Skip to content

Commit

Permalink
Extend --remove-machine-only Automatus option
Browse files Browse the repository at this point in the history
The `system_with_kernel` platform will replace the `machine` platform
in most of the rules. In Automatus we have `--remove-machine-only`
option that intentionally remove the `machine` platform from rules
to force the rule to be applicable in a container back end.
To preserve the ability to test the `machine` rules in a container back
end after we change their platform to `system_with_kernel` we need to
extend the `--remove-machine-only` feature to remove also the
`system_with_kernel` from the temporary data stream.
  • Loading branch information
jan-cerny committed Oct 7, 2024
1 parent cc6bedd commit 018a15b
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions tests/ssg_test_suite/xml_operations.py
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,8 @@ def remove_machine_platform(root):
remove_platforms_from_element(root, "xccdf-1.2:Group", "cpe:/a:machine")
remove_platforms_from_element(root, "xccdf-1.2:Rule", "#machine")
remove_platforms_from_element(root, "xccdf-1.2:Group", "#machine")
remove_platforms_from_element(root, "xccdf-1.2:Rule", "#system_with_kernel")
remove_platforms_from_element(root, "xccdf-1.2:Group", "#system_with_kernel")


def remove_platforms(root):
Expand Down Expand Up @@ -141,6 +143,7 @@ def remove_bash_machine_remediation_condition(root):
system = "urn:xccdf:fix:script:sh"
considered_machine_platform_checks = [
r"\[\s+!\s+-f\s+/\.dockerenv\s+\]\s+&&\s+\[\s+!\s+-f\s+/run/\.containerenv\s+\]",
r"rpm\s+--quiet\s+-q\s+kernel"
]
repl = "true"
_replace_in_fix(root, system, considered_machine_platform_checks, repl)
Expand All @@ -150,6 +153,7 @@ def remove_ansible_machine_remediation_condition(root):
system = "urn:xccdf:fix:script:ansible"
considered_machine_platform_checks = [
r"\bansible_virtualization_type\s+not\s+in.*docker.*",
r"\"kernel\"\s+in\s+ansible_facts.packages"
]
repl = "True"
_replace_in_fix(root, system, considered_machine_platform_checks, repl)
Expand Down

0 comments on commit 018a15b

Please sign in to comment.