Bastille bug fixes and enhancements
cover Bastille bug fixes and enhancements
The patches in this set consist of a number of actual bug fixes and a few enhancements. The two enhancements are:
1) A change in the semantics of the -l flag so that it lists configuration files even if Bastille has not been run previously.
2) A change in the distributions are inferred, specified, and observed so that a distribution can always be specified and so that a specified distribution overrides an inferred distribution when they are different.
At this point, the Bastille screens will show the appropriate questions and when the questions have been responded to it will write out the responses to the config file.
The two significant things that it cannot do, but that the documentation claims that it does are:
1) Test the system on which it is run for answers to the questions.
2) Make changes to the system based on those answers.
Clearly, code has at one time been written to effect those changes on some systems. But the following things don't work, and appear to be due to bugs in the existing code base rather than errors in the set-up.
1) After the answers have been given InteractiveBastille is supposed to not only write out the responses to the config file but invoke BastilleBackEnd so that it makes the changes. The implementation does not do this correctly. The method that is invoked for this purpose is Run_Bastille_with_Config. The definition of this comment has above it the comment "Not used in HP-UX. Run_Bastille_with_Config may be dead code in all OS-s." which does not inspire confidence. The invocation has been removed, so that the screen flicker that it causes will go away.
2) If it were the case that "bastille -b" were effective, i.e., if bastille could be run so as to apply the contents of the config file to the system, problem (1) would not be so serious. But this is not the case. Instead, Bastille encounters a variety of fatal errors in the Bastille source, arising, at least in part, from a propensity to invoke HP-UX specific code regardless of the distro.
3) Bastille is quite unable even to assess the status of a system with regard to the questions asked. In its current state, the result of an assessment is a file with no entries. This can be changed with relative ease, so that the code that will attempt to discover the answers to the relevant questions is executed. However, in that case, the same fatal errors as described in point
(2) are encountered.
4) Generally speaking, the code appears to be bug-ridden. Attempting to fix it to the point that it actually works might actually be more expensive and less rewarding than starting from scratch.
Perhaps this version of Bastille could be kept as a record of decisions made about the appropriate issues to address for security on Yocto distributions, but no further effort be made to fix it. Instead, some other alternative could be found to achieve the same results. Here are two possibilities:
1) OpenScap's oscap tool (open-scap.org). This tool is all about security and the source code repository was last updated a few days ago. It might work nicely with the Script Check Engine for XCCDF which is described at pvrabec.livejournal.com/887.html.
2) Puppet (puppetlabs.com) is more general and is about configuring anything at all for various purposes. It has some associated applications, including Facter (which finds out facts about the system on which it is running). These applications have been written in Ruby.
The following changes since commit 600a74468bf6d2e2f865e7d7c70e68c60c829234:
lib-perl: Change description to match package. (2013-08-20 08:39:35 -0700)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib mulhern/bastille-final
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=mulhern/bastille-final
mulhern (6):
Bastille: Preliminary cleanup of existing patches.
Bastille: Miscellaneous fixes to the Bastille code base.
Bastille: change in behavior of bastille -l.
Bastille: accept and observe --os flag in multiple situations.
Bastille: set Yocto specific questions via config file.
Bastille: document the current status and usability of the Bastille
install.
