Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ea9e83a

Browse files
author
Jan Lieskovsky
committed
[RHEL/7] Version ComplianceAsCode#2 of service_disabled (unix:file_test) template for systemd.
 Service is considered disabled if: * corresponding RPM isn't installed OR, * particular service got masked OR, * particular service is disabled on boot AND not enabled at runtime. Also apply that template against abrtd service for testing.
1 parent 62722ef commit ea9e83a

File tree

12 files changed

+242
-27
lines changed

12 files changed

+242
-27
lines changed

‎RHEL/6/input/checks/package_abrt_removed.xml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎RHEL/6/input/checks/package_abrt_removed.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../shared/oval/package_abrt_removed.xml

‎RHEL/7/input/checks/package_abrt_removed.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../shared/oval/package_abrt_removed.xml

‎RHEL/7/input/checks/service_abrtd_disabled.xml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
<def-group>
2+
<!-- THIS FILE IS GENERATED by create_services_disabled.py according to RHEL-7 template
3+
from RHEL/7/input/checks/templates/template_service_disabled. DO NOT EDIT.
4+
5+
IF REQUIRED INSTEAD OF EDITING THIS FILE RATHER EDIT THAT TEMPLATE DIRECTLY.
6+
AFTER THAT BE SURE TO REGENERATE ALL CORRESPONDING UNCOMMENTED CHECKS FROM
7+
service_disabled.csv CSV FILE AND PLACE THOSE NEW OVAL VERSIONS into
8+
RHEL/7/input/checks DIRECTORY REPLACING THE FORMER ONES
9+
-->
10+
11+
<definition class="compliance" id="service_abrtd_disabled" version="1">
12+
<metadata>
13+
<title>Service abrtd Disabled</title>
14+
<affected family="unix">
15+
<platform>Red Hat Enterprise Linux 7</platform>
16+
</affected>
17+
<description>The abrtd service should be disabled if possible.</description>
18+
<reference source="JL" ref_id="20140921" ref_url="test_attestation"/>
19+
</metadata>
20+
<criteria operator="OR" comment="package abrt removed or service abrtd is not configured to start">
21+
<extend_definition comment="abrt removed" definition_ref="package_abrt_removed" />
22+
<criteria operator="OR" comment="service abrtd is not configured to start">
23+
<criterion comment="abrtd masked" test_ref="test_abrtd_masked" />
24+
<criteria operator="AND" comment="service abrtd is disabled on boot and not enabled at runtime">
25+
<criterion comment="abrtd disabled on boot" test_ref="test_abrtd_disabled_on_boot" />
26+
<criterion comment="abrtd not enabled at runtime" test_ref="test_abrtd_runtime_not_enabled" />
27+
</criteria>
28+
</criteria>
29+
</criteria>
30+
</definition>
31+
32+
<!-- Test if abrtd is masked -->
33+
<unix:file_test id="test_abrtd_masked" check="all" check_existence="at_least_one_exists" comment="Test if abrtd is masked" version="1">
34+
<unix:object object_ref="object_abrtd_masked" />
35+
</unix:file_test>
36+
37+
<unix:file_object id="object_abrtd_masked" comment="/etc/systemd/system/abrtd.service exists" version="1">
38+
<unix:filepath>/etc/systemd/system/abrtd.service</unix:filepath>
39+
</unix:file_object>
40+
41+
<!-- Test if abrtd is disabled for all targets on boot -->
42+
<unix:file_test id="test_abrtd_disabled_on_boot" check="all" check_existence="none_exist" comment="Test if abrtd not enabled on boot" version="1">
43+
<unix:object object_ref="object_abrtd_disabled_on_boot" />
44+
</unix:file_test>
45+
46+
<unix:file_object id="object_abrtd_disabled_on_boot" comment="No /etc/systemd/system/*.wants/abrtd.service exists" version="1">
47+
<!-- Don't follow symbolic links below to search just through /etc/systemd/system/* content -->
48+
<unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
49+
<unix:path>/etc/systemd/system</unix:path>
50+
<unix:filename>abrtd.service</unix:filename>
51+
<!-- Include all symbolic link entities in the /etc/systemd/system directory tree -->
52+
<filter action="include">state_abrtd_symlink</filter>
53+
<!-- But exclude that one causing service to be masked -->
54+
<filter action="exclude">state_abrtd_masked_symlink</filter>
55+
</unix:file_object>
56+
57+
<unix:file_state id="state_abrtd_symlink" version="1">
58+
<unix:type>symbolic link</unix:type>
59+
</unix:file_state>
60+
61+
<unix:file_state id="state_abrtd_masked_symlink" version="1">
62+
<unix:filepath>/etc/systemd/system/abrtd.service</unix:filepath>
63+
</unix:file_state>
64+
65+
<!-- Test if abrtd is not enabled at runtime -->
66+
<unix:file_test id="test_abrtd_runtime_not_enabled" check="all" check_existence="none_exist" comment="Test if abrtd not enabled at runtime" version="1">
67+
<unix:object object_ref="object_abrtd_runtime_not_enabled" />
68+
</unix:file_test>
69+
70+
<unix:file_object id="object_abrtd_runtime_not_enabled" comment="No /run/systemd/system/*.wants/abrtd.service exists" version="1">
71+
<!-- Don't follow symbolic links below to search just through /run/systemd/system/* content -->
72+
<unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
73+
<unix:path>/run/systemd/system</unix:path>
74+
<unix:filename>abrtd.service</unix:filename>
75+
<!-- Include all symbolic link entities in the /run/systemd/system directory tree -->
76+
<filter action="include">state_abrtd_symlink</filter>
77+
</unix:file_object>
78+
79+
</def-group>

