[bugfix] [RHEL/7] Create services_disabled & services_enabled templates for RHEL-7 (based on unix:file_test & systemd-aware)

[iankko]

This set of patches does the following:

1. Updates former RHEL-6 services_disabled template to be systemd-aware using unix:file_test probe,
   Testing status: Tested on RHEL-7 & works as expected.

2. Unifies packages_removed RHEL-6 & RHEL-7 OVAL checks to be shared/ ones (since I needed it for subsequent changes) for the following services:
   * abrtd, sshd, atd, rdisc, oddjobd, qpidd

Testing status: Tested on both RHEL-6 & RHEL-7 & (still) works fine.

3. Adds RHEL-7 specific package_removed OVAL check for ntpdate package (since there wasn't one for RHEL-6 yet that could be shared)

 Testing status: Tested on RHEL-7 & works fine.

4. Adds initial RHEL-7 specific content for services_disabled.csv file (make it to be aware of we want those seven services to be handled within it) & adds RHEL-7 specific OVAL checks for service disabled condition for those seven services (replaced former RHEL-7 service_sshd_disabled.xml version with the templated one)

 Testing status: Tested on RHEL-7 & works fine

5. Finally updates RHT-CCP profile to switch on rules for the following six services:
   * abrtd, atd, rdisc, ntpdate, oddjobd & qpidd
   Updates appropriate XCCDF test stamp entries for these services on RHEL-7 & also RHEL-7 test stamp entry for the sshd service.

 Testing status: Tested on RHEL-7 & works fine.

Please review (further testing appreciated, but generally AFAICT / as far as I tested this should be working correctly).

Thanks, Jan.

[shawndwells]

traceback to ticket #227

[iankko]

Have updated the original pull request with another four commits dedicated to RHEL-7 services_enabled template. The patch purpose description is as follows:

* commit 3f6f4cb
  [RHEL/7] Modify service_enabled template file so it would work against systemd

Purpose: This is clear. Create new services_enabled RHEL-7 template & update RHEL/7/input/checks/templates/Makefile to be aware of it.

* commit 567a9b2
  [RHEL/7] Create package_iptables-services_installed OVAL check

Purpose: This change is required since the final OVAL check result depends on two sub-tests:
a) package is installed AND b) service is enabled

In RHEL-7 iptables & ip6tables services has been moved to iptables-services RPM package, therefore we will need RHEL-7 OVAL check for iptables-services package. This commit is doing that.

* commit e0a2bb3
  [RHEL/7] Create initial form of services_enabled.csv file for RHEL-7
  [RHEL/7] Create RHEL-7 services enabled OVAL checks for iptables & ip6tables services

Purpose: Since we have template & package installed OVAL check, we can create service enabled OVAL check. This is what the commit does - creates initial services_enabled.csv file containing two entries, so iptables & ip6tables service enabled OVAL checks could be created. Then create them by utilizing make services & place the results into RHEL/7/input/checks directory (since they are RHEL-7 specific).

* commit 1254d89
[RHEL/7] Update RHEL-7 XCCDF test stamps for service ip{,6}tables enabled checks
[RHEL/7] Switch on service ip{,6}tables enabled checks in RHT-CCP profile

Purpose: What's remaining yet, we need to enable the new rules in RHT-CCP profile, test them in various configurations & in case of proper work update corresponding XCCDF test stamps. This is what the commit does.

Testing report :

The change (all the four added patches) have been tested on RHEL-7 system under different circumstances:

• package installed & service enabled,
• package installed & service disabled,
• package not installed (removed),
• package installed again (=> services not enabled by default)

and they return expected results for all of the aforementioned test scenarios.

Please review.

[iankko]

Fixes: #62
Fixes: #61

[iankko]

Found one issue with the templates, namely the case of mask | unmask services. While the current state corresponds to RHEL-6 behaviour (e.g. when the service is disabled, it can be manually started by administrator), the current template (for both enabled / disabled) doesn't handle properly (in my opinion) case when service has been disabled via mask | unmask systemctl options (it will print service isn't disabled when it is for disabled macro, and report its enabled when it actually isn't for enabled macro in the case service was before manipulated via mask | unmask options).

I will update the templates once this patchset is approved (under assumption there aren't other issues) -- it's easier to modify 1 + 7 + 1 + 2 files (templates ones + generated ones) via subsequent patch, than to need to generate the changes in those 49 files again.

Further testing appreciated.

[iankko]

Will provide second version of service enabled & disabled template handling also cases of masked or runtime-enabled services. Closing this one.

[shawndwells]

hey @iankko, do you think you'll still be providing a patch for this? wasn't sure if you were working on one. if not I will take this on tomorrow (fri)

[iankko]

Re:

hey @iankko, do you think you'll still be providing a patch for this? wasn't sure if you were working on one. if not I will take this on tomorrow (fri)

This has been handled as a second version via pull request:
#230

which got included / pushed yesterday. What remains is to apply these templates against more services (e.g. for those seven service disabled ones that were present in this request). I will do that for those seven cases service disabled ones I was working before. Then you can enhance on that if you wish.

Thanks.

[shawndwells]

On 9/26/14, 8:30 AM, iankko wrote:

Re:

hey @iankko <https://github.com/iankko>, do you think you'll still
be providing a patch for this? wasn't sure if you were working on
one. if not I will take this on tomorrow (fri)

This has been handled as a second version via pull request:
#230 #230

which got included / pushed yesterday. What remains is to apply these
templates against more services (e.g. for those seven service disabled
ones that were present in this request). I will do that for those
seven cases service disabled ones I was working before. Then you can
enhance on that if you wish.

Thanks.

got it - thanks!

[iankko]

got it - thanks!

Actually got distracted today with updating the form of service_*_enabled.sh remediaton scripts (they to start using systemctl instead of chkconfig, PR #256 ). Since they are used in the HTML guide, needed to update them first (we not to show not working commands).

Since it's pretty late for me now, I am not going to touch this one already. So if you want, feel free to do what you originally intended / take this one. Sorry.