Sysctl improvements

docs/templates/template_reference.md

@@ -834,8 +834,10 @@ The selected value can be changed in the profile (consult the actual variable fo
     sysctl configurations:
     - /etc/sysctl.conf
     - /etc/sysctl.d/\*.conf
+    - /lib/sysctl.d/\*.conf (does not apply to Fedora, RHEL and OL)
     - /run/sysctl.d/\*.conf
-    - /usr/lib/sysctl.d/\*.conf (does not apply to RHEL and OL)
+    - /usr/local/lib/sysctl.d/\*.conf (only if SLE)
+    - /usr/lib/sysctl.d/\*.conf (does not apply to Fedora, RHEL and OL)
 
     A sysctl option is allowed to be defined in more than one file within the scanned directories
     as long as those values are compliant.
@@ -862,8 +864,13 @@ The selected value can be changed in the profile (consult the actual variable fo
             in the OVAL check, but won't be used in the remediations.
             All remediations will use an XCCDF value instead.
 
-    -   **wrong_sysctlval_for_testing** - the value that is always wrong. This
-        will be used in templated test scenarios when **sysctlval** is a list.
+    -   **correct_sysctlval_for_testing** - the value that is always correct.
+        This will be used in templated test scenarios when **sysctlval** is a
+        list or comes from variable.
+
+    -   **wrong_sysctlval_for_testing** - the value that is always wrong.
+        This will be used in templated test scenarios when **sysctlval** is a
+        list or comes from variable.
 
     -   **missing_parameter_pass** - if set to `true` the check will pass if the
         setting for the given **sysctlvar** is not present in sysctl
@@ -1114,6 +1121,18 @@ escape_regex
     some regular expression, behaves similar to the Python 3’s
     [**re.escape**](https://docs.python.org/3/library/re.html#re.escape).
 
+escape_regex_all
+-   Escapes characters in the string for it to be usable as a part of
+    some regular expression.
+    Escape all but unprintable and **\w**.
+    [**re.escape**](https://docs.python.org/3/library/re.html#re.escape).
+
+escape_regex_sq
+-   Escapes characters in the string for it to be usable as a part of
+    some regular expression.
+    Use `.` -> `[.]` style escape method. And `^` is replaced with `\^'.
+    Escape all but unprintable and **\w**.
+
 escape_yaml_key
 -   Escape uppercase letters and `^` with additional `^` and convert letters
     to lovercase. This is because of OVAL's name argument limitations.

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/ansible/shared.yml

@@ -6,8 +6,9 @@
 {{{ ansible_instantiate_variables("rsyslog_remote_loghost_address") }}}
 
 - name: "Set rsyslog remote loghost"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/rsyslog.conf
-    regexp: "^\\*\\.\\*"
+    regexp: >-
+      ^\*\.\*[ \\t]+(?:@|\:omrelp\:)
     line: "*.* @@{{ rsyslog_remote_loghost_address }}"
     create: yes

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/bash/shared.sh

@@ -2,4 +2,11 @@
 
 {{{ bash_instantiate_variables("rsyslog_remote_loghost_address") }}}
 
-{{{ bash_replace_or_append('/etc/rsyslog.conf', '^\*\.\*', "@@$rsyslog_remote_loghost_address", '%s %s') }}}
+{{{ bash_replace_or_append(
+    '/etc/rsyslog.conf',
+    '*.*',
+    "@@${rsyslog_remote_loghost_address}",
+    '%s %s',
+    key_regex='^\*\.\*[ \t]\+(@|\:omrelp\:)',
+    word_boundary='',
+) }}}

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/oval/shared.xml

@@ -1,3 +1,4 @@
+{{%- set remote_rx = "^\*\.\*[ \t]+(?:@|\:omrelp\:)" -%}}
 <def-group>
   <definition class="compliance" id="rsyslog_remote_loghost" version="1">
     {{{ oval_metadata("Syslog logs should be sent to a remote loghost") }}}
@@ -33,14 +34,14 @@
 
   <ind:textfilecontent54_object id="object_remote_loghost_rsyslog_conf" version="1">
     <ind:filepath>/etc/rsyslog.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
+    <ind:pattern operation="pattern match">{{{ remote_rx }}}</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_object id="object_remote_loghost_rsyslog_d" version="1">
     <ind:path>/etc/rsyslog.d</ind:path>
     <ind:filename operation="pattern match">^.+\.conf$</ind:filename>
-    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
+    <ind:pattern operation="pattern match">{{{ remote_rx }}}</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 

linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: alinux2,alinux3,anolis8,ol7,ol8,ol9,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,ubuntu2204
+prodtype: alinux2,alinux3,anolis8,fedora,ol7,ol8,ol9,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,ubuntu2204
 
 title: 'Configure Accepting Router Advertisements on All IPv6 Interfaces'
 

linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: sle12,sle15
+prodtype: fedora,sle12,sle15
 
 title: 'Disable Kernel Parameter for IPv6 Forwarding by default'
 

