Fix rsyslog_remote_tls Remediations

[Mab879]

Description:

Fix the Ansible and bash remediations for rsyslog_remote_tls.

Rationale:

Closes #9631
Closes #9623

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
@@ -5,7 +5,7 @@
 
 
 # Get omfwd configuration directive
-OMFWD_CONFIG_OUTPUT=`grep -Pzo '(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`
+OMFWD_CONFIG_OUTPUT=`grep -Pzo '^(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`
 OMFWD_CONFIG=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $2}'`
 OMFWD_CONFIG_FILE=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $1}'`
 if ! [ -z "$OMFWD_CONFIG" ]; then

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
@@ -5,7 +5,8 @@
 - always
 
 - name: Get omfwd configuration directive
- shell: sed -e '/action\s*(\s*type\s*=\s*"omfwd"/,/)/!d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
+ shell: sed -e '/^action\s*(\s*type\s*=\s*"omfwd"/,/)/!d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
+ || true
 register: include_omfwd_config_output
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:

[codeclimate]

Code Climate has analyzed commit 85659bd and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 41.0% (0.0% change).

View more on Code Climate.

[jan-cerny]

I have confirmed that it fixed #9631 on a RHEL 9.0 virtual machine

In the following paste, the ds-broken is built from a45b876 and ds-fixed is build from this PR.

[root@localhost ~]# oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-broken.xml 
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   Configure TLS for rsyslog remote logging
Rule    xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident   CCE-83991-0
Result  fail


--- Starting Remediation ---

WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title   Configure TLS for rsyslog remote logging
Rule    xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident   CCE-83991-0
Result  error


[root@localhost ~]# oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-fixed.xml 
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   Configure TLS for rsyslog remote logging
Rule    xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident   CCE-83991-0
Result  fail


--- Starting Remediation ---

WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title   Configure TLS for rsyslog remote logging
Rule    xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident   CCE-83991-0
Result  fixed

[root@localhost ~]# oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_rsyslog_remote_tls ds-fixed.xml 
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   Configure TLS for rsyslog remote logging
Rule    xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
Ident   CCE-83991-0
Result  pass