import scap-security-guide-0.1.63-2.el9_0
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
c765dbf87f
commit
9693413bb6
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/scap-security-guide-0.1.60.tar.bz2
|
||||
SOURCES/scap-security-guide-0.1.63.tar.bz2
|
||||
|
||||
@ -1 +1 @@
|
||||
6768818c9bd6f9f35596f2fe23c50ffe52b974c3 SOURCES/scap-security-guide-0.1.60.tar.bz2
|
||||
b77c67caa4f8818e95fa6a4c74adf3173ed8e3d2 SOURCES/scap-security-guide-0.1.63.tar.bz2
|
||||
|
||||
@ -1,24 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
index 9f036f83015..f94ddab2fe1 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
@@ -32,6 +32,7 @@ references:
|
||||
cis@ubuntu2004: 4.1.1.4
|
||||
disa: CCI-001849
|
||||
nist: CM-6(a)
|
||||
+ ospp: FAU_STG.1,FAU_STG.3
|
||||
srg: SRG-OS-000254-GPOS-00095,SRG-OS-000341-GPOS-00132
|
||||
stigid@ol8: OL08-00-030602
|
||||
stigid@rhel8: RHEL-08-030602
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
|
||||
index 6d76e896ffc..7396b9167c6 100644
|
||||
--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
|
||||
@@ -25,6 +25,7 @@ identifiers:
|
||||
|
||||
references:
|
||||
cis@ubuntu2004: 4.1.1.4
|
||||
+ ospp: FAU_STG.1,FAU_STG.3
|
||||
|
||||
ocil_clause: 'audit backlog limit is not configured'
|
||||
|
||||
@ -1,26 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
|
||||
index 5841f378fe6..f4780b4ae6d 100644
|
||||
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
|
||||
@@ -22,7 +22,7 @@ identifiers:
|
||||
references:
|
||||
disa: CCI-000366
|
||||
nist: CM-6
|
||||
- ospp: FAU_GEN.1.1.c
|
||||
+ ospp: FAU_GEN.1
|
||||
srg: SRG-OS-000062-GPOS-00031,SRG-OS-000480-GPOS-00227
|
||||
stigid@ol8: OL08-00-030061
|
||||
stigid@rhel8: RHEL-08-030061
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
|
||||
index ba60b9b2c98..19dc3320e85 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
|
||||
@@ -47,7 +47,7 @@ identifiers:
|
||||
|
||||
references:
|
||||
nist: AU-2(a)
|
||||
- ospp: FAU_GEN.1.1.c
|
||||
+ ospp: FAU_GEN.1
|
||||
srg: SRG-OS-000365-GPOS-00152,SRG-OS-000475-GPOS-00220
|
||||
|
||||
ocil_clause: 'the file does not exist or the content differs'
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
|
||||
index 6c39a05550c..f169cba9f6b 100644
|
||||
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
|
||||
@@ -21,7 +21,7 @@ identifiers:
|
||||
|
||||
references:
|
||||
nist: CM-6
|
||||
- ospp: FAU_GEN.1.1.c
|
||||
+ ospp: FAU_STG.1
|
||||
srg: SRG-OS-000480-GPOS-00227
|
||||
|
||||
ocil_clause: write_logs isn't set to yes
|
||||
@ -1,26 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
|
||||
index 48ed2f31795..b536a68cf2a 100644
|
||||
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
|
||||
@@ -23,7 +23,7 @@ identifiers:
|
||||
references:
|
||||
disa: CCI-000366
|
||||
nist: CM-6,AU-3
|
||||
- ospp: FAU_GEN.1
|
||||
+ ospp: FAU_GEN.1.2
|
||||
srg: SRG-OS-000255-GPOS-00096,SRG-OS-000480-GPOS-00227
|
||||
stigid@ol8: OL08-00-030063
|
||||
stigid@rhel8: RHEL-08-030063
|
||||
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
|
||||
index a31e975c1c9..8da90cd760f 100644
|
||||
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
|
||||
@@ -24,7 +24,7 @@ identifiers:
|
||||
references:
|
||||
disa: CCI-001851
|
||||
nist: CM-6,AU-3
|
||||
- ospp: FAU_GEN.1
|
||||
+ ospp: FAU_GEN.1.2
|
||||
srg: SRG-OS-000039-GPOS-00017,SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
|
||||
stigid@ol7: OL07-00-030211
|
||||
stigid@ol8: OL08-00-030062
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
|
||||
index ac43b654188..70357c153be 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
|
||||
@@ -37,7 +37,7 @@ identifiers:
|
||||
references:
|
||||
disa: CCI-000162
|
||||
nist: AU-2(a)
|
||||
- ospp: FAU_GEN.1.1.c
|
||||
+ ospp: FAU_GEN.1.2
|
||||
srg: SRG-OS-000462-GPOS-00206,SRG-OS-000475-GPOS-00220,SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029
|
||||
stigid@ol8: OL08-00-030122
|
||||
stigid@rhel8: RHEL-08-030122
|
||||
@ -1,12 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
|
||||
index 5af94a56910..7968d90331e 100644
|
||||
--- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
|
||||
+++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
|
||||
@@ -31,6 +31,7 @@ references:
|
||||
iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
|
||||
nist: CM-6(a)
|
||||
nist-csf: PR.PT-1
|
||||
+ ospp: FTP_ITC_EXT.1.1
|
||||
srg: SRG-OS-000479-GPOS-00224,SRG-OS-000051-GPOS-00024,SRG-OS-000480-GPOS-00227
|
||||
stigid@ol8: OL08-00-030670
|
||||
stigid@rhel8: RHEL-08-030670
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
|
||||
index d5d49bf7426..83c6d9339de 100644
|
||||
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
|
||||
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
|
||||
@@ -29,7 +29,7 @@ references:
|
||||
anssi: BP28(R43)
|
||||
ism: 0988,1405
|
||||
nist: AU-9(3),CM-6(a)
|
||||
- ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1
|
||||
+ ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1,FIA_X509_EXT.1.1,FMT_SMF_EXT.1.1
|
||||
srg: SRG-OS-000480-GPOS-00227,SRG-OS-000120-GPOS-00061
|
||||
|
||||
ocil_clause: 'omfwd is not configured with gtls and AuthMode'
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
|
||||
index 635207b571f..818f24718a0 100644
|
||||
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
|
||||
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
|
||||
@@ -27,7 +27,7 @@ identifiers:
|
||||
references:
|
||||
anssi: BP28(R43)
|
||||
ism: 0988,1405
|
||||
- ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1
|
||||
+ ospp: FCS_TLSC_EXT.1
|
||||
srg: SRG-OS-000480-GPOS-00227
|
||||
|
||||
ocil_clause: 'CA certificate for rsyslog remote logging via TLS is not set'
|
||||
@ -1,24 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/package_audit_installed/rule.yml b/linux_os/guide/system/auditing/package_audit_installed/rule.yml
|
||||
index 8b36f0c2fa3..795089c8b83 100644
|
||||
--- a/linux_os/guide/system/auditing/package_audit_installed/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/package_audit_installed/rule.yml
|
||||
@@ -27,6 +27,7 @@ references:
|
||||
nerc-cip: CIP-004-6 R3.3,CIP-007-3 R6.5
|
||||
nist: AC-7(a),AU-7(1),AU-7(2),AU-14,AU-12(2),AU-2(a),CM-6(a)
|
||||
nist@sle12: AU-7(a),AU-7(b),AU-8(b),AU-12.1(iv),AU-12(3),AU-12(c),CM-5(1)
|
||||
+ ospp: FAU_GEN.1
|
||||
srg: SRG-OS-000122-GPOS-00063,SRG-OS-000337-GPOS-00129,SRG-OS-000348-GPOS-00136,SRG-OS-000349-GPOS-00137,SRG-OS-000350-GPOS-00138,SRG-OS-000351-GPOS-00139,SRG-OS-000352-GPOS-00140,SRG-OS-000353-GPOS-00141,SRG-OS-000354-GPOS-00142,SRG-OS-000358-GPOS-00145,SRG-OS-000359-GPOS-00146,SRG-OS-000365-GPOS-00152,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000480-GPOS-00227,SRG-OS-000062-GPOS-00031
|
||||
stigid@ol8: OL08-00-030180
|
||||
stigid@rhel8: RHEL-08-030180
|
||||
diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
|
||||
index 320b69c3179..99edca3e270 100644
|
||||
--- a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
|
||||
@@ -50,6 +50,7 @@ references:
|
||||
nist: AC-2(g),AU-3,AU-10,AU-2(d),AU-12(c),AU-14(1),AC-6(9),CM-6(a),SI-4(23)
|
||||
nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
|
||||
nist@sle12: AU-3,AU-3(1),AU-3(1).1(ii),AU-3.1,AU-6(4),AU-6(4).1,AU-7(1),AU-7(1).1,AU-7(a),AU-14(1),AU-14(1).1,CM-6(b),CM-6.1(iv),MA-4(1)(a)
|
||||
+ ospp: FAU_GEN.1
|
||||
pcidss: Req-10.1
|
||||
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000038-GPOS-00016,SRG-OS-000039-GPOS-00017,SRG-OS-000040-GPOS-00018,SRG-OS-000041-GPOS-00019,SRG-OS-000042-GPOS-00021,SRG-OS-000051-GPOS-00024,SRG-OS-000054-GPOS-00025,SRG-OS-000122-GPOS-00063,SRG-OS-000254-GPOS-00095,SRG-OS-000255-GPOS-00096,SRG-OS-000365-GPOS-00152,SRG-OS-000392-GPOS-00172,SRG-OS-000480-GPOS-00227,SRG-OS-000062-GPOS-00031
|
||||
stigid@ol7: OL07-00-030000
|
||||
@ -1,146 +0,0 @@
|
||||
From 32ecdb4e8ccccf07acd8c6c82a3676ec15647b4a Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 16 Feb 2022 14:02:45 +0100
|
||||
Subject: [PATCH 1/3] add grub2 variant
|
||||
|
||||
---
|
||||
.../rule.yml | 40 +++++++++++++++++++
|
||||
2 files changed, 40 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..3d0c8b95d8a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml
|
||||
@@ -0,0 +1,40 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: rhel9
|
||||
+
|
||||
+title: 'Enable randomization of the page allocator'
|
||||
+
|
||||
+description: |-
|
||||
+ To enable randomization of the page allocator in the kernel, add the
|
||||
+ <tt>page_alloc.shuffle=1</tt> argument to the default GRUB 2 command line.
|
||||
+ {{{ describe_grub2_argument("page_alloc.shuffle=1") | indent(4) }}}
|
||||
+
|
||||
+rationale: |-
|
||||
+ The <tt>CONFIG_SHUFFLE_PAGE_ALLOCATOR</tt> config option is primarily
|
||||
+ focused on improving the average utilization of a direct-mapped
|
||||
+ memory-side-cache. Aside of this performance effect, it also reduces
|
||||
+ predictability of page allocations in situations when the bad actor can
|
||||
+ crash the system and somehow leverage knowledge of (page) allocation order
|
||||
+ right after a fresh reboot, or can control the timing between a
|
||||
+ hot-pluggable memory node (as in NUMA node) and applications allocating
|
||||
+ memory ouf of that node. The <tt>page_alloc.shuffle=1</tt> kernel command
|
||||
+ line parameter then forces this functionality irrespectively of memory cache
|
||||
+ architecture.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-85879-5
|
||||
+
|
||||
+ocil_clause: 'randomization of the page allocator is not enabled in the kernel'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_grub2_argument("page_alloc.shuffle=1") | indent(4) }}}
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: grub2_bootloader_argument
|
||||
+ vars:
|
||||
+ arg_name: page_alloc.shuffle
|
||||
+ arg_value: '1'
|
||||
|
||||
From ccd4bee3bec201cdee883c662056fc408b2d88ad Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 16 Feb 2022 14:20:59 +0100
|
||||
Subject: [PATCH 2/3] add zipl variant
|
||||
|
||||
---
|
||||
.../zipl_page_alloc_shuffle_argument/rule.yml | 46 +++++++++++++++++++
|
||||
2 files changed, 46 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..5179b19fcc0
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml
|
||||
@@ -0,0 +1,46 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: rhel9
|
||||
+
|
||||
+title: 'Enable randomization of the page allocator in zIPL'
|
||||
+
|
||||
+description: |-
|
||||
+ To enable the randomization of the page allocator in the kernel, check that
|
||||
+ all boot entries in <tt>/boot/loader/entries/*.conf</tt> have
|
||||
+ <tt>page_alloc.shuffle=1</tt> included in its options.<br />
|
||||
+
|
||||
+ To enable randomization of the page allocator also for newly installed
|
||||
+ kernels, add <tt>page_alloc.shuffle=1</tt> to <tt>/etc/kernel/cmdline</tt>.
|
||||
+
|
||||
+rationale: |-
|
||||
+ The <tt>CONFIG_SHUFFLE_PAGE_ALLOCATOR</tt> config option is primarily
|
||||
+ focused on improving the average utilization of a direct-mapped
|
||||
+ memory-side-cache. Aside of this performance effect, it also reduces
|
||||
+ predictability of page allocations in situations when the bad actor can
|
||||
+ crash the system and somehow leverage knowledge of (page) allocation order
|
||||
+ right after a fresh reboot, or can control the timing between a
|
||||
+ hot-pluggable memory node (as in NUMA node) and applications allocating
|
||||
+ memory ouf of that node. The <tt>page_alloc.shuffle=1</tt> kernel command
|
||||
+ line parameter then forces this functionality irrespectively of memory cache
|
||||
+ architecture.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-85880-3
|
||||
+
|
||||
+ocil_clause: 'randomization of the page allocator is not enabled in the kernel'
|
||||
+
|
||||
+ocil: |-
|
||||
+ To check that the randomization of the page allocator in the kernel is
|
||||
+ enabled, check all boot entries with following command:
|
||||
+ <pre>sudo grep -L"^options\s+.*\bpage_alloc\.shuffle=1\b" /boot/loader/entries/*.conf</pre>
|
||||
+ No line should be returned, each line returned is a boot entry that doesn't enable audit.
