1

I'm working with a set of config files and I need a way to only cherry pick out certain entries when defining an Augeas lens.

How do I effectively state "if what Augeas sees isn't already listed specifically as an extraction it is OK to ignore"?

I was thinking a lens that explicitly doesn't match any other lens combined with a union might work but I have no idea on how the syntax would work.

My use case would be the following:

I'm parsing out some details (comments, script id, tag_summary, script_tag). There are other lines - logic statements, custom fields that only exist in certain cases and the like - that aren't structured and I can't readily write extractions for.

# Description: Unpassworded bash account
include("revisions-lib.inc");

tag_summary = "The account 'account' has no password set. An attacker may use it to gain further privileges on this system
This account was probably created by a backdoor installed  by a fake Linux Redhat patch. See http://www.k-otik.com/news/FakeRedhatPatchAnalysis.txt";

if(description)
{
 script_id(15583);
 script_version("$Revision: 17 $");
 script_tag(name:"last_modification", value:"$Date: 2013-10-27 15:01:43 +0100 (Sun, 27 Oct 2013) $");
 }

1 Answer 1

0

Augeas has a holistic approach to parsing files. Each file is matched against a regular expression which is generated from the lens. The file is parsed entirely, and there is (currently) no way to ignore parts of the file.

2
  • Thanks. I realize that Augeas needs to parse the whole file and the nature of the regular expressions in use (although I'm more of a PCRE guy). Flipping the regex logic isn't that hard. I'm thinking it should be possible to have a lens that matches everything but a list of other lenses provided, eg L4 = NOT( (L1,L2,L3)*). Therefore the L4 should be "everything else" if L1,L2,L3 is a list of all lenses. Jan 9, 2014 at 17:26
  • Yes, you can match anything but a regexp, something like store (reg1 - reg2) or, if you have more than one regexp, store (reg1 - (reg2|reg3|reg4)). However, you still need to make sure this doesn't lead to an ambiguous concatenation.
    – raphink
    Jan 9, 2014 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .