@@ -76,30 +76,30 @@ bundle agent inventory_CVE_2014_6271
76
76
### What does this inventory policy do?
77
77
78
78
Meta type promises are used to attach additional information to bundles. We
79
- have set ' description' so that future readers of the policy will know what the
79
+ have set ` description ` so that future readers of the policy will know what the
80
80
policy is for and how to get more information on the vulnerability. For
81
- the sake of simplicity in this example set ' autorun' as a tag to the bundle.
81
+ the sake of simplicity in this example set ` autorun ` as a tag to the bundle.
82
82
This makes the bundle available for automatic activation when using the autorun
83
83
feature in the Masterfiles Policy Framework.
84
84
85
85
Next we set the paths to the binaries that we will use to exeucte our test
86
- command. As of this writing the paths for ' env' and ' echo' are both in the
87
- standard libraries paths bundle, but ' bash' is not. Note that you may need to
86
+ command. As of this writing the paths for ` env ` and ` echo ` are both in the
87
+ standard libraries paths bundle, but ` bash ` is not. Note that you may need to
88
88
adjust the path to bash for your platforms. Then we run our test command and
89
- place the command output into the ' test_result' variable. Since we have no
90
- _ CVE_2014_6271 _ class defined yet, the next promise to set the variable
91
- ' vulnerable' to ' CVE-2014 -6271' will be skipped on the first pass. Then the
92
- classes type promise is evaluated and defines the class _ CVE_2014_6271 _ if the
93
- output matches the regular expression ' vulnerable.\* ' . Finally the reports are
94
- evaluated before starting the second pass. If the class ' DEBUG' or
95
- ' DEBUG_inventory_CVE_2014_6271' is set the test command output will be shown,
89
+ place the command output into the ` test_result ` variable. Since we have no
90
+ ` CVE_2014_6271 ` class defined yet, the next promise to set the variable
91
+ ` vulnerable ` to ` CVE-2014-6271 ` will be skipped on the first pass. Then the
92
+ classes type promise is evaluated and defines the class ` CVE_2014_6271 ` if the
93
+ output matches the regular expression ` vulnerable.\* ` . Finally the reports are
94
+ evaluated before starting the second pass. If the class ` DEBUG ` or
95
+ ` DEBUG_inventory_CVE_2014_6271 ` is set the test command output will be shown,
96
96
and if the vulnerability is present agent is running in inform or verbose mode
97
97
message indicating the host is vulnerable along with the description will be
98
98
output.
99
99
100
- On the second pass only that variable ' vulnerable' will be set with the value
101
- ' CVE-2014 -6271' if the host is vulnerable. Note how this variable tagged with
102
- ' inventory' and ' attribute_name=' . These are special meta tags that CFEngine
100
+ On the second pass only that variable ` vulnerable ` will be set with the value
101
+ ` CVE-2014-6271 ` if the host is vulnerable. Note how this variable tagged with
102
+ ` inventory ` and ` attribute_name= ` . These are special meta tags that CFEngine
103
103
Enterprise uses in order to display information.
104
104
105
105
### Deploy the policy
@@ -172,9 +172,9 @@ bundle agent remediate_CVE_2014_6271
172
172
173
173
### What does this remediation policy do?
174
174
175
- For simplicity of the example this policy defines the class allow_update on hub
175
+ For simplicity of the example this policy defines the class ` allow_update ` on hub
176
176
and host001, but you could use any class that makes sense to you. If the
177
- allow_update class is set, and the class _ CVE_2014_6271 _ is defined (indicating
177
+ ` allow_update ` class is set, and the class ` CVE_2014_6271 ` is defined (indicating
178
178
the host is vulnerable) then the policy ensures that bash is updated to the
179
179
latest version available.
180
180
0 commit comments