diff --git a/scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch b/scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch new file mode 100644 index 0000000..eb63127 --- /dev/null +++ b/scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch @@ -0,0 +1,106 @@ +From a8cea205d5f9f975ca03ef39e79d18698236cfe2 Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Mon, 13 Feb 2023 17:49:14 +0100 +Subject: [PATCH 3/5] Change custom zones check in firewalld_sshd_port_enabled + +Patch-name: scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch +Patch-status: Change custom zones check in firewalld_sshd_port_enabled +--- + .../oval/shared.xml | 68 +++++++++++++++---- + 1 file changed, 54 insertions(+), 14 deletions(-) + +diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml +index 4adef2e53f..d7c96665b4 100644 +--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml ++++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml +@@ -133,9 +133,10 @@ + OVAL resources in order to detect and assess only active zone, which are zones with at + least one NIC assigned to it. Since it was possible to easily have the list of active + zones, it was cumbersome to use that list in other OVAL objects without introduce a high +- level of complexity to make sure environments with multiple NICs and multiple zones are +- in use. So, in favor of simplicity and readbility it was decided to work with a static +- list. It means that, in the future, it is possible this list needs to be updated. --> ++ level of complexity to ensure proper assessment in environments where multiple NICs and ++ multiple zones are in use. So, in favor of simplicity and readbility it was decided to ++ work with a static list. It means that, in the future, it is possible this list needs to ++ be updated. --> + +@@ -145,23 +146,62 @@ + +- ++ +- +- +- ++ ++ ++ ++ ++ ++ var_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count ++ ++ ++ ++ ++ ++ ++ + + +- /etc/firewalld/zones +- ^.*\.xml$ +- /zone/service[@name='ssh'] ++ /etc/firewalld/zones ++ ^.*\.xml$ ++ /zone/service[@name='ssh'] + + +- +- /zone/service[@name='ssh'] +- ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ /etc/firewalld/zones ++ ^.*\.xml$ ++ + + + +- +- /etc/rsyslog.conf +- ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ +- 1 +- state_permissions_ignore_hidden_paths +- +- +- +- +- ^.*\/\..*$ +- +- +- +- +- +- +- +- +- +- +- +- +- +- var_rfp_include_config_regex +- +- +- +- ^/etc/rsyslog.conf$ +- +- +- +- var_rfp_syslog_config +- +- +- +- +- +- object_var_rfp_include_config_regex +- object_var_rfp_syslog_config +- +- +- +- +- +- +- +- +- +- +- +- +- ^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ +- 1 +- state_permissions_ignore_include_paths +- +- +- +- +- (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- regular +- false +- {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} +- true +- {{% else %}} +- false +- {{% endif %}} +- false +- false +- false +- false +- false +- +- +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml +index 508ff73cde..042c35362d 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml +@@ -1,18 +1,24 @@ ++{{%- if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}} ++ {{%- set rsyslog_perm='640' %}} ++{{%- else %}} ++ {{%- set rsyslog_perm='600' %}} ++{{%- endif %}} ++ + documentation_complete: true + + title: 'Ensure System Log Files Have Correct Permissions' + + description: |- + The file permissions for all log files written by rsyslog should +- be set to 600, or more restrictive. These log files are determined by the ++ be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the + second part of each Rule line in /etc/rsyslog.conf and typically + all appear in /var/log. For each log file LOGFILE + referenced in /etc/rsyslog.conf, run the following command to + inspect the file's permissions: + 
$ ls -l LOGFILE
+- If the permissions are not 600 or more restrictive, run the following ++ If the permissions are not {{{ rsyslog_perm }}} or more restrictive, run the following + command to correct this: +- 
$ sudo chmod 0600 LOGFILE
" ++ 
$ sudo chmod {{{ rsyslog_perm }}} LOGFILE
" + + rationale: |- + Log files can contain valuable information regarding system +@@ -46,9 +52,23 @@ ocil_clause: 'the permissions are not correct' + + ocil: |- + The file permissions for all log files written by rsyslog should +- be set to 600, or more restrictive. These log files are determined by the ++ be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the + second part of each Rule line in /etc/rsyslog.conf and typically + all appear in /var/log. To see the permissions of a given log + file, run the following command: + 
$ ls -l LOGFILE
+- The permissions should be 600, or more restrictive. ++ The permissions should be {{{ rsyslog_perm }}}, or more restrictive. ++ ++template: ++ name: rsyslog_logfiles_attributes_modify ++ vars: ++ attribute: permissions ++ value: '0600' ++ value@debian10: '0640' ++ value@debian11: '0640' ++ value@sle12: '0640' ++ value@sle15: '0640' ++ value@ubuntu1604: '0640' ++ value@ubuntu1804: '0640' ++ value@ubuntu2004: '0640' ++ value@ubuntu2204: '0640' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh +deleted file mode 100755 +index c27e7874d9..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh ++++ /dev/null +@@ -1,40 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0600 from $IncludeConfig passes. +-# test $IncludeConfig with wildcard (*.conf) +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh +deleted file mode 100755 +index 124b5e863e..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh ++++ /dev/null +@@ -1,41 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0601 from $IncludeConfig fails. +-# test $IncludeConfig with wildcard (*.conf) +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh +deleted file mode 100755 +index a6ff6a1109..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh ++++ /dev/null +@@ -1,39 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0600 from $IncludeConfig passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${test_conf} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh +deleted file mode 100755 +index 2ae5c89a4e..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh ++++ /dev/null +@@ -1,40 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0601 from $IncludeConfig fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${test_conf} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh +deleted file mode 100755 +index a5a2f67fad..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh ++++ /dev/null +@@ -1,85 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0600 from $IncludeConfig passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 5 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[2]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[3]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[4]} +- +-# create test configuration files +-conf_subdir=${RSYSLOG_TEST_DIR}/subdir +-conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir +-mkdir ${conf_subdir} +-mkdir ${conf_hiddir} +- +-test_conf_in_subdir=${conf_subdir}/in_subdir.conf +-test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak +- +-test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf +-test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf +- +-cat << EOF > ${test_conf_in_subdir} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-cat << EOF > ${test_conf_name_bak} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-cat << EOF > ${test_conf_in_hiddir} +-# rsyslog configuration file +-# not used +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[3]} +-EOF +- +-cat << EOF > ${test_conf_dot_name} +-# rsyslog configuration file +-# not used +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[4]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional") +-include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional") +-include(file="${RSYSLOG_TEST_DIR}" mode="optional") +- +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf +-\$IncludeConfig ${RSYSLOG_TEST_DIR} +- +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh +deleted file mode 100755 +index fe4db0a3c9..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh ++++ /dev/null +@@ -1,86 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0601 from $IncludeConfig fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 5 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[3]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[4]} +- +-# create test configuration files +-conf_subdir=${RSYSLOG_TEST_DIR}/subdir +-conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir +-mkdir ${conf_subdir} +-mkdir ${conf_hiddir} +- +-test_conf_in_subdir=${conf_subdir}/in_subdir.conf +-test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak +- +-test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf +-test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf +- +-cat << EOF > ${test_conf_in_subdir} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-cat << EOF > ${test_conf_name_bak} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-cat << EOF > ${test_conf_in_hiddir} +-# rsyslog configuration file +-# not used +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[3]} +-EOF +- +-cat << EOF > ${test_conf_dot_name} +-# rsyslog configuration file +-# not used +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[4]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional") +-include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional") +-include(file="${RSYSLOG_TEST_DIR}" mode="optional") +- +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf +-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf +-\$IncludeConfig ${RSYSLOG_TEST_DIR} +- +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh +deleted file mode 100755 +index eabcb21956..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh ++++ /dev/null +@@ -1,41 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0600 from multiline include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include( +- file="${test_conf}" +-) +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh +deleted file mode 100755 +index 32cd4c334a..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh ++++ /dev/null +@@ -1,39 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0600 from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh +deleted file mode 100755 +index 357d4f9718..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh ++++ /dev/null +@@ -1,52 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +- +-# Check rsyslog.conf with log file permisssions 0600 from rules and +-# log file permissions 0600 from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh +deleted file mode 100755 +index 7bdb830c00..