From faf3a3c6b07e96784a1b38e9a32afeca8167b530 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Mon, 25 Nov 2013 14:20:56 +0100
Subject: [PATCH] [Fedora] Add package_installed OVAL templating directory
 structure and functionality          (prerequisite for the service enabled
 checks) [Fedora] Include initial OVAL check if ntpd service is enabled

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 Fedora/input/checks/package_ntp_installed.xml      | 25 ++++++++++++
 Fedora/input/checks/service_ntpd_enabled.xml       | 37 +++++++++++++++++
 Fedora/input/checks/templates/Makefile             | 18 +++++++++
 Fedora/input/checks/templates/README               | 35 ++++++++++++++++
 .../checks/templates/create_package_installed.py   | 46 ++++++++++++++++++++++
 Fedora/input/checks/templates/output/.gitignore    |  3 ++
 .../input/checks/templates/packages_installed.csv  |  1 +
 .../templates/template_BASH_package_installed      |  1 +
 .../checks/templates/template_package_installed    | 25 ++++++++++++
 Fedora/input/fixes/bash/service_ntpd_enabled.sh    | 17 ++++++++
 Fedora/input/services/ntp.xml                      |  2 +-
 Fedora/scap-security-guide.spec                    |  6 ++-
 12 files changed, 214 insertions(+), 2 deletions(-)
 create mode 100644 Fedora/input/checks/package_ntp_installed.xml
 create mode 100644 Fedora/input/checks/service_ntpd_enabled.xml
 create mode 100644 Fedora/input/checks/templates/Makefile
 create mode 100644 Fedora/input/checks/templates/README
 create mode 100755 Fedora/input/checks/templates/create_package_installed.py
 create mode 100644 Fedora/input/checks/templates/output/.gitignore
 create mode 100644 Fedora/input/checks/templates/packages_installed.csv
 create mode 100644 Fedora/input/checks/templates/template_BASH_package_installed
 create mode 100644 Fedora/input/checks/templates/template_package_installed
 create mode 100644 Fedora/input/fixes/bash/service_ntpd_enabled.sh

