Skip to content

Commit 572c9b3

Browse files
jan-cernyjan-cerny
authored
Merge pull request #2146 from evgenyz/add-multiprofile-tailoring
Enable autotailor to process multi-profile JSON Tailorings
2 parents 66b58f1 + 2700210 commit 572c9b3

5 files changed

Lines changed: 184 additions & 123 deletions

File tree

‎tests/utils/autotailor_integration_test.sh‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www
7070
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
7171
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4" and @severity="high"]'
7272

73-
7473
# select additional rule R4 and change its role to "unchecked"
7574
python3 $autotailor --id-namespace "com.example.www" --select R4 --rule-role R4=unchecked $ds $original_profile > $tailoring
7675
$OSCAP xccdf eval --profile P1_customized --progress --tailoring-file $tailoring --results $result $ds
@@ -83,7 +82,6 @@ assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www
8382
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notchecked"]'
8483
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4" and @role="unchecked"]'
8584

86-
8785
# select additional rule R3; the customized profile will have a special profile ID
8886
customized_profile="xccdf_com.pink.elephant_profile_pineapple"
8987
python3 $autotailor --new-profile-id $customized_profile --id-namespace "com.example.www" --select R3 $ds $original_profile > $tailoring
@@ -113,7 +111,7 @@ assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www
113111
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="notselected"]'
114112
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
115113

116-
# use JSON tailoring
114+
# use JSON tailoring (P1)
117115
python3 $autotailor $ds --id-namespace "com.example.www" --json-tailoring $json_tailoring > $tailoring
118116
$OSCAP xccdf eval --profile JSON_P1 --progress --tailoring-file $tailoring --results $result $ds
119117
assert_exists 1 '/Benchmark/TestResult/set-value[@idref="xccdf_com.example.www_value_V1" and text()="New Value"]'
@@ -124,3 +122,18 @@ assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www
124122
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3" and @severity="unknown"]'
125123
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4"]/result[text()="notselected"]'
126124
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R4" and @role="unchecked"]'
125+
126+
# use JSON tailoring (P11)
127+
python3 $autotailor --id-namespace "com.example.www" --json-tailoring $json_tailoring $ds > $tailoring
128+
$OSCAP xccdf eval --profile JSON_P11 --progress --tailoring-file $tailoring --results $result $ds
129+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="pass"]'
130+
131+
# use JSON tailoring (P11) with command-line override
132+
python3 $autotailor --id-namespace "com.example.www" --json-tailoring $json_tailoring --tailored-profile-id=JSON_P11 --unselect R3 $ds > $tailoring
133+
$OSCAP xccdf eval --profile JSON_P11 --progress --tailoring-file $tailoring --results $result $ds
134+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="notselected"]'
135+
136+
# use JSON tailoring (P11) with a new profile from the command line
137+
python3 $autotailor --id-namespace "com.example.www" --json-tailoring $json_tailoring --tailored-profile-id=CMDL_P --select R3 $ds $original_profile > $tailoring
138+
$OSCAP xccdf eval --profile CMDL_P --progress --tailoring-file $tailoring --results $result $ds
139+
assert_exists 1 '/Benchmark/TestResult/rule-result[@idref="xccdf_com.example.www_rule_R3"]/result[text()="pass"]'

‎tests/utils/custom.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,16 @@
3030
"option_id": "some"
3131
}
3232
}
33+
},
34+
{
35+
"id": "JSON_P11",
36+
"title": "JSON Tailored Profile P11",
37+
"base_profile_id": "P1",
38+
"rules": {
39+
"R3": {
40+
"evaluate": true
41+
}
42+
}
3343
}
3444
]
3545
}

‎tests/utils/test_autotailor.py‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -29,68 +29,68 @@ def test_is_valid_xccdf_id():
2929

