def make_simple_ima_blacklist_baseline_with_updated_file_and_hash(): return { "name": "simple_ima_blacklist_baseline_{0}".format(get_current_timestamp()), "description": "a simple blacklist ima baseline for systems testing", "records": [{"path": "test-file", "hash": USB_STORAGE_FILE_HASH_2}] }
def make_baseline_from_xml(xml_report, appraiser_type): """search the xml for records and add each one to a dictionary.""" timestamp = get_current_timestamp() baseline_name = "full_{0}_baseline_{1}".format(appraiser_type, timestamp) baseline_description = "{0} baseline created by parsing an xml report and uploaded for systems testing".format(appraiser_type) baseline = {"name": baseline_name, "description": baseline_description} baseline["records"] = [] tree = parse_xml_with_stripped_namespaces(xml_report) if appraiser_type == "TPM": pcr_tags = get_all_nodes_recursively(tree, "PcrValue") for pcr_tag in pcr_tags: tpm_digest = get_all_nodes_recursively(pcr_tag, "digest")[0].text parsed_record = {} parsed_record["pcr"] = pcr_tag.attrib['PcrNumber'] parsed_record["hash"] = binascii.hexlify(binascii.a2b_base64(tpm_digest)) baseline["records"].append(parsed_record) if appraiser_type == "IMA": ima_records = get_all_nodes_recursively(tree, "imaRecords") for ima_record in ima_records: ima_path = get_all_nodes_recursively(ima_record, "path")[0].text ima_digest = get_all_nodes_recursively(ima_record, "digest")[0].text parsed_record = {} parsed_record['path'] = ima_path hash64 = ima_digest parsed_record["hash"] = ( binascii.hexlify(binascii.a2b_base64(hash64))) baseline["records"].append(parsed_record) logging.info("created {0} baseline from xml with {1} records".format( appraiser_type, str(len(baseline["records"])))) return baseline
def make_simple_ima_blacklist_baseline(): return { "name": "simple_ima_blacklist_baseline_{0}".format(get_current_timestamp()), "description": "a simple blacklist ima baseline for systems testing", "records": [{"path": "/boot/usb-storage-foo.ko"}] #"records": [{"path": "usb-storage-foo.ko"}] }
def make_simple_ima_baseline(): timestamp = get_current_timestamp() if CLIENT_OS == "centos6": records = [{"path": "/lib/udev/console_init", "hash": send_command_sha1sum("sha1sum /lib/udev/console_init")}, {"path": "/bin/mknod", "hash": send_command_sha1sum("sha1sum /bin/mknod")}] elif CLIENT_OS == "centos7": records = [{"path": "/lib/systemd/rhel-readonly", "hash": send_command_sha1sum("sha1sum /lib/systemd/rhel-readonly")}, {"path": "/bin/sort", "hash": send_command_sha1sum("sha1sum /bin/sort")}] elif CLIENT_OS == "ubuntu16": records = [{"path": "/lib/systemd/systemd-udevd", "hash": send_command_sha1sum("sha1sum /lib/systemd/systemd-udevd")}, {"path": "/bin/udevadm", "hash": send_command_sha1sum("sha1sum /bin/udevadm")}] else: logging.error("unsupported client os type: %s", CLIENT_OS) simple_baseline = {"name": "simple_ima_baseline_{0}".format(timestamp), "description": "a simple hard-coded ima baseline for systems testing", "records": records} return simple_baseline