Improve Rsyslog rules to support RainerScript syntax

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/oval/shared.xml

@@ -5,8 +5,12 @@
     <criteria operator="OR">
       <criterion comment="cron is configured in /etc/rsyslog.conf"
       test_ref="test_cron_logging_rsyslog" />
+      <criterion comment="cron is configured in /etc/rsyslog.conf using RainerScript"
+      test_ref="test_cron_logging_rsyslog_rainer" />
       <criterion comment="cron is configured in /etc/rsyslog.d"
       test_ref="test_cron_logging_rsyslog_dir" />
+      <criterion comment="cron is configured in /etc/rsyslog.d using RainerScript"
+      test_ref="test_cron_logging_rsyslog_dir_rainer" />
       {{% if product == "ol8" %}}
       <criterion comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities"
       test_ref="test_cron_logging_rsyslog_logging_all_facilities" />
@@ -16,14 +20,29 @@
     </criteria>
   </definition>
 
+{{% set legacy_regex = "^[\\s]*cron\\.\\*[\\s]+/var/log/cron\\s*(?:#.*)?$" %}}
+{{# RainerScript keys are case-insensitive #}}
+{{% set rainer_script_regex = "^\\s*cron\\.\\*\\s+action\\(.*(?i)\\btype\\b(?-i)=\"omfile\".*(?i)\\bfile\\b(?-i)=\"/var/log/cron\".*\\)\\s*$" %}}
+
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
   comment="cron is configured in /etc/rsyslog.conf"
   id="test_cron_logging_rsyslog" version="1">
     <ind:object object_ref="obj_cron_logging_rsyslog" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_cron_logging_rsyslog" version="1">
     <ind:filepath>/etc/rsyslog.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron\s*(?:#.*)?$</ind:pattern>
+    <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+  comment="cron is configured in /etc/rsyslog.conf using RainerScript"
+  id="test_cron_logging_rsyslog_rainer" version="1">
+    <ind:object object_ref="obj_cron_logging_rsyslog_rainer" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_rainer" version="1">
+    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -35,7 +54,19 @@
   <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir" version="1">
     <ind:path>/etc/rsyslog.d</ind:path>
     <ind:filename operation="pattern match">^.*$</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron\s*(?:#.*)?$</ind:pattern>
+    <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+  comment="cron is configured in /etc/rsyslog.d using RainerScript"
+  id="test_cron_logging_rsyslog_dir_rainer" version="1">
+    <ind:object object_ref="obj_cron_logging_rsyslog_dir_rainer" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_rainer" version="1">
+    <ind:path>/etc/rsyslog.d</ind:path>
+    <ind:filename operation="pattern match">^.*$</ind:filename>
+    <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml

@@ -8,7 +8,10 @@ description: |-
     cron job status. If <tt>cron</tt> is not logging to <tt>rsyslog</tt>, it
     can be implemented by adding the following to the <i>RULES</i> section of
     <tt>/etc/rsyslog.conf</tt>:
+    If the legacy syntax is used:
     <pre>cron.*                                                  /var/log/cron</pre>
+    If the modern syntax (RainerScript) is used:
+    <pre>cron.* action(type="omfile" file="/var/log/cron")</pre>
 
 rationale: |-
     Cron logging can be used to trace the successful or unsuccessful execution
@@ -46,6 +49,8 @@ ocil: |-
     run the following command:
     <pre>grep -rni "cron\.\*" /etc/rsyslog.*</pre>
     <pre>cron.*                                                  /var/log/cron</pre>
+    or
+    <pre>cron.* action(type="omfile" file="/var/log/cron")</pre>
 
 fixtext: |-
     Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory:

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/all_facilities_set_rsyslog_conf.pass.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 # platform = Oracle Linux 7,Oracle Linux 8
 
 . set_cron_logging.sh

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/all_facilities_set_rsyslog_d.pass.sh

@@ -1,10 +1,11 @@
 #!/bin/bash
+# packages = rsyslog
 # platform = Oracle Linux 7,Oracle Linux 8
 . set_cron_logging.sh
 
 RSYSLOG_CONF='/etc/rsyslog.conf'
 RSYSLOG_D_FOLDER='/etc/rsyslog.d'
-RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test'
+RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'
 
 mkdir -p $RSYSLOG_D_FOLDER
 rm "$RSYSLOG_D_FOLDER/*"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_capital_case_rsyslog_conf.pass.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# packages = rsyslog
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+RSYSLOG_D_FILES='/etc/rsyslog.d/*'
+
+# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
+touch $RSYSLOG_CONF
+for rsyslog_d_file in $RSYSLOG_D_FILES
+do
+	sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
+done
+
+echo 'cron.* action(Name="local-cron" Type="omfile" FileCreateMode="0600" FileOwner="root" FileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_CONF"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_rsyslog_conf.pass.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# packages = rsyslog
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+RSYSLOG_D_FILES='/etc/rsyslog.d/*'
+
+# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
+touch $RSYSLOG_CONF
+for rsyslog_d_file in $RSYSLOG_D_FILES
+do
+	sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
+done
+
+echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/var/log/cron")' >> "$RSYSLOG_CONF"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_rsyslog_d.pass.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# packages = rsyslog
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+RSYSLOG_D_FOLDER='/etc/rsyslog.d'
+RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'
+
+# Ensure that rsyslog.d folder exists and contains our 'test.conf' file
+mkdir -p $RSYSLOG_D_FOLDER
+touch $RSYSLOG_D_FILE
+
+sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
+
+echo 'cron.* action(name="local-cron" type="omfile" FileCreateMode="0600" fileOwner="root" fileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_D_FILE"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rsyslog_conf.pass.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 . set_cron_logging.sh
 