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh ++++ /dev/null +@@ -1,53 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +- +-# Check rsyslog.conf with log file permisssions 0600 from rules and +-# log file permissions 0601 from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh +deleted file mode 100644 +index 9b0185c6b2..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh ++++ /dev/null +@@ -1,53 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +- +-# Check rsyslog.conf with log file permisssions 0600 from rules and +-# log file permissions 0601 from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create hidden test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/.test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh +deleted file mode 100644 +index b929f2a94a..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh ++++ /dev/null +@@ -1,45 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +- +-# Check rsyslog.conf with log file permisssions 0600 from rules and +-# log file permissions 0601 from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_PASS=0600 +-PERMS_FAIL=0601 +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# Skip creation test2 configuration file +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh +deleted file mode 100644 +index 2eb515a43e..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh ++++ /dev/null +@@ -1,23 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[@]} +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +-:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh +deleted file mode 100755 +index fd3f9e92ec..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh ++++ /dev/null +@@ -1,41 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +- +-# Check rsyslog.conf with log file permissions 0600 from rules and +-# log file permissions 0601 from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS_FAIL=0601 +- +-PERMS_PASS=0600 +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]} +-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh +deleted file mode 100644 +index 7a598626d0..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh ++++ /dev/null +@@ -1,22 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-source $SHARED/rsyslog_log_utils.sh +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files and permissions +-chmod 0600 ${RSYSLOG_TEST_LOGS[0]} +-chmod 0601 ${RSYSLOG_TEST_LOGS[1]} +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +-:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh +new file mode 100755 +index 0000000000..b3846fec47 +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh +@@ -0,0 +1,25 @@ ++#!/bin/bash ++# platform = multi_platform_sle,multi_platform_ubuntu ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++CHATTR="chmod" ++ATTR_VALUE="0640" ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh +new file mode 100755 +index 0000000000..0b4cb5dce0 +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh +@@ -0,0 +1,25 @@ ++#!/bin/bash ++# platform = multi_platform_all ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++CHATTR="chmod" ++ATTR_VALUE="0400" ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh +deleted file mode 100755 +index fbdcd18f77..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh ++++ /dev/null +@@ -1,35 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check if log file with permissions 0600 in rsyslog.conf passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0600 +- +-# setup test data +-create_rsyslog_test_logs 4 +- +-# setup all files with incorrect permission +-chmod 0601 "${RSYSLOG_TEST_LOGS[@]}" +- +-# setup the real logfile with correct permissions +-chmod $PERMS "${RSYSLOG_TEST_LOGS[0]}" +- +-# add rule with 0600 permissions log file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +- *.* ${RSYSLOG_TEST_LOGS[1]} +- +-authpriv.* /nonexistent_file +- +-# *.* /irrelevant_file +- +-\$something /irrelevant_file +- +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh +deleted file mode 100755 +index 75e9558c63..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh ++++ /dev/null +@@ -1,34 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check if log file with permissions 0601 in rsyslog.conf fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-PERMS=0601 +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log file and permissions +-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]} +- +-# add rule with 0601 permissions log file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-cron.* /nonexistent_file +- +- authpriv.* /irrelevant_file +- +-# *.* /irrelevant_file +- +-\$something /irrelevant_file +- +-something.* ${RSYSLOG_TEST_LOGS[2]} +- +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template +index fc9e8844b6..81d6220415 100644 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template +@@ -20,7 +20,7 @@ + - name: '{{{ rule_title }}} - Get include files directives' + ansible.builtin.shell: | + set -o pipefail +- grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\"" -f 2 || true ++ awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' {{ rsyslog_etc_config }} || true + register: rsyslog_new_inc + changed_when: False + +@@ -61,8 +61,9 @@ + - name: '{{{ rule_title }}} -Setup log files attribute' + ansible.builtin.file: + path: "{{ item }}" +- owner: '{{ ( "{{{ ATTRIBUTE }}}" is match("owner")) | ternary({{{ VALUE }}}, omit) }}' +- group: '{{ ( "{{{ ATTRIBUTE }}}" is match("groupowner")) | ternary({{{ VALUE }}} , omit) }}' ++ {{{ 'owner: ' ~ VALUE if ATTRIBUTE == "owner" }}} ++ {{{- 'group: ' ~ VALUE if ATTRIBUTE == "groupowner" }}} ++ {{{- 'mode: ' ~ VALUE if ATTRIBUTE == "permissions" }}} + state: file + loop: "{{ log_files | list | flatten | unique }}" + failed_when: false +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template +index ab4a563dc5..d6755d5692 100644 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template +@@ -48,7 +48,8 @@ do + # * Strip quotes and closing brackets from paths. + # * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files + # * From the remaining valid rows select only fields constituting a log file path +- # Text file column is understood to represent a log file path if and only if all of the following are met: ++ # Text file column is understood to represent a log file path if and only if all of the ++ # following are met: + # * it contains at least one slash '/' character, + # * it is preceded by space + # * it doesn't contain space (' '), colon (':'), and semicolon (';') characters +@@ -60,8 +61,8 @@ do + FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}") + CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}") + MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}") +- # Since above sed command might return more than one item (delimited by newline), split the particular +- # matches entries into new array specific for this log file ++ # Since above sed command might return more than one item (delimited by newline), split ++ # the particular matches entries into new array specific for this log file + readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS" + # Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with + # items from newly created array for this log file +@@ -71,7 +72,8 @@ do + fi + done + +-# Check for RainerScript action log format which might be also multiline so grep regex is a bit curly ++# Check for RainerScript action log format which might be also multiline so grep regex is a bit ++# curly: + # extract possibly multiline action omfile expressions + # extract File="logfile" expression + # match only "logfile" expression +@@ -82,22 +84,10 @@ do + LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")") + done + +-FILE_PARAM="{{{ ATTRIBUTE }}}" +-FILE_CMD="" +-case "$FILE_PARAM" in +- "groupowner") +- FILE_CMD=$(which chgrp) +- ;; +- "owner") +- FILE_CMD=$(which chown) +- ;; +- *) +- echo -n "Not supported file attribute! " +- exit 1 +- ;; +-esac +- +-# Correct the form o ++# Ensure the correct attribute if file exists ++{{{ 'FILE_CMD="chown"' if ATTRIBUTE == "owner" }}} ++{{{- 'FILE_CMD="chgrp"' if ATTRIBUTE == "groupowner" }}} ++{{{- 'FILE_CMD="chmod"' if ATTRIBUTE == "permissions" }}} + for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}" + do + # Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing +@@ -105,6 +95,5 @@ do + then + continue + fi +- +- $FILE_CMD "+{{{ VALUE }}}" "$LOG_FILE_PATH" ++ $FILE_CMD "{{{ VALUE }}}" "$LOG_FILE_PATH" + done +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template +index 4f288df1c9..243d678852 100644 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template +@@ -3,59 +3,57 @@ + {{{ oval_metadata("All syslog log files should have appropriate ownership.") }}} + + {{% if product in ["debian10", "debian11", "ubuntu1604"] %}} +- ++ + {{% endif %}} +- ++ + +- + + +- +- +- ++ ++ + /etc/rsyslog.conf + ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ ++ operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ + 1 + + + + ++ comment="rsyslog's include config values converted to regex."> + + + ++ object_ref="object_{{{ _RULE_ID }}}_include_config_value"/> + + + + +- +- ++ ++ + var_{{{ _RULE_ID }}}_include_config_regex + + +- ++ + ^/etc/rsyslog.conf$ + + +- ++ + var_{{{ _RULE_ID }}}_syslog_config + + +- +- ++ ++ + + object_var_{{{ _RULE_ID }}}_include_config_regex + object_var_{{{ _RULE_ID }}}_syslog_config +@@ -64,74 +62,72 @@ + + +- +- ++ ++ + + +- +- +- +- +- ^\s*[^(\s|#|\$)]+\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$ ++ ++ ++ ++ ++ ^\s*[^(\s|#|\$)]+\s+.*\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$ + 1 +- state_{{{ _RULE_ID }}}_ownership_ignore_include_paths ++ state_{{{ _RULE_ID }}}_ignore_include_paths + + +- +- ++ ++ + (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) + + + ++ retrieved from the different rsyslog configuration files. --> + +- ++ comment="File paths of all rsyslog log files"> ++ + + +- +- +- ++ ++ ++ + + + +- +- ++ ++ + + + + regular + {{% if ATTRIBUTE == "groupowner" %}} + {{{ VALUE }}} +- {{% else %}} ++ {{% elif ATTRIBUTE == "owner" %}} + {{{ VALUE }}} ++ {{% else %}} ++ {{{ STATEMODE | indent(4) }}} + {{% endif %}} + +- + +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/template.py b/shared/templates/rsyslog_logfiles_attributes_modify/template.py +new file mode 100644 +index 0000000000..9ea31c9a6b +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/template.py +@@ -0,0 +1,18 @@ ++def preprocess(data, lang): ++ if lang == "oval" and data["attribute"] == 'permissions': ++ # create STATEMODE used in the OVAL template by processing the octal permission and ++ # creating the equivalent permission fields of "unix:file_state" element. ++ mode = data["value"] ++ fields = [ ++ 'oexec', 'owrite', 'oread', 'gexec', 'gwrite', 'gread', ++ 'uexec', 'uwrite', 'uread', 'sticky', 'sgid', 'suid'] ++ mode_int = int(mode, 8) ++ mode_str = "" ++ for field in fields: ++ if mode_int & 0x01 == 0: ++ mode_str = ( ++ "false\n{mode_str}".format( ++ field=field, mode_str=mode_str)) ++ mode_int = mode_int >> 1 ++ data["statemode"] = mode_str.rstrip("\n") ++ return data +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh +deleted file mode 100755 +index db7e5261eb..