Fix sle16 pam options

[teacup-on-rockingchair]

Description:

• Master based PR for Stabilization: fix sle16 pam options #14425

Rationale:

• See Stabilization: fix sle16 pam options #14425

Review Hints:

• Should be undrafted after merge of Stabilization: fix sle16 pam options #14425

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su' differs.
--- oval:ssg-use_pam_wheel_for_su:def:1
+++ oval:ssg-use_pam_wheel_for_su:def:1
@@ -1,2 +1,2 @@
 criteria AND
-criterion oval:ssg-test_use_pam_wheel_for_su:tst:1
+criterion oval:ssg-test_pam_auth_pam_wheel_use_uid:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su' differs.
--- xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su
+++ xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su
@@ -1,8 +1,57 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q pam; then
 
-# uncomment the option if commented
-sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su
+declare -a VALUES=()
+declare -a VALUE_NAMES=()
+declare -a ARGS=()
+declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
+
+
+
+
+VALUES+=("")
+VALUE_NAMES+=("")
+ARGS+=("use_uid")
+NEW_ARGS+=("use_uid")
+
+
+for idx in "${!VALUES[@]}"
+do
+    if [ -e "/etc/pam.d/su" ] ; then
+        valueRegex="${VALUES[$idx]}" defaultValue="${VALUES[$idx]}"
+        # non-empty values need to be preceded by an equals sign
+        [ -n "${valueRegex}" ] && valueRegex="=${valueRegex}"
+        # add an equals sign to non-empty values
+        [ -n "${defaultValue}" ] && defaultValue="=${defaultValue}"
+
+        # fix the value for 'option' if one exists but does not match 'valueRegex'
+        if grep -q -P "^\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s+${VALUE_NAMES[$idx]}(?"'!'"${valueRegex}(\\s|\$))" < "/etc/pam.d/su" ; then
+            sed --follow-symlinks -i -E -e "s/^(\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s)${VALUE_NAMES[$idx]}=[^[:space:]]*/\\1${VALUE_NAMES[$idx]}${defaultValue}/" "/etc/pam.d/su"
+
+        # add 'option=default' if option is not set
+        elif grep -q -E "^\\s*auth\\s+required\\s+pam_wheel.so" < "/etc/pam.d/su" &&
+                grep    -E "^\\s*auth\\s+required\\s+pam_wheel.so" < "/etc/pam.d/su" | grep -q -E -v "\\s${VALUE_NAMES[$idx]}(=|\\s|\$)" ; then
+
+            sed --follow-symlinks -i -E -e "s/^(\\s*auth\\s+required\\s+pam_wheel.so[^\\n]*)/\\1 ${VALUE_NAMES[$idx]}${defaultValue}/" "/etc/pam.d/su"
+        # add a new entry if none exists
+        elif ! grep -q -P "^\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s+${VALUE_NAMES[$idx]}${valueRegex}(\\s|\$)" < "/etc/pam.d/su" ; then
+            echo "auth required pam_wheel.so ${VALUE_NAMES[$idx]}${defaultValue}" >> "/etc/pam.d/su"
+        fi
+    else
+        echo "/etc/pam.d/su doesn't exist" >&2
+    fi
+done
+
+for idx in "${!ARGS[@]}"
+do
+    if ! grep -q -P "^\s*auth\s+required\s+pam_wheel.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/su ; then
+        sed --follow-symlinks -i -E -e "s/^\\s*auth\\s+required\\s+pam_wheel.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/su
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/su
+        fi
+    fi
+done
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su'.
OVAL for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su' differs.
--- oval:ssg-use_pam_wheel_group_for_su:def:1
+++ oval:ssg-use_pam_wheel_group_for_su:def:1
@@ -1,2 +1,3 @@
 criteria AND
-criterion oval:ssg-test_use_pam_wheel_group_for_su:tst:1
+criterion oval:ssg-test_pam_auth_pam_wheel_group:tst:1
+criterion oval:ssg-test_pam_auth_pam_wheel_use_uid:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su' differs.
--- xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
+++ xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
@@ -1,21 +1,66 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q pam; then
 