README | 44 +-
recipes-security/bastille/bastille_3.2.1.bb | 21 +-
.../files/Curses-and-IOLoader-changes.patch | 50 ---
.../bastille/files/accept_os_flag_in_backend.patch | 28 ++
.../bastille/files/allow_os_with_assess.patch | 37 ++
.../bastille/files/call_output_config.patch | 13 +
.../bastille/files/do_not_apply_config.patch | 34 ++
.../bastille/files/edit_usage_message.patch | 26 ++
.../bastille/files/find_existing_config.patch | 58 +++
.../files/fix_missing_use_directives.patch | 48 ++
.../bastille/files/fix_number_of_modules.patch | 32 ++
...rd-patch.patch => fixed_defined_warnings.patch} | 32 +-
.../bastille/files/organize_distro_discovery.patch | 470 ++++++++++++++++++++
.../remove_questions_text_file_references.patch | 24 +
.../bastille/files/set_required_questions.py | 135 ++++++
.../bastille/files/simplify_B_place.patch | 34 ++
.../files/upgrade_options_processing.patch | 85 ++++
17 files changed, 1080 insertions(+), 91 deletions(-)
delete mode 100644 recipes-security/bastille/files/Curses-and-IOLoader-changes.patch
create mode 100644 recipes-security/bastille/files/accept_os_flag_in_backend.patch
create mode 100644 recipes-security/bastille/files/allow_os_with_assess.patch
create mode 100644 recipes-security/bastille/files/call_output_config.patch
create mode 100644 recipes-security/bastille/files/do_not_apply_config.patch
create mode 100644 recipes-security/bastille/files/edit_usage_message.patch
create mode 100644 recipes-security/bastille/files/find_existing_config.patch
create mode 100644 recipes-security/bastille/files/fix_missing_use_directives.patch
create mode 100644 recipes-security/bastille/files/fix_number_of_modules.patch
rename recipes-security/bastille/files/{yocto-standard-patch.patch => fixed_defined_warnings.patch} (65%)
create mode 100644 recipes-security/bastille/files/organize_distro_discovery.patch
create mode 100644 recipes-security/bastille/files/remove_questions_text_file_references.patch
create mode 100755 recipes-security/bastille/files/set_required_questions.py
create mode 100644 recipes-security/bastille/files/simplify_B_place.patch
create mode 100644 recipes-security/bastille/files/upgrade_options_processing.patchSignature · 1 line
1.7.10.4
PATCH 1/6 Bastille: Preliminary cleanup of existing patches.
[YOCTO #3867]
Renames existing patches and removes some changes.
Curses-and-IOLoader-changes.patch is renamed to call_output_config.patch. The new patch omits the removal of the pruning step in Load_Questions but retains the replacement of a call to a non-existant function with a call to an appropriate implemented function.
yocto-standard-patch.patch is renamed to fixed_defined_warnings.patch. The new patch omits the definition of a yocto distro but includes the defined warnings fix.
The recipe file is changed to include the new patches and also to omit a related action in the do_install script.
---
recipes-security/bastille/bastille_3.2.1.bb | 5 +-
.../files/Curses-and-IOLoader-changes.patch | 50 --------------------
.../bastille/files/call_output_config.patch | 13 +++++
...rd-patch.patch => fixed_defined_warnings.patch} | 32 ++++---------
4 files changed, 25 insertions(+), 75 deletions(-)
delete mode 100644 recipes-security/bastille/files/Curses-and-IOLoader-changes.patch
create mode 100644 recipes-security/bastille/files/call_output_config.patch
rename recipes-security/bastille/files/{yocto-standard-patch.patch => fixed_defined_warnings.patch} (65%)recipes-security/bastille/bastille_3.2.1.bb +2 -3
@@ -17,8 +17,8 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://ServiceAdmin.pm \ file://config \ file://fix_version_parse.patch \ - file://yocto-standard-patch.patch \ - file://Curses-and-IOLoader-changes.patch \ + file://fixed_defined_warnings.patch \ + file://call_output_config.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