diff --git a/Fedora/input/checks/package_ntp_installed.xml b/Fedora/input/checks/package_ntp_installed.xml
new file mode 100644
index 0000000..389f166
--- /dev/null
+++ b/Fedora/input/checks/package_ntp_installed.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_ntp_installed"
+  version="1">
+    <metadata>
+      <title>Package ntp Installed</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The RPM package ntp should be installed.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="package ntp is installed"
+      test_ref="test_package_ntp_installed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="all_exist"
+  id="test_package_ntp_installed" version="1"
+  comment="package ntp is installed">
+    <linux:object object_ref="obj_package_ntp_installed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_ntp_installed" version="1">
+    <linux:name>ntp</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/Fedora/input/checks/service_ntpd_enabled.xml b/Fedora/input/checks/service_ntpd_enabled.xml
new file mode 100644
index 0000000..171640b
--- /dev/null
+++ b/Fedora/input/checks/service_ntpd_enabled.xml
@@ -0,0 +1,37 @@
+<def-group>
+  <definition class="compliance" id="service_ntpd_enabled" version="1">
+    <metadata>
+      <title>Service ntpd Enabled</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>
+        The ntpd service should be enabled.
+      </description>
+    </metadata>
+    <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
+    <extend_definition comment="ntp installed" definition_ref="package_ntp_installed" />
+      <criterion comment="ntpd multi-user.target" test_ref="test_ntpd_enabled_multi_user_target" />
+    </criteria>
+  </definition>
+
+  <unix:file_test check="all" check_existence="at_least_one_exists"
+   comment="look for ntpd.service in /etc/systemd/system/multi-user.target.wants"
+   id="test_ntpd_enabled_multi_user_target" version="1">
+
+    <unix:object object_ref="object_ntpd_enabled_multi_user_target" />
+  </unix:file_test>
+
+  <unix:file_object comment="look for ntpd.service in /etc/systemd/system/multi-user.target.wants"
+   id="object_ntpd_enabled_multi_user_target" version="1">
+
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:filepath>/etc/systemd/system/multi-user.target.wants/ntpd.service</unix:filepath>
+    <filter action="include">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_state id="state_symlink" version="1">
+    <unix:type operation="equals">symbolic link</unix:type>
+  </unix:file_state>
+
+</def-group>
diff --git a/Fedora/input/checks/templates/Makefile b/Fedora/input/checks/templates/Makefile
new file mode 100644
index 0000000..b0236b0
--- /dev/null
+++ b/Fedora/input/checks/templates/Makefile
@@ -0,0 +1,18 @@
+templates: packages
+
+packages:
+	./create_package_installed.py packages_installed.csv
+
+compare:
+	diff output/ ../ | grep -v "Only in ../"
+
+copy:
+	cp output/*.xml ../
+	cp output/*.sh ../../fixes/bash/
+
+find-untemplated: templates
+	./find_untemplated.py
+
+clean:
+	rm -f output/*.xml
+	rm -f output/*.sh
diff --git a/Fedora/input/checks/templates/README b/Fedora/input/checks/templates/README
new file mode 100644
index 0000000..f028c5f
--- /dev/null
+++ b/Fedora/input/checks/templates/README
@@ -0,0 +1,35 @@
+These templates are designed to make generation of OVAL tests
+which have repetitive structure easier.
+
+For example:
+	$ ./create_services_disabled.py services_disabled.csv
+will produce all the OVAL checks (in a shorthand format)
+to disable services, and store them in the output directory.
+
+The CSV input files should contain all the relevant information
+for each check.  Files should be compared to existing OVAL checks
+for consistency before copying to the main checks directory.
+
+
+A Makefile exists to activate all the scripts here and ease comparison
+with existing checks. For example, to run all scripts to generate
+OVAL checks from the available templates:
+	$ make templates
+
+To compare the newly-generated files in the output directory to the existing
+checks, run:
+	$ make compare
+
+Then, if the changes are agreeable, the following command can be run to copy the
+newly generated files to the main checks directory:
+	$ make copy
+
+To list files that have been manually created (and may potentially be
+templated), run:
+	# make find-untemplated
+
+Note, however, that some checks may have been intentionally hand-edited.
+For example, some sysctl checks (such as for IPv6) may include additional
+tests so that they pass if the IPv6 module is disabled.  Never blindly
+copy over existing checks.
+
diff --git a/Fedora/input/checks/templates/create_package_installed.py b/Fedora/input/checks/templates/create_package_installed.py
new file mode 100755
index 0000000..1701f07
--- /dev/null
+++ b/Fedora/input/checks/templates/create_package_installed.py
@@ -0,0 +1,46 @@
+#!/usr/bin/python
+
+#
+# create_package_installed.py
+#   automatically generate checks for installed packages
+#
+# NOTE: The file 'template_package_installed' should be located in the same working directory as this script. The
