From 69f9acc2b456a79095ed0a9127fc60c7186d618f Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Tue, 15 Jul 2025 09:13:01 +0000 Subject: [PATCH] import CS scap-security-guide-0.1.77-2.el10 --- .gitignore | 1 + disable_ospp.patch | 22 + scap-security-guide.spec | 548 ++++++++++++++++++ ...-guide_0_1_78_fix_uefi_applicability.patch | 40 ++ ..._0_1_78_fix_uefi_applicability_jinja.patch | 42 ++ ...-guide_0_1_78_fix_wrong_grubmkconfig.patch | 101 ++++ sources | 1 + 7 files changed, 755 insertions(+) create mode 100644 .gitignore create mode 100644 disable_ospp.patch create mode 100644 scap-security-guide.spec create mode 100644 scap-security-guide_0_1_78_fix_uefi_applicability.patch create mode 100644 scap-security-guide_0_1_78_fix_uefi_applicability_jinja.patch create mode 100644 scap-security-guide_0_1_78_fix_wrong_grubmkconfig.patch create mode 100644 sources diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fa40fa8 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +scap-security-guide-0.1.77.tar.bz2 diff --git a/disable_ospp.patch b/disable_ospp.patch new file mode 100644 index 0000000..2499154 --- /dev/null +++ b/disable_ospp.patch @@ -0,0 +1,22 @@ +From 56f17c7c5c9544633ac88a54c264ab232268a40d Mon Sep 17 00:00:00 2001 +From: Vojtech Polasek +Date: Tue, 25 Feb 2025 17:18:53 +0100 +Subject: prevent ospp profile from being built on rhel10 product + +--- + products/rhel10/profiles/ospp.profile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/products/rhel10/profiles/ospp.profile b/products/rhel10/profiles/ospp.profile +index 0642cbab2e..bf87808035 100644 +--- a/products/rhel10/profiles/ospp.profile ++++ b/products/rhel10/profiles/ospp.profile +@@ -1,4 +1,5 @@ + documentation_complete: true ++hidden: true + + metadata: + version: 4.3 +-- +2.48.1 + diff --git a/scap-security-guide.spec b/scap-security-guide.spec new file mode 100644 index 0000000..aabf622 --- /dev/null +++ b/scap-security-guide.spec @@ -0,0 +1,548 @@ +# SSG build system and tests count with build directory name `build`. +# For more details see: +# https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds +%global _vpath_builddir build + +Name: scap-security-guide +Version: 0.1.77 +Release: 2%{?dist} +Summary: Security guidance and baselines in SCAP formats +License: BSD-3-Clause +URL: https://github.com/ComplianceAsCode/content/ +Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 +Patch0: disable_ospp.patch +# fix applicability of grub2_admin_username and grub2_password rules on uefi systems +Patch1: scap-security-guide_0_1_78_fix_uefi_applicability.patch +Patch2: scap-security-guide_0_1_78_fix_uefi_applicability_jinja.patch +# fix wrong grub-mkconfig (should be grub2-mkconfig) command in rule descriptions +Patch3: scap-security-guide_0_1_78_fix_wrong_grubmkconfig.patch + +BuildArch: noarch + +BuildRequires: libxslt +BuildRequires: openscap-scanner >= 1.2.5 +BuildRequires: cmake >= 2.8 +# To get python3 inside the buildroot require its path explicitly in BuildRequires +BuildRequires: /usr/bin/python3 +BuildRequires: python%{python3_pkgversion} +BuildRequires: python%{python3_pkgversion}-jinja2 +BuildRequires: python%{python3_pkgversion}-PyYAML +BuildRequires: python%{python3_pkgversion}-setuptools +Requires: xml-common, openscap-scanner >= 1.2.5 + +%description +The scap-security-guide project provides a guide for configuration of the +system from the final system's security point of view. The guidance is specified +in the Security Content Automation Protocol (SCAP) format and constitutes +a catalog of practical hardening advice, linked to government requirements +where applicable. The project bridges the gap between generalized policy +requirements and specific implementation guidelines. The system +administrator can use the oscap CLI tool from openscap-scanner package, or the +scap-workbench GUI tool from scap-workbench package to verify that the system +conforms to provided guideline. Refer to scap-security-guide(8) manual page for +further information. + +%package doc +Summary: HTML formatted security guides generated from XCCDF benchmarks +Requires: %{name} = %{version}-%{release} + +%description doc +The %{name}-doc package contains HTML formatted documents containing +hardening guidances that