Skip to content

Commit 80a5c2e

Browse files
macko1macko1
committed
take2
1 parent 1ad577e commit 80a5c2e

8 files changed

Lines changed: 583 additions & 20 deletions

File tree

‎docs/templates/template_reference.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -461,10 +461,18 @@ they must be of the same length.
461461

462462
- **arg_name** - argument name, eg. `audit`
463463

464-
- **arg_value** - argument value, eg. `'1'`
465-
466-
- **arg_variable** - the variable used as the value for the argument, eg. `'var_slub_debug_options'`
467-
This parameter is mutually exclusive with **arg_value**.
464+
- **arg_value** - argument value, eg. `'1'`.
465+
This parameter is mutually exclusive with **arg_variable** and **arg_minimal_value**.
466+
467+
- **arg_variable** - the variable used as the value for the argument, eg. `'var_slub_debug_options'`.
468+
This parameter is mutually exclusive with **arg_value** and **arg_minimal_value**.
469+
470+
- **arg_minimal_value** - XCCDF variable ID whose value is the minimum
471+
acceptable integer for the argument, eg. `'var_audit_backlog_limit'`.
472+
When set, the OVAL check captures the numeric value after
473+
`arg_name=` and verifies it is greater than or equal to the
474+
variable's value at scan time.
475+
This parameter is mutually exclusive with **arg_value** and **arg_variable**.
468476

469477
- Languages: Ansible, Bash, OVAL, Blueprint, Kickstart
470478

‎linux_os/guide/auditing/grub2_audit_backlog_limit_argument/policy/stig/shared.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,17 @@ vuldiscussion: |-
1515
checktext: |-
1616
Verify {{{ full_name }}} allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command:
1717
18-
$ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit=8192'
18+
$ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit'
1919
20-
If the command returns any outputs, and audit_backlog_limit is less than "8192", this is a finding.
20+
If the command returns any output, audit_backlog_limit is not configured for all kernels and this is a finding.
21+
22+
Verify the audit_backlog_limit value is sufficient with the following command:
23+
24+
$ sudo grubby --info=ALL | sed -n 's/.*audit_backlog_limit=\([0-9]*\).*/\1/p'
25+
26+
If the returned value is less than "8192", this is a finding.
2127
2228
fixtext: |-
2329
Configure {{{ full_name }}} to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command:
2430
2531
$ sudo grubby --update-kernel=ALL --args=audit_backlog_limit=8192
26-
27-

‎linux_os/guide/auditing/grub2_audit_backlog_limit_argument/rule.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,4 @@ template:
5050
name: grub2_bootloader_argument
5151
vars:
5252
arg_name: audit_backlog_limit
53-
arg_variable: var_audit_backlog_limit
53+
arg_minimal_value: var_audit_backlog_limit

‎linux_os/guide/auditing/var_audit_backlog_limit.var‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ documentation_complete: true
33
title: Audit backlog limit
44

55
description: |-
6-
Value of the audit_backlog_limit argument in GRUB 2 configuration.
7-
The audit_backlog_limit parameter determines how auditd records can
8-
be held in the auditd backlog.
6+
Minimum value of the audit_backlog_limit kernel parameter in
7+
GRUB 2 configuration. This parameter determines how many audit
8+
records can be held in the backlog queue before the audit daemon
9+
starts processing them.
910

1011
type: string
1112

12-
operator: equals
13+
operator: greater than or equal
1314

1415
interactive: true
1516

‎shared/templates/grub2_bootloader_argument/oval.template‎

Lines changed: 427 additions & 7 deletions
Large diffs are not rendered by default.

‎shared/templates/grub2_bootloader_argument/template.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,16 @@ def preprocess(data, lang):
88
"arg_name: {0}\n"
99
"arg_variable: {1}".format(data['arg_value'], data['arg_variable']))
1010

11+
# arg_minimal_value activates a "greater than or equal" integer comparison
12+
# against an XCCDF external variable (e.g. var_audit_backlog_limit).
13+
# It replaces the exact-match / regex logic that arg_value and arg_variable
14+
# provide, so the three are mutually exclusive.
15+
if 'arg_minimal_value' in data and ('arg_value' in data or 'arg_variable' in data):
16+
raise RuntimeError(
17+
"ERROR: 'arg_minimal_value' is mutually exclusive with "
18+
"'arg_value' and 'arg_variable'.\n"
19+
"arg_name: {0}".format(data['arg_name']))
20+
1121
if 'arg_variable' in data:
1222
data["arg_name_value"] = data["arg_name"]
1323
else:

‎shared/templates/grub2_bootloader_argument/tests/arg_value_below_minimal.fail.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/bash
2+
{{#-
3+
Test: arg_value_below_minimal — expected result: FAIL
4+
5+
Scenario:
6+
The kernel argument (e.g. audit_backlog_limit) is set to a value that is
7+
BELOW the required minimum. The OVAL check uses "greater than or equal",
8+
so below-minimum is a failing case.
9+
10+
What happens:
11+
1. The XCCDF variable (e.g. var_audit_backlog_limit) is set to 8192.
12+
2. The remediation macro writes ARG_NAME=100 into all GRUB locations
13+
(grubby, /etc/default/grub, grub.cfg — depending on the product).
14+
3. The OVAL object captures "100" (the digits after ARG_NAME=).
15+
4. The OVAL state compares: 100 >= 8192 → false → FAIL.
16+
17+
Applicability:
18+
Only runs for rules that use arg_minimal_value (e.g. audit_backlog_limit).
19+
Rules using arg_value or arg_variable skip this test (platform = Not Applicable).
20+
-#}}
21+
22+
{{#- This test only makes sense for rules using arg_minimal_value.
23+
If the rule does NOT use arg_minimal_value (i.e. it uses arg_value or
24+
arg_variable instead), emit "platform = Not Applicable" so Automatus
25+
skips it. Otherwise, run on all platforms.
26+
("# platform = ..." is an Automatus directive parsed from the rendered
27+
script — bash sees it as a comment, but Automatus uses it to decide
28+
whether to run the test.) -#}}
29+
{{% if not ARG_MINIMAL_VALUE %}}
30+
# platform = Not Applicable
31+
{{% else %}}
32+
# platform = multi_platform_all
33+
{{% endif %}}
34+
35+
{{#- Ubuntu only needs the grub2 package.
36+
All other products also need grubby (used by the remediation macro to
37+
write kernel arguments into /boot/loader/entries/*.conf).
38+
("# packages = ..." is an Automatus directive — it installs these
39+
packages on the test VM before running the script.) -#}}
40+
{{%- if 'ubuntu' in product %}}
41+
# packages = grub2
42+
{{%- else %}}
43+
# packages = grub2,grubby
44+
{{%- endif %}}
45+
46+
{{#- When arg_minimal_value is set, tell Automatus which XCCDF variable to
47+
use and what value to assign it. "# variables = ..." is an Automatus
48+
directive that sets the variable before the OVAL scan runs.
49+
Here we set the minimum to 8192. -#}}
50+
{{%- if ARG_MINIMAL_VALUE %}}
51+
# variables = {{{ ARG_MINIMAL_VALUE }}}=8192
52+
{{%- endif %}}
53+
54+
{{#- common.sh sets up the GRUB environment for the test (creates necessary
55+
files, cleans previous state, etc.). -#}}
56+
source common.sh
57+
58+
{{#- Write ARG_NAME=100 into all GRUB config locations.
59+
Value is below the minimum (100 < 8192) → the check should FAIL. -#}}
60+
{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=100") }}}

‎shared/templates/grub2_bootloader_argument/tests/arg_value_meets_minimal.pass.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/bash
2+
{{#-
3+
Test: arg_value_meets_minimal — expected result: PASS
4+
5+
Scenario:
6+
The kernel argument (e.g. audit_backlog_limit) is set to a value that
7+
EQUALS the required minimum. The OVAL check uses "greater than or equal",
8+
so equal-to-minimum is a passing case.
9+
10+
What happens:
11+
1. The XCCDF variable (e.g. var_audit_backlog_limit) is set to 8192.
12+
2. The remediation macro writes ARG_NAME=8192 into all GRUB locations
13+
(grubby, /etc/default/grub, grub.cfg — depending on the product).
14+
3. The OVAL object captures "8192" (the digits after ARG_NAME=).
15+
4. The OVAL state compares: 8192 >= 8192 → true → PASS.
16+
17+
Applicability:
18+
Only runs for rules that use arg_minimal_value (e.g. audit_backlog_limit).
19+
Rules using arg_value or arg_variable skip this test (platform = Not Applicable).
20+
-#}}
21+
22+
{{#- This test only makes sense for rules using arg_minimal_value.
23+
If the rule does NOT use arg_minimal_value (i.e. it uses arg_value or
24+
arg_variable instead), emit "platform = Not Applicable" so Automatus
25+
skips it. Otherwise, run on all platforms.
26+
("# platform = ..." is an Automatus directive parsed from the rendered
27+
script — bash sees it as a comment, but Automatus uses it to decide
28+
whether to run the test.) -#}}
29+
{{% if not ARG_MINIMAL_VALUE %}}
30+
# platform = Not Applicable
31+
{{% else %}}
32+
# platform = multi_platform_all
33+
{{% endif %}}
34+
35+
{{#- Ubuntu only needs the grub2 package.
36+
All other products also need grubby (used by the remediation macro to
37+
write kernel arguments into /boot/loader/entries/*.conf).
38+
("# packages = ..." is an Automatus directive — it installs these
39+
packages on the test VM before running the script.) -#}}
40+
{{%- if 'ubuntu' in product %}}
41+
# packages = grub2
42+
{{%- else %}}
43+
# packages = grub2,grubby
44+
{{%- endif %}}
45+
46+
{{#- When arg_minimal_value is set, tell Automatus which XCCDF variable to
47+
use and what value to assign it. "# variables = ..." is an Automatus
48+
directive that sets the variable before the OVAL scan runs.
49+
Here we set the minimum to 8192. -#}}
50+
{{%- if ARG_MINIMAL_VALUE %}}
51+
# variables = {{{ ARG_MINIMAL_VALUE }}}=8192
52+
{{%- endif %}}
53+
54+
{{#- common.sh sets up the GRUB environment for the test (creates necessary
55+
files, cleans previous state, etc.). -#}}
56+
source common.sh
57+
58+
{{#- Write ARG_NAME=8192 into all GRUB config locations.
59+
Value equals the minimum → the check should PASS. -#}}
60+
{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=8192") }}}

0 commit comments

Comments
 (0)