Description:

When reading sysctl manuals and looking code there was some differencies. And I also wanted to convert sysctl_net_ipv4_ip_local_port_range to have support for variables. And I also wanted to try to see how jinja macro based implementations would look like.

I'm not totally happy with how it looks like.

For example setting value explicitly ensures variable=value is accepted by kernel. But it does not ensure that this value will be there at next boot. There is file based approach, but it does not manage all directories at least under RHEL etc. Files have ordering and at least for other types of tasks oscap-scanner is not able to access all files. So remediation should simulate boot in this regard to ensure there is no ordering issues or any other trickery involved. So remediation tasks should be:

• comment out variables / wrong variable=values in files
• add new configuration in defined place
• ensure setup is correct as far as possible, for example when remediation file is /etc/sysctl.conf but systemd-sysctl.service does read only sysctl.d directories and it does rely on symlink /etc/sysctl.d/99-sysctl.conf -> ../sysctl.conf. What if symlink does not exist? (not done atm)
• ensure new value can be set as wanted: sysctl -w
• ensure new value will be set during next boot if config stays the same: /usr/lib/systemd/systemd-sysctl --cat-config or systemctl restart systemd-sysctl and check setting again (not done atm). Ansible can reload all the same but does it ensure file is what really is set during boot? I'm not sure, and bash does not do even that. SLE has own remediation file and naming ensures it is easy to override it. And even RHEL style symlink above, it is easy to override that too. So this is why in the end remediation should be rely on boot / service restart simulation to catch any an all possible trickery. This is not about sysctl issue, but for most services have this issue too. Set configuration just so, but in the end you need to enable to configuration and then ask system / runtime what their representation is and only that ensures remediation was success.

I guess sysctl.d directories should be set via product mechanism and not by each type: OVAL, bash and ansible. But it would lack all feature, which is nice for testing. At least now I have reduced it to only one test per type.

If there is need to do proper quoting, there should be also definite standards to do regexp matching. Ansible has python with per plugin variants (substing match, full content match, multiline), OVAL has tiny bit different pcre. Lastly bash has either BRE (grep, sed), ERE (grep -E, sed -E), perlre (grep -P, no sed), awk. Any jinja macro structure should support only one type of regexp format. Usual pattern is to quote regexp to make it partially literal and that should be done via specialized and tested function to ensure this macro structure does not break if there is need.

There really do need to be #10387 style support to ensure tests do not fail in envs where they are impossible.

I have not expanded sysctl test suite to match all the possible quirks, but it would probably mean many more tests. Not at #10519 level multiple dimensions but still. But I wonder if this is easiest way. It also is usually quite hard to test only one item per test as there could be quite a lot of need for example testing regexps used is okay. Does regexp testing really need to be separate each case, and is there any way to do some kind of combinations?

Another dimension of testing is this seen with comments and symlinks. Is this something that could be tested once per template? Also proper test should check situation after the fact. Now we just run OVAL eval again after remediation, but it just checks what is there, and for example commented out contents does not matter or if file contents was via symlink structure. In OVAL there is no state to check that has this filename changed from symlink to regular file or how actually has file contents changed and is it according to a what remediation should do. Tests should define domain of test and before and after remediation test suite should take copy of this domain and then compare after and before. To see if there was no side effects. For example here: /etc/sysctl.conf and sysctl.d directory contents and ansible plugin stat style dump, sysctl --all dump. This is something that is seen with sed in bash, in many cases --follow-symlinks is missing with -i. And there is comments modification with sysctl.

Next item from previous is that ansible and bash remediations should produce about the same result and those dumps done previously should also compared with each other.

One other case of harmonization is character set. Commands like grep, sed should probably always have common LC_ALL=C value.

There is missing codeclimate for OVAL. And also there is no single style to indent XML attributes. Many attributes are quite long as rule names are quite long. So any such should have their own line. Do we want to indent XML to align 2nd+ line attibute to align with 1st line attibute or have normal 4 space indent with element. And what about ordering?

Also I'm not totally happy with patches like fix: sysctl/bash: follow sysctl quirks more where in one swoop I implement multiple changes. It just gets really tedious to keep them separated after a while as after I change one aspect I need to keep multiple temporary states alive. Similar problem with style: sysctl/oval: indent 4.

Rationale:

Add sysctl_net_ipv4_ip_local_port_range. Enable sysctl rules in Fedora.

Have more robust and more base system sysctl / sysctl.d implementation following OVAL and remediation following.

bash_replace_or_append needed to have more features to accomodate all of needs I encountered.

I guess bits and peaces could be submitted as smaller PR, but this PR tries to answer question of how and why this feature could be used.

Review Hints:

At this point this probably fails in many interesting ways.

At least following ways:

Tests seem to fail because JinjaAnalysis does not understand recursive jinja macros. But as far as I can see that is only way to implement oval_list_to_set style conversion macros in jinja. As macro works as intended, I'm not going to to change it at this time. Fix available at: ComplianceAsCode/content-test-filtering#43

I don't think codeclimate complexity requirements are something to fix. Code there is just multiple possibilities. It is possible to split to functions but I don't think it is all that benefical.

I moved all commits where I needed to fix something not working in other or more strict test envs.