foreman_openscap 7.1.1 → 8.0.0

data/app/assets/javascripts/foreman_openscap/reports.js

@@ -4,3 +4,8 @@ function showReportDetails(log_id, event) {
   showDetails.is(':visible') ? $(event).find('span').attr('class', 'glyphicon glyphicon-collapse-up') : $(event).find('span').attr('class', 'glyphicon glyphicon-collapse-down');
 }
 
+function showRemediationWizard(log_id) {
+  var wizard_button = $('#openscapRemediationWizardButton');
+  wizard_button.attr('data-log-id', log_id);
+  wizard_button.click();
+}

data/app/controllers/arf_reports_controller.rb

@@ -2,7 +2,7 @@ class ArfReportsController < ApplicationController
   include Foreman::Controller::AutoCompleteSearch
   include ForemanOpenscap::ArfReportsControllerCommonExtensions
 
-  before_action :find_arf_report, :only => %i[show show_html destroy parse_html parse_bzip download_html]
+  before_action :find_arf_report, :only => %i[show show_html destroy parse_html parse_bzip download_html show_log]
   before_action :find_multiple, :only => %i[delete_multiple submit_delete_multiple]
 
   def model_of_controller
@@ -72,6 +72,27 @@ class ArfReportsController < ApplicationController
     end
   end
 
+  def show_log
+    return not_found unless @arf_report # TODO: use Message/Log model directly instead?
+
+    log = @arf_report.logs.find(params[:log_id])
+    return not_found unless log
+
+    respond_to do |format|
+      format.json do
+        render json: {
+          log: {
+            source: log.source,
+            message: {
+              value: log.message.value,
+              fixes: log.message.fixes,
+            }
+          },
+        }, status: :ok
+      end
+    end
+  end
+
   private
 
   def find_arf_report
@@ -99,7 +120,7 @@ class ArfReportsController < ApplicationController
 
   def action_permission
     case params[:action]
-    when 'show_html', 'parse_html', 'parse_bzip', 'download_html'
+    when 'show_html', 'parse_html', 'parse_bzip', 'download_html', 'show_log'
       :view
     when 'delete_multiple', 'submit_delete_multiple'
       :destroy

data/app/helpers/arf_reports_helper.rb

@@ -62,9 +62,22 @@ module ArfReportsHelper
     msg.html_safe
   end
 
-  def host_search_by_rule_result_buttons(source)
-    action_buttons(display_link_if_authorized(_('Hosts failing this rule'), hash_for_hosts_path(:search => "fails_xccdf_rule = #{source}")),
-                   display_link_if_authorized(_('Hosts passing this rule'), hash_for_hosts_path(:search => "passes_xccdf_rule = #{source}")),
-                   display_link_if_authorized(_('Hosts othering this rule'), hash_for_hosts_path(:search => "others_xccdf_rule = #{source}")))
+  def host_search_by_rule_result_buttons(log)
+    buttons = [
+      display_link_if_authorized(_('Hosts failing this rule'), hash_for_hosts_path(:search => "fails_xccdf_rule = #{log.source}")),
+      display_link_if_authorized(_('Hosts passing this rule'), hash_for_hosts_path(:search => "passes_xccdf_rule = #{log.source}")),
+      display_link_if_authorized(_('Hosts othering this rule'), hash_for_hosts_path(:search => "others_xccdf_rule = #{log.source}")),
+    ]
+    if log.result == 'fail' && log.message.fixes.present?
+      buttons << link_to_function_if_authorized(_('Remediation'), "showRemediationWizard(#{log.id})", hash_for_show_log_arf_report_path(id: log.report.id))
+    end
+    action_buttons(buttons)
+  end
+
+  def supported_remediation_snippets
+    snippets = []
+    snippets << 'urn:xccdf:fix:script:sh' if ForemanOpenscap.with_remote_execution?
+    snippets << 'urn:xccdf:fix:script:ansible' if ForemanOpenscap.with_ansible?
+    snippets
   end
 end

data/app/models/foreman_openscap/arf_report.rb

@@ -131,14 +131,16 @@ module ForemanOpenscap
                   :severity => log[:severity],
                   :description => newline_to_space(log[:description]),
                   :rationale => newline_to_space(log[:rationale]),
-                  :scap_references => references_links(log[:references])
+                  :scap_references => references_links(log[:references]),
+                  :fixes => fixes(log[:fixes])
                 }
               else
                 msg = Message.new(:value => N_(log[:title]),
                                   :severity => log[:severity],
                                   :description => newline_to_space(log[:description]),
                                   :rationale => newline_to_space(log[:rationale]),
-                                  :scap_references => references_links(log[:references]))
+                                  :scap_references => references_links(log[:references]),
+                                  :fixes => fixes(log[:fixes]))
               end
               msg.save!
             end
@@ -222,12 +224,19 @@ module ForemanOpenscap
       html_links.join(', ')
     end
 
