-
Notifications
You must be signed in to change notification settings - Fork 709
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'origin/master' into u2404_53344
- Loading branch information
Showing
56 changed files
with
860 additions
and
334 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
72 changes: 72 additions & 0 deletions
72
linux_os/guide/services/ntp/file_groupowner_etc_chrony_keys/oval/shared.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| <def-group> | ||
|
|
||
| <definition class="compliance" id="{{{ rule_id }}}" version="1"> | ||
| {{{ oval_metadata("/etc/chrony.keys should be owned by chrony group") }}} | ||
| <criteria operator="OR"> | ||
| <criteria operator="AND"> | ||
| <criterion test_ref="test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles" negate="true" | ||
| comment="The /etc/nsswitch.conf does not use nss-altfiles"/> | ||
| <criterion test_ref="test_file_groupowner_etc_chrony_keys" | ||
| comment="Check group ownership of /etc/chrony.keys"/> | ||
| </criteria> | ||
| <criteria operator="AND"> | ||
| <criterion test_ref="test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles" | ||
| comment="The /etc/nsswitch.conf uses nss-altfiles"/> | ||
| <criterion test_ref="test_file_groupowner_etc_chrony_keys_with_usrlib" | ||
| comment="Check group ownership of /etc/chrony.keys"/> | ||
| </criteria> | ||
| </criteria> | ||
| </definition> | ||
|
|
||
| {{{ oval_test_nsswitch_uses_altfiles() }}} | ||
|
|
||
| <unix:file_test id="test_file_groupowner_etc_chrony_keys" version="1" check="all" comment="Testing group ownership of /etc/chrony.keys" check_existence="none_exist" state_operator="AND"> | ||
| <unix:object object_ref="object_file_groupowner_etc_chrony_keys" /> | ||
| </unix:file_test> | ||
| <unix:file_object id="object_file_groupowner_etc_chrony_keys" version="1" comment="/etc/chrony.keys"> | ||
| <unix:filepath>/etc/chrony.keys</unix:filepath> | ||
| <filter action="exclude">state_file_groupowner_etc_chrony_keys_uid_chrony</filter> | ||
| <filter action="exclude">state_file_groupowner_etc_chrony_keys_gid_chrony</filter> | ||
| </unix:file_object> | ||
| <ind:textfilecontent54_object id="object_file_groupowner_etc_chrony_keys_etc_group" version="1" comment="gid of the dedicated chrony group"> | ||
| <ind:filepath>/etc/group</ind:filepath> | ||
| <ind:pattern operation="pattern match">^chrony:\w+:(\w+):.*</ind:pattern> | ||
| <ind:instance datatype="int" operation="equals">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| <unix:file_state id="state_file_groupowner_etc_chrony_keys_gid_chrony" version="1" operator="AND"> | ||
| <unix:group_id datatype="int" var_ref="var_dedicated_groupowner_etc_chrony_keys_uid_chrony" /> | ||
| </unix:file_state> | ||
| <unix:file_state id="state_file_groupowner_etc_chrony_keys_uid_chrony" version="1" operator="AND"> | ||
| <unix:type operation="equals">symbolic link</unix:type> | ||
| </unix:file_state> | ||
| <local_variable id="var_dedicated_groupowner_etc_chrony_keys_uid_chrony" version="1" datatype="int" comment="gid of the dedicated chrony group"> | ||
| <object_component item_field="subexpression" object_ref="object_file_groupowner_etc_chrony_keys_etc_group" /> | ||
| </local_variable> | ||
|
|
||
| <unix:file_test id="test_file_groupowner_etc_chrony_keys_with_usrlib" version="1" check="all" comment="Testing group ownership of /etc/chrony.keys" check_existence="none_exist" state_operator="AND"> | ||
| <unix:object object_ref="object_file_groupowner_etc_chrony_keys_with_usrlib" /> | ||
| </unix:file_test> | ||
| <unix:file_object id="object_file_groupowner_etc_chrony_keys_with_usrlib" version="1" comment="/etc/chrony.keys"> | ||
| <unix:filepath>/etc/chrony.keys</unix:filepath> | ||
| <filter action="exclude">state_file_groupowner_etc_chrony_keys_uid_chrony</filter> | ||
| <filter action="exclude">state_file_groupowner_etc_chrony_keys_gid_chrony_with_usrlib</filter> | ||
| </unix:file_object> | ||
| <ind:textfilecontent54_object id="object_file_groupowner_etc_chrony_keys_etc_group_with_usrlib" version="1" comment="gid of the dedicated chrony group"> | ||