have been generated from XCCDF benchmarks +present in %{name} package. + +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) +%package rule-playbooks +Summary: Ansible playbooks per each rule. +Group: System Environment/Base +Requires: %{name} = %{version}-%{release} + +%description rule-playbooks +The %{name}-rule-playbooks package contains individual ansible playbooks per rule. +%endif + +%prep +%autosetup -p1 + +%define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF +%define cmake_defines_specific %{nil} +%if 0%{?rhel} && ! %{defined eln} +%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON +%endif +%if 0%{?centos} +%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON +%endif + +mkdir -p build +%build +%cmake %{cmake_defines_common} %{cmake_defines_specific} +%cmake_build + +%install +%cmake_install +rm %{buildroot}/%{_docdir}/%{name}/README.md +rm %{buildroot}/%{_docdir}/%{name}/Contributors.md + +%files +# To Enabled once the content for RHEL 10 +%{_datadir}/xml/scap/ssg/content +%{_datadir}/%{name}/ansible/*.yml +%lang(en) %{_mandir}/man8/scap-security-guide.8.* +%doc %{_docdir}/%{name}/LICENSE +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) +%exclude %{_datadir}/%{name}/ansible/rule_playbooks +%endif + +%files doc +%doc %{_docdir}/%{name}/guides/*.html +%doc %{_docdir}/%{name}/tables/*.html + +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) +%files rule-playbooks +%defattr(-,root,root,-) +%{_datadir}/%{name}/ansible/rule_playbooks +%endif + +%changelog +* Fri Jun 27 2025 Vojtech Polasek - 0.1.77-2 +- fix incorrect applicability of Grub2 UEFI specific rules +- replace grub-mkconfig with grub2-mkconfig in rule descriptions + +* Tue Jun 03 2025 Matthew Burket - 0.1.77-1 +- Rebase scap-security-guide to the latest upstream version 0.1.77 (RHEL-94804) + +* Thu Feb 27 2025 Vojtech Polasek - 0.1.76-2 +- rebuilt + +* Tue Feb 25 2025 Vojtech Polasek - 0.1.76-1 +- rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-74239) + +* Tue Oct 29 2024 Troy Dawson - 0.1.74-2 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 + +* Fri Aug 09 2024 Matthew Burket +- Update to latest upstream SCAP-Security-Guide-0.1.74 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 + +* Mon Jun 24 2024 Troy Dawson - 0.1.73-2 +- Bump release for June 2024 mass rebuild + +* Wed May 22 2024 Jan Černý - 0.1.73-1 +- Upgrade to the latest upstream release + +* Wed Mar 27 2024 Matthew Burket - 0.1.72-2 +- Add RHEL10 Product + +* Fri Feb 09 2024 Vojtech Polasek - 0.1.72-1 +- Update to latest upstream SCAP-Security-Guide-0.1.72 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72 + +* Sat Jan 27 2024 Fedora Release Engineering - 0.1.71-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Dec 19 2023 Vojtech Polasek - 0.1.71-1 +- Update to latest upstream SCAP-Security-Guide-0.1.71 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.71 + +* Thu Oct 12 2023 Matthew Burket - 0.1.70-1 +- Update to latest upstream SCAP-Security-Guide-0.1.70 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.70 + +* Thu Aug 03 2023 Jan Černý - 0.1.69-1 +- Update to latest upstream SCAP-Security-Guide-0.1.69 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.69 + +* Sat Jul 22 2023 Fedora Release Engineering - 0.1.68-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jun 15 2023 Jan Černý - 0.1.68-1 +- Update to latest upstream SCAP-Security-Guide-0.1.68 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.68 + +* Wed Apr 12 2023 Matthew Burket - 0.1.67-1 +- Update to latest upstream SCAP-Security-Guide-0.1.67 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.67 + + +* Fri Feb 03 2023 Vojtech Polasek - 0.1.66-1 +- Update to latest upstream SCAP-Security-Guide-0.1.66 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.66 + +* Sat Jan 21 2023 Fedora Release Engineering - 0.1.65-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Dec 06 2022 Marcus Burghardt - 0.1.65-1 +- Update to latest upstream SCAP-Security-Guide-0.1.65 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.65 + +* Tue Oct 04 2022 Watson Sato - 0.1.64-1 +- Update to latest upstream SCAP-Security-Guide-0.1.64 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.64 + +* Mon Aug 01 2022 Watson Sato - 0.1.63-1 +- Update