+    def self.fixes(raw_fixes)
+      return if raw_fixes.empty?
+
+      JSON.fast_generate(raw_fixes)
+    end
+
     def self.update_msg_with_changes(msg, incoming_data)
       msg.severity = incoming_data['severity']
       msg.description = incoming_data['description']
       msg.rationale = incoming_data['rationale']
       msg.scap_references = incoming_data['references']
       msg.value = incoming_data['title']
+      msg.fixes = fixes(incoming_data['fixes'])
 
       return unless msg.changed?
       msg.save

data/app/views/arf_reports/_output.html.erb

@@ -25,7 +25,7 @@
         </td>
         <td><%= log.source %></td>
         <td><%= react_component 'RuleSeverity', { :severity => log.message.severity.downcase } %></td>
-        <td><%= host_search_by_rule_result_buttons(log.source) %></td>
+        <td><%= host_search_by_rule_result_buttons(log) %></td>
       </tr>
     <% end %>
     <tr id='ntsh' <%= "style='display: none;'".html_safe if logs.size > 0%>>
@@ -35,3 +35,7 @@
     </tr>
   </tbody>
 </table>
+<%= react_component 'OpenscapRemediationWizard',
+                    { report_id: @arf_report.id,
+                      host: { name: @arf_report.host.name, id: @arf_report.host.id },
+                      supported_remediation_snippets: supported_remediation_snippets } %>

data/app/views/job_templates/run_openscap_remediation_-_ansible_default.erb

@@ -0,0 +1,27 @@
+<%#
+name: Run OpenSCAP remediation - Ansible Default
+job_category: OpenSCAP Ansible Commands
+description_format: Run OpenSCAP remediation on given host. Please note, it is not meant to be used directly.
+snippet: false
+provider_type: Ansible
+kind: job_template
+model: JobTemplate
+feature: ansible_run_openscap_remediation
+template_inputs:
+- name: tasks
+  description: Tasks to run on the host
+  input_type: user
+  required: true
+- name: reboot
+  description: Indicate wether the host should be rebooted after all the remediation
+  input_type: user
+  required: false
+%>
+---
+- hosts: all
+  tasks:
+<%= indent(4) { input('tasks') } -%>
+<% if truthy?(input('reboot')) %>
+    - name: Reboot the machine
+      reboot:
+<% end %>

data/app/views/job_templates/run_openscap_remediation_-_script_default.erb

@@ -0,0 +1,24 @@
+<%#
+name: Run OpenSCAP remediation - Script Default
+job_category: OpenSCAP
+description_format: Run OpenSCAP remediation on given host. Please note, it is not meant to be used directly.
+snippet: false
+provider_type: script
+kind: job_template
+model: JobTemplate
+feature: script_run_openscap_remediation
+template_inputs:
+- name: command
+  description: Command to run on the host
+  input_type: user
+  required: true
+- name: reboot
+  description: Indicate wether the host should be rebooted after the remediation
+  input_type: user
+  required: false
+%>
+<%= input('command') %>
+<% if truthy?(input('reboot')) -%>
+echo "A reboot is required to finish the remediation. The system is going to reboot now."
+<%= render_template('Power Action - Script Default', action: 'restart') %>
+<% end -%>

data/config/routes.rb

@@ -9,6 +9,7 @@ Rails.application.routes.draw do
         get 'parse_html'
         get 'parse_bzip'
         get 'download_html'
+        get 'show_log'
       end
       collection do
         get 'auto_complete_search'

data/db/migrate/20230912122310_add_fixes_to_message.rb

@@ -0,0 +1,5 @@
+class AddFixesToMessage < ActiveRecord::Migration[6.1]
+  def change
+    add_column :messages, :fixes, :text
+  end
+end

data/lib/foreman_openscap/engine.rb

@@ -48,7 +48,7 @@ module ForemanOpenscap
 
     initializer 'foreman_openscap.register_plugin', :before => :finisher_hook do |app|
       Foreman::Plugin.register :foreman_openscap do
-        requires_foreman '>= 3.7'
+        requires_foreman '>= 3.11'
         register_gettext
 
         apipie_documented_controllers ["#{ForemanOpenscap::Engine.root}/app/controllers/api/v2/compliance/*.rb"]
@@ -58,7 +58,7 @@ module ForemanOpenscap
 
