{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/611","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/611/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/611/comments","events_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/611/events","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/611","id":95000127,"number":611,"title":"[RFE] Implement universal replace_or_append() remediation function","user":{"login":"iankko","id":8414918,"avatar_url":"https://avatars.githubusercontent.com/u/8414918?v=3","gravatar_id":"","url":"https://api.github.com/users/iankko","html_url":"https://github.com/iankko","followers_url":"https://api.github.com/users/iankko/followers","following_url":"https://api.github.com/users/iankko/following{/other_user}","gists_url":"https://api.github.com/users/iankko/gists{/gist_id}","starred_url":"https://api.github.com/users/iankko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iankko/subscriptions","organizations_url":"https://api.github.com/users/iankko/orgs","repos_url":"https://api.github.com/users/iankko/repos","events_url":"https://api.github.com/users/iankko/events{/privacy}","received_events_url":"https://api.github.com/users/iankko/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/Infrastructure","name":"Infrastructure","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-14T17:48:23Z","updated_at":"2015-07-14T19:27:44Z","closed_at":null,"body":"As already mentioned in:\r\n  https://github.com/OpenSCAP/scap-security-guide/pull/572#issuecomment-121287078\r\n\r\nthe majority of existing remediation scripts is performing the following tasks:\r\n* search some concrete text / configuration file for occurrence of a particular keyword,\r\n* verify if value for that keyword / config key is set to expected value,\r\n* if not, update the value of that key to the requirement,\r\n* if the key isn't found at all in the configuration file, append new line having the proper format\r\n```\r\n  key = new_value\r\n```\r\n* also as noted in https://github.com/OpenSCAP/scap-security-guide/pull/572#discussion_r31556153\r\nwe should probably unify on the effort that each remediation script would include a CCE-id comment before adding the new setting (for the case CCE id is known for that concrete rule).\r\n\r\nTherefore this ticket is to propose introduction / implementation of new universal remediation function, which would hide the aforementioned tasks into its input arguments.\r\n\r\nThe proposed declaration is as follows (RFC):\r\n```\r\nreplace_or_append($config_file_location, $key_to_search_for, $new_value)\r\n```\r\n\r\nwith the explanation of arguments being as follows:\r\n* all of them would be required,\r\n* ```$config_file_location``` - the concrete configuration / text file remediation script to act on,\r\n* ```$key_to_search``` - the configuration file key, that should be searched for,\r\n* ```$new_value``` - new value of that key in the config / text file (where new value could be either plain string or some already known variable content).\r\n\r\nAfter some review, there might be another optional parameters be necessary like:\r\n* ```$follow_symlinks``` = (yes|no) for the cases when remediation target is just symlink, but instead of updating it, we should update the target of the symlink, \r\n* etc. (further enhancements might be added once initial version is created)\r\n\r\nExample calls of such a routine would be:\r\n* ```replace_or_append('/etc/sysconfig/prelink', 'PRELINKING', 'no')``` for the ```disable_prelink``` remediation, \r\n* ```replace_or_append('/etc/login.defs', PASS_MAX_DAYS, '$var_accounts_maximum_age_login_defs')``` for the ```accounts_maximum_age_login_defs``` remediation script,\r\n* ```replace_or_append('/etc/audit/auditd.conf', '^admin_space_left_action', \"$var_auditd_admin_space_left_action\")``` for the ```auditd_data_retention_admin_space_left_action``` remediation script\r\n...\r\n\r\nIMHO this approach could simplify the way we currently develop and maintain remediation scripts (it's easier to fix bug in one function, than to fix multiple remediation scripts). Also it's scalable (by adding benchmarks for new products we could develop remediation scripts more quickly). And the proper work of the script is verifiable via upstream test (we could provide selected input file to it, and compare via ```diff -s``` with expected output).\r\n\r\nComments / feedback / patches / PR welcome.\r\n\r\nThanks, Jan."},"comment":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/comments/121348910","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/611#issuecomment-121348910","issue_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/611","id":121348910,"user":{"login":"shawndwells","id":5713754,"avatar_url":"https://avatars.githubusercontent.com/u/5713754?v=3","gravatar_id":"","url":"https://api.github.com/users/shawndwells","html_url":"https://github.com/shawndwells","followers_url":"https://api.github.com/users/shawndwells/followers","following_url":"https://api.github.com/users/shawndwells/following{/other_user}","gists_url":"https://api.github.com/users/shawndwells/gists{/gist_id}","starred_url":"https://api.github.com/users/shawndwells/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawndwells/subscriptions","organizations_url":"https://api.github.com/users/shawndwells/orgs","repos_url":"https://api.github.com/users/shawndwells/repos","events_url":"https://api.github.com/users/shawndwells/events{/privacy}","received_events_url":"https://api.github.com/users/shawndwells/received_events","type":"User","site_admin":false},"created_at":"2015-07-14T19:27:44Z","updated_at":"2015-07-14T19:27:44Z","body":"This makes a lot of sense and would simplify the process of writing remediations. \r\n\r\nTwo initial thoughts:\r\n\r\n#1: How would different name-pair values be set when the syntax is different, e.g.\r\n\r\n`````VARIABLE ${some_value}`````\r\n\r\nvs\r\n\r\n`````VARIABLE=${some_value}`````\r\n\r\n#2:  WRT to symlinks, we should normalizing using `````--follow-symlinks````` with sed during initial version, else we risk breaking end points."}}