Fix bash_instantiate_variables jinja macro #13049
Open
+4
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the variable contains single quotes, the remediation script being generated broke, as shown in the example below: <xccdf:set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">Hey' man!</xccdf:set-value> Remediation script excerpt: login_banner_text='Hey' man!' Result: line 3: unexpected EOF while looking for matching `'' --- The fix consists in using "cat << EOF" to let bash source the value correctly. New remediation script excerpt: login_banner_text=$(cat << EOF Hey' man! EOF )
|
Hi @rmetrich. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This datastream diff is auto generated by the check Click here to see the trimmed diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -4,7 +4,10 @@
if ! rpm -q --quiet "aide" ; then
yum install -y "aide"
fi
-var_aide_scan_notification_email=''
+var_aide_scan_notification_email=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_crypto_policy
@@ -1,5 +1,8 @@
-var_system_crypto_policy=''
+var_system_crypto_policy=$(cat << EOF
+
+EOF
+)
stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2>&1 > /dev/null)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy
@@ -1,5 +1,8 @@
-sshd_approved_ciphers=''
+sshd_approved_ciphers=$(cat << EOF
+
+EOF
+)
if [ -e "/etc/crypto-policies/back-ends/openssh.config" ] ; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
@@ -1,5 +1,8 @@
-sshd_approved_ciphers=''
+sshd_approved_ciphers=$(cat << EOF
+
+EOF
+)
CONF_FILE=/etc/crypto-policies/back-ends/opensshserver.config
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy
@@ -1,5 +1,8 @@
-sshd_approved_macs=''
+sshd_approved_macs=$(cat << EOF
+
+EOF
+)
if [ -e "/etc/crypto-policies/back-ends/openssh.config" ] ; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
@@ -1,5 +1,8 @@
-sshd_approved_macs=''
+sshd_approved_macs=$(cat << EOF
+
+EOF
+)
CONF_FILE=/etc/crypto-policies/back-ends/opensshserver.config
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
-inactivity_timeout_value=''
+inactivity_timeout_value=$(cat << EOF
+
+EOF
+)
# Check for setting in any of the DConf db directories
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
-var_screensaver_lock_delay=''
+var_screensaver_lock_delay=$(cat << EOF
+
+EOF
+)
# Check for setting in any of the DConf db directories
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudo_add_passwd_timeout' differs.
--- xccdf_org.ssgproject.content_rule_sudo_add_passwd_timeout
+++ xccdf_org.ssgproject.content_rule_sudo_add_passwd_timeout
@@ -1,6 +1,9 @@
-var_sudo_passwd_timeout=''
+var_sudo_passwd_timeout=$(cat << EOF
+
+EOF
+)
if /usr/sbin/visudo -qcf /etc/sudoers; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudo_add_umask' differs.
--- xccdf_org.ssgproject.content_rule_sudo_add_umask
+++ xccdf_org.ssgproject.content_rule_sudo_add_umask
@@ -1,6 +1,9 @@
-var_sudo_umask=''
+var_sudo_umask=$(cat << EOF
+
+EOF
+)
if /usr/sbin/visudo -qcf /etc/sudoers; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudo_custom_logfile' differs.
--- xccdf_org.ssgproject.content_rule_sudo_custom_logfile
+++ xccdf_org.ssgproject.content_rule_sudo_custom_logfile
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then
-var_sudo_logfile=''
+var_sudo_logfile=$(cat << EOF
+
+EOF
+)
if /usr/sbin/visudo -qcf /etc/sudoers; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudo_require_reauthentication' differs.
--- xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
+++ xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then
-var_sudo_timestamp_timeout=''
+var_sudo_timestamp_timeout=$(cat << EOF
+
+EOF
+)
if grep -Px '^[\s]*Defaults.*timestamp_timeout[\s]*=.*' /etc/sudoers.d/*; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_enable_authselect' differs.
