Update tftpd_uses_secure_mode

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/ansible/shared.yml

@@ -0,0 +1,31 @@
+# platform = Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,WRLinux 1019
+# reboot = false
+# complexity = low
+# strategy = configure
+# disruption = low
+
+{{{ ansible_instantiate_variables("var_tftpd_secure_directory") }}}
+
+- name: "Find out if the file exists and contains the line configuring server arguments"
+  find:
+    path: "/etc/xinetd.d"
+    patterns: "tftp"
+    contains: '^[\s]+server_args.*$'
+  register: tftpd_secure_config_line
+
+- name: "Ensure that TFTP server is configured to start with secure directory"
+  lineinfile:
+    path: "/etc/xinetd.d/tftp"
+    regexp: '^[\s]*(server_args[\s]+=[\s]+.*?)(-s[\s]+[/\.\w]+)*(.*)$'
+    line: '\1 -s {{ var_tftpd_secure_directory }} \3'
+    state: present
+    backrefs: true
+  when: tftpd_secure_config_line is defined and tftpd_secure_config_line.matched > 0
+
+- name: "Insert correct config line to start TFTP server with secure directory"
+  lineinfile:
+    path: "/etc/xinetd.d/tftp"
+    line: "server_args = -s {{ var_tftpd_secure_directory }}"
+    state: present
+    create: true
+  when: tftpd_secure_config_line is defined and tftpd_secure_config_line.matched == 0

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/bash/shared.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# platform = Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,WRLinux 1019
+
+. /usr/share/scap-security-guide/remediation_functions
+
+{{{ bash_instantiate_variables ("var_tftpd_secure_directory") }}}
+
+if grep -q 'server_args' /etc/xinetd.d/tftp; then
+    sed -i -E "s;^([[:blank:]]*server_args[[:blank:]]+=[[:blank:]]+.*?)(-s[[:blank:]]+[[:graph:]]+)*(.*)$;\1 -s $var_tftpd_secure_directory \3;" /etc/xinetd.d/tftp
+else
+    echo "server_args = -s $var_tftpd_secure_directory" >> /etc/xinetd.d/tftp
+fi
+
+

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/oval/shared.xml

@@ -17,10 +17,18 @@
   </definition>
   <ind:textfilecontent54_test check="all" comment="tftpd secure mode" id="test_tftpd_uses_secure_mode" version="1">
     <ind:object object_ref="object_tftpd_uses_secure_mode" />
+    <ind:state state_ref="state_tftpd_uses_secure_mode" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_tftpd_uses_secure_mode" version="1">
     <ind:filepath>/etc/xinetd.d/tftp</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=.*[\s]+\-s[\s]+.+$</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=[\s]+.*?-s[\s]+([/\.\w]+).*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_tftpd_uses_secure_mode" version="1">
+    <ind:subexpression datatype="int" operation="equals" var_check="all"
+    var_ref="var_tftpd_secure_directory" />
+  </ind:textfilecontent54_state>
+
+    <external_variable comment="TFTP server secure directory" datatype="string" id="var_tftpd_secure_directory" version="1" />
 </def-group>

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml

@@ -8,8 +8,8 @@ description: |-
     If running the <tt>tftp</tt> service is necessary, it should be configured
     to change its root directory at startup. To do so, ensure
     <tt>/etc/xinetd.d/tftp</tt> includes <tt>-s</tt> as a command line argument, as shown in
-    the following example (which is also the default):
-    <pre>server_args = -s /var/lib/tftpboot</pre>
+    the following example:
+    <pre>server_args = -s {{{ sub_var_value("var_tftpd_secure_directory") }}}</pre>
 
 rationale: |-
     Using the <tt>-s</tt> option causes the TFTP service to only serve files from the
@@ -33,7 +33,6 @@ references:
     srg@rhel6: SRG-OS-999999
     disa: CCI-000366
     nist: CM-6(b),AC-6,CM-7(a)
-
     nist-csf: PR.AC-3,PR.AC-4,PR.DS-5,PR.IP-1,PR.PT-3,PR.PT-4
     srg: SRG-OS-000480-GPOS-00227
     stigid@rhel7: RHEL-07-040720
@@ -56,4 +55,4 @@ ocil: |-
     The output should indicate the <tt>server_args</tt> variable is configured
     with the <tt>-s</tt> flag, matching the example below:
     <pre>$ grep "server_args" /etc/xinetd.d/tftp
-    server_args = -s /var/lib/tftpboot</pre>
+    server_args = -s {{{ sub_var_value("var_tftpd_secure_directory") }}}</pre>

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/tests/correct.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+yum -y install tftp-server
+
+if grep -q 'server_args' /etc/xinetd.d/tftp; then
+	sed -i 's/.*server_args.*/server_args = -s \/var\/lib\/tftpboot/' /etc/xinetd.d/tftp
+else
+	echo "server_args = -s /var/lib/tftpboot" >> /etc/xinetd.d/tftp
+fi

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/tests/line_missing.fail.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+yum -y install tftp-server
+
+if grep -q 'server_args' /etc/xinetd.d/tftp; then
+	sed -i '/.*server_args.*/d' /etc/xinetd.d/tftp
+fi

linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/tests/wrong.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+yum -y install tftp-server
+
+if grep -q 'server_args' /etc/xinetd.d/tftp; then
+	sed -i 's/.*server_args.*/server_args = --something/' /etc/xinetd.d/tftp
+else
+	echo "server_args = --something" >> /etc/xinetd.d/tftp
+fi

linux_os/guide/services/obsolete/tftp/var_tftpd_secure_directory.var

@@ -0,0 +1,14 @@
+documentation_complete: true
+
+title: 'TFTP server secure directory'
+
+description: "Specify the directory which is used by TFTP server as a root directory when running in secure mode."
+
+type: string
+
+operator: equals
+
+interactive: true
+
+options:
+    default: /var/lib/tftpboot