Bastille bug fixes and enhancements
cover Bastille bug fixes and enhancements
The patches in this set consist of a number of actual bug fixes and a few enhancements. The two enhancements are:
1) A change in the semantics of the -l flag so that it lists configuration files even if Bastille has not been run previously.
2) A change in the distributions are inferred, specified, and observed so that a distribution can always be specified and so that a specified distribution overrides an inferred distribution when they are different.
At this point, the Bastille screens will show the appropriate questions and when the questions have been responded to it will write out the responses to the config file.
The two significant things that it cannot do, but that the documentation claims that it does are:
1) Test the system on which it is run for answers to the questions.
2) Make changes to the system based on those answers.
Clearly, code has at one time been written to effect those changes on some systems. But the following things don't work, and appear to be due to bugs in the existing code base rather than errors in the set-up.
1) After the answers have been given InteractiveBastille is supposed to not only write out the responses to the config file but invoke BastilleBackEnd so that it makes the changes. The existing code does not do this correctly, and fails to make any changes. The method that is invoked for this purpose is Run_Bastille_with_Config. The definition of this comment has above it the comment "Not used in HP-UX. Run_Bastille_with_Config may be dead code in all OS-s." which does not inspire confidence.
2) If it were the case that "bastille -b" were effective, i.e., if bastille could be run so as to apply the contents of the config file to the system, problem (1) would not be so serious. But this is not the case. Instead, Bastille encounters a variety of fatal errors in the Bastille source, arising, at least in part, from a propensity to invoke HP-UX specific code regardless of the distro.
3) Bastille is quite unable even to assess the status of a system with regard to the questions asked. In its current state, the result of an assessment is a file with no entries. This can be changed with relative ease, so that the code that will attempt to discover the answers to the relevant questions is executed. However, in that case, the same fatal errors as described in point
(2) are encountered.
4) Generally speaking, the code appears to be bug-ridden. Attempting to fix it to the point that it actually works might actually be more expensive and less rewarding than starting from scratch.
Perhaps this version of Bastille could be kept as a record of decisions made about the appropriate issues to address for security on Yocto distributions, but no further effort be made to fix it. Instead, some other alternative could be found to achieve the same results. Here are two possibilities:
1) OpenScap's oscap tool (open-scap.org). This tool is all about security and the source code repository was last updated a few days ago. It might work nicely with the Script Check Engine for XCCDF which is described at pvrabec.livejournal.com/887.html.
2) Puppet (puppetlabs.com) is more general and is about configuring anything at all for various purposes. It has some associated applications, including Facter (which finds out facts about the system on which it is running. These applications have been written in Ruby.
The following changes since commit 600a74468bf6d2e2f865e7d7c70e68c60c829234:
lib-perl: Change description to match package. (2013-08-20 08:39:35 -0700)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib mulhern/bastille-final
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=mulhern/bastille-final
mulhern (5):
Bastille: Preliminary cleanup of existing patches.
Bastille: Miscellaneous fixes to the Bastille code base.
Bastille: change in behavior of bastille -l.
Bastille: accept and observe --os flag in multiple situations.
Bastille: set Yocto specific questions via config file.
