Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule #14057

Arden97 · 2025-10-29T12:38:37Z

Description:

This pull request enhances the OVAL check for rsyslog remote logging configuration to properly detect RainerScript action() statements that span multiple lines
The regex pattern rsyslog_remote_loghost_rainer_regex now includes the s flag (dotall mode), which allows the . metacharacter to match newline characters
This enables the pattern to match RainerScript action() configurations where parameters are split across multiple lines for readability, which is a common formatting practice in rsyslog configurations
Added a new test case remote_configured_rainer_newline.pass.sh that validates detection of multiline RainerScript action configurations

Rationale:

The previous regex pattern with only the (?m) (multiline) flag could match patterns where ^ and $ anchors work across lines, but the .* portions could not span newlines
Fixes # RHEL-104207

Review Hints:

use automatus to verify, that remote_configured_rainer_multiline test is passing
use automatus to test following rules (both bash and ansible remediations):
- rsyslog_remote_loghost
- rsyslog_remote_tls
- rsyslog_cron_logging
- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
- rsyslog_encrypt_offload_actionsendstreamdrivermode
- rsyslog_encrypt_offload_defaultnetstreamdriver

openshift-ci · 2025-10-29T12:38:49Z

Hi @Arden97. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jan-cerny

It looks fine. The automatus test scenarios pass locally for me.

Two things that came to my mind:

Please check if there aren't any other similar rules that would need the same modification. I know that there are multiple rules for rsyslog configuration in the project and they might suffer from the same problem.
Consider creating another test scenario that would create the same configuration file as the example of the configuration file the reporter of the bug provided in the Jira ticket. I think that would be a good regression test.

…uthmode

Arden97 · 2025-11-05T09:16:35Z

OVAL checks and tests of the following rules were updated to support both legacy and RainerScript syntax (multi-line included):

rsyslog_cron_logging
rsyslog_encrypt_offload_actionsendstreamdriverauthmode
rsyslog_encrypt_offload_actionsendstreamdrivermode
rsyslog_encrypt_offload_defaultnetstreamdriver

Arden97 · 2025-11-05T14:04:49Z

Testing scenario remote_configured_rainer_multiline_azuremonitoragent for rsyslog_remote_loghost rule was created. It specifically tests the case described in RHEL-104207.

jan-cerny · 2025-11-06T15:54:23Z

shared/macros/10-bash.jinja

+
+
+{{#
+This macro sets up the rsyslog environment for testing rsyslog_encrypt_offload_actionsendstreamdriverauthmode rule.


I think it would be better to put macros like this to shared/macros/20-test-scenarios.jinja.

jan-cerny · 2025-11-06T15:54:48Z

shared/macros/10-bash.jinja

+{{%- endmacro -%}}
+
+
+{{%- macro setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() -%}}


Undocumented macro

jan-cerny · 2025-11-06T15:55:13Z

shared/macros/10-bash.jinja

+It ensures the rsyslog directory structure and rsyslog conf file exist, then removes any existing
+multilined and legacy format entries.
+#}}
+{{%- macro setup_rsyslog_cron_logging () -%}}


coding style

jan-cerny · 2025-11-06T15:56:44Z

...stem/logging/rsyslog_sending_messages/rsyslog_remote_loghost/tests/remote_configured.pass.sh

-else
-	echo "$LOGHOST_LINE" >> "$CONF_FILE"
-fi
+{{{ setup_rsyslog_remote_loghost("*.* @@192.168.122.1:5000") }}}


missing end of file

jan-cerny · 2025-11-06T15:59:41Z

...es/rsyslog_remote_loghost/tests/remote_configured_rainer_multiline_azuremonitoragent.pass.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# packages = rsyslog
+


Suggested change

# This TS is a regression test of https://issues.redhat.com/browse/RHEL-104207.

jan-cerny

@Arden97 So far looks good. Do you plan to make the PR as ready for a review or is there anything else that you plan to do?

Arden97 · 2025-11-07T13:06:33Z

@Arden97 So far looks good. Do you plan to make the PR as ready for a review or is there anything else that you plan to do?

