Test and use rules to components mapping

components/chrony.yml

@@ -2,6 +2,7 @@ name: chrony
 packages:
 - chrony
 rules:
+- chronyd_configure_pool_and_server
 - chronyd_run_as_chrony_user
 - chronyd_server_directive
 - chronyd_specify_remote_server

components/firewalld.yml

@@ -12,6 +12,7 @@ rules:
 - firewalld-backend
 - firewalld_loopback_traffic_restricted
 - firewalld_loopback_traffic_trusted
+- network_implement_access_control
 - package_firewalld_installed
 - package_firewalld_removed
 - service_firewalld_disabled

docs/manual/developer/03_creating_content.md

@@ -1254,3 +1254,5 @@ YAML file keys:
 - `changelog` (list) - records substantial changes in the given component that affected rules and remediations (optional)
 
 Each rule in the benchmark in the `/linux_os/guide` directory must be a member of at least 1 component.
+
+Products specify a path to the directory with component files by the `components_root` key in the `product.yml`.

products/example/product.yml

@@ -4,6 +4,7 @@ type: platform
 
 benchmark_id: EXAMPLE
 benchmark_root: "../../linux_os/guide"
+components_root: "../../components"
 
 profiles_root: "./profiles"
 

products/fedora/product.yml

@@ -4,6 +4,7 @@ type: platform
 
 benchmark_id: FEDORA
 benchmark_root: "../../linux_os/guide"
+components_root: "../../components"
 
 profiles_root: "./profiles"
 

products/rhel7/product.yml

@@ -4,6 +4,7 @@ type: platform
 
 benchmark_id: RHEL-7
 benchmark_root: "../../linux_os/guide"
+components_root: "../../components"
 
 profiles_root: "./profiles"
 

products/rhel8/product.yml

@@ -4,6 +4,7 @@ type: platform
 
 benchmark_id: RHEL-8
 benchmark_root: "../../linux_os/guide"
+components_root: "../../components"
 
 profiles_root: "./profiles"
 

products/rhel9/product.yml

@@ -4,6 +4,7 @@ type: platform
 
 benchmark_id: RHEL-9
 benchmark_root: "../../linux_os/guide"
+components_root: "../../components"
 
 profiles_root: "./profiles"
 

ssg/build_yaml.py

@@ -2,6 +2,7 @@
 from __future__ import print_function
 
 from copy import deepcopy
+import collections
 import datetime
 import json
 import os
@@ -12,6 +13,7 @@
 
 
 import ssg.build_remediations
+import ssg.components
 from .build_cpe import CPEALLogicalTest, CPEALCheckFactRef, ProductCPEs
 from .constants import (XCCDF12_NS,
                         OSCAP_BENCHMARK,
@@ -1331,13 +1333,42 @@ def __init__(
         self.stig_references = None
         if stig_reference_path:
             self.stig_references = ssg.build_stig.map_versions_to_rule_ids(stig_reference_path)
+        self.rule_to_components = self._load_components()
+
+    def _load_components(self):
+        if "components_root" not in self.env_yaml:
+            return None
+        product_dir = self.env_yaml["product_dir"]
+        components_root = self.env_yaml["components_root"]
+        components_dir = os.path.join(product_dir, components_root)
+        components = ssg.components.load(components_dir)
+        rule_to_components = ssg.components.get_rule_to_components_mapping(
+            components)
+        return rule_to_components
 
     def _process_values(self):
         for value_yaml in self.value_files:
             value = Value.from_yaml(value_yaml, self.env_yaml)
             self.all_values[value.id_] = value
             self.loaded_group.add_value(value)
 