recipes-security/bastille/bastille_3.2.1.bb | 18 +-
.../files/Curses-and-IOLoader-changes.patch | 50 ---
.../bastille/files/accept_os_flag_in_backend.patch | 28 ++
.../bastille/files/allow_os_with_assess.patch | 37 ++
.../bastille/files/call_output_config.patch | 13 +
.../bastille/files/edit_usage_message.patch | 26 ++
.../bastille/files/find_existing_config.patch | 58 +++
.../files/fix_missing_use_directives.patch | 48 ++
.../bastille/files/fix_number_of_modules.patch | 32 ++
...rd-patch.patch => fixed_defined_warnings.patch} | 32 +-
.../bastille/files/organize_distro_discovery.patch | 470 ++++++++++++++++++++
.../remove_questions_text_file_references.patch | 24 +
.../bastille/files/set_required_questions.py | 135 ++++++
.../bastille/files/simplify_B_place.patch | 34 ++
.../files/upgrade_options_processing.patch | 85 ++++
15 files changed, 1015 insertions(+), 75 deletions(-)
delete mode 100644 recipes-security/bastille/files/Curses-and-IOLoader-changes.patch
create mode 100644 recipes-security/bastille/files/accept_os_flag_in_backend.patch
create mode 100644 recipes-security/bastille/files/allow_os_with_assess.patch
create mode 100644 recipes-security/bastille/files/call_output_config.patch
create mode 100644 recipes-security/bastille/files/edit_usage_message.patch
create mode 100644 recipes-security/bastille/files/find_existing_config.patch
create mode 100644 recipes-security/bastille/files/fix_missing_use_directives.patch
create mode 100644 recipes-security/bastille/files/fix_number_of_modules.patch
rename recipes-security/bastille/files/{yocto-standard-patch.patch => fixed_defined_warnings.patch} (65%)
create mode 100644 recipes-security/bastille/files/organize_distro_discovery.patch
create mode 100644 recipes-security/bastille/files/remove_questions_text_file_references.patch
create mode 100755 recipes-security/bastille/files/set_required_questions.py
create mode 100644 recipes-security/bastille/files/simplify_B_place.patch
create mode 100644 recipes-security/bastille/files/upgrade_options_processing.patchSignature · 1 line
1.7.10.4
PATCH 1/5 Bastille: Preliminary cleanup of existing patches.
[YOCTO #3867]
Renames existing patches and removes some changes.
Curses-and-IOLoader-changes.patch is renamed to call_output_config.patch. The new patch omits the removal of the pruning step in Load_Questions but retains the replacement of a call to a non-existant function with a call to an appropriate implemented function.
yocto-standard-patch.patch is renamed to fixed_defined_warnings.patch. The new patch omits the definition of a yocto distro but includes the defined warnings fix.
The recipe file is changed to include the new patches and also to omit a related action in the do_install script.
---
recipes-security/bastille/bastille_3.2.1.bb | 5 +-
.../files/Curses-and-IOLoader-changes.patch | 50 --------------------
.../bastille/files/call_output_config.patch | 13 +++++
...rd-patch.patch => fixed_defined_warnings.patch} | 32 ++++---------
4 files changed, 25 insertions(+), 75 deletions(-)
delete mode 100644 recipes-security/bastille/files/Curses-and-IOLoader-changes.patch
create mode 100644 recipes-security/bastille/files/call_output_config.patch
rename recipes-security/bastille/files/{yocto-standard-patch.patch => fixed_defined_warnings.patch} (65%)recipes-security/bastille/bastille_3.2.1.bb +2 -3
@@ -17,8 +17,8 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://ServiceAdmin.pm \ file://config \ file://fix_version_parse.patch \ - file://yocto-standard-patch.patch \ - file://Curses-and-IOLoader-changes.patch \ + file://fixed_defined_warnings.patch \ + file://call_output_config.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
