xccdf_org.ssgproject.content_rule_accounts_tmout: replace 'declare' by 'typeset' #11289
Conversation
|
Hi @rmetrich. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout'.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -10,7 +10,10 @@
setting in a file loaded by /etc/profile, e.g.
/etc/profile.d/tmout.sh should read as follows:
+typeset -xr TMOUT='xccdf_org.ssgproject.content_value_var_accounts_tmout'
+or
declare -xr TMOUT='xccdf_org.ssgproject.content_value_var_accounts_tmout'
+Using the typeset keyword is preferred for wider compatibility with ksh and other shells.
[reference]:
BP28(R29)
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout' differs.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -11,16 +11,14 @@
for f in /etc/profile /etc/profile.d/*.sh; do
if grep --silent '^[^#].*TMOUT' $f; then
- sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/declare -xr TMOUT=$var_accounts_tmout\3/g" $f
+ sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/typeset -xr TMOUT=$var_accounts_tmout\3/g" $f
tmout_found=1
fi
done
if [ $tmout_found -eq 0 ]; then
echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" >> /etc/profile.d/tmout.sh
- echo "declare -xr TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
- echo "readonly TMOUT" >> /etc/profile.d/tmout.sh
- echo "export TMOUT" >> /etc/profile.d/tmout.sh
+ echo "typeset -xr TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
fi
else
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_tmout' differs.
--- xccdf_org.ssgproject.content_rule_accounts_tmout
+++ xccdf_org.ssgproject.content_rule_accounts_tmout
@@ -8,7 +8,7 @@
replace:
path: /etc/profile
regexp: ^[^#].*TMOUT=.*
- replace: declare -xr TMOUT={{ var_accounts_tmout }}
+ replace: typeset -xr TMOUT={{ var_accounts_tmout }}
register: profile_replaced
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
@@ -31,7 +31,7 @@
path: /etc/profile.d/tmout.sh
create: true
regexp: TMOUT=
- line: declare -xr TMOUT={{ var_accounts_tmout }}
+ line: typeset -xr TMOUT={{ var_accounts_tmout }}
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags: |
| @@ -40,7 +40,7 @@ | |||
| {{% if product in ['sle12', 'sle15'] or "ubuntu" in product %}} | |||
| <ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+)[\s]*readonly TMOUT[\s]*export TMOUT$</ind:pattern> | |||
| {{% else %}} | |||
| <ind:pattern operation="pattern match">^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern> | |||
| <ind:pattern operation="pattern match">^[\s]*typeset[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern> | |||
There was a problem hiding this comment.
To keep more compatibility, please keep both "declare" and "typeset" acceptable in the OVAL check.
…y 'typeset' On bash and zsh, these are synonyms, but 'declare' is not known to ksh, causing an error message when having /etc/profile.d/tmout.sh loaded: -------- 8< ---------------- 8< ---------------- 8< -------- /etc/profile[68]: .: line 731: declare: not found -------- 8< ---------------- 8< ---------------- 8< -------- 'typeset' works on every known sh shell, including ksh.
To keep backwards compatibility we will allow also the `declare` keyword alongside to the `typeset` keyword by the OVAL checks. The remediations will still insert `typeset`. This commit also adds a small test scenario to account for this situation.
|
I have rebased the PR on the top of the master and linked the Jira bug. I have allowed the declare keyword. I have add a small test scenario. I have add a note to the description. |
|
Code Climate has analyzed commit 9d6a742 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5% (0.0% change). View more on Code Climate. |
|
I agree this looks good. Merging. |
marcusburghardt
added
the
Update Rule
Description:
On bash and zsh, these are synonyms, but declare is not known to ksh, causing an error message when having /etc/profile.d/tmout.sh loaded:
Rationale:
typeset works on every known sh shell, including ksh.
Resolves: https://issues.redhat.com/browse/RHEL-1811