3030

3131
def test_full_id():
32-
t = autotailor.Tailoring()
33-
assert t._full_rule_id("accounts_tmout") == \
32+
p = autotailor.Profile()
33+
assert p._full_rule_id("accounts_tmout") == \
3434
"xccdf_org.ssgproject.content_rule_accounts_tmout"
35-
assert t._full_rule_id(
35+
assert p._full_rule_id(
3636
"xccdf_org.ssgproject.content_rule_accounts_tmout") == \
3737
"xccdf_org.ssgproject.content_rule_accounts_tmout"
38-
assert t._full_profile_id("stig") == \
38+
assert p._full_profile_id("stig") == \
3939
"xccdf_org.ssgproject.content_profile_stig"
40-
assert t._full_profile_id(
40+
assert p._full_profile_id(
4141
"xccdf_org.ssgproject.content_profile_stig") == \
4242
"xccdf_org.ssgproject.content_profile_stig"
43-
assert t._full_var_id("var_crypto_policy") == \
43+
assert p._full_var_id("var_crypto_policy") == \
4444
"xccdf_org.ssgproject.content_value_var_crypto_policy"
45-
assert t._full_var_id(
45+
assert p._full_var_id(
4646
"xccdf_org.ssgproject.content_value_var_crypto_policy") == \
4747
"xccdf_org.ssgproject.content_value_var_crypto_policy"
4848

4949

5050
def test_customized_profile_id():
51-
t = autotailor.Tailoring()
52-
t.extends = "stig"
53-
assert t.profile_id == "stig_customized"
54-
t.profile_id = "my_cool_profile"
55-
assert t.profile_id == "my_cool_profile"
51+
p = autotailor.Profile()
52+
p.extends = "stig"
53+
assert p.profile_id == "stig_customized"
54+
p.profile_id = "my_cool_profile"
55+
assert p.profile_id == "my_cool_profile"
5656

5757

5858
def test_refine_rule():
59-
t = autotailor.Tailoring()
59+
p = autotailor.Profile()
6060
with pytest.raises(ValueError) as e:
61-
t.refine_rule("selinux_state", "severity", "high")
61+
p.refine_rule("selinux_state", "severity", "high")
6262
assert str(e.value) == "Rule id 'selinux_state' is invalid!"
6363
with pytest.raises(ValueError) as e:
64-
t.refine_rule(
64+
p.refine_rule(
6565
"xccdf_org.ssgproject.content_rule_accounts_tmout", "foo", "bar")
6666
assert str(e.value) == "Unsupported refine-rule attribute foo"
6767
with pytest.raises(ValueError) as e:
68-
t.refine_rule(
68+
p.refine_rule(
6969
"xccdf_org.ssgproject.content_rule_accounts_tmout",
7070
"role", "mnau")
7171
assert str(e.value) == (
7272
"Can't refine role of rule 'xccdf_org.ssgproject.content_rule_accounts"
7373
"_tmout' to 'mnau'. Allowed role values are: \"full\", \"unscored\", "
7474
"\"unchecked\".")
7575
with pytest.raises(ValueError) as e:
76-
t.refine_rule(
76+
p.refine_rule(
7777
"xccdf_org.ssgproject.content_rule_accounts_tmout",
7878
"severity", "mnau")
7979
assert str(e.value) == (
8080
"Can't refine severity of rule 'xccdf_org.ssgproject.content_rule_"
8181
"accounts_tmout' to 'mnau'. Allowed severity values are: \"unknown\", "
8282
"\"info\", \"low\", \"medium\", \"high\".")
8383
fav = "xccdf_org.ssgproject.content_rule_accounts_tmout"
84-
t.refine_rule(fav, "severity", "high")
85-
assert t.rule_refinements(fav, "severity") == "high"
86-
t.refine_rule(fav, "role", "full")
87-
assert t.rule_refinements(fav, "severity") == "high"
88-
assert t.rule_refinements(fav, "role") == "full"
84+
p.refine_rule(fav, "severity", "high")
85+
assert p.rule_refinements(fav, "severity") == "high"
86+
p.refine_rule(fav, "role", "full")
87+
assert p.rule_refinements(fav, "severity") == "high"
88+
assert p.rule_refinements(fav, "role") == "full"
8989
with pytest.raises(ValueError) as e:
90-
t.refine_rule(fav, "severity", "low")
90+
p.refine_rule(fav, "severity", "low")
9191
assert str(e.value) == (
9292
"Can't refine severity of rule 'xccdf_org.ssgproject.content_rule_"
9393
"accounts_tmout' to 'low'. This rule severity is already refined to "
9494
"'high'.")
95-
assert t.rule_refinements(fav, "severity") == "high"
96-
assert t.rule_refinements(fav, "role") == "full"
95+
assert p.rule_refinements(fav, "severity") == "high"
96+
assert p.rule_refinements(fav, "role") == "full"

0 commit comments

Comments
 (0)