Skip to content

Commit 13a4ebc

Browse files
macko1macko1
committed
Revert, Reimplement "greater than or equal" and adjust tests and docs accordingly
1 parent c32f292 commit 13a4ebc

25 files changed

+427
-104
lines changed

‎docs/templates/template_reference.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,13 @@ they must be of the same length.
466466
- **arg_variable** - the variable used as the value for the argument, eg. `'var_slub_debug_options'`
467467
This parameter is mutually exclusive with **arg_value**.
468468

469+
- **operation** - (optional) OVAL operation used to compare the
470+
collected argument value with the expected value. Default value:
471+
`pattern match`. When set to a numeric operation such as
472+
`greater than or equal`, the OVAL check captures only the
473+
numeric portion of the argument and compares it as an integer.
474+
Works with both **arg_variable** and **arg_value**.
475+
469476
- Languages: Ansible, Bash, OVAL, Blueprint, Kickstart
470477

471478
#### grub2_bootloader_argument_absent

‎linux_os/guide/auditing/grub2_audit_backlog_limit_argument/rule.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,3 +51,4 @@ template:
5151
vars:
5252
arg_name: audit_backlog_limit
5353
arg_variable: var_audit_backlog_limit
54+
operation: greater than or equal

‎shared/templates/grub2_bootloader_argument/oval.template‎

Lines changed: 304 additions & 59 deletions
Large diffs are not rendered by default.

‎shared/templates/grub2_bootloader_argument/template.py‎

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,43 @@
11
import ssg.utils
22

3+
VALID_OPERATIONS = {
4+
"pattern match",
5+
"greater than or equal",
6+
}
7+
38

49
def preprocess(data, lang):
10+
# arg_value and arg_variable are mutually exclusive
511
if 'arg_value' in data and 'arg_variable' in data:
612
raise RuntimeError(
713
"ERROR: The template should not set both 'arg_value' and 'arg_variable'.\n"
814
"arg_name: {0}\n"
915
"arg_variable: {1}".format(data['arg_value'], data['arg_variable']))
1016

17+
# Default and validate the OVAL comparison operation (oval.template
18+
# branches on "pattern match" vs "greater than or equal" for state checks)
19+
if "operation" not in data:
20+
data["operation"] = "pattern match"
21+
22+
if data["operation"] not in VALID_OPERATIONS:
23+
raise RuntimeError(
24+
f"ERROR: Invalid operation '{data['operation']}' for rule "
25+
f"'{data['_rule_id']}'. "
26+
f"Must be one of: {sorted(VALID_OPERATIONS)}"
27+
)
28+
29+
# Placeholder values substituted into tests/*.sh scenarios via
30+
# TEST_CORRECT_VALUE / TEST_WRONG_VALUE (e.g. grub2_bootloader_argument_remediation calls)
31+
if data["operation"] == "pattern match":
32+
data["test_correct_value"] = "correct_value"
33+
data["test_wrong_value"] = "wrong_value"
34+
elif data["operation"] == "greater than or equal":
35+
data["test_correct_value"] = "200"
36+
data["test_wrong_value"] = "199"
37+
38+
# Build ARG_NAME_VALUE ("name=value") used in oval.template comments/metadata,
39+
# bash.template remediation, and ansible.template remediation.
40+
# When arg_variable is set the value comes from an XCCDF variable at eval time.
1141
if 'arg_variable' in data:
1242
data["arg_name_value"] = data["arg_name"]
1343
else:
@@ -19,11 +49,13 @@ def preprocess(data, lang):
1949
if 'is_substring' not in data:
2050
data["is_substring"] = "false"
2151

52+
# OVAL-specific: escape dots for regex patterns in oval.template
53+
# (ESCAPED_ARG_NAME_VALUE in state subexpressions, ESCAPED_ARG_NAME in object patterns)
2254
if lang == "oval":
23-
# escape dot, this is used in oval regex
2455
data["escaped_arg_name_value"] = data["arg_name_value"].replace(".", "\\.")
2556
data["escaped_arg_name"] = data["arg_name"].replace(".", "\\.")
26-
# replace . with _, this is used in test / object / state ids
2757

58+
# SANITIZED_ARG_NAME: used as component of OVAL IDs (test_grub2_<name>_*,
59+
# obj_grub2_<name>_*, state_grub2_<name>_*) and bash bootc .toml filenames
2860
data["sanitized_arg_name"] = ssg.utils.escape_id(data["arg_name"])
2961
return data

‎shared/templates/grub2_bootloader_argument/tests/arg_not_in_entries.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
# packages = grub2,grubby
55

66
{{%- if ARG_VARIABLE %}}
7-
# variables = {{{ ARG_VARIABLE }}}=correct_value
8-
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
7+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
8+
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=" ~ TEST_CORRECT_VALUE %}}
99
{{%- endif %}}
1010

1111
source common.sh

‎shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# platform = multi_platform_all
44

55
{{%- if ARG_VARIABLE %}}
6-
# variables = {{{ ARG_VARIABLE }}}=correct_value
7-
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
6+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
7+
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=" ~ TEST_CORRECT_VALUE %}}
88
{{%- endif %}}
99

1010
source common.sh

‎shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
# platform = multi_platform_all
44
{{%- if ARG_VARIABLE %}}
5-
# variables = {{{ ARG_VARIABLE }}}=correct_value
6-
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
5+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
6+
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=" ~ TEST_CORRECT_VALUE %}}
77
{{%- endif %}}
88

99
source common.sh

‎shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_and_not_referenced.pass.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
# packages = grub2,grubby
55

66
{{%- if ARG_VARIABLE %}}
7-
# variables = {{{ ARG_VARIABLE }}}=correct_value
8-
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
7+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
8+
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=" ~ TEST_CORRECT_VALUE %}}
99
{{%- endif %}}
1010

1111
source common.sh

‎shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_but_referenced.fail.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# platform = Oracle Linux 8,Red Hat Enterprise Linux 8
44
# packages = grub2,grubby
55
{{%- if ARG_VARIABLE %}}
6-
# variables = {{{ ARG_VARIABLE }}}=correct_value
7-
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
6+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
7+
{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=" ~ TEST_CORRECT_VALUE %}}
88
{{%- endif %}}
99

1010
source common.sh

‎shared/templates/grub2_bootloader_argument/tests/arg_value_below_minimal.fail.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
3+
{{% if OPERATION == "pattern match" %}}
4+
# platform = Not Applicable
5+
{{% else %}}
6+
# platform = multi_platform_all
7+
{{% endif %}}
8+
{{%- if 'ubuntu' in product %}}
9+
# packages = grub2
10+
{{%- else %}}
11+
# packages = grub2,grubby
12+
{{%- endif %}}
13+
{{%- if ARG_VARIABLE %}}
14+
# variables = {{{ ARG_VARIABLE }}}={{{ TEST_CORRECT_VALUE }}}
15+
{{% endif %}}
16+
17+
source common.sh
18+
19+
{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=" ~ TEST_WRONG_VALUE) }}}

0 commit comments

Comments
 (0)