‎RHEL/7/input/checks/templates/Makefile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
templates: services packages
2+
3+
SHARED_DIR=../../../../../shared/oval/templates
4+
5+
services:
6+
${SHARED_DIR}/create_services_disabled.py services_disabled.csv
7+
8+
packages:
9+
${SHARED_DIR}/create_package_removed.py packages_removed.csv
10+
11+
compare:
12+
diff output/ ../ | grep -v "Only in ../"
13+
14+
copy:
15+
cp output/*.xml ../
16+
cp output/*.sh ../../fixes/bash/
17+
18+
find-untemplated: templates
19+
./find_untemplated.py
20+
21+
clean:
22+
rm -f output/*.xml
23+
rm -f output/*.sh

‎RHEL/7/input/checks/templates/output/.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# files to ignore
2+
*.xml
3+
*.sh

‎RHEL/7/input/checks/templates/packages_removed.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
abrt

‎RHEL/7/input/checks/templates/services_disabled.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
abrtd,abrt

‎RHEL/7/input/checks/templates/template_package_removed‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<def-group>
2+
<!-- THIS FILE IS GENERATED by create_package_removed.py. DO NOT EDIT. -->
3+
<definition class="compliance" id="package_PKGNAME_removed"
4+
version="1">
5+
<metadata>
6+
<title>Package PKGNAME Removed</title>
7+
<affected family="unix">
8+
<platform>Red Hat Enterprise Linux 7</platform>
9+
</affected>
10+
<description>The RPM package PKGNAME should be removed.</description>
11+
<reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
12+
</metadata>
13+
<criteria>
14+
<criterion comment="package PKGNAME is removed"
15+
test_ref="test_package_PKGNAME_removed" />
16+
</criteria>
17+
</definition>
18+
<linux:rpminfo_test check="all" check_existence="none_exist"
19+
id="test_package_PKGNAME_removed" version="1"
20+
comment="package PKGNAME is removed">
21+
<linux:object object_ref="obj_package_PKGNAME_removed" />
22+
</linux:rpminfo_test>
23+
<linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
24+
<linux:name>PKGNAME</linux:name>
25+
</linux:rpminfo_object>
26+
</def-group>

