg">
10+
<criterion comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg contains a configfile directive" test_ref="test_grub2_uefi_password_stub" />
11+
<criterion comment="make sure a password is defined in {{{ grub2_boot_path }}}/user.cfg" test_ref="test_grub2_uefi_password_boot_usercfg" />
12+
</criteria>
13+
{{% endif %}}
714
</criteria>
815
</definition>
9-
16+
1017
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/user.cfg" id="test_grub2_uefi_password_usercfg" version="1">
1118
<ind:object object_ref="object_grub2_uefi_password_usercfg" />
1219
</ind:textfilecontent54_test>
@@ -16,4 +23,24 @@
1623
<ind:instance datatype="int">1</ind:instance>
1724
</ind:textfilecontent54_object>
1825

26+
{{% if product in ["rhel8"] %}}
27+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if {{{ grub2_uefi_boot_path }}}/grub.cfg contains a configfile directive" id="test_grub2_uefi_password_stub" version="1">
28+
<ind:object object_ref="object_grub2_uefi_password_stub" />
29+
</ind:textfilecontent54_test>
30+
<ind:textfilecontent54_object id="object_grub2_uefi_password_stub" version="1">
31+
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
32+
<ind:pattern operation="pattern match">^[\s]*configfile\b.*$</ind:pattern>
33+
<ind:instance datatype="int">1</ind:instance>
34+
</ind:textfilecontent54_object>
35+
36+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_boot_path }}}/user.cfg" id="test_grub2_uefi_password_boot_usercfg" version="1">
37+
<ind:object object_ref="object_grub2_uefi_password_boot_usercfg" />
38+
</ind:textfilecontent54_test>
39+
<ind:textfilecontent54_object id="object_grub2_uefi_password_boot_usercfg" version="1">
40+
<ind:filepath>{{{ grub2_boot_path }}}/user.cfg</ind:filepath>
41+
<ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
42+
<ind:instance datatype="int">1</ind:instance>
43+
</ind:textfilecontent54_object>
44+
{{% endif %}}
45+
1946
</def-group>

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/tests/invalid_username.fail.sh‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/tests/stub.fail.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
# platform = Red Hat Enterprise Linux 8
3+
4+
. $SHARED/grub2.sh
5+
6+
cp "/boot/efi/EFI/redhat/user.cfg" "/boot/grub2/user.cfg"
7+
cat <<'EOF' >/boot/efi/EFI/redhat/grub.cfg
8+
search --no-floppy --set prefix --file /boot/grub2/grub.cfg
9+
set prefix=($prefix)/boot/grub2
10+
configfile $prefix/grub.cfg
11+
EOF
12+
rm -rf "/boot/grub2/user.cfg"

‎linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/tests/stub.pass.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
# platform = Red Hat Enterprise Linux 8
3+
4+
. $SHARED/grub2.sh
5+
6+
cat <<'EOF' >/boot/efi/EFI/redhat/grub.cfg
7+
search --no-floppy --set prefix --file /boot/grub2/grub.cfg
8+
set prefix=($prefix)/boot/grub2
9+
configfile $prefix/grub.cfg
10+
EOF
11+
12+
GRUB_CFG_ROOT="/boot/grub2"
13+
make_grub_password

0 commit comments

Comments
 (0)