--- xccdf_org.ssgproject.content_rule_enable_authselect
+++ xccdf_org.ssgproject.content_rule_enable_authselect
@@ -1,5 +1,8 @@
-var_authselect_profile=''
+var_authselect_profile=$(cat << EOF
+
+EOF
+)
authselect current
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-login_banner_text=''
+login_banner_text=$(cat << EOF
+
+EOF
+)
# Multiple regexes transform the banner regex into a usable banner
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-cis_banner_text=''
+cis_banner_text=$(cat << EOF
+
+EOF
+)
echo "$cis_banner_text" > "/etc/issue"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-remote_login_banner_text=''
+remote_login_banner_text=$(cat << EOF
+
+EOF
+)
# Multiple regexes transform the banner regex into a usable banner
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-cis_banner_text=''
+cis_banner_text=$(cat << EOF
+
+EOF
+)
echo "$cis_banner_text" > "/etc/issue.net"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-motd_banner_text=''
+motd_banner_text=$(cat << EOF
+
+EOF
+)
# Multiple regexes transform the banner regex into a usable banner
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-cis_banner_text=''
+cis_banner_text=$(cat << EOF
+
+EOF
+)
echo "$cis_banner_text" > "/etc/motd"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then
-login_banner_text=''
+login_banner_text=$(cat << EOF
+
+EOF
+)
# Multiple regexes transform the banner regex into a usable banner
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -1,8 +1,14 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_remember=''
-var_password_pam_remember_control_flag=''
+var_password_pam_remember=$(cat << EOF
+
+EOF
+)
+var_password_pam_remember_control_flag=$(cat << EOF
+
+EOF
+)
var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -1,8 +1,14 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_remember=''
-var_password_pam_remember_control_flag=''
+var_password_pam_remember=$(cat << EOF
+
+EOF
+)
+var_password_pam_remember_control_flag=$(cat << EOF
+
+EOF
+)
var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_unix_remember=''
+var_password_pam_unix_remember=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_accounts_passwords_pam_faillock_deny=''
+var_accounts_passwords_pam_faillock_deny=$(cat << EOF
+
+EOF
+)
if [ -f /usr/bin/authselect ]; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_accounts_passwords_pam_faillock_dir=''
+var_accounts_passwords_pam_faillock_dir=$(cat << EOF
+
+EOF
+)
if [ -f /usr/bin/authselect ]; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_accounts_passwords_pam_faillock_fail_interval=''
+var_accounts_passwords_pam_faillock_fail_interval=$(cat << EOF
+
+EOF
+)
if [ -f /usr/bin/authselect ]; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_accounts_passwords_pam_faillock_unlock_time=''
+var_accounts_passwords_pam_faillock_unlock_time=$(cat << EOF
+
+EOF
+)
if [ -f /usr/bin/authselect ]; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_dcredit=''
+var_password_pam_dcredit=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_dictcheck=''
+var_password_pam_dictcheck=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_difok' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_difok
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_difok
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_difok=''
+var_password_pam_difok=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_lcredit=''
+var_password_pam_lcredit=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_maxclassrepeat=''
+var_password_pam_maxclassrepeat=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_maxrepeat=''
+var_password_pam_maxrepeat=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_minclass=''
+var_password_pam_minclass=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_minlen=''
+var_password_pam_minlen=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_ocredit=''
+var_password_pam_ocredit=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_retry=''
+var_password_pam_retry=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_ucredit=''
+var_password_pam_ucredit=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q libuser; then
-var_password_hashing_algorithm_pam=''
+var_password_hashing_algorithm_pam=$(cat << EOF
+
+EOF
+)
LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_password_hashing_algorithm=''
+var_password_hashing_algorithm=$(cat << EOF
+
+EOF
+)
# Allow multiple algorithms, but choose the first one for remediation
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_hashing_algorithm_pam=''
+var_password_hashing_algorithm_pam=$(cat << EOF
+
+EOF
+)
PAM_FILE_PATH="/etc/pam.d/password-auth"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_hashing_algorithm_pam=''
+var_password_hashing_algorithm_pam=$(cat << EOF
+
+EOF
+)
PAM_FILE_PATH="/etc/pam.d/system-auth"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
@@ -1,5 +1,8 @@
-var_password_hashing_min_rounds_login_defs=''
+var_password_hashing_min_rounds_login_defs=$(cat << EOF
+
+EOF
+)
config_file="/etc/login.defs"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_logind_session_timeout' differs.
