Skip to content

Commit b7f6aa3

Browse files
evgenyzevgenyz
authored
Merge pull request #1985 from 0intro/shadow-offline
Add offline capabilities to the shadow OVAL probe
2 parents a045994 + 7b26ed9 commit b7f6aa3

File tree

6 files changed

+166
-27
lines changed

6 files changed

+166
-27
lines changed

‎src/OVAL/probes/probe-table.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ static const probe_table_entry_t probe_table[] = {
329329
{OVAL_UNIX_RUNLEVEL, NULL, runlevel_probe_main, NULL, runlevel_probe_offline_mode_supported},
330330
#endif
331331
#ifdef OPENSCAP_PROBE_UNIX_SHADOW
332-
{OVAL_UNIX_SHADOW, NULL, shadow_probe_main, NULL, NULL},
332+
{OVAL_UNIX_SHADOW, NULL, shadow_probe_main, NULL, shadow_probe_offline_mode_supported},
333333
#endif
334334
#ifdef OPENSCAP_PROBE_UNIX_SYMLINK
335335
{OVAL_UNIX_SYMLINK, NULL, symlink_probe_main, NULL, symlink_probe_offline_mode_supported},

‎src/OVAL/probes/unix/shadow_probe.c

Lines changed: 52 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -177,36 +177,62 @@ static void report_finding(struct result_info *res, probe_ctx *ctx)
177177
SEXP_free_r(&se_flg_mem);
178178
}
179179

180+
static void _process_struct_shadow(struct spwd *sp, SEXP_t *un_ent, probe_ctx *ctx)
181+
{
182+
SEXP_t *un;
183+
struct result_info r;
184+
185+
dI("Have user: %s", sp->sp_namp);
186+
un = SEXP_string_newf("%s", sp->sp_namp);
187+
if (probe_entobj_cmp(un_ent, un) != OVAL_RESULT_TRUE) {
188+
SEXP_free(un);
189+
return;
190+
}
191+
192+
r.username = sp->sp_namp;
193+
r.password = sp->sp_pwdp;
194+
r.chg_lst = sp->sp_lstchg;
195+
r.chg_allow = sp->sp_min;
196+
r.chg_req = sp->sp_max;
197+
r.exp_warn = sp->sp_warn;
198+
r.exp_inact = sp->sp_inact;
199+
r.exp_date = sp->sp_expire;
200+
r.flag = sp->sp_flag;
201+
202+
report_finding(&r, ctx);
203+
SEXP_free(un);
204+
}
205+
180206
static int read_shadow(SEXP_t *un_ent, probe_ctx *ctx)
181207
{
182-
int err = 1;
183-
struct spwd *pw;
184-
185-
while ((pw = getspent())) {
186-
SEXP_t *un;
187-
188-
dI("Have user: %s", pw->sp_namp);
189-
err = 0;
190-
un = SEXP_string_newf("%s", pw->sp_namp);
191-
if (probe_entobj_cmp(un_ent, un) == OVAL_RESULT_TRUE) {
192-
struct result_info r;
193-
194-
r.username = pw->sp_namp;
195-
r.password = pw->sp_pwdp;
196-
r.chg_lst = pw->sp_lstchg;
197-
r.chg_allow = pw->sp_min;
198-
r.chg_req = pw->sp_max;
199-
r.exp_warn = pw->sp_warn;
200-
r.exp_inact = pw->sp_inact;
201-
r.exp_date = pw->sp_expire;
202-
r.flag = pw->sp_flag;
203-
204-
report_finding(&r, ctx);
208+
struct spwd *sp;
209+
210+
if (ctx->offline_mode & PROBE_OFFLINE_OWN) {
211+
const char *root = getenv("OSCAP_PROBE_ROOT");
212+
char *shadow_file_path = oscap_path_join(root, "/etc/shadow");
213+
FILE *fp = fopen(shadow_file_path, "r");
214+
if (fp == NULL) {
215+
free(shadow_file_path);
216+
return 1;
205217
}
206-
SEXP_free(un);
218+
while ((sp = fgetspent(fp))) {
219+
_process_struct_shadow(sp, un_ent, ctx);
220+
}
221+
fclose(fp);
222+
free(shadow_file_path);
223+
} else {
224+
while ((sp = getspent())) {
225+
_process_struct_shadow(sp, un_ent, ctx);
226+
}
227+
endspent();
207228
}
208-
endspent();
209-
return err;
229+
230+
return 0;
231+
}
232+
233+
int shadow_probe_offline_mode_supported()
234+
{
235+
return PROBE_OFFLINE_OWN;
210236
}
211237

