import oscap-anaconda-addon-1.2.1-7.el8
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
9e8ba78f88
commit
12ca6c1699
@ -1,167 +0,0 @@
|
|||||||
From 6243c5621a6b76a4652ea68437f37d3b15bc93c7 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matej Tyc <matyc@redhat.com>
|
|
||||||
Date: Fri, 14 Jan 2022 17:24:00 +0100
|
|
||||||
Subject: [PATCH] Add support for the firstboot remediation
|
|
||||||
|
|
||||||
OpenSCAP can support a new remediation type -
|
|
||||||
a classical scan + remediate that is executed during the first boot.
|
|
||||||
This PR adds support for this functionality,
|
|
||||||
and allows to control it via a remediate kickstart property.
|
|
||||||
---
|
|
||||||
org_fedora_oscap/common.py | 41 ++++++++++++++++++++++++++++++
|
|
||||||
org_fedora_oscap/ks/oscap.py | 48 ++++++++++++++++++++++++++++--------
|
|
||||||
2 files changed, 79 insertions(+), 10 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/org_fedora_oscap/common.py b/org_fedora_oscap/common.py
|
|
||||||
index 05829ce..663c526 100644
|
|
||||||
--- a/org_fedora_oscap/common.py
|
|
||||||
+++ b/org_fedora_oscap/common.py
|
|
||||||
@@ -29,6 +29,7 @@
|
|
||||||
import subprocess
|
|
||||||
import zipfile
|
|
||||||
import tarfile
|
|
||||||
+import textwrap
|
|
||||||
|
|
||||||
import cpioarchive
|
|
||||||
import re
|
|
||||||
@@ -309,6 +310,46 @@ def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
|
|
||||||
return proc.stdout
|
|
||||||
|
|
||||||
|
|
||||||
+def _schedule_firstboot_remediation(
|
|
||||||
+ chroot, profile, ds_path, results_path, report_path, ds_id, xccdf_id, tailoring_path):
|
|
||||||
+ config = textwrap.dedent(f"""\
|
|
||||||
+ OSCAP_REMEDIATE_DS='{ds_path}'
|
|
||||||
+ OSCAP_REMEDIATE_PROFILE_ID='{profile}'
|
|
||||||
+ OSCAP_REMEDIATE_ARF_RESULT='{results_path}'
|
|
||||||
+ OSCAP_REMEDIATE_HTML_REPORT='{report_path}'
|
|
||||||
+ """)
|
|
||||||
+ if ds_id:
|
|
||||||
+ config += "OSCAP_REMEDIATE_DATASTREAM_ID='{ds_id}'\n"
|
|
||||||
+ if xccdf_id:
|
|
||||||
+ config += "OSCAP_REMEDIATE_XCCDF_ID='{xccdf_id}'\n"
|
|
||||||
+ if tailoring_path:
|
|
||||||
+ config += "OSCAP_REMEDIATE_TAILORING='{tailoring_path}'\n"
|
|
||||||
+
|
|
||||||
+ relative_filename = "var/tmp/oscap-remediate-offline.conf.sh"
|
|
||||||
+ local_config_filename = f"/{relative_filename}"
|
|
||||||
+ chroot_config_filename = os.path.join(chroot, relative_filename)
|
|
||||||
+ with open(chroot_config_filename, "w") as f:
|
|
||||||
+ f.write(config)
|
|
||||||
+ os.symlink(local_config_filename,
|
|
||||||
+ os.path.join(chroot, "system-update"))
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+def schedule_firstboot_remediation(chroot, profile, fpath, ds_id="", xccdf_id="", tailoring=""):
|
|
||||||
+ if not profile:
|
|
||||||
+ return ""
|
|
||||||
+
|
|
||||||
+ # make sure the directory for the results exists
|
|
||||||
+ results_dir = os.path.dirname(RESULTS_PATH)
|
|
||||||
+ results_dir = os.path.normpath(chroot + "/" + results_dir)
|
|
||||||
+ utils.ensure_dir_exists(results_dir)
|
|
||||||
+
|
|
||||||
+ log.info("OSCAP addon: Scheduling firstboot remediation")
|
|
||||||
+ _schedule_firstboot_remediation(
|
|
||||||
+ chroot, profile, fpath, RESULTS_PATH, REPORT_PATH, ds_id, xccdf_id, tailoring)
|
|
||||||
+
|
|
||||||
+ return ""
|
|
||||||
+
|
|
||||||
