Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't scan dir with preconfigured sysctls #8718

Merged
merged 5 commits into from
May 16, 2022
Merged

Don't scan dir with preconfigured sysctls #8718

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0fc94c3
Don't scan dir with preconfigured sysctls in RHEL
yuumasato May 5, 2022
149fd27
Document recent changes to sysctl template
yuumasato May 6, 2022
219d97b
Don't scan /usr/lib/sysctl.d/ for conf files
yuumasato May 10, 2022
66020fc
Sysctl: template Remediate files in /run/sysctl.d
yuumasato May 10, 2022
9cdc4fe
Fix typo and update docs
yuumasato May 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion docs/templates/template_reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -788,10 +788,20 @@ The selected value can be changed in the profile (consult the actual variable fo
```

#### sysctl
- Checks sysctl parameters. The OVAL definition checks both
- Checks sysctl parameters. The OVAL definition checks both static
configuration and runtime settings and require both of them to be
set to the desired value to return true.

The following file and directories are checked for static
sysctl configurations:
- /etc/sysct.conf
yuumasato marked this conversation as resolved.
Show resolved Hide resolved
- /etc/sysct.d/\*.conf
yuumasato marked this conversation as resolved.
Show resolved Hide resolved
- /run/sysct.d/\*.conf
yuumasato marked this conversation as resolved.
Show resolved Hide resolved
- /usr/lib/sysct.d/\*.conf (does not apply to RHEL)
yuumasato marked this conversation as resolved.
Show resolved Hide resolved

A sysctl option defined in more than one file within the scanned directories
will result in `fail`.

- Parameters:

- **sysctlvar** - name of the sysctl value, eg.
Expand Down
9 changes: 9 additions & 0 deletions ...s/sysctl_net_ipv4_conf_default_accept_source_route/tests/wrong_value_run_sysctl_d.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#!/bin/bash

# Clean sysctl config directories
rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*

sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_source_route = 1" >> /run/sysctl.d/run.conf
# Setting correct runtime value
sysctl -w net.ipv4.conf.default.accept_source_route=0
4 changes: 3 additions & 1 deletion shared/templates/sysctl/ansible.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@

- name: List /etc/sysctl.d/*.conf files
find:
paths: "/etc/sysctl.d/"
paths:
- "/etc/sysctl.d/"
- "/run/sysctl.d/"
contains: '^[\s]*{{{ SYSCTLVAR }}}.*$'
patterns: "*.conf"
register: find_sysctl_d
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/sysctl/bash.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# disruption = medium

# Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf ; do
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
matching_list=$(grep -P '^(?!#).*[\s]*{{{ SYSCTLVAR }}}.*$' $f | uniq )
if ! test -z "$matching_list"; then
while IFS= read -r entry; do
Expand Down
8 changes: 8 additions & 0 deletions shared/templates/sysctl/oval.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,10 @@
test_ref="test_static_etc_sysctld_{{{ SYSCTLID }}}"/>
<criterion comment="kernel static parameter {{{ SYSCTLVAR }}} set to {{{ COMMENT_VALUE }}} in /run/sysctl.d/*.conf"
test_ref="test_static_run_sysctld_{{{ SYSCTLID }}}"/>
{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}}
<criterion comment="kernel static parameter {{{ SYSCTLVAR }}} set to {{{ COMMENT_VALUE }}} in /usr/lib/sysctl.d/*.conf"
test_ref="test_static_usr_lib_sysctld_{{{ SYSCTLID }}}"/>
{{% endif %}}
</criteria>
<criterion comment="Check that {{{ SYSCTLID }}} is defined in only one file" test_ref="test_sysctl_{{{ SYSCTLID }}}_defined_in_one_file" />
</criteria>
Expand All @@ -134,11 +136,13 @@
{{{ state_static_sysctld("run_sysctld") }}}
</ind:textfilecontent54_test>

{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}}
<ind:textfilecontent54_test id="test_static_usr_lib_sysctld_{{{ SYSCTLID }}}" version="1"
check="all"
comment="{{{ SYSCTLVAR }}} static configuration in /etc/sysctl.d/*.conf">
{{{ state_static_sysctld("usr_lib_sysctld") }}}
</ind:textfilecontent54_test>
{{% endif %}}

<ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains {{{ SYSCTLID }}}"
id="test_sysctl_{{{ SYSCTLID }}}_defined_in_one_file" version="1">
Expand Down Expand Up @@ -238,7 +242,9 @@
<ind:textfilecontent54_object id="object_static_run_usr_sysctls_{{{ SYSCTLID }}}" version="1">
<set>
<object_reference>object_static_run_sysctld_{{{ SYSCTLID }}}</object_reference>
{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}}
<object_reference>object_static_usr_lib_sysctld_{{{ SYSCTLID }}}</object_reference>
{{% endif %}}
</set>
</ind:textfilecontent54_object>

Expand All @@ -259,11 +265,13 @@
{{{ sysctl_match() }}}
</ind:textfilecontent54_object>

{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}}
<ind:textfilecontent54_object id="object_static_usr_lib_sysctld_{{{ SYSCTLID }}}" version="1">
<ind:path>/usr/lib/sysctl.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
{{{ sysctl_match() }}}
</ind:textfilecontent54_object>
{{% endif %}}
{{% if SYSCTLVAL == "" %}}

<ind:textfilecontent54_state id="state_static_sysctld_{{{ SYSCTLID }}}" version="1">
Expand Down