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: rhel7,rhel8,rhel9
+prodtype: fedora,rhel7,rhel8,rhel9
 
 title: 'Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces'
 

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml

@@ -87,7 +87,7 @@ template:
     name: sysctl
     vars:
         sysctlvar: net.ipv4.conf.all.rp_filter
-        {{% if 'ol' in product or 'rhel' in product %}}
+        {{% if product in ['fedora'] or 'ol' in product or 'rhel' in product %}}
         sysctlval:
         - '1'
         - '2'

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel
 
-# Clean sysctl config directories
-rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
+{{{ bash_sysctl_test_clean() }}}
 
 sed -i "/net.ipv4.conf.all.rp_filter/d" /etc/sysctl.conf
 echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel
 
-# Clean sysctl config directories
-rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
+{{{ bash_sysctl_test_clean() }}}
 
 sed -i "/net.ipv4.conf.all.rp_filter/d" /etc/sysctl.conf
 echo "net.ipv4.conf.all.rp_filter = 2" >> /etc/sysctl.conf

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/wrong_value_run_sysctl_d.fail.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
 
-# Clean sysctl config directories
-rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
+{{{ bash_sysctl_test_clean() }}}
 
 sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf
 echo "net.ipv4.conf.default.accept_source_route = 1" >> /run/sysctl.d/run.conf

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range/rule.yml

@@ -4,7 +4,7 @@ prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,sle12,sle15
 
 title: 'Set Kernel Parameter to Increase Local Port Range'
 
-description: '{{{ describe_sysctl_option_value(sysctl="net.ipv4.ip_local_port_range", value="32768 65535") }}}'
+description: '{{{ describe_sysctl_option_value(sysctl="net.ipv4.ip_local_port_range", value=xccdf_value("sysctl_net_ipv4_ip_local_port_range_value")) }}}'
 
 rationale: |-
     This setting defines the local port range that is used by TCP and UDP to
@@ -23,13 +23,12 @@ identifiers:
 references:
     anssi: BP28(R22)
 
-{{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.ip_local_port_range", value="32768 65535") }}}
+{{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.ip_local_port_range", value=xccdf_value("sysctl_net_ipv4_ip_local_port_range_value")) }}}
 
 template:
     name: sysctl
     vars:
         sysctlvar: net.ipv4.ip_local_port_range
         datatype: string
-        sysctlval: 32768 65535
-        operation: pattern match
-        sysctlval_regex: '32768\s*65535'
+        correct_sysctlval_for_testing: 32768 65535
+        wrong_sysctlval_for_testing: 48000 60000

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range_value.var

@@ -0,0 +1,17 @@
+documentation_complete: true
+
+title: net.ipv4.ip_local_port_range
+
+description: |-
+    Configure the local port range that is used by TCP and UDP to choose the
+    local port. First number is start of range and last number is last of range.
+
+type: string
+
+operator: equals
+
+interactive: true
+
+options:
+    default: 32768 65535
+    fedora: 32768 60999

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_invalid_ratelimit/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,ol8,ol9,rhcos4,rhel7,rhel8,rhel9,sle15
+prodtype: fedora,ol7,ol8,ol9,rhcos4,rhel7,rhel8,rhel9,sle15
 
 title: 'Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments'
 

linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_rfc1337/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,ol8,ol9,rhel7,rhel8,rhel9,sle12,sle15
+prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,sle12,sle15
 
 title: 'Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces'
 

linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml

@@ -69,7 +69,7 @@ template:
     name: sysctl
     vars:
         sysctlvar: kernel.kptr_restrict
-        {{% if 'ol' in product or 'rhel' in product %}}
+        {{% if product in ['fedora'] or 'ol' in product or 'rhel' in product %}}
         sysctlval:
         - '1'
         - '2'

linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel
 
-# Clean sysctl config directories
-rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
+{{{ bash_sysctl_test_clean() }}}
 
 sed -i "/kernel.kptr_restrict/d" /etc/sysctl.conf
 echo "kernel.kptr_restrict = 1" >> /etc/sysctl.conf

linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel
 
-# Clean sysctl config directories
-rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
+{{{ bash_sysctl_test_clean() }}}
 
 sed -i "/kernel.kptr_restrict/d" /etc/sysctl.conf
 echo "kernel.kptr_restrict = 2" >> /etc/sysctl.conf

linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml

@@ -13,7 +13,7 @@ rationale: |-
 
 severity: medium
 
-{{% if product in ["rhel9"] %}}
+{{% if product in ["fedora", "rhel9"] %}}
 conflicts:
     - sysctl_kernel_core_pattern_empty_string
 {{% endif %}}