+
|
|
||||||
def extract_data(archive, out_dir, ensure_has_files=None):
|
|
||||||
"""
|
|
||||||
Fuction that extracts the given archive to the given output directory. It
|
|
||||||
diff --git a/org_fedora_oscap/ks/oscap.py b/org_fedora_oscap/ks/oscap.py
|
|
||||||
index ef34448..8fef2aa 100644
|
|
||||||
--- a/org_fedora_oscap/ks/oscap.py
|
|
||||||
+++ b/org_fedora_oscap/ks/oscap.py
|
|
||||||
@@ -54,7 +54,7 @@
|
|
||||||
# LABEL:?, hdaX:?,
|
|
||||||
)
|
|
||||||
|
|
||||||
-REQUIRED_PACKAGES = ("openscap", "openscap-scanner", )
|
|
||||||
+REQUIRED_PACKAGES = ("openscap", "openscap-scanner", "openscap-utils",)
|
|
||||||
|
|
||||||
FINGERPRINT_REGEX = re.compile(r'^[a-z0-9]+$')
|
|
||||||
|
|
||||||
@@ -100,6 +100,9 @@ def __init__(self, name, just_clear=False):
|
|
||||||
# certificate to verify HTTPS connection or signed data
|
|
||||||
self.certificates = ""
|
|
||||||
|
|
||||||
+ # What remediation(s) to execute
|
|
||||||
+ self.remediate = ""
|
|
||||||
+
|
|
||||||
# internal values
|
|
||||||
self.rule_data = rule_handling.RuleData()
|
|
||||||
self.dry_run = False
|
|
||||||
@@ -145,6 +148,9 @@ def key_value_pair(key, value, indent=4):
|
|
||||||
if self.certificates:
|
|
||||||
ret += "\n%s" % key_value_pair("certificates", self.certificates)
|
|
||||||
|
|
||||||
+ if self.remediate:
|
|
||||||
+ ret += "\n%s" % key_value_pair("remediate", self.remediate)
|
|
||||||
+
|
|
||||||
ret += "\n%end\n\n"
|
|
||||||
return ret
|
|
||||||
|
|
||||||
@@ -203,6 +209,10 @@ def _parse_fingerprint(self, value):
|
|
||||||
def _parse_certificates(self, value):
|
|
||||||
self.certificates = value
|
|
||||||
|
|
||||||
+ def _parse_remediate(self, value):
|
|
||||||
+ assert value in ("none", "post", "firstboot", "both")
|
|
||||||
+ self.remediate = value
|
|
||||||
+
|
|
||||||
def handle_line(self, line):
|
|
||||||
"""
|
|
||||||
The handle_line method that is called with every line from this addon's
|
|
||||||
@@ -224,6 +234,7 @@ def handle_line(self, line):
|
|
||||||
"tailoring-path": self._parse_tailoring_path,
|
|
||||||
"fingerprint": self._parse_fingerprint,
|
|
||||||
"certificates": self._parse_certificates,
|
|
||||||
+ "remediate": self._parse_remediate,
|
|
||||||
}
|
|
||||||
|
|
||||||
line = line.strip()
|
|
||||||
@@ -527,15 +538,32 @@ def execute(self, storage, ksdata, users, payload):
|
|
||||||
if os.path.exists(self.preinst_tailoring_path):
|
|
||||||
shutil.copy2(self.preinst_tailoring_path, target_content_dir)
|
|
||||||
|
|
||||||
- try:
|
|
||||||
- common.run_oscap_remediate(self.profile_id, self.postinst_content_path,
|
|
||||||
- self.datastream_id, self.xccdf_id,
|
|
||||||
- self.postinst_tailoring_path,
|
|
||||||
- chroot=conf.target.system_root)
|
|
||||||
- except Exception as exc:
|
|
||||||
- msg = _(f"Something went wrong during the final hardening: {str(exc)}.")
|
|
||||||
- self._terminate(msg)
|
|
||||||
- return
|
|
||||||
+ if self.remediate in ("", "post", "both"):
|
|
||||||
+ try:
|
|
||||||
+ common.run_oscap_remediate(self.profile_id, self.postinst_content_path,
|
|
||||||
+ self.datastream_id, self.xccdf_id,
|
|
||||||
+ self.postinst_tailoring_path,
|
|
||||||
+ chroot=conf.target.system_root)
|
|
||||||
+ except Exception as exc:
|
|
||||||
+ msg = _(f"Something went wrong during the final hardening: {str(exc)}.")
|
|
||||||
+ self._terminate(msg)
|
|
||||||
+ return
|
|
||||||
+
|
|
||||||
+ if self.remediate in ("", "firstboot", "both"):
|
|
||||||
+ try:
|
|
||||||
+ common.schedule_firstboot_remediation(
|
|
||||||
+ conf.target.system_root,
|
|
||||||
+ self.profile_id,
|
|
||||||
+ self.postinst_content_path,
|
|
||||||
+ self.datastream_id,
|
|
||||||
+ self.xccdf_id,
|
|
||||||
+ self.postinst_tailoring_path,
|
|
||||||
+ )
|
|
||||||
+ except Exception as exc:
|
|
||||||
+ msg = _("Something went wrong when scheduling the first-boot remediation: {exc}."
|
|
||||||
+ .format(exc=str(exc)))
|
|
||||||
+ terminate(msg)
|
|
||||||
+ return
|
|
||||||
|
|
||||||
def clear_all(self):
|
|
||||||
"""Clear all the stored values."""
|
|
||||||
@ -1,72 +0,0 @@
|
|||||||
From 353b2782ac4ec71c1f815915e03cefec075a5a3a Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matej Tyc <matyc@redhat.com>
|
|
||||||
Date: Wed, 9 Mar 2022 11:36:44 +0100
|
|
||||||
Subject: [PATCH] Fix firstboot remediation setup
|
|
||||||
|
|
||||||
Expand all string substitutions, and
|
|
||||||
add a test that performs a basic sanity check of the generated config.
|
|
||||||
---
|
|
||||||
org_fedora_oscap/common.py | 16 +++++++++++-----
|
|
||||||
tests/test_common.py | 15 +++++++++++++++
|
|
||||||
2 files changed, 26 insertions(+), 5 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/org_fedora_oscap/common.py b/org_fedora_oscap/common.py
|
|
||||||
index 663c526..99a3fbd 100644
|
|
||||||
--- a/org_fedora_oscap/common.py
|
|
||||||
+++ b/org_fedora_oscap/common.py
|
|
||||||
@@ -310,8 +310,8 @@ def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
|
|
||||||
return proc.stdout
|
|
||||||
|
|
||||||
|
|
||||||
-def _schedule_firstboot_remediation(
|
|
||||||
- chroot, profile, ds_path, results_path, report_path, ds_id, xccdf_id, tailoring_path):
|
|
||||||
+def _create_firstboot_config_string(
|
|
||||||
+ profile, ds_path, results_path, report_path, ds_id, xccdf_id, tailoring_path):
|
|
||||||
config = textwrap.dedent(f"""\
|
|
||||||
OSCAP_REMEDIATE_DS='{ds_path}'
|
|
||||||
OSCAP_REMEDIATE_PROFILE_ID='{profile}'
|
|
||||||
@@ -319,12 +319,18 @@ def _schedule_firstboot_remediation(
|
|
||||||
OSCAP_REMEDIATE_HTML_REPORT='{report_path}'
|
|
||||||
""")
|
|
||||||
if ds_id:
|
|
||||||
- config += "OSCAP_REMEDIATE_DATASTREAM_ID='{ds_id}'\n"
|
|
||||||
+ config += f"OSCAP_REMEDIATE_DATASTREAM_ID='{ds_id}'\n"
|
|
||||||
if xccdf_id:
|
|
||||||
- config += "OSCAP_REMEDIATE_XCCDF_ID='{xccdf_id}'\n"
|
|
||||||
+ config += f"OSCAP_REMEDIATE_XCCDF_ID='{xccdf_id}'\n"
|
|
||||||
if tailoring_path:
|
|
||||||
- config += "OSCAP_REMEDIATE_TAILORING='{tailoring_path}'\n"
|
|
||||||
+ config += f"OSCAP_REMEDIATE_TAILORING='{tailoring_path}'\n"
|
|
||||||
+ return config
|
|
||||||
+
|
|
||||||
|
|
||||||
+def _schedule_firstboot_remediation(
|
|
||||||
+ chroot, profile, ds_path, results_path, report_path, ds_id, xccdf_id, tailoring_path):
|
|
||||||
+ config = _create_firstboot_config_string(
|
|
||||||
+ profile, ds_path, results_path, report_path, ds_id, xccdf_id, tailoring_path)
|
|
||||||
relative_filename = "var/tmp/oscap-remediate-offline.conf.sh"
|
|
||||||
local_config_filename = f"/{relative_filename}"
|
|
||||||
chroot_config_filename = os.path.join(chroot, relative_filename)
|
|
||||||
diff --git a/tests/test_common.py b/tests/test_common.py
|
|
||||||
index 4f25379..d39898a 100644
|
|
||||||
--- a/tests/test_common.py
|
|
||||||
+++ b/tests/test_common.py
|
|
||||||
@@ -274,3 +274,18 @@ def test_extract_tailoring_rpm_ensure_filename_there():
|
|
||||||
in str(excinfo.value)
|
|
||||||
|
|
||||||
shutil.rmtree(temp_path)
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+def test_firstboot_config():
|
|
||||||
+ config_args = dict(
|
|
||||||
+ profile="@PROFILE@",
|
|
||||||
+ ds_path="@DS_PATH@",
|
|
||||||
+ results_path="@RES_PATH@",
|
|
||||||
+ report_path="@REP_PATH",
|
|
||||||
+ ds_id="@DS_ID@",
|
|
||||||
+ xccdf_id="@XCCDF_ID@",
|
|
||||||
+ tailoring_path="@TAIL_PATH@",
|
|
||||||
+ )
|
|
||||||
+ config_string = common._create_firstboot_config_string(** config_args)
|
|
||||||
+ for arg in config_args.values():
|
|
||||||
+ assert arg in config_string
|
|
||||||
@ -3,7 +3,7 @@
|
|||||||
|
|
||||||
Name: oscap-anaconda-addon
|
Name: oscap-anaconda-addon
|
||||||
Version: 1.2.1
|
Version: 1.2.1
|
||||||
Release: 6%{?dist}
|
Release: 7%{?dist}
|
||||||
Summary: Anaconda addon integrating OpenSCAP to the installation process
|
Summary: Anaconda addon integrating OpenSCAP to the installation process
|
||||||
|
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
@ -22,8 +22,6 @@ Patch1: lang.patch
|
|||||||
Patch2: oscap-anaconda-addon-1.2.2-content_ident-PR_167.patch
|
Patch2: oscap-anaconda-addon-1.2.2-content_ident-PR_167.patch
|
||||||
Patch3: oscap-anaconda-addon-1.2.2-deep_archives-PR_168.patch
|
Patch3: oscap-anaconda-addon-1.2.2-deep_archives-PR_168.patch
|
||||||
Patch4: oscap-anaconda-addon-1.2.2-absent_appstream-PR_184.patch
|
Patch4: oscap-anaconda-addon-1.2.2-absent_appstream-PR_184.patch
|
||||||
Patch5: oscap-anaconda-addon-1.2.2-firstboot-PR_190.patch
|
|
||||||
Patch6: oscap-anaconda-addon-1.3.0-fix_dsid-PR_194.patch
|
|
||||||
|
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
BuildRequires: make
|
BuildRequires: make
|
||||||
@ -53,8 +51,6 @@ content.
|
|||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
%patch3 -p1
|
%patch3 -p1
|
||||||
%patch4 -p1
|
%patch4 -p1
|
||||||
%patch5 -p1
|
|
||||||
%patch6 -p1
|
|
||||||
# NOTE CONCERNING TRANSLATION PATCHES
|
# NOTE CONCERNING TRANSLATION PATCHES
|
||||||
# When preparing translation patches, don't consider that some languages are unsupported -
|
# When preparing translation patches, don't consider that some languages are unsupported -
|
||||||
# we aim to include all applicable translation texts to the appropriate patch.
|
# we aim to include all applicable translation texts to the appropriate patch.
|
||||||
@ -76,6 +72,11 @@ make install DESTDIR=%{buildroot}
|
|||||||
%doc COPYING ChangeLog README.md
|
%doc COPYING ChangeLog README.md
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Jun 10 2022 Matej Tyc <matyc@redhat.com> - 1.2.1-7
|
||||||
|
- Remove the firstboot remediation feature completely.
|
||||||
|
We can't have it, while maintaining the standard UX.
|
||||||
|
Resolves: rhbz#2063179
|
||||||
|
|
||||||
* Mon Mar 21 2022 Matej Tyc <matyc@redhat.com> - 1.2.1-6
|
* Mon Mar 21 2022 Matej Tyc <matyc@redhat.com> - 1.2.1-6
|
||||||
- Introduce the firstboot remediation
|
- Introduce the firstboot remediation
|
||||||
Resolves: rhbz#1834716
|
Resolves: rhbz#1834716
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user