Create file if it doesn't exist for coredump rules

[Mab879]

Description:

Create file if it doesn't exist for coredump rules.

Rationale:

Fixes #12171

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_backtraces' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
+++ xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
@@ -1,20 +1,38 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
-if [ -e "/etc/systemd/coredump.conf" ] ; then
-    
-    LC_ALL=C sed -i "/^\s*ProcessSizeMax\s*=\s*/Id" "/etc/systemd/coredump.conf"
-else
-    touch "/etc/systemd/coredump.conf"
+found=false
+
+# set value in all files if they contain section or key
+for f in $(echo -n "/etc/systemd/coredump.conf"); do
+    if [ ! -e "$f" ]; then
+        continue
+    fi
+
+    # find key in section and change value
+    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*ProcessSizeMax" "$f"; then
+
+            sed -i "s/ProcessSizeMax[^(\n)]*/ProcessSizeMax=0/" "$f"
+
+            found=true
+
+    # find section and add key = value to it
+    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then
+
+            sed -i "/[[:space:]]*\[Coredump\]/a ProcessSizeMax=0" "$f"
+
+            found=true
+    fi
+done
+
+# if section not in any file, append section with key = value to FIRST file in files parameter
+if ! $found ; then
+    file=$(echo "/etc/systemd/coredump.conf" | cut -f1 -d ' ')
+    mkdir -p "$(dirname "$file")"
+
+    echo -e "[Coredump]\nProcessSizeMax=0" >> "$file"
+
 fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/coredump.conf"
-
-cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
-# Insert at the end of the file
-printf '%s\n' "ProcessSizeMax=0" >> "/etc/systemd/coredump.conf"
-# Clean up after ourselves.
-rm "/etc/systemd/coredump.conf.bak"
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_backtraces' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
+++ xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
@@ -14,34 +14,14 @@
   - no_reboot_needed
   - restrict_strategy
 
-- name: Disable core dump backtraces
-  block:
-
-  - name: Check for duplicate values
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*ProcessSizeMax\s*=\s*
-      state: absent
-    check_mode: true
-    changed_when: false
-    register: dupes
-
-  - name: Deduplicate values from /etc/systemd/coredump.conf
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*ProcessSizeMax\s*=\s*
-      state: absent
-    when: dupes.found is defined and dupes.found > 1
-
-  - name: Insert correct line to /etc/systemd/coredump.conf
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*ProcessSizeMax\s*=\s*
-      line: ProcessSizeMax=0
-      state: present
+- name: Set 'ProcessSizeMax' to '0' in the [Coredump] section of '/etc/systemd/coredump.conf'
+  ini_file:
+    path: /etc/systemd/coredump.conf
+    section: Coredump
+    option: ProcessSizeMax
+    value: '0'
+    create: true
+    mode: 420
   when: '"systemd" in ansible_facts.packages'
   tags:
   - CCE-82251-0

bash remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_storage' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_storage
+++ xccdf_org.ssgproject.content_rule_coredump_disable_storage
@@ -1,20 +1,38 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
-if [ -e "/etc/systemd/coredump.conf" ] ; then
-    
-    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/Id" "/etc/systemd/coredump.conf"
-else
-    touch "/etc/systemd/coredump.conf"
+found=false
+
+# set value in all files if they contain section or key
+for f in $(echo -n "/etc/systemd/coredump.conf"); do
+    if [ ! -e "$f" ]; then
+        continue
+    fi
+
+    # find key in section and change value
+    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*Storage" "$f"; then
+
+            sed -i "s/Storage[^(\n)]*/Storage=none/" "$f"
+
+            found=true
+
+    # find section and add key = value to it
+    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then
+
+            sed -i "/[[:space:]]*\[Coredump\]/a Storage=none" "$f"
+
+            found=true
+    fi
+done
+
+# if section not in any file, append section with key = value to FIRST file in files parameter
+if ! $found ; then
+    file=$(echo "/etc/systemd/coredump.conf" | cut -f1 -d ' ')
+    mkdir -p "$(dirname "$file")"
+
+    echo -e "[Coredump]\nStorage=none" >> "$file"
+
 fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/coredump.conf"
-
-cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
-# Insert at the end of the file
-printf '%s\n' "Storage=none" >> "/etc/systemd/coredump.conf"
-# Clean up after ourselves.
-rm "/etc/systemd/coredump.conf.bak"
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_storage' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_storage
+++ xccdf_org.ssgproject.content_rule_coredump_disable_storage
@@ -14,34 +14,14 @@
   - no_reboot_needed
   - restrict_strategy
 
