Merge ~gomesjoao/+git/ubuntu-fips-tools:master into ~fips-cc-stig/+git/ubuntu-fips-tools:master

[João Gomes]

729b886... by João Gomes on 2024-02-29

Add initial version of script to scan lxc minimal image.

33a7243... by João Gomes on 2024-03-01

Add initial version of script to scan schroot target.

Unmerged commits

33a7243... by João Gomes on 2024-03-01

Add initial version of script to scan schroot target.

729b886... by João Gomes on 2024-02-29

Add initial version of script to scan lxc minimal image.

ceafe9e... by João Gomes on 2024-02-26

Add initial version of script to build audit schroot

diff --git a/audit_build_schroot.sh b/audit_build_schroot.sh
new file mode 100755
index 0000000..bfe69b7
--- /dev/null
+++ b/audit_build_schroot.sh
@@ -0,0 +1,69 @@
+#!/bin/sh
+
+set -e
+
+ARCH="amd64"
+RELEASE="jammy"
+EXTRA_PKG=""
+
+DEPS="debootstrap schroot"
+for dep in $DEPS ; do
+  if ! [ -x "$(command -v "$dep")" ]; then
+    printf "Error:\t%s is missing.\n" "$dep"
+    exit 1
+  fi
+done
+
+if [ $# -lt 2 ]; then
+  printf "Error:\tMissing parameters\n"
+  printf "\tThe name and dir of the schroot needs to be provided\n"
+  printf "Usage:\t%s [name] [dir]\n" "$0"
+  exit 1
+fi
+
+SCHROOT_NAME=$1
+SCHROOT_DIR=$2
+
+schroot_config=$(cat <<-END
+[$SCHROOT_NAME]
+description=$SCHROOT_NAME
+groups=sbuild,root
+root-groups=sbuild,root
+source-root-users=root,sbuild,admin
+source-root-groups=root,sbuild,admin
+type=directory
+profile=default
+union-type=overlay
+directory=$SCHROOT_DIR
+preserve-environment=true
+END
+)
+
+[ -d "$SCHROOT_DIR" ] || {
+  # Create dir to install chroot on
+  mkdir -p "$SCHROOT_DIR"
+}
+
+[ -f "$schroot_config" ] || {
+  # Create chroot config
+  echo "$schroot_config" > /etc/schroot/chroot.d/"$SCHROOT_NAME-$ARCH"
+}
+
+# Bootstrap minimal chroot
+debootstrap --variant=minbase --arch="$ARCH" "$RELEASE" "$SCHROOT_DIR" http://archive.ubuntu.com/ubuntu
+
+# Install ubuntu-minimal to install all software we consider required
+schroot -c "$SCHROOT_NAME" -u root -- apt-get install ubuntu-minimal
+
+# Remove symlinks that reference the base system and cause loops when scanning
+rm --one-file-system /srv/devel/schroot/test-minimal/var/lock
+rm --one-file-system /srv/devel/schroot/test-minimal/var/run
+rm --one-file-system /srv/devel/schroot/test-minimal/dev/fd
+rm --one-file-system /srv/devel/schroot/test-minimal/dev/stderr
+rm --one-file-system /srv/devel/schroot/test-minimal/dev/stdin
+rm --one-file-system /srv/devel/schroot/test-minimal/dev/stdout
+
+# Install extra packages if necessary
+[ -n "$EXTRA_PKG" ] && {
+  schroot -c "$SCHROOT_NAME" -u root -- apt-get -y install "$EXTRA_PKG"
+}
diff --git a/audit_scan_lxd.sh b/audit_scan_lxd.sh
new file mode 100755
index 0000000..3c1e951
--- /dev/null
+++ b/audit_scan_lxd.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -e
+
+EXTRA_PKG=""
+
+DEPS="lxc"
+for dep in $DEPS ; do
+  if ! [ -x "$(command -v "$dep")" ]; then
+    printf "Error:\t%s is missing." "$dep"
+    exit 1
+  fi
+done
+
+if [ $# -lt 2 ]; then
+  printf "Error:\tMissing parameters\n"
+  printf "\tThe container name and rule file need to be provided\n"
+  printf "Usage:\t%s [container_name] [rulefile]\n" "$0"
+  exit 1
+fi
+
+CONTAINER_NAME=$1
+RULE_FILE=$2
+
+[ -f "$RULE_FILE" ] || {
+  printf "Error:\trule file does not exist\n"
+  exit 1
+}
+
+# Setting up the container if it isn't available already
+[ "$(lxc list -c n -f csv "$CONTAINER_NAME")" ] || {
+  lxc launch ubuntu-minimal:jammy "$CONTAINER_NAME"
+}
+
+# install yara from the archives
+lxc exec "$CONTAINER_NAME" -- apt-get update
+lxc exec "$CONTAINER_NAME" -- apt-get -y install yara
+
+# Install any extra packages that are needed
+[ -n "$EXTRA_PKG" ] && {
+  lxc exec "$CONTAINER_NAME" -- apt-get -y install "$EXTRA_PKG"
+}
+
+# Send the rule file into the container
+lxc file push "$RULE_FILE" "$CONTAINER_NAME/root/"
+
+lxc exec "$CONTAINER_NAME" -- yara -N -r "./$(basename "$RULE_FILE")" /
diff --git a/audit_scan_schroot.sh b/audit_scan_schroot.sh
new file mode 100755
index 0000000..bf9b2e0
--- /dev/null
+++ b/audit_scan_schroot.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+DEPS="yara"
+for dep in $DEPS ; do
+  if ! [ -x "$(command -v "$dep")" ]; then
+    printf "Error:\t%s is missing." "$dep"
+    exit 1
+  fi
+done
+
+if [ $# -lt 2 ]; then
+  printf "Error:\tMissing parameters\n"
+  printf "\tThe schroot dir and rule file need to be provided\n"
+  printf "Usage:\t%s [schroot_dir] [rulefile]\n" "$0"
+  exit 1
+fi
+
+SCHROOT_DIR=$1
+RULE_FILE=$2
+
+[ -d "$SCHROOT_DIR" ] || {
+  printf "Error:\tschroot dir does not exist\n"
+  exit 1
+}
+
+[ -f "$RULE_FILE" ] || {
+  printf "Error:\trule file does not exist\n"
+  exit 1
+}
+
+yara -N -r "$RULE_FILE" "$SCHROOT_DIR"