@@ -136,7 +136,6 @@ do_install () { done ln -s ${D}${sbindir}/RevertBastille ${D}${sbindir}/UndoBastille - sed -i 's/3.8.11-yocto-standard/${KERNEL_VERSION}/g' ${D}${libdir}/Bastille/API.pm } FILES_${PN} += "${datadir}/Bastille ${libdir}/Bastille ${libdir}/perl* ${sysconfdir}/*"
recipes-security/bastille/files/Curses-and-IOLoader-changes.patch deleted +0 -50
50 lines not on this page · raw message
recipes-security/bastille/files/call_output_config.patch new file +13 -0
@@ -0,0 +1,13 @@ +Index: Bastille/Bastille_Curses.pm +=================================================================== +--- Bastille.orig/Bastille_Curses.pm 2013-08-21 08:58:53.899950000 -0400 ++++ Bastille/Bastille_Curses.pm 2013-08-21 09:20:20.295950005 -0400 +@@ -84,7 +84,7 @@ + } + + # Output answers to the script and display +- &checkAndSaveConfig(&getGlobal('BFILE', "config")); ++ &outputConfig; + + # Run Bastille +
recipes-security/bastille/files/fixed_defined_warnings.patch renamed from recipes-security/bastille/files/yocto-standard-patch.patch +10 -22
@@ -16,31 +16,22 @@ Signed-off-by: Andrei Dinu <[email protected]> Bastille/API.pm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) -diff --git a/Bastille/API.pm b/Bastille/API.pm -index 40f8c72..ebbe9f7 100644 ---- a/Bastille/API.pm -+++ b/Bastille/API.pm -@@ -445,8 +445,8 @@ sub GetDistro() { +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2008-09-14 19:56:53.000000000 -0400 ++++ Bastille/Bastille/API.pm 2013-08-21 08:55:26.715950001 -0400 +@@ -445,8 +445,8 @@ $release=`/usr/bin/uname -sr`; } else { - print STDERR "$err Could not determine operating system version!\n"; - $distro="unknown"; -+ #print STDERR "$err Could not determine operating system version!\n"; -+ $distro="3.8.11-yocto-standard"; ++ print STDERR "$err Could not determine operating system version!\n"; ++ $distro="unknown" } # Figure out what kind of system we're on. -@@ -537,7 +537,7 @@ sub getSupportedOSHash () { - "DB2.2", "DB3.0", - "RH6.0","RH6.1","RH6.2","RH7.0", - "RH7.1","RH7.2","RH7.3","RH8.0", -- "RH9", -+ "RH9","3.8.11-yocto-standard", - "RHEL5", - "RHEL4AS","RHEL4ES","RHEL4WS", - "RHEL3AS","RHEL3ES","RHEL3WS", -@@ -1284,7 +1284,7 @@ sub B_write_sums { +@@ -1284,7 +1284,7 @@ my $sumFile = &getGlobal('BFILE',"sum.csv");
@@ -49,7 +40,7 @@ index 40f8c72..ebbe9f7 100644 open( SUM, "> $sumFile") or &B_log("ERROR","Unable to open $sumFile for write.\n$!\n"); -@@ -1318,7 +1318,7 @@ sub B_check_sum($) { +@@ -1318,7 +1318,7 @@ my $file = $_[0]; my $cksum = &getGlobal('BIN',"cksum");
@@ -58,7 +49,7 @@ index 40f8c72..ebbe9f7 100644 &B_read_sums; } -@@ -1375,7 +1375,7 @@ sub listModifiedFiles { +@@ -1375,7 +1375,7 @@ sub B_isFileinSumDB($) { my $file = $_[0];
@@ -67,6 +58,3 @@ index 40f8c72..ebbe9f7 100644 &B_log("DEBUG","Reading in DB from B_isFileinSumDB"); &B_read_sums; } --- -1.7.9.5 -
Signature · 1 line
1.7.10.4
PATCH 2/6 Bastille: Miscellaneous fixes to the Bastille code base.
In reply to mulhern[YOCTO #3867]
Adds four additional small patches which address miscellaneous small problems in Bastille.
The four patches are:
fix_missing_use_directives.patch: A number of use directives were missing from several files. These were added as discovered.
fix_number_of_modules.patch: The curses interface includes a title for most screens which gives a module, a module number, and the number of modules in the series. Previously the last value was always 0, now it is simply omitted. It would be more desirable to give the correct number, but this would require a significant change to the code base.
remove_questions_text_file_references.patch: This version of Bastille does not make use of a Questions.txt file, therefore the specification of the location of this file in the OSMap/*.bastille files has been removed.
simplify_B_place.patch: This patch discards redundant variables, mostly defined but not used cases, and makes the error reporting more informative.