+# template contains the following tags that *must* be replaced successfully in order for the checks to work.
+#
+# PKGNAME - the name of the package that should be installed
+#
+
+import sys, csv, re
+
+def output_check(package_info):
+    pkgname = package_info[0]
+    if pkgname:
+        with open("./template_package_installed", 'r') as OVALtemplatefile:
+            filestring = OVALtemplatefile.read()
+            filestring = filestring.replace("PKGNAME", pkgname)
+            with open("./output/package_" + pkgname + "_installed.xml", 'wb+') as OVALoutputfile:
+                OVALoutputfile.write(filestring)
+                OVALoutputfile.close()
+	with open("./template_BASH_package_installed", 'r') as BASHtemplatefile:
+		filestring = BASHtemplatefile.read()
+		filestring = filestring.replace("PKGNAME", pkgname)
+		with open("./output/package_" + pkgname + "_installed.sh", 'wb+') as BASHoutputfile:
+			BASHoutputfile.write(filestring)
+			BASHoutputfile.close()
+    else:
+        print "ERROR: input violation: the package name must be defined"
+
+def main():
+    if len(sys.argv) < 2:
+        print("usage: %s <CSV_FILE_PATH>" % sys.argv[0])
+        print("   the csv file should contain lines of the format:")
+        print("   PACKAGE_NAME")
+        sys.exit(1)
+    with open(sys.argv[1], 'r') as csv_file:
+        csv_lines = csv.reader(csv_file)
+        for line in csv_lines:
+            output_check(line)
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
diff --git a/Fedora/input/checks/templates/output/.gitignore b/Fedora/input/checks/templates/output/.gitignore
new file mode 100644
index 0000000..9fa9e7b
--- /dev/null
+++ b/Fedora/input/checks/templates/output/.gitignore
@@ -0,0 +1,3 @@
+# files to ignore
+*.xml
+*.sh
diff --git a/Fedora/input/checks/templates/packages_installed.csv b/Fedora/input/checks/templates/packages_installed.csv
new file mode 100644
index 0000000..dc37c5a
--- /dev/null
+++ b/Fedora/input/checks/templates/packages_installed.csv
@@ -0,0 +1 @@
+ntp
diff --git a/Fedora/input/checks/templates/template_BASH_package_installed b/Fedora/input/checks/templates/template_BASH_package_installed
new file mode 100644
index 0000000..1ea466e
--- /dev/null
+++ b/Fedora/input/checks/templates/template_BASH_package_installed
@@ -0,0 +1 @@
+yum -y install PKGNAME
diff --git a/Fedora/input/checks/templates/template_package_installed b/Fedora/input/checks/templates/template_package_installed
new file mode 100644
index 0000000..84f1190
--- /dev/null
+++ b/Fedora/input/checks/templates/template_package_installed
@@ -0,0 +1,25 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_PKGNAME_installed"
+  version="1">
+    <metadata>
+      <title>Package PKGNAME Installed</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The RPM package PKGNAME should be installed.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="package PKGNAME is installed"
+      test_ref="test_package_PKGNAME_installed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="all_exist"
+  id="test_package_PKGNAME_installed" version="1"
+  comment="package PKGNAME is installed">
+    <linux:object object_ref="obj_package_PKGNAME_installed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_PKGNAME_installed" version="1">
+    <linux:name>PKGNAME</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/Fedora/input/fixes/bash/service_ntpd_enabled.sh b/Fedora/input/fixes/bash/service_ntpd_enabled.sh
new file mode 100644
index 0000000..4c9b5c6
--- /dev/null
+++ b/Fedora/input/fixes/bash/service_ntpd_enabled.sh
@@ -0,0 +1,17 @@
+#
+# Install ntp package if necessary
+#
+
+yum -y install ntp
+
+#
+# Enable ntpd service (for current systemd target)
+#
+
+systemctl enable ntpd.service
+
+#
+# Start ntpd if not currently running
+#
+
+systemctl start ntpd.service
diff --git a/Fedora/input/services/ntp.xml b/Fedora/input/services/ntp.xml
index 7462f4a..37d3611 100644
--- a/Fedora/input/services/ntp.xml
+++ b/Fedora/input/services/ntp.xml
@@ -42,7 +42,7 @@ logs and auditing possible security breaches.
 The NTP daemon offers all of the functionality of <tt>ntpdate</tt>, which is
 now deprecated.  Additional information on this is available at
 http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</rationale>
-<!-- <oval id="service_ntpd_enabled" /> -->
+<oval id="service_ntpd_enabled" />
 <ref nist="AU-8(1)" disa="160" />
 </Rule>
 
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 40d79b5..ec056f3 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global	fedorassgversion	4.rc3
+%global	fedorassgversion	4.rc4
 
 Name:		scap-security-guide
 Version:	0.1.%{fedorassgversion}
@@ -53,6 +53,10 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
 %doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html
 
 %changelog
+* Mon Nov 25 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc4-1
+- Initial OVAL check if ntpd service is enabled. Add package_installed
+  OVAL templating directory structure and functionality.
+
 * Fri Nov 22 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc3-1
 - Include services section, and XCCDF description for selected ntpd's
   sshd's service rules
-- 
1.8.3.1

