8000 Improve bash/ansible_ensure_pam_module_option macros by teacup-on-rockingchair · Pull Request #13405 · ComplianceAsCode/content · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Improve bash/ansible_ensure_pam_module_option macros #13405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
May 5, 2025
Merged

Improve bash/ansible_ensure_pam_module_option macros #13405

merged 2 commits into from
May 5, 2025

Conversation

teacup-on-rockingchair
Copy link
Contributor

Description:

  • Make sure that bash/ansible_ensure_pam_module_option can handle situation in which option with value is not set correctly

Rationale:

  • Current implementation was failing in case the pam option(i.e. deny) is set but to an empty value ,i.e. instead of deny=5, if we have the deny= or even deny=-3 the regex will fail to match the option

@teacup-on-rockingchair
Improve bash/ansible_ensure_pam_module_option macros
047d4d7 
Make sure that bash/ansible_ensure_pam_module_option can handle situation in which option with value is not set correctly

Current implementation was failing in case the pam option(i.e. deny) is set but to an empty value ,i.e.
instead of `deny=5`, if we have the `deny= ` or even `deny=-3` the regex will fail to match the option
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 29, 2025
@openshift-ci OpenShift CI
Copy link
openshift-ci bot commented Apr 29, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@teacup-on-rockingchair teacup-on-rockingchair added Ansible Ansible remediation update. Bash Bash remediation update. Update Template Issues or pull requests related to Templates updates. labels Apr 29, 2025
@teacup-on-rockingchair teacup-on-rockingchair added this to the 0.1.77 milestone Apr 29, 2025
@github-actions GitHub Actions
Copy link

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff 
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -202,7 +202,7 @@
     if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
         sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
     else
-        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
+        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
     fi
     if [ -f /usr/bin/authselect ]; then
         

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -871,7 +871,7 @@
     ansible.builtin.lineinfile:
       path: '{{ pam_file_path }}'
       backrefs: true
-      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
+      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]*\s*(.*)
       line: \1\2={{ var_password_pam_remember }} \3
     register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_edit
     when:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -202,7 +202,7 @@
     if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
         sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
     else
-        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
+        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
     fi
     if [ -f /usr/bin/authselect ]; then
         

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -870,7 +870,7 @@
     ansible.builtin.lineinfile:
       path: '{{ pam_file_path }}'
       backrefs: true
-      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
+      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]*\s*(.*)
       line: \1\2={{ var_password_pam_remember }} \3
     register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_edit
     when:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -203,7 +203,7 @@
     if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
         sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_unix_remember/" "$PAM_FILE_PATH"
     else
-        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_remember \3/" "$PAM_FILE_PATH"
+        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_unix_remember \3/" "$PAM_FILE_PATH"
     fi
     if [ -f /usr/bin/authselect ]; then
         

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -841,7 +841,7 @@
     ansible.builtin.lineinfile:
       path: '{{ pam_file_path }}'
       backrefs: true
-      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
+      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]*\s*(.*)
       line: \1\2={{ var_password_pam_unix_remember }} \3
     register: result_pam_accounts_password_pam_unix_remember_edit
     when:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -58,7 +58,7 @@
         if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\srounds\b" "$PAM_FILE_PATH"; then
             sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ rounds=$var_password_pam_unix_rounds/" "$PAM_FILE_PATH"
         else
-            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
+            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
         fi
     if [ -f /usr/bin/authselect ]; then
         

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -283,7 +283,7 @@
     ansible.builtin.lineinfile:
       path: '{{ pam_file_path }}'
       backrefs: true
-      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]+\s*(.*)
+      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]*\s*(.*)
       line: \1\2={{ var_password_pam_unix_rounds }} \3
     register: result_pam_accounts_password_pam_unix_rounds_password_auth_edit
     when:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -57,7 +57,7 @@
         if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\srounds\b" "$PAM_FILE_PATH"; then
             sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ rounds=$var_password_pam_unix_rounds/" "$PAM_FILE_PATH"
         else
-            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
+            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
         fi
     if [ -f /usr/bin/authselect ]; then
         

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -283,7 +283,7 @@
     ansible.builtin.lineinfile:
       path: '{{ pam_file_path }}'
       backrefs: true
-      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]+\s*(.*)
+      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]*\s*(.*)
       line: \1\2={{ var_password_pam_unix_rounds }} \3
     register: result_pam_accounts_password_pam_unix_rounds_system_auth_edit
     when:

@teacup-on-rockingchair teacup-on-rockingchair marked this pull request as ready for review May 2, 2025 13:28
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label May 2, 2025
@codeclimate CodeClimate
Copy link
codeclimate bot commented May 2, 2025

Code Climate has analyzed commit 785b8fe and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

@jan-cerny jan-cerny self-assigned this May 5, 2025
jan-cerny
jan-cerny approved these changes May 5, 2025
View reviewed changes
Copy link
Collaborator
@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have run automatus tests locally:

jcerny@fedora:~/work/git/scap-security-guide (pr/13405)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 sssd_enable_smartcards
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-05-05-0934/test_suite.log
WARNING - Script 'sssd_parameter_false.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_missing.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_missing_file.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_true.pass.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
INFO - xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_disabled.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled.pass.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_conf_d.pass.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_lower.pass.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false_conf_d.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing_file.fail.sh using profile (all) OK
INFO - Script sssd_parameter_missing_remove_authselect.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13405)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible sssd_enable_smartcards
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-05-05-0939/test_suite.log
WARNING - Script 'sssd_parameter_false.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_missing.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_missing_file.fail.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
WARNING - Script 'sssd_parameter_true.pass.sh' is not applicable on 'rhel9' target because its platform is 'multi_platform_fedora,Oracle Linux 7,Red Hat Virtualization 4'
INFO - xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_disabled.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled.pass.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_conf_d.pass.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_lower.pass.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false_conf_d.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing_file.fail.sh using profile (all) OK
INFO - Script sssd_parameter_missing_remove_authselect.fail.sh using profile (all) OK

@jan-cerny jan-cerny merged commit e79936e into ComplianceAsCode:master May 5, 2025
109 of 110 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes

@matusmarhefka matusmarhefka Awaiting requested review from matusmarhefka matusmarhefka is a code owner

@Mab879 Mab879 Awaiting requested review from Mab879 Mab879 is a code owner

@vojtapolasek vojtapolasek Awaiting requested review from vojtapolasek vojtapolasek is a code owner

Assignees

@jan-cerny jan-cerny

Labels
Ansible Ansible remediation update. Bash Bash remediation update. Update Template Issues or pull requests related to Templates updates.
Projects
None yet
Milestone
0.1.77
Development

Successfully merging this pull request may close these issues.
2 participants
@teacup-on-rockingchair @jan-cerny
0