@@ -136,7 +136,6 @@ do_install () { done ln -s ${D}${sbindir}/RevertBastille ${D}${sbindir}/UndoBastille - sed -i 's/3.8.11-yocto-standard/${KERNEL_VERSION}/g' ${D}${libdir}/Bastille/API.pm } FILES_${PN} += "${datadir}/Bastille ${libdir}/Bastille ${libdir}/perl* ${sysconfdir}/*"
recipes-security/bastille/files/Curses-and-IOLoader-changes.patch deleted +0 -50
50 lines not on this page · raw message
recipes-security/bastille/files/call_output_config.patch new file +13 -0
@@ -0,0 +1,13 @@ +Index: Bastille/Bastille_Curses.pm +=================================================================== +--- Bastille.orig/Bastille_Curses.pm 2013-08-21 08:58:53.899950000 -0400 ++++ Bastille/Bastille_Curses.pm 2013-08-21 09:20:20.295950005 -0400 +@@ -84,7 +84,7 @@ + } + + # Output answers to the script and display +- &checkAndSaveConfig(&getGlobal('BFILE', "config")); ++ &outputConfig; + + # Run Bastille +
recipes-security/bastille/files/fixed_defined_warnings.patch renamed from recipes-security/bastille/files/yocto-standard-patch.patch +10 -22
@@ -16,31 +16,22 @@ Signed-off-by: Andrei Dinu <[email protected]> Bastille/API.pm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) -diff --git a/Bastille/API.pm b/Bastille/API.pm -index 40f8c72..ebbe9f7 100644 ---- a/Bastille/API.pm -+++ b/Bastille/API.pm -@@ -445,8 +445,8 @@ sub GetDistro() { +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2008-09-14 19:56:53.000000000 -0400 ++++ Bastille/Bastille/API.pm 2013-08-21 08:55:26.715950001 -0400 +@@ -445,8 +445,8 @@ $release=`/usr/bin/uname -sr`; } else { - print STDERR "$err Could not determine operating system version!\n"; - $distro="unknown"; -+ #print STDERR "$err Could not determine operating system version!\n"; -+ $distro="3.8.11-yocto-standard"; ++ print STDERR "$err Could not determine operating system version!\n"; ++ $distro="unknown" } # Figure out what kind of system we're on. -@@ -537,7 +537,7 @@ sub getSupportedOSHash () { - "DB2.2", "DB3.0", - "RH6.0","RH6.1","RH6.2","RH7.0", - "RH7.1","RH7.2","RH7.3","RH8.0", -- "RH9", -+ "RH9","3.8.11-yocto-standard", - "RHEL5", - "RHEL4AS","RHEL4ES","RHEL4WS", - "RHEL3AS","RHEL3ES","RHEL3WS", -@@ -1284,7 +1284,7 @@ sub B_write_sums { +@@ -1284,7 +1284,7 @@ my $sumFile = &getGlobal('BFILE',"sum.csv");
@@ -49,7 +40,7 @@ index 40f8c72..ebbe9f7 100644 open( SUM, "> $sumFile") or &B_log("ERROR","Unable to open $sumFile for write.\n$!\n"); -@@ -1318,7 +1318,7 @@ sub B_check_sum($) { +@@ -1318,7 +1318,7 @@ my $file = $_[0]; my $cksum = &getGlobal('BIN',"cksum");
@@ -58,7 +49,7 @@ index 40f8c72..ebbe9f7 100644 &B_read_sums; } -@@ -1375,7 +1375,7 @@ sub listModifiedFiles { +@@ -1375,7 +1375,7 @@ sub B_isFileinSumDB($) { my $file = $_[0];
@@ -67,6 +58,3 @@ index 40f8c72..ebbe9f7 100644 &B_log("DEBUG","Reading in DB from B_isFileinSumDB"); &B_read_sums; } --- -1.7.9.5 -
Signature · 1 line
1.7.10.4
PATCH 2/5 Bastille: Miscellaneous fixes to the Bastille code base.
In reply to mulhern[YOCTO #3867]
Adds four additional small patches which address miscellaneous small problems in Bastille.
The four patches are:
fix_missing_use_directives.patch: A number of use directives were missing from several files. These were added as discovered.
fix_number_of_modules.patch: The curses interface includes a title for most screens which gives a module, a module number, and the number of modules in the series. Previously the last value was always 0, now it is simply omitted. It would be more desirable to give the correct number, but this would require a significant change to the code base.
remove_questions_text_file_references.patch: This version of Bastille does not make use of a Questions.txt file, therefore the specification of the location of this file in the OSMap/*.bastille files has been removed.
simplify_B_place.patch: This patch discards redundant variables, mostly defined but not used cases, and makes the error reporting more informative.