to latest upstream SCAP-Security-Guide-0.1.63 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.63 + +* Sat Jul 23 2022 Fedora Release Engineering - 0.1.62-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jun 09 2022 Vojtech Polasek - 0.1.62-2 +- rebuild, the release did not get propagated into rawhide + +* Mon May 30 2022 Vojtech Polasek - 0.1.62-1 +- Update to latest upstream SCAP-Security-Guide-0.1.62 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.62 + +* Wed May 04 2022 Watson Sato - 0.1.61-1 +- Update to latest upstream SCAP-Security-Guide-0.1.61 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.61 + +* Fri Jan 28 2022 Watson Sato - 0.1.60-1 +- Update to latest upstream SCAP-Security-Guide-0.1.60 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.60 + +* Sat Jan 22 2022 Fedora Release Engineering - 0.1.59-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Dec 01 2021 Watson Sato - 0.1.59-1 +- Update to latest upstream SCAP-Security-Guide-0.1.59 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 +- Fix loading of jinja files + +* Thu Sep 30 2021 Watson Sato - 0.1.58-1 +- Update to latest upstream SCAP-Security-Guide-0.1.58 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.58 +- Fix license warning. + +* Thu Jul 29 2021 Matej Tyc - 0.1.57-1 +- Update to latest upstream SCAP-Security-Guide-0.1.57 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.57 + +* Fri Jul 23 2021 Fedora Release Engineering - 0.1.56-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jun 08 2021 Matej Tyc - 0.1.56-2 +- Updated the packaging according to the RHEL development trends. +- Don't ship 1.2 datastreams and Bash remediations. +- Clean up dependencies and other package metadata. +- Change the RHEL target. + +* Wed May 26 2021 Vojtech Polasek - 0.1.56-1 +- Update to latest upstream SCAP-Security-Guide-0.1.56 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 + +* Fri Mar 19 2021 Vojtech Polasek - 0.1.55-2 +- rebuilt + +* Fri Mar 19 2021 Vojtech Polasek - 0.1.55-1 +- Update to latest upstream SCAP-Security-Guide-0.1.55 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.55 + +* Fri Feb 12 2021 Matej Tyc - 0.1.54-3 +- Moved the spec file closer to the RHEL one. + +* Fri Feb 12 2021 Vojtech Polasek - 0.1.54-2 +- fix definition of build directory + +* Fri Feb 05 2021 Vojtech Polasek - 0.1.54-1 +- Update to latest upstream SCAP-Security-Guide-0.1.54 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.54 + +* Wed Jan 27 2021 Fedora Release Engineering - 0.1.53-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Nov 16 2020 Vojtech Polasek - 0.1.53-1 +- Update to latest upstream SCAP-Security-Guide-0.1.53 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.53 + +* Wed Sep 23 2020 Vojtech Polasek - 0.1.52-3 +- revert previous rework, it did not solve the problem + +* Wed Sep 23 2020 Vojtech Polasek - 0.1.52-2 +- rewrite solution for CMake out of source builds + +* Mon Sep 21 2020 Vojtech Polasek - 0.1.52-1 +- Update to latest upstream SCAP-Security-Guide-0.1.52 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.52 + +* Tue Aug 04 2020 Jan Černý - 0.1.51-4 +- Update for new CMake out of source builds + https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds +- Fix FTBS in Rawhide/F33 (RHBZ#1863741) + +* Sat Aug 01 2020 Fedora Release Engineering - 0.1.51-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 0.1.51-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jul 17 2020 Vojtech Polasek - 0.1.51-1 +- Update to latest upstream SCAP-Security-Guide-0.1.51 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.51 + +* Mon Mar 23 2020 Watson Sato - 0.1.49-1 +- Update to latest upstream SCAP-Security-Guide-0.1.49 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.49 + +* Thu Jan 30 2020 Fedora Release Engineering - 0.1.48-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jan 16 2020 Watson Sato - 0.1.48-1 +- Update to latest upstream SCAP-Security-Guide-0.1.48 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.48 + +* Mon Dec 09 2019 Matěj Týč - 0.1.47-2 +- Hotfix of the XML parsing fix. + +* Mon Dec 09 2019 Matěj Týč - 0.1.47-1 +- Update to latest upstream SCAP-Security-Guide-0.1.47 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.47 +- Fixed