Skip to content

Commit 637e223

Browse files
copejonclaude
copejon
and
claude
committed
Fix robocop lint violations in CIS test suite
- LEN03: Extract Harden And Scan Baseline keyword to reduce Setup length - VAR11: Rename report_file arg to oscap_report to avoid reserved name - DEPR06: Use VAR instead of Create List for empty list init - MISC09: Replace multi-line IF with inline IF Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent d378ffc commit 637e223

3 files changed

Lines changed: 43 additions & 34 deletions

File tree

‎test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# Sourced from scenario.sh and uses functions defined there.
44

55
# CIS hardening runs inside the Robot suite and takes ~20 minutes
6+
# shellcheck disable=SC2034 # used elsewhere
67
TEST_EXECUTION_TIMEOUT=60m
78

89
# The RPM-based image used to create the VM for this test does not
@@ -143,6 +144,7 @@ scenario_remove_vms() {
143144
}
144145

145146
scenario_run_tests() {
147+
# shellcheck disable=SC2034 # used elsewhere
146148
TEST_RANDOMIZATION=none
147149
run_tests host1 \
148150
--variable "SCAP_DS_FILE:/usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml" \

‎test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# Sourced from scenario.sh and uses functions defined there.
44

55
# CIS hardening runs inside the Robot suite and takes ~20 minutes
6+
# shellcheck disable=SC2034 # used elsewhere
67
TEST_EXECUTION_TIMEOUT=60m
78

89
# The RPM-based image used to create the VM for this test does not
@@ -104,6 +105,7 @@ scenario_remove_vms() {
104105
}
105106

106107
scenario_run_tests() {
108+
# shellcheck disable=SC2034 # used elsewhere
107109
TEST_RANDOMIZATION=none
108110
run_tests host1 \
109111
suites/cis/

‎test/suites/cis/validate-cis-lvl2.robot‎

Lines changed: 39 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -19,32 +19,32 @@ Test Tags slow
1919

2020

2121
*** Variables ***
22-
${USHIFT_HOST} ${EMPTY}
23-
${USHIFT_USER} ${EMPTY}
24-
${API_PORT} 6443
25-
${OSCAP_BASELINE_FILE} /tmp/cis-baseline-results.xml
26-
${OSCAP_POST_FILE} /tmp/cis-post-results.xml
27-
${OSCAP_REPORT_FILE} /tmp/cis-post-report.html
28-
${OSCAP_PROFILE} xccdf_org.ssgproject.content_profile_cis
29-
${SCAP_DS_FILE} /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
30-
${CIS_REQUIREMENTS_FILE} cis-requirements.yml
31-
${CIS_HARDEN_FILE} cis-harden.yml
22+
${USHIFT_HOST} ${EMPTY}
23+
${USHIFT_USER} ${EMPTY}
24+
${API_PORT} 6443
25+
${OSCAP_BASELINE_FILE} /tmp/cis-baseline-results.xml
26+
${OSCAP_POST_FILE} /tmp/cis-post-results.xml
27+
${OSCAP_REPORT_FILE} /tmp/cis-post-report.html
28+
${OSCAP_PROFILE} xccdf_org.ssgproject.content_profile_cis
29+
${SCAP_DS_FILE} /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
30+
${CIS_REQUIREMENTS_FILE} cis-requirements.yml
31+
${CIS_HARDEN_FILE} cis-harden.yml
3232

3333
# Rules that MicroShift is known to cause. Any new failure outside this
3434
# set means MicroShift introduced an unexpected CIS regression.
3535
@{KNOWN_MICROSHIFT_RULES}
36-
... sysctl_net_ipv4_ip_forward
37-
... sysctl_net_ipv6_conf_all_forwarding
38-
... sysctl_net_ipv4_conf_all_forwarding
39-
... sysctl_net_ipv4_conf_default_forwarding
40-
... sysctl_net_ipv6_conf_default_forwarding
41-
... file_permissions_ungroupowned
42-
... no_files_unowned_by_user
43-
... no_files_or_dirs_ungroupowned
44-
... no_files_or_dirs_unowned_by_user
45-
... dir_perms_world_writable_sticky_bits
46-
... file_permissions_unauthorized_world_writable
47-
... audit_rules_privileged_commands
36+
... sysctl_net_ipv4_ip_forward
37+
... sysctl_net_ipv6_conf_all_forwarding
38+
... sysctl_net_ipv4_conf_all_forwarding
39+
... sysctl_net_ipv4_conf_default_forwarding
40+
... sysctl_net_ipv6_conf_default_forwarding
41+
... file_permissions_ungroupowned
42+
... no_files_unowned_by_user
43+
... no_files_or_dirs_ungroupowned
44+
... no_files_or_dirs_unowned_by_user
45+
... dir_perms_world_writable_sticky_bits
46+
... file_permissions_unauthorized_world_writable
47+
... audit_rules_privileged_commands
4848