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh ++++ /dev/null +@@ -1,50 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# non root user log from $IncludeConfig fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-ADDCOMMAND="useradd" +-CHATTR="chown" +-{{% else %}} +-ADDCOMMAND="groupadd" +-CHATTR="chgrp" +-{{% endif %}} +- +-USER_TEST=testssg +-$ADDCOMMAND $USER_TEST +- +-USER_ROOT=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${test_conf} +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh +deleted file mode 100755 +index d79ae23cfc..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh ++++ /dev/null +@@ -1,50 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# non root user log from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-ADDCOMMAND="useradd" +-CHATTR="chown" +-{{% else %}} +-ADDCOMMAND="groupadd" +-CHATTR="chgrp" +-{{% endif %}} +- +-USER_TEST=testssg +-$ADDCOMMAND $USER_TEST +- +-USER_ROOT=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh +deleted file mode 100644 +index 7869a180a8..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh ++++ /dev/null +@@ -1,75 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# root user log from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-ADDCOMMAND="useradd" +-CHATTR="chown" +-{{% else %}} +-ADDCOMMAND="groupadd" +-CHATTR="chgrp" +-{{% endif %}} +- +-USER_TEST=testssg +-$ADDCOMMAND $USER_TEST +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files ownership +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-{{% if ATTRIBUTE == "owner" %}} +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +- +-*.* action(type="omfile" FileCreateMode="0640" fileOwner="$USER_TEST" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") +-EOF +-{{% else %}} +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +- +-*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="$USER_TEST" File="${RSYSLOG_TEST_LOGS[2]}") +-EOF +-{{% endif %}} +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh +deleted file mode 100755 +index e80395ca99..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh ++++ /dev/null +@@ -1,46 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# root user log from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +- +-{{% if ATTRIBUTE == "owner" %}} +-CHATTR="chown" +-{{% else %}} +-CHATTR="chgrp" +-{{% endif %}} +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh +deleted file mode 100755 +index e7b4905dc5..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh ++++ /dev/null +@@ -1,63 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# non root user log from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-ADDCOMMAND="useradd" +-CHATTR="chown" +-{{% else %}} +-ADDCOMMAND="groupadd" +-CHATTR="chgrp" +-{{% endif %}} +- +-USER_ROOT=root +- +-USER_TEST=testssg +-$ADDCOMMAND $USER_TEST +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files ownership +-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[1]} +-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh +deleted file mode 100755 +index 6389e6ea3b..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh ++++ /dev/null +@@ -1,58 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# root user log from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-CHATTR="chown" +-{{% else %}} +-CHATTR="chgrp" +-{{% endif %}} +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[2]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh +deleted file mode 100755 +index 6b81a77c2f..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh ++++ /dev/null +@@ -1,59 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# root user log from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-CHATTR="chown" +-{{% else %}} +-CHATTR="chgrp" +-{{% endif %}} +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 3 +- +-# setup test log files ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create test2 configuration file +-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf +-cat << EOF > ${test_conf2} +-# rsyslog configuration file +- +-#### RULES #### +- +- +-*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +- +-\$IncludeConfig ${test_conf2} +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh +deleted file mode 100755 +index 78b105abf3..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh ++++ /dev/null +@@ -1,47 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root user log from rules and +-# root user log from multiline include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-CHATTR="chown" +-{{% else %}} +-CHATTR="chgrp" +-{{% endif %}} +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include( +- file="${test_conf}" +-) +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh +deleted file mode 100755 +index afce21fa27..0000000000 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh ++++ /dev/null +@@ -1,30 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check if log file with root user in rsyslog.conf passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-{{% if ATTRIBUTE == "owner" %}} +-CHATTR="chown" +-{{% else %}} +-CHATTR="chgrp" +-{{% endif %}} +- +-USER=root +- +-# setup test data +-create_rsyslog_test_logs 1 +- +-# setup test log file ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +- +-# add rule with root user owned log file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh +similarity index 53% +rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh +index 1afe20823c..dc362ae003 100755 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh +@@ -1,33 +1,31 @@ + #!/bin/bash + # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +-# Check if log file with non root user in rsyslog.conf fails. +- ++# Declare variables used for the tests and define the create_rsyslog_test_logs function + source $SHARED/rsyslog_log_utils.sh + + {{% if ATTRIBUTE == "owner" %}} +-ADDCOMMAND="useradd" + CHATTR="chown" +-{{% else %}} +-ADDCOMMAND="groupadd" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} + CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" + {{% endif %}} + +-USER=testssg +- +-$ADDCOMMAND $USER +- +-# setup test data ++# create one test log file + create_rsyslog_test_logs 1 + +-# setup test log file ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} + +-# add rule with non-root user owned log file ++# add rule with test log file + cat << EOF > $RSYSLOG_CONF + # rsyslog configuration file + + #### RULES #### +- + *.* ${RSYSLOG_TEST_LOGS[0]} ++ + EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh +similarity index 51% +rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh +index b03268fe3e..c742f41039 100755 +--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh +@@ -1,45 +1,45 @@ + #!/bin/bash + # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle + +-# Check rsyslog.conf with root user log from rules and +-# root user log from $IncludeConfig passes. +- ++# Declare variables used for the tests and define the create_rsyslog_test_logs function + source $SHARED/rsyslog_log_utils.sh + + {{% if ATTRIBUTE == "owner" %}} + CHATTR="chown" +-{{% else %}} ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} + CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" + {{% endif %}} + +-USER=root +- +-# setup test data ++# create two test log file + create_rsyslog_test_logs 2 + +-# setup test log files ownership +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} +-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} + +-# create test configuration file ++# create test configuration file with rule for second test log file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf + cat << EOF > ${test_conf} +-# rsyslog configuration file ++# rsyslog test configuration file + + #### RULES #### +- + *.* ${RSYSLOG_TEST_LOGS[1]} ++ + EOF + +-# create rsyslog.conf configuration file ++# add rule with first test log file plus an include statement + cat << EOF > $RSYSLOG_CONF + # rsyslog configuration file + + #### RULES #### +- + *.* ${RSYSLOG_TEST_LOGS[0]} + + #### MODULES #### +- + \$IncludeConfig ${test_conf} ++ + EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh +new file mode 100755 +index 0000000000..a12d0bc653 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh +@@ -0,0 +1,50 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create two test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# create test configuration file with rule for second test log file ++test_conf=${RSYSLOG_TEST_DIR}/test1.conf ++cat << EOF > ${test_conf} ++# rsyslog test configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[1]} ++ ++EOF ++ ++# add rule with first test log file plus an include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++ ++#### MODULES #### ++\$IncludeConfig ${test_conf} ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh +new file mode 100755 +index 0000000000..25430db033 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh +@@ -0,0 +1,33 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create one test log file ++create_rsyslog_test_logs 1 ++ ++# setup test log file property ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} ++ ++# add rule with non-root user owned log file ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh +new file mode 100755 +index 0000000000..c1c5758d80 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh +@@ -0,0 +1,33 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh +new file mode 100755 +index 0000000000..0235130534 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh +@@ -0,0 +1,58 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 3 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]} ++ ++# create first test configuration file with legacy rule for second test log file ++test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf ++cat << EOF > ${test_conf1} ++# rsyslog test configuration file with legacy syntax ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[1]} ++ ++EOF ++ ++# create second test configuration file with RainerScript rule for third test log file ++test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf ++cat << EOF > ${test_conf2} ++# rsyslog test configuration file with RainerScript syntax ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") ++ ++EOF ++ ++# add rule with first test log file plus two mixed include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++ ++#### MODULES #### ++\$IncludeConfig ${test_conf1} ++ ++include(file="${test_conf2}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh +new file mode 100755 +index 0000000000..bed0afaf5e +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh +@@ -0,0 +1,63 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 3 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]} ++ ++# create first test configuration file with legacy rule for second test log file ++test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf ++cat << EOF > ${test_conf1} ++# rsyslog test configuration file with legacy syntax ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[1]} ++ ++EOF ++ ++# create second test configuration file with RainerScript rule for third test log file ++test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf ++cat << EOF > ${test_conf2} ++# rsyslog test configuration file with RainerScript syntax ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") ++ ++EOF ++ ++# add rule with first test log file plus two mixed include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++ ++#### MODULES #### ++\$IncludeConfig ${test_conf1} ++ ++include(file="${test_conf2}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh +new file mode 100755 +index 0000000000..83c69b3a17 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh +@@ -0,0 +1,63 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 3 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[2]} ++ ++# create first test configuration file with legacy rule for second test log file ++test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf ++cat << EOF > ${test_conf1} ++# rsyslog test configuration file with legacy syntax ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[1]} ++ ++EOF ++ ++# create second test configuration file with RainerScript rule for third test log file ++test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf ++cat << EOF > ${test_conf2} ++# rsyslog test configuration file with RainerScript syntax ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}") ++ ++EOF ++ ++# add rule with first test log file plus two mixed include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++ ++#### MODULES #### ++\$IncludeConfig ${test_conf1} ++ ++include(file="${test_conf2}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh +new file mode 100755 +index 0000000000..43a6f2648d +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh +@@ -0,0 +1,38 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]} ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh +new file mode 100755 +index 0000000000..f459e7377b +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh +@@ -0,0 +1,38 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh +new file mode 100755 +index 0000000000..67193b69d8 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh +@@ -0,0 +1,38 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create three test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# add rules with both syntax for different test log files ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* ${RSYSLOG_TEST_LOGS[0]} ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh +new file mode 100755 +index 0000000000..abdb09c485 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh +@@ -0,0 +1,31 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++{{% endif %}} ++ ++# create one test log file ++create_rsyslog_test_logs 1 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++ ++# add rule with test log file ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh +new file mode 100755 +index 0000000000..8b73578e39 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh +@@ -0,0 +1,45 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++{{% endif %}} ++ ++# create two test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# create test configuration file with rule for second test log file ++test_conf=${RSYSLOG_TEST_DIR}/test1.conf ++cat << EOF > ${test_conf} ++# rsyslog test configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF ++ ++# add rule with first test log file plus an include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++#### MODULES #### ++include(file="${test_conf}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh +new file mode 100755 +index 0000000000..4c25c09e2e +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh +@@ -0,0 +1,50 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create two test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# create test configuration file with rule for second test log file ++test_conf=${RSYSLOG_TEST_DIR}/test1.conf ++cat << EOF > ${test_conf} ++# rsyslog test configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF ++ ++# add rule with first test log file plus an include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++#### MODULES #### ++include(file="${test_conf}") ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh +new file mode 100755 +index 0000000000..508a5cf6eb +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh +@@ -0,0 +1,47 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++{{% endif %}} ++ ++# create two test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# create test configuration file with rule for second test log file ++test_conf=${RSYSLOG_TEST_DIR}/test1.conf ++cat << EOF > ${test_conf} ++# rsyslog test configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF ++ ++# add rule with first test log file plus an include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++#### MODULES #### ++include( ++ file="${test_conf}" ++) ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh +new file mode 100755 +index 0000000000..49fada4cd4 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh +@@ -0,0 +1,52 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_VALUE="root" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_VALUE="0600" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create two test log file ++create_rsyslog_test_logs 2 ++ ++# setup test log file property ++$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]} ++ ++# create test configuration file with rule for second test log file ++test_conf=${RSYSLOG_TEST_DIR}/test1.conf ++cat << EOF > ${test_conf} ++# rsyslog test configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}") ++ ++EOF ++ ++# add rule with first test log file plus an include statement ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++#### MODULES #### ++include( ++ file="${test_conf}" ++) ++ ++EOF +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh +new file mode 100755 +index 0000000000..b17eb6b744 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh +@@ -0,0 +1,33 @@ ++#!/bin/bash ++# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++ ++# Declare variables used for the tests and define the create_rsyslog_test_logs function ++source $SHARED/rsyslog_log_utils.sh ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++ATTR_INCORRECT_VALUE="cac_testuser" ++useradd $ATTR_INCORRECT_VALUE ++{{% elif ATTRIBUTE == "groupowner" %}} ++CHATTR="chgrp" ++ATTR_INCORRECT_VALUE="cac_testgroup" ++groupadd $ATTR_INCORRECT_VALUE ++{{% else %}} ++CHATTR="chmod" ++ATTR_INCORRECT_VALUE="0666" ++{{% endif %}} ++ ++# create one test log file ++create_rsyslog_test_logs 1 ++ ++# setup test log file property ++$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]} ++ ++# add rule with non-root user owned log file ++cat << EOF > $RSYSLOG_CONF ++# rsyslog configuration file ++ ++#### RULES #### ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}") ++ ++EOF +-- +2.39.1 + diff --git a/scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch b/scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch new file mode 100644 index 0000000..80bcc2f --- /dev/null +++ b/scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch @@ -0,0 +1,1950 @@ +From b8d2b568eb07b10f8a51f1327e399303bc06528d Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Mon, 13 Feb 2023 17:49:12 +0100 +Subject: [PATCH 1/5] Rsyslog files rules remediations + +Patch-name: scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch +Patch-status: Rsyslog files rules remediations +--- + controls/cis_sle12.yml | 4 +- + controls/cis_sle15.yml | 4 +- + .../file_groupowner_logfiles_value.var | 18 --- + .../oval/shared.xml | 116 --------------- + .../rsyslog_files_groupownership/rule.yml | 39 ++++- + .../tests/IncludeConfig_is_other.fail.sh | 42 ------ + .../tests/IncludeConfig_is_root.pass.sh | 39 ----- + .../tests/include_is_other.fail.sh | 42 ------ + .../tests/include_is_root.pass.sh | 39 ----- + .../tests/include_multiline_is_root.pass.sh | 41 ------ + .../tests/is_other.fail.sh | 25 ---- + .../tests/is_root.pass.sh | 24 --- + .../rsyslog_files_ownership/oval/shared.xml | 114 --------------- + .../rsyslog_files_ownership/rule.yml | 44 +++++- + .../ansible/shared.yml | 12 ++ + .../rsyslog_logging_configured/bash/shared.sh | 7 + + .../oval/shared.xml | 41 ++++++ + .../rsyslog_logging_configured/rule.yml | 34 +++++ + ...with_everything_logged_to_messages.pass.sh | 13 ++ + .../rsyslog_file_with_no_logging.fail.sh | 12 ++ + .../profiles/anssi_np_nt28_average.profile | 2 - + products/debian10/profiles/standard.profile | 2 - + .../profiles/anssi_np_nt28_average.profile | 2 - + products/debian11/profiles/standard.profile | 2 - + products/rhel7/profiles/rht-ccp.profile | 2 - + products/rhel8/profiles/rht-ccp.profile | 2 - + .../profiles/anssi_bp28_intermediary.profile | 1 + + products/sle15/profiles/standard.profile | 2 - + .../profiles/anssi_np_nt28_average.profile | 2 - + products/ubuntu1604/profiles/standard.profile | 2 - + .../profiles/anssi_np_nt28_average.profile | 2 - + products/ubuntu1804/profiles/standard.profile | 2 - + products/ubuntu2004/profiles/standard.profile | 2 - + products/ubuntu2204/profiles/standard.profile | 2 - + shared/references/cce-sle12-avail.txt | 1 - + shared/references/cce-sle15-avail.txt | 1 - + .../ansible.template | 68 +++++++++ + .../bash.template | 110 ++++++++++++++ + .../oval.template | 137 ++++++++++++++++++ + .../template.yml | 4 + + .../tests/IncludeConfig_is_other.fail.sh | 14 +- + .../tests/IncludeConfig_is_root.pass.sh | 10 +- + .../tests/include_is_other.fail.sh | 14 +- + ...udeConfig_is_other_RainerLogClause.fail.sh | 37 ++++- + .../tests/include_is_root.pass.sh | 11 +- + ...ude_is_root_IncludeConfig_is_other.fail.sh | 16 +- + ...lude_is_root_IncludeConfig_is_root.pass.sh | 12 +- + ...ludeConfig_is_root_RainerLogClause.pass.sh | 22 +-- + .../tests/include_multiline_is_root.pass.sh | 10 +- + .../tests/is_other.fail.sh | 12 +- + .../tests/is_root.pass.sh | 8 +- + 51 files changed, 648 insertions(+), 576 deletions(-) + delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var + delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh + delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh + delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_everything_logged_to_messages.pass.sh + create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_no_logging.fail.sh + create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/ansible.template + create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/bash.template + create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/oval.template + create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/template.yml + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/IncludeConfig_is_other.fail.sh (75%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/IncludeConfig_is_root.pass.sh (81%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_other.fail.sh (75%) + rename linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_root.pass.sh => shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh (50%) + mode change 100755 => 100644 + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root.pass.sh (81%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root_IncludeConfig_is_other.fail.sh (77%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_is_root_IncludeConfig_is_root.pass.sh (82%) + rename linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_other.fail.sh => shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh (65%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/include_multiline_is_root.pass.sh (81%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/is_other.fail.sh (70%) + rename {linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership => shared/templates/rsyslog_logfiles_attributes_modify}/tests/is_root.pass.sh (77%) + +diff --git a/controls/cis_sle12.yml b/controls/cis_sle12.yml +index 5c464fe556..8576343b9d 100644 +--- a/controls/cis_sle12.yml ++++ b/controls/cis_sle12.yml +@@ -1321,7 +1321,9 @@ controls: + levels: + - l1_server + - l1_workstation +- status: manual ++ automated: yes ++ rules: ++ - rsyslog_logging_configured + + - id: 4.2.1.5 + title: Ensure rsyslog is configured to send logs to a remote log host (Automated) +diff --git a/controls/cis_sle15.yml b/controls/cis_sle15.yml +index 36d7616f90..f82341a038 100644 +--- a/controls/cis_sle15.yml ++++ b/controls/cis_sle15.yml +@@ -1469,7 +1469,9 @@ controls: + levels: + - l1_server + - l1_workstation +- status: manual ++ automated: yes ++ rules: ++ - rsyslog_logging_configured + + - id: 4.2.1.5 + title: Ensure rsyslog is configured to send logs to a remote log host (Automated) +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var +deleted file mode 100644 +index 7ebf8c191a..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/file_groupowner_logfiles_value.var ++++ /dev/null +@@ -1,18 +0,0 @@ +-documentation_complete: true +- +-title: 'group who owns log files' +- +-description: |- +- Specify group owner of all logfiles specified in +- /etc/rsyslog.conf. +- +-type: string +- +-operator: equals +- +-interactive: false +- +-options: +- default: root +- adm: adm +- root: root +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml +deleted file mode 100644 +index 4567f4d411..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml ++++ /dev/null +@@ -1,116 +0,0 @@ +- +- +- {{{ oval_metadata("All syslog log files should be owned by the appropriate group.") }}} +- +- +- {{% if product in ["debian10", "debian11", "ubuntu1604"] %}} +- +- {{% endif %}} +- +- +- +- +- +- +- +- /etc/rsyslog.conf +- ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ +- 1 +- +- +- +- +- +- +- +- +- +- +- +- +- +- var_rfg_include_config_regex +- +- +- +- ^/etc/rsyslog.conf$ +- +- +- +- var_rfg_syslog_config +- +- +- +- +- +- object_var_rfg_include_config_regex +- object_var_rfg_syslog_config +- +- +- +- +- +- +- +- +- +- +- +- +- ^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ +- 1 +- state_groupownership_ignore_include_paths +- +- +- +- +- (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- regular +- {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu2004", "ubuntu2204"] %}} +- 4 +- {{% else %}} +- 0 +- {{% endif %}} +- +- +- +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml +index 4f797f4a21..13c89d90c5 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml +@@ -4,15 +4,30 @@ title: 'Ensure Log Files Are Owned By Appropriate Group' + + description: |- + The group-owner of all log files written by +- rsyslog should be {{{ xccdf_value("file_groupowner_logfiles_value") }}}. ++ rsyslog should be ++{{% if 'debian' in product or 'ubuntu' in product %}} ++ adm. ++{{% else %}} ++ root. ++{{% endif %}} + These log files are determined by the second part of each Rule line in + /etc/rsyslog.conf and typically all appear in /var/log. + For each log file LOGFILE referenced in /etc/rsyslog.conf, + run the following command to inspect the file's group owner: + 
$ ls -l LOGFILE
+- If the owner is not {{{ xccdf_value("file_groupowner_logfiles_value") }}}, run the following command to ++ If the owner is not ++ {{% if 'debian' in product or 'ubuntu' in product %}} ++ adm, ++ {{% else %}} ++ root, ++ {{% endif %}} ++ run the following command to + correct this: +- 
$ sudo chgrp {{{ xccdf_value("file_groupowner_logfiles_value") }}} LOGFILE
++{{% if 'debian' in product or 'ubuntu' in product %}} ++ 
$ sudo chgrp adm LOGFILE
++{{% else %}} ++ 
$ sudo chgrp root LOGFILE
++{{% endif %}} + + rationale: |- + The log files generated by rsyslog contain valuable information regarding system +@@ -47,8 +62,24 @@ references: + ocil_clause: 'the group-owner is not correct' + + ocil: |- +- The group-owner of all log files written by rsyslog should be {{{ xccdf_value("file_groupowner_logfiles_value") }}}. ++ The group-owner of all log files written by rsyslog should be ++ {{% if 'debian' in product or 'ubuntu' in product %}} ++ adm. ++ {{% else %}} ++ root. ++ {{% endif %}} + These log files are determined by the second part of each Rule line in + /etc/rsyslog.conf and typically all appear in /var/log. + To see the group-owner of a given log file, run the following command: + 
$ ls -l LOGFILE
++ ++template: ++ name: rsyslog_logfiles_attributes_modify ++ vars: ++ attribute: groupowner ++ value: 0 ++ value@debian10: 4 ++ value@debian11: 4 ++ value@ubuntu1604: 4 ++ value@ubuntu2004: 4 ++ value@ubuntu2204: 4 +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh +deleted file mode 100755 +index 575530ef2e..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh ++++ /dev/null +@@ -1,42 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with root group-owner log from rules and +-# non root group-owner log from $IncludeConfig fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP_TEST=testssg +-groupadd $GROUP_TEST +- +-GROUP_ROOT=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP_TEST ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${test_conf} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh +deleted file mode 100755 +index 39efc1a4b7..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_root.pass.sh ++++ /dev/null +@@ -1,39 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check rsyslog.conf with root group-owner log from rules and +-# root group-owner log from $IncludeConfig passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-\$IncludeConfig ${test_conf} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh +deleted file mode 100755 +index c0db7056b4..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_other.fail.sh ++++ /dev/null +@@ -1,42 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root group-owner log from rules and +-# non root group-owner log from include() fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP_TEST=testssg +-groupadd $GROUP_TEST +- +-GROUP_ROOT=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP_TEST ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh +deleted file mode 100755 +index 1feaf762fc..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root.pass.sh ++++ /dev/null +@@ -1,39 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root group-owner log from rules and +-# root group-owner log from include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include(file="${test_conf}") +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh +deleted file mode 100755 +index 5a357d029b..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_multiline_is_root.pass.sh ++++ /dev/null +@@ -1,41 +0,0 @@ +-#!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle +- +-# Check rsyslog.conf with root group-owner log from rules and +-# root group-owner log from multiline include() passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP=root +- +-# setup test data +-create_rsyslog_test_logs 2 +- +-# setup test log files ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]} +- +-# create test configuration file +-test_conf=${RSYSLOG_TEST_DIR}/test1.conf +-cat << EOF > ${test_conf} +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[1]} +-EOF +- +-# create rsyslog.conf configuration file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-#### MODULES #### +- +-include( +- file="${test_conf}" +-) +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh +deleted file mode 100755 +index c7c01132f2..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_other.fail.sh ++++ /dev/null +@@ -1,25 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check if log file with non root group-owner in rsyslog.conf fails. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP=testssg +- +-groupadd $GROUP +- +-# setup test data +-create_rsyslog_test_logs 1 +- +-# setup test log file ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +- +-# add rule with non-root group owned log file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh +deleted file mode 100755 +index 0ecbb35bd1..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/is_root.pass.sh ++++ /dev/null +@@ -1,24 +0,0 @@ +-#!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle +- +-# Check if log file with root group-owner in rsyslog.conf passes. +- +-source $SHARED/rsyslog_log_utils.sh +- +-GROUP=root +- +-# setup test data +-create_rsyslog_test_logs 1 +- +-# setup test log file ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +- +-# add rule with root group owned log file +-cat << EOF > $RSYSLOG_CONF +-# rsyslog configuration file +- +-#### RULES #### +- +-*.* ${RSYSLOG_TEST_LOGS[0]} +- +-EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml +deleted file mode 100644 +index 8e3f68db26..0000000000 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/oval/shared.xml ++++ /dev/null +@@ -1,114 +0,0 @@ +- +- +- {{{ oval_metadata("All syslog log files should be owned by the appropriate user.") }}} +- +- +- +- +- +- +- +- +- +- /etc/rsyslog.conf +- ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ +- 1 +- +- +- +- +- +- +- +- +- +- +- +- +- +- var_rfo_include_config_regex +- +- +- +- ^/etc/rsyslog.conf$ +- +- +- +- var_rfo_syslog_config +- +- +- +- +- +- object_var_rfo_include_config_regex +- object_var_rfo_syslog_config +- +- +- +- +- +- +- +- +- +- +- +- +- ^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ +- 1 +- state_owner_ignore_include_paths +- +- +- +- +- (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- regular +- +- {{% if product in ["ubuntu2004", "ubuntu2204"] %}} +- 104 +- {{% else %}} +- 0 +- {{% endif %}} +- +- +- +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/rule.yml +index 37c87b07cd..0d9bf40f4b 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/rule.yml +@@ -4,15 +4,36 @@ title: 'Ensure Log Files Are Owned By Appropriate User' + + description: |- + The owner of all log files written by +- rsyslog should be {{{ xccdf_value("file_owner_logfiles_value") }}}. ++ rsyslog should be ++ {{% if product in ['ubuntu2204','ubuntu2004'] %}} ++ syslog. ++ {{% elif 'debian' in product or 'ubuntu' in product %}} ++ adm. ++ {{% else %}} ++ root. ++ {{% endif %}} + These log files are determined by the second part of each Rule line in + /etc/rsyslog.conf and typically all appear in /var/log. + For each log file LOGFILE referenced in /etc/rsyslog.conf, + run the following command to inspect the file's owner: + 
