OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	07/01/2022 06:30:50 AM	rwxr-xr-x
📄 __init__.py	0 bytes	05/18/2022 04:04:36 PM	rw-r--r--
📁 __pycache__	-	07/01/2022 06:30:50 AM	rwxr-xr-x
📄 cc_apk_configure.py	5.56 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_apt_configure.py	31.87 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_apt_pipelining.py	2.63 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_bootcmd.py	2.69 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_byobu.py	3.49 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ca_certs.py	7.34 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_chef.py	13.62 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_debug.py	3.37 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_disable_ec2_metadata.py	1.85 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_disk_setup.py	32 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_fan.py	2.93 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_final_message.py	2.97 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_growpart.py	18.87 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_grub_dpkg.py	5.62 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_install_hotplug.py	3.64 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_keyboard.py	1.87 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_keys_to_console.py	3.45 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_landscape.py	4.67 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_locale.py	1.7 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_lxd.py	11.12 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_mcollective.py	6.01 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_migrator.py	3.34 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_mounts.py	19.33 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ntp.py	16.53 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_package_update_upgrade_install.py	4.13 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_phone_home.py	5.3 KB	06/15/2022 04:38:21 PM	rw-r--r--
📄 cc_power_state_change.py	7.47 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_puppet.py	12.86 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_refresh_rmc_and_interface.py	5.31 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_reset_rmc.py	4.36 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_resizefs.py	9.9 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_resolv_conf.py	4.5 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_rh_subscription.py	16.86 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_rightscale_userdata.py	4.05 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_rsyslog.py	9.58 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_runcmd.py	2.66 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_salt_minion.py	5.36 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_scripts_per_boot.py	1.5 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_scripts_per_instance.py	1.66 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_scripts_per_once.py	1.61 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_scripts_user.py	1.69 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_scripts_vendor.py	2.14 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_seed_random.py	4.64 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_set_hostname.py	4.45 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_set_passwords.py	10.17 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_snap.py	6.16 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_spacewalk.py	3.33 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ssh.py	13.88 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ssh_authkey_fingerprints.py	4.06 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ssh_import_id.py	5.63 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_timezone.py	1.25 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ubuntu_advantage.py	5.67 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_ubuntu_drivers.py	4.63 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_update_etc_hosts.py	4.93 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_update_hostname.py	3.22 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_users_groups.py	7.43 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_write_files.py	6.46 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_write_files_deferred.py	1.46 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_yum_add_repo.py	6.92 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 cc_zypper_add_repo.py	6.31 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 modules.py	10.57 KB	05/18/2022 04:04:36 PM	rw-r--r--
📄 schema.py	27.82 KB	06/15/2022 04:38:21 PM	rw-r--r--
📁 schemas	-	07/01/2022 06:30:50 AM	rwxr-xr-x

Editing: cc_refresh_rmc_and_interface.py

# (c) Copyright IBM Corp. 2020 All Rights Reserved
#
# Author: Aman Kumar Sinha <amansi26@in.ibm.com>
#
# This file is part of cloud-init. See LICENSE file for license information.

"""Refresh IPv6 interface and RMC:
Ensure Network Manager is not managing IPv6 interface"""

import errno

from cloudinit import log as logging
from cloudinit import netinfo, subp, util
from cloudinit.config.schema import MetaSchema
from cloudinit.distros import ALL_DISTROS
from cloudinit.settings import PER_ALWAYS

MODULE_DESCRIPTION = """\
This module is IBM PowerVM Hypervisor specific

Reliable Scalable Cluster Technology (RSCT) is a set of software components
that together provide a comprehensive clustering environment(RAS features)
for IBM PowerVM based virtual machines. RSCT includes the Resource
Monitoring and Control (RMC) subsystem. RMC is a generalized framework used
for managing, monitoring, and manipulating resources. RMC runs as a daemon
process on individual machines and needs creation of unique node id and
restarts during VM boot.
More details refer
https://www.ibm.com/support/knowledgecenter/en/SGVKBA_3.2/admin/bl503_ovrv.htm