‎RHEL/7/input/checks/templates/template_service_disabled‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<def-group>
2+
<!-- THIS FILE IS GENERATED by create_services_disabled.py according to RHEL-7 template
3+
from RHEL/7/input/checks/templates/template_service_disabled. DO NOT EDIT.
4+
5+
IF REQUIRED INSTEAD OF EDITING THIS FILE RATHER EDIT THAT TEMPLATE DIRECTLY.
6+
AFTER THAT BE SURE TO REGENERATE ALL CORRESPONDING UNCOMMENTED CHECKS FROM
7+
service_disabled.csv CSV FILE AND PLACE THOSE NEW OVAL VERSIONS into
8+
RHEL/7/input/checks DIRECTORY REPLACING THE FORMER ONES
9+
-->
10+
11+
<definition class="compliance" id="service_SERVICENAME_disabled" version="1">
12+
<metadata>
13+
<title>Service SERVICENAME Disabled</title>
14+
<affected family="unix">
15+
<platform>Red Hat Enterprise Linux 7</platform>
16+
</affected>
17+
<description>The SERVICENAME service should be disabled if possible.</description>
18+
</metadata>
19+
<criteria operator="OR" comment="package PACKAGENAME removed or service SERVICENAME is not configured to start">
20+
<extend_definition comment="PACKAGENAME removed" definition_ref="package_PACKAGENAME_removed" />
21+
<criteria operator="OR" comment="service SERVICENAME is not configured to start">
22+
<criterion comment="SERVICENAME masked" test_ref="test_SERVICENAME_masked" />
23+
<criteria operator="AND" comment="service SERVICENAME is disabled on boot and not enabled at runtime">
24+
<criterion comment="SERVICENAME disabled on boot" test_ref="test_SERVICENAME_disabled_on_boot" />
25+
<criterion comment="SERVICENAME not enabled at runtime" test_ref="test_SERVICENAME_runtime_not_enabled" />
26+
</criteria>
27+
</criteria>
28+
</criteria>
29+
</definition>
30+
31+
<!-- Test if SERVICENAME is masked -->
32+
<unix:file_test id="test_SERVICENAME_masked" check="all" check_existence="at_least_one_exists" comment="Test if SERVICENAME is masked" version="1">
33+
<unix:object object_ref="object_SERVICENAME_masked" />
34+
</unix:file_test>
35+
36+
<unix:file_object id="object_SERVICENAME_masked" comment="/etc/systemd/system/SERVICENAME.service exists" version="1">
37+
<unix:filepath>/etc/systemd/system/SERVICENAME.service</unix:filepath>
38+
</unix:file_object>
39+
40+
<!-- Test if SERVICENAME is disabled for all targets on boot -->
41+
<unix:file_test id="test_SERVICENAME_disabled_on_boot" check="all" check_existence="none_exist" comment="Test if SERVICENAME not enabled on boot" version="1">
42+
<unix:object object_ref="object_SERVICENAME_disabled_on_boot" />
43+
</unix:file_test>
44+
45+
<unix:file_object id="object_SERVICENAME_disabled_on_boot" comment="No /etc/systemd/system/*.wants/SERVICENAME.service exists" version="1">
46+
<!-- Don't follow symbolic links below to search just through /etc/systemd/system/* content -->
47+
<unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
48+
<unix:path>/etc/systemd/system</unix:path>
49+
<unix:filename>SERVICENAME.service</unix:filename>
50+
<!-- Include all symbolic link entities in the /etc/systemd/system directory tree -->
51+
<filter action="include">state_SERVICENAME_symlink</filter>
52+
<!-- But exclude that one causing service to be masked -->
53+
<filter action="exclude">state_SERVICENAME_masked_symlink</filter>
54+
</unix:file_object>
55+
56+
<unix:file_state id="state_SERVICENAME_symlink" version="1">
57+
<unix:type>symbolic link</unix:type>
58+
</unix:file_state>
59+
60+
<unix:file_state id="state_SERVICENAME_masked_symlink" version="1">
61+
<unix:filepath>/etc/systemd/system/SERVICENAME.service</unix:filepath>
62+
</unix:file_state>
63+
64+
<!-- Test if SERVICENAME is not enabled at runtime -->
65+
<unix:file_test id="test_SERVICENAME_runtime_not_enabled" check="all" check_existence="none_exist" comment="Test if SERVICENAME not enabled at runtime" version="1">
66+
<unix:object object_ref="object_SERVICENAME_runtime_not_enabled" />
67+
</unix:file_test>
68+
69+
<unix:file_object id="object_SERVICENAME_runtime_not_enabled" comment="No /run/systemd/system/*.wants/SERVICENAME.service exists" version="1">
70+
<!-- Don't follow symbolic links below to search just through /run/systemd/system/* content -->
71+
<unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
72+
<unix:path>/run/systemd/system</unix:path>
73+
<unix:filename>SERVICENAME.service</unix:filename>
74+
<!-- Include all symbolic link entities in the /run/systemd/system directory tree -->
75+
<filter action="include">state_SERVICENAME_symlink</filter>
76+
</unix:file_object>
77+
78+
</def-group>

0 commit comments

Comments
 (0)