rsyslog_files_permissions: Consider the last field in the config line the log file path

[yuumasato]

Description:

• Fix path filtering in the Bash remediation.
  • It was assuming that the log file path is always the second field in the config line. But this assumption breaks when there are conditionals.
  • The log file path is always the last field in the config line.

Rationale:

• Should fix errors in testing-farm:centos-stream-9-x86_64 test on Add CIS and ANSSI machine hardening tests for TF #9738

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[yuumasato]

@lonicerae Hi, would you mind looking at the PR? Thanks.
Edit: As you recently proposed fixes to this rule, I thought that your input could be interesting.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_files_permissions
+++ xccdf_org.ssgproject.content_rule_rsyslog_files_permissions
@@ -58,7 +58,7 @@
 then
 NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
 LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
- FILTERED_PATHS=$(awk '{if(NF>=2&&($2~/^\//||$2~/^-\//)){sub(/^-\//,"/",$2);print $2}}' <<< "${LINES_WITH_PATHS}")
+ FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
 CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
 MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
 # Since above sed command might return more than one item (delimited by newline), split the particular

[yuumasato]

@brett060102 You may be interested in this fix as well.

[mildas]

@yuumasato @ggbecker Any idea what is wrong with Automatus?

[yuumasato]

@yuumasato @ggbecker Any idea what is wrong with Automatus?

No idea, automatus on containers work locally for me.

I have removed some old comments from the test scenario, and pushed again.
Let's see how the tests go.

[codeclimate]

Code Climate has analyzed commit be4b176 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 46.7%.

View more on Code Climate.

[mildas]

I've tested it on CS8 and CS9 images, works well. Thank you for the fix @yuumasato !