Skip to content

Commit a4db680

Browse files
kkanaskkanas
committed
SystemdParameter: block parameter do not need [], add Journal.Compress=yes as default
Signed-off-by: Krzysztof Kanas <kkanas@microsoft.com>
1 parent 0b7ced9 commit a4db680

File tree

2 files changed

+85
-8
lines changed

2 files changed

+85
-8
lines changed

‎src/modules/complianceengine/src/lib/procedures/SystemdConfig.cpp‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ namespace
2121
// Maps (block, parameter) -> (value, sourceFile)
2222
typedef std::map<std::pair<std::string, std::string>, std::pair<std::string, std::string>> SystemdConfigMap_t;
2323

24+
const SystemdConfigMap_t& GetSystemdConfigDefaults()
25+
{
26+
static const SystemdConfigMap_t defaults = {
27+
{{"[Journal]", "Compress"}, {"yes", "<default>"}},
28+
};
29+
return defaults;
30+
}
31+
2432
Result<bool> GetSystemdConfig(SystemdConfigMap_t& config, const std::string& filename, ContextInterface& context)
2533
{
2634
auto result = context.ExecuteCommand("/usr/bin/systemd-analyze cat-config " + filename);
@@ -67,6 +75,14 @@ Result<bool> GetSystemdConfig(SystemdConfigMap_t& config, const std::string& fil
6775
std::string value = line.substr(eqSign + 1);
6876
config[std::make_pair(currentBlock, key)] = std::make_pair(value, currentConfig);
6977
}
78+
79+
// Merge defaults: only insert entries not already present (parsed config wins)
80+
for (const auto& entry : GetSystemdConfigDefaults())
81+
{
82+
if (config.find(entry.first) == config.end())
83+
config.insert(entry);
84+
}
85+
7086
return true;
7187
}
7288
} // namespace
@@ -160,7 +176,9 @@ Result<Status> AuditSystemdParameter(const SystemdParameterParams& params, Indic
160176
SystemdConfigMap_t::const_iterator paramIt = config.end();
161177
if (params.block.HasValue())
162178
{
163-
paramIt = config.find(std::make_pair(params.block.Value(), params.parameter));
179+
auto block = params.block.Value();
180+
block = "[" + block + "]";
181+
paramIt = config.find(std::make_pair(block, params.parameter));
164182
}
165183
else
166184
{
@@ -178,8 +196,10 @@ Result<Status> AuditSystemdParameter(const SystemdParameterParams& params, Indic
178196
{
179197
if (params.block.HasValue())
180198
{
181-
OsConfigLogInfo(log, "Parameter '%s' not found in block '%s'", params.parameter.c_str(), params.block->c_str());
182-
return indicators.NonCompliant("Parameter '" + params.parameter + "' not found in block '" + params.block.Value() + "'");
199+
auto block = params.block.Value();
200+
block = "[" + block + "]";
201+
OsConfigLogInfo(log, "Parameter '%s' not found in block '%s'", params.parameter.c_str(), block.c_str());
202+
return indicators.NonCompliant("Parameter '" + params.parameter + "' not found in block '" + block + "'");
183203
}
184204
else
185205
{

‎src/modules/complianceengine/tests/procedures/SystemdConfigTest.cpp‎

Lines changed: 62 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -643,7 +643,7 @@ TEST_F(SystemdConfigTest, BlockParameterFoundInCorrectBlock)
643643
params.parameter = "Restart";
644644
params.valueRegex = regex("^always$");
645645
params.file = "test.conf";
646-
params.block = std::string("[Service]");
646+
params.block = std::string("Service");
647647

648648
auto result = AuditSystemdParameter(params, mIndicators, mContext);
649649
ASSERT_TRUE(result.HasValue());
@@ -666,7 +666,7 @@ TEST_F(SystemdConfigTest, BlockParameterNotFoundInWrongBlock)
666666
params.parameter = "Restart";
667667
params.valueRegex = regex("^always$");
668668
params.file = "test.conf";
669-
params.block = std::string("[Unit]");
669+
params.block = std::string("Unit");
670670

671671
auto result = AuditSystemdParameter(params, mIndicators, mContext);
672672
ASSERT_TRUE(result.HasValue());
@@ -686,7 +686,7 @@ TEST_F(SystemdConfigTest, BlockParameterNotFoundInNonexistentBlock)
686686
params.parameter = "ExecStart";
687687
params.valueRegex = regex(".*");
688688
params.file = "test.conf";
689-
params.block = std::string("[Install]");
689+
params.block = std::string("Install");
690690