XML parsing of remediation functions. + +* Mon Jul 29 2019 Watson Sato - 0.1.45-1 +- Update to latest upstream SCAP-Security-Guide-0.1.45 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.45 + +* Fri Jul 26 2019 Fedora Release Engineering - 0.1.44-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon May 06 2019 Watson Yuuma Sato - 0.1.44-1 +- Update to latest upstream SCAP-Security-Guide-0.1.44 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.44 + +* Fri Feb 22 2019 Watson Yuuma Sato - 0.1.43-1 +- Update to latest upstream SCAP-Security-Guide-0.1.43 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.43 +- Update URL and source URL + +* Sat Feb 02 2019 Fedora Release Engineering - 0.1.42-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Dec 12 2018 Watson Yuuma Sato - 0.1.42-1 +- Update to latest upstream SCAP-Security-Guide-0.1.42 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.42 +- Fix man page build dependency on derivative content + +* Mon Oct 01 2018 Watson Yuuma Sato - 0.1.41-1 +- Update to latest upstream SCAP-Security-Guide-0.1.41 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.41 +- Fix Licence of this package + +* Wed Jul 25 2018 Matěj Týč - 0.1.40-1 +- Update to latest upstream SCAP-Security-Guide-0.1.40 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.40 +- Update to use Python3 for build. + +* Sat Jul 14 2018 Fedora Release Engineering - 0.1.39-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri May 04 2018 Watson Yuuma Sato - 0.1.39-2 +- Add python version to python2-jinja2 package + +* Fri May 04 2018 Watson Yuuma Sato - 0.1.39-1 +- Update to latest upstream SCAP-Security-Guide-0.1.39 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.39 + +* Mon Mar 05 2018 Watson Yuuma Sato - 0.1.38-2 +- Add python version to python package prefixes + +* Mon Mar 05 2018 Watson Yuuma Sato - 0.1.38-1 +- Update to latest upstream SCAP-Security-Guide-0.1.38 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.38 + +* Fri Feb 09 2018 Fedora Release Engineering - 0.1.37-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Jan 04 2018 Watson Yuuma Sato - 0.1.37-1 +- Update to latest upstream SCAP-Security-Guide-0.1.37 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.37 + +* Wed Nov 01 2017 Watson Yuuma Sato - 0.1.36-1 +- Update to latest upstream SCAP-Security-Guide-0.1.36 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.36 + +* Tue Aug 29 2017 Watson Sato - 0.1.35-1 +- Update to latest upstream SCAP-Security-Guide-0.1.35 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.35 + +* Thu Jul 27 2017 Fedora Release Engineering - 0.1.34-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Mon Jul 03 2017 Watson Sato - 0.1.34-1 +- updated to latest upstream release + +* Mon May 01 2017 Martin Preisler - 0.1.33-1 +- updated to latest upstream release + +* Thu Mar 30 2017 Martin Preisler - 0.1.32-1 +- updated to latest upstream release + +* Sat Feb 11 2017 Fedora Release Engineering - 0.1.31-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Mon Nov 28 2016 Martin Preisler - 0.1.31-2 +- use make_build and make_install RPM macros + +* Mon Nov 28 2016 Martin Preisler - 0.1.31-1 +- update to the latest upstream release +- new default location for content /usr/share/scap/ssg +- install HTML tables in the doc subpackage + +* Mon Jun 27 2016 Jan iankko Lieskovsky - 0.1.30-2 +- Correct currently failing parallel SCAP Security Guide build + +* Mon Jun 27 2016 Jan iankko Lieskovsky - 0.1.30-1 +- Update to latest upstream SCAP-Security-Guide-0.1.30 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30 +- Drop shell library for remediation functions since it is not required + starting from 0.1.30 release any more + +* Thu May 05 2016 Jan iankko Lieskovsky - 0.1.29-1 +- Update to latest upstream SCAP-Security-Guide-0.1.29 release: + https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.29 +- Do not ship Firefox/DISCLAIMER documentation file since it has been removed + in 0.1.29 upstream release + +* Thu Feb 04 2016 Fedora Release Engineering - 0.1.28-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jan 20 2016 Šimon Lukašík - 0.1.28-1 +- upgrade to the latest upstream release + +* Fri Dec 11 2015 Šimon Lukašík - 0.1.27-1 +- update to the