|
1
|
|
|
#!/usr/bin/env python |
|
2
|
|
|
|
|
3
|
|
|
from __future__ import print_function |
|
4
|
|
|
|
|
5
|
|
|
import argparse |
|
6
|
|
|
import os |
|
7
|
|
|
import sys |
|
8
|
|
|
from collections import defaultdict |
|
9
|
|
|
|
|
10
|
|
|
import json |
|
11
|
|
|
|
|
12
|
|
|
import ssg.build_yaml |
|
13
|
|
|
import ssg.oval |
|
14
|
|
|
import ssg.build_remediations |
|
15
|
|
|
import ssg.rules |
|
16
|
|
|
import ssg.yaml |
|
17
|
|
|
|
|
18
|
|
|
|
|
19
|
|
|
SSG_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..")) |
|
20
|
|
|
|
|
21
|
|
|
|
|
22
|
|
|
def parse_args(): |
|
23
|
|
|
parser = argparse.ArgumentParser() |
|
24
|
|
|
parser.add_argument("-r", "--root", type=str, action="store", default=SSG_ROOT, |
|
25
|
|
|
help="Path to SSG root directory (defaults to %s)" % SSG_ROOT) |
|
26
|
|
|
parser.add_argument("-o", "--output", type=str, action="store", default="build/rule_dirs.json", |
|
27
|
|
|
help="File to write json output to (defaults to build/rule_dirs.json)") |
|
28
|
|
|
|
|
29
|
|
|
return parser.parse_args() |
|
30
|
|
|
|
|
31
|
|
|
|
|
32
|
|
|
def walk_products(root, all_products): |
|
33
|
|
|
visited_guide_dirs = set() |
|
34
|
|
|
|
|
35
|
|
|
all_rule_dirs = [] |
|
36
|
|
|
product_yamls = {} |
|
37
|
|
|
known_rules = set() |
|
38
|
|
|
|
|
39
|
|
|
for product in all_products: |
|
40
|
|
|
product_dir = os.path.join(root, product) |
|
41
|
|
|
product_yaml_path = os.path.join(product_dir, "product.yml") |
|
42
|
|
|
product_yaml = ssg.yaml.open_raw(product_yaml_path) |
|
43
|
|
|
product_yaml.update(ssg.yaml._get_implied_properties(product_yaml)) |
|
44
|
|
|
product_yamls[product] = product_yaml |
|
45
|
|
|
|
|
46
|
|
|
guide_dir = os.path.join(product_dir, product_yaml['benchmark_root']) |
|
47
|
|
|
guide_dir = os.path.abspath(guide_dir) |
|
48
|
|
|
|
|
49
|
|
|
if guide_dir in visited_guide_dirs: |
|
50
|
|
|
continue |
|
51
|
|
|
|
|
52
|
|
|
new_rule_dirs = sorted(ssg.rules.find_rule_dirs(guide_dir)) |
|
53
|
|
|
for rule_dir in new_rule_dirs: |
|
54
|
|
|
rule_id = ssg.rules.get_rule_dir_id(rule_dir) |
|
55
|
|
|
all_rule_dirs.append((rule_id, rule_dir, guide_dir, product)) |
|
56
|
|
|
|
|
57
|
|
|
if rule_id in known_rules: |
|
58
|
|
|
exp = "Multiple rules with same rule_id: %s and %s" % \ |
|
59
|
|
|
(known_rules[rule_id]['rule_dir'], rule_dir) |
|
60
|
|
|
raise ValueError(exp) |
|
61
|
|
|
known_rules.add(rule_id) |
|
62
|
|
|
|
|
63
|
|
|
visited_guide_dirs.add(guide_dir) |
|
64
|
|
|
|
|
65
|
|
|
return all_rule_dirs, product_yamls |
|
66
|
|
|
|
|
67
|
|
|
|
|
68
|
|
|
def handle_rule_yaml(product_list, product_yamls, rule_id, rule_dir, guide_dir): |
|
69
|
|
|
rule_obj = {'id': rule_id, 'dir': rule_dir, 'guide': guide_dir} |
|
70
|
|
|
rule_file = ssg.rules.get_rule_dir_yaml(rule_dir) |