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: zipl_bls_entries_option
|
||||
+ vars:
|
||||
+ arg_name: page_alloc.shuffle
|
||||
+ arg_value: '1'
|
||||
|
||||
From 89671b0a5a69ccaf0a46ff1fc86db82fc822dda0 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 16 Feb 2022 14:24:32 +0100
|
||||
Subject: [PATCH 3/3] add rules to rhel9 ospp profile
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index f25abd7e4c4..4bdf8d98b97 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -126,6 +126,7 @@ selections:
|
||||
- grub2_audit_backlog_limit_argument
|
||||
- grub2_vsyscall_argument
|
||||
- grub2_init_on_alloc_argument
|
||||
+ - grub2_page_alloc_shuffle_argument
|
||||
|
||||
## Security Settings
|
||||
- sysctl_kernel_kptr_restrict
|
||||
@@ -409,3 +410,4 @@ selections:
|
||||
- zipl_audit_backlog_limit_argument
|
||||
- zipl_vsyscall_argument
|
||||
- zipl_init_on_alloc_argument
|
||||
+ - zipl_page_alloc_shuffle_argument
|
||||
@ -1,165 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
||||
index 8a28af022a7..02c69bddd27 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_all
|
||||
# reboot = false
|
||||
# strategy = restrict
|
||||
# complexity = high
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
index a7182849548..db89a5e47a1 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
@@ -31,6 +31,8 @@ rationale: |-
|
||||
of initiating changes, including upgrades and modifications.
|
||||
|
||||
identifiers:
|
||||
+ cce@rhel8: CCE-88692-9
|
||||
+ cce@rhel9: CCE-88693-7
|
||||
cce@sle12: CCE-83234-5
|
||||
cce@sle15: CCE-85753-2
|
||||
|
||||
@@ -40,6 +42,8 @@ references:
|
||||
disa: CCI-001499
|
||||
nerc-cip: CIP-003-8 R6
|
||||
nist: CM-5,CM-5(6),CM-5(6).1
|
||||
+ srg: SRG-OS-000259-GPOS-00100
|
||||
+ stigid@rhel8: RHEL-08-010331
|
||||
stigid@sle12: SLES-12-010872
|
||||
stigid@sle15: SLES-15-010352
|
||||
stigid@ubuntu2004: UBTU-20-010427
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
index af078463b05..6e957c302ac 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
find "$dirPath" -perm /022 -type d -exec chmod go-w '{}' \;
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
index d58616bcafb..55ff9cebd4f 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
chmod -R 755 "$dirPath"
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
index 98d18cde3ea..c2b5b6bf029 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
||||
DIRS="/lib /lib64"
|
||||
for dirPath in $DIRS; do
|
||||
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
index 6df6e2f8f9b..40e6c42c829 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
||||
DIRS="/usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
||||
diff --git a/products/rhel8/profiles/cjis.profile b/products/rhel8/profiles/cjis.profile
|
||||
index decba0087e8..920a55659fd 100644
|
||||
--- a/products/rhel8/profiles/cjis.profile
|
||||
+++ b/products/rhel8/profiles/cjis.profile
|
||||
@@ -77,6 +77,7 @@ selections:
|
||||
- accounts_password_pam_difok
|
||||
- accounts_max_concurrent_login_sessions
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- file_owner_etc_shadow
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 04f158116ee..5d98b1c894e 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -228,6 +228,9 @@ selections:
|
||||
# RHEL-08-010330
|
||||
- file_permissions_library_dirs
|
||||
|
||||
+ # RHEL-08-010331
|
||||
+ - dir_permissions_library_dirs
|
||||
+
|
||||
# RHEL-08-010340
|
||||
- file_ownership_library_dirs
|
||||
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 8f79b22e3e4..2614504e9cd 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -229,6 +229,9 @@ selections:
|
||||
# RHEL-08-010330
|
||||
- file_permissions_library_dirs
|
||||
|
||||
+ # RHEL-08-010331
|
||||
+ - dir_permissions_library_dirs
|
||||
+
|
||||
# RHEL-08-010340
|
||||
- file_ownership_library_dirs
|
||||
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 3f6ec5e17c4..4a926bce5de 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -2645,8 +2645,6 @@ CCE-88688-7
|
||||
CCE-88689-5
|
||||
CCE-88690-3
|
||||
CCE-88691-1
|
||||
-CCE-88692-9
|
||||
-CCE-88693-7
|
||||
CCE-88694-5
|
||||
CCE-88695-2
|
||||
CCE-88696-0
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index ed739e724f4..4df5c4a2e21 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -25,6 +25,7 @@ extends: null
|
||||
metadata:
|
||||
version: V1R4
|
||||
SMEs:
|
||||
+ - mab879
|
||||
- ggbecker
|
||||
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
||||
selections:
|
||||
@@ -180,6 +181,7 @@ selections:
|
||||
- dconf_gnome_screensaver_idle_delay
|
||||
- dconf_gnome_screensaver_lock_enabled
|
||||
- dir_group_ownership_library_dirs
|
||||
+- dir_permissions_library_dirs
|
||||
- dir_perms_world_writable_root_owned
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
- directory_group_ownership_var_log_audit
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 56c3fcb9f59..98746158aed 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -36,6 +36,7 @@ extends: null
|
||||
metadata:
|
||||
version: V1R4
|
||||
SMEs:
|
||||
+ - mab879
|
||||
- ggbecker
|
||||
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
||||
selections:
|
||||
@@ -191,6 +192,7 @@ selections:
|
||||
- dconf_gnome_screensaver_idle_delay
|
||||
- dconf_gnome_screensaver_lock_enabled
|
||||
- dir_group_ownership_library_dirs
|
||||
+- dir_permissions_library_dirs
|
||||
- dir_perms_world_writable_root_owned
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
- directory_group_ownership_var_log_audit
|
||||
@ -1,57 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
|
||||
index 68b353965ec..ff106996f00 100644
|
||||
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
|
||||
@@ -28,7 +28,7 @@ references:
|
||||
cis@ubuntu2004: 1.4.1
|
||||
cjis: 5.10.1.3
|
||||
cobit5: APO01.06,BAI01.06,BAI02.01,BAI03.05,BAI06.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS03.05,DSS04.07,DSS05.02,DSS05.03,DSS05.05,DSS05.07,DSS06.02,DSS06.06
|
||||
- disa: CCI-002699,CCI-001744
|
||||
+ disa: CCI-002696,CCI-002699,CCI-001744
|
||||
isa-62443-2009: 4.3.4.3.2,4.3.4.3.3,4.3.4.4.4
|
||||
isa-62443-2013: 'SR 3.1,SR 3.3,SR 3.4,SR 3.8,SR 4.1,SR 6.2,SR 7.6'
|
||||
ism: 1034,1288,1341,1417
|
||||
@@ -36,9 +36,9 @@ references:
|
||||
nist: CM-6(a)
|
||||
nist-csf: DE.CM-1,DE.CM-7,PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1,PR.IP-3
|
||||
pcidss: Req-11.5
|
||||
- srg: SRG-OS-000363-GPOS-00150
|
||||
+ srg: SRG-OS-000363-GPOS-00150,SRG-OS-000445-GPOS-00199
|
||||
stigid@ol8: OL08-00-010360
|
||||
- stigid@rhel8: RHEL-08-010360
|
||||
+ stigid@rhel8: RHEL-08-010359
|
||||
stigid@sle12: SLES-12-010500
|
||||
stigid@sle15: SLES-15-010420
|
||||
stigid@ubuntu2004: UBTU-20-010450
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index ff23f83cfbf..cb72403e81a 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -239,8 +239,10 @@ selections:
|
||||
- root_permissions_syslibrary_files
|
||||
- dir_group_ownership_library_dirs
|
||||
|
||||
- # RHEL-08-010360
|
||||
+ # RHEL-08-010359
|
||||
- package_aide_installed
|
||||
+
|
||||
+ # RHEL-08-010360
|
||||
- aide_scan_notification
|
||||
|
||||
# RHEL-08-010370
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 31015d4b83c..93ecc404dc2 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -240,8 +240,10 @@ selections:
|
||||
- root_permissions_syslibrary_files
|
||||
- dir_group_ownership_library_dirs
|
||||
|
||||
- # RHEL-08-010360
|
||||
+ # RHEL-08-010359
|
||||
- package_aide_installed
|
||||
+
|
||||
+ # RHEL-08-010360
|
||||
- aide_scan_notification
|
||||
|
||||
# RHEL-08-010370
|
||||
@ -1,596 +0,0 @@
|
||||
From 19bd5adfd804590b15e42cc75287b792706286d5 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Thu, 10 Feb 2022 15:25:06 +0100
|
||||
Subject: [PATCH 1/9] Add rule to check for default sudoers includedir
|
||||
|
||||
This rule supports RHEL-08-010379.
|
||||
---
|
||||
.../ansible/shared.yml | 7 ++++
|
||||
.../sudoers_default_includedir/bash/shared.sh | 11 ++++++
|
||||
.../oval/shared.xml | 23 +++++++++++
|
||||
.../sudo/sudoers_default_includedir/rule.yml | 38 +++++++++++++++++++
|
||||
.../tests/default_includedir.pass.sh | 7 ++++
|
||||
.../tests/duplicate_includedir.fail.sh | 7 ++++
|
||||
.../tests/no_includedir.fail.sh | 4 ++
|
||||
.../tests/two_includedir.fail.sh | 8 ++++
|
||||
shared/references/cce-redhat-avail.txt | 3 --
|
||||
9 files changed, 105 insertions(+), 3 deletions(-)
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
new file mode 100644
|
||||
index 00000000000..d9d5933285f
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
@@ -0,0 +1,7 @@
|
||||
+# platform = multi_platform_all
|
||||
+# # reboot = false
|
||||
+# # strategy = configure
|
||||
+# # complexity = low
|
||||
+# # disruption = low
|
||||
+
|
||||
+{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..3a9e2da985b
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+sudoers_config_file="/etc/sudoers"
|
||||
+sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
|
||||
+if [ "$sudoers_includedir_count" -gt 1 ]; then
|
||||
+ sed -i "/#includedir.*/d" "$sudoers_config_file"
|
||||
+ echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
|
||||
+fi
|
||||
+if [ "$sudoers_includedir_count" -eq 0 ]; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..5618c64291c
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
@@ -0,0 +1,23 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
||||
+ {{{ oval_metadata("Check if sudo includes only the default includedir") }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists"
|
||||
+ comment="audit augenrules rmmod" id="test_sudoers_default_includedir" version="1">
|
||||
+ <ind:object object_ref="object_sudoers_default_includedir" />
|
||||
+ <ind:state state_ref="state_sudoers_default_includedir" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object id="object_sudoers_default_includedir" version="1">
|
||||
+ <ind:filepath>/etc/sudoers</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^#includedir[\s]+(.*)$</ind:pattern>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+ <ind:textfilecontent54_state id="state_sudoers_default_includedir" version="1">
|
||||
+ <ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
|
||||
+ </ind:textfilecontent54_state>
|
||||
+
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..5c33121f911
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
@@ -0,0 +1,38 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,rhel7,rhel8,rhel9
|
||||
+
|
||||
+title: 'Ensure sudo only includes the default configuration directory'
|
||||
+
|
||||
+description: |-
|
||||
+ Administrators can configure authorized <tt>sudo</tt> users via drop-in files, and it is possible to include
|
||||
+ other directories and configuration files from the file currently being parsed.
|
||||
+
|
||||
+ Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>.
|
||||
+ The <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
|
||||
+ <tt>/etc/sudoers.d</tt>
|
||||
+ Note that the '#' character doesn't denote a comment in the configuration file.
|
||||
+
|
||||
+rationale: |-
|
||||
+ Some <tt>sudo</tt> configurtion options allow users to run programs without re-authenticating.
|
||||
+ Use of these configuration options makes it easier for one compromised accound to be used to
|
||||
+ compromise other accounts.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel7: CCE-86277-1
|
||||
+ cce@rhel8: CCE-86377-9
|
||||
+ cce@rhel9: CCE-86477-7
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-000366
|
||||
+ stigid@rhel8: RHEL-08-010379
|
||||
+
|
||||
+ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other directories?"
|
||||
+
|
||||
+ocil: |-
|
||||
+ To determine whether <tt>sudo</tt> command includes configuration files from the appropriate directory,
|
||||
+ run the following command:
|
||||
+ <pre>$ sudo grep 'include' /etc/sudoers</pre>
|
||||
+ If only the line <tt>#includedir /etc/sudoers> is returned, then the drop-in file configuration is set correctly.