latest upstream release + +* Tue Oct 20 2015 Šimon Lukašík - 0.1.26-1 +- update to the latest upstream release + +* Sat Sep 05 2015 Šimon Lukašík - 0.1.25-1 +- update to the latest upstream release + +* Thu Jul 09 2015 Šimon Lukašík - 0.1.24-1 +- update to the latest upstream release +- created doc sub-package to ship all the guides +- start distributing centos and scientific linux content +- rename java content to jre + +* Fri Jun 19 2015 Fedora Release Engineering - 0.1.22-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Tue May 05 2015 Šimon Lukašík - 0.1.22-1 +- update to the latest upstream release +- only DataStream file is now available for Fedora +- start distributing security baseline for Firefox +- start distributing security baseline for Java RunTime deployments + +* Wed Mar 04 2015 Šimon Lukašík - 0.1.21-1 +- update to the latest upstream release +- move content to /usr/share/scap/ssg/content + +* Thu Oct 02 2014 Šimon Lukašík - 0.1.19-1 +- update to the latest upstream release + +* Mon Jul 14 2014 Šimon Lukašík - 0.1.5-4 +- require only openscap-scanner, not whole openscap-utils package + +* Tue Jul 01 2014 Šimon Lukašík - 0.1.5-3 +- Rebase the RHEL part of SSG to the latest upstream version (0.1.18) +- Add STIG DISCLAIMER to the shipped documentation + +* Sun Jun 08 2014 Fedora Release Engineering - 0.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu Feb 27 2014 Jan iankko Lieskovsky 0.1.5-1 +- Fix fedora-srpm and fedora-rpm Make targets to work again +- Include RHEL-6 and RHEL-7 datastream files to support remote RHEL system scans +- EOL for Fedora 18 support +- Include Fedora datastream file for remote Fedora system scans + +* Mon Jan 06 2014 Jan iankko Lieskovsky 0.1.4-2 +- Drop -compat package, provide openscap-content directly (RH BZ#1040335#c14) + +* Fri Dec 20 2013 Jan iankko Lieskovsky 0.1.4-1 +- Fix remediation for sshd set keepalive (ClientAliveCountMax) and move + it to /shared +- Add shared remediations for sshd disable empty passwords and + sshd set idle timeout +- Shared remediation for sshd disable root login +- Add empty -compat subpackage to ensure backward-compatibility with + openscap-content and firstaidkit-plugin-openscap packages (RH BZ#1040335) +- OVAL check for sshd disable root login +- Fix typo in OVAL check for sshd disable empty passwords +- OVAL check for sshd disable empty passwords +- Unselect no shelllogin for systemaccounts rule from being run by default +- Rename XCCDF rules +- Revert Set up Fedora release name and CPE based on build system properties +- Shared OVAL check for Verify that Shared Library Files Have Root Ownership +- Shared OVAL check for Verify that System Executables Have Restrictive Permissions +- Shared OVAL check for Verify that System Executables Have Root Ownership +- Shared OVAL check for Verify that Shared Library Files Have Restrictive + Permissions +- Fix remediation for Disable Prelinking rule +- OVAL check and remediation for sshd's ClientAliveCountMax rule +- OVAL check for sshd's ClientAliveInterval rule +- Include descriptions for permissions section, and rules for checking + permissions and ownership of shared library files and system executables +- Disable selected rules by default +- Add remediation for Disable Prelinking rule +- Adjust service-enable-macro, service-disable-macro XSLT transforms + definition to evaluate to proper systemd syntax +- Fix service_ntpd_enabled OVAL check make validate to pass again +- Include patch from Šimon Lukašík to obsolete openscap-content + package (RH BZ#1028706) +- Add OVAL check to test if there's is remote NTP server configured for + time data +- Add system settings section for the guide (to track system wide + hardening configurations) +- Include disable prelink rule and OVAL check for it +- Initial OVAL check if ntpd service is enabled. Add package_installed + OVAL templating directory structure and functionality. +- Include services section, and XCCDF description for selected ntpd's + sshd's service rules +- Include remediations for login.defs' based password minimum, maximum and + warning age rules +- Include directory structure to support remediations +- Add SCAP "replace or append pattern value in text file based on variable" + remediation script