--- recipes-security/bastille/bastille_3.2.1.bb | 4 ++ .../files/fix_missing_use_directives.patch | 48 ++++++++++++++++++++ .../bastille/files/fix_number_of_modules.patch | 32 +++++++++++++ .../remove_questions_text_file_references.patch | 24 ++++++++++ .../bastille/files/simplify_B_place.patch | 34 ++++++++++++++ 5 files changed, 142 insertions(+) create mode 100644 recipes-security/bastille/files/fix_missing_use_directives.patch create mode 100644 recipes-security/bastille/files/fix_number_of_modules.patch create mode 100644 recipes-security/bastille/files/remove_questions_text_file_references.patch create mode 100644 recipes-security/bastille/files/simplify_B_place.patch
recipes-security/bastille/bastille_3.2.1.bb +4 -0
@@ -19,6 +19,10 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://fix_version_parse.patch \ file://fixed_defined_warnings.patch \ file://call_output_config.patch \ + file://fix_missing_use_directives.patch \ + file://fix_number_of_modules.patch \ + file://remove_questions_text_file_references.patch \ + file://simplify_B_place.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/fix_missing_use_directives.patch new file +48 -0
48 lines not on this page · raw message
recipes-security/bastille/files/fix_number_of_modules.patch new file +32 -0
@@ -0,0 +1,32 @@ +Index: Bastille/Bastille_Curses.pm +=================================================================== +--- Bastille.orig/Bastille_Curses.pm 2013-08-24 18:21:54.445288000 -0400 ++++ Bastille/Bastille_Curses.pm 2013-08-24 18:29:16.981288000 -0400 +@@ -36,9 +36,6 @@ + use Curses; + use Curses::Widgets; + +- # Number_Modules is the number of modules loaded in by Load_Questions +- $Number_Modules=0; +- + # + # Highlighted button is the button currently chosen in the button bar + # We preserve this from question to question... +@@ -397,7 +394,7 @@ + my $title; + + if ($module) { +- $title=$module . " of $Number_Modules"; ++ $title=$module; + } + + txt_field( 'window' => $window, +@@ -488,7 +485,7 @@ + my $title; + + if ($module) { +- $title=$module . " of $Number_Modules"; ++ $title=$module; + } + + noecho;
recipes-security/bastille/files/remove_questions_text_file_references.patch new file +24 -0
@@ -0,0 +1,24 @@ +Index: Bastille/OSMap/LINUX.bastille +=================================================================== +--- Bastille.orig/OSMap/LINUX.bastille 2008-01-25 18:31:35.000000000 -0500 ++++ Bastille/OSMap/LINUX.bastille 2013-08-22 04:48:32.677968002 -0400 +@@ -12,7 +12,6 @@ + + bfile,InteractiveBastille,'/usr/sbin/InteractiveBastille' + bfile,BastilleBackEnd,'/usr/sbin/BastilleBackEnd' +-bfile,Questions,'/usr/share/Bastille/Questions.txt' + bfile,QuestionsModules,'/usr/share/Bastille/Modules.txt' + bfile,TODO,'/var/log/Bastille/TODO' + bfile,TODOFlag,'/var/log/Bastille/TODOFlag.txt' +Index: Bastille/OSMap/OSX.bastille +=================================================================== +--- Bastille.orig/OSMap/OSX.bastille 2007-09-11 18:09:26.000000000 -0400 ++++ Bastille/OSMap/OSX.bastille 2013-08-22 04:48:47.245968001 -0400 +@@ -10,7 +10,6 @@ + bdir,share,'/usr/share/Bastille' + + bfile,BastilleBackEnd,'/var/root/Bastille/BastilleBackEnd' +-bfile,Questions,'/usr/share/Bastille/Questions.txt' + bfile,QuestionsModules,'/usr/share/Bastille/Modules.txt' + bfile,TODO,'/var/log/Bastille/TODO' + bfile,TODOFlag,'/var/log/Bastille/TODOFlag.txt'
recipes-security/bastille/files/simplify_B_place.patch new file +34 -0