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..ac0c808ccd6
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# Ensure default config is there
|
||||
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..5bad8225625
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# duplicate default entry
|
||||
+if grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..1e0ab8aea92
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
|
||||
@@ -0,0 +1,4 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+sed -i "/#includedir.*/d" /etc/sudoers
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..09d14eab630
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# Ensure that there are two different indludedirs
|
||||
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
+echo "#includedir /opt/extra_config.d" >> /etc/sudoers
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 41caad9f0d0..f2990adb537 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -340,7 +340,6 @@ CCE-86273-0
|
||||
CCE-86274-8
|
||||
CCE-86275-5
|
||||
CCE-86276-3
|
||||
-CCE-86277-1
|
||||
CCE-86278-9
|
||||
CCE-86279-7
|
||||
CCE-86281-3
|
||||
@@ -428,7 +427,6 @@ CCE-86373-8
|
||||
CCE-86374-6
|
||||
CCE-86375-3
|
||||
CCE-86376-1
|
||||
-CCE-86377-9
|
||||
CCE-86378-7
|
||||
CCE-86379-5
|
||||
CCE-86380-3
|
||||
@@ -524,7 +522,6 @@ CCE-86473-6
|
||||
CCE-86474-4
|
||||
CCE-86475-1
|
||||
CCE-86476-9
|
||||
-CCE-86477-7
|
||||
CCE-86478-5
|
||||
CCE-86479-3
|
||||
CCE-86480-1
|
||||
|
||||
From 99fe46922243e8dff5822e2ed6eb49addd000baa Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Thu, 10 Feb 2022 16:21:46 +0100
|
||||
Subject: [PATCH 2/9] Select rule in RHEL8 STIG
|
||||
|
||||
Select sudoers_default_indludedir aligning to RHEL8 STIG V1R5
|
||||
---
|
||||
products/rhel8/profiles/stig.profile | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index d92bc72971c..e13bda7a787 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -271,6 +271,9 @@ selections:
|
||||
# RHEL-08-010376
|
||||
- sysctl_kernel_perf_event_paranoid
|
||||
|
||||
+ # RHEL-08-010379
|
||||
+ - sudoers_default_includedir
|
||||
+
|
||||
# RHEL-08-010380
|
||||
- sudo_remove_nopasswd
|
||||
|
||||
|
||||
From 3686fe72a6e27049f1c46d0a4efa07e1b42b6a20 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Thu, 10 Feb 2022 17:26:59 +0100
|
||||
Subject: [PATCH 3/9] Add test and fix for case when the single includedir is
|
||||
wrong
|
||||
|
||||
---
|
||||
.../sudo/sudoers_default_includedir/bash/shared.sh | 7 +++++--
|
||||
.../tests/wrong_includedir.fail.sh | 5 +++++
|
||||
2 files changed, 10 insertions(+), 2 deletions(-)
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
index 3a9e2da985b..258af02c121 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
@@ -5,7 +5,10 @@ sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
|
||||
if [ "$sudoers_includedir_count" -gt 1 ]; then
|
||||
sed -i "/#includedir.*/d" "$sudoers_config_file"
|
||||
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
|
||||
-fi
|
||||
-if [ "$sudoers_includedir_count" -eq 0 ]; then
|
||||
+elif [ "$sudoers_includedir_count" -eq 0 ]; then
|
||||
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
|
||||
+else
|
||||
+ if ! grep -q "^#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" /etc/sudoers
|
||||
+ fi
|
||||
fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..55a072adf3c
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
|
||||
@@ -0,0 +1,5 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+sed -i "/#includedir.*/d" /etc/sudoers
|
||||
+echo "#includedir /opt/extra_config.d" >> /etc/sudoers
|
||||
|
||||
From 0b20b495ed82cead1a033170b900c13da5260603 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 14:50:11 +0100
|
||||
Subject: [PATCH 4/9] Add tests for sudo file and dir includes in
|
||||
/etc/sudoers.d
|
||||
|
||||
---
|
||||
.../tests/sudoers.d_with_include.fail.sh | 9 +++++++++
|
||||
.../tests/sudoers.d_with_includedir.fail.sh | 9 +++++++++
|
||||
.../tests/sudoers_with_include.fail.sh | 11 +++++++++++
|
||||
3 files changed, 29 insertions(+)
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..554ef2e060d
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# Ensure default config is there
|
||||
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
+
|
||||
+echo "#include /etc/my-sudoers" > /etc/sudoers.d/my-sudoers
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..516b68b5a3e
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# Ensure default config is there
|
||||
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
+
|
||||
+echo "#includedir /etc/my-sudoers.d" > /etc/sudoers.d/my-sudoers
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..ad04880e334
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_all
|
||||
+
|
||||
+# Ensure default config is there
|
||||
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
+fi
|
||||
+
|
||||
+if ! grep -q "#include " /etc/sudoers; then
|
||||
+ echo "#include /etc/my-sudoers" >> /etc/sudoers
|
||||
+fi
|
||||
|
||||
From d91e3eefe6c265c27634cb15b0f276a298f81645 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 14:59:18 +0100
|
||||
Subject: [PATCH 5/9] Update rule catch and remove other sudo includes
|
||||
|
||||
Any other #include or #includedir besides:
|
||||
"/etc/sudoers: #includedir /etc/sudoers.d" should be removed.
|
||||
---
|
||||
.../ansible/shared.yml | 14 +++++++++++
|
||||
.../sudoers_default_includedir/bash/shared.sh | 7 ++++--
|
||||
.../oval/shared.xml | 23 +++++++++++++++++++
|
||||
.../sudo/sudoers_default_includedir/rule.yml | 7 +++---
|
||||
4 files changed, 46 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
index d9d5933285f..175a447e0d9 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
@@ -5,3 +5,17 @@
|
||||
# # disruption = low
|
||||
|
||||
{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
|
||||
+{{{ ansible_lineinfile(msg='Ensure sudoers doesn\'t include other non-default file', regex='^#include[\s]+.*$', path='/etc/sudoers', state='absent') }}}
|
||||
+- name: "Find out if /etc/sudoers.d/* files contain file or directory includes"
|
||||
+ find:
|
||||
+ path: "/etc/sudoers.d"
|
||||
+ patterns: "*"
|
||||
+ contains: '^#include(dir)?\s.*$'
|
||||
+ register: sudoers_d_includes
|
||||
+
|
||||
+- name: "Remove found occurrences of file and directory inclues from /etc/sudoers.d/* files"
|
||||
+ lineinfile:
|
||||
+ path: "{{ item.path }}"
|
||||
+ regexp: '^#include(dir)?\s.*$'
|
||||
+ state: absent
|
||||
+ with_items: "{{ sudoers_d_includes.files }}"
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
index 258af02c121..2d00b471677 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
@@ -1,6 +1,7 @@
|
||||
# platform = multi_platform_all
|
||||
|
||||
sudoers_config_file="/etc/sudoers"
|
||||
+sudoers_config_dir="/etc/sudoers.d"
|
||||
sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
|
||||
if [ "$sudoers_includedir_count" -gt 1 ]; then
|
||||
sed -i "/#includedir.*/d" "$sudoers_config_file"
|
||||
@@ -8,7 +9,9 @@ if [ "$sudoers_includedir_count" -gt 1 ]; then
|
||||
elif [ "$sudoers_includedir_count" -eq 0 ]; then
|
||||
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
|
||||
else
|
||||
- if ! grep -q "^#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
- sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" /etc/sudoers
|
||||
+ if ! grep -q "^#includedir /etc/sudoers.d" "$sudoers_config_file"; then
|
||||
+ sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" "$sudoers_config_file"
|
||||
fi
|
||||
fi
|
||||
+sed -i "/^#include\s\+.*/d" "$sudoers_config_file" "${sudoers_config_dir}"/*
|
||||
+sed -i "/^#includedir\s\+.*/d" "${sudoers_config_dir}"/*
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
index 5618c64291c..59cab0b89de 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
|
||||
@@ -3,6 +3,8 @@
|
||||
{{{ oval_metadata("Check if sudo includes only the default includedir") }}}
|
||||
<criteria operator="AND">
|
||||
<criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
|
||||
+ <criterion comment="Check /etc/sudoers for #include" test_ref="test_sudoers_without_include" />
|
||||
+ <criterion comment="Check /etc/sudoers.d for includes" test_ref="test_sudoersd_without_includes" />
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
@@ -20,4 +22,25 @@
|
||||
<ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
|
||||
</ind:textfilecontent54_state>
|
||||
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
|
||||
+ comment="audit augenrules rmmod" id="test_sudoers_without_include" version="1">
|
||||
+ <ind:object object_ref="object_sudoers_without_include" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object id="object_sudoers_without_include" version="1">
|
||||
+ <ind:filepath>/etc/sudoers</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^#include[\s]+.*$</ind:pattern>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
|
||||
+ comment="audit augenrules rmmod" id="test_sudoersd_without_includes" version="1">
|
||||
+ <ind:object object_ref="object_sudoersd_without_includes" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object id="object_sudoersd_without_includes" version="1">
|
||||
+ <ind:path>/etc/sudoers.d/</ind:path>
|
||||
+ <ind:filename operation="pattern match">.*</ind:filename>
|
||||
+ <ind:pattern operation="pattern match">^#include(dir)?[\s]+.*$</ind:pattern>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
</def-group>
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
index 5c33121f911..3a8c22ac8af 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
@@ -10,7 +10,7 @@ description: |-
|
||||
|
||||
Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>.
|
||||
The <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
|
||||
- <tt>/etc/sudoers.d</tt>
|
||||
+ <tt>/etc/sudoers.d</tt>, and no file in <tt>/etc/sudoers.d/</tt> should include other files or directories.
|
||||
Note that the '#' character doesn't denote a comment in the configuration file.
|
||||
|
||||
rationale: |-
|
||||
@@ -34,5 +34,6 @@ ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other
|
||||
ocil: |-
|
||||
To determine whether <tt>sudo</tt> command includes configuration files from the appropriate directory,
|
||||
run the following command:
|
||||
- <pre>$ sudo grep 'include' /etc/sudoers</pre>
|
||||
- If only the line <tt>#includedir /etc/sudoers> is returned, then the drop-in file configuration is set correctly.
|
||||
+ <pre>$ sudo grep -rP '^#include(dir)?' /etc/sudoers /etc/sudoers.d</pre>
|
||||
+ If only the line <tt>/etc/sudoers:#includedir /etc/sudoers.d</tt> is returned, then the drop-in include configuration is set correctly.
|
||||
+ Any other line returned is a finding.
|
||||
|
||||
From ead72b744f1fc03893184079c079df27780044c2 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 15:00:46 +0100
|
||||
Subject: [PATCH 6/9] Add SRG to sudoers_default_includedir
|
||||
|
||||
---
|
||||
.../system/software/sudo/sudoers_default_includedir/rule.yml | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
index 3a8c22ac8af..a97bd3efb2c 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
|
||||
@@ -27,6 +27,7 @@ identifiers:
|
||||
|
||||
references:
|
||||
disa: CCI-000366
|
||||
+ srg: SRG-OS-000480-GPOS-00227
|
||||
stigid@rhel8: RHEL-08-010379
|
||||
|
||||
ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other directories?"
|
||||
|
||||
From c1a08fe6b8e6388b89b190ca74e57af06e7c999c Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 16:12:32 +0100
|
||||
Subject: [PATCH 7/9] Update RHEL8 STIG profile stability data
|
||||
|
||||
---
|
||||
tests/data/profile_stability/rhel8/stig.profile | 1 +
|
||||
tests/data/profile_stability/rhel8/stig_gui.profile | 1 +
|
||||
2 files changed, 2 insertions(+)
|
||||
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index e4fee44f9f9..974b28757e9 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -365,6 +365,7 @@ selections:
|
||||
- sudo_remove_nopasswd
|
||||
- sudo_require_reauthentication
|
||||
- sudo_restrict_privilege_elevation_to_authorized
|
||||
+- sudoers_default_includedir
|
||||
- sudoers_validate_passwd
|
||||
- sysctl_crypto_fips_enabled
|
||||
- sysctl_fs_protected_hardlinks
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 83d04775e3a..99e0af4f5a6 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -376,6 +376,7 @@ selections:
|
||||
- sudo_remove_nopasswd
|
||||
- sudo_require_reauthentication
|
||||
- sudo_restrict_privilege_elevation_to_authorized
|
||||
+- sudoers_default_includedir
|
||||
- sudoers_validate_passwd
|
||||
- sysctl_crypto_fips_enabled
|
||||
- sysctl_fs_protected_hardlinks
|
||||
|
||||
From adae3ecbda4362e23cd1f30e053db37d6a1d403b Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 16:59:22 +0100
|
||||
Subject: [PATCH 8/9] Fix Ansible remediation metadata
|
||||
|
||||
---
|
||||
.../sudo/sudoers_default_includedir/ansible/shared.yml | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
index 175a447e0d9..0d8c9e75184 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
|
||||
@@ -1,8 +1,8 @@
|
||||
# platform = multi_platform_all
|
||||
-# # reboot = false
|
||||
-# # strategy = configure
|
||||
-# # complexity = low
|
||||
-# # disruption = low
|
||||
+# reboot = false
|
||||
+# strategy = configure
|
||||
+# complexity = low
|
||||
+# disruption = low
|
||||
|
||||
{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
|
||||
{{{ ansible_lineinfile(msg='Ensure sudoers doesn\'t include other non-default file', regex='^#include[\s]+.*$', path='/etc/sudoers', state='absent') }}}
|
||||
|
||||
From d3f048456908b316c0dcc0bff2328cf87fe6e7de Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 17:39:39 +0100
|
||||
Subject: [PATCH 9/9] Handle case when /etc/sudoers.d doesn't exist
|
||||
|
||||
The remediation skips the directory, and the test scenarios create the
|
||||
dir to ensure the test scenario works.
|
||||
---
|
||||
.../sudo/sudoers_default_includedir/bash/shared.sh | 8 ++++++--
|
||||
.../tests/sudoers.d_with_include.fail.sh | 1 +
|
||||
.../tests/sudoers.d_with_includedir.fail.sh | 1 +
|
||||
3 files changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
index 2d00b471677..fbff5eb6f30 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
|
||||
@@ -13,5 +13,9 @@ else
|
||||
sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" "$sudoers_config_file"
|
||||
fi
|
||||
fi
|
||||
-sed -i "/^#include\s\+.*/d" "$sudoers_config_file" "${sudoers_config_dir}"/*
|
||||
-sed -i "/^#includedir\s\+.*/d" "${sudoers_config_dir}"/*
|
||||
+
|
||||
+sed -i "/^#include\s\+.*/d" "$sudoers_config_file"
|
||||
+
|
||||
+if grep -Pr "^#include(dir)? .*" "$sudoers_config_dir" ; then
|
||||
+ sed -i "/^#include\(dir\)\?\s\+.*/d" "$sudoers_config_dir"/*
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
index 554ef2e060d..3f14ecc1627 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
|
||||
@@ -1,6 +1,7 @@
|
||||
#!/bin/bash
|
||||
# platform = multi_platform_all
|
||||
|
||||
+mkdir -p /etc/sudoers.d
|
||||
# Ensure default config is there
|
||||
if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
index 516b68b5a3e..89515076ff1 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
|
||||
@@ -1,6 +1,7 @@
|
||||
#!/bin/bash
|
||||
# platform = multi_platform_all
|
||||
|
||||
+mkdir -p /etc/sudoers.d
|
||||
# Ensure default config is there
|
||||
if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
|
||||
echo "#includedir /etc/sudoers.d" >> /etc/sudoers
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
||||
index 5353f60975c..69a36c4959a 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
||||
@@ -43,7 +43,7 @@ references:
|
||||
stigid@ol7: OL07-00-010270
|
||||
stigid@ol8: OL08-00-020220
|
||||
stigid@rhel7: RHEL-07-010270
|
||||
- stigid@rhel8: RHEL-08-020220
|
||||
+ stigid@rhel8: RHEL-08-020221
|
||||
vmmsrg: SRG-OS-000077-VMM-000440
|
||||
|
||||
ocil_clause: |-
|
||||
@ -1,49 +0,0 @@
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
|
||||
index de0e359a44e..df56a30be80 100644
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
|
||||
@@ -39,6 +39,7 @@ references:
|
||||
nist: CM-7(a),CM-7(b),CM-6(a)
|
||||
nist-csf: PR.AC-3,PR.PT-4
|
||||
srg: SRG-OS-000480-GPOS-00227
|
||||
+ stigid@rhel8: RHEL-08-040321
|
||||
|
||||
ocil_clause: 'the X windows display server is running and/or has not been disabled'
|
||||
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 09fa85df181..ffca983d0bd 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -1169,6 +1169,9 @@ selections:
|
||||
# RHEL-08-040320
|
||||
- xwindows_remove_packages
|
||||
|
||||
+ # RHEL-08-040321
|
||||
+ - xwindows_runlevel_target
|
||||
+
|
||||
# RHEL-08-040330
|
||||
- network_sniffer_disabled
|
||||
|
||||
diff --git a/products/rhel8/profiles/stig_gui.profile b/products/rhel8/profiles/stig_gui.profile
|
||||
index d1577215b07..d29ceb9c54e 100644
|
||||
--- a/products/rhel8/profiles/stig_gui.profile
|
||||
+++ b/products/rhel8/profiles/stig_gui.profile
|
||||
@@ -35,3 +35,6 @@ extends: stig
|
||||
selections:
|
||||
# RHEL-08-040320
|
||||
- '!xwindows_remove_packages'
|
||||
+
|
||||
+ # RHEL-08-040321
|
||||
+ - '!xwindows_runlevel_target'
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index 9c05c27117c..e4fee44f9f9 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -398,6 +398,7 @@ selections:
|
||||
- usbguard_generate_policy
|
||||
- wireless_disable_interfaces
|
||||
- xwindows_remove_packages
|
||||
+- xwindows_runlevel_target
|
||||
- var_rekey_limit_size=1G
|
||||
- var_rekey_limit_time=1hour
|
||||
- var_accounts_user_umask=077
|
||||
@ -1,38 +0,0 @@
|
||||
From 8605b236665b1022c7379e87d9445c9ca42e78f3 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 11:41:15 +0100
|
||||
Subject: [PATCH] Add SRG references to STIG rules.
|
||||
|
||||
Rules accounts_password_pam_pwquality_password_auth and accounts_password_pam_pwquality_system_auth
|
||||
were missing SRG required references.
|
||||
---
|
||||
.../accounts_password_pam_pwquality_password_auth/rule.yml | 2 ++
|
||||
.../accounts_password_pam_pwquality_system_auth/rule.yml | 2 ++
|
||||
2 files changed, 4 insertions(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
|
||||
index 6c7bb1ad7a0..34dd6e2fcca 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
|
||||
@@ -22,6 +22,8 @@ identifiers:
|
||||
cce@rhel9: CCE-85878-7
|
||||
|
||||
references:
|
||||
+ disa: CCI-000366
|
||||
+ srg: SRG-OS-000480-GPOS-00227
|
||||
stigid@rhel8: RHEL-08-020100
|
||||
|
||||
ocil_clause: 'pam_pwquality.so is not enabled in password-auth'
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
|
||||
index ea42ff9b07a..a5189c61608 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
|
||||
@@ -22,6 +22,8 @@ identifiers:
|
||||
cce@rhel9: CCE-85873-8
|
||||
|
||||
references:
|
||||
+ disa: CCI-000366
|
||||
+ srg: SRG-OS-000480-GPOS-00227
|
||||
stigid@rhel8: RHEL-08-020101
|
||||
|
||||
ocil_clause: 'pam_pwquality.so is not enabled in system-auth'
|
||||
@ -1,369 +0,0 @@
|
||||
From bbafe0a7b4b9eb50bc622d9f9f3c0074fca932f9 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 16:17:52 +0100
|
||||
Subject: [PATCH 1/2] Pass the rule when no time server nor pool is set
|
||||
|
||||
If no time server or pool is configured, there is no entry to add
|
||||
maxpoll option to, so the rule should evaluate to pass.
|
||||
---
|
||||
.../oval/shared.xml | 50 +++++++++++++++----
|
||||
.../ntp/chronyd_or_ntpd_set_maxpoll/rule.yml | 2 +
|
||||
.../tests/chrony_no_pool_nor_servers.pass.sh | 12 +++++
|
||||
3 files changed, 54 insertions(+), 10 deletions(-)
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
|
||||
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
|
||||
index 780c2e2d0ba..76f810123f3 100644
|
||||
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
|
||||
@@ -3,17 +3,25 @@
|
||||
{{{ oval_metadata("Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
|
||||
to continuously poll the time source servers.") }}}
|
||||
<criteria operator="OR">
|
||||
- <criteria operator="AND">
|
||||
- <criterion comment="check if maxpoll is set in /etc/ntp.conf"
|
||||
- test_ref="test_ntp_set_maxpoll" />
|
||||
- <criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf"
|
||||
- test_ref="test_ntp_all_server_has_maxpoll"/>
|
||||
+ <criteria operator="OR">
|
||||
+ <criterion comment="check if no server or pool entry is set in /etc/chrony.conf"
|
||||
+ test_ref="test_ntp_no_server"/>
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion comment="check if maxpoll is set in /etc/ntp.conf"
|
||||
+ test_ref="test_ntp_set_maxpoll" />
|
||||
+ <criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf"
|
||||
+ test_ref="test_ntp_all_server_has_maxpoll"/>
|
||||
+ </criteria>
|
||||
</criteria>
|
||||
- <criteria operator="AND">
|
||||
- <criterion comment="check if maxpoll is set in /etc/chrony.conf"
|
||||
- test_ref="test_chrony_set_maxpoll" />
|
||||
- <criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf"
|
||||
- test_ref="test_chrony_all_server_has_maxpoll"/>
|
||||
+ <criteria operator="OR">
|
||||
+ <criterion comment="check if no server or pool entry is set in /etc/chrony.conf"
|
||||
+ test_ref="test_chrony_no_server_nor_pool"/>
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion comment="check if maxpoll is set in /etc/chrony.conf"
|
||||
+ test_ref="test_chrony_set_maxpoll" />
|
||||
+ <criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf"
|
||||
+ test_ref="test_chrony_all_server_has_maxpoll"/>
|
||||
+ </criteria>
|
||||
</criteria>
|
||||
</criteria>
|
||||
</definition>
|
||||
@@ -77,4 +85,26 @@
|
||||
<ind:subexpression operation="pattern match" datatype="string">maxpoll \d+</ind:subexpression>
|
||||
</ind:textfilecontent54_state>
|
||||
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
|
||||
+ comment="check if no server entries have server or pool set in /etc/chrony.conf"
|
||||
+ id="test_chrony_no_server_nor_pool" version="1">
|
||||
+ <ind:object object_ref="obj_chrony_no_server_nor_pool" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object id="obj_chrony_no_server_nor_pool" version="1">
|
||||
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^(?:server|pool).*</ind:pattern>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
|
||||
+ comment="check if all server entries have maxpoll set in /etc/ntp.conf"
|
||||
+ id="test_ntp_no_server" version="1">
|
||||
+ <ind:object object_ref="obj_ntp_no_server_nor_pool" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object id="obj_ntp_no_server_nor_pool" version="1">
|
||||
+ <ind:filepath>/etc/ntp.conf</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^server.*</ind:pattern>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
</def-group>
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
|
||||
index 20e7467a7b5..c115ad3c115 100644
|
||||
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
|
||||
@@ -13,6 +13,8 @@ description: |-
|
||||
<pre>maxpoll {{{ xccdf_value("var_time_service_set_maxpoll") }}}</pre>
|
||||
to <pre>server</pre> directives. If using chrony any <pre>pool</pre> directives
|
||||
should be configured too.
|
||||
+ If no <tt>server</tt> or <tt>pool</tt> directives are configured, the rule evaluates
|
||||
+ to pass.
|
||||
{{% if product == "rhcos4" %}}
|
||||
<p>
|
||||
Note that if the remediation shipping with this content is being used, the
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..bbae20fc696
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
|
||||
@@ -0,0 +1,12 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+#
|
||||
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
||||
+
|
||||
+yum remove -y ntp
|
||||
+
|
||||
+# Remove all pool and server options
|
||||
+sed -i "/^pool.*/d" /etc/chrony.conf
|
||||
+sed -i "/^server.*/d" /etc/chrony.conf
|
||||
+
|
||||
+systemctl enable chronyd.service
|
||||
|
||||
From 60ef6eb2cce9e53ea256738ff2583b332155a318 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Fri, 11 Feb 2022 12:14:30 +0100
|
||||
Subject: [PATCH 2/2] Add rule ensuring Chrony only uses server directive
|
||||
|
||||
This new rule only asserts that Chrony has at least one time source configured,
|
||||
and that it is done with the 'server' directive.
|
||||
No remediation is provided for rule, that is left for other specialized
|
||||
rules.
|
||||
---
|
||||
.../chronyd_server_directive/oval/shared.xml | 33 +++++++++++++++++++
|
||||
.../ntp/chronyd_server_directive/rule.yml | 32 ++++++++++++++++++
|
||||
.../tests/file_empty.fail.sh | 6 ++++
|
||||
.../tests/file_missing.fail.sh | 6 ++++
|
||||
.../tests/line_missing.fail.sh | 7 ++++
|
||||
.../tests/multiple_servers.pass.sh | 8 +++++
|
||||
.../tests/only_pool.fail.sh | 9 +++++
|
||||
.../tests/only_server.pass.sh | 6 ++++
|
||||
products/rhel8/profiles/stig.profile | 1 +
|
||||
products/rhel9/profiles/stig.profile | 1 +
|
||||
shared/references/cce-redhat-avail.txt | 2 --
|
||||
.../data/profile_stability/rhel8/stig.profile | 1 +
|
||||
.../profile_stability/rhel8/stig_gui.profile | 1 +
|
||||
13 files changed, 111 insertions(+), 2 deletions(-)
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
|
||||
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml b/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..2244e608047
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
|
||||
@@ -0,0 +1,33 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
||||
+ {{{ oval_metadata("Ensure Chrony has time sources configured with server directive") }}}
|
||||
+ <criteria comment="chrony.conf only has server directive">
|
||||
+ <criterion test_ref="test_chronyd_server_directive_with_server" />
|
||||
+ <criterion test_ref="test_chronyd_server_directive_no_pool" />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
|
||||
+ comment="Ensure at least one time source is set with server directive" id="test_chronyd_server_directive_with_server"
|
||||
+ version="1">
|
||||
+ <ind:object object_ref="object_chronyd_server_directive" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object comment="Matches server entries in Chrony conf files"
|
||||
+ id="object_chronyd_server_directive" version="1">
|
||||
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^[\s]*server.*$</ind:pattern>
|
||||
+ <ind:instance datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
|
||||
+ comment="Ensure no time source is set with pool directive" id="test_chronyd_server_directive_no_pool"
|
||||
+ version="1">
|
||||
+ <ind:object object_ref="object_chronyd_no_pool_directive" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:textfilecontent54_object comment="Matches pool entires in Chrony conf files"
|
||||
+ id="object_chronyd_no_pool_directive" version="1">
|
||||
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^[\s]+pool.*$</ind:pattern>
|
||||
+ <ind:instance datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml b/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..6dc24f1be85
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
|
||||
@@ -0,0 +1,32 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Ensure Chrony is only configured with the server directive'
|
||||
+
|
||||
+description: |-
|
||||
+ Check that Chrony only has time sources configured with the <tt>server</tt> directive.
|
||||
+
|
||||
+rationale: |-
|
||||
+ Depending on the infrastruture being used the <tt>pool</tt> directive may not be supported.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+platform: chrony
|
||||
+
|
||||
+warnings:
|
||||
+ - general: This rule doesn't come with a remediation, the time source needs to be added by the adminstrator.
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel8: CCE-86077-5
|
||||
+ cce@rhel9: CCE-87077-4
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001891
|
||||
+ srg: SRG-OS-000355-GPOS-00143,SRG-OS-000356-GPOS-00144,SRG-OS-000359-GPOS-00146
|
||||
+ stigid@rhel8: RHEL-08-030740
|
||||
+
|
||||
+ocil_clause: 'a remote time server is not configured or configured with pool directive'
|
||||
+
|
||||
+ocil: |-
|
||||
+ Run the following command and verify that time sources are only configure with <tt>server</tt> directive:
|
||||
+ <pre># grep -E "^(server|pool)" /etc/chrony.conf</pre>
|
||||
+ A line with the appropriate server should be returned, any line returned starting with <tt>pool</tt> is a finding.
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..d1ba0755198
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+# remediation = none
|
||||
+
|
||||
+echo "" > /etc/chrony.conf
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..12a50ebc3d2
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+# remediation = none
|
||||
+
|
||||
+rm -f /etc/chrony.conf
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..bffa8b62b1b
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+# remediation = none
|
||||
+
|
||||
+echo "some line" > /etc/chrony.conf
|
||||
+echo "another line" >> /etc/chrony.conf
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..5527f389316
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+# remediation = none
|
||||
+
|
||||
+sed -i "^pool.*" /etc/chrony.conf
|
||||
+echo "server 0.pool.ntp.org" > /etc/chrony.conf
|
||||
+echo "server 1.pool.ntp.org" >> /etc/chrony.conf
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..616fe8844fc
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+# remediation = none
|
||||
+
|
||||
+sed -i "^server.*" /etc/chrony.conf
|
||||
+if ! grep "^pool.*" /etc/chrony.conf; then
|
||||
+ echo "pool 0.pool.ntp.org" > /etc/chrony.conf
|
||||
+fi
|
||||
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..21a70dc4900
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+# packages = chrony
|
||||
+# platform = multi_platform_fedora,multi_platform_rhel
|
||||
+
|
||||
+sed -i "^pool.*" /etc/chrony.conf
|
||||
+echo "server 0.pool.ntp.org" > /etc/chrony.conf
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 36f606ee461..2bd1fb54316 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -909,6 +909,7 @@ selections:
|
||||
# RHEL-08-030740
|
||||
# remediation fails because default configuration file contains pool instead of server keyword
|
||||
- chronyd_or_ntpd_set_maxpoll
|
||||
+ - chronyd_server_directive
|
||||
|
||||
# RHEL-08-030741
|
||||
- chronyd_client_only
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 374932cfd32..0d4d7b0ff97 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -909,6 +909,7 @@ selections:
|
||||
# RHEL-08-030740
|
||||
# remediation fails because default configuration file contains pool instead of server keyword
|
||||
- chronyd_or_ntpd_set_maxpoll
|
||||
+ - chronyd_server_directive
|
||||
|
||||
# RHEL-08-030741
|
||||
- chronyd_client_only
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 8c59c5d3201..0081fe1938f 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -152,7 +152,6 @@ CCE-86073-4
|
||||
CCE-86074-2
|
||||
CCE-86075-9
|
||||
CCE-86076-7
|
||||
-CCE-86077-5
|
||||
CCE-86078-3
|
||||
CCE-86079-1
|
||||
CCE-86080-9
|
||||
@@ -1079,7 +1078,6 @@ CCE-87073-3
|
||||
CCE-87074-1
|
||||
CCE-87075-8
|
||||
CCE-87076-6
|
||||
-CCE-87077-4
|
||||
CCE-87078-2
|
||||
CCE-87079-0
|
||||
CCE-87080-8
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index 5b06103d72e..7d44f8910d1 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -160,6 +160,7 @@ selections:
|
||||
- chronyd_client_only
|
||||
- chronyd_no_chronyc_network
|
||||
- chronyd_or_ntpd_set_maxpoll
|
||||
+- chronyd_server_directive
|
||||
- clean_components_post_updating
|
||||
- configure_bashrc_exec_tmux
|
||||
- configure_bind_crypto_policy
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 11e0ee9515a..91546d1d418 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -171,6 +171,7 @@ selections:
|
||||
- chronyd_client_only
|
||||
- chronyd_no_chronyc_network
|
||||
- chronyd_or_ntpd_set_maxpoll
|
||||
+- chronyd_server_directive
|
||||
- clean_components_post_updating
|
||||
- configure_bashrc_exec_tmux
|
||||
- configure_bind_crypto_policy
|
||||
@ -1,282 +0,0 @@
|
||||
From f7a2fb33ad1507ad4ce3f7ec6534c06d4f6a7e83 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Fri, 4 Feb 2022 12:02:36 +0100
|
||||
Subject: [PATCH 1/3] Add tests for distributed SSHD RekeyLimit config
|
||||
|
||||
---
|
||||
.../sshd_rekey_limit/tests/bad_size_directory.fail.sh | 10 ++++++++++
|
||||
.../sshd_rekey_limit/tests/bad_time_directory.fail.sh | 10 ++++++++++
|
||||
.../sshd_rekey_limit/tests/no_line_directory.fail.sh | 8 ++++++++
|
||||
.../sshd_rekey_limit/tests/rhel8_ok.pass.sh | 2 +-
|
||||
.../sshd_rekey_limit/tests/rhel9_ok.pass.sh | 11 +++++++++++
|
||||
5 files changed, 40 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
|
||||
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
|
||||
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..88c6420c5ca
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
|
||||
+
|
||||
+mkdir -p /etc/ssh/sshd_config.d
|
||||
+touch /etc/ssh/sshd_config.d/nothing
|
||||
+
|
||||
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
|
||||
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
|
||||
+fi
|
||||
+
|
||||
+echo "RekeyLimit 812M 1h" > /etc/ssh/sshd_config.d/bad_config.conf
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..3bb0926017c
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
|
||||
+
|
||||
+mkdir -p /etc/ssh/sshd_config.d
|
||||
+touch /etc/ssh/sshd_config.d/nothing
|
||||
+
|
||||
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
|
||||
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
|
||||
+fi
|
||||
+
|
||||
+echo "RekeyLimit 512M 2h" > /etc/ssh/sshd_config.d/bad_config.conf
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..00569de1b84
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
|
||||
+
|
||||
+mkdir -p /etc/ssh/sshd_config.d
|
||||
+touch /etc/ssh/sshd_config.d/nothing
|
||||
+
|
||||
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
|
||||
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
|
||||
+fi
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
|
||||
index b9834e6d0b2..894c0ae4ba8 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = Red Hat Enterprise Linux 8
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
|
||||
# profiles = xccdf_org.ssgproject.content_profile_ospp
|
||||
|
||||
sed -e '/RekeyLimit/d' /etc/ssh/sshd_config
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..e183e8986dc
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+# platform = Red Hat Enterprise Linux 9
|
||||
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
||||
+
|
||||
+mkdir -p /etc/ssh/sshd_config.d
|
||||
+touch /etc/ssh/sshd_config.d/nothing
|
||||
+
|
||||
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
|
||||
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
|
||||
+fi
|
||||
+
|
||||
+echo "RekeyLimit 1G 1h" >> /etc/ssh/sshd_config.d/good_config.conf
|
||||
|
||||
From 782e3a6108ea377d526d0aed4e8c0cf019f3dcdd Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Fri, 4 Feb 2022 12:06:45 +0100
|
||||
Subject: [PATCH 2/3] Update rule to handle distributed config
|
||||
|
||||
Based on the template sshd_lineinfile, updated rule sshd_rekey_limit to
|
||||
check and remediate SSHD configuration in products that support
|
||||
/etc/sshd/sshd_config.d/
|
||||
|
||||
The rule cannot use the template as it relies on two external variables.