I'm currently working on updating ansible remediations for changed ensure_rsyslog_log_file_configuration rules. Will make this PR ready for review later today

…on rules

rainer regex new line support

223b780

Arden97 requested review from Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners October 29, 2025 12:38

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Oct 29, 2025

Arden97 changed the title ~~Add multiline support for RainerScript action detection in rsysslog_remote_loghost rule~~ Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule Oct 29, 2025

jan-cerny added the bugfix Fixes to reported bugs. label Oct 30, 2025

jan-cerny reviewed Oct 30, 2025

View reviewed changes

jan-cerny added this to the 0.1.79 milestone Oct 30, 2025

jan-cerny self-assigned this Oct 30, 2025

Arden97 added 12 commits October 31, 2025 11:11

multiline support in rsyslog_cron_logging

e490b6b

fixing rainer_loging_regex

e19c94d

fixing tests for rsyslog_cron_logging

3b935f7

add newline and fix a commit message

75d7c5c

multiline support for rsyslog_encrypt_offload_actionsendstreamdrivermode

3ade7f7

minor regex fix in rsyslog_encrypt_offload_actionsendstreamdrivermode

8b8b640

multiline support for rsyslog_encrypt_offload_defaultnetstreamdriver

9e49653

multiline support for rsyslog_encrypt_offload_actionsendstreamdrivera…

5e1b2ed

…uthmode

updating tests and remediation of rsyslog_cron_logging

517a5c4

updating tests for rsyslog_encrypt_offload_defaultnetstreamdriver

393fcd6

updating tests for rsyslog_encrypt_offload_defaultnetstreamdriver

ce972e1

replacing setup.sh with jinja macros

386aa72

Arden97 marked this pull request as draft November 5, 2025 09:28

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Nov 5, 2025

Arden97 added 3 commits November 5, 2025 13:01

adding macro for rsyslog_remote_loghost, regression test

960bce9

removing RainerScript entries before rsyslog_remote_tls tests

9aa18aa

fixing typo in default_no_pass.fail.sh tests

21f1ae7

jan-cerny reviewed Nov 6, 2025

View reviewed changes

moving macros to test-scenarios

a9f56ba

jan-cerny reviewed Nov 7, 2025

View reviewed changes

Arden97 added 3 commits November 7, 2025 19:53

updating ansible remediations for ensure_rsyslog_log_file_configurati…

c5ef30b

…on rules

updating bash macros for ensure_rsyslog_log_file_configuration rules

d34214c

fix 'rule_title is undefined' error

c16d5b2

Arden97 force-pushed the scap_rainerscript_format branch from 49e6850 to c16d5b2 Compare November 7, 2025 19:52

Arden97 marked this pull request as ready for review November 7, 2025 21:06

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Nov 7, 2025

fixing error for ol7 target

cd99c9a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule #14057

Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule #14057

Arden97 commented Oct 29, 2025 •

edited

Loading

Uh oh!

openshift-ci bot commented Oct 29, 2025

Uh oh!

jan-cerny left a comment

Uh oh!

Arden97 commented Nov 5, 2025 •

edited

Loading

Uh oh!

Arden97 commented Nov 5, 2025

Uh oh!

jan-cerny Nov 6, 2025

Uh oh!

jan-cerny Nov 6, 2025

Uh oh!

jan-cerny Nov 6, 2025

Uh oh!

jan-cerny Nov 6, 2025

Uh oh!

jan-cerny Nov 6, 2025

Uh oh!

jan-cerny left a comment

Uh oh!

Arden97 commented Nov 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants



		{{#
		This macro sets up the rsyslog environment for testing rsyslog_encrypt_offload_actionsendstreamdriverauthmode rule.

		{{%- endmacro -%}}


		{{%- macro setup_rsyslog_encrypt_offload_actionsendstreamdriverauthmode() -%}}


	# This TS is a regression test of https://issues.redhat.com/browse/RHEL-104207.

Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule #14057

Are you sure you want to change the base?

Add multiline support for RainerScript action detection in rsyslog_remote_loghost rule #14057

Conversation

Arden97 commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

openshift-ci bot commented Oct 29, 2025

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Arden97 commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Arden97 commented Nov 5, 2025

Uh oh!

jan-cerny Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Arden97 commented Nov 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Arden97 commented Oct 29, 2025 •

edited

Loading

Arden97 commented Nov 5, 2025 •

edited

Loading