--- recipes-security/bastille/bastille_3.2.1.bb | 4 ++ .../files/fix_missing_use_directives.patch | 48 ++++++++++++++++++++ .../bastille/files/fix_number_of_modules.patch | 32 +++++++++++++ .../remove_questions_text_file_references.patch | 24 ++++++++++ .../bastille/files/simplify_B_place.patch | 34 ++++++++++++++ 5 files changed, 142 insertions(+) create mode 100644 recipes-security/bastille/files/fix_missing_use_directives.patch create mode 100644 recipes-security/bastille/files/fix_number_of_modules.patch create mode 100644 recipes-security/bastille/files/remove_questions_text_file_references.patch create mode 100644 recipes-security/bastille/files/simplify_B_place.patch
recipes-security/bastille/bastille_3.2.1.bb +4 -0
@@ -19,6 +19,10 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://fix_version_parse.patch \ file://fixed_defined_warnings.patch \ file://call_output_config.patch \ + file://fix_missing_use_directives.patch \ + file://fix_number_of_modules.patch \ + file://remove_questions_text_file_references.patch \ + file://simplify_B_place.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/fix_missing_use_directives.patch new file +48 -0
48 lines not on this page · raw message
recipes-security/bastille/files/fix_number_of_modules.patch new file +32 -0
@@ -0,0 +1,32 @@ +Index: Bastille/Bastille_Curses.pm +=================================================================== +--- Bastille.orig/Bastille_Curses.pm 2013-08-24 18:21:54.445288000 -0400 ++++ Bastille/Bastille_Curses.pm 2013-08-24 18:29:16.981288000 -0400 +@@ -36,9 +36,6 @@ + use Curses; + use Curses::Widgets; + +- # Number_Modules is the number of modules loaded in by Load_Questions +- $Number_Modules=0; +- + # + # Highlighted button is the button currently chosen in the button bar + # We preserve this from question to question... +@@ -397,7 +394,7 @@ + my $title; + + if ($module) { +- $title=$module . " of $Number_Modules"; ++ $title=$module; + } + + txt_field( 'window' => $window, +@@ -488,7 +485,7 @@ + my $title; + + if ($module) { +- $title=$module . " of $Number_Modules"; ++ $title=$module; + } + + noecho;
recipes-security/bastille/files/remove_questions_text_file_references.patch new file +24 -0
@@ -0,0 +1,24 @@ +Index: Bastille/OSMap/LINUX.bastille +=================================================================== +--- Bastille.orig/OSMap/LINUX.bastille 2008-01-25 18:31:35.000000000 -0500 ++++ Bastille/OSMap/LINUX.bastille 2013-08-22 04:48:32.677968002 -0400 +@@ -12,7 +12,6 @@ + + bfile,InteractiveBastille,'/usr/sbin/InteractiveBastille' + bfile,BastilleBackEnd,'/usr/sbin/BastilleBackEnd' +-bfile,Questions,'/usr/share/Bastille/Questions.txt' + bfile,QuestionsModules,'/usr/share/Bastille/Modules.txt' + bfile,TODO,'/var/log/Bastille/TODO' + bfile,TODOFlag,'/var/log/Bastille/TODOFlag.txt' +Index: Bastille/OSMap/OSX.bastille +=================================================================== +--- Bastille.orig/OSMap/OSX.bastille 2007-09-11 18:09:26.000000000 -0400 ++++ Bastille/OSMap/OSX.bastille 2013-08-22 04:48:47.245968001 -0400 +@@ -10,7 +10,6 @@ + bdir,share,'/usr/share/Bastille' + + bfile,BastilleBackEnd,'/var/root/Bastille/BastilleBackEnd' +-bfile,Questions,'/usr/share/Bastille/Questions.txt' + bfile,QuestionsModules,'/usr/share/Bastille/Modules.txt' + bfile,TODO,'/var/log/Bastille/TODO' + bfile,TODOFlag,'/var/log/Bastille/TODOFlag.txt'
recipes-security/bastille/files/simplify_B_place.patch new file +34 -0