This module handles
- Refreshing RMC
- Disabling NetworkManager from handling IPv6 interface, as IPv6 interface
  is used for communication between RMC daemon and PowerVM hypervisor.
"""

meta: MetaSchema = {
    "id": "cc_refresh_rmc_and_interface",
    "name": "Refresh IPv6 Interface and RMC",
    "title": "Ensure Network Manager is not managing IPv6 interface",
    "description": MODULE_DESCRIPTION,
    "distros": [ALL_DISTROS],
    "frequency": PER_ALWAYS,
    "examples": [],
}

# This module is undocumented in our schema docs
__doc__ = ""

LOG = logging.getLogger(__name__)
# Ensure that /opt/rsct/bin has been added to standard PATH of the
# distro. The symlink to rmcctrl is /usr/sbin/rsct/bin/rmcctrl .
RMCCTRL = "rmcctrl"

def handle(name, _cfg, _cloud, _log, _args):
    if not subp.which(RMCCTRL):
        LOG.debug("No '%s' in path, disabled", RMCCTRL)
        return

LOG.debug(
        "Making the IPv6 up explicitly. "
        "Ensuring IPv6 interface is not being handled by NetworkManager "
        "and it is  restarted to re-establish the communication with "
        "the hypervisor"
    )

ifaces = find_ipv6_ifaces()

# Setting NM_CONTROLLED=no for IPv6 interface
    # making it down and up

if len(ifaces) == 0:
        LOG.debug("Did not find any interfaces with ipv6 addresses.")
    else:
        for iface in ifaces:
            refresh_ipv6(iface)
            disable_ipv6(sysconfig_path(iface))
        restart_network_manager()

def find_ipv6_ifaces():
    info = netinfo.netdev_info()
    ifaces = []
    for iface, data in info.items():
        if iface == "lo":
            LOG.debug("Skipping localhost interface")
        if len(data.get("ipv4", [])) != 0:
            # skip this interface, as it has ipv4 addrs
            continue
        ifaces.append(iface)
    return ifaces

def refresh_ipv6(interface):
    # IPv6 interface is explicitly brought up, subsequent to which the
    # RMC services are restarted to re-establish the communication with
    # the hypervisor.
    subp.subp(["ip", "link", "set", interface, "down"])
    subp.subp(["ip", "link", "set", interface, "up"])

def sysconfig_path(iface):
    return "/etc/sysconfig/network-scripts/ifcfg-" + iface

def restart_network_manager():
    subp.subp(["systemctl", "restart", "NetworkManager"])

def disable_ipv6(iface_file):
    # Ensuring that the communication b/w the hypervisor and VM is not
    # interrupted due to NetworkManager. For this purpose, as part of
    # this function, the NM_CONTROLLED is explicitly set to No for IPV6
    # interface and NetworkManager is restarted.
    try:
        contents = util.load_file(iface_file)
    except IOError as e:
        if e.errno == errno.ENOENT:
            LOG.debug("IPv6 interface file %s does not exist\n", iface_file)
        else:
            raise e

if "IPV6INIT" not in contents:
        LOG.debug("Interface file %s did not have IPV6INIT", iface_file)
        return

LOG.debug("Editing interface file %s ", iface_file)

# Dropping any NM_CONTROLLED or IPV6 lines from IPv6 interface file.
    lines = contents.splitlines()
    lines = [line for line in lines if not search(line)]
    lines.append("NM_CONTROLLED=no")

with open(iface_file, "w") as fp:
        fp.write("\n".join(lines) + "\n")

def search(contents):
    # Search for any NM_CONTROLLED or IPV6 lines in IPv6 interface file.
    return (
        contents.startswith("IPV6ADDR")
        or contents.startswith("IPADDR6")
        or contents.startswith("IPV6INIT")
        or contents.startswith("NM_CONTROLLED")
    )

def refresh_rmc():
    # To make a healthy connection between RMC daemon and hypervisor we
    # refresh RMC. With refreshing RMC we are ensuring that making IPv6
    # down and up shouldn't impact communication between RMC daemon and
    # hypervisor.
    # -z : stop Resource Monitoring & Control subsystem and all resource
    # managers, but the command does not return control to the user
    # until the subsystem and all resource managers are stopped.
    # -s : start Resource Monitoring & Control subsystem.
    try:
        subp.subp([RMCCTRL, "-z"])
        subp.subp([RMCCTRL, "-s"])
    except Exception:
        util.logexc(LOG, "Failed to refresh the RMC subsystem.")
        raise