Store plain login banner text in XCCDF Value

[jan-cerny]

Description:

Allow users to specify a custom login banner text, including newlines.

To specify the login banner text, we currently use XCCDF Values which contain regular expressions. The remediations scripts "deregexify" the regexes, trying to get the actual text from the regular expressions. This is prone to problems and doesn't handle newlines well.

With this change, users will be able to specify the exact banner text as XCCDF Values in their tailoring files. The values will contain the exact plain text, including newlines and spaces.

The exact banner text from the new values will be used in remediations. This will mean that the contents of the banner files (/etc/issue, /etc/motd) will be exactly as desired.

OVAL checks will still use the regular expressions XCCDF Values. That is because we have some profiles where multiple different values are allowed (eg. STIG that allows 2 variants of the banner).

Rationale:

Users want to be able to create a custom login banner, special for their organization. They want to provide the banner text in their tailoring files. They expect that OpenSCAP scan will pass with their custom login banner and that remediation will insert the custom login banner instead of the default system banner.

Resolves: https://issues.redhat.com/browse/RHEL-118499

Review Hints:

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -1,26 +1,8 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel-core; then
 
-read -r -d '' login_banner_text <<'EOF' || true
-
-EOF
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
-# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
-login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
-formatted=$(echo "$login_banner_text" | fold -sw 80)
-cat <<EOF >/etc/issue
-$formatted
-EOF
+login_banner_contents=$(echo "" | sed 's/\\n/\n/g')
+echo "$login_banner_contents" > /etc/issue
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -13,18 +13,18 @@
   - medium_severity
   - no_reboot_needed
   - unknown_strategy
-- name: XCCDF Value login_banner_text # promote to variable
+- name: XCCDF Value login_banner_contents # promote to variable
   set_fact:
-    login_banner_text: !!str 
+    login_banner_contents: !!str 
   tags:
     - always
 
 - name: Modify the System Login Banner - Ensure Correct Banner
   ansible.builtin.copy:
     dest: /etc/issue
-    content: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
-      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
-      "\n") | regex_replace("\\", "") | wordwrap() }}'
+    content: |
+      {{ login_banner_contents | replace('\n', '
+      ') }}
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-80763-6

bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net
@@ -1,26 +1,8 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel-core; then
 
-remote_login_banner_text=''
-
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
-# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
-remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\\//g')
-formatted=$(echo "$remote_login_banner_text" | fold -sw 80)
-
-cat <<EOF >/etc/issue.net
-$formatted
-EOF
+remote_login_banner_contents=$(echo "" | sed 's/\\n/\n/g')
+echo "$remote_login_banner_contents" > /etc/issue.net
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net
@@ -9,18 +9,18 @@
   - medium_severity
   - no_reboot_needed
   - unknown_strategy
-- name: XCCDF Value remote_login_banner_text # promote to variable
+- name: XCCDF Value remote_login_banner_contents # promote to variable
   set_fact:
-    remote_login_banner_text: !!str 
+    remote_login_banner_contents: !!str 
   tags:
     - always
 
 - name: Modify the System Login Banner for Remote Connections - ensure correct banner
   ansible.builtin.copy:
     dest: /etc/issue.net
-    content: '{{ remote_login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
-      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
-      "\n") | regex_replace("\\", "") | wordwrap() }}'
+    content: |
+      {{ remote_login_banner_contents | replace('\n', '
+      ') }}
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-86147-6

bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd
@@ -1,26 +1,8 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel-core; then
 
-motd_banner_text=''
-
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-motd_banner_text=$(echo "$motd_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-motd_banner_text=$(echo "$motd_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-motd_banner_text=$(echo "$motd_banner_text" | sed 's/\[\\s\\n\]+/ /g')
-# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
-motd_banner_text=$(echo "$motd_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-motd_banner_text=$(echo "$motd_banner_text" | sed 's/\\//g')
-formatted=$(echo "$motd_banner_text" | fold -sw 80)
-
-cat <<EOF >/etc/motd
-$formatted
-EOF
+motd_banner_contents=$(echo "" | sed 's/\\n/\n/g')
+echo "$motd_banner_contents" > /etc/motd
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd
@@ -9,18 +9,18 @@
   - medium_severity
   - no_reboot_needed
   - unknown_strategy
-- name: XCCDF Value motd_banner_text # promote to variable
+- name: XCCDF Value motd_banner_contents # promote to variable
   set_fact:
-    motd_banner_text: !!str 
+    motd_banner_contents: !!str 
   tags:
     - always
 
