Skip to content

Commit 57576ee

Browse files
Mab879Mab879
committed
Always check the current lists before inserting on blueprints
Fixes #2282
1 parent 50f042e commit 57576ee

File tree

5 files changed

+197
-1
lines changed

5 files changed

+197
-1
lines changed

‎src/XCCDF_POLICY/xccdf_policy_remediate.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -724,7 +724,7 @@ static inline int _parse_blueprint_fix(const char *fix_text, struct blueprint_cu
724724
memcpy(val, &fix_text[ovector[2]], ovector[3] - ovector[2]);
725725
val[ovector[3] - ovector[2]] = '\0';
726726

727-
if (!oscap_list_contains(customizations->kernel_append, val, (oscap_cmp_func) oscap_streq)) {
727+
if (!oscap_list_contains(tab[i].list, val, (oscap_cmp_func) oscap_streq)) {
728728
oscap_list_prepend(tab[i].list, val);
729729
} else {
730730
free(val);

‎tests/API/XCCDF/unittests/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,4 @@ add_oscap_test("test_no_newline_between_select_elements.sh")
112112
add_oscap_test("test_single_line_tailoring.sh")
113113
add_oscap_test("test_reference.sh")
114114
add_oscap_test("test_remediation_bootc.sh")
115+
add_oscap_test("test_duplicate_blueprint_service.sh")

‎tests/API/XCCDF/unittests/test_duplicate_blueprint_service.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/usr/bin/env bash
2+
. $builddir/tests/test_common.sh
3+
4+
set -e
5+
set -o pipefail
6+
7+
name=$(basename $0 .sh)
8+
result=$(make_temp_file /tmp ${name}.out)
9+
stderr=$(make_temp_file /tmp ${name}.out)
10+
11+
ret=0
12+
13+
input_xml="$srcdir/${name}.xccdf.xml"
14+
valid_toml="$srcdir/${name}.toml"
15+
16+
expected_result=$(mktemp)
17+
sed "s;TEST_XCCDF_FILE_NAME;$input_xml;" "$valid_toml" > "$expected_result"
18+
19+
echo "Stderr file = $stderr"
20+
echo "Result file = $result"
21+
[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
22+
23+
# The expected file was generated without ' # This file was generated by OpenSCAP 1.3.14 using:' line
24+
# to make the test independent from the scanner version. We have to filter this line from the output as well.
25+
26+
$OSCAP xccdf generate fix --fix-type blueprint --profile 'common' "$input_xml" | grep -v "OpenSCAP" > "$result"
27+
28+
diff "$expected_result" "$result"
29+
30+
rm "$result"
31+
rm "$expected_result"

‎tests/API/XCCDF/unittests/test_duplicate_blueprint_service.toml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
###############################################################################
2+
#
3+
# Blueprint for Profile title on one line
4+
#
5+
# Profile Description:
6+
# Profile description
7+
#
8+
# Profile ID: xccdf_moc.elpmaxe.www_profile_common
9+
# Benchmark ID: xccdf_moc.elpmaxe.www_benchmark_test
10+
# Benchmark Version: 1.0
11+
# XCCDF Version: 1.2
12+
#
13+
#
14+
# It attempts to fix every selected rule, even if the system is already compliant.
15+
#
16+
# How to apply this Blueprint:
17+
# composer-cli blueprints push blueprint.toml
18+
#
19+
###############################################################################
20+
21+
name = "hardened_xccdf_moc.elpmaxe.www_profile_common"
22+
description = "Profile title on one line"
23+
version = "1.0"
24+
25+
[customizations.openscap]
26+
profile_id = "xccdf_moc.elpmaxe.www_profile_common"
27+
# If your hardening data stream is not part of the 'scap-security-guide' package
28+
# provide the absolute path to it (from the root of the image filesystem).
29+
# datastream = "/usr/share/xml/scap/ssg/content/ssg-xxxxx-ds.xml"
30+
31+
distro = rhel-80
32+
33+
[[packages]]
34+
name = "aide"
35+
version = "*"
36+
37+
[[customizations.filesystem]]
38+
mountpoint = "/home"
39+
size = 1
40+
41+
[[customizations.filesystem]]
42+
mountpoint = "/tmp"
43+
size = 2
44+
45+
[customizations.kernel]
46+
append = "foo=bar audit=1"
47+
48+
[customizations.services]
49+
enabled = ["sshd","usbguard"]
50+
disabled = ["kdump"]
51+
masked = []
52+

