Skip to content

Commit 738fd0f

Browse files
committed
Add --raw switch to xccdf generate fix module
The option would allow the user to generate fix scripts without headers and boilerplate. Currently implemented for Kickstart remediation type.
1 parent fbf3e3c commit 738fd0f

8 files changed

Lines changed: 163 additions & 59 deletions

File tree

src/XCCDF_POLICY/public/xccdf_policy.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -518,9 +518,10 @@ OSCAP_API bool xccdf_policy_resolve(struct xccdf_policy * policy);
518518
* @param input_file_name file name of the input SCAP file
519519
* @param tailoring input tailoring file (parsed as oscap source)
520520
* @param output_fd write prescription to this file descriptor
521+
* @param raw controls verbosiness of generated remediation files (if greater than zero, the function won't add commentaries and optional boilerplate instructions)
521522
* @returns zero on success, non-zero indicate partial (incomplete) output.
522523
*/
523-
OSCAP_API int xccdf_policy_generate_fix(struct xccdf_policy *policy, struct xccdf_result *result, const char *sys, const char *input_file_name, struct oscap_source *tailoring, int output_fd);
524+
OSCAP_API int xccdf_policy_generate_fix(struct xccdf_policy *policy, struct xccdf_result *result, const char *sys, const char *input_file_name, struct oscap_source *tailoring, int output_fd, int raw);
524525

525526
/**
526527
* xccdf_policy_model_get_files and xccdf_item_get_files each return oscap_file_entries instead of raw strings

src/XCCDF_POLICY/xccdf_policy_remediate.c

Lines changed: 80 additions & 53 deletions
Large diffs are not rendered by default.

tests/API/XCCDF/unittests/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ add_oscap_test("test_single_rule_stigw.sh")
7878
add_oscap_test("test_remediation_simple.sh")
7979
add_oscap_test("test_remediation_offline.sh")
8080
add_oscap_test("test_remediation_kickstart.sh")
81+
add_oscap_test("test_remediation_kickstart_raw.sh")
8182
add_oscap_test("test_remediation_metadata.sh")
8283
add_oscap_test("test_remediation_blueprint.sh")
8384
add_oscap_test("test_remediation_bad_fix.sh")

tests/API/XCCDF/unittests/test_remediation_kickstart_expected.cfg

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@
2424
###############################################################################
2525

2626

27-
# Default values for automated installation
27+
# Default values for automated installation (optional)
2828
lang en_US.UTF-8
2929
keyboard --vckeymap us
3030
timezone --utc America/New_York
3131

32-
# Root password is required for system rescue tasks
32+
# Root password is required for system rescue tasks (optional)
3333
rootpw changeme
3434

3535
# Create partition layout scheme (required for security compliance)
Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# %partitions
2+
zerombr
3+
clearpart --all --initlabel
4+
reqpart --add-boot
5+
part pv.01 --grow --size=1
6+
volgroup system pv.01
7+
logvol / --name=root --vgname=system --size=2000 --grow
8+
logvol swap --name=swap --vgname=system --size=1000
9+
# %logvols
10+
logvol /var/tmp --name=vartmp --vgname=system --size=1024
11+
# %end
12+
13+
bootloader --append="quick audit=1"
14+
15+
%addon com_redhat_kdump --disable
16+
%end
17+
18+
firewall --remove-service=httpd --service=sshd
19+
20+
services --disabled=telnet,httpd --enabled=auditd,rsyslog,sshd
21+
22+
%packages
23+
openscap-scanner
24+
scap-security-guide
25+
rsyslog
26+
openssh-server
27+
podman
28+
-usbguard
29+
%end
30+
31+
%post --erroronfail
32+
oscap xccdf eval --remediate --results-arf /root/oscap_arf.xml --report /root/oscap_report.html --profile 'xccdf_org.openscap.www_profile_common' /usr/share/xml/scap/ssg/content/test_remediation_kickstart.ds.xml
33+
[ $? -eq 0 -o $? -eq 2 ] || exit 1
34+
%end
35+
36+
%post --nochroot
37+
mkdir -p /etc/ddfds
38+
%end
39+
40+
%post --nochroot
41+
mkdir -p /etc/abcd
42+
%end
43+
44+
%post
45+
rm -rf /etc/xyz
46+
# create a new path
47+
feel /etc/xyz
48+
%end
49+
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/usr/bin/env bash
2+
. $builddir/tests/test_common.sh
3+
4+
set -e -o pipefail
5+
6+
function test_raw {
7+
kickstart=$(mktemp)
8+
stderr=$(mktemp)
9+
expected_modified=$(mktemp)
10+
11+
sed "s;TEST_DATA_STREAM_PATH;$srcdir/test_remediation_kickstart.ds.xml;" "$srcdir/test_remediation_kickstart_expected_raw.cfg" > "$expected_modified"
12+
13+
$OSCAP xccdf generate fix --fix-type kickstart --raw --output "$kickstart" --profile common "$srcdir/test_remediation_kickstart.ds.xml"
14+
15+
diff -u "$expected_modified" "$kickstart"
16+
17+
rm -rf "$kickstart"
18+
rm -rf "$stderr"
19+
rm -rf "$expected_modified"
20+
rm -rf "$kickstart_modified"
21+
}
22+
23+
test_raw