@@ -0,0 +1,34 @@ +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2013-08-21 08:59:17.939950001 -0400 ++++ Bastille/Bastille/API.pm 2013-08-21 08:59:30.983950001 -0400 +@@ -1679,24 +1679,22 @@ + + use File::Copy; + +- my $original_source=$source; + $source = &getGlobal('BDIR', "share") . $source; +- my $original_target=$target; + + if ( -e $target and -f $target ) { +- &B_backup_file($original_target); +- &B_log("ACTION","About to copy $original_source to $original_target -- had to backup target\n"); ++ &B_backup_file($target); ++ &B_log("ACTION","About to copy $source to $target -- had to backup target\n"); + $had_to_backup_target=1; + } + $retval=copy($source,$target); + if ($retval) { +- &B_log("ACTION","placed file $original_source as $original_target\n"); ++ &B_log("ACTION","placed file $source as $target\n"); + # + # We want to add a line to the &getGlobal('BFILE', "created-files") so that the + # file we just put at $original_target gets deleted. +- &B_revert_log(&getGlobal('BIN',"rm") . " $original_target\n"); ++ &B_revert_log(&getGlobal('BIN',"rm") . " $target\n"); + } else { +- &B_log("ERROR","Failed to place $original_source as $original_target\n"); ++ &B_log("ERROR","Failed to place $source as $target\n"); + } + + # We add the file to the GLOBAL_SUMS hash if it is not already present
Signature · 1 line
1.7.10.4
PATCH 3/5 Bastille: change in behavior of bastille -l.
In reply to mulhern[YOCTO #3867]
bastille -l now reports existing configuration file paths even if it has not previously been run. Previously, it exited with an error if it detected an absence of log files indicating a previous run.
--- recipes-security/bastille/bastille_3.2.1.bb | 1 + .../bastille/files/find_existing_config.patch | 58 ++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 recipes-security/bastille/files/find_existing_config.patch
recipes-security/bastille/bastille_3.2.1.bb +1 -0
@@ -23,6 +23,7 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://fix_number_of_modules.patch \ file://remove_questions_text_file_references.patch \ file://simplify_B_place.patch \ + file://find_existing_config.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/find_existing_config.patch new file +58 -0
58 lines not on this page · raw message
Signature · 1 line
1.7.10.4
PATCH 4/5 Bastille: accept and observe --os flag in multiple situations.
In reply to mulhern[YOCTO #3867]
Five additional patches which cause the --os flag to be accepted and observed are added. An additional distro, Yocto, is added. The individual patches are described below.
upgrade_options_processing.patch: Changes setOptions procedure so that it accepts named parameters for greater flexibility and adjusts all invocations accordingly. Uses more precise specifications in invocatiosn of Getop::Long::GetOptions. Omits code associated with a commented out flag.
accept_os_flag_in_backend.patch: Accepts and observes an additional --os flag in BastilleBackEnd.
allow_os_with_assess.patch: No longer print a usage message and quit if --assess or its related flags are specified along with the --os flag.
edit_usage_message.patch: Edit usage message to include the specification of an --os flag with the specification of an --assess flag.
organize_distro_discovery.patch: Separates inferring the distro from specifying the distro. Adds a "Yocto" distro among the other Linux distros. Causes the specified distro to override the inferred distro with a warning message when they are different. Previously if either the inferred distro or the specified distro was not among supported distros Bastille would quit with an error.