|
||||
---
|
||||
.../sshd_rekey_limit/ansible/shared.yml | 8 +++-
|
||||
.../sshd_rekey_limit/bash/shared.sh | 2 +-
|
||||
.../sshd_rekey_limit/oval/shared.xml | 46 ++++++++++++++-----
|
||||
.../ssh/ssh_server/sshd_rekey_limit/rule.yml | 10 +++-
|
||||
4 files changed, 50 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
|
||||
index 84a4f084d40..f30dcdb2ed3 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
|
||||
@@ -5,4 +5,10 @@
|
||||
# disruption = low
|
||||
{{{ ansible_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}}
|
||||
|
||||
-{{{ ansible_sshd_set(parameter="RekeyLimit", value="{{ var_rekey_limit_size }} {{ var_rekey_limit_time }}") }}}
|
||||
+{{{
|
||||
+ ansible_sshd_set(
|
||||
+ parameter="RekeyLimit",
|
||||
+ value="{{ var_rekey_limit_size }} {{ var_rekey_limit_time }}",
|
||||
+ config_is_distributed=sshd_distributed_config
|
||||
+ )
|
||||
+}}}
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
|
||||
index 4422f63472c..789358472a1 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
|
||||
@@ -2,4 +2,4 @@
|
||||
|
||||
{{{ bash_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}}
|
||||
|
||||
-{{{ bash_sshd_config_set(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time") }}}
|
||||
+{{{ bash_sshd_remediation(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time", config_is_distributed=sshd_distributed_config) -}}}
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
index f49d9ab5275..e109cbd3124 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
@@ -1,26 +1,49 @@
|
||||
-{{% set filepath = "/etc/ssh/sshd_config" -%}}
|
||||
-
|
||||
+{{%- set parameter = "RekeyLimit" %}}
|
||||
+{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
|
||||
+{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
|
||||
+{{%- set description = "Ensure RekeyLimit is configured with the appropriate value in " ~ sshd_config_path %}}
|
||||
+{{%- if sshd_distributed_config == "true" %}}
|
||||
+{{%- set description = description ~ " or in " ~ sshd_config_dir -%}}
|
||||
+{{%- endif %}}
|
||||
|
||||
<def-group>
|
||||
<definition class="compliance" id="{{{ rule_id }}}" version="1">
|
||||
- {{{ oval_metadata("Ensure 'RekeyLimit' is configured with the correct value in '" + filepath + "'") }}}
|
||||
- <criteria comment="sshd is configured correctly or is not installed" operator="OR">
|
||||
- {{{- application_not_required_or_requirement_unset() }}}
|
||||
- {{{- application_required_or_requirement_unset() }}}
|
||||
- {{{- oval_line_in_file_criterion(filepath, "RekeyLimit") }}}
|
||||
- </criteria>
|
||||
- </criteria>
|
||||
+ {{{ oval_metadata(description) }}}
|
||||
+ <criteria comment="sshd is configured correctly or is not installed" operator="OR">
|
||||
+ {{{- application_not_required_or_requirement_unset() }}}
|
||||
+ {{{- application_required_or_requirement_unset() }}}
|
||||
+ <criteria comment="sshd is configured corectly" operator="OR">
|
||||
+ {{{- oval_line_in_file_criterion(sshd_config_path, parameter) }}}
|
||||
+ {{%- if sshd_distributed_config %}}
|
||||
+ {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter) | indent(8) }}}
|
||||
+ {{%- endif %}}
|
||||
+ </criteria>
|
||||
+ </criteria><!-- macro application_required_or_requirement_unset() leaves an open criteria element-->
|
||||
+ </criteria>
|
||||
</definition>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
|
||||
<ind:object object_ref="obj_sshd_rekey_limit"/>
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
<ind:textfilecontent54_object id="obj_sshd_rekey_limit" version="1">
|
||||
- <ind:filepath>{{{ filepath }}}</ind:filepath>
|
||||
+ <ind:filepath>{{{ sshd_config_path }}}</ind:filepath>
|
||||
+ <ind:pattern var_ref="sshd_line_regex" operation="pattern match"></ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ {{%- if sshd_distributed_config %}}
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
|
||||
+ <ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="obj_sshd_rekey_limit_config_dir" version="1">
|
||||
+ <ind:path>{{{ sshd_config_dir}}}</ind:path>
|
||||
+ <ind:filename operation="pattern match">.*\.conf$</ind:filename>
|
||||
<ind:pattern var_ref="sshd_line_regex" operation="pattern match"></ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
+ {{%- endif %}}
|
||||
|
||||
<local_variable id="sshd_line_regex" datatype="string" comment="The regex of the directive" version="1">
|
||||
<concat>
|
||||
@@ -35,4 +58,3 @@
|
||||
<external_variable comment="Size component of the rekey limit" datatype="string" id="var_rekey_limit_size" version="1" />
|
||||
<external_variable comment="Time component of the rekey limit" datatype="string" id="var_rekey_limit_time" version="1" />
|
||||
</def-group>
|
||||
-
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
|
||||
index 450f244de41..702cd0506d3 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
|
||||
@@ -6,8 +6,10 @@ description: |-
|
||||
The <tt>RekeyLimit</tt> parameter specifies how often
|
||||
the session key of the is renegotiated, both in terms of
|
||||
amount of data that may be transmitted and the time
|
||||
- elapsed. To decrease the default limits, put line
|
||||
- <tt>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</tt> to file <tt>/etc/ssh/sshd_config</tt>.
|
||||
+ elapsed.<br/>
|
||||
+ To decrease the default limits, add or correct the following line in
|
||||
+ {{{ sshd_config_file() }}}
|
||||
+ <pre>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</pre>
|
||||
|
||||
rationale: |-
|
||||
By decreasing the limit based on the amount of data and enabling
|
||||
@@ -32,6 +34,10 @@ ocil_clause: 'it is commented out or is not set'
|
||||
ocil: |-
|
||||
To check if RekeyLimit is set correctly, run the
|
||||
following command:
|
||||
+ {{% if sshd_distributed_config == "true" %}}
|
||||
+ <pre>$ sudo grep RekeyLimit /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*</pre>
|
||||
+ {{% else %}}
|
||||
<pre>$ sudo grep RekeyLimit /etc/ssh/sshd_config</pre>
|
||||
+ {{% endif %}}
|
||||
If configured properly, output should be
|
||||
<pre>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</pre>
|
||||
|
||||
From 78d6d40f280b0e43e6c8fd7d60cfd81e7979fb8f Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 16:59:53 +0100
|
||||
Subject: [PATCH 3/3] Use the Jinja variable 'parameter' where applicable
|
||||
|
||||
---
|
||||
.../ssh/ssh_server/sshd_rekey_limit/oval/shared.xml | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
index e109cbd3124..d79ac7f2047 100644
|
||||
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
|
||||
@@ -1,7 +1,7 @@
|
||||
{{%- set parameter = "RekeyLimit" %}}
|
||||
{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
|
||||
{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
|
||||
-{{%- set description = "Ensure RekeyLimit is configured with the appropriate value in " ~ sshd_config_path %}}
|
||||
+{{%- set description = "Ensure {{{ parameter }}} is configured with the appropriate value in " ~ sshd_config_path %}}
|
||||
{{%- if sshd_distributed_config == "true" %}}
|
||||
{{%- set description = description ~ " or in " ~ sshd_config_dir -%}}
|
||||
{{%- endif %}}
|
||||
@@ -22,7 +22,7 @@
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in the file" id="test_sshd_rekey_limit" version="1">
|
||||
<ind:object object_ref="obj_sshd_rekey_limit"/>
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
{{%- if sshd_distributed_config %}}
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
|
||||
<ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
@@ -47,7 +47,7 @@
|
||||
|
||||
<local_variable id="sshd_line_regex" datatype="string" comment="The regex of the directive" version="1">
|
||||
<concat>
|
||||
- <literal_component>^[\s]*RekeyLimit[\s]+</literal_component>
|
||||
+ <literal_component>^[\s]*{{{ parameter }}}[\s]+</literal_component>
|
||||
<variable_component var_ref="var_rekey_limit_size"/>
|
||||
<literal_component>[\s]+</literal_component>
|
||||
<variable_component var_ref="var_rekey_limit_time"/>
|
||||
@ -1,536 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..de85c892704
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
|
||||
@@ -0,0 +1,38 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Audit Configuration Files Must Be Owned By Group root'
|
||||
+
|
||||
+description: |-
|
||||
+ All audit configuration files must be owned by group root.
|
||||
+ <pre>chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</pre>
|
||||
+
|
||||
+rationale: |-
|
||||
+ Without the capability to restrict which roles and individuals can
|
||||
+ select which events are audited, unauthorized personnel may be able
|
||||
+ to prevent the auditing of critical events.
|
||||
+ Misconfigured audits may degrade the system's performance by
|
||||
+ overwhelming the audit log. Misconfigured audits may also make it more
|
||||
+ difficult to establish, correlate, and investigate the events relating
|
||||
+ to an incident or identify those responsible for one.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-000171
|
||||
+ srg: SRG-OS-000063-GPOS-00032
|
||||
+ stigid@ubuntu2004: UBTU-20-010135
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ describe_file_group_owner(file="/etc/audit/", group="root") }}}
|
||||
+ {{{ describe_file_group_owner(file="/etc/audit/rules.d/", group="root") }}}
|
||||
+
|
||||
+template:
|
||||
+ name: file_groupowner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /etc/audit/
|
||||
+ - /etc/audit/rules.d/
|
||||
+ file_regex:
|
||||
+ - ^audit(\.rules|d\.conf)$
|
||||
+ - ^.*\.rules$
|
||||
+ filegid: '0'
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..5235e0d05a3
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
|
||||
+export AUDITFILE=/etc/audit/auditd.conf
|
||||
+mkdir -p /etc/audit/rules.d/
|
||||
+touch $TESTFILE
|
||||
+touch $AUDITFILE
|
||||
+chgrp root $TESTFILE
|
||||
+chgrp root $AUDITFILE
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..52378d810a5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+groupadd group_test
|
||||
+export TESTFILLE=/etc/audit/rules.d/test_rule.rules
|
||||
+export AUDITFILE=/etc/audit/auditd.conf
|
||||
+mkdir -p /etc/audit/rules.d/
|
||||
+touch $TESTFILLE
|
||||
+touch $AUDITFILE
|
||||
+chgrp group_test $TESTFILLE
|
||||
+chgrp group_test $AUDITFILE
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
|
||||
index 5e2cabafc34..927d08d03d4 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
|
||||
@@ -1,8 +1,15 @@
|
||||
+{{% if 'ubuntu' in product %}}
|
||||
+{{% set gid = 'syslog' %}}
|
||||
+{{% else %}}
|
||||
+{{% set gid = 'root' %}}
|
||||
+{{% endif %}}
|
||||
+
|
||||
+
|
||||
documentation_complete: true
|
||||
|
||||
title: 'Verify Group Who Owns /var/log Directory'
|
||||
|
||||
-description: '{{{ describe_file_group_owner(file="/var/log", group="root") }}}'
|
||||
+description: '{{{ describe_file_group_owner(file="/var/log", group=gid) }}}'
|
||||
|
||||
rationale: |-
|
||||
The <tt>/var/log</tt> directory contains files with logs of error
|
||||
@@ -22,13 +29,16 @@ references:
|
||||
stigid@rhel8: RHEL-08-010260
|
||||
stigid@ubuntu2004: UBTU-20-010417
|
||||
|
||||
-ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group="root") }}}'
|
||||
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group=gid) }}}'
|
||||
|
||||
ocil: |-
|
||||
- {{{ ocil_file_group_owner(file="/var/log", group="root") }}}
|
||||
+ {{{ ocil_file_group_owner(file="/var/log", group=gid) }}}
|
||||
|
||||
template:
|
||||
name: file_groupowner
|
||||
vars:
|
||||
filepath: /var/log/
|
||||
filegid: '0'
|
||||
+ filegid@ubuntu1604: '110'
|
||||
+ filegid@ubuntu1804: '110'
|
||||
+ filegid@ubuntu2004: '110'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..f654279fe54
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
|
||||
@@ -0,0 +1,27 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Verify Group Who Owns /var/log/syslog File'
|
||||
+
|
||||
+description: '{{{ describe_file_group_owner(file="/var/log/syslog", group="adm") }}}'
|
||||
+
|
||||
+rationale: |-
|
||||
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
|
||||
+ the system and should only be accessed by authorized personnel.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001314
|
||||
+ srg: SRG-OS-000206-GPOS-00084
|
||||
+ stigid@ubuntu2004: UBTU-20-010420
|
||||
+
|
||||
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log/syslog", group="adm") }}}'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_file_group_owner(file="/var/log/syslog", group="adm") }}}
|
||||
+
|
||||
+template:
|
||||
+ name: file_groupowner
|
||||
+ vars:
|
||||
+ filepath: /var/log/syslog
|
||||
+ filegid: '4'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..655b2cd1aef
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
|
||||
@@ -0,0 +1,65 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: ubuntu2004
|
||||
+
|
||||
+title: 'Verify that system commands directories are group owned by root'
|
||||
+
|
||||
+description: |-
|
||||
+ System commands files are stored in the following directories by default:
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/sbin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin
|
||||
+ </pre>
|
||||
+ All these directories should be owned by the <tt>root</tt> group.
|
||||
+ If the directory is found to be owned by a group other than root correct
|
||||
+ its ownership with the following command:
|
||||
+ <pre>$ sudo chgrp root <i>DIR</i></pre>
|
||||
+
|
||||
+rationale: |-
|
||||
+ If the operating system allows any user to make changes to software
|
||||
+ libraries, then those changes might be implemented without undergoing the
|
||||
+ appropriate testing and approvals that are part of a robust change management
|
||||
+ process.
|
||||
+ This requirement applies to operating systems with software libraries
|
||||
+ that are accessible and configurable, as in the case of interpreted languages.