@@ -0,0 +1,34 @@ +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2013-08-21 08:59:17.939950001 -0400 ++++ Bastille/Bastille/API.pm 2013-08-21 08:59:30.983950001 -0400 +@@ -1679,24 +1679,22 @@ + + use File::Copy; + +- my $original_source=$source; + $source = &getGlobal('BDIR', "share") . $source; +- my $original_target=$target; + + if ( -e $target and -f $target ) { +- &B_backup_file($original_target); +- &B_log("ACTION","About to copy $original_source to $original_target -- had to backup target\n"); ++ &B_backup_file($target); ++ &B_log("ACTION","About to copy $source to $target -- had to backup target\n"); + $had_to_backup_target=1; + } + $retval=copy($source,$target); + if ($retval) { +- &B_log("ACTION","placed file $original_source as $original_target\n"); ++ &B_log("ACTION","placed file $source as $target\n"); + # + # We want to add a line to the &getGlobal('BFILE', "created-files") so that the + # file we just put at $original_target gets deleted. +- &B_revert_log(&getGlobal('BIN',"rm") . " $original_target\n"); ++ &B_revert_log(&getGlobal('BIN',"rm") . " $target\n"); + } else { +- &B_log("ERROR","Failed to place $original_source as $original_target\n"); ++ &B_log("ERROR","Failed to place $source as $target\n"); + } + + # We add the file to the GLOBAL_SUMS hash if it is not already present
Signature · 1 line
1.7.10.4
PATCH 3/6 Bastille: change in behavior of bastille -l.
In reply to mulhern[YOCTO #3867]
bastille -l now reports existing configuration file paths even if it has not previously been run. Previously, it exited with an error if it detected an absence of log files indicating a previous run.
--- recipes-security/bastille/bastille_3.2.1.bb | 1 + .../bastille/files/find_existing_config.patch | 58 ++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 recipes-security/bastille/files/find_existing_config.patch
recipes-security/bastille/bastille_3.2.1.bb +1 -0
@@ -23,6 +23,7 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://fix_number_of_modules.patch \ file://remove_questions_text_file_references.patch \ file://simplify_B_place.patch \ + file://find_existing_config.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/find_existing_config.patch new file +58 -0
58 lines not on this page · raw message
Signature · 1 line
1.7.10.4
PATCH 4/6 Bastille: accept and observe --os flag in multiple situations.
In reply to mulhern[YOCTO #3867]
Five additional patches which cause the --os flag to be accepted and observed are added. An additional distro, Yocto, is added. The individual patches are described below.
upgrade_options_processing.patch: Changes setOptions procedure so that it accepts named parameters for greater flexibility and adjusts all invocations accordingly. Uses more precise specifications in invocatiosn of Getop::Long::GetOptions. Omits code associated with a commented out flag.
accept_os_flag_in_backend.patch: Accepts and observes an additional --os flag in BastilleBackEnd.
allow_os_with_assess.patch: No longer print a usage message and quit if --assess or its related flags are specified along with the --os flag.
edit_usage_message.patch: Edit usage message to include the specification of an --os flag with the specification of an --assess flag.
organize_distro_discovery.patch: Separates inferring the distro from specifying the distro. Adds a "Yocto" distro among the other Linux distros. Causes the specified distro to override the inferred distro with a warning message when they are different. Previously if either the inferred distro or the specified distro was not among supported distros Bastille would quit with an error.