 RSYSLOG_CONF='/etc/rsyslog.conf'

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rsyslog_d.pass.sh

@@ -1,11 +1,12 @@
 #!/bin/bash
+# packages = rsyslog
 . set_cron_logging.sh
 
 RSYSLOG_CONF='/etc/rsyslog.conf'
 RSYSLOG_D_FOLDER='/etc/rsyslog.d'
-RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test'
+RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test.conf'
 
-# Ensure that rsyslog.d folder exists and contains our 'test' file
+# Ensure that rsyslog.d folder exists and contains our 'test.conf' file
 mkdir -p $RSYSLOG_D_FOLDER
 touch $RSYSLOG_D_FILE
 

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/no_cron_logging.fail.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 
 RSYSLOG_CONF='/etc/rsyslog.conf'
 RSYSLOG_D_FILES='/etc/rsyslog.d/*'

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/no_cron_logging_no_rsyslog_d_files.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = rsyslog
+
+rm -rf /etc/rsyslog.d
+touch /etc/rsyslog.conf
+sed -i '/^[[:space:]]*cron\.\*/d' /etc/rsyslog.conf

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/wrong_log_rainer_rsyslog_conf.fail.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# packages = rsyslog
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+RSYSLOG_D_FILES='/etc/rsyslog.d/*'
+
+# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
+touch $RSYSLOG_CONF
+for rsyslog_d_file in $RSYSLOG_D_FILES
+do
+	sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
+done
+
+# If there's cron.* line, then remove it
+sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
+# Add cron.* that logs into wrong file
+echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/tmp/log/cron")' >> "$RSYSLOG_CONF"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/tests/wrong_log_rsyslog_conf.fail.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 . set_cron_logging.sh
 
 RSYSLOG_CONF='/etc/rsyslog.conf'

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml

@@ -3,14 +3,21 @@
         {{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
         <criteria operator="AND">
             <criteria operator="OR">
-                 <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
+                <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                             test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
+                <criterion comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
+                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
                 <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
                             test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
+                <criterion comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
+                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
             </criteria>
         </criteria>
     </definition>
 
+{{% set legacy_regex = "^\\$ActionSendStreamDriverAuthMode x509/name$" %}}
+{{% set rainer_script_regex = "^\\s*action\\(.*(?i)\\btype\\b(?-i)=\"omfwd\".*(?i)\\bStreamDriverAuthMode\\b(?-i)=\"x509/name\".*\\)\\s*$" %}}
+
     <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                 comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                                 id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" version="1">
@@ -22,7 +29,22 @@
                                     comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                                     version="1">
         <ind:filepath>/etc/rsyslog.conf</ind:filepath>
-        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
+        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <ind:textfilecontent54_test check="all" check_existence="all_exist"
+                                comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
+                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" version="1">
+
+        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
+    </ind:textfilecontent54_test>
+
+    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer"
+                                    comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
+                                    version="1">
+        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
         <ind:instance datatype="int">1</ind:instance>
     </ind:textfilecontent54_object>
 
@@ -37,7 +59,23 @@
                                     version="1">
         <ind:path>/etc/rsyslog.d</ind:path>
         <ind:filename operation="pattern match">^.*conf$</ind:filename>
-        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
+        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
         <ind:instance datatype="int">1</ind:instance>
     </ind:textfilecontent54_object>
+
+    <ind:textfilecontent54_test check="all" check_existence="all_exist"
+                                comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
+                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" version="1">
+        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
+    </ind:textfilecontent54_test>
+
+    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer"
+                                    comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
+                                    version="1">
+        <ind:path>/etc/rsyslog.d</ind:path>
+        <ind:filename operation="pattern match">^.*conf$</ind:filename>
+        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
+        <ind:instance datatype="int">1</ind:instance>
+    </ind:textfilecontent54_object>
+
 </def-group>

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml

@@ -11,6 +11,11 @@ description: |-
 
     When using <tt>rsyslogd</tt> to off-load logs the remote system must be authenticated.
 
+    Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
+    <pre>$ActionSendStreamDriverAuthMode x509/name</pre>
+    Alternatively, use the RainerScript syntax:
+    <pre>action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")</pre>
+
 rationale: |-
     The audit records generated by Rsyslog contain valuable information regarding system
     configuration, user authentication, and other such information. Audit records should be

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 bash -x setup.sh
 
 if [[ -f encrypt.conf ]]; then

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 bash -x setup.sh
 
 echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.conf

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer.pass.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# packages = rsyslog
+bash -x setup.sh
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+RSYSLOG_D_FILES='/etc/rsyslog.d/*'
+
+# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
+touch $RSYSLOG_CONF
+for rsyslog_d_file in $RSYSLOG_D_FILES
+do
+	sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
+done
+
+echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")' >> "$RSYSLOG_CONF"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer_wrong_value.fail.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# packages = rsyslog
+bash -x setup.sh
+
+RSYSLOG_CONF='/etc/rsyslog.conf'
+
+echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="0")' >> "$RSYSLOG_CONF"

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 bash -x setup.sh
 
 echo "\$ActionSendStreamDriverAuthMode 0" >> /etc/rsyslog.conf

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 bash -x setup.sh
 
 echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.d/encrypt.conf

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# packages = rsyslog
 bash -x setup.sh
 
 echo "\$ActionSendStreamDriverAuthMode x509/certvalid" >> /etc/rsyslog.d/encrypt.conf