--- recipes-security/bastille/bastille_3.2.1.bb | 5 + .../bastille/files/accept_os_flag_in_backend.patch | 28 ++ .../bastille/files/allow_os_with_assess.patch | 37 ++ .../bastille/files/edit_usage_message.patch | 26 ++ .../bastille/files/organize_distro_discovery.patch | 470 ++++++++++++++++++++ .../files/upgrade_options_processing.patch | 85 ++++ 6 files changed, 651 insertions(+) create mode 100644 recipes-security/bastille/files/accept_os_flag_in_backend.patch create mode 100644 recipes-security/bastille/files/allow_os_with_assess.patch create mode 100644 recipes-security/bastille/files/edit_usage_message.patch create mode 100644 recipes-security/bastille/files/organize_distro_discovery.patch create mode 100644 recipes-security/bastille/files/upgrade_options_processing.patch
recipes-security/bastille/bastille_3.2.1.bb +5 -0
@@ -24,6 +24,11 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://remove_questions_text_file_references.patch \ file://simplify_B_place.patch \ file://find_existing_config.patch \ + file://upgrade_options_processing.patch \ + file://accept_os_flag_in_backend.patch \ + file://allow_os_with_assess.patch \ + file://edit_usage_message.patch \ + file://organize_distro_discovery.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/accept_os_flag_in_backend.patch new file +28 -0
@@ -0,0 +1,28 @@ +Index: Bastille/BastilleBackEnd +=================================================================== +--- Bastille.orig/BastilleBackEnd 2013-08-21 12:40:54.000000000 -0400 ++++ Bastille/BastilleBackEnd 2013-08-21 12:43:21.895950001 -0400 +@@ -52,11 +52,13 @@ + my $force = 0; + my $debug = 0; + my $alternate_config=undef; ++my $os_version=undef; + + if( Getopt::Long::GetOptions( "n" => \$nodisclaim, + "v" => \$verbose, + "force" => \$force, + "f=s" => \$alternate_config, ++ "os=s" => \$os_version, + "debug" => \$debug) ) { + $error = 0; # no parse error + +@@ -66,7 +68,8 @@ + + &setOptions( + debug => $debug, +- verbose => $verbose); ++ verbose => $verbose, ++ os => $os_version); + &ConfigureForDistro; + + if ( $error ) { # GetOptions couldn't parse all of the args
recipes-security/bastille/files/allow_os_with_assess.patch new file +37 -0
@@ -0,0 +1,37 @@ +Index: Bastille/bin/bastille +=================================================================== +--- Bastille.orig/bin/bastille 2013-08-21 08:59:06.647950000 -0400 ++++ Bastille/bin/bastille 2013-08-21 15:55:53.193631711 -0400 +@@ -195,7 +195,6 @@ + systemFileLocations + + isAssessing='no' +-nonXArg='no' + + if [ $PERL_V_MAJ -eq $MIN_V_MAJ -a $PERL_V_MIN -lt $MIN_V_MIN -o $PERL_V_MAJ -lt $MIN_V_MAJ ]; then # invalid Perl + printErr +@@ -316,12 +315,10 @@ + '--os') + options_left="$options_left --os" + optarg='yes' +- nonXArg='yes' + ;; + '-f') + options_left="$options_left -f" + optarg='yes' +- nonXArg='yes' + ;; + # Non-exclusive (undocumented and unsupported) options follow: + # There is no validity/combination checking done with these. +@@ -345,11 +342,6 @@ + fi + done + +-#Detect case where -f or --os attempted use with --assess +- if [ \( x$nonXArg = xyes \) -a \( x$isAssessing = xyes \) ]; then +- printUsage +- exit 2 +- fi + + # We have a valid version of perl! Verify that all the required + # modules can be found.