|
||||
+ Software libraries also include privileged programs which execute with
|
||||
+ escalated privileges. Only qualified and authorized individuals must be
|
||||
+ allowed to obtain access to information system components for purposes
|
||||
+ of initiating changes, including upgrades and modifications.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001495
|
||||
+ srg: SRG-OS-000258-GPOS-00099
|
||||
+ stigid@ubuntu2004: UBTU-20-010425
|
||||
+
|
||||
+ocil_clause: 'any of these directories are not owned by root group'
|
||||
+
|
||||
+ocil: |-
|
||||
+ System commands are stored in the following directories:
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/sbin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin</pre>
|
||||
+ For each of these directories, run the following command to find files not
|
||||
+ owned by root group:
|
||||
+ <pre>$ sudo find -L <i>$DIR</i> ! -group root -type d \;</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_groupowner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /bin/
|
||||
+ - /sbin/
|
||||
+ - /usr/bin/
|
||||
+ - /usr/sbin/
|
||||
+ - /usr/local/bin/
|
||||
+ - /usr/local/sbin/
|
||||
+ recursive: 'true'
|
||||
+ filegid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
|
||||
deleted file mode 100644
|
||||
index 28df7839430..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
|
||||
+++ /dev/null
|
||||
@@ -1,23 +0,0 @@
|
||||
-# platform = multi_platform_sle
|
||||
-# reboot = false
|
||||
-# strategy = restrict
|
||||
-# complexity = medium
|
||||
-# disruption = medium
|
||||
-- name: "Read list libraries without root ownership"
|
||||
- find:
|
||||
- paths:
|
||||
- - "/usr/lib"
|
||||
- - "/usr/lib64"
|
||||
- - "/lib"
|
||||
- - "/lib64"
|
||||
- file_type: "directory"
|
||||
- register: library_dirs_not_owned_by_root
|
||||
-
|
||||
-- name: "Set ownership of system library dirs to root"
|
||||
- file:
|
||||
- path: "{{ item.path }}"
|
||||
- owner: "root"
|
||||
- state: "directory"
|
||||
- mode: "{{ item.mode }}"
|
||||
- with_items: "{{ library_dirs_not_owned_by_root.files }}"
|
||||
- when: library_dirs_not_owned_by_root.matched > 0
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..f61a5f988dc
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: ubuntu2004
|
||||
+
|
||||
+title: 'Verify that audit tools are owned by group root'
|
||||
+
|
||||
+description: |-
|
||||
+ The {{{ full_name }}} operating system audit tools must have the proper
|
||||
+ ownership configured to protected against unauthorized access.
|
||||
+
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl root
|
||||
+ /sbin/aureport root
|
||||
+ /sbin/ausearch root
|
||||
+ /sbin/autrace root
|
||||
+ /sbin/auditd root
|
||||
+ /sbin/audispd root
|
||||
+ /sbin/augenrules root
|
||||
+ </pre>
|
||||
+
|
||||
+ Audit tools needed to successfully view and manipulate audit information
|
||||
+ system activity and records. Audit tools include custom queries and report
|
||||
+ generators
|
||||
+
|
||||
+rationale: |-
|
||||
+ Protecting audit information also includes identifying and protecting the
|
||||
+ tools used to view and manipulate log data. Therefore, protecting audit
|
||||
+ tools is necessary to prevent unauthorized operation on audit information.
|
||||
+
|
||||
+ Operating systems providing tools to interface with audit information
|
||||
+ will leverage user permissions and roles identifying the user accessing the
|
||||
+ tools and the corresponding rights the user enjoys to make access decisions
|
||||
+ regarding the access to audit tools.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001493,CCI-001494
|
||||
+ srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
|
||||
+ stigid@ubuntu2004: UBTU-20-010201
|
||||
+
|
||||
+ocil: |-
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl root
|
||||
+ /sbin/aureport root
|
||||
+ /sbin/ausearch root
|
||||
+ /sbin/autrace root
|
||||
+ /sbin/auditd root
|
||||
+ /sbin/audispd root
|
||||
+ /sbin/augenrules root
|
||||
+ </pre>
|
||||
+
|
||||
+ If the command does not return all the above lines, the missing ones
|
||||
+ need to be added.
|
||||
+
|
||||
+ Run the following command to correct the permissions of the missing
|
||||
+ entries:
|
||||
+ <pre>$ sudo chown :root [audit_tool] </pre>
|
||||
+
|
||||
+ Replace "[audit_tool]" with each audit tool not group-owned by root.
|
||||
+
|
||||
+template:
|
||||
+ name: file_groupowner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /sbin/auditctl
|
||||
+ - /sbin/aureport
|
||||
+ - /sbin/ausearch
|
||||
+ - /sbin/autrace
|
||||
+ - /sbin/auditd
|
||||
+ - /sbin/audispd
|
||||
+ - /sbin/augenrules
|
||||
+ filegid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
index bb7c72550e9..a9e8c7d8e25 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
|
||||
do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
|
||||
index 7cf507ca5f4..33a0c85d35b 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
|
||||
@@ -1,10 +1,12 @@
|
||||
#!/bin/bash
|
||||
|
||||
+groupadd group_test
|
||||
+
|
||||
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
|
||||
do
|
||||
if [[ ! -f $TESTFILE ]]
|
||||
then
|
||||
touch $TESTFILE
|
||||
fi
|
||||
- chown nobody.nobody $TESTFILE
|
||||
+ chgrp group_test $TESTFILE
|
||||
done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
|
||||
deleted file mode 100644
|
||||
index 08019fd48bb..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
|
||||
+++ /dev/null
|
||||
@@ -1,26 +0,0 @@
|
||||
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
-# reboot = false
|
||||
-# strategy = restrict
|
||||
-# complexity = high
|
||||
-# disruption = medium
|
||||
-
|
||||
-- name: "Read list libraries without root ownership"
|
||||
- find:
|
||||
- paths:
|
||||
- - "/usr/lib"
|
||||
- - "/usr/lib64"
|
||||
- - "/lib"
|
||||
- - "/lib64"
|
||||
- file_type: "file"
|
||||
- register: library_files_not_group_owned_by_root
|
||||
-
|
||||
-- name: "Set group ownership of system library files to root"
|
||||
- file:
|
||||
- path: "{{ item.path }}"
|
||||
- group: "root"
|
||||
- state: "file"
|
||||
- mode: "{{ item.mode }}"
|
||||
- with_items: "{{ library_files_not_group_owned_by_root.files }}"
|
||||
- when:
|
||||
- - library_files_not_group_owned_by_root.matched > 0
|
||||
- - item.gid != 0
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
|
||||
deleted file mode 100644
|
||||
index 3a42beafb8a..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
|
||||
+++ /dev/null
|
||||
@@ -1,7 +0,0 @@
|
||||
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
-
|
||||
-find /lib \
|
||||
-/lib64 \
|
||||
-/usr/lib \
|
||||
-/usr/lib64 \
|
||||
-\! -group root -type f -exec chgrp root '{}' \;
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
|
||||
deleted file mode 100644
|
||||
index f5ca9380b55..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
|
||||
+++ /dev/null
|
||||
@@ -1,27 +0,0 @@
|
||||
-<def-group>
|
||||
- <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
|
||||
- {{{ oval_metadata("
|
||||
- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
|
||||
- are owned by root.
|
||||
- ") }}}
|
||||
- <criteria >
|
||||
- <criterion test_ref="test_root_permissions_for_syslibrary_files" />
|
||||
- </criteria>
|
||||
- </definition>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
|
||||
- <unix:object object_ref="root_permissions_for_system_wide_library_files" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
|
||||
- <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
|
||||
- are owned by root. -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
|
||||
- <unix:filename operation="pattern match">^.*$</unix:filename>
|
||||
- <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
|
||||
- <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
|
||||
- </unix:file_state>
|
||||
-</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
index 17923f52ea6..eaf04c8d36c 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
@@ -1,6 +1,6 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15
|
||||
+prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15,ubuntu2004
|
||||
|
||||
title: |-
|
||||
Verify the system-wide library files in directories
|
||||
@@ -46,6 +46,7 @@ references:
|
||||
stigid@rhel8: RHEL-08-010350
|
||||
stigid@sle12: SLES-12-010875
|
||||
stigid@sle15: SLES-15-010355
|
||||
+ stigid@ubuntu2004: UBTU-20-01430
|
||||
|
||||
ocil_clause: 'system wide library files are not group owned by root'
|
||||
|
||||
@@ -59,3 +60,14 @@ ocil: |-
|
||||
To find if system-wide library files stored in these directories are not group-owned by
|
||||
root run the following command for each directory <i>DIR</i>:
|
||||
<pre>$ sudo find -L <i>DIR</i> ! -group root -type f </pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_groupowner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /lib/
|
||||
+ - /lib64/
|
||||
+ - /usr/lib/
|
||||
+ - /usr/lib64/
|
||||
+ file_regex: ^.*$
|
||||
+ filegid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
similarity index 86%
|
||||
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
|
||||
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
index a4ae2854db1..0e982c3b8ca 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
|
||||
do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
similarity index 70%
|
||||
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
|
||||
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
index c96f65b989c..23a7703f57d 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
@@ -1,10 +1,11 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
+groupadd group_test
|
||||
for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
|
||||
do
|
||||
if [[ ! -f $TESTFILE ]]
|
||||
then
|
||||
touch $TESTFILE
|
||||
fi
|
||||
- chown nobody.nobody $TESTFILE
|
||||
+ chgrp group_test $TESTFILE
|
||||
done
|
||||
diff --git a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
|
||||
index 938e6b30819..015ff98c99d 100644
|
||||
--- a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
|
||||
+++ b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
|
||||
@@ -1,8 +1,20 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
|
||||
-{{% if MISSING_FILE_PASS %}}
|
||||
- rm -f {{{ FILEPATH }}}
|
||||
-{{% else %}}
|
||||
- true
|
||||
-{{% endif %}}
|
||||
+{{% for path in FILEPATH %}}
|
||||
+ {{% if MISSING_FILE_PASS %}}
|
||||
+ rm -f {{{ path }}}
|
||||
+ {{% else %}}
|
||||
+ {{% if IS_DIRECTORY and FILE_REGEX %}}
|
||||
+ echo "Create specific tests for this rule because of regex"
|
||||
+ {{% elif IS_DIRECTORY and RECURSIVE %}}
|
||||
+ find -L {{{ path }}} -type d -exec chgrp {{{ FILEGID }}} {} \;
|
||||
+ {{% else %}}
|
||||
+ if [ ! -f {{{ path }}} ]; then
|
||||
+ mkdir -p "$(dirname '{{{ path }}}')"
|
||||
+ touch {{{ path }}}
|
||||
+ fi
|
||||
+ chgrp {{{ FILEGID }}} {{{ path }}}
|
||||
+ {{% endif %}}
|
||||
+ {{% endif %}}
|
||||
+{{% endfor %}}
|
||||
@ -1,288 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..968ef336148
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml
|
||||
@@ -0,0 +1,39 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Audit Configuration Files Must Be Owned By Root'
|
||||
+
|
||||
+description: |-
|
||||
+ All audit configuration files must be owned by root user.
|
||||
+ {{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
|
||||
+ {{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
|
||||
+
|
||||
+rationale: |-
|
||||
+ Without the capability to restrict which roles and individuals can
|
||||
+ select which events are audited, unauthorized personnel may be able
|
||||
+ to prevent the auditing of critical events.
|
||||
+ Misconfigured audits may degrade the system's performance by
|
||||
+ overwhelming the audit log. Misconfigured audits may also make it more
|
||||
+ difficult to establish, correlate, and investigate the events relating
|
||||
+ to an incident or identify those responsible for one.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-000171
|
||||
+ srg: SRG-OS-000063-GPOS-00032
|
||||
+ stigid@ubuntu2004: UBTU-20-010134
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
|
||||
+ {{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /etc/audit/
|
||||
+ - /etc/audit/rules.d/
|
||||
+ file_regex:
|
||||
+ - ^audit(\.rules|d\.conf)$
|
||||
+ - ^.*\.rules$
|
||||
+ fileuid: '0'
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..4d67307a1ef
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+# packages = audit
|
||||
+
|
||||
+chown 0 /etc/audit/audit.rules
|
||||
+chown 0 /etc/audit/auditd.conf
|
||||
+chown 0 -R /etc/audit/rules.d/
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..337074fab92
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# packages = audit
|
||||
+
|
||||
+useradd testuser_123
|
||||
+chown testuser_123 /etc/audit/audit.rules
|
||||
+chown testuser_123 /etc/audit/auditd.conf
|
||||
+chown testuser_123 -R /etc/audit/rules.d/
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..f1bf515455d
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml
|
||||
@@ -0,0 +1,27 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Verify User Who Owns /var/log/syslog File'
|
||||
+
|
||||
+description: '{{{ describe_file_owner(file="/var/log/syslog", owner="syslog") }}}'
|
||||
+
|
||||
+rationale: |-
|
||||
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
|
||||
+ the system and should only be accessed by authorized personnel.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001314
|
||||
+ srg: SRG-OS-000206-GPOS-00084
|
||||
+ stigid@ubuntu2004: UBTU-20-010421
|
||||
+
|
||||
+ocil_clause: '{{{ ocil_clause_file_owner(file="/var/log/syslog", owner="syslog") }}}'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_file_owner(file="/var/log/syslog", owner="syslog") }}}
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath: /var/log/syslog
|
||||
+ fileuid: '104'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..e2362388678
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
|
||||
@@ -0,0 +1,55 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Verify that System Executable Have Root Ownership'
|
||||
+
|
||||
+description: |-
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/sbin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin</pre>
|
||||
+ All these directories should be owned by the <tt>root</tt> user.
