Merge pull request #12308 from Xeicker/grub2_slub_debug

Add "is_substring" variable to grub2_bootloader_argument template
ComplianceAsCode · Aug 19, 2024 · d0b210e · d0b210e
2 parents 0a687f7 + d7f142c
commit d0b210e
Show file tree

Hide file tree

Showing 5 changed files with 54 additions and 0 deletions.
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
@@ -42,6 +42,7 @@ template:
     vars:
         arg_name: slub_debug
         arg_variable: var_slub_debug_options
+        is_substring@ol8: "true"
 
 fixtext: |-
     {{{ describe_grub2_argument("slub_debug=" ~ xccdf_value("var_slub_debug_options")) | indent(4) }}}

diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
@@ -241,7 +241,13 @@
   datatype="string" version="1">
     <concat>
       <literal_component>^(?:.*\s)?{{{ ARG_NAME }}}=</literal_component>
+      {{% if IS_SUBSTRING == "true" %}}
+      <literal_component>\S*</literal_component>
+      {{% endif %}}
       <variable_component var_ref="{{{ ARG_VARIABLE }}}" />
+      {{% if IS_SUBSTRING == "true" %}}
+      <literal_component>\S*</literal_component>
+      {{% endif %}}
       <literal_component>(?:\s.*)?$</literal_component>
     </concat>
   </local_variable>

diff --git a/shared/templates/grub2_bootloader_argument/template.py b/shared/templates/grub2_bootloader_argument/template.py
@@ -13,6 +13,9 @@ def preprocess(data, lang):
     else:
         data["arg_name_value"] = data["arg_name"] + "=" + data["arg_value"]
 
+    if 'is_substring' not in data:
+        data["is_substring"] = "false"
+
     if lang == "oval":
         # escape dot, this is used in oval regex
         data["escaped_arg_name_value"] = data["arg_name_value"].replace(".", "\\.")

diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_substring_left.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_substring_left.pass.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+{{% if IS_SUBSTRING != "true" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_all
+{{% endif %}}
+{{%- if 'ubuntu' in product %}}
+# packages = grub2
+{{%- else %}}
+# packages = grub2,grubby
+{{%- endif %}}
+
+{{%- if ARG_VARIABLE %}}
+# variables = {{{ ARG_VARIABLE }}}=correct_value
+{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
+{{%- endif %}}
+
+{{%- set ARG_NAME_VALUE= ARG_NAME_VALUE ~ "A" %}}
+
+source common.sh
+
+{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME_VALUE) }}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_substring_right.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_substring_right.pass.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+{{% if IS_SUBSTRING != "true" %}}
+# platform = Not Applicable
+{{% else %}}
+# platform = multi_platform_all
+{{% endif %}}
+{{%- if 'ubuntu' in product %}}
+# packages = grub2
+{{%- else %}}
+# packages = grub2,grubby
+{{%- endif %}}
+
+{{%- if ARG_VARIABLE %}}
+# variables = {{{ ARG_VARIABLE }}}=correct_value
+{{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
+{{%- endif %}}
+
+{{%- set ARG_NAME_VALUE = (ARG_NAME_VALUE | replace("=","=A")) %}}
+
+source common.sh
+
+{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME_VALUE) }}}