recipes-security/bastille/files/edit_usage_message.patch new file +26 -0
@@ -0,0 +1,26 @@ +Index: Bastille/bin/bastille +=================================================================== +--- Bastille.orig/bin/bastille 2013-08-25 14:16:35.614779001 -0400 ++++ Bastille/bin/bastille 2013-08-25 14:16:38.674779000 -0400 +@@ -60,7 +60,7 @@ + printUsage () { + cat >&2 << EOF + $ERRSPACES Usage: bastille [ -b | -c | -x ] [ --os <version>] [ -f <alternate config> ] +-$ERRSPACES bastille [-r | -l | -h | --assess | --assessnobrowser ] ++$ERRSPACES bastille [-r | -l | -h | --assess | --assessnobrowser ] [ --os <version> ] + $ERRSPACES -b : use a saved config file to apply changes + $ERRSPACES directly to system + $ERRSPACES -c : use the Curses (non-X11) GUI, not available on HP-UX +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2013-08-25 08:15:40.266779002 -0400 ++++ Bastille/Bastille/API.pm 2013-08-25 14:18:22.750778811 -0400 +@@ -206,7 +206,7 @@ + #options before interactive or Bastille runs, so this check is often redundant + $GLOBAL_ERROR{"usage"}="\n". + "$spc Usage: bastille [ -b | -c | -x ] [ --os <version> ] [ -f <alternate config> ]\n". +- "$spc bastille [ -r | --assess | --assessnobowser ]\n\n". ++ "$spc bastille [ -r | --assess | --assessnobowser ] [ --os <version> ]\n\n". + "$spc --assess : check status of system and report in browser\n". + "$spc --assessnobrowser : check status of system and list report locations\n". + "$spc -b : use a saved config file to apply changes\n".
recipes-security/bastille/files/organize_distro_discovery.patch new file +470 -0
470 lines not on this page · raw message
recipes-security/bastille/files/upgrade_options_processing.patch new file +85 -0
85 lines not on this page · raw message
Signature · 1 line
1.7.10.4
PATCH 5/5 Bastille: set Yocto specific questions via config file.
In reply to mulhern[YOCTO #3867]
The python script, set_required_questions.py reads the list of questions and answers from the config file and edits the REQUIRE_DISTRO field for those questions in the questions file so that it includes "Yocto" if it is not already present. This has the effect of causing Bastille, when loading questions for the Yocto distribution, to load only those that are answered in the existing config file. Under the assumption that the exisitng config file contains question/answer pairs that are relevant to the Yocto project, this will cause the interactive question screen to have answers that are relevant to the Yocto project.
--- recipes-security/bastille/bastille_3.2.1.bb | 3 + .../bastille/files/set_required_questions.py | 135 ++++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100755 recipes-security/bastille/files/set_required_questions.py
recipes-security/bastille/bastille_3.2.1.bb +3 -0
@@ -139,6 +139,9 @@ do_install () { install -m 0644 OSMap/HP-UX.service ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.bastille ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.system ${D}${datadir}/Bastille/OSMap + + ${THISDIR}/files/set_required_questions.py ${WORKDIR}/config Questions + install -m 0777 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config for file in `cat Modules.txt` ; do
recipes-security/bastille/files/set_required_questions.py new file +135 -0
135 lines not on this page · raw message
Signature · 1 line
1.7.10.4
Re: [PATCH 5/5] Bastille: set Yocto specific questions via config file.
Quoted 24 lines · mulhern
[YOCTO #3867]
The python script,
set_required_questions.pyreads the list of questions and answers from the config file and edits theREQUIRE_DISTROfield for those questions in the questions file so that it includes "Yocto" if it is not already present. This has the effect of causing Bastille, when loading questions for the Yocto distribution, to load only those that are answered in the existing config file. Under the assumption that the exisitng config file contains question/answer pairs that are relevant to the Yocto project, this will cause the interactive question screen to have answers that are relevant to the Yocto project.Signed-off-by mulhern <[email protected]>--- recipes-security/bastille/bastille_3.2.1.bb | 3 + .../bastille/files/set_required_questions.py | 135 ++++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100755 recipes-security/bastille/files/set_required_questions.pyrecipes-security/bastille/bastille_3.2.1.bb +0
-0
recipes-security/bastille/bastille_3.2.1.bb do_install () { · line 144
Quoted 6 lines
recipes-security/bastille/bastille_3.2.1.bb +3
-0@@ -139,6 +139,9 @@ do_install () { install -m 0644 OSMap/HP-UX.service ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.bastille ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.system ${D}${datadir}/Bastille/OSMap + + ${THISDIR}/files/set_required_questions.py ${WORKDIR}/config Questions +
Inconsistent whitespace.
