Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SLE add ability to configure emergency via dropin #10482

Merged
merged 3 commits into from
May 10, 2023
Merged

SLE add ability to configure emergency via dropin #10482

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
23af3a8
SLE add ability to configure emergency via dropin
teacup-on-rockingchair Apr 24, 2023
d1fe359
Improve indentation in oval definitions
teacup-on-rockingchair May 9, 2023
02f4dc8
Remove deadcode
teacup-on-rockingchair May 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion .../guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,23 @@
# complexity = low
# disruption = low

{{% if 'sle' in product %}}
- name: Require emergency mode password
ansible.builtin.blockinfile:
create: yes
dest: /etc/systemd/system/emergency.service.d/10-oscap.conf
block: |
[Service]
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
{{% else %}}
- name: Require emergency mode password
lineinfile:
create: yes
dest: /usr/lib/systemd/system/emergency.service
regexp: "^#?ExecStart="
{{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9","sle12", "sle15"] -%}}
{{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] -%}}
line: "ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency"
{{%- else -%}}
line: 'ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"'
{{%- endif %}}
{{% endif %}}
11 changes: 11 additions & 0 deletions ...x_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,26 @@
# platform = multi_platform_all

{{% if 'sle' in product %}}
service_dropin_cfg_dir="/etc/systemd/system/emergency.service.d"
service_dropin_file="${service_dropin_cfg_dir}/10-oscap.conf"
{{% else %}}
service_file="/usr/lib/systemd/system/emergency.service"
{{% endif %}}

{{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9", "sle12", "sle15"] -%}}
sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency"
{{%- else -%}}
sulogin='/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"'
{{%- endif %}}

{{% if 'sle' in product %}}
mkdir -p "${service_dropin_cfg_dir}"
echo "[Service]" >> "${service_dropin_file}"
echo "ExecStart=-$sulogin" >> "${service_dropin_file}"
{{% else %}}
if grep "^ExecStart=.*" "$service_file" ; then
sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
echo "ExecStart=-$sulogin" >> "$service_file"
fi
{{% endif %}}
56 changes: 50 additions & 6 deletions ..._os/guide/system/accounts/accounts-physical/require_emergency_target_auth/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,25 @@
<definition class="compliance" id="require_emergency_target_auth" version="1">
{{{ oval_metadata("The requirement for a password to boot into emergency mode
should be configured correctly.") }}}
<criteria operator="AND">
<criterion comment="Conditions are satisfied"
test_ref="test_require_emergency_service" />
<criterion test_ref="test_require_emergency_service_emergency_target" />
<criterion test_ref="test_no_custom_emergency_target" negate="true"/>
<criterion test_ref="test_no_custom_emergency_service" negate="true"/>
{{% if 'sle' in product %}}
<criteria operator="OR">
{{% endif %}}
<criteria operator="AND">
<criterion comment="Conditions are satisfied"
test_ref="test_require_emergency_service" />
<criterion test_ref="test_require_emergency_service_emergency_target" />
<criterion test_ref="test_no_custom_emergency_target" negate="true"/>
<criterion test_ref="test_no_custom_emergency_service" negate="true"/>
</criteria>
{{% if 'sle' in product %}}
<criteria operator="OR">
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<criterion comment="Check /usr/lib/* configuration"
test_ref="test_require_emergency_service" />
<criterion comment="Check drop-in configuration"
test_ref="test_require_emergency_service_dropin" />
</criteria>
</criteria>
{{% endif %}}
</definition>
<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Tests that
Expand All @@ -32,6 +44,23 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

{{% if 'sle' in product %}}
<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Tests that
/usr/lib/systemd/systemd-sulogin-shell
was not removed from the default systemd emergency.service to ensure that a
password must be entered to access single user mode"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_require_emergency_service_dropin" version="1">
<ind:object object_ref="obj_require_emergency_service_dropin" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_require_emergency_service_dropin" version="1">
<ind:path>/etc/systemd/system/emergency.service.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% endif %}}

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Tests that the systemd emergency.service is in the emergency.target"
id="test_require_emergency_service_emergency_target" version="1">
Expand Down Expand Up @@ -66,4 +95,19 @@
<unix:path operation="equals">/etc/systemd/system</unix:path>
<unix:filename operation="pattern match">^emergency.target$</unix:filename>
</unix:file_object>

<unix:file_test check="all" check_existence="at_least_one_exists"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
comment="look for emergency.target in /etc/systemd/system/emergency.service.d"
id="test_no_custom_emergency_target_dropin" version="1">
<unix:object object_ref="object_no_custom_emergency_target_dropin" />
</unix:file_test>

<unix:file_object id="object_no_custom_emergency_target_dropin"
comment="look for emergency.target in /etc/systemd/system/emergency.service.d"
version="1">
<unix:behaviors recurse="directories" recurse_direction="down"
recurse_file_system="all" />
<unix:path operation="equals">/etc/systemd/system/emergency.service.d</unix:path>
<unix:filename operation="pattern match">^*.conf$</unix:filename>
</unix:file_object>
</def-group>