--- recipes-security/bastille/bastille_3.2.1.bb | 5 + .../bastille/files/accept_os_flag_in_backend.patch | 28 ++ .../bastille/files/allow_os_with_assess.patch | 37 ++ .../bastille/files/edit_usage_message.patch | 26 ++ .../bastille/files/organize_distro_discovery.patch | 470 ++++++++++++++++++++ .../files/upgrade_options_processing.patch | 85 ++++ 6 files changed, 651 insertions(+) create mode 100644 recipes-security/bastille/files/accept_os_flag_in_backend.patch create mode 100644 recipes-security/bastille/files/allow_os_with_assess.patch create mode 100644 recipes-security/bastille/files/edit_usage_message.patch create mode 100644 recipes-security/bastille/files/organize_distro_discovery.patch create mode 100644 recipes-security/bastille/files/upgrade_options_processing.patch
recipes-security/bastille/bastille_3.2.1.bb +5 -0
@@ -24,6 +24,11 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://remove_questions_text_file_references.patch \ file://simplify_B_place.patch \ file://find_existing_config.patch \ + file://upgrade_options_processing.patch \ + file://accept_os_flag_in_backend.patch \ + file://allow_os_with_assess.patch \ + file://edit_usage_message.patch \ + file://organize_distro_discovery.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/accept_os_flag_in_backend.patch new file +28 -0
@@ -0,0 +1,28 @@ +Index: Bastille/BastilleBackEnd +=================================================================== +--- Bastille.orig/BastilleBackEnd 2013-08-21 12:40:54.000000000 -0400 ++++ Bastille/BastilleBackEnd 2013-08-21 12:43:21.895950001 -0400 +@@ -52,11 +52,13 @@ + my $force = 0; + my $debug = 0; + my $alternate_config=undef; ++my $os_version=undef; + + if( Getopt::Long::GetOptions( "n" => \$nodisclaim, + "v" => \$verbose, + "force" => \$force, + "f=s" => \$alternate_config, ++ "os=s" => \$os_version, + "debug" => \$debug) ) { + $error = 0; # no parse error + +@@ -66,7 +68,8 @@ + + &setOptions( + debug => $debug, +- verbose => $verbose); ++ verbose => $verbose, ++ os => $os_version); + &ConfigureForDistro; + + if ( $error ) { # GetOptions couldn't parse all of the args
recipes-security/bastille/files/allow_os_with_assess.patch new file +37 -0
@@ -0,0 +1,37 @@ +Index: Bastille/bin/bastille +=================================================================== +--- Bastille.orig/bin/bastille 2013-08-21 08:59:06.647950000 -0400 ++++ Bastille/bin/bastille 2013-08-21 15:55:53.193631711 -0400 +@@ -195,7 +195,6 @@ + systemFileLocations + + isAssessing='no' +-nonXArg='no' + + if [ $PERL_V_MAJ -eq $MIN_V_MAJ -a $PERL_V_MIN -lt $MIN_V_MIN -o $PERL_V_MAJ -lt $MIN_V_MAJ ]; then # invalid Perl + printErr +@@ -316,12 +315,10 @@ + '--os') + options_left="$options_left --os" + optarg='yes' +- nonXArg='yes' + ;; + '-f') + options_left="$options_left -f" + optarg='yes' +- nonXArg='yes' + ;; + # Non-exclusive (undocumented and unsupported) options follow: + # There is no validity/combination checking done with these. +@@ -345,11 +342,6 @@ + fi + done + +-#Detect case where -f or --os attempted use with --assess +- if [ \( x$nonXArg = xyes \) -a \( x$isAssessing = xyes \) ]; then +- printUsage +- exit 2 +- fi + + # We have a valid version of perl! Verify that all the required + # modules can be found.