|
71
|
|
|
|
|
72
|
|
|
prod_type = product_list[0] |
|
73
|
|
|
product_yaml = product_yamls[prod_type] |
|
74
|
|
|
|
|
75
|
|
|
rule_yaml = ssg.build_yaml.Rule.from_yaml(rule_file, product_yaml) |
|
76
|
|
|
rule_products = set() |
|
77
|
|
|
for product in product_list: |
|
78
|
|
|
if ssg.rules.is_applicable(rule_yaml.prodtype, product): |
|
79
|
|
|
rule_products.add(product) |
|
80
|
|
|
|
|
81
|
|
|
rule_products = sorted(rule_products) |
|
82
|
|
|
rule_obj['products'] = rule_products |
|
83
|
|
|
rule_obj['title'] = rule_yaml.title |
|
84
|
|
|
|
|
85
|
|
|
return rule_obj |
|
86
|
|
|
|
|
87
|
|
|
|
|
88
|
|
|
def handle_ovals(product_list, product_yamls, rule_obj): |
|
89
|
|
|
rule_dir = rule_obj['dir'] |
|
90
|
|
|
|
|
91
|
|
|
rule_ovals = {} |
|
92
|
|
|
oval_products = defaultdict(set) |
|
93
|
|
|
|
|
94
|
|
|
for oval_path in ssg.rules.get_rule_dir_ovals(rule_dir): |
|
95
|
|
|
oval_name = os.path.basename(oval_path) |
|
96
|
|
|
oval_product, _ = os.path.splitext(oval_name) |
|
97
|
|
|
oval_obj = {'name': oval_name, 'product': oval_product} |
|
98
|
|
|
|
|
99
|
|
|
platforms = ssg.oval.applicable_platforms(oval_path) |
|
100
|
|
|
cs_platforms = ','.join(platforms) |
|
101
|
|
|
|
|
102
|
|
|
oval_obj['platforms'] = platforms |
|
103
|
|
|
oval_obj['products'] = set() |
|
104
|
|
|
for product in product_list: |
|
105
|
|
|
if ssg.rules.is_applicable(cs_platforms, product): |
|
106
|
|
|
oval_products[product].add(oval_name) |
|
107
|
|
|
oval_obj['products'].add(product) |
|
108
|
|
|
|
|
109
|
|
|
oval_obj['products'] = sorted(oval_obj['products']) |
|
110
|
|
|
rule_ovals[oval_name] = oval_obj |
|
111
|
|
|
|
|
112
|
|
|
return rule_ovals, oval_products |
|
113
|
|
|
|
|
114
|
|
|
|
|
115
|
|
|
def handle_remediations(product_list, product_yamls, rule_obj): |
|
116
|
|
|
rule_dir = rule_obj['dir'] |
|
117
|
|
|
|
|
118
|
|
|
rule_remediations = {} |
|
119
|
|
|
r_products = defaultdict(set) |
|
120
|
|
|
for r_type in ssg.build_remediations.REMEDIATION_TO_EXT_MAP: |
|
121
|
|
|
rule_remediations[r_type] = {} |
|
122
|
|
|
r_paths = ssg.rules.get_rule_dir_remediations(rule_dir, r_type) |
|
123
|
|
|
|
|
124
|
|
|
for r_path in r_paths: |
|
125
|
|
|
r_name = os.path.basename(r_path) |
|
126
|
|
|
r_product, r_ext = os.path.splitext(r_name) |
|
127
|
|
|
r_obj = {'type': r_type, 'name': r_name, 'product': r_product, 'ext': r_ext[1:]} |
|
128
|
|
|
|
|
129
|
|
|
prod_type = product_list[0] |
|
130
|
|
|
if r_product != 'shared' and r_product in product_list: |
|
131
|
|
|
prod_type = r_product |
|
132
|
|
|
product_yaml = product_yamls[prod_type] |
|
133
|
|
|
|
|
134
|
|
|
_, config = ssg.build_remediations.parse_from_file(r_path, product_yaml) |
|
135
|
|
|
platforms = config['platform'] |
|
136
|
|
|
if not platforms: |
