Skip to content

Commit 4495906

Browse files
jan-cernyjan-cerny
authored
Merge pull request #2091 from evgenyz/add-bp-mask-services
Support Blueprint services customization for masking
2 parents 430dfe4 + e8369e4 commit 4495906

File tree

3 files changed

+64
-43
lines changed

3 files changed

+64
-43
lines changed

‎src/XCCDF_POLICY/xccdf_policy_remediate.c

Lines changed: 53 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -667,19 +667,28 @@ struct blueprint_entries {
667667
oscap_pcre_t *re;
668668
};
669669

670-
static inline int _parse_blueprint_fix(const char *fix_text, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
670+
struct blueprint_customizations {
671+
struct oscap_list *generic;
672+
struct oscap_list *services_enable;
673+
struct oscap_list *services_disable;
674+
struct oscap_list *services_mask;
675+
struct oscap_list *kernel_append;
676+
};
677+
678+
static inline int _parse_blueprint_fix(const char *fix_text, struct blueprint_customizations *customizations)
671679
{
672680
char *err;
673681
int errofs;
674682
int ret = 0;
675683

676684
struct blueprint_entries tab[] = {
677-
{"\\[customizations\\.services\\]\\s+enabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_enable, NULL},
678-
{"\\[customizations\\.services\\]\\s+disabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_disable, NULL},
679-
{"\\[customizations\\.kernel\\]\\s+append[=\\s\"]+([^\"]+)[\\s\"]+", kernel_append, NULL},
685+
{"\\[customizations\\.services\\]\\s+enabled[=\\s]+\\[([^\\]]+)\\]\\s+", customizations->services_enable, NULL},
686+
{"\\[customizations\\.services\\]\\s+disabled[=\\s]+\\[([^\\]]+)\\]\\s+", customizations->services_disable, NULL},
687+
{"\\[customizations\\.services\\]\\s+masked[=\\s]+\\[([^\\]]+)\\]\\s+", customizations->services_mask, NULL},
688+
{"\\[customizations\\.kernel\\]\\s+append[=\\s\"]+([^\"]+)[\\s\"]+", customizations->kernel_append, NULL},
680689
// We do this only to pop the 'distro' entry to the top of the generic list,
681690
// effectively placing it to the root of the TOML document.
682-
{"\\s+(distro[=\\s\"]+[^\"]+[\\s\"]+)", generic, NULL},
691+
{"\\s+(distro[=\\s\"]+[^\"]+[\\s\"]+)", customizations->generic, NULL},
683692
{NULL, NULL, NULL}
684693
};
685694

@@ -714,7 +723,7 @@ static inline int _parse_blueprint_fix(const char *fix_text, struct oscap_list *
714723
memcpy(val, &fix_text[ovector[2]], ovector[3] - ovector[2]);
715724
val[ovector[3] - ovector[2]] = '\0';
716725

717-
if (!oscap_list_contains(kernel_append, val, (oscap_cmp_func) oscap_streq)) {
726+
if (!oscap_list_contains(customizations->kernel_append, val, (oscap_cmp_func) oscap_streq)) {
718727
oscap_list_prepend(tab[i].list, val);
719728
} else {
720729
free(val);
@@ -725,7 +734,7 @@ static inline int _parse_blueprint_fix(const char *fix_text, struct oscap_list *
725734
}
726735

727736
if (start_offset < fix_text_len-1) {
728-
oscap_list_add(generic, strdup(fix_text + start_offset));
737+
oscap_list_add(customizations->generic, strdup(fix_text + start_offset));
729738
}
730739

731740
exit:
@@ -872,14 +881,14 @@ static int _xccdf_policy_rule_generate_fix(struct xccdf_policy *policy, struct x
872881
return ret;
873882
}
874883

875-
static int _xccdf_policy_rule_generate_blueprint_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
884+
static int _xccdf_policy_rule_generate_blueprint_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct blueprint_customizations *customizations)
876885
{
877886
char *fix_text = NULL;
878887
int ret = _xccdf_policy_rule_get_fix_text(policy, rule, template, &fix_text);
879888
if (fix_text == NULL) {
880889
return ret;
881890
}
882-
ret = _parse_blueprint_fix(fix_text, generic, services_enable, services_disable, kernel_append);
891+
ret = _parse_blueprint_fix(fix_text, customizations);
883892
free(fix_text);
884893
return ret;
885894
}
@@ -1161,67 +1170,68 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
11611170
}
11621171
}
11631172

1173+
static inline void _format_and_write_list_into_blueprint_fd(struct oscap_list *list_, const char *separator, int output_fd)
1174+
{
1175+
struct oscap_iterator *it = oscap_iterator_new(list_);
1176+
while(oscap_iterator_has_more(it)) {
1177+
char *var_line = (char *)oscap_iterator_next(it);
1178+
_write_text_to_fd(output_fd, var_line);
1179+
if (oscap_iterator_has_more(it))
1180+
_write_text_to_fd(output_fd, separator);
1181+
}
1182+
oscap_iterator_free(it);
1183+
}
1184+
11641185
static int _xccdf_policy_generate_fix_blueprint(struct oscap_list *rules_to_fix, struct xccdf_policy *policy, const char *sys, int output_fd)
11651186
{
11661187
int ret = 0;
1167-
struct oscap_list *generic = oscap_list_new();
1168-
struct oscap_list *services_enable = oscap_list_new();
1169-
struct oscap_list *services_disable = oscap_list_new();
1170-
struct oscap_list *kernel_append = oscap_list_new();
1188+
struct blueprint_customizations customizations = {
1189+
.generic = oscap_list_new(),
1190+
.services_enable = oscap_list_new(),
1191+
.services_disable = oscap_list_new(),
1192+
.services_mask = oscap_list_new(),
1193+
.kernel_append = oscap_list_new()
1194+
};
1195+
11711196
struct oscap_iterator *rules_to_fix_it = oscap_iterator_new(rules_to_fix);
11721197
while (oscap_iterator_has_more(rules_to_fix_it)) {
11731198
struct xccdf_rule *rule = (struct xccdf_rule*)oscap_iterator_next(rules_to_fix_it);
1174-
ret = _xccdf_policy_rule_generate_blueprint_fix(policy, rule, sys, generic, services_enable, services_disable, kernel_append);
1199+
ret = _xccdf_policy_rule_generate_blueprint_fix(policy, rule, sys, &customizations);
11751200
if (ret != 0)
11761201
break;
11771202
}
11781203
oscap_iterator_free(rules_to_fix_it);
11791204