4949

5050
*** Test Cases ***
@@ -77,14 +77,12 @@ Setup
7777
... run a post-install scan, and prepare for functional tests.
7878
Check Required Env Variables
7979
Login MicroShift Host
80-
Apply CIS Hardening
81-
Reboot And Reconnect
82-
Run CIS Scan ${OSCAP_BASELINE_FILE}
80+
Harden And Scan Baseline
8381
Install And Enable MicroShift
8482
Reboot And Reconnect
8583
Configure Firewall After Hardening
8684
Wait Until Greenboot Health Check Exited
87-
Run CIS Scan ${OSCAP_POST_FILE} report_file=${OSCAP_REPORT_FILE}
85+
Run CIS Scan ${OSCAP_POST_FILE} oscap_report=${OSCAP_REPORT_FILE}
8886
Setup Kubeconfig
8987

9088
Teardown
@@ -100,6 +98,12 @@ Teardown
10098
Run Keyword And Ignore Error
10199
... Logout MicroShift Host
102100

101+
Harden And Scan Baseline
102+
[Documentation] Apply CIS hardening, reboot, and run the baseline scan.
103+
Apply CIS Hardening
104+
Reboot And Reconnect
105+
Run CIS Scan ${OSCAP_BASELINE_FILE}
106+
103107
Apply CIS Hardening
104108
[Documentation] Install prerequisites, upload assets, and run the CIS hardening playbook
105109
Command Should Work dnf install -y openscap-scanner scap-security-guide ansible-core
@@ -157,9 +161,9 @@ Configure Firewall Trusted Sources
157161

158162
Run CIS Scan
159163
[Documentation] Execute the OpenSCAP CIS Level 2 scan and save results.
160-
[Arguments] ${results_file} ${report_file}=${EMPTY}
161-
${report_arg}= Set Variable If "${report_file}" != "${EMPTY}"
162-
... --report ${report_file} ${EMPTY}
164+
[Arguments] ${results_file} ${oscap_report}=${EMPTY}
165+
${report_arg}= Set Variable If "${oscap_report}" != "${EMPTY}"
166+
... --report ${oscap_report} ${EMPTY}
163167
${stdout} ${stderr} ${rc}= Execute Command
164168
... oscap xccdf eval --profile ${OSCAP_PROFILE} --results ${results_file} ${report_arg} ${SCAP_DS_FILE}
165169
... sudo=True
@@ -176,7 +180,10 @@ Get Failing Rule IDs
176180
Verify Remote File Exists With Sudo ${results_file}
177181
${stdout} ${stderr} ${rc}= Execute Command
178182
... python3 -c "import xml.etree.ElementTree as ET; ns={'x':'http://checklists.nist.gov/xccdf/1.2'}; tree=ET.parse('${results_file}'); rules=[rr.get('idref').replace('xccdf_org.ssgproject.content_rule_','') for rr in tree.findall('.//x:rule-result',ns) if rr.find('x:result',ns).text=='fail']; print('\\n'.join(sorted(rules)))"
179-
... sudo=True return_rc=True return_stdout=True return_stderr=True
183+
... sudo=True
184+
... return_rc=True
185+
... return_stdout=True
186+
... return_stderr=True
180187
Should Be Equal As Integers ${rc} 0 msg=Failed to parse results: ${stderr}
181188
@{rules}= Split String ${stdout.strip()} \n
182189
RETURN ${rules}
@@ -191,12 +198,10 @@ Should Only Contain Expected Rules
191198
[Documentation] Assert every rule in the delta is in the known MicroShift set.
192199
... Logs each unexpected rule and fails if any exist.
193200
[Arguments] ${delta}
194-
@{unexpected}= Create List
201+
VAR @{unexpected}= @{EMPTY}
195202
FOR ${rule} IN @{delta}
196203
${is_known}= Evaluate $rule in $KNOWN_MICROSHIFT_RULES
197-
IF not ${is_known}
198-
Append To List ${unexpected} ${rule}
199-
END
204+
IF not ${is_known} Append To List ${unexpected} ${rule}
200205
END
201206
Log Known MicroShift rules in delta: ${delta}
202207
IF len($unexpected) > 0

0 commit comments

Comments
 (0)