utils/oscap-tool.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ struct oscap_action {
161161
char *local_files;
162162
char *reference;
163163
int references;
164+
int raw;
164165
};
165166

166167
int app_xslt(const char *infile, const char *xsltfile, const char *outfile, const char **params);

utils/oscap-xccdf.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,7 @@ static struct oscap_module XCCDF_GEN_FIX = {
283283
" --fix-type <type> - Fix type. Should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes,\n"
284284
" blueprint, kickstart (default: bash).\n"
285285
" --output <file> - Write the script into file.\n"
286+
" --raw - Don't write extra headers or boilerplate instructions, only compose the content snippets.\n"
286287
" --result-id <id> - Fixes will be generated for failed rule-results of the specified TestResult.\n"
287288
" --benchmark-id <id> - ID of XCCDF Benchmark in some component in the data stream that should be used.\n"
288289
" (only applicable for source data streams)\n"
@@ -1041,7 +1042,7 @@ int app_generate_fix(const struct oscap_action *action)
10411042

10421043
struct xccdf_policy *policy = xccdf_session_get_xccdf_policy(session);
10431044
struct xccdf_result *result = xccdf_policy_get_result_by_id(policy, xccdf_session_get_result_id(session));
1044-
if (xccdf_policy_generate_fix(policy, result, remediation_system, action->f_xccdf, tailoring, output_fd) == 0)
1045+
if (xccdf_policy_generate_fix(policy, result, remediation_system, action->f_xccdf, tailoring, output_fd, action->raw) == 0)
10451046
ret = OSCAP_OK;
10461047
} else { // Fallback to profile if result id is missing
10471048
/* Profile-oriented fixes */
@@ -1055,7 +1056,7 @@ int app_generate_fix(const struct oscap_action *action)
10551056
}
10561057
}
10571058
struct xccdf_policy *policy = xccdf_session_get_xccdf_policy(session);
1058-
if (xccdf_policy_generate_fix(policy, NULL, remediation_system, action->f_xccdf, tailoring, output_fd) == 0)
1059+
if (xccdf_policy_generate_fix(policy, NULL, remediation_system, action->f_xccdf, tailoring, output_fd, action->raw) == 0)
10591060
ret = OSCAP_OK;
10601061
}
10611062
cleanup2:
@@ -1243,8 +1244,9 @@ bool getopt_xccdf(int argc, char **argv, struct oscap_action *action)
12431244
{"hide-profile-info", no_argument, &action->hide_profile_info, 1},
12441245
{"export-variables", no_argument, &action->export_variables, 1},
12451246
{"skip-schematron", no_argument, &action->schematron, 0},
1246-
{"without-syschar", no_argument, &action->without_sys_chars, 1},
1247+
{"without-syschar", no_argument, &action->without_sys_chars, 1},
12471248
{"thin-results", no_argument, &action->thin_results, 1},
1249+
{"raw", no_argument, &action->raw, 1},
12481250
// end
12491251
{0, 0, 0, 0}
12501252
};

0 commit comments

Comments
 (0)