1180-
struct oscap_iterator *generic_it = oscap_iterator_new(generic);
1205+
struct oscap_iterator *generic_it = oscap_iterator_new(customizations.generic);
11811206
while(oscap_iterator_has_more(generic_it)) {
11821207
char *var_line = (char *) oscap_iterator_next(generic_it);
11831208
_write_text_to_fd(output_fd, var_line);
11841209
}
11851210
_write_text_to_fd(output_fd, "\n");
11861211
oscap_iterator_free(generic_it);
1187-
oscap_list_free(generic, free);
11881212

11891213
_write_text_to_fd(output_fd, "[customizations.kernel]\nappend = \"");
1190-
struct oscap_iterator *kernel_append_it = oscap_iterator_new(kernel_append);
1191-
while(oscap_iterator_has_more(kernel_append_it)) {
1192-
char *var_line = (char *) oscap_iterator_next(kernel_append_it);
1193-
_write_text_to_fd(output_fd, var_line);
1194-
if (oscap_iterator_has_more(kernel_append_it))
1195-
_write_text_to_fd(output_fd, " ");
1196-
}
1214+
_format_and_write_list_into_blueprint_fd(customizations.kernel_append, " ", output_fd);
11971215
_write_text_to_fd(output_fd, "\"\n\n");
1198-
oscap_iterator_free(kernel_append_it);
1199-
oscap_list_free(kernel_append, free);
12001216

12011217
_write_text_to_fd(output_fd, "[customizations.services]\n");
12021218
_write_text_to_fd(output_fd, "enabled = [");
1203-
struct oscap_iterator *services_enable_it = oscap_iterator_new(services_enable);
1204-
while(oscap_iterator_has_more(services_enable_it)) {
1205-
char *var_line = (char *) oscap_iterator_next(services_enable_it);
1206-
_write_text_to_fd(output_fd, var_line);
1207-
if (oscap_iterator_has_more(services_enable_it))
1208-
_write_text_to_fd(output_fd, ",");
1209-
}
1219+
_format_and_write_list_into_blueprint_fd(customizations.services_enable, ",", output_fd);
12101220
_write_text_to_fd(output_fd, "]\n");
1211-
oscap_iterator_free(services_enable_it);
1212-
oscap_list_free(services_enable, free);
12131221

12141222
_write_text_to_fd(output_fd, "disabled = [");
1215-
struct oscap_iterator *services_disable_it = oscap_iterator_new(services_disable);
1216-
while(oscap_iterator_has_more(services_disable_it)) {
1217-
char *var_line = (char *) oscap_iterator_next(services_disable_it);
1218-
_write_text_to_fd(output_fd, var_line);
1219-
if (oscap_iterator_has_more(services_disable_it))
1220-
_write_text_to_fd(output_fd, ",");
1221-
}
1223+
_format_and_write_list_into_blueprint_fd(customizations.services_disable, ",", output_fd);
1224+
_write_text_to_fd(output_fd, "]\n");
1225+
1226+
_write_text_to_fd(output_fd, "masked = [");
1227+
_format_and_write_list_into_blueprint_fd(customizations.services_mask, ",", output_fd);
12221228
_write_text_to_fd(output_fd, "]\n\n");
1223-
oscap_iterator_free(services_disable_it);
1224-
oscap_list_free(services_disable, free);
1229+
1230+
oscap_list_free(customizations.services_mask, free);
1231+
oscap_list_free(customizations.services_disable, free);
1232+
oscap_list_free(customizations.kernel_append, free);
1233+
oscap_list_free(customizations.services_enable, free);
1234+
oscap_list_free(customizations.generic, free);
12251235

12261236
return ret;
12271237
}

‎tests/API/XCCDF/unittests/test_remediation_blueprint.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,5 @@ append = "foo=bar audit=1"
4949
[customizations.services]
5050
enabled = ["sshd","usbguard"]
5151
disabled = ["kdump"]
52+
masked = ["evil"]
5253

‎tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,16 @@ distro = rhel-80
9494
<fix system="urn:redhat:osbuild:blueprint">
9595
[customizations.services]
9696
enabled = ["sshd"]
97+
</fix>
98+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
99+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
100+
</check>
101+
</Rule>
102+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_10">
103+
<title>Enable sshd</title>
104+
<fix system="urn:redhat:osbuild:blueprint">
105+
[customizations.services]
106+
masked = ["evil"]
97107
</fix>
98108
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
99109
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>

0 commit comments

Comments
 (0)