+    def __process_rule(self, rule):
+        if self.rule_to_components is not None and rule.id_ not in self.rule_to_components:
+            raise ValueError(
+                "The rule '%s' isn't mapped to any component! Insert the "
+                "rule ID at least once to the rule-component mapping." %
+                (rule.id_))
+        prodtypes = parse_prodtype(rule.prodtype)
+        if "all" not in prodtypes and self.product not in prodtypes:
+            return False
+        self.all_rules[rule.id_] = rule
+        self.loaded_group.add_rule(
+            rule, env_yaml=self.env_yaml, product_cpes=self.product_cpes)
+        rule.normalize(self.env_yaml["product"])
+        if self.stig_references:
+            rule.add_stig_references(self.stig_references)
+        return True
+
     def _process_rules(self):
         for rule_yaml in self.rule_files:
             try:
@@ -1346,16 +1377,8 @@ def _process_rules(self):
             except DocumentationNotComplete:
                 # Happens on non-debug build when a rule is "documentation-incomplete"
                 continue
-            prodtypes = parse_prodtype(rule.prodtype)
-            if "all" not in prodtypes and self.product not in prodtypes:
+            if not self.__process_rule(rule):
                 continue
-            self.all_rules[rule.id_] = rule
-            self.loaded_group.add_rule(
-                rule, env_yaml=self.env_yaml, product_cpes=self.product_cpes)
-
-            rule.normalize(self.env_yaml["product"])
-            if self.stig_references:
-                rule.add_stig_references(self.stig_references)
 
     def _get_new_loader(self):
         loader = BuildLoader(
@@ -1364,6 +1387,8 @@ def _get_new_loader(self):
         loader.sce_metadata = self.sce_metadata
         # Do it this way so we only have to parse the STIG references once.
         loader.stig_references = self.stig_references
+        # Do it this way so we only have to parse the component metadata once.
+        loader.rule_to_components = self.rule_to_components
         return loader
 
     def export_group_to_file(self, filename):

ssg/components.py

@@ -0,0 +1,65 @@
+from __future__ import print_function
+
+from collections import defaultdict
+import os
+
+import ssg.yaml
+
+
+def load(components_dir):
+    components = {}
+    for component_filename in os.listdir(components_dir):
+        components_filepath = os.path.join(components_dir, component_filename)
+        component = Component(components_filepath)
+        components[component.name] = component
+    return components
+
+
+def rule_components_mapping(components):
+    rules_to_components = defaultdict(list)
+    for component in components.values():
+        for rule_id in component.rules:
+            rules_to_components[rule_id].append(component)
+    return rules_to_components
+
+
+def package_component_mapping(components):
+    packages_to_components = {}
+    for component in components.values():
+        for package in component.packages:
+            packages_to_components[package] = component.name
+    return packages_to_components
+
+
+def template_component_mapping(components):
+    template_to_component = {}
+    for component in components.values():
+        for template in component.templates:
+            template_to_component[template] = component.name
+    return template_to_component
+
+
+def group_components_mapping(components):
+    group_to_component = defaultdict(list)
+    for component in components.values():
+        for group in component.groups:
+            group_to_component[group].append(component.name)
+    return group_to_component
+
+
+class Component:
+    def __init__(self, filepath):
+        yaml_data = ssg.yaml.open_raw(filepath)
+        self.name = yaml_data["name"]
+        self.rules = yaml_data["rules"]
+        self.packages = yaml_data["packages"]
+        self.templates = yaml_data.get("templates", [])
+        self.groups = yaml_data.get("groups", [])
+
+
+def get_rule_to_components_mapping(components):
+    rule_to_components = defaultdict(list)
+    for component in components.values():
+        for rule_id in component.rules:
+            rule_to_components[rule_id].append(component.name)
+    return rule_to_components

tests/CMakeLists.txt

@@ -360,3 +360,10 @@ if (PYTHON_VERSION_MAJOR GREATER 2)
     )
     set_tests_properties("install-vm" PROPERTIES LABELS quick)
 endif()
+
+if (SSG_PRODUCT_RHEL9)
+add_test(
+    NAME "components"
+    COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_components.py" --build-dir "${CMAKE_BINARY_DIR}" --source-dir "${CMAKE_SOURCE_DIR}" --product "rhel9"
+)
+endif()