| <set> | ||
| <object_reference>object_file_groupowner_etc_chrony_keys_etc_group</object_reference> | ||
| <object_reference>object_file_groupowner_etc_chrony_keys_usr_lib_group</object_reference> | ||
| </set> | ||
| </ind:textfilecontent54_object> | ||
| <ind:textfilecontent54_object id="object_file_groupowner_etc_chrony_keys_usr_lib_group" version="1"> | ||
| <ind:filepath>/usr/lib/group</ind:filepath> | ||
| <ind:pattern operation="pattern match">^chrony:\w+:(\w+):.*</ind:pattern> | ||
| <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| <unix:file_state id="state_file_groupowner_etc_chrony_keys_gid_chrony_with_usrlib" version="1" operator="AND"> | ||
| <unix:group_id datatype="int" var_ref="var_dedicated_groupowner_etc_chrony_keys_uid_chrony_with_usrlib" /> | ||
| </unix:file_state> | ||
| <local_variable id="var_dedicated_groupowner_etc_chrony_keys_uid_chrony_with_usrlib" version="1" datatype="int" comment="gid of the dedicated chrony group"> | ||
| <object_component item_field="subexpression" object_ref="object_file_groupowner_etc_chrony_keys_etc_group_with_usrlib" /> | ||
| </local_variable> | ||
|
|
||
| </def-group> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 3 additions & 0 deletions
3
...-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enabled/bash/shared.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| # platform = multi_platform_ubuntu | ||
|
|
||
| {{{ bash_pam_faillock_enable() }}} |
116 changes: 116 additions & 0 deletions
116
...pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enabled/oval/shared.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| <def-group> | ||
| <definition class="compliance" id="{{{ rule_id }}}" version="6"> | ||
| {{{ oval_metadata(description) }}} | ||
| <criteria operator="AND" comment="Check the proper configuration of pam_faillock.so"> | ||
| <!-- pam_unix.so is a control module present in all realistic scenarios and also used | ||
| as reference for the correct position of pam_faillock.so in auth section. If the | ||
| system is properly configured, it must appear only once in auth section. --> | ||
| <criterion test_ref="test_accounts_passwords_pam_faillock_common_pam_unix_auth" | ||
| comment="pam_unix.so appears only once in auth section of common-auth"/> | ||
| <criterion test_ref="test_accounts_passwords_pam_faillock_common_pam_faillock_auth" | ||
| comment="pam_faillock.so is properly defined in auth section of common-auth"/> | ||
| <criterion test_ref="test_accounts_passwords_pam_faillock_common_pam_faillock_account" | ||
| comment="pam_faillock.so is properly defined in common-account"/> | ||
| </criteria> | ||
| </definition> | ||
|
|
||
| <!-- The following tests demand complex regex which are necessary more than once. | ||
| These variables make simpler the usage of regex patterns. --> | ||
| <constant_variable id="var_accounts_passwords_pam_faillock_pam_unix_regex" | ||
| datatype="string" version="2" | ||
| comment="regex to identify pam_unix.so in auth section of pam files"> | ||
| <value>^\s*auth\N+pam_unix\.so</value> | ||
| </constant_variable> | ||
|
|
||
| <constant_variable | ||
| id="var_accounts_passwords_pam_faillock_pam_faillock_auth_regex" | ||
| datatype="string" version="2" | ||
| comment="regex to identify pam_faillock.so entries in auth section of pam files"> | ||
| {{% if 'debian' in product %}} | ||
| <value>^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc</value> | ||
| {{% elif 'ubuntu' in product %}} | ||
| <value>^\s*auth\s+(requisite|required)\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail</value> | ||
| {{% elif 'openeuler' in product or 'kylinserver' in product %}} | ||
| <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)?(?=.*?\bnew_authtok_reqd=done\b)?(?=.*?\bdefault=ignore\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=die\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value> | ||
| {{% else %}} | ||
| <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value> | ||
| {{% endif %}} | ||
| </constant_variable> | ||
|
|
||
| <constant_variable | ||