+declare -a VALUES=()
+declare -a VALUE_NAMES=()
+declare -a ARGS=()
+declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
+
+
+
+
+
+
 var_pam_wheel_group_for_su=''
 
+VALUES+=("$var_pam_wheel_group_for_su")
+VALUE_NAMES+=("group")
+ARGS+=("")
+NEW_ARGS+=("")
 
-PAM_CONF=/etc/pam.d/su
+VALUES+=("")
+VALUE_NAMES+=("")
+ARGS+=("use_uid")
+NEW_ARGS+=("use_uid")
 
-pamstr=$(grep -P '^auth\s+required\s+pam_wheel\.so\s+(?=[^#]*\buse_uid\b)(?=[^#]*\bgroup=)' ${PAM_CONF})
-if [ -z "$pamstr" ]; then
-    sed -Ei '/^auth\b.*\brequired\b.*\bpam_wheel\.so/d' ${PAM_CONF} # remove any remaining uncommented pam_wheel.so line
-    sed -Ei "/^auth\s+sufficient\s+pam_rootok\.so.*$/a auth             required        pam_wheel.so use_uid group=${var_pam_wheel_group_for_su}" ${PAM_CONF}
-else
-    group_val=$(echo -n "$pamstr" | grep -Eo '\bgroup=[_a-z][-0-9_a-z]*' | cut -d '=' -f 2)
-    if [ -z "${group_val}" ] || [ ${group_val} != ${var_pam_wheel_group_for_su} ]; then
-        sed -Ei "s/(^auth\s+required\s+pam_wheel.so\s+[^#]*group=)[_a-z][-0-9_a-z]*/\1${var_pam_wheel_group_for_su}/" ${PAM_CONF}
+
+for idx in "${!VALUES[@]}"
+do
+    if [ -e "/etc/pam.d/su" ] ; then
+        valueRegex="${VALUES[$idx]}" defaultValue="${VALUES[$idx]}"
+        # non-empty values need to be preceded by an equals sign
+        [ -n "${valueRegex}" ] && valueRegex="=${valueRegex}"
+        # add an equals sign to non-empty values
+        [ -n "${defaultValue}" ] && defaultValue="=${defaultValue}"
+
+        # fix the value for 'option' if one exists but does not match 'valueRegex'
+        if grep -q -P "^\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s+${VALUE_NAMES[$idx]}(?"'!'"${valueRegex}(\\s|\$))" < "/etc/pam.d/su" ; then
+            sed --follow-symlinks -i -E -e "s/^(\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s)${VALUE_NAMES[$idx]}=[^[:space:]]*/\\1${VALUE_NAMES[$idx]}${defaultValue}/" "/etc/pam.d/su"
+
+        # add 'option=default' if option is not set
+        elif grep -q -E "^\\s*auth\\s+required\\s+pam_wheel.so" < "/etc/pam.d/su" &&
+                grep    -E "^\\s*auth\\s+required\\s+pam_wheel.so" < "/etc/pam.d/su" | grep -q -E -v "\\s${VALUE_NAMES[$idx]}(=|\\s|\$)" ; then
+
+            sed --follow-symlinks -i -E -e "s/^(\\s*auth\\s+required\\s+pam_wheel.so[^\\n]*)/\\1 ${VALUE_NAMES[$idx]}${defaultValue}/" "/etc/pam.d/su"
+        # add a new entry if none exists
+        elif ! grep -q -P "^\\s*auth\\s+required\\s+pam_wheel.so(\\s.+)?\\s+${VALUE_NAMES[$idx]}${valueRegex}(\\s|\$)" < "/etc/pam.d/su" ; then
+            echo "auth required pam_wheel.so ${VALUE_NAMES[$idx]}${defaultValue}" >> "/etc/pam.d/su"
+        fi
+    else
+        echo "/etc/pam.d/su doesn't exist" >&2
     fi
-fi
+done
+
+for idx in "${!ARGS[@]}"
+do
+    if ! grep -q -P "^\s*auth\s+required\s+pam_wheel.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/su ; then
+        sed --follow-symlinks -i -E -e "s/^\\s*auth\\s+required\\s+pam_wheel.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/su
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/su
+        fi
+    fi
+done
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su'.