recipes-security/bastille/files/edit_usage_message.patch new file +26 -0
@@ -0,0 +1,26 @@ +Index: Bastille/bin/bastille +=================================================================== +--- Bastille.orig/bin/bastille 2013-08-25 14:16:35.614779001 -0400 ++++ Bastille/bin/bastille 2013-08-25 14:16:38.674779000 -0400 +@@ -60,7 +60,7 @@ + printUsage () { + cat >&2 << EOF + $ERRSPACES Usage: bastille [ -b | -c | -x ] [ --os <version>] [ -f <alternate config> ] +-$ERRSPACES bastille [-r | -l | -h | --assess | --assessnobrowser ] ++$ERRSPACES bastille [-r | -l | -h | --assess | --assessnobrowser ] [ --os <version> ] + $ERRSPACES -b : use a saved config file to apply changes + $ERRSPACES directly to system + $ERRSPACES -c : use the Curses (non-X11) GUI, not available on HP-UX +Index: Bastille/Bastille/API.pm +=================================================================== +--- Bastille.orig/Bastille/API.pm 2013-08-25 08:15:40.266779002 -0400 ++++ Bastille/Bastille/API.pm 2013-08-25 14:18:22.750778811 -0400 +@@ -206,7 +206,7 @@ + #options before interactive or Bastille runs, so this check is often redundant + $GLOBAL_ERROR{"usage"}="\n". + "$spc Usage: bastille [ -b | -c | -x ] [ --os <version> ] [ -f <alternate config> ]\n". +- "$spc bastille [ -r | --assess | --assessnobowser ]\n\n". ++ "$spc bastille [ -r | --assess | --assessnobowser ] [ --os <version> ]\n\n". + "$spc --assess : check status of system and report in browser\n". + "$spc --assessnobrowser : check status of system and list report locations\n". + "$spc -b : use a saved config file to apply changes\n".
recipes-security/bastille/files/organize_distro_discovery.patch new file +470 -0
470 lines not on this page · raw message
recipes-security/bastille/files/upgrade_options_processing.patch new file +85 -0
85 lines not on this page · raw message
Signature · 1 line
1.7.10.4
PATCH 5/6 Bastille: set Yocto specific questions via config file.
In reply to mulhernThe python script, set_required_questions.py reads the list of questions and answers from the config file and edits the REQUIRE_DISTRO field for those questions in the questions file so that it includes "Yocto" if it is not already present. This has the effect of causing Bastille, when loading questions for the Yocto distribution, to load only those that are answered in the existing config file. Under the assumption that the exisitng config file contains question/answer pairs that are relevant to the Yocto project, this will cause the interactive question screen to have answers that are relevant to the Yocto project.
--- recipes-security/bastille/bastille_3.2.1.bb | 3 + .../bastille/files/set_required_questions.py | 135 ++++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100755 recipes-security/bastille/files/set_required_questions.py
recipes-security/bastille/bastille_3.2.1.bb +3 -0
@@ -139,6 +139,9 @@ do_install () { install -m 0644 OSMap/HP-UX.service ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.bastille ${D}${datadir}/Bastille/OSMap install -m 0644 OSMap/OSX.system ${D}${datadir}/Bastille/OSMap + + ${THISDIR}/files/set_required_questions.py ${WORKDIR}/config Questions + install -m 0777 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config for file in `cat Modules.txt` ; do
recipes-security/bastille/files/set_required_questions.py new file +135 -0
135 lines not on this page · raw message
Signature · 1 line
1.7.10.4
PATCH 6/6 Bastille: document the current status and usability of the Bastille install.
In reply to mulhernThe README file is updated to indicate the functionality of Bastille that is actually available.
The recipe file is updated with a pointer to the README file.
An additional patch is added so that when Bastille is run in interactive mode it will not attempt to make any changes to the system. This is better than attempting to make the changes and making the screen flicker . The text on the final screen has been updated appropriately.
