diff --git a/salt/common/tools/sbin/so-common-status-check b/salt/common/tools/sbin/so-common-status-check index 878ed7225..b41a48e82 100644 --- a/salt/common/tools/sbin/so-common-status-check +++ b/salt/common/tools/sbin/so-common-status-check @@ -38,49 +38,39 @@ def check_needs_restarted(): f.write(val) def check_for_fips(): - os = __grains__['os'] - fips = False - # Only checking fully supported OS - if os == 'OEL': - try: - result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE) - fips = result.returncode == 0 - except FileNotFoundError: - with open('/proc/sys/crypto/fips_enabled', 'r') as f: - contents = f.read() - if '1' in contents: - fips = True - else: - fips = False - return fips + fips = 0 + try: + result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE) + fips = int(result.returncode == 0) + except FileNotFoundError: + with open('/proc/sys/crypto/fips_enabled', 'r') as f: + contents = f.read() + if '1' in contents: + fips = 1 + else: + fips = 0 + with open('/opt/so/log/sostatus/fips_enabled', 'w') as f: + f.write(str(fips)) def check_for_luks(): - os = __grains__['os'] - luks = False - # Only checking fully supported OS - if os == 'OEL': - result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE) - data = json.loads(result.stdout) - for device in data['blockdevices']: - if 'children' in device: - for gc in device['children']: - if 'children' in gc: - try: - result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE) - luks = result.returncode == 0 - except FileNotFoundError: - for ggc in gc['children']: - if 'crypt' in ggc['type']: - luks = True - if luks: - break - return luks - -def check_features(): - fips = check_for_fips() - luks = check_for_luks() - with open('/opt/so/log/sostatus/features-check.log', 'w') as f: - f.write("featuresdetected fips={},luks={}".format(fips,luks)) + luks = 0 + result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE) + data = json.loads(result.stdout) + for device in data['blockdevices']: + if 'children' in device: + for gc in device['children']: + if 'children' in gc: + try: + result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE) + luks = int(result.returncode == 0) + except FileNotFoundError: + for ggc in gc['children']: + if 'crypt' in ggc['type']: + luks = 1 + if luks: + break + with open('/opt/so/log/sostatus/luks_enabled', 'w') as f: + f.write(str(luks)) def fail(msg): print(msg, file=sys.stderr) @@ -92,7 +82,8 @@ def main(): fail("This program must be run as root") check_needs_restarted() - check_features() + check_for_fips() + check_for_luks() if __name__ == "__main__": main()