$ ls -l LOGFILE
+- If the owner is not {{{ xccdf_value("file_owner_logfiles_value") }}}, run the following command to ++ If the owner is not ++ {{% if product in ['ubuntu2204','ubuntu2004'] %}} ++ syslog, ++ {{% elif 'debian' in product or 'ubuntu' in product %}} ++ adm, ++ {{% else %}} ++ root, ++ {{% endif %}} ++ run the following command to + correct this: +- 
$ sudo chown {{{ xccdf_value("file_owner_logfiles_value") }}} LOGFILE
++ {{% if product in ['ubuntu2204','ubuntu2004'] %}} ++ 
$ sudo chown syslog LOGFILE
++ {{% elif 'debian' in product or 'ubuntu' in product %}} ++ 
$ sudo chown adm LOGFILE
++ {{% else %}} ++ 
$ sudo chown root LOGFILE
++ {{% endif %}} + + rationale: |- + The log files generated by rsyslog contain valuable information regarding system +@@ -47,8 +68,23 @@ references: + ocil_clause: 'the owner is not correct' + + ocil: |- +- The owner of all log files written by rsyslog should be {{{ xccdf_value("file_owner_logfiles_value") }}}. ++ The owner of all log files written by rsyslog should be ++ {{% if product in ['ubuntu2204','ubuntu2004'] %}} ++ syslog. ++ {{% elif 'debian' in product or 'ubuntu' in product %}} ++ adm. ++ {{% else %}} ++ root. ++ {{% endif %}} + These log files are determined by the second part of each Rule line in + /etc/rsyslog.conf and typically all appear in /var/log. + To see the owner of a given log file, run the following command: + 
$ ls -l LOGFILE
++ ++template: ++ name: rsyslog_logfiles_attributes_modify ++ vars: ++ attribute: owner ++ value: 0 ++ value@ubuntu2004: 104 ++ value@ubuntu2204: 104 +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml +new file mode 100644 +index 0000000000..041e263155 +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml +@@ -0,0 +1,12 @@ ++# platform = multi_platform_sle ++# reboot = false ++# strategy = restrict ++# complexity = low ++# disruption = low ++ ++- name: "Set rsyslog remote loghost" ++ lineinfile: ++ dest: /etc/rsyslog.conf ++ regexp: "^\\*\\.\\*" ++ line: "*.* /var/log/messages" ++ create: yes +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh +new file mode 100644 +index 0000000000..d634610225 +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh +@@ -0,0 +1,7 @@ ++# platform = multi_platform_sle ++# reboot = false ++# strategy = restrict ++# complexity = low ++# disruption = low ++ ++{{{ bash_replace_or_append('/etc/rsyslog.conf', '^\*\.\*', "/var/log/messages", '%s %s') }}} +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml +new file mode 100644 +index 0000000000..89e1e7616e +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml +@@ -0,0 +1,41 @@ ++ ++ ++ {{{ oval_metadata("Syslog logs should be configured") }}} ++ ++ ++ {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804"] %}} ++ ++ {{% endif %}} ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ /etc/rsyslog.conf ++ ^[^(\s|#|\$)]+[\s]+.*[\s]+(\:\w+\:\S*|-?(\/+[^:;\s]+);*\.*)$ ++ 1 ++ ++ ++ ++ /etc/rsyslog.d ++ ^.+\.conf$ ++ ^[^(\s|#|\$)]+[\s]+.*[\s]+(\:\w+\:\S*|-?(\/+[^:;\s]+);*\.*)$ ++ 1 ++ ++ ++ +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml +new file mode 100644 +index 0000000000..f9477de9e9 +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml +@@ -0,0 +1,34 @@ ++documentation_complete: true ++ ++title: 'Ensure logging is configured' ++ ++description: |- ++ The /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files ++ specifies rules for logging and which files are to be used to log certain ++ classes of messages. ++ ++rationale: |- ++ A great deal of important security-related information is sent via ++ rsyslog (e.g., successful and failed su attempts, failed login attempts, ++ root login attempts, etc.). ++ ++severity: medium ++ ++identifiers: ++ cce@sle12: CCE-92379-7 ++ cce@sle15: CCE-92497-7 ++ ++references: ++ cis@sle12: 4.2.1.4 ++ cis@sle15: 4.2.1.4 ++ ++ocil_clause: 'no logging is configured' ++ ++ocil: |- ++ Review the contents of the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf ++ files to ensure appropriate logging is set. In addition, run the following command: ++ 
ls -l /var/log/
++ and verify that the log files are logging information ++ ++fixtext: |- ++ Configure logging with selectors covering each priority +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_everything_logged_to_messages.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_everything_logged_to_messages.pass.sh +new file mode 100644 +index 0000000000..a4fb1cf07a +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_everything_logged_to_messages.pass.sh +@@ -0,0 +1,13 @@ ++#!/bin/bash ++# platform = multi_platform_sle ++ ++# Check rsyslog.conf with no includes and all loggging facility/priority configured to go to /var/log/messages ++ ++source $SHARED/rsyslog_log_utils.sh ++cat << EOF > ${RSYSLOG_CONF} ++# rsyslog configuration file ++ ++#### RULES #### ++ ++*.* /var/log/messages ++EOF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_no_logging.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_no_logging.fail.sh +new file mode 100644 +index 0000000000..158cf4c98d +--- /dev/null ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/tests/rsyslog_file_with_no_logging.fail.sh +@@ -0,0 +1,12 @@ ++#!/bin/bash ++# platform = multi_platform_sle ++ ++# Check rsyslog.conf with no includes and no loggging facility/priority configured ++ ++source $SHARED/rsyslog_log_utils.sh ++cat << EOF > ${RSYSLOG_CONF} ++# rsyslog configuration file ++ ++#### RULES #### ++ ++EOF +diff --git a/products/debian10/profiles/anssi_np_nt28_average.profile b/products/debian10/profiles/anssi_np_nt28_average.profile +index 600f1a6f71..4c42814719 100644 +--- a/products/debian10/profiles/anssi_np_nt28_average.profile ++++ b/products/debian10/profiles/anssi_np_nt28_average.profile +@@ -22,9 +22,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/debian10/profiles/standard.profile b/products/debian10/profiles/standard.profile +index 3784182fa1..446f5aca1d 100644 +--- a/products/debian10/profiles/standard.profile ++++ b/products/debian10/profiles/standard.profile +@@ -33,9 +33,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/debian11/profiles/anssi_np_nt28_average.profile b/products/debian11/profiles/anssi_np_nt28_average.profile +index 600f1a6f71..4c42814719 100644 +--- a/products/debian11/profiles/anssi_np_nt28_average.profile ++++ b/products/debian11/profiles/anssi_np_nt28_average.profile +@@ -22,9 +22,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/debian11/profiles/standard.profile b/products/debian11/profiles/standard.profile +index e1b2c718df..c21f8d592b 100644 +--- a/products/debian11/profiles/standard.profile ++++ b/products/debian11/profiles/standard.profile +@@ -33,9 +33,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/rhel7/profiles/rht-ccp.profile b/products/rhel7/profiles/rht-ccp.profile +index 12a3a25013..a246d5a094 100644 +--- a/products/rhel7/profiles/rht-ccp.profile ++++ b/products/rhel7/profiles/rht-ccp.profile +@@ -11,8 +11,6 @@ description: |- + selections: + - var_selinux_state=enforcing + - var_selinux_policy_name=targeted +- - file_owner_logfiles_value=root +- - file_groupowner_logfiles_value=root + - sshd_idle_timeout_value=5_minutes + - var_accounts_minimum_age_login_defs=7 + - var_accounts_passwords_pam_faillock_deny=5 +diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile +index b192461f95..6856951bff 100644 +--- a/products/rhel8/profiles/rht-ccp.profile ++++ b/products/rhel8/profiles/rht-ccp.profile +@@ -11,8 +11,6 @@ description: |- + selections: + - var_selinux_state=enforcing + - var_selinux_policy_name=targeted +- - file_owner_logfiles_value=root +- - file_groupowner_logfiles_value=root + - sshd_idle_timeout_value=5_minutes + - var_logind_session_timeout=5_minutes + - var_accounts_minimum_age_login_defs=7 +diff --git a/products/sle12/profiles/anssi_bp28_intermediary.profile b/products/sle12/profiles/anssi_bp28_intermediary.profile +index 24a98fd824..22498b6b6f 100644 +--- a/products/sle12/profiles/anssi_bp28_intermediary.profile ++++ b/products/sle12/profiles/anssi_bp28_intermediary.profile +@@ -23,3 +23,4 @@ description: |- + + selections: + - anssi:all:intermediary ++ +diff --git a/products/sle15/profiles/standard.profile b/products/sle15/profiles/standard.profile +index 204804c2ee..1af0a865ef 100644 +--- a/products/sle15/profiles/standard.profile ++++ b/products/sle15/profiles/standard.profile +@@ -29,9 +29,7 @@ selections: + - service_cron_enabled + - service_ntp_enabled + - service_rsyslog_enabled +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - ensure_logrotate_activated +diff --git a/products/ubuntu1604/profiles/anssi_np_nt28_average.profile b/products/ubuntu1604/profiles/anssi_np_nt28_average.profile +index 600f1a6f71..4c42814719 100644 +--- a/products/ubuntu1604/profiles/anssi_np_nt28_average.profile ++++ b/products/ubuntu1604/profiles/anssi_np_nt28_average.profile +@@ -22,9 +22,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/ubuntu1604/profiles/standard.profile b/products/ubuntu1604/profiles/standard.profile +index 6fd70f0da6..93001f3bfe 100644 +--- a/products/ubuntu1604/profiles/standard.profile ++++ b/products/ubuntu1604/profiles/standard.profile +@@ -34,9 +34,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/ubuntu1804/profiles/anssi_np_nt28_average.profile b/products/ubuntu1804/profiles/anssi_np_nt28_average.profile +index 600f1a6f71..4c42814719 100644 +--- a/products/ubuntu1804/profiles/anssi_np_nt28_average.profile ++++ b/products/ubuntu1804/profiles/anssi_np_nt28_average.profile +@@ -22,9 +22,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/ubuntu1804/profiles/standard.profile b/products/ubuntu1804/profiles/standard.profile +index d587d499d8..a17117818e 100644 +--- a/products/ubuntu1804/profiles/standard.profile ++++ b/products/ubuntu1804/profiles/standard.profile +@@ -32,9 +32,7 @@ selections: + - sshd_allow_only_protocol2 + - var_sshd_set_keepalive=0 + - sshd_set_keepalive_0 +- - file_owner_logfiles_value=adm + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/ubuntu2004/profiles/standard.profile b/products/ubuntu2004/profiles/standard.profile +index 823a69a5d9..6ed27aa16d 100644 +--- a/products/ubuntu2004/profiles/standard.profile ++++ b/products/ubuntu2004/profiles/standard.profile +@@ -31,9 +31,7 @@ selections: + - sshd_disable_empty_passwords + - var_sshd_set_keepalive=0 + - sshd_set_keepalive +- - file_owner_logfiles_value=syslog + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/products/ubuntu2204/profiles/standard.profile b/products/ubuntu2204/profiles/standard.profile +index c8bc5369c9..1bb9f43e7d 100644 +--- a/products/ubuntu2204/profiles/standard.profile ++++ b/products/ubuntu2204/profiles/standard.profile +@@ -31,9 +31,7 @@ selections: + - sshd_disable_empty_passwords + - var_sshd_set_keepalive=0 + - sshd_set_keepalive +- - file_owner_logfiles_value=syslog + - rsyslog_files_ownership +- - file_groupowner_logfiles_value=adm + - rsyslog_files_groupownership + - rsyslog_files_permissions + - "!rsyslog_remote_loghost" +diff --git a/shared/references/cce-sle12-avail.txt b/shared/references/cce-sle12-avail.txt +index c119834759..4e0a76f8de 100644 +--- a/shared/references/cce-sle12-avail.txt ++++ b/shared/references/cce-sle12-avail.txt +@@ -54,7 +54,6 @@ CCE-92375-5 + CCE-92376-3 + CCE-92377-1 + CCE-92378-9 +-CCE-92379-7 + CCE-92380-5 + CCE-92381-3 + CCE-92382-1 +diff --git a/shared/references/cce-sle15-avail.txt b/shared/references/cce-sle15-avail.txt +index d04c40d31f..e39dae033e 100644 +--- a/shared/references/cce-sle15-avail.txt ++++ b/shared/references/cce-sle15-avail.txt +@@ -17,7 +17,6 @@ CCE-92492-8 + CCE-92493-6 + CCE-92495-1 + CCE-92496-9 +-CCE-92497-7 + CCE-92498-5 + CCE-92499-3 + CCE-92500-8 +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template +new file mode 100644 +index 0000000000..fc9e8844b6 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template +@@ -0,0 +1,68 @@ ++# platform = multi_platform_all ++# reboot = false ++# strategy = configure ++# complexity = low ++# disruption = medium ++ ++- name: '{{{ rule_title }}} - Set rsyslog logfile configuration facts' ++ ansible.builtin.set_fact: ++ rsyslog_etc_config: "/etc/rsyslog.conf" ++ ++# * And also the log file paths listed after rsyslog's $IncludeConfig directive ++# (store the result into array for the case there's shell glob used as value of IncludeConfig) ++- name: '{{{ rule_title }}} - Get IncludeConfig directive' ++ ansible.builtin.shell: | ++ set -o pipefail ++ grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true ++ register: rsyslog_old_inc ++ changed_when: False ++ ++- name: '{{{ rule_title }}} - Get include files directives' ++ ansible.builtin.shell: | ++ set -o pipefail ++ grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\"" -f 2 || true ++ register: rsyslog_new_inc ++ changed_when: False ++ ++- name: '{{{ rule_title }}} - Aggregate rsyslog includes' ++ ansible.builtin.set_fact: ++ include_config_output: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}" ++ ++- name: '{{{ rule_title }}} - List all config files' ++ ansible.builtin.find: ++ paths: "{{ include_config_output | list | map('dirname') }}" ++ patterns: "{{ include_config_output | list | map('basename') }}" ++ hidden: no ++ follow: yes ++ register: rsyslog_config_files ++ failed_when: False ++ changed_when: False ++ ++- name: '{{{ rule_title }}} - Extract log files old format' ++ ansible.builtin.shell: | ++ set -o pipefail ++ grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }} |awk '{print $NF}'|sed -e 's/^-//' || true ++ loop: "{{ rsyslog_config_files.files|map(attribute='path')|list|flatten|unique + [ rsyslog_etc_config ] }}" ++ register: log_files_old ++ changed_when: False ++ ++- name: '{{{ rule_title }}} - Extract log files new format' ++ ansible.builtin.shell: | ++ set -o pipefail ++ grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item }} | grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)"|grep -oE "\"([/[:alnum:][:punct:]]*)\"" |tr -d "\""|| true ++ loop: "{{ rsyslog_config_files.files|map(attribute='path')|list|flatten|unique + [ rsyslog_etc_config ] }}" ++ register: log_files_new ++ changed_when: False ++ ++- name: '{{{ rule_title }}} - Sum all log files found' ++ ansible.builtin.set_fact: ++ log_files: "{{ log_files_new.results|map(attribute='stdout_lines')|list|flatten|unique + log_files_old.results|map(attribute='stdout_lines')|list|flatten|unique }}" ++ ++- name: '{{{ rule_title }}} -Setup log files attribute' ++ ansible.builtin.file: ++ path: "{{ item }}" ++ owner: '{{ ( "{{{ ATTRIBUTE }}}" is match("owner")) | ternary({{{ VALUE }}}, omit) }}' ++ group: '{{ ( "{{{ ATTRIBUTE }}}" is match("groupowner")) | ternary({{{ VALUE }}} , omit) }}' ++ state: file ++ loop: "{{ log_files | list | flatten | unique }}" ++ failed_when: false +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template +new file mode 100644 +index 0000000000..ab4a563dc5 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template +@@ -0,0 +1,110 @@ ++# platform = multi_platform_all ++ ++# List of log file paths to be inspected for correct permissions ++# * Primarily inspect log file paths listed in /etc/rsyslog.conf ++RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf" ++# * And also the log file paths listed after rsyslog's $IncludeConfig directive ++# (store the result into array for the case there's shell glob used as value of IncludeConfig) ++readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2) ++readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done) ++readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf) ++readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done) ++ ++# Declare an array to hold the final list of different log file paths ++declare -a LOG_FILE_PATHS ++ ++# Array to hold all rsyslog config entries ++RSYSLOG_CONFIGS=() ++RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}") ++ ++# Get full list of files to be checked ++# RSYSLOG_CONFIGS may contain globs such as ++# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule ++# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files. ++RSYSLOG_CONFIG_FILES=() ++for ENTRY in "${RSYSLOG_CONFIGS[@]}" ++do ++ # If directory, rsyslog will search for config files in recursively. ++ # However, files in hidden sub-directories or hidden files will be ignored. ++ if [ -d "${ENTRY}" ] ++ then ++ readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f) ++ RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}") ++ elif [ -f "${ENTRY}" ] ++ then ++ RSYSLOG_CONFIG_FILES+=("${ENTRY}") ++ else ++ echo "Invalid include object: ${ENTRY}" ++ fi ++done ++ ++# Browse each file selected above as containing paths of log files ++# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration) ++for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}" ++do ++ # From each of these files extract just particular log file path(s), thus: ++ # * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters, ++ # * Ignore empty lines, ++ # * Strip quotes and closing brackets from paths. ++ # * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files ++ # * From the remaining valid rows select only fields constituting a log file path ++ # Text file column is understood to represent a log file path if and only if all of the following are met: ++ # * it contains at least one slash '/' character, ++ # * it is preceded by space ++ # * it doesn't contain space (' '), colon (':'), and semicolon (';') characters ++ # Search log file for path(s) only in case it exists! ++ if [[ -f "${LOG_FILE}" ]] ++ then ++ NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}") ++ LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}") ++ FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}") ++ CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}") ++ MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}") ++ # Since above sed command might return more than one item (delimited by newline), split the particular ++ # matches entries into new array specific for this log file ++ readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS" ++ # Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with ++ # items from newly created array for this log file ++ LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}") ++ # Delete the temporary array ++ unset ARRAY_FOR_LOG_FILE ++ fi ++done ++ ++# Check for RainerScript action log format which might be also multiline so grep regex is a bit curly ++# extract possibly multiline action omfile expressions ++# extract File="logfile" expression ++# match only "logfile" expression ++for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}" ++do ++ ACTION_OMFILE_LINES=$(grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}") ++ OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)") ++ LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")") ++done ++ ++FILE_PARAM="{{{ ATTRIBUTE }}}" ++FILE_CMD="" ++case "$FILE_PARAM" in ++ "groupowner") ++ FILE_CMD=$(which chgrp) ++ ;; ++ "owner") ++ FILE_CMD=$(which chown) ++ ;; ++ *) ++ echo -n "Not supported file attribute! " ++ exit 1 ++ ;; ++esac ++ ++# Correct the form o ++for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}" ++do ++ # Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing ++ if [ -z "$LOG_FILE_PATH" ] ++ then ++ continue ++ fi ++ ++ $FILE_CMD "+{{{ VALUE }}}" "$LOG_FILE_PATH" ++done +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template +new file mode 100644 +index 0000000000..4f288df1c9 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template +@@ -0,0 +1,137 @@ ++ ++ ++ {{{ oval_metadata("All syslog log files should have appropriate ownership.") }}} ++ ++ {{% if product in ["debian10", "debian11", "ubuntu1604"] %}} ++ ++ {{% endif %}} ++ ++ ++ ++ ++ ++ ++ ++ ++ /etc/rsyslog.conf ++ ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ ++ 1 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ var_{{{ _RULE_ID }}}_include_config_regex ++ ++ ++ ++ ^/etc/rsyslog.conf$ ++ ++ ++ ++ var_{{{ _RULE_ID }}}_syslog_config ++ ++ ++ ++ ++ ++ object_var_{{{ _RULE_ID }}}_include_config_regex ++ object_var_{{{ _RULE_ID }}}_syslog_config ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ^\s*[^(\s|#|\$)]+\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$ ++ 1 ++ state_{{{ _RULE_ID }}}_ownership_ignore_include_paths ++ ++ ++ ++ ++ (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ regular ++ {{% if ATTRIBUTE == "groupowner" %}} ++ {{{ VALUE }}} ++ {{% else %}} ++ {{{ VALUE }}} ++ {{% endif %}} ++ ++ ++ +diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/template.yml