--- README | 44 +++++++++++++------- recipes-security/bastille/bastille_3.2.1.bb | 3 ++ .../bastille/files/do_not_apply_config.patch | 34 +++++++++++++++ 3 files changed, 65 insertions(+), 16 deletions(-) create mode 100644 recipes-security/bastille/files/do_not_apply_config.patch
README +28 -16
@@ -43,22 +43,34 @@ help for each package. like rcp and rlogin, and helps create "chroot jails" that help limit the vulnerability of common Internet services like Web services and DNS. - usage : Bastille can be used via meta-security layer only in command line mode. - To start Bastille simply write in a terminal : - - bastille -c - - If this is the first usage of Bastille on the system, the user will be - guided through a list of questions which need to be answered. In the end, - a config file will be created and run. After these steps, you will have a - hardened system. - - If you only want to run the config file, without stepping through the - list of questions, simply write in a terminal : - - bastille -b - - More information can be found in the package readme and manual. + usage : The functionality of Bastille which is available is + restricted to a purely informational one. The command: + bastille -c --os Yocto + will cause a series of menus containing security questions + about the system to be displayed to the user. For each + question, a default response, specified in the configuration + file which is installed with Bastille, will be selected. + The user may select an alternate response. When the user + has completed the sequence of menus Bastille saves the + responses to the configuration file. + + The command: + bastille -l lists the configuration files that Bastille + is able to locate. + + The other functionality which Bastille is intended to provide + is actually unavailable. This is not due to errors in poky + installation or configuration of the application. The Bastille + distribution is no longer supported. Significant modifications + would be required to make it possible to make use of the + functionality which is currently unavailable. + + + Additional information about Bastille can be found in the package + README file and other documentation. + + Alternatives to Bastille include buck-security and checksecurity, + described elsewhere in this file. == redhat-security ==
recipes-security/bastille/bastille_3.2.1.bb +3 -0
@@ -1,3 +1,5 @@ +#The functionality of Bastille that is actually available is restricted. Please +#consult the README file for the meta-security layer for additional information. SUMMARY = "Linux hardening tool" DESCRIPTION = "Bastille Linux is a Hardening and Reporting/Auditing Program which enhances the security of a Linux box, by configuring daemons, system settings and firewalling." LICENSE = "GPLv2"
@@ -29,6 +31,7 @@ SRC_URI = "http://sourceforge.net/projects/bastille-linux/files/bastille-linux/3 file://allow_os_with_assess.patch \ file://edit_usage_message.patch \ file://organize_distro_discovery.patch \ + file://do_not_apply_config.patch \ " SRC_URI[md5sum] = "df803f7e38085aa5da79f85d0539f91b"
recipes-security/bastille/files/do_not_apply_config.patch new file +34 -0
@@ -0,0 +1,34 @@ +Index: Bastille/Bastille_Curses.pm +=================================================================== +--- Bastille.orig/Bastille_Curses.pm 2013-08-27 16:43:39.130959000 -0400 ++++ Bastille/Bastille_Curses.pm 2013-08-27 16:43:39.794959000 -0400 +@@ -83,11 +83,6 @@ + # Output answers to the script and display + &outputConfig; + +- # Run Bastille +- +- &Run_Bastille_with_Config; +- +- + # Display Credits + + open CREDITS,"/usr/share/Bastille/Credits"; +Index: Bastille/InteractiveBastille +=================================================================== +--- Bastille.orig/InteractiveBastille 2013-08-27 16:43:39.434959000 -0400 ++++ Bastille/InteractiveBastille 2013-08-27 17:18:55.758959000 -0400 +@@ -531,10 +531,10 @@ + " Please address bug reports and suggestions to jay\@bastille-linux.org\n" . + "\n"; + +- $InterfaceEndScreenDescription = "We will now implement the choices you have made here.\n\n" . ++ $InterfaceEndScreenDescription = "We will now record the choices you have made here.\n\n" . + "Answer NO if you want to go back and make changes!\n"; +- $InterfaceEndScreenQuestion = "Are you finished answering the questions, i.e. may we make the changes?"; +- $InterfaceEndScreenNoEpilogue = "Please use Back/Next buttons to move among the questions you wish to\nchange.\n\nChoose YES on this question later to implement your choices.\n"; ++ $InterfaceEndScreenQuestion = "Are you finished answering the questions, i.e. may we record the answers and exit?"; ++ $InterfaceEndScreenNoEpilogue = "Please use Back/Next buttons to move among the questions you wish to\nchange.\n\nChoose YES on this question later to record your choices.\n"; + require Bastille_Curses; + } elsif ($GLOBAL_AUDITONLY) { +
Signature · 1 line
1.7.10.4