-- name: Disable storing core dump
-  block:
-
-  - name: Check for duplicate values
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*Storage\s*=\s*
-      state: absent
-    check_mode: true
-    changed_when: false
-    register: dupes
-
-  - name: Deduplicate values from /etc/systemd/coredump.conf
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*Storage\s*=\s*
-      state: absent
-    when: dupes.found is defined and dupes.found > 1
-
-  - name: Insert correct line to /etc/systemd/coredump.conf
-    lineinfile:
-      path: /etc/systemd/coredump.conf
-      create: false
-      regexp: ^\s*Storage\s*=\s*
-      line: Storage=none
-      state: present
+- name: Set 'Storage' to 'none' in the [Coredump] section of '/etc/systemd/coredump.conf'
+  ini_file:
+    path: /etc/systemd/coredump.conf
+    section: Coredump
+    option: Storage
+    value: none
+    create: true
+    mode: 420
   when: '"systemd" in ansible_facts.packages'
   tags:
   - CCE-82252-8

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12181
This image was built from commit: 7b774a1

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12181

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12181 make deploy-local

[jan-cerny]

@Mab879 Can you create a test scenario for this situation?

[jan-cerny]

Is the problem that insert_after should be a regular expression, which means that this matches some class of characters instead of the literal string?

[Mab879]

Good catch, fixed.

[jan-cerny]

The test scenarios that you added are failing.

jcerny@fedora:~/work/git/scap-security-guide (pr/12181)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 coredump_disable_backtraces coredump_disable_storage disable_users_coredumps
.Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-07-29-0923/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
INFO - Script coredumps_processsizemax_0.pass.sh using profile (all) OK
INFO - Script coredumps_processsizemax_default.fail.sh using profile (all) OK
INFO - Script coredumps_processsizemax_nonzero.fail.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_backtraces'.
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_storage
INFO - Script coredumps_storage_default.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none.pass.sh using profile (all) OK
INFO - Script coredumps_storage_persistent.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none_dropin.pass.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_storage'.
INFO - xccdf_org.ssgproject.content_rule_disable_users_coredumps
INFO - Script coredumps_disabled.pass.sh using profile (all) OK
INFO - Script enabled_coredumps.fail.sh using profile (all) OK
INFO - Script no_coredumps_limit.fail.sh using profile (all) OK

The problem is that now the remediation creates the file if the file doesn't exist and inserts the option there but it doesn't create the section.

[root@localhost ~]# ls /etc/systemd/coredump.conf
/etc/systemd/coredump.conf
[root@localhost ~]# cat /etc/systemd/coredump.conf
ProcessSizeMax=0
[root@localhost ~]# 

[codeclimate]

Code Climate has analyzed commit 7b774a1 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

[jan-cerny]

jcerny@fedora:~/work/git/scap-security-guide (pr/12181)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 coredump_disable_backtraces coredump_disable_storage disable_users_coredumps
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-07-29-1553/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
INFO - Script coredumps_processsizemax_0.pass.sh using profile (all) OK
INFO - Script coredumps_processsizemax_default.fail.sh using profile (all) OK
INFO - Script coredumps_processsizemax_nonzero.fail.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_storage
INFO - Script coredumps_storage_default.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none.pass.sh using profile (all) OK
INFO - Script coredumps_storage_persistent.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none_dropin.pass.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_disable_users_coredumps
INFO - Script coredumps_disabled.pass.sh using profile (all) OK
INFO - Script enabled_coredumps.fail.sh using profile (all) OK
INFO - Script no_coredumps_limit.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12181)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible coredump_disable_backtraces coredump_disable_storage disable_users_coredumps
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-07-29-1558/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
INFO - Script coredumps_processsizemax_0.pass.sh using profile (all) OK
INFO - Script coredumps_processsizemax_default.fail.sh using profile (all) OK
INFO - Script coredumps_processsizemax_nonzero.fail.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_coredump_disable_storage
INFO - Script coredumps_storage_default.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none.pass.sh using profile (all) OK
INFO - Script coredumps_storage_persistent.fail.sh using profile (all) OK
INFO - Script coredumps_storage_none_dropin.pass.sh using profile (all) OK
INFO - Script etc_systemd_coredump_conf_dne.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_disable_users_coredumps
INFO - Script coredumps_disabled.pass.sh using profile (all) OK
INFO - Script enabled_coredumps.fail.sh using profile (all) OK
INFO - Script no_coredumps_limit.fail.sh using profile (all) OK