| id="var_accounts_passwords_pam_faillock_pam_faillock_account_regex" | ||
| datatype="string" version="2" | ||
| comment="regex to identify pam_faillock.so entry in account section of pam files"> | ||
| {{% if 'debian' in product or 'ubuntu' in product %}} | ||
| <value>^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$</value> | ||
| {{% elif 'openeuler' in product or 'kylinserver' in product %}} | ||
| <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so</value> | ||
| {{% else %}} | ||
| <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value> | ||
| {{% endif %}} | ||
| </constant_variable> | ||
|
|
||
| {{% macro generate_test_faillock_enabled(file_stem) %}} | ||
| <!-- Check occurences of pam_unix.so in auth section of {{{ file_stem }}}-auth file --> | ||
| <ind:textfilecontent54_test | ||
| check="all" check_existence="none_exist" version="2" | ||
| id="test_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_unix_auth" | ||
| comment="no more that one pam_unix.so is expected in auth section of {{{ file_stem }}}-auth"> | ||
| <ind:object object_ref="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_unix_auth"/> | ||
| </ind:textfilecontent54_test> | ||
|
|
||
| <ind:textfilecontent54_object | ||
| version="2" | ||
| id="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_unix_auth" | ||
| comment="Get the second and subsequent occurrences of pam_unix.so in auth section of {{{ file_stem}}}-auth"> | ||
| <ind:filepath>/etc/pam.d/{{{file_stem}}}-auth</ind:filepath> | ||
| <ind:pattern operation="pattern match" var_ref="var_accounts_passwords_pam_faillock_pam_unix_regex"/> | ||
| <ind:instance datatype="int" operation="greater than">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| <!-- Check common definition of pam_faillock.so in {{{ file_stem }}}-auth file --> | ||
| <ind:textfilecontent54_test | ||
| check="all" check_existence="only_one_exists" version="2" | ||
| id="test_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_auth" | ||
| comment="One and only one occurrence is expected in auth section of {{{ file_stem }}}-auth"> | ||
| <ind:object | ||
| object_ref="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_auth"/> | ||
| </ind:textfilecontent54_test> | ||
|
|
||
| <ind:textfilecontent54_object | ||
| version="2" | ||
| id="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_auth" | ||
| comment="Check common definition of pam_faillock.so in auth section of common-auth"> | ||
| <ind:filepath>/etc/pam.d/{{{ file_stem }}}-auth</ind:filepath> | ||
| <ind:pattern operation="pattern match" | ||
| var_ref="var_accounts_passwords_pam_faillock_pam_faillock_auth_regex"/> | ||
| <ind:instance datatype="int" operation="equals">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| {{% endmacro %}} | ||
|
|
||
| {{{ generate_test_faillock_enabled (file_stem="common") }}} | ||
|
|
||
| {{% macro generate_test_faillock_account(file_stem, file) %}} | ||
| <!-- Check common definition of pam_faillock.so in {{{ file_stem }}}-account --> | ||
| <ind:textfilecontent54_test | ||
| check="all" check_existence="only_one_exists" version="2" | ||
| id="test_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_account" | ||
| comment="One and only one occurrence is expected in {{{ file }}}"> | ||
| <ind:object | ||
| object_ref="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_account"/> | ||
| </ind:textfilecontent54_test> | ||
|
|
||
| <ind:textfilecontent54_object | ||
| version="2" | ||
| id="object_accounts_passwords_pam_faillock_{{{ file_stem }}}_pam_faillock_account" | ||
| comment="Check common definition of pam_faillock.so in account section of {{{ file }}}"> | ||
| <ind:filepath>/etc/pam.d/{{{ file }}}</ind:filepath> | ||
| <ind:pattern operation="pattern match" | ||
| var_ref="var_accounts_passwords_pam_faillock_pam_faillock_account_regex"/> | ||
| <ind:instance datatype="int" operation="equals">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| {{% endmacro %}} | ||
|
|
||
| {{{ generate_test_faillock_account (file_stem="common", file="common-account") }}} | ||
|
|
||
| </def-group> |
Oops, something went wrong.