Fix several audit-related ignition remediations

[jhrozek]

Description:

The OVAL checks use the filetextcontent54 probe and check against a blob
defined in the DS, so any divergence from the blob fails the rule. In these
remediations, the ignition files rendered trailing whitespace. Also,
some characters like ">=" were already encoded when the resulting file
was urlencoded.

Rationale:

Applying the remediations was still resulting in a failed check during a
subsequent run.

[openshift-ci-robot]

Hi @jhrozek. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[JAORMX]

/ok-to-test

[shawndwells]

@jhrozek how are you URL encoding the data?

We used the python snippet from @JAORMX's blog at https://jaosorior.dev/2019/modifying-node-configurations-in-openshift-4.x/:

$ cat "string to encode" | python3 -c "import sys, urllib.parse; print(urllib.parse.quote(''.join(sys.stdin.readlines())))"

[shawndwells]

@openscap-ci retest this please

[jhrozek]

@jhrozek how are you URL encoding the data?

We used the python snippet from @JAORMX's blog at https://jaosorior.dev/2019/modifying-node-configurations-in-openshift-4.x/:

$ cat "string to encode" | python3 -c "import sys, urllib.parse; print(urllib.parse.quote(''.join(sys.stdin.readlines())))"

For quick and dirty one-liners I'm using a script from the CaC repo:

$ python3 utils/ignition-remediation.py encode --mode=0600 --infile=/tmp/etc/audit/rules.d/30-ospp-v42.rules --target=/etc/audit/rules.d/30-ospp-v42.rules --rule=audit_ospp_general --platform=multi_platform_rhel,multi_platform_fedora,multi_platform_ocp

I've been also developing this other tool where you keep a chroot-like tree of all files you want to encode together with metadata in the files about which rule they apply to and then you just run a single command which generates all the ignitions for you. This way, you can view, grep and inspect the raw files and also it's easier to then keep tabs on a single file used for multiple rules. I'm not sure if it's usable for anyone else, the tool is definitely very raw, but it's been handy for me.

[jhrozek]

btw for review of the PR, the ingition-remediation.py script can also be used. e.g. calling:

python3 utils/ignition-remediation.py decode --rule=audit_modify_failed

before and after the applying the patch could clearly show what are the differences.

[yuumasato]

/retest

[shawndwells]

Decoded & compared against the *.rules files.

[shawndwells]

@jhrozek how are you URL encoding the data?
We used the python snippet from @JAORMX's blog at https://jaosorior.dev/2019/modifying-node-configurations-in-openshift-4.x/:

$ cat "string to encode" | python3 -c "import sys, urllib.parse; print(urllib.parse.quote(''.join(sys.stdin.readlines())))"

For quick and dirty one-liners I'm using a script from the CaC repo:

$ python3 utils/ignition-remediation.py encode --mode=0600 --infile=/tmp/etc/audit/rules.d/30-ospp-v42.rules --target=/etc/audit/rules.d/30-ospp-v42.rules --rule=audit_ospp_general --platform=multi_platform_rhel,multi_platform_fedora,multi_platform_ocp

I've been also developing this other tool where you keep a chroot-like tree of all files you want to encode together with metadata in the files about which rule they apply to and then you just run a single command which generates all the ignitions for you. This way, you can view, grep and inspect the raw files and also it's easier to then keep tabs on a single file used for multiple rules. I'm not sure if it's usable for anyone else, the tool is definitely very raw, but it's been handy for me.

Thanks! There doesn't seem to be mention of this in the docs. Will work on adding it.