# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default; then
var_journal_upload_server_key_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_key_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ServerKeyFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_key_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ServerKeyFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^ServerKeyFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
var_journal_upload_server_certificate_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_certificate_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ServerCertificateFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_certificate_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ServerCertificateFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^ServerCertificateFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
var_journal_upload_server_trusted_certificate_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_trusted_certificate_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^TrustedCertificateFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_trusted_certificate_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^TrustedCertificateFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^TrustedCertificateFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi