rpms/scap-security-guide
7
0
Fork 0
Code Issues Pull Requests Releases Activity
c228ce9aaf
scap-security-guide/SOURCES/scap-security-guide-0.1.58-tests_for_playbooks_that_change_banners-PR_7376.patch

525 lines
19 KiB
Diff
Raw Normal View History

import scap-security-guide-0.1.57-3.el8
2021-08-24 22:41:12 +00:00
From bf018e9f8327b231b967db8ec74fabf01802b6a8 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:45:04 +0200
Subject: [PATCH 1/3] Add test for ansible files removed and readded
Check if any playbook removes a file and then add it back again.
The file removal is based on the 'file' module with 'state: absent', and
the reintroduction of the file is based on 'lineinfile', 'blockinfile'
and 'copy' modules.
---
CMakeLists.txt | 2 +
tests/CMakeLists.txt | 8 ++
tests/test_ansible_file_removed_and_added.py | 97 ++++++++++++++++++++
3 files changed, 107 insertions(+)
create mode 100644 tests/test_ansible_file_removed_and_added.py
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 330b869d0f9..e41f2caa630 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -129,6 +129,7 @@ find_python_module(jinja2 REQUIRED)
find_python_module(pytest)
find_python_module(pytest_cov)
find_python_module(json2html)
+find_python_module(yamlpath)
# sphinx documentation requirements
find_python_module(sphinx)
@@ -231,6 +232,7 @@ message(STATUS "python pytest module (optional): ${PY_PYTEST}")
message(STATUS "ansible-playbook module (optional): ${ANSIBLE_PLAYBOOK_EXECUTABLE}")
message(STATUS "ansible-lint module (optional): ${ANSIBLE_LINT_EXECUTABLE}")
message(STATUS "yamllint module (optional): ${YAMLLINT_EXECUTABLE}")
+message(STATUS "yamlpath module (optional): ${PY_YAMLPATH}")
message(STATUS "BATS framework (optional): ${BATS_EXECUTABLE}")
message(STATUS "python sphinx module (optional): ${PY_SPHINX}")
message(STATUS "python sphinxcontrib.autojinja module (optional): ${PY_SPHINXCONTRIB.AUTOJINJA}")
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 3e2d8a4ec31..739cc124035 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -121,3 +121,11 @@ add_test(
)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
+
+if (PY_YAMLPATH)
+ add_test(
+ NAME "ansible-file-removed-and-added"
+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
+ )
+ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
+endif()
diff --git a/tests/test_ansible_file_removed_and_added.py b/tests/test_ansible_file_removed_and_added.py
new file mode 100644
index 00000000000..23f6f888bda
--- /dev/null
+++ b/tests/test_ansible_file_removed_and_added.py
@@ -0,0 +1,97 @@
+#!/usr/bin/python3
+
+import argparse
+import os
+import sys
+from types import SimpleNamespace
+from yamlpath import Processor
+from yamlpath import YAMLPath
+from yamlpath.common import Parsers
+from yamlpath.exceptions import YAMLPathException
+from yamlpath.wrappers import ConsolePrinter
+
+
+def parse_command_line_args():
+ parser = argparse.ArgumentParser(
+ description="Checks if an Ansible Playbook removes a file and then adds it again.")
+ parser.add_argument("--ansible_dir", required=True,
+ help="Directory containing Ansible Playbooks")
+ args = parser.parse_args()
+ return args
+
+
+def check_playbook_file_removed_and_added(playbook_path):
+ playbook_ok = True
+
+ yaml_parser = Parsers.get_yaml_editor()
+
+ logging_args = SimpleNamespace(quiet=False, verbose=False, debug=False)
+ log = ConsolePrinter(logging_args)
+
+ # Find every path removed by a file Task (also matches tasks within blocks)
+ files_absent_string = "tasks.**.file[state=absent][parent()].path"
+ files_absent_yamlpath = YAMLPath(files_absent_string)
+ path_editing_tasks_yamlpath = ""
+
+ log.info("Info: Evaluating playbook '{}'".format(playbook_path))
+ (yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml_parser, log, playbook_path)
+ if not doc_loaded:
+ # There was an issue loading the file; an error message has already been
+ # printed via ConsolePrinter.
+ return False
+
+ processor = Processor(log, yaml_data)
+ try:
+ for node in processor.get_nodes(files_absent_yamlpath, mustexist=False):
+ path = str(node)
+ # 'node' is a NodeCoords.
+ if path == 'None':
+ continue
+ elif "{{" in path:
+ # Identified path is a Jinja expression, unfortunately there is no easy way to get
+ # the actual path without making this test very complicated
+ continue
+
+ # Check if this paths is used in any of the following ansible modules
+ ansible_modules = ["lineinfile", "blockinfile", "copy"]
+ path_editing_tasks_string = "tasks.**.[.=~/{modules}/][*='{path}'][parent()].name"
+ path_editing_tasks_yamlpath = YAMLPath(path_editing_tasks_string.format(
+ modules="|".join(ansible_modules),
+ path=node)
+ )
+ for task in processor.get_nodes(path_editing_tasks_yamlpath, mustexist=False):
+ log.info("Error: Task '{}' manipulates a file that is removed by another task"
+ .format(task))
+ playbook_ok = False
+ except YAMLPathException as ex:
+ no_file_msg = ("Cannot add PathSegmentTypes.TRAVERSE subreference to lists at 'None' "
+ "in '{}'.")
+ if str(ex) == no_file_msg.format(files_absent_string):
+ log.info("Info: Playbook {} has no 'file' tasks.".format(playbook_path))
+ elif path_editing_tasks_yamlpath and str(ex) == no_file_msg.format(
+ path_editing_tasks_yamlpath):
+ log.info("Info: Playbook {} has no '{}' tasks.".format(
+ playbook_path, " ".join(ansible_modules)))
+ else:
+ log.info("Error: {}.".format(ex))
+
+ return playbook_ok
+
+
+def main():
+ args = parse_command_line_args()
+
+ all_playbooks_ok = True
+ for dir_item in os.listdir(args.ansible_dir):
+ if dir_item.endswith(".yml"):
+ playbook_path = os.path.join(args.ansible_dir, dir_item)
+
+ if not check_playbook_file_removed_and_added(playbook_path):
+ all_playbooks_ok = False
+
+ if not all_playbooks_ok:
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
From e6d727762ba446cad94f1e002fa7a7fef0f1a4cb Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:48:14 +0200
Subject: [PATCH 2/3] Unit tests the function for file removed and added
Add a unit test for the core function that checks if any playbook
removes a file and then reintroduces it back.
---
tests/CMakeLists.txt | 6 ++
.../file_block_removed_and_added.yml | 69 +++++++++++++++++++
.../file_not_removed_and_added.yml | 49 +++++++++++++
.../file_removed_and_added.yml | 62 +++++++++++++++++
.../file_removed_and_not_added.yml | 46 +++++++++++++
...t_check_playbook_file_removed_and_added.py | 39 +++++++++++
6 files changed, 271 insertions(+)
create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
create mode 100644 tests/test_check_playbook_file_removed_and_added.py
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 739cc124035..000a1b1385d 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -123,6 +123,12 @@ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
if (PY_YAMLPATH)
+ if (PY_PYTEST)
+ add_test(
+ NAME "test-function-check_playbook_file_removed_and_added"
+ COMMAND "${PYTHON_EXECUTABLE}" -m pytest ${PYTEST_COVERAGE_OPTIONS} "${CMAKE_CURRENT_SOURCE_DIR}/test_check_playbook_file_removed_and_added.py"
+ )
+ endif()
add_test(
NAME "ansible-file-removed-and-added"
COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
new file mode 100644
index 00000000000..8863b333129
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
@@ -0,0 +1,69 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - block:
+
+ - name: Remove Rsh Trust Files
+ file:
+ path: /root/shosts.equiv
+ state: absent
+
+ - name: Add line to /root/shosts.equiv
+ lineinfile:
+ dest: /root/shosts.equiv
+ line: 'test host'
+ create: true
+ tags:
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+ - no_rsh_trust_files
+ - restrict_strategy
+
diff --git a/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
new file mode 100644
index 00000000000..3d3e53b958f
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
@@ -0,0 +1,49 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
new file mode 100644
index 00000000000..a44c39a9db2
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
@@ -0,0 +1,62 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - remove incorrect banner
+ file:
+ state: absent
+ path: /etc/issue
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
new file mode 100644
index 00000000000..08cda7e5063
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
@@ -0,0 +1,46 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - remove incorrect banner
+ file:
+ state: absent
+ path: /etc/issue
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/test_check_playbook_file_removed_and_added.py b/tests/test_check_playbook_file_removed_and_added.py
new file mode 100644
index 00000000000..181bb14ed46
--- /dev/null
+++ b/tests/test_check_playbook_file_removed_and_added.py
@@ -0,0 +1,39 @@
+import os
+import pytest
+
+from .test_ansible_file_removed_and_added import check_playbook_file_removed_and_added
+
+
+def test_file_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_removed_and_added.yml")
+ assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_removed_and_not_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_removed_and_not_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_not_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_not_removed_and_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_block_removed_and_added.yml")
+ assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_not_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_block_removed_and_not_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
From 741ec823ac39341f8aa0649031b72d2ac36e8a64 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 12 Aug 2021 10:36:47 +0200
Subject: [PATCH 3/3] Mention Ansible static yamlpath test in docs
---
.../developer/02_building_complianceascode.md | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/docs/manual/developer/02_building_complianceascode.md b/docs/manual/developer/02_building_complianceascode.md
index d536df0a259..87469bf5f9b 100644
--- a/docs/manual/developer/02_building_complianceascode.md
+++ b/docs/manual/developer/02_building_complianceascode.md
@@ -64,6 +64,20 @@ yum install yamllint ansible-lint
apt-get install yamllint ansible-lint
```
+### Static Ansible Playbooks tests
+
+Install `yamlpath` and `pytest` to run tests cases that analyse the Ansible
+Playbooks' yaml nodes.
+```bash
+pip3 install yamlpath
+
+# Fedora/RHEL
+yum install python3-pytest
+
+# Ubuntu/Debian
+apt-get install python-pytest
+```
+
### Ninja (Faster Builds)
Install the `ninja` build system if you want to use it instead of
Reference in New Issue Copy Permalink