generator +- Add remediation for "Set Password Minimum Length in login.defs" rule + +* Mon Nov 18 2013 Jan iankko Lieskovsky 0.1.3-1 +- Update versioning scheme - move fedorassgrelease to be part of + upstream version. Rename it to fedorassgversion to avoid name collision + with Fedora package release. + +* Tue Oct 22 2013 Jan iankko Lieskovsky 0.1-3 +- Add .gitignore for Fedora output directory +- Set up Fedora release name and CPE based on build system properties +- Use correct file paths in scap-security-guide(8) manual page + (RH BZ#1018905, c#10) +- Apply further changes motivated by scap-security-guide Fedora RPM review + request (RH BZ#1018905, c#8): + * update package description, + * make content files to be owned by the scap-security-guide package, + * remove Fedora release number from generated content files, + * move HTML form of the guide under the doc directory (together + with that drop fedora/content subdir and place the content + directly under fedora/ subdir). +- Fixes for scap-security-guide Fedora RPM review request (RH BZ#1018905): + * drop Fedora release from package provided files' final path (c#5), + * drop BuildRoot, selected Requires:, clean section, drop chcon for + manual page, don't gzip man page (c#4), + * change package's description (c#4), + * include PD license text (#c4). + +* Mon Oct 14 2013 Jan iankko Lieskovsky 0.1-2 +- Provide manual page for scap-security-guide +- Remove percent sign from spec's changelog to silence rpmlint warning +- Convert RHEL6 'Restrict Root Logins' section's rules to Fedora +- Convert RHEL6 'Set Password Expiration Parameter' rules to Fedora +- Introduce 'Account and Access Control' section +- Convert RHEL6 'Verify Proper Storage and Existence of Password Hashes' section's + rules to Fedora +- Set proper name of the build directory in the spec's setup macro. +- Replace hard-coded paths with macros. Preserve attributes when copying files. + +* Tue Sep 17 2013 Jan iankko Lieskovsky 0.1-1 +- Initial Fedora SSG RPM. diff --git a/scap-security-guide_0_1_78_fix_uefi_applicability.patch b/scap-security-guide_0_1_78_fix_uefi_applicability.patch new file mode 100644 index 0000000..67dd18e --- /dev/null +++ b/scap-security-guide_0_1_78_fix_uefi_applicability.patch @@ -0,0 +1,40 @@ +From 35a873bf3da694876a1390eb4ea324cfb3d64327 Mon Sep 17 00:00:00 2001 +From: Gabriel Becker +Date: Wed, 18 Jun 2025 14:04:34 +0200 +Subject: [PATCH] Remove uefi/non-uefi from grub2 rules in case they do not + need. + +Products that have the same grub2 path for both UEFI/non-UEFI do not +need to set the platform and the products have now consolidated the use +of the grub2 rules to only select the ones that come from the non-UEFI +set of rules. +--- + linux_os/guide/system/bootloader-grub2/non-uefi/group.yml | 2 ++ + linux_os/guide/system/bootloader-grub2/uefi/group.yml | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml +index b093bdad864..2a79674b363 100644 +--- a/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml ++++ b/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml +@@ -5,4 +5,6 @@ title: 'Non-UEFI GRUB2 bootloader configuration' + description: |- + Non-UEFI GRUB2 bootloader configuration + ++{{%- if grub2_boot_path != grub2_uefi_boot_path -%}} + platform: non-uefi ++{{%- endif -%}} +diff --git a/linux_os/guide/system/bootloader-grub2/uefi/group.yml b/linux_os/guide/system/bootloader-grub2/uefi/group.yml +index e08747fe8c9..08f2e4ad9d0 100644 +--- a/linux_os/guide/system/bootloader-grub2/uefi/group.yml ++++ b/linux_os/guide/system/bootloader-grub2/uefi/group.yml +@@ -5,7 +5,9 @@ title: 'UEFI GRUB2 bootloader configuration' + description: |- + UEFI GRUB2 bootloader configuration + ++{{%- if grub2_boot_path != grub2_uefi_boot_path -%}} + platform: uefi ++{{%- endif -%}} + + warnings: + - functionality: |- diff --git a/scap-security-guide_0_1_78_fix_uefi_applicability_jinja.patch b/scap-security-guide_0_1_78_fix_uefi_applicability_jinja.patch new file mode 100644 index 0000000..ddfe407 --- /dev/null +++ b/scap-security-guide_0_1_78_fix_uefi_applicability_jinja.patch @@ -0,0 +1,42 @@ +From 884ccb32e27aca7e3a4b0af841ddd5ecba81ae67 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 19 Jun 2025 14:40:17 +0200 +Subject: [PATCH] Remove