--- xccdf_org.ssgproject.content_rule_logind_session_timeout
+++ xccdf_org.ssgproject.content_rule_logind_session_timeout
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel && { ( grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" && { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.7"; printf "%s\n%s" "$expected" "$real" | sort -VC; } && grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" && { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="9.0"; [[ "$real" != "$expected" ]]; } ) || grep -qP "^ID=[\"']?ol[\"']?$" "/etc/os-release" && { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.7"; printf "%s\n%s" "$expected" "$real" | sort -VC; }; }; then
-var_logind_session_timeout=''
+var_logind_session_timeout=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers' differs.
--- xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers
+++ xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-var_smartcard_drivers=''
+var_smartcard_drivers=$(cat << EOF
+
+EOF
+)
OPENSC_TOOL="/usr/bin/opensc-tool"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_force_opensc_card_drivers' differs.
--- xccdf_org.ssgproject.content_rule_force_opensc_card_drivers
+++ xccdf_org.ssgproject.content_rule_force_opensc_card_drivers
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-var_smartcard_drivers=''
+var_smartcard_drivers=$(cat << EOF
+
+EOF
+)
OPENSC_TOOL="/usr/bin/opensc-tool"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration' differs.
--- xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
+++ xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_account_disable_post_pw_expiration=''
+var_account_disable_post_pw_expiration=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_maximum_age_login_defs=''
+var_accounts_maximum_age_login_defs=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_minimum_age_login_defs=''
+var_accounts_minimum_age_login_defs=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_password_minlen_login_defs=''
+var_accounts_password_minlen_login_defs=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
@@ -1,5 +1,8 @@
-var_accounts_maximum_age_login_defs=''
+var_accounts_maximum_age_login_defs=$(cat << EOF
+
+EOF
+)
while IFS= read -r i; do
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_root
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_root
@@ -1,4 +1,7 @@
-var_accounts_maximum_age_root=''
+var_accounts_maximum_age_root=$(cat << EOF
+
+EOF
+)
chage -M $var_accounts_maximum_age_root root
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
@@ -1,5 +1,8 @@
-var_accounts_minimum_age_login_defs=''
+var_accounts_minimum_age_login_defs=$(cat << EOF
+
+EOF
+)
while IFS= read -r i; do
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
@@ -1,5 +1,8 @@
-var_accounts_password_warn_age_login_defs=''
+var_accounts_password_warn_age_login_defs=$(cat << EOF
+
+EOF
+)
while IFS= read -r i; do
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_password_warn_age_login_defs=''
+var_accounts_password_warn_age_login_defs=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing
+++ xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing
@@ -1,5 +1,8 @@
-var_account_disable_post_pw_expiration=''
+var_account_disable_post_pw_expiration=$(cat << EOF
+
+EOF
+)
while IFS= read -r i; do
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_unix_rounds=''
+var_password_pam_unix_rounds=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_password_pam_unix_rounds=''
+var_password_pam_unix_rounds=$(cat << EOF
+
+EOF
+)
if [ -e "/etc/pam.d/system-auth" ] ; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty' differs.
--- xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
+++ xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_pam_wheel_group_for_su=''
+var_pam_wheel_group_for_su=$(cat << EOF
+
+EOF
+)
if ! grep -q "^${var_pam_wheel_group_for_su}:[^:]*:[^:]*:[^:]*" /etc/group; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su' differs.
--- xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
+++ xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_pam_wheel_group_for_su=''
+var_pam_wheel_group_for_su=$(cat << EOF
+
+EOF
+)
PAM_CONF=/etc/pam.d/su
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay' differs.
--- xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay
+++ xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_fail_delay=''
+var_accounts_fail_delay=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions' differs.
--- xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
+++ xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then
-var_accounts_max_concurrent_login_sessions=''
+var_accounts_max_concurrent_login_sessions=$(cat << EOF
+
+EOF
+)
if grep -q '^[^#]*\<maxlogins\>' /etc/security/limits.d/*.conf; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout' differs.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-var_accounts_tmout=''
+var_accounts_tmout=$(cat << EOF
+
+EOF
+)
# if 0, no occurence of tmout found, if 1, occurence found
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -1,5 +1,8 @@
-var_user_initialization_files_regex=''
+var_user_initialization_files_regex=$(cat << EOF
+
+EOF
+)
readarray -t interactive_users < <(awk -F: '$3>=1000 {print $1}' /etc/passwd)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
@@ -1,5 +1,8 @@
-var_user_initialization_files_regex=''
+var_user_initialization_files_regex=$(cat << EOF
+
+EOF
+)
readarray -t interactive_users < <(awk -F: '$3==0 || $3>=1000 {print $1}' /etc/passwd)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc' differs.
--- xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc
+++ xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q bash; then
-var_accounts_user_umask=''
+var_accounts_user_umask=$(cat << EOF
+
+EOF
+)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc' differs.
--- xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc
+++ xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc
@@ -1,5 +1,8 @@
-var_accounts_user_umask=''
+var_accounts_user_umask=$(cat << EOF
+
+EOF
+)
grep -q "^\s*umask" /etc/csh.cshrc && \
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then
-var_accounts_user_umask=''
+var_accounts_user_umask=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile' differs.
--- xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile
+++ xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile
@@ -1,5 +1,8 @@
-var_accounts_user_umask=''
+var_accounts_user_umask=$(cat << EOF
+
+EOF
+)
readarray -t profile_files < <(find /etc/profile.d/ -type f -name '*.sh' -or -name 'sh.local')
bash remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_l1tf_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_l1tf_argument
+++ xccdf_org.ssgproject.content_rule_grub2_l1tf_argument
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common && rpm --quiet -q kernel ); then
-var_l1tf_options=''
+var_l1tf_options=$(cat << EOF
+
+EOF
+)
expected_value="$var_l1tf_options"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument
+++ xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common && rpm --quiet -q kernel ); then
-var_rng_core_default_quality=''
+var_rng_core_default_quality=$(cat << EOF
+
+EOF
+)
expected_value="$var_rng_core_default_quality"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument
+++ xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common && rpm --quiet -q kernel ); then
-var_spec_store_bypass_disable_options=''
+var_spec_store_bypass_disable_options=$(cat << EOF
+
+EOF
+)
expected_value="$var_spec_store_bypass_disable_options"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-rsyslog_remote_loghost_address=''
+rsyslog_remote_loghost_address=$(cat << EOF
+
+EOF
+)
# Strip any search characters in the key arg so that the key can be replaced without
bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-rsyslog_remote_loghost_address=''
+rsyslog_remote_loghost_address=$(cat << EOF
+
+EOF
+)
params_to_add_if_missing=("protocol" "target" "port" "StreamDriver" "StreamDriverMode" "StreamDriverAuthMode" "streamdriver.CheckExtendedKeyPurpose")
values_to_add_if_missing=("tcp" "$rsyslog_remote_loghost_address" "6514" "gtls" "1" "x509/name" "on")
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_ra_value=''
+sysctl_net_ipv6_conf_all_accept_ra_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value=''
+sysctl_net_ipv6_conf_all_accept_ra_defrtr_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value=''
+sysctl_net_ipv6_conf_all_accept_ra_pinfo_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value=''
+sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_redirects_value=''
+sysctl_net_ipv6_conf_all_accept_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_accept_source_route_value=''
+sysctl_net_ipv6_conf_all_accept_source_route_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_autoconf_value=''
+sysctl_net_ipv6_conf_all_autoconf_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_forwarding_value=''
+sysctl_net_ipv6_conf_all_forwarding_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_max_addresses_value=''
+sysctl_net_ipv6_conf_all_max_addresses_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_all_router_solicitations_value=''
+sysctl_net_ipv6_conf_all_router_solicitations_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_ra_value=''
+sysctl_net_ipv6_conf_default_accept_ra_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value=''
+sysctl_net_ipv6_conf_default_accept_ra_defrtr_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value=''
+sysctl_net_ipv6_conf_default_accept_ra_pinfo_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value=''
+sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_redirects_value=''
+sysctl_net_ipv6_conf_default_accept_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_accept_source_route_value=''
+sysctl_net_ipv6_conf_default_accept_source_route_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_autoconf_value=''
+sysctl_net_ipv6_conf_default_autoconf_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_max_addresses_value=''
+sysctl_net_ipv6_conf_default_max_addresses_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv6_conf_default_router_solicitations_value=''
+sysctl_net_ipv6_conf_default_router_solicitations_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_accept_redirects_value=''
+sysctl_net_ipv4_conf_all_accept_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_accept_source_route_value=''
+sysctl_net_ipv4_conf_all_accept_source_route_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_arp_filter_value=''
+sysctl_net_ipv4_conf_all_arp_filter_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_arp_ignore_value=''
+sysctl_net_ipv4_conf_all_arp_ignore_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_forwarding_value=''
+sysctl_net_ipv4_conf_all_forwarding_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_log_martians_value=''
+sysctl_net_ipv4_conf_all_log_martians_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_rp_filter_value=''
+sysctl_net_ipv4_conf_all_rp_filter_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_secure_redirects_value=''
+sysctl_net_ipv4_conf_all_secure_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_all_shared_media_value=''
+sysctl_net_ipv4_conf_all_shared_media_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_accept_redirects_value=''
+sysctl_net_ipv4_conf_default_accept_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_accept_source_route_value=''
+sysctl_net_ipv4_conf_default_accept_source_route_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_log_martians_value=''
+sysctl_net_ipv4_conf_default_log_martians_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_rp_filter_value=''
+sysctl_net_ipv4_conf_default_rp_filter_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_secure_redirects_value=''
+sysctl_net_ipv4_conf_default_secure_redirects_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_conf_default_shared_media_value=''
+sysctl_net_ipv4_conf_default_shared_media_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=''
+sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=''
+sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_invalid_ratelimit' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_invalid_ratelimit
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_invalid_ratelimit
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_tcp_invalid_ratelimit_value=''
+sysctl_net_ipv4_tcp_invalid_ratelimit_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_rfc1337' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_rfc1337
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_rfc1337
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_tcp_rfc1337_value=''
+sysctl_net_ipv4_tcp_rfc1337_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_net_ipv4_tcp_syncookies_value=''
+sysctl_net_ipv4_tcp_syncookies_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_nftables_table' differs.
--- xccdf_org.ssgproject.content_rule_set_nftables_table
+++ xccdf_org.ssgproject.content_rule_set_nftables_table
@@ -1,9 +1,15 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q nftables; then
-var_nftables_family=''
+var_nftables_family=$(cat << EOF
-var_nftables_table=''
+EOF
+)
+
+var_nftables_table=$(cat << EOF
+
+EOF
+)
if ! nft list table $var_nftables_family $var_nftables_table; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} && { rpm --quiet -q rpm-ostree ;} && { rpm --quiet -q bootc ;} && { ! rpm --quiet -q openshift-kubelet ;} ) && ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then
-var_removable_partition=''
+var_removable_partition=$(cat << EOF
+
+EOF
+)
device_regex="^\s*$var_removable_partition\s\+"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} && { rpm --quiet -q rpm-ostree ;} && { rpm --quiet -q bootc ;} && { ! rpm --quiet -q openshift-kubelet ;} ) && ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then
-var_removable_partition=''
+var_removable_partition=$(cat << EOF
+
+EOF
+)
device_regex="^\s*$var_removable_partition\s\+"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} && { rpm --quiet -q rpm-ostree ;} && { rpm --quiet -q bootc ;} && { ! rpm --quiet -q openshift-kubelet ;} ) && ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then
-var_removable_partition=''
+var_removable_partition=$(cat << EOF
+
+EOF
+)
device_regex="^\s*$var_removable_partition\s\+"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
+++ xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
@@ -5,7 +5,10 @@
- var_mount_option_proc_hidepid=''
+ var_mount_option_proc_hidepid=$(cat << EOF
+
+EOF
+)
mountoption="hidepid=$var_mount_option_proc_hidepid"
mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /proc)"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_umask_for_daemons' differs.
