Module to handle arbitrary commands and miscellaneous checks
Closed this issue · 6 comments
would like to be able to look for specific strings/results from the output of a command. For instance item 1.3.2 for RHEL/CentOS (crontab -u root -l | grep aide) or 1.2.2 for RHEL/CentOS (rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey).
We're planning some discussion on how to best handle arbitrary command checks. This is coming, we just want to do it right. Hopefully not too much longer.
sounds good - i'm working on adding RHEL 6 to the CIS.yaml file now. Then will start building profiles for the various DISA STIG for RHEL 6. When I find other features/enhancements, would you want me to just create an issue like i did for this one?
Yes please. Any feedback, feature requests or bugs you might have please file them here. We're very interested in community feedback.
I'm going to work on spec'ing out a module and yaml syntax for this.
as you are thinking of the logic for this, if you have a match_output section, sometimes inspections are looking for specific output or patterns; othertimes they are looking to make sure that certain output is NOT present.
Right. I expect it will have an arg for flipping between matches being treated as success, or matches being treated as failures.