excess dashes in Jinja 2 expression + +These dashes consume all surrounding namespaces. As a result, +the platform key isn't taken as a key but becomes part of the +description value. +--- + linux_os/guide/system/bootloader-grub2/non-uefi/group.yml | 4 ++-- + linux_os/guide/system/bootloader-grub2/uefi/group.yml | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml +index 2a79674b363..67c0612649c 100644 +--- a/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml ++++ b/linux_os/guide/system/bootloader-grub2/non-uefi/group.yml +@@ -5,6 +5,6 @@ title: 'Non-UEFI GRUB2 bootloader configuration' + description: |- + Non-UEFI GRUB2 bootloader configuration + +-{{%- if grub2_boot_path != grub2_uefi_boot_path -%}} ++{{% if grub2_boot_path != grub2_uefi_boot_path -%}} + platform: non-uefi +-{{%- endif -%}} ++{{%- endif %}} +diff --git a/linux_os/guide/system/bootloader-grub2/uefi/group.yml b/linux_os/guide/system/bootloader-grub2/uefi/group.yml +index 08f2e4ad9d0..b9516b94403 100644 +--- a/linux_os/guide/system/bootloader-grub2/uefi/group.yml ++++ b/linux_os/guide/system/bootloader-grub2/uefi/group.yml +@@ -5,9 +5,9 @@ title: 'UEFI GRUB2 bootloader configuration' + description: |- + UEFI GRUB2 bootloader configuration + +-{{%- if grub2_boot_path != grub2_uefi_boot_path -%}} ++{{% if grub2_boot_path != grub2_uefi_boot_path -%}} + platform: uefi +-{{%- endif -%}} ++{{%- endif %}} + + warnings: + - functionality: |- diff --git a/scap-security-guide_0_1_78_fix_wrong_grubmkconfig.patch b/scap-security-guide_0_1_78_fix_wrong_grubmkconfig.patch new file mode 100644 index 0000000..70471c9 --- /dev/null +++ b/scap-security-guide_0_1_78_fix_wrong_grubmkconfig.patch @@ -0,0 +1,101 @@ +From 0e0667783e9901f898af637c00464217654fcf9e Mon Sep 17 00:00:00 2001 +From: vojtapolasek +Date: Fri, 27 Jun 2025 13:53:28 +0200 +Subject: [PATCH] replace instances of grub-mkconfig with correct + grub2-mkconfig + +--- + .../bootloader-grub2/non-uefi/grub2_admin_username/rule.yml | 4 ++-- + .../system/bootloader-grub2/non-uefi/grub2_password/rule.yml | 4 ++-- + .../bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml | 4 ++-- + .../system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml | 4 ++-- + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml +index 20c824cd0b6..53baf2b128a 100644 +--- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml +@@ -23,7 +23,7 @@ description: |- + update the + grub.cfg file by running: + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +@@ -85,7 +85,7 @@ fixtext: |- + Once the superuser account has been added, update the grub.cfg file by running: + + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml +index cf660bff13e..326cfda1a84 100644 +--- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml +@@ -28,7 +28,7 @@ description: |- + update the + grub.cfg file by running: + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +@@ -111,7 +111,7 @@ fixtext: |- + Once the superuser account has been added, update the grub.cfg file by running: + + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml +index ad52e7797e1..451537e032f 100644 +--- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml +@@ -23,7 +23,7 @@ description: |- + update the + grub.cfg file by running: + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +@@ -89,7 +89,7 @@ fixtext: |- + Once the superuser account has been added, update the grub.cfg file by running: + + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml +index 357c2e8defa..0d75ba87338 100644 +--- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml +@@ -28,7 +28,7 @@ description: |- + update the + grub.cfg file by running: + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} +@@ -109,7 +109,7 @@ fixtext: |- + Then, update the grub.cfg file by running: + + {{%- if "rhel" in product %}} +- 
grub-mkconfig -o /boot/grub2/grub.cfg
++ 
grub2-mkconfig -o /boot/grub2/grub.cfg
+ {{%- else %}} + 
{{{ grub_command("update") }}}
+ {{%- endif %}} diff --git a/sources b/sources new file mode 100644 index 0000000..513cdd0 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (scap-security-guide-0.1.77.tar.bz2) = cc3bda1c7e3e40f58407b59d2c7222da7b1d3979f5411a2c12e5f12b73cfff4a71d04b3a51dcc84ca797486aca77ed6091977cb3f067ef3f63dc3d855b059b11