691691
auto result = AuditSystemdParameter(params, mIndicators, mContext);
692692
ASSERT_TRUE(result.HasValue());
@@ -709,7 +709,7 @@ TEST_F(SystemdConfigTest, SameParameterInDifferentBlocksWithBlockFilter)
709709
params.op = SystemdParameterOperator::Equal;
710710
params.value = std::string("stream");
711711
params.file = "test.conf";
712-
params.block = std::string("[Socket]");
712+
params.block = std::string("Socket");
713713

714714
auto result = AuditSystemdParameter(params, mIndicators, mContext);
715715
ASSERT_TRUE(result.HasValue());
@@ -755,7 +755,7 @@ TEST_F(SystemdConfigTest, BlockWithOperatorComparison)
755755
params.op = SystemdParameterOperator::GreaterOrEqual;
756756
params.value = std::string("1024");
757757
params.file = "test.conf";
758-
params.block = std::string("[Service]");
758+
params.block = std::string("Service");
759759

760760
auto result = AuditSystemdParameter(params, mIndicators, mContext);
761761
ASSERT_TRUE(result.HasValue());
@@ -783,3 +783,60 @@ TEST_F(SystemdConfigTest, ParameterWithoutBlockHeaderFoundWithoutBlockFilter)
783783
ASSERT_TRUE(result.HasValue());
784784
ASSERT_EQ(result.Value(), Status::Compliant);
785785
}
786+
787+
TEST_F(SystemdConfigTest, JournalCompressUsesDefaultWhenOutputHasNoJournalSection)
788+
{
789+
std::string systemdOutput = "# /etc/systemd/journald.conf\n";
790+
791+
EXPECT_CALL(mContext, ExecuteCommand(::testing::HasSubstr("/usr/bin/systemd-analyze cat-config journald.conf"))).WillOnce(Return(Result<std::string>(systemdOutput)));
792+
793+
SystemdParameterParams params;
794+
params.parameter = "Compress";
795+
params.valueRegex = regex("^yes$");
796+
params.file = "journald.conf";
797+
params.block = std::string("Journal");
798+
799+
auto result = AuditSystemdParameter(params, mIndicators, mContext);
800+
ASSERT_TRUE(result.HasValue());
801+
ASSERT_EQ(result.Value(), Status::Compliant);
802+
}
803+
804+
TEST_F(SystemdConfigTest, JournalCompressUsesDefaultWhenJournalSectionHasNoCompressLine)
805+
{
806+
std::string systemdOutput =
807+
"# /etc/systemd/journald.conf\n"
808+
"[Journal]\n"
809+
"Storage=auto\n";
810+
811+
EXPECT_CALL(mContext, ExecuteCommand(::testing::HasSubstr("/usr/bin/systemd-analyze cat-config journald.conf"))).WillOnce(Return(Result<std::string>(systemdOutput)));
812+
813+
SystemdParameterParams params;
814+
params.parameter = "Compress";
815+
params.valueRegex = regex("^yes$");
816+
params.file = "journald.conf";
817+
params.block = std::string("Journal");
818+
819+
auto result = AuditSystemdParameter(params, mIndicators, mContext);
820+
ASSERT_TRUE(result.HasValue());
821+
ASSERT_EQ(result.Value(), Status::Compliant);
822+
}
823+
824+
TEST_F(SystemdConfigTest, JournalCompressOverrideWinsOverDefaultCompliant)
825+
{
826+
std::string systemdOutput =
827+
"# /etc/systemd/journald.conf\n"
828+
"[Journal]\n"
829+
"Compress=no\n";
830+
831+
EXPECT_CALL(mContext, ExecuteCommand(::testing::HasSubstr("/usr/bin/systemd-analyze cat-config journald.conf"))).WillOnce(Return(Result<std::string>(systemdOutput)));
832+
833+
SystemdParameterParams params;
834+
params.parameter = "Compress";
835+
params.valueRegex = regex("^no$");
836+
params.file = "journald.conf";
837+
params.block = std::string("Journal");
838+
839+
auto result = AuditSystemdParameter(params, mIndicators, mContext);
840+
ASSERT_TRUE(result.HasValue());
841+
ASSERT_EQ(result.Value(), Status::Compliant);
842+
}

0 commit comments

Comments
 (0)