212238
int shadow_probe_main(probe_ctx *ctx, void *arg)

‎src/OVAL/probes/unix/shadow_probe.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525

2626
#include "probe-api.h"
2727

28+
int shadow_probe_offline_mode_supported(void);
2829
int shadow_probe_main(probe_ctx *ctx, void *arg);
2930

3031
#endif /* OPENSCAP_SHADOW_PROBE_H */

‎tests/probes/shadow/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
if(ENABLE_PROBES_UNIX)
22
add_oscap_test("test_probes_shadow.sh")
3+
add_oscap_test("test_probes_shadow_offline.sh")
34
endif()

‎tests/probes/shadow/test_probes_shadow_offline.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2009 Red Hat Inc., Durham, North Carolina.
4+
# All Rights Reserved.
5+
#
6+
# OpenScap Probes Test Suite.
7+
#
8+
# Created on: Nov 30, 2009
9+
#
10+
# Authors:
11+
# Peter Vrabec, <[email protected]>
12+
# David Niemoller
13+
# Ondrej Moris, <[email protected]>
14+
15+
. $builddir/tests/test_common.sh
16+
17+
set -e -o pipefail
18+
19+
# Test Cases.
20+
21+
function test_probes_shadow {
22+
23+
probecheck "shadow" || return 255
24+
25+
local ret_val=0;
26+
local DF="${srcdir}/test_probes_shadow_offline.xml"
27+
local RF="results.xml"
28+
29+
[ -f $RF ] && rm -f $RF
30+
31+
tmpdir=$(make_temp_dir /tmp "test_offline_mode_shadow")
32+
mkdir -p "${tmpdir}/etc"
33+
echo "root:!locked::0:99999:7:::" > "${tmpdir}/etc/shadow"
34+
set_chroot_offline_test_mode "${tmpdir}"
35+
36+
$OSCAP oval eval --results $RF $DF
37+
38+
unset_chroot_offline_test_mode
39+
rm -rf "${tmpdir}"
40+
41+
if [ -f $RF ]; then
42+
verify_results "def" $DF $RF 1 && verify_results "tst" $DF $RF $LINES
43+
ret_val=$?
44+
else
45+
ret_val=1
46+
fi
47+
48+
return $ret_val
49+
}
50+
51+
# Testing.
52+
53+
test_init
54+
55+
test_run "test_probes_shadow" test_probes_shadow
56+
57+
test_exit

‎tests/probes/shadow/test_probes_shadow_offline.xml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0"?>
2+
<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
3+
4+
<generator>
5+
<oval:product_name>shadow</oval:product_name>
6+
<oval:product_version>1.0</oval:product_version>
7+
<oval:schema_version>5.4</oval:schema_version>
8+
<oval:timestamp>2008-03-31T00:00:00-00:00</oval:timestamp>
9+
</generator>
10+
11+
<definitions>
12+
13+
<definition class="compliance" version="1" id="oval:1:def:1"> <!-- comment="true" -->
14+
<metadata>
15+
<title></title>
16+
<description></description>
17+
</metadata>
18+
<criteria>
19+
<criteria operator="AND">
20+
<criterion test_ref="oval:1:tst:1"/>
21+
</criteria>
22+
</criteria>
23+
</definition>
24+
25+
</definitions>
26+
27+
<tests>
28+
29+
<shadow_test version="1" id="oval:1:tst:1" check="all" comment="true" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
30+
<object object_ref="oval:1:obj:1"/>
31+
<state state_ref="oval:1:ste:1"/>
32+
</shadow_test>
33+
</tests>
34+
35+
<objects>
36+
<shadow_object version="1" id="oval:1:obj:1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
37+
<username>root</username>
38+
</shadow_object>
39+
</objects>
40+
41+
<states>
42+
<shadow_state version="1" id="oval:1:ste:1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
43+
<username>root</username>
44+
<password>!locked</password>
45+
<chg_lst datatype="int">-1</chg_lst>
46+
<chg_allow datatype="int">0</chg_allow>
47+
<chg_req datatype="int">99999</chg_req>
48+
<exp_warn datatype="int">7</exp_warn>
49+
<exp_inact datatype="int">-1</exp_inact>
50+
<exp_date datatype="int">-1</exp_date>
51+
</shadow_state>
52+
</states>
53+
54+
</oval_definitions>

0 commit comments

Comments
 (0)