|
137
|
|
|
print(config['platform']) |
|
138
|
|
|
|
|
139
|
|
|
r_obj['platforms'] = sorted(map(lambda x: x.strip(), platforms.split(','))) |
|
140
|
|
|
r_obj['products'] = set() |
|
141
|
|
|
for product in product_list: |
|
142
|
|
|
if ssg.rules.is_applicable(platforms, product): |
|
143
|
|
|
r_products[product].add(r_name) |
|
144
|
|
|
r_obj['products'].add(product) |
|
145
|
|
|
|
|
146
|
|
|
r_obj['products'] = sorted(r_obj['products']) |
|
147
|
|
|
rule_remediations[r_type][r_name] = r_obj |
|
148
|
|
|
|
|
149
|
|
|
return rule_remediations, r_products |
|
150
|
|
|
|
|
151
|
|
|
|
|
152
|
|
|
def main(): |
|
153
|
|
|
args = parse_args() |
|
154
|
|
|
|
|
155
|
|
|
linux_products, other_products = ssg.products.get_all(args.root) |
|
156
|
|
|
all_products = linux_products.union(other_products) |
|
157
|
|
|
|
|
158
|
|
|
all_rule_dirs, product_yamls = walk_products(args.root, all_products) |
|
159
|
|
|
|
|
160
|
|
|
known_rules = {} |
|
161
|
|
|
for rule_id, rule_dir, guide_dir, given_product in all_rule_dirs: |
|
162
|
|
|
product_list = sorted(linux_products) |
|
163
|
|
|
if 'linux_os' not in guide_dir: |
|
164
|
|
|
product_list = [given_product] |
|
165
|
|
|
|
|
166
|
|
|
rule_obj = handle_rule_yaml(product_list, product_yamls, rule_id, rule_dir, guide_dir) |
|
167
|
|
|
rule_obj['ovals'], oval_products = handle_ovals(product_list, product_yamls, rule_obj) |
|
168
|
|
|
rule_obj['remediations'], r_products = handle_remediations(product_list, product_yamls, rule_obj) |
|
169
|
|
|
|
|
170
|
|
|
# Validate oval products |
|
171
|
|
|
for key in oval_products: |
|
172
|
|
|
oval_products[key] = sorted(oval_products[key]) |
|
173
|
|
|
if len(oval_products[key]) > 1: |
|
174
|
|
|
print("product has multiple ovals: %s - %s" % (key, ','.join(oval_products[key])), file=sys.stderr) |
|
175
|
|
|
|
|
176
|
|
|
rule_obj['oval_products'] = oval_products |
|
177
|
|
|
|
|
178
|
|
|
# Validate remediation products |
|
179
|
|
|
for key in r_products: |
|
180
|
|
|
r_products[key] = sorted(r_products[key]) |
|
181
|
|
|
if len(r_products[key]) > 1: |
|
182
|
|
|
exts = sorted(map(lambda x: os.path.splitext(x)[1], r_products[key])) |
|
183
|
|
|
if len(exts) != len(set(exts)): |
|
184
|
|
|
print("product has multiple remediations of the same type: %s - %s" % (key, ','.join(r_products[key])), file=sys.stderr) |
|
185
|
|
|
|
|
186
|
|
|
rule_obj['remediation_products'] = r_products |
|
187
|
|
|
|
|
188
|
|
|
known_rules[rule_id] = rule_obj |
|
189
|
|
|
|
|
190
|
|
|
f = open(args.output, 'w') |
|
191
|
|
|
j = json.dump(known_rules, f) |
|
192
|
|
|
if not f.closed: |
|
193
|
|
|
f.flush() |
|
194
|
|
|
f.close() |
|
195
|
|
|
|
|
196
|
|
|
if __name__ == "__main__": |
|
197
|
|
|
main() |
|
198
|
|
|
|
ComplianceAsCode /
content
