From ca84abcb8c6ec2980f894a4bd31046d0054a68b1 Mon Sep 17 00:00:00 2001 From: Miha Purg Date: Fri, 10 Jan 2025 15:29:54 +0100 Subject: [PATCH] Fix architecture applicability Architecture applicability conditionals were matching checking only in /proc/sys/kernel/osrelease which doesn't contain the architecture on Ubuntu. Added /proc/sys/kernel/arch to the checks and refactored the OVALs to a Jinja macro. --- shared/applicability/aarch64_arch.yml | 2 +- shared/applicability/not_aarch64_arch.yml | 2 +- shared/applicability/not_s390x_arch.yml | 2 +- ...proc_sys_kernel_osrelease_arch_aarch64.xml | 34 +----------------- ...proc_sys_kernel_osrelease_arch_ppc64le.xml | 34 +----------------- .../proc_sys_kernel_osrelease_arch_s390x.xml | 34 +----------------- .../proc_sys_kernel_osrelease_arch_x86_64.xml | 34 +----------------- shared/applicability/ppc64le_arch.yml | 2 +- shared/applicability/s390x_arch.yml | 2 +- shared/applicability/x86_64_arch.yml | 2 +- shared/macros/10-oval.jinja | 36 +++++++++++++++++++ 11 files changed, 46 insertions(+), 138 deletions(-) diff --git a/shared/applicability/aarch64_arch.yml b/shared/applicability/aarch64_arch.yml index 8ba95fee3b2..9880fcf6dae 100644 --- a/shared/applicability/aarch64_arch.yml +++ b/shared/applicability/aarch64_arch.yml @@ -1,5 +1,5 @@ name: cpe:/a:aarch64_arch title: System architecture is AARCH64 check_id: proc_sys_kernel_osrelease_arch_aarch64 -bash_conditional: 'grep -q aarch64 /proc/sys/kernel/osrelease' +bash_conditional: 'grep -q aarch64 /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture == "aarch64"' diff --git a/shared/applicability/not_aarch64_arch.yml b/shared/applicability/not_aarch64_arch.yml index 8ed261adbf1..0c88bd9c0aa 100644 --- a/shared/applicability/not_aarch64_arch.yml +++ b/shared/applicability/not_aarch64_arch.yml @@ -1,5 +1,5 @@ name: cpe:/a:not_aarch64_arch title: System architecture is not AARCH64 check_id: proc_sys_kernel_osrelease_arch_not_aarch64 -bash_conditional: '! grep -q aarch64 /proc/sys/kernel/osrelease' +bash_conditional: '! grep -q aarch64 /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture != "aarch64"' diff --git a/shared/applicability/not_s390x_arch.yml b/shared/applicability/not_s390x_arch.yml index f3257510a39..c21e1e99c30 100644 --- a/shared/applicability/not_s390x_arch.yml +++ b/shared/applicability/not_s390x_arch.yml @@ -1,5 +1,5 @@ name: cpe:/a:not_s390x_arch title: System architecture is not S390X check_id: proc_sys_kernel_osrelease_arch_not_s390x -bash_conditional: '! grep -q s390x /proc/sys/kernel/osrelease' +bash_conditional: '! grep -q s390x /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture != "s390x"' diff --git a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_aarch64.xml b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_aarch64.xml index 3d54f81e6d4..f55448d5532 100644 --- a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_aarch64.xml +++ b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_aarch64.xml @@ -1,33 +1 @@ - - - - Test that the architecture is aarch64 - - multi_platform_all - - Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64 - - - - - - - - - - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - ^aarch64$ - - +{{{ oval_check_proc_sys_kernel_osrelease_arch("aarch64") }}} diff --git a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml index 058de0db5e7..e9a71cbd869 100644 --- a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml +++ b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml @@ -1,33 +1 @@ - - - - Test that the architecture is ppc64le - - multi_platform_all - - Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le - - - - - - - - - - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - ^ppc64le$ - - +{{{ oval_check_proc_sys_kernel_osrelease_arch("ppc64le") }}} diff --git a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_s390x.xml b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_s390x.xml index 7f416de6475..ae9087bf4bb 100644 --- a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_s390x.xml +++ b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_s390x.xml @@ -1,33 +1 @@ - - - - Test that the architecture is s390x - - multi_platform_all - - Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x - - - - - - - - - - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - ^s390x$ - - +{{{ oval_check_proc_sys_kernel_osrelease_arch("s390x") }}} diff --git a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_x86_64.xml b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_x86_64.xml index 8ebbc9b84a6..bc60ef869df 100644 --- a/shared/applicability/oval/proc_sys_kernel_osrelease_arch_x86_64.xml +++ b/shared/applicability/oval/proc_sys_kernel_osrelease_arch_x86_64.xml @@ -1,33 +1 @@ - - - - Test that the architecture is x86_64 - - multi_platform_all - - Check that architecture of kernel in /proc/sys/kernel/osrelease is x86_64 - - - - - - - - - - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - ^x86_64$ - - +{{{ oval_check_proc_sys_kernel_osrelease_arch("x86_64") }}} diff --git a/shared/applicability/ppc64le_arch.yml b/shared/applicability/ppc64le_arch.yml index 40aa30dfff8..c8c76e4ef0c 100644 --- a/shared/applicability/ppc64le_arch.yml +++ b/shared/applicability/ppc64le_arch.yml @@ -1,5 +1,5 @@ name: "cpe:/a:ppc64le_arch" title: "System architecture is ppc64le" check_id: proc_sys_kernel_osrelease_arch_ppc64le -bash_conditional: 'grep -q ppc64le /proc/sys/kernel/osrelease' +bash_conditional: 'grep -q ppc64le /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture == "ppc64le"' diff --git a/shared/applicability/s390x_arch.yml b/shared/applicability/s390x_arch.yml index 34fe148267f..5db3ff4157b 100644 --- a/shared/applicability/s390x_arch.yml +++ b/shared/applicability/s390x_arch.yml @@ -1,5 +1,5 @@ name: cpe:/a:s390x_arch title: System architecture is S390X check_id: proc_sys_kernel_osrelease_arch_s390x -bash_conditional: 'grep -q s390x /proc/sys/kernel/osrelease' +bash_conditional: 'grep -q s390x /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture == "s390x"' diff --git a/shared/applicability/x86_64_arch.yml b/shared/applicability/x86_64_arch.yml index 6d8a2424250..1a0652aa250 100644 --- a/shared/applicability/x86_64_arch.yml +++ b/shared/applicability/x86_64_arch.yml @@ -1,5 +1,5 @@ name: cpe:/a:x86_64_arch title: System architecture is x86_64 check_id: proc_sys_kernel_osrelease_arch_x86_64 -bash_conditional: 'grep -q x86_64 /proc/sys/kernel/osrelease' +bash_conditional: 'grep -q x86_64 /proc/sys/kernel/{osrelease,arch}' ansible_conditional: 'ansible_architecture == "x86_64"' diff --git a/shared/macros/10-oval.jinja b/shared/macros/10-oval.jinja index 4570f252ec5..0fd0f07bf94 100644 --- a/shared/macros/10-oval.jinja +++ b/shared/macros/10-oval.jinja @@ -1724,3 +1724,39 @@ The macros generates the OVAL test including the dependent OVAL object and OVAL altfiles {{%- endmacro -%}} + +{{# + Macro for checking the system architecture in /proc/sys/kernel/{osrelease,arch} + + :param arch: system architecture (x86_64, aarch64, s90x, ppc64le, ...) +#}} +{{%- macro oval_check_proc_sys_kernel_osrelease_arch(arch) -%}} + + + + Test that the architecture is {{{ arch }}} + + multi_platform_all + + Check that architecture of kernel in /proc/sys/kernel is {{{ arch }}} + + + + + + + + + + + /proc/sys/kernel/(osrelease|arch) + ^.*\.{{{ arch }}}$|^{{{ arch }}}$ + 1 + + + +{{%- endmacro -%}}