|
||||
+ If any directory <i>DIR</i> in these directories is found
|
||||
+ to be owned by a user other than root, correct its ownership with the
|
||||
+ following command:
|
||||
+ <pre>$ sudo chown root <i>DIR</i></pre>
|
||||
+
|
||||
+rationale: |-
|
||||
+ System binaries are executed by privileged users as well as system services,
|
||||
+ and restrictive permissions are necessary to ensure that their
|
||||
+ execution of these programs cannot be co-opted.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001495
|
||||
+ srg: SRG-OS-000258-GPOS-00099
|
||||
+ stigid@ubuntu2004: UBTU-20-010424
|
||||
+
|
||||
+ocil_clause: 'any system exectables directories are found to not be owned by root'
|
||||
+
|
||||
+ocil: |-
|
||||
+ System executables are stored in the following directories by default:
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin
|
||||
+ /usr/sbin</pre>
|
||||
+ For each of these directories, run the following command to find files
|
||||
+ not owned by root:
|
||||
+ <pre>$ sudo find -L <i>DIR/</i> ! -user root -type d -exec chown root {} \;</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /bin/
|
||||
+ - /sbin/
|
||||
+ - /usr/bin/
|
||||
+ - /usr/sbin/
|
||||
+ - /usr/local/bin/
|
||||
+ - /usr/local/sbin/
|
||||
+ recursive: 'true'
|
||||
+ fileuid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..0c7d9b313d5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: ubuntu2004
|
||||
+
|
||||
+title: 'Verify that audit tools are owned by root'
|
||||
+
|
||||
+description: |-
|
||||
+ The {{{ full_name }}} operating system audit tools must have the proper
|
||||
+ ownership configured to protected against unauthorized access.
|
||||
+
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl root
|
||||
+ /sbin/aureport root
|
||||
+ /sbin/ausearch root
|
||||
+ /sbin/autrace root
|
||||
+ /sbin/auditd root
|
||||
+ /sbin/audispd root
|
||||
+ /sbin/augenrules root
|
||||
+ </pre>
|
||||
+
|
||||
+ Audit tools needed to successfully view and manipulate audit information
|
||||
+ system activity and records. Audit tools include custom queries and report
|
||||
+ generators
|
||||
+
|
||||
+rationale: |-
|
||||
+ Protecting audit information also includes identifying and protecting the
|
||||
+ tools used to view and manipulate log data. Therefore, protecting audit
|
||||
+ tools is necessary to prevent unauthorized operation on audit information.
|
||||
+
|
||||
+ Operating systems providing tools to interface with audit information
|
||||
+ will leverage user permissions and roles identifying the user accessing the
|
||||
+ tools and the corresponding rights the user enjoys to make access decisions
|
||||
+ regarding the access to audit tools.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001493,CCI-001494
|
||||
+ srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
|
||||
+ stigid@ubuntu2004: UBTU-20-010200
|
||||
+
|
||||
+ocil: |-
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl root
|
||||
+ /sbin/aureport root
|
||||
+ /sbin/ausearch root
|
||||
+ /sbin/autrace root
|
||||
+ /sbin/auditd root
|
||||
+ /sbin/audispd root
|
||||
+ /sbin/augenrules root
|
||||
+ </pre>
|
||||
+
|
||||
+ If the command does not return all the above lines, the missing ones
|
||||
+ need to be added.
|
||||
+
|
||||
+ Run the following command to correct the permissions of the missing
|
||||
+ entries:
|
||||
+ <pre>$ sudo chown root [audit_tool] </pre>
|
||||
+
|
||||
+ Replace "[audit_tool]" with each audit tool not owned by root.
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /sbin/auditctl
|
||||
+ - /sbin/aureport
|
||||
+ - /sbin/ausearch
|
||||
+ - /sbin/autrace
|
||||
+ - /sbin/auditd
|
||||
+ - /sbin/audispd
|
||||
+ - /sbin/augenrules
|
||||
+ fileuid: '0'
|
||||
diff --git a/shared/templates/file_owner/ansible.template b/shared/templates/file_owner/ansible.template
|
||||
index 80eaae8d50b..590c9fc6055 100644
|
||||
--- a/shared/templates/file_owner/ansible.template
|
||||
+++ b/shared/templates/file_owner/ansible.template
|
||||
@@ -25,7 +25,7 @@
|
||||
|
||||
- name: Ensure owner on {{{ path }}} recursively
|
||||
file:
|
||||
- paths "{{{ path }}}"
|
||||
+ path: "{{{ path }}}"
|
||||
state: directory
|
||||
recurse: yes
|
||||
owner: "{{{ FILEUID }}}"
|
||||
diff --git a/shared/templates/file_owner/tests/missing_file_test.pass.sh b/shared/templates/file_owner/tests/missing_file_test.pass.sh
|
||||
index 938e6b30819..4e3683f9dcf 100644
|
||||
--- a/shared/templates/file_owner/tests/missing_file_test.pass.sh
|
||||
+++ b/shared/templates/file_owner/tests/missing_file_test.pass.sh
|
||||
@@ -1,8 +1,18 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
|
||||
-{{% if MISSING_FILE_PASS %}}
|
||||
- rm -f {{{ FILEPATH }}}
|
||||
-{{% else %}}
|
||||
- true
|
||||
-{{% endif %}}
|
||||
+{{% for path in FILEPATH %}}
|
||||
+ {{% if MISSING_FILE_PASS %}}
|
||||
+ rm -f {{{ path }}}
|
||||
+ {{% else %}}
|
||||
+ {{% if IS_DIRECTORY and RECURSIVE %}}
|
||||
+ find -L {{{ path }}} -type d -exec chown {{{ FILEUID }}} {} \;
|
||||
+ {{% else %}}
|
||||
+ if [ ! -f {{{ path }}} ]; then
|
||||
+ mkdir -p "$(dirname '{{{ path }}}')"
|
||||
+ touch {{{ path }}}
|
||||
+ fi
|
||||
+ chown {{{ FILEUID }}} {{{ path }}}
|
||||
+ {{% endif %}}
|
||||
+ {{% endif %}}
|
||||
+{{% endfor %}}
|
||||
@ -1,409 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh
|
||||
new file mode 100644
|
||||
index 00000000000..93fd73e6ece
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh
|
||||
@@ -0,0 +1,14 @@
|
||||
+# platform = multi_platform_ubuntu
|
||||
+
|
||||
+readarray -t files < <(find /var/log/)
|
||||
+for file in "${files[@]}"; do
|
||||
+ if basename $file | grep -qE '^.*$'; then
|
||||
+ chmod 0640 $file
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+if grep -qE "^f \/var\/log\/(btmp|wtmp|lastlog)? " /usr/lib/tmpfiles.d/var.conf; then
|
||||
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/btmp[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
|
||||
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/wtmp[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
|
||||
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/lastlog[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml
|
||||
deleted file mode 100644
|
||||
index dd95ce05936..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml
|
||||
+++ /dev/null
|
||||
@@ -1,36 +0,0 @@
|
||||
-<def-group>
|
||||
- <definition class="compliance" id="permissions_local_var_log" version="1">
|
||||
- {{{ oval_metadata("
|
||||
- Checks that files in /var/log have permission at least 0640
|
||||
- ") }}}
|
||||
- <criteria operator="AND">
|
||||
- <criterion test_ref="test_mode_log_files" />
|
||||
- </criteria>
|
||||
- </definition>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="log file with less restrictive permission than 0640" id="test_mode_log_files" version="1">
|
||||
- <unix:object object_ref="object_file_mode_log_files" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_object comment="log files" id="object_file_mode_log_files" version="1">
|
||||
- <unix:path operation="pattern match">^\/var\/log\/</unix:path>
|
||||
- <unix:filename operation="pattern match">^.*$</unix:filename>
|
||||
- <filter action="include">log_files_permission_more_0640</filter>
|
||||
- <filter action="exclude">var_log_symlinks</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_state id="log_files_permission_more_0640" version="1" operator="OR">
|
||||
- <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
|
||||
- <unix:uexec datatype="boolean">true</unix:uexec>
|
||||
- <unix:gwrite datatype="boolean">true</unix:gwrite>
|
||||
- <unix:gexec datatype="boolean">true</unix:gexec>
|
||||
- <unix:oread datatype="boolean">true</unix:oread>
|
||||
- <unix:owrite datatype="boolean">true</unix:owrite>
|
||||
- <unix:oexec datatype="boolean">true</unix:oexec>
|
||||
- </unix:file_state>
|
||||
-
|
||||
- <unix:file_state id="var_log_symlinks" version="1">
|
||||
- <unix:type operation="equals">symbolic link</unix:type>
|
||||
- </unix:file_state>
|
||||
-
|
||||
-</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
|
||||
index 2b0431b7763..9ce79cfde4e 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
|
||||
@@ -47,3 +47,10 @@ ocil: |-
|
||||
<pre>
|
||||
sudo find /var/log -perm /137 -type f -exec stat -c "%n %a" {} \;
|
||||
</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath: /var/log/
|
||||
+ file_regex: '.*'
|
||||
+ filemode: '0640'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
|
||||
index 5317ef272b8..1793259cff5 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
|
||||
@@ -1,5 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
+chmod -R 640 /var/log
|
||||
mkdir -p /var/log/testme
|
||||
touch /var/log/testme/test.log
|
||||
chmod 640 /var/log/testme/test.log
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
|
||||
index 83db1acf8d3..69b081473a5 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
|
||||
@@ -1,4 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
+chmod -R 640 /var/log/
|
||||
mkdir -p /var/log/testme
|
||||
chmod 777 /var/log/testme
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh
|
||||
new file mode 100644
|
||||
index 00000000000..93962ea66a7
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+# platform = multi_platform_ubuntu
|
||||
+
|
||||
+chmod 0755 /var/log/
|
||||
+
|
||||
+if grep -q "^z \/var\/log " /usr/lib/tmpfiles.d/00rsyslog.conf; then
|
||||
+ sed -i --follow-symlinks "s/\(^z[[:space:]]\+\/var\/log[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10755/" /usr/lib/tmpfiles.d/00rsyslog.conf
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..73258d40fdc
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml
|
||||
@@ -0,0 +1,28 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Verify Permissions on /var/log/syslog File'
|
||||
+
|
||||
+description: |-
|
||||
+ {{{ describe_file_permissions(file="/var/log/syslog", perms="0640") }}}
|
||||
+
|
||||
+rationale: |-
|
||||
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
|
||||
+ the system and should only be accessed by authorized personnel.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001314
|
||||
+ srg: SRG-OS-000206-GPOS-00084
|
||||
+ stigid@ubuntu2004: UBTU-20-010422
|
||||
+
|
||||
+ocil_clause: '{{{ ocil_clause_file_permissions(file="/var/log/syslog", perms="-rw-r-----") }}}'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_file_permissions(file="/var/log/syslog", perms="-rw-r-----") }}}
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath: /var/log/syslog
|
||||
+ filemode: '0640'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..a666c768870
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml
|
||||
@@ -0,0 +1,57 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+title: 'Verify that System Executable Directories Have Restrictive Permissions'
|
||||
+
|
||||
+description: |-
|
||||
+ System executables are stored in the following directories by default:
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/sbin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin</pre>
|
||||
+ These directories should not be group-writable or world-writable.
|
||||
+ If any directory <i>DIR</i> in these directories is found to be
|
||||
+ group-writable or world-writable, correct its permission with the
|
||||
+ following command:
|
||||
+ <pre>$ sudo chmod go-w <i>DIR</i></pre>
|
||||
+
|
||||
+rationale: |-
|
||||
+ System binaries are executed by privileged users, as well as system services,
|
||||
+ and restrictive permissions are necessary to ensure execution of these programs
|
||||
+ cannot be co-opted.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001495
|
||||
+ srg: SRG-OS-000258-GPOS-00099
|
||||
+ stigid@ubuntu2004: UBTU-20-010423
|
||||
+
|
||||
+ocil_clause: 'any of these files are group-writable or world-writable'
|
||||
+
|
||||
+ocil: |-
|
||||
+ System executables are stored in the following directories by default:
|
||||
+ <pre>/bin
|
||||
+ /sbin
|
||||
+ /usr/bin
|
||||
+ /usr/sbin
|
||||
+ /usr/local/bin
|
||||
+ /usr/local/sbin</pre>
|
||||
+ To find system executables directories that are group-writable or
|
||||
+ world-writable, run the following command for each directory <i>DIR</i>
|
||||
+ which contains system executables:
|
||||
+ <pre>$ sudo find -L <i>DIR</i> -perm /022 -type d</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /bin/
|
||||
+ - /sbin/
|
||||
+ - /usr/bin/
|
||||
+ - /usr/sbin/
|
||||
+ - /usr/local/bin/
|
||||
+ - /usr/local/sbin/
|
||||
+ recursive: 'true'
|
||||
+ filemode: '0755'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
