Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Select rules on the command line #1832

Merged
merged 10 commits into from
Jan 18, 2022
Merged

Select rules on the command line #1832

merged 10 commits into from
Jan 18, 2022

Commits on Jan 18, 2022

  1. Allow multiple --rule 

    When multiple --rule options will be specified on the command line,
OpenSCAP will evaluate multiple rules at once.

Resolves: rhbz#2020581
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    734e951 View commit details
    Browse the repository at this point in the history

  2. Introduce --skip-rule option 

    The option will allow users to easily tell oscap to skip some
rules without having to create a tailoring file. User will simply
provide --skip-rule RULE_ID option on the command line to skip
evaluation of the rule RULE_ID.

Resolves: rhbz#2020580
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    7971af8 View commit details
    Browse the repository at this point in the history

  3. Fix broken requires ID 

    The rule `xccdf_moc.elpmaxe.www_rule_17` requires group
`xccdf_moc.elpmaxe.www_group_1_2` which is a typo or mistake because
group `xccdf_moc.elpmaxe.www_group_1_2` doesn't exist. Instead, there is
group `xccdf_moc.elpmaxe_group_1_2` (the correct group ID doesn't
contain `.www`). To fix this, we could simply fix the ID in the `requires`
element of rule `xccdf_moc.elpmaxe.www_rule_17`. But, since all other
IDs in this XCCDF are in a form of `xccdf_moc.elpmaxe.www_.*` and we
like consistency we will instead rename the group so that all IDs follow
the same format.
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    a33607d View commit details
    Browse the repository at this point in the history

  4. Extend tests of the XCCDF requires and conflicts 

    The purpose of these new test cases is to preserve the current behavior
of rules with requires and conflicts elements when `oscap` is invoked
with the `--rule` option selecting specific rule or rules. The tests are
based on current behavior, not on any specification, as `--rule` option
is our custom feature, but at the same time we want notice behavior
changes in future.
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    a54703e View commit details
    Browse the repository at this point in the history

  5. Refactor: Extract function 

    This allows us to modify the final selection at other places without
consulting the real selection in the XCCDF document.
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    4a1eab6 View commit details
    Browse the repository at this point in the history

  6. Ignore selections and conflicts 

    If the user explicitly requests a rule using --rule, they expect all
the rules would be evaluated regardless selections and conflicts.
The use-case for the `--rule` option is development and testing
and in these situation it anyways behaves as an override.

However, this patch doesn't solve the "requires" element handling.
Required rules are still not added.
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    360b329 View commit details
    Browse the repository at this point in the history

  7. Issue a warning about required rules 

    If at least one `--rule` option is provided by the user, only the rules
listed as arguments of `--rule` options are evaluated. It ignores the
`requires` element in the rule. The required rules aren't added
automatically and aren't evaluated unless they're explicitely listed.
This way we keep the behavior of `--rule` option in previous versions of
OpenSCAP, because SSGTS relies on the fact that single occurence of
`--rule` options means that at most 1 rule is evaluated.

To avoid confusion, OpenSCAP will now report a warning that the rule
they are evaluating a requires another rule.
    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    bf45839 View commit details
    Browse the repository at this point in the history

  8. Use _user_specified_rule_mode for readability

    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    fdc07ad View commit details
    Browse the repository at this point in the history

  9. Document that required rules aren't evlauated

    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    8006bbd View commit details
    Browse the repository at this point in the history

  10. Remove a duplicate word

    @jan-cerny
    jan-cerny committed Jan 18, 2022
    Configuration menu
    Copy the full SHA
    1420b04 View commit details
    Browse the repository at this point in the history