b/shared/templates/rsyslog_logfiles_attributes_modify/template.yml +new file mode 100644 +index 0000000000..b57de6fbb6 +--- /dev/null ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/template.yml +@@ -0,0 +1,4 @@ ++supported_languages: ++ - ansible ++ - bash ++ - oval +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh +similarity index 75% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh +index 6c82a1942f..db7e5261eb 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh +@@ -6,8 +6,16 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++ADDCOMMAND="useradd" ++CHATTR="chown" ++{{% else %}} ++ADDCOMMAND="groupadd" ++CHATTR="chgrp" ++{{% endif %}} ++ + USER_TEST=testssg +-useradd $USER_TEST ++$ADDCOMMAND $USER_TEST + + USER_ROOT=root + +@@ -15,8 +23,8 @@ USER_ROOT=root + create_rsyslog_test_logs 2 + + # setup test log files ownership +-chown $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chown $USER_TEST ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh +similarity index 81% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh +index b24e5e1699..b03268fe3e 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/IncludeConfig_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh +@@ -6,14 +6,20 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=root + + # setup test data + create_rsyslog_test_logs 2 + + # setup test log files ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} +-chown $USER ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh +similarity index 75% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh +index 18f43c6927..d79ae23cfc 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh +@@ -6,8 +6,16 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++ADDCOMMAND="useradd" ++CHATTR="chown" ++{{% else %}} ++ADDCOMMAND="groupadd" ++CHATTR="chgrp" ++{{% endif %}} ++ + USER_TEST=testssg +-useradd $USER_TEST ++$ADDCOMMAND $USER_TEST + + USER_ROOT=root + +@@ -15,8 +23,8 @@ USER_ROOT=root + create_rsyslog_test_logs 2 + + # setup test log files ownership +-chown $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chown $USER_TEST ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh +old mode 100755 +new mode 100644 +similarity index 50% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh +index 05dd50ed24..7869a180a8 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh +@@ -1,20 +1,31 @@ + #!/bin/bash + # platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle + +-# Check rsyslog.conf with root group-owner log from rules and +-# root group-owner log from include() passes. ++# Check rsyslog.conf with root user log from rules and ++# root user log from include() passes. + + source $SHARED/rsyslog_log_utils.sh + +-GROUP=root ++{{% if ATTRIBUTE == "owner" %}} ++ADDCOMMAND="useradd" ++CHATTR="chown" ++{{% else %}} ++ADDCOMMAND="groupadd" ++CHATTR="chgrp" ++{{% endif %}} ++ ++USER_TEST=testssg ++$ADDCOMMAND $USER_TEST ++ ++USER=root + + # setup test data + create_rsyslog_test_logs 3 + + # setup test log files ownership +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[1]} +-chgrp $GROUP ${RSYSLOG_TEST_LOGS[2]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +@@ -28,13 +39,25 @@ EOF + + # create test2 configuration file + test_conf2=${RSYSLOG_TEST_DIR}/test2.conf ++{{% if ATTRIBUTE == "owner" %}} ++cat << EOF > ${test_conf2} ++# rsyslog configuration file ++ ++#### RULES #### ++ ++ ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="$USER_TEST" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") ++EOF ++{{% else %}} + cat << EOF > ${test_conf2} + # rsyslog configuration file + + #### RULES #### + +-*.* ${RSYSLOG_TEST_LOGS[2]} ++ ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="$USER_TEST" File="${RSYSLOG_TEST_LOGS[2]}") + EOF ++{{% endif %}} + + # create rsyslog.conf configuration file + cat << EOF > $RSYSLOG_CONF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh +similarity index 81% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh +index 69dead5135..e80395ca99 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh +@@ -6,14 +6,21 @@ + + source $SHARED/rsyslog_log_utils.sh + ++ ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=root + + # setup test data + create_rsyslog_test_logs 2 + + # setup test log files ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} +-chown $USER ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh +similarity index 77% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh +index e725fb4d54..e7b4905dc5 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh +@@ -6,18 +6,26 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++ADDCOMMAND="useradd" ++CHATTR="chown" ++{{% else %}} ++ADDCOMMAND="groupadd" ++CHATTR="chgrp" ++{{% endif %}} ++ + USER_ROOT=root + + USER_TEST=testssg +-useradd $USER_TEST ++$ADDCOMMAND $USER_TEST + + # setup test data + create_rsyslog_test_logs 3 + + # setup test log files ownership +-chown $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chown $USER_ROOT ${RSYSLOG_TEST_LOGS[1]} +-chown $USER_TEST ${RSYSLOG_TEST_LOGS[2]} ++$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh +similarity index 82% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh +index ca47d453c1..6389e6ea3b 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_is_root_IncludeConfig_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh +@@ -6,15 +6,21 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=root + + # setup test data + create_rsyslog_test_logs 3 + + # setup test log files ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} +-chown $USER ${RSYSLOG_TEST_LOGS[1]} +-chown $USER ${RSYSLOG_TEST_LOGS[2]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh +similarity index 65% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh +index 9747e0b28b..6b81a77c2f 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/include_is_root_IncludeConfig_is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh +@@ -1,23 +1,26 @@ + #!/bin/bash + # platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle + +-# Check rsyslog.conf with root group-owner log from rules and +-# non root group-owner log from include() fails. ++# Check rsyslog.conf with root user log from rules and ++# root user log from include() passes. + + source $SHARED/rsyslog_log_utils.sh + +-GROUP_ROOT=root ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} + +-GROUP_TEST=testssg +-groupadd $GROUP_TEST ++USER=root + + # setup test data + create_rsyslog_test_logs 3 + + # setup test log files ownership +-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[0]} +-chgrp $GROUP_ROOT ${RSYSLOG_TEST_LOGS[1]} +-chgrp $GROUP_TEST ${RSYSLOG_TEST_LOGS[2]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +@@ -36,7 +39,8 @@ cat << EOF > ${test_conf2} + + #### RULES #### + +-*.* ${RSYSLOG_TEST_LOGS[2]} ++ ++*.* action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}") + EOF + + # create rsyslog.conf configuration file +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_multiline_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh +similarity index 81% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_multiline_is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh +index d68cc2e67d..78b105abf3 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/include_multiline_is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh +@@ -6,14 +6,20 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=root + + # setup test data + create_rsyslog_test_logs 2 + + # setup test log files ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} +-chown $USER ${RSYSLOG_TEST_LOGS[1]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]} + + # create test configuration file + test_conf=${RSYSLOG_TEST_DIR}/test1.conf +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh +similarity index 70% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_other.fail.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh +index 7edbb17ea1..1afe20823c 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_other.fail.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh +@@ -5,15 +5,23 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++ADDCOMMAND="useradd" ++CHATTR="chown" ++{{% else %}} ++ADDCOMMAND="groupadd" ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=testssg + +-useradd $USER ++$ADDCOMMAND $USER + + # setup test data + create_rsyslog_test_logs 1 + + # setup test log file ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} + + # add rule with non-root user owned log file + cat << EOF > $RSYSLOG_CONF +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh +similarity index 77% +rename from linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_root.pass.sh +rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh +index e0e518bc50..afce21fa27 100755 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_ownership/tests/is_root.pass.sh ++++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh +@@ -5,13 +5,19 @@ + + source $SHARED/rsyslog_log_utils.sh + ++{{% if ATTRIBUTE == "owner" %}} ++CHATTR="chown" ++{{% else %}} ++CHATTR="chgrp" ++{{% endif %}} ++ + USER=root + + # setup test data + create_rsyslog_test_logs 1 + + # setup test log file ownership +-chown $USER ${RSYSLOG_TEST_LOGS[0]} ++$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]} + + # add rule with root user owned log file + cat << EOF > $RSYSLOG_CONF +-- +2.39.1 + diff --git a/scap-security-guide.spec b/scap-security-guide.spec index c3d293d..eda0e78 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -11,6 +11,16 @@ Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 +# Rsyslog files rules remediations +Patch1: scap-security-guide-0.1.67-rsyslog_files_rules_remediations-PR_9789.patch +# Extends rsyslog_logfiles_attributes_modify template for permissions +Patch2: scap-security-guide-0.1.67-rsyslog_files_permissions_template-PR_10139.patch +# Change custom zones check in firewalld_sshd_port_enabled +Patch3: scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch +# Accept required and requisite control flag for pam_pwhistory +Patch4: scap-security-guide-0.1.67-pwhistory_control-PR_10175.patch +# remove rule logind_session_timeout and associated variable from profiles +Patch5: scap-security-guide-0.1.67-remove_logind_session_timeout_from_profiles-PR_10202.patch BuildArch: noarch BuildRequires: libxslt @@ -101,6 +111,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md * Mon Feb 13 2023 Watson Sato - 0.1.66-1 - Rebase to a new upstream release 0.1.66 (RHBZ#2169443) - Fix remediation of audit watch rules (RHBZ#2169441) +- Fix check firewalld_sshd_port_enabled (RHBZ#2169443) +- Fix accepted control flags for pam_pwhistory (RHBZ#2169443) +- Unselect rule logind_session_timeout (RHBZ#2169443) +- Add support rainer scripts in rsyslog rules (RHBZ#2169445) * Thu Aug 25 2022 Gabriel Becker - 0.1.63-5 - OSPP: fix rule related to coredump (RHBZ#2081688)