Merge pull request #12208 from Security-Onion-Solutions/reyesj2-patch-sl

salt/common/tools/sbin/so-common-status-check

@@ -38,27 +38,22 @@ def check_needs_restarted():
     f.write(val)
 
 def check_for_fips():
-    os = __grains__['os']
+    fips = 0
-    fips = False
-    # Only checking fully supported OS
-    if os == 'OEL':
     try:
         result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE)
-            fips = result.returncode == 0
+        fips = int(result.returncode == 0)
     except FileNotFoundError:
         with open('/proc/sys/crypto/fips_enabled', 'r') as f:
             contents = f.read()
             if '1' in contents:
-                    fips = True
+                fips = 1
             else:
-                    fips = False
+                fips = 0
-        return fips
+    with open('/opt/so/log/sostatus/fips_enabled', 'w') as f:
+       f.write(str(fips))
 
 def check_for_luks():
-    os = __grains__['os']
+    luks = 0
-    luks = False
-    # Only checking fully supported OS
-    if os == 'OEL':
     result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE)
     data = json.loads(result.stdout)
     for device in data['blockdevices']:
@@ -67,20 +62,15 @@ def check_for_luks():
                 if 'children' in gc:
                     try:
                         result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE)
-                            luks = result.returncode == 0
+                        luks = int(result.returncode == 0)
                     except FileNotFoundError:
                         for ggc in gc['children']:
                             if 'crypt' in ggc['type']:
-                                    luks = True
+                                luks = 1
         if luks:
             break
-        return luks
+    with open('/opt/so/log/sostatus/luks_enabled', 'w') as f:
-
+       f.write(str(luks))
-def check_features():
-    fips = check_for_fips()
-    luks = check_for_luks()
-    with open('/opt/so/log/sostatus/features-check.log', 'w') as f:
-       f.write("featuresdetected fips={},luks={}".format(fips,luks))
 
 def fail(msg):
   print(msg, file=sys.stderr)
@@ -90,9 +80,13 @@ def main():
   proc = subprocess.run(['id', '-u'], stdout=subprocess.PIPE, encoding="utf-8")
   if proc.stdout.strip() != "0":
     fail("This program must be run as root")
-
+  # Ensure that umask is 0022 so that files created by this script have rw-r-r permissions
+  org_umask = os.umask(0o022)
   check_needs_restarted()
-  check_features()
+  check_for_fips()
+  check_for_luks()
+  # Restore umask to whatever value was set before this script was run. STIG sets to 0077 rw---
+  os.umask(org_umask)
 
 if __name__ == "__main__":
   main()

salt/telegraf/scripts/features.sh

@@ -7,8 +7,11 @@
 
 if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
 
-    cat /var/log/sostatus/features-check.log
+    FIPS_ENABLED=$(cat /var/log/sostatus/fips_enabled)
+    LUKS_ENABLED=$(cat /var/log/sostatus/luks_enabled)
 
+    echo "features fips=$FIPS_ENABLED"
+    echo "features luks=$LUKS_ENABLED"
 fi
 
 exit 0