--- xccdf_org.ssgproject.content_rule_umask_for_daemons
+++ xccdf_org.ssgproject.content_rule_umask_for_daemons
@@ -1,5 +1,8 @@
-var_umask_for_daemons=''
+var_umask_for_daemons=$(cat << EOF
+
+EOF
+)
grep -q ^umask /etc/init.d/functions && \
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict' differs.
--- xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
+++ xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
@@ -25,7 +25,10 @@
SYSCONFIG_FILE="/etc/sysctl.conf"
-sysctl_kernel_kptr_restrict_value=''
+sysctl_kernel_kptr_restrict_value=$(cat << EOF
+
+EOF
+)
#
bash remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument
+++ xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel && { rpm --quiet -q grub2-common; }; then
-var_slub_debug_options=''
+var_slub_debug_options=$(cat << EOF
+
+EOF
+)
expected_value="$var_slub_debug_options"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_selinux_policytype' differs.
--- xccdf_org.ssgproject.content_rule_selinux_policytype
+++ xccdf_org.ssgproject.content_rule_selinux_policytype
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-var_selinux_policy_name=''
+var_selinux_policy_name=$(cat << EOF
+
+EOF
+)
if [ -e "/etc/selinux/config" ] ; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_selinux_state' differs.
--- xccdf_org.ssgproject.content_rule_selinux_state
+++ xccdf_org.ssgproject.content_rule_selinux_state
@@ -1,7 +1,10 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
-var_selinux_state=''
+var_selinux_state=$(cat << EOF
+
+EOF
+)
if [ -e "/etc/selinux/config" ] ; then
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_abrt_anon_write' differs.
--- xccdf_org.ssgproject.content_rule_sebool_abrt_anon_write
+++ xccdf_org.ssgproject.content_rule_sebool_abrt_anon_write
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_abrt_anon_write=''
+ var_abrt_anon_write=$(cat << EOF
+
+EOF
+)
setsebool -P abrt_anon_write $var_abrt_anon_write
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_abrt_handle_event' differs.
--- xccdf_org.ssgproject.content_rule_sebool_abrt_handle_event
+++ xccdf_org.ssgproject.content_rule_sebool_abrt_handle_event
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_abrt_handle_event=''
+ var_abrt_handle_event=$(cat << EOF
+
+EOF
+)
setsebool -P abrt_handle_event $var_abrt_handle_event
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write' differs.
--- xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write
+++ xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_abrt_upload_watch_anon_write=''
+ var_abrt_upload_watch_anon_write=$(cat << EOF
+
+EOF
+)
setsebool -P abrt_upload_watch_anon_write $var_abrt_upload_watch_anon_write
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_antivirus_can_scan_system' differs.
--- xccdf_org.ssgproject.content_rule_sebool_antivirus_can_scan_system
+++ xccdf_org.ssgproject.content_rule_sebool_antivirus_can_scan_system
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_antivirus_can_scan_system=''
+ var_antivirus_can_scan_system=$(cat << EOF
+
+EOF
+)
setsebool -P antivirus_can_scan_system $var_antivirus_can_scan_system
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_antivirus_use_jit' differs.
--- xccdf_org.ssgproject.content_rule_sebool_antivirus_use_jit
+++ xccdf_org.ssgproject.content_rule_sebool_antivirus_use_jit
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_antivirus_use_jit=''
+ var_antivirus_use_jit=$(cat << EOF
+
+EOF
+)
setsebool -P antivirus_use_jit $var_antivirus_use_jit
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content' differs.
--- xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content
+++ xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_auditadm_exec_content=''
+ var_auditadm_exec_content=$(cat << EOF
+
+EOF
+)
setsebool -P auditadm_exec_content $var_auditadm_exec_content
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_authlogin_nsswitch_use_ldap' differs.
