Merge pull request #12208 from Security-Onion-Solutions/reyesj2-patch-sl

salt/common/tools/sbin/so-common-status-check

@@ -38,49 +38,39 @@ def check_needs_restarted():
     f.write(val)
 
 def check_for_fips():
-    os = __grains__['os']
+    fips = 0
-    fips = False
+    try:
-    # Only checking fully supported OS
+        result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE)
-    if os == 'OEL':
+        fips = int(result.returncode == 0)
-        try:
+    except FileNotFoundError:
-            result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE)
+        with open('/proc/sys/crypto/fips_enabled', 'r') as f:
-            fips = result.returncode == 0
+            contents = f.read()
-        except FileNotFoundError:
+            if '1' in contents:
-            with open('/proc/sys/crypto/fips_enabled', 'r') as f:
+                fips = 1
-                contents = f.read()
+            else:
-                if '1' in contents:
+                fips = 0
-                    fips = True
+    with open('/opt/so/log/sostatus/fips_enabled', 'w') as f:
-                else:
+       f.write(str(fips))
-                    fips = False
-        return fips
 
 def check_for_luks():
-    os = __grains__['os']
+    luks = 0
-    luks = False
+    result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE)
-    # Only checking fully supported OS
+    data = json.loads(result.stdout)
-    if os == 'OEL':
+    for device in data['blockdevices']:
-        result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE)
+        if 'children' in device:
-        data = json.loads(result.stdout)
+            for gc in device['children']:
-        for device in data['blockdevices']:
+                if 'children' in gc:
-            if 'children' in device:
+                    try:
-                for gc in device['children']:
+                        result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE)
-                    if 'children' in gc:
+                        luks = int(result.returncode == 0)
-                        try:
+                    except FileNotFoundError:
-                            result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE)
+                        for ggc in gc['children']:
-                            luks = result.returncode == 0
+                            if 'crypt' in ggc['type']:
-                        except FileNotFoundError:
+                                luks = 1
-                            for ggc in gc['children']:
+        if luks:
-                                if 'crypt' in ggc['type']:
+            break
-                                    luks = True
+    with open('/opt/so/log/sostatus/luks_enabled', 'w') as f:
-            if luks:
+       f.write(str(luks))
-                break
-        return luks
-
-def check_features():
-    fips = check_for_fips()
-    luks = check_for_luks()
-    with open('/opt/so/log/sostatus/features-check.log', 'w') as f:
-       f.write("featuresdetected fips={},luks={}".format(fips,luks))
 
 def fail(msg):
   print(msg, file=sys.stderr)
@@ -90,9 +80,13 @@ def main():
   proc = subprocess.run(['id', '-u'], stdout=subprocess.PIPE, encoding="utf-8")
   if proc.stdout.strip() != "0":
     fail("This program must be run as root")
-
+  # Ensure that umask is 0022 so that files created by this script have rw-r-r permissions
+  org_umask = os.umask(0o022)
   check_needs_restarted()
-  check_features()
+  check_for_fips()
+  check_for_luks()
+  # Restore umask to whatever value was set before this script was run. STIG sets to 0077 rw---
+  os.umask(org_umask)
 
 if __name__ == "__main__":
   main()

salt/telegraf/scripts/features.sh

@@ -7,8 +7,11 @@
 
 if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
 
-    cat /var/log/sostatus/features-check.log
+    FIPS_ENABLED=$(cat /var/log/sostatus/fips_enabled)
+    LUKS_ENABLED=$(cat /var/log/sostatus/luks_enabled)
 
+    echo "features fips=$FIPS_ENABLED"
+    echo "features luks=$LUKS_ENABLED"
 fi
 
 exit 0