 - name: Modify the System Message of the Day Banner - ensure correct banner
   ansible.builtin.copy:
     dest: /etc/motd
-    content: '{{ motd_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
-      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
-      "\n") | regex_replace("\\", "") | wordwrap() }}'
+    content: |
+      {{ motd_banner_contents | replace('\n', '
+      ') }}
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-83496-0

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -1,24 +1,7 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q gdm; then
 
-login_banner_text=''
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
-# 3 - Adds newline "tokens". (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "(n)*")
-login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/(n)*/g')
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
-# 5 - Removes the newline "token." (Transforms them into newline escape sequences "\n").
-#    ( Needs to be done after 4, otherwise the escapce sequence will become just "n".
-login_banner_text=$(echo "$login_banner_text" | sed 's/(n)\*/\\n/g')
-
+dconf_login_banner_contents=$(echo "" )
 # Check for setting in any of the DConf db directories
 # If files contain ibus or distro, ignore them.
 # The assignment assumes that individual filenames don't contain :
@@ -45,7 +28,7 @@
     printf '%s\n' "[org/gnome/login-screen]" >> ${DCONFFILE}
 fi
 
-escaped_value="$(sed -e 's/\\/\\\\/g' <<< "'${login_banner_text}'")"
+escaped_value="$(sed -e 's/\\/\\\\/g' <<< "'${dconf_login_banner_contents}'")"
 if grep -q "^\\s*banner-message-text\\s*=" "${DCONFFILE}"
 then
         sed -i "s/\\s*banner-message-text\\s*=\\s*.*/banner-message-text=${escaped_value}/g" "${DCONFFILE}"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -13,9 +13,9 @@
   - medium_severity
   - no_reboot_needed
   - unknown_strategy
-- name: XCCDF Value login_banner_text # promote to variable
+- name: XCCDF Value dconf_login_banner_contents # promote to variable
   set_fact:
-    login_banner_text: !!str 
+    dconf_login_banner_contents: !!str 
   tags:
     - always
 
@@ -72,9 +72,7 @@
     dest: /etc/dconf/db/gdm.d/00-security-settings
     section: org/gnome/login-screen
     option: banner-message-text
-    value: '''{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
-      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
-      "(n)*") | regex_replace("\\", "") | regex_replace("\(n\)\*", "\\n") }}'''
+    value: '''{{ dconf_login_banner_contents }}'''
     create: true
     no_extra_spaces: true
   register: result_ini

[Mab879]

Should the text in banner_etc_issue_cis_recommended.pass.sh be updated as well?

[Mab879]

Suggested change

	cis_banners: ^(Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$

[Mab879]

Suggested change

	- dconf_login_banner_contents=cis_default
	- dconf_login_banner_contents=dod_default

[Mab879]

Suggested change

	In remediations the motd_banner_contents variable is used instead.
	In remediations the remote_login_banner_contents variable is used instead.

[Mab879]

Should we also change this multi platform all?

This is the closet line I can comment on.

[Mab879]

Suggested change

	In OVAL checks a regular expression specified in the login_banner_text variable is used instead.
	In OVAL checks a regular expression specified in the remote_login_banner_text variable is used instead.

[Mab879]

Should we use the dconf contents here?

[ggbecker]

I had the impression that it was actually uses, for example: https://www.tenable.com/audits/items/CIS_Oracle_Linux_8_Server_L1_v1.0.0.audit:888f33a2337672de94c3974b6716a810

[jan-cerny]

🤷
The CIS is inconsistent. I looked to RHEL CIS Benchmarks and I have found both users and uses.

[jan-cerny]

I have rebased this PR on the top of the latest upstream master branch. I have changed the PR so that the login banner text for the CIS requirement for Dconf GDM login banner contains "Authorized uses".