         # Add permissions
         security_block :foreman_openscap do
-          permission :view_arf_reports, { :arf_reports => %i[index show parse_html show_html
+          permission :view_arf_reports, { :arf_reports => %i[index show parse_html show_html show_log
                                                              parse_bzip auto_complete_search download_html],
                                           'api/v2/compliance/arf_reports' => %i[index show download download_html],
                                           :compliance_hosts => [:show] },
@@ -275,6 +275,16 @@ module ForemanOpenscap
           :description => N_("Run OVAL scan")
         }
 
+        ansible_remediation_options = {
+          :description => N_("Run OpenSCAP remediation with Ansible"),
+          :provided_inputs => ["tasks", "reboot"]
+        }
+
+        script_remediation_options = {
+          :description => N_("Run OpenSCAP remediation with Shell"),
+          :provided_inputs => ["command", "reboot"]
+        }
+
         if Gem::Version.new(ForemanRemoteExecution::VERSION) >= Gem::Version.new('1.2.3')
           options[:host_action_button] = true
           oval_options[:host_action_button] = (!::Foreman.in_rake? && ActiveRecord::Base.connection.table_exists?(:settings)) ? (Setting.find_by(:name => 'lab_features')&.value || false) : false
@@ -282,6 +292,8 @@ module ForemanOpenscap
 
         RemoteExecutionFeature.register(:foreman_openscap_run_scans, N_("Run OpenSCAP scan"), options)
         RemoteExecutionFeature.register(:foreman_openscap_run_oval_scans, N_("Run OVAL scan"), oval_options)
+        RemoteExecutionFeature.register(:ansible_run_openscap_remediation, N_("Run OpenSCAP remediation with Ansible"), ansible_remediation_options)
+        RemoteExecutionFeature.register(:script_run_openscap_remediation, N_("Run OpenSCAP remediation with Shell"), script_remediation_options)
       end
     end
 
@@ -303,4 +315,8 @@ module ForemanOpenscap
   def self.with_remote_execution?
     RemoteExecutionFeature rescue false
   end
+
+  def self.with_ansible?
+    ForemanAnsible rescue false
+  end
 end

data/lib/foreman_openscap/version.rb

@@ -1,3 +1,3 @@
 module ForemanOpenscap
-  VERSION = "7.1.1".freeze
+  VERSION = "8.0.0".freeze
 end

data/lib/tasks/foreman_openscap_tasks.rake

@@ -86,22 +86,11 @@ namespace :test do
     test_dir = File.join(File.dirname(__FILE__), '../..', 'test')
     t.libs << ["test", test_dir]
     t.pattern = "#{test_dir}/**/*_test.rb"
-    t.verbose = true
-    t.warning = false
-  end
-end
-
-namespace :test do
-  desc "Test Core parts extended by ForemanOpenscap"
-  Rake::TestTask.new(:foreman_openscap_extensions) do |t|
-    test_dir = Rails.root.join('test')
-    t.libs << ["test", test_dir]
-    t.test_files = FileList[
-      "#{test_dir}/unit/foreman/access_permissions_test.rb",
-      "#{test_dir}/controllers/api/v2/hosts_controller_test.rb",
-      "#{test_dir}/controllers/api/v2/hostgroups_controller_test.rb",
-      "#{test_dir}/models/hosts/*_test.rb",
-      ]
+    t.test_files = [
+      Rails.root.join('test/unit/foreman/access_permissions_test.rb'),
+      Rails.root.join('test/controllers/api/v2/hosts_controller_test.rb'),
+      Rails.root.join('test/controllers/api/v2/hostgroups_controller_test.rb'),
+    ] + Rails.root.glob("test/models/hosts/*_test.rb")
     t.verbose = true
     t.warning = false
   end

data/locale/cs_CZ/foreman_openscap.edit.po

@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: foreman_openscap 7.1.0\n"
+"Project-Id-Version: foreman_openscap 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
 "PO-Revision-Date: 2023-05-16 14:11+0200\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
@@ -381,15 +381,15 @@ msgstr ""
 msgid "Successfully deleted %s compliance reports"
 msgstr ""
 
-#: ../app/controllers/arf_reports_controller.rb:85
+#: ../app/controllers/arf_reports_controller.rb:106
 msgid "No compliance reports were found."
 msgstr ""
 
-#: ../app/controllers/arf_reports_controller.rb:89
+#: ../app/controllers/arf_reports_controller.rb:110
 msgid "No compliance reports selected"
 msgstr ""
 
-#: ../app/controllers/arf_reports_controller.rb:94
+#: ../app/controllers/arf_reports_controller.rb:115
 msgid "Something went wrong while selecting compliance reports - %s"
 msgstr ""
 
@@ -429,15 +429,15 @@ msgstr ""
 msgid "No valid policy ID provided"
 msgstr ""
 
-#: ../app/controllers/policies_controller.rb:125
-msgid "No hosts were found."
+#: ../app/controllers/policies_controller.rb:129
+msgid "No hosts were found with that id, name or query filter"
 msgstr ""
 
-#: ../app/controllers/policies_controller.rb:129
+#: ../app/controllers/policies_controller.rb:134
 msgid "No hosts selected"
 msgstr ""
 
-#: ../app/controllers/policies_controller.rb:134
+#: ../app/controllers/policies_controller.rb:139
 msgid "Something went wrong while selecting hosts - %s"
 msgstr ""
 
@@ -509,18 +509,22 @@ msgstr ""
 msgid " through %s"
 msgstr ""
 
-#: ../app/helpers/arf_reports_helper.rb:66
+#: ../app/helpers/arf_reports_helper.rb:67
 msgid "Hosts failing this rule"
 msgstr ""
 
-#: ../app/helpers/arf_reports_helper.rb:67
+#: ../app/helpers/arf_reports_helper.rb:68
 msgid "Hosts passing this rule"
 msgstr ""
 
-#: ../app/helpers/arf_reports_helper.rb:68
+#: ../app/helpers/arf_reports_helper.rb:69
 msgid "Hosts othering this rule"
 msgstr ""
 
+#: ../app/helpers/arf_reports_helper.rb:72
+msgid "Remediation"
+msgstr ""
+
 #: ../app/helpers/compliance_dashboard_helper.rb:3 ../app/views/arf_reports/_list.html.erb:6 ../app/views/arf_reports/delete_multiple.html.erb:7 ../app/views/policy_dashboard/_policy_reports.html.erb:6
 msgid "Host"
 msgstr ""
@@ -1160,7 +1164,7 @@ msgstr ""
 msgid "You can specify custom cron line, e.g. \"0  3  *  *  *\", separate each of 5 values by space"
 msgstr ""
 
-#: ../app/views/policies/_list.html.erb:3 ../app/views/tailoring_files/_list.html.erb:3 ../webpack/routes/OvalContents/OvalContentsIndex/OvalContentsTable.js:19 ../webpack/routes/OvalContents/OvalContentsNew/OvalContentsNew.js:57 ../webpack/routes/OvalContents/OvalContentsShow/OvalContentsShow.js:48 ../webpack/routes/OvalPolicies/OvalPoliciesIndex/OvalPoliciesTable.js:19 ../webpack/routes/OvalPolicies/OvalPoliciesNew/NewOvalPolicyForm.js:56 ../webpack/routes/OvalPolicies/OvalPoliciesShow/DetailsTab.js:31 ../webpack/routes/OvalPolicies/OvalPoliciesShow/HostgroupsTable.js:9
+#: ../app/views/policies/_list.html.erb:3 ../app/views/tailoring_files/_list.html.erb:3 ../webpack/components/OpenscapRemediationWizard/steps/ReviewHosts.js:162 ../webpack/routes/OvalContents/OvalContentsIndex/OvalContentsTable.js:19 ../webpack/routes/OvalContents/OvalContentsNew/OvalContentsNew.js:57 ../webpack/routes/OvalContents/OvalContentsShow/OvalContentsShow.js:48 ../webpack/routes/OvalPolicies/OvalPoliciesIndex/OvalPoliciesTable.js:19 ../webpack/routes/OvalPolicies/OvalPoliciesNew/NewOvalPolicyForm.js:56 ../webpack/routes/OvalPolicies/OvalPoliciesShow/DetailsTab.js:31 ../webpack/routes/OvalPolicies/OvalPoliciesShow/HostgroupsTable.js:9
 msgid "Name"
 msgstr ""
 
@@ -1486,14 +1490,22 @@ msgstr ""
 msgid "ID of OpenSCAP Proxy"
 msgstr ""
 
-#: ../lib/foreman_openscap/engine.rb:270 ../lib/foreman_openscap/engine.rb:283
+#: ../lib/foreman_openscap/engine.rb:270 ../lib/foreman_openscap/engine.rb:293
 msgid "Run OpenSCAP scan"
 msgstr ""
 
-#: ../lib/foreman_openscap/engine.rb:275 ../lib/foreman_openscap/engine.rb:284
+#: ../lib/foreman_openscap/engine.rb:275 ../lib/foreman_openscap/engine.rb:294
 msgid "Run OVAL scan"
 msgstr ""
 
+#: ../lib/foreman_openscap/engine.rb:279 ../lib/foreman_openscap/engine.rb:295
+msgid "Run OpenSCAP remediation with Ansible"
+msgstr ""
+
+#: ../lib/foreman_openscap/engine.rb:284 ../lib/foreman_openscap/engine.rb:296
+msgid "Run OpenSCAP remediation with Shell"
+msgstr ""
+
 #: ../webpack/components/ConfirmModal.js:19
 msgid "Confirm"
 msgstr ""
@@ -1506,14 +1518,130 @@ msgstr ""
 msgid "There's no available report for this host"
 msgstr ""
 
-#: ../webpack/components/withDeleteModal.js:27
-msgid "Are you sure you want to delete %s?"
+#: ../webpack/components/OpenscapRemediationWizard/ViewSelectedHostsLink.js:27
+msgid "View selected hosts"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/index.js:69 ../webpack/components/OpenscapRemediationWizard/steps/ReviewHosts.js:174
+msgid "Review hosts"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/index.js:77 ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:123
+msgid "Select snippet"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/index.js:85 ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:94
+msgid "Review remediation"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/index.js:89
+msgid "Run"
 msgstr ""
 
-#: ../webpack/components/withLoading.js:12
+#: ../webpack/components/OpenscapRemediationWizard/index.js:93
+msgid "Done"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/index.js:127
+msgid "Remediate %s rule"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/Finish.js:84
+msgid "Job details"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/Finish.js:87
+msgid "Close"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/Finish.js:97 ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:144 ../webpack/components/withLoading.js:12
 msgid "Error!"
 msgstr ""
 
+#: ../webpack/components/OpenscapRemediationWizard/steps/Finish.js:105
+msgid "The job has started on selected host(s), you can check the status on the job details page."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewHosts.js:167
+msgid "OS"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewHosts.js:175
+msgid "By default, remediation is applied to the current host. Optionally, remediate any additional hosts that fail the rule."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:61
+msgid "Review the remediation snippet and apply it to the host manually."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:62
+msgid "Review the remediation snippet that will be applied to selected host(s)."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:67
+msgid "A reboot is required after applying remediation."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:68
+msgid "A reboot might be required after applying remediation."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:84
+msgid "Successfully copied to clipboard!"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:85
+msgid "Copy to clipboard"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:103
+msgid "Do not implement any of the recommended remedial actions or scripts without first testing them in a non-production environment."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:106
+msgid "Remediation might render the system non-functional."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:139
+msgid "Other hosts failing this rule"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/ReviewRemediation.js:155
+msgid "Reboot the system(s)"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:71
+msgid "Method"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:77
+msgid "Remote job"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:86
+msgid "Manual"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:101
+msgid "There is no job to remediate with. Please remediate manually."
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:107
+msgid "Snippet"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:150
+msgid "Select remediation method"
+msgstr ""
+
+#: ../webpack/components/OpenscapRemediationWizard/steps/SnippetSelect.js:151
+msgid "You can remediate by running a remote job or you can display a snippet for manual remediation."
+msgstr ""
+
+#: ../webpack/components/withDeleteModal.js:27
+msgid "Are you sure you want to delete %s?"
+msgstr ""
+
 #: ../webpack/components/withLoading.js:64
 msgid "Permission denied"
 msgstr ""