123 lines
6.7 KiB
Diff
123 lines
6.7 KiB
Diff
From 2275e47e111ba89595658f5d91964454c1a65323 Mon Sep 17 00:00:00 2001
|
|
From: Watson Sato <wsato@redhat.com>
|
|
Date: Wed, 4 May 2022 19:21:04 +0200
|
|
Subject: [PATCH 1/2] Add tests to ensure valid symlinks are checked
|
|
|
|
These sysctl tests help check cases when:
|
|
- A symlink points to a file out of the default default dirs
|
|
- Multile symlinks point to the same file in the default dirs
|
|
|
|
Symlinks are a valid use case how to configure sysctls.
|
|
---
|
|
.../tests/symlink_root_duplicate.fail.sh | 15 +++++++++++++++
|
|
.../tests/symlink_root_incompliant.fail.sh | 15 +++++++++++++++
|
|
.../tests/symlinks_to_same_file.pass.sh | 14 ++++++++++++++
|
|
3 files changed, 44 insertions(+)
|
|
create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_duplicate.fail.sh
|
|
create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_incompliant.fail.sh
|
|
create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlinks_to_same_file.pass.sh
|
|
|
|
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_duplicate.fail.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_duplicate.fail.sh
|
|
new file mode 100644
|
|
index 00000000000..c4f756a110f
|
|
--- /dev/null
|
|
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_duplicate.fail.sh
|
|
@@ -0,0 +1,15 @@
|
|
+#!/bin/bash
|
|
+
|
|
+# Clean sysctl config directories
|
|
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
|
+
|
|
+sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf
|
|
+echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
|
|
+
|
|
+# Put a config file out of the default dirs
|
|
+echo "net.ipv4.conf.default.accept_source_route = 0" >> /root/root-sysctl.conf
|
|
+
|
|
+# Add a symlink
|
|
+ln -s /root/root-sysctl.conf /etc/sysctl.d/90-root.conf
|
|
+
|
|
+sysctl -w net.ipv4.conf.default.accept_source_route=0
|
|
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_incompliant.fail.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_incompliant.fail.sh
|
|
new file mode 100644
|
|
index 00000000000..3b67676ac69
|
|
--- /dev/null
|
|
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlink_root_incompliant.fail.sh
|
|
@@ -0,0 +1,15 @@
|
|
+#!/bin/bash
|
|
+
|
|
+# Clean sysctl config directories
|
|
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
|
+
|
|
+sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf
|
|
+echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
|
|
+
|
|
+# Put a config file out of the default dirs
|
|
+echo "net.ipv4.conf.default.accept_source_route = 1" >> /root/root-sysctl.conf
|
|
+
|
|
+# Add a symlink
|
|
+ln -s /root/root-sysctl.conf /etc/sysctl.d/90-root.conf
|
|
+
|
|
+sysctl -w net.ipv4.conf.default.accept_source_route=0
|
|
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlinks_to_same_file.pass.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlinks_to_same_file.pass.sh
|
|
new file mode 100644
|
|
index 00000000000..6164d0b1ca9
|
|
--- /dev/null
|
|
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/symlinks_to_same_file.pass.sh
|
|
@@ -0,0 +1,14 @@
|
|
+#!/bin/bash
|
|
+
|
|
+# Clean sysctl config directories
|
|
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
|
+
|
|
+sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf
|
|
+echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
|
|
+
|
|
+# Multiple symliks to the same file should be ignored
|
|
+ln -s /etc/sysctl.conf /etc/sysctl.d/90-sysctl.conf
|
|
+ln -s /etc/sysctl.conf /etc/sysctl.d/99-sysctl.conf
|
|
+
|
|
+sysctl -w net.ipv4.conf.default.accept_source_route=0
|
|
+
|
|
|
|
From 4f4bb24620338b2ff8f59d173b575d2089618357 Mon Sep 17 00:00:00 2001
|
|
From: Watson Sato <wsato@redhat.com>
|
|
Date: Wed, 4 May 2022 19:23:41 +0200
|
|
Subject: [PATCH 2/2] Filter out symlinks referencing default dirs
|
|
|
|
Apply a filter on the collected symlinks and exclude the ones that
|
|
don't point to the default dirs.
|
|
In other words, only remove ignore options in symlinks if the files they
|
|
reference will be scanned anyway, because they are in the one of the
|
|
default dirs.
|
|
---
|
|
shared/templates/sysctl/oval.template | 12 +++++++++++-
|
|
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/shared/templates/sysctl/oval.template b/shared/templates/sysctl/oval.template
|
|
index 0b5cde45045..ac395d545c3 100644
|
|
--- a/shared/templates/sysctl/oval.template
|
|
+++ b/shared/templates/sysctl/oval.template
|
|
@@ -217,10 +217,20 @@
|
|
|
|
<!-- "pattern match" doesn't seem to work with symlink_object, not sure if a bug or not.
|
|
Workaround by querying for all conf files found -->
|
|
- <unix:symlink_object comment="syctl symlinks" id="object_{{{ SYSCTLID }}}_symlinks" version="1">
|
|
+ <unix:symlink_object comment="Symlinks referencing files in default dirs" id="object_{{{ SYSCTLID }}}_symlinks" version="1">
|
|
<unix:filepath operation="equals" var_ref="local_var_conf_files_{{{ SYSCTLID }}}" />
|
|
+ <filter action="exclude">state_symlink_points_outside_usual_dirs_{{{ SYSCTLID }}}</filter>
|
|
</unix:symlink_object>
|
|
|
|
+ <!-- The state matches symlinks that don't point to the default dirs, i.e. paths that are not:
|
|
+ ^/etc/sysctl.conf$
|
|
+ ^/etc/sysctl.d/.*$
|
|
+ ^/run/sysctl.d/.*$
|
|
+ ^/usr/lib/sysctl.d/.*$ -->
|
|
+ <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="state_symlink_points_outside_usual_dirs_{{{ SYSCTLID }}}" version="1">
|
|
+ <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
|
|
+ </unix:symlink_state>
|
|
+
|
|
<local_variable comment="List of conf files" datatype="string" id="local_var_conf_files_{{{ SYSCTLID }}}" version="1">
|
|
<object_component object_ref="object_static_set_unfiltered_sysctls_{{{ SYSCTLID }}}" item_field="filepath" />
|
|
</local_variable>
|