Quoted 151 lines
recipes-security/bastille/bastille_3.2.1.bb +0
-0install -m 0777 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config for file in `cat Modules.txt` ; dorecipes-security/bastille/files/set_required_questions.py new file +135
-0@@ -0,0 +1,135 @@ +#!/usr/bin/env python + +import argparse, os, shutil, sys, tempfile +from os import path + + + +def get_config(lines): + """ + From a sequence of lines retrieve the question file name, question identifier + pairs. + """ + for l in lines: + if not l.startswith("#"): + try: + (coord, value) = l.split("=") + try: + (fname, ident) = coord.split(".") + yield fname, ident + except ValueError as e: + raise ValueError("Badly formatted coordinates %s in line %s." % (coord, l.strip())) + except ValueError as e: + raise ValueError("Skipping badly formatted line %s, %s" % (l.strip(), e)) + + + +def check_contains(line, name): + """ + Check if the value field for REQUIRE_DISTRO contains the given name. + @param name line The REQUIRE_DISTRO line + @param name name The name to look for in the value field of the line. + """ + try: + (label, distros) = line.split(":") + return name in distros.split() + except ValueError as e: + raise ValueError("Error splitting REQUIRE_DISTRO line: %s" % e) + + + +def add_requires(the_ident, distro, lines): + + """ + Yield a sequence of lines the same as lines except that where + the_ident matches a question identifier change the REQUIRE_DISTRO so that + it includes the specified distro. + + @param name the_ident The question identifier to be matched. + @param name distro The distribution to added to the questions REQUIRE_DISTRO + field. + @param lines The sequence to be processed. + """ + for l in lines: + yield l + if l.startswith("LABEL:"): + try: + (label, ident) = l.split(":") + if ident.strip() == the_ident: + break + except ValueError as e: + raise ValueError("Unexpected line %s in questions file." % l.strip()) + for l in lines: + if l.startswith("REQUIRE_DISTRO"): + if not check_contains(l, distro): + yield l.rstrip() + " " + distro + "\n" + else: + yield l + break; + else: + yield l + for l in lines: + yield l + + + +def xform_file(qfile, distro, qlabel): + questions_in = open(qfile) + questions_out = tempfile.NamedTemporaryFile(delete=False) + for l in add_requires(qlabel, distro, questions_in): + questions_out.write(l) + questions_out.close() + questions_in.close() + shutil.move(questions_out.name, qfile) + + + +def handle_args(parser): + parser.add_argument('config_file', + help = "Configuration file path.") + parser.add_argument('questions_dir', + help = "Directory containing Questions files.") + parser.add_argument('--distro', '-d', + help = "The distribution, the default is Yocto.", + default = "Yocto") + return parser.parse_args() + + + +def check_args(args): + args.config_file = os.path.abspath(args.config_file) + args.questions_dir = os.path.abspath(args.questions_dir) + + if not os.path.isdir(args.questions_dir): + raise ValueError("Specified Questions directory %s does not exist or is not a directory." % args.questions_dir) + + if not os.path.isfile(args.config_file): + raise ValueError("Specified configuration file %s not found." % args.config_file) + + + +def main(): + opts = handle_args(argparse.ArgumentParser(description="A simple script that sets required questions based on the question/answer pairs in a configuration file.")) + + try: + check_args(opts) + except ValueError as e: + sys.exit("Fatal error: %s" % e) + + + try: + config_in = open(opts.config_file) + for qfile, qlabel in get_config(config_in): + questions_file = os.path.join(opts.questions_dir, qfile + ".txt") + xform_file(questions_file, opts.distro, qlabel) + config_in.close() + + except IOError as e: + sys.exit("Fatal error reading config file: %s" % e) + except ValueError as e: + sys.exit("Fatal error: %s" % e) + + + +if __name__ == "__main__": + main()Signature · 6 lines
1.7.10.4 _______________________________________________ yocto mailing list [email protected] https://lists.yoctoproject.org/listinfo/yocto
Signature · 1 line
Martin 'JaMa' Jansa jabber: [email protected]