--- xccdf_org.ssgproject.content_rule_sebool_authlogin_nsswitch_use_ldap
+++ xccdf_org.ssgproject.content_rule_sebool_authlogin_nsswitch_use_ldap
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_authlogin_nsswitch_use_ldap=''
+ var_authlogin_nsswitch_use_ldap=$(cat << EOF
+
+EOF
+)
setsebool -P authlogin_nsswitch_use_ldap $var_authlogin_nsswitch_use_ldap
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_authlogin_radius' differs.
--- xccdf_org.ssgproject.content_rule_sebool_authlogin_radius
+++ xccdf_org.ssgproject.content_rule_sebool_authlogin_radius
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_authlogin_radius=''
+ var_authlogin_radius=$(cat << EOF
+
+EOF
+)
setsebool -P authlogin_radius $var_authlogin_radius
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_authlogin_yubikey' differs.
--- xccdf_org.ssgproject.content_rule_sebool_authlogin_yubikey
+++ xccdf_org.ssgproject.content_rule_sebool_authlogin_yubikey
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_authlogin_yubikey=''
+ var_authlogin_yubikey=$(cat << EOF
+
+EOF
+)
setsebool -P authlogin_yubikey $var_authlogin_yubikey
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sebool_awstats_purge_apache_log_files' differs.
--- xccdf_org.ssgproject.content_rule_sebool_awstats_purge_apache_log_files
+++ xccdf_org.ssgproject.content_rule_sebool_awstats_purge_apache_log_files
@@ -8,7 +8,10 @@
if selinuxenabled || { rpm --quiet -q kernel rpm-ostree bootc && ! rpm --quiet -q openshift-kubelet && { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
- var_awstats_purge_apache_log_files=''
+ var_awstats_purge_apache_log_files=$(cat << EOF
+
+EOF
+)
setsebool -P awstats_
... The diff is trimmed here ... |
|
Code Climate has analyzed commit 86ce21b and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.9% (0.0% change). View more on Code Climate. |
rmetrich
changed the title
openshift-ci
bot
added
the
do-not-merge/work-in-progress
jan-cerny
reviewed
Feb 17, 2025
| {{{ name }}}=$(cat << EOF | ||
| (bash-populate {{{ name }}}) | ||
| EOF | ||
| ) |
There was a problem hiding this comment.
I would prefer instead of complicating the generated bash code we can improve the generator so that it would escape the quotes.
I think it could be added here:
content/ssg/build_remediations.py
Line 649 in 5f28a9a
There was a problem hiding this comment.
Yes that was my plan actually. I moved that PR as WIP because it's not working at all in the end.
It works for strings, but not patterns and patterns have to be used instead.
There was a problem hiding this comment.
This actually cannot work:
Basically we have this:
{{{ bash_instantiate_variables("login_banner_text") }}}
which makes the python code (after jinja substitution) generate this:
login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'
instead we would need this below:
login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text_escaped" use="legacy"/>'
but content_value_login_banner_text_escaped cannot exist, because it would require fixing the XML model to generate such var when user in SCAP workbench sets a value for content_value_login_banner_text.
There was a problem hiding this comment.
Actually the initial PR works fine, it's just that I made a mistake when creating a Test banner (I replaced spaces by [\s\n] instead of [\s\n]+ ...
With this one below it works fine:
^L'accès[\s\n]+au[\s\n]+système[\s\n]+est[\s\n]+fourni[\s\n]+par[\s\n]+la[\s\n]+société[\s\n]+XXX[\s\n]+YYY[\s\n]+à[\s\n]+des[\s\n]+fins[\s\n]+d'activités[\s\n]+autorisées\.$
|
@jan-cerny would you mind to assign yourself to this pull request as reviewer? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
When the variable contains single quotes, the remediation script being generated broke, as shown in the example below:
Remediation script excerpt:
Result:
The fix consists in using "cat << EOF" to let bash source the value correctly.
New remediation script excerpt:
Rationale:
Banners may have single quotes inside, typically for French language (
C'est-y[\s\n]+pas[\s\n]+beau[\s\n]+!).Review Hints:
Generate a tailoring file with a banner containing single quotes (rule
xccdf_org.ssgproject.content_value_login_banner_text)This is a follow up of PR 7784.