‎tests/API/XCCDF/unittests/test_duplicate_blueprint_service.xccdf.xml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_test">
3+
<status>accepted</status>
4+
<version>1.0</version>
5+
<Profile id="xccdf_moc.elpmaxe.www_profile_common">
6+
<title>Profile title on one line</title>
7+
<description>Profile description</description>
8+
<select idref="xccdf_moc.elpmaxe.www_rule_1" selected="true"/>
9+
</Profile>
10+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_1">
11+
<title>Install aide</title>
12+
<fix system="urn:redhat:osbuild:blueprint">
13+
[[packages]]
14+
name = "aide"
15+
version = "*"
16+
</fix>
17+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
18+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
19+
</check>
20+
</Rule>
21+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_2">
22+
<title>Define /home</title>
23+
<fix system="urn:redhat:osbuild:blueprint">
24+
[[customizations.filesystem]]
25+
mountpoint = "/home"
26+
size = 1
27+
</fix>
28+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
29+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
30+
</check>
31+
</Rule>
32+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_3">
33+
<title>Add audit=1 kernel option</title>
34+
<fix system="urn:redhat:osbuild:blueprint">
35+
[customizations.kernel]
36+
append = "audit=1"
37+
</fix>
38+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
39+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
40+
</check>
41+
</Rule>
42+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_4">
43+
<title>Add foo=bar kernel option</title>
44+
<fix system="urn:redhat:osbuild:blueprint">
45+
[customizations.kernel]
46+
append = "foo=bar"
47+
</fix>
48+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
49+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
50+
</check>
51+
</Rule>
52+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_5">
53+
<title>Define /tmp</title>
54+
<fix system="urn:redhat:osbuild:blueprint">
55+
[[customizations.filesystem]]
56+
mountpoint = "/tmp"
57+
size = 2
58+
</fix>
59+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
60+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
61+
</check>
62+
</Rule>
63+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_6">
64+
<title>Enable usbguard</title>
65+
<fix system="urn:redhat:osbuild:blueprint">
66+
[customizations.services]
67+
enabled = ["usbguard"]
68+
</fix>
69+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
70+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
71+
</check>
72+
</Rule>
73+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_7">
74+
<title>Disable kdump</title>
75+
<fix system="urn:redhat:osbuild:blueprint">
76+
[customizations.services]
77+
disabled = ["kdump"]
78+
</fix>
79+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
80+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
81+
</check>
82+
</Rule>
83+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_8">
84+
<title>Set distro (RHEL 8.0)</title>
85+
<fix system="urn:redhat:osbuild:blueprint">
86+
distro = rhel-80
87+
</fix>
88+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
89+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
90+
</check>
91+
</Rule>
92+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_9">
93+
<title>Enable sshd</title>
94+
<fix system="urn:redhat:osbuild:blueprint">
95+
[customizations.services]
96+
enabled = ["sshd"]
97+
</fix>
98+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
99+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
100+
</check>
101+
</Rule>
102+
<Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_10">
103+
<title>Enable sshd</title>
104+
<fix system="urn:redhat:osbuild:blueprint">
105+
[customizations.services]
106+
enabled = ["sshd"]
107+
</fix>
108+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
109+
<check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
110+
</check>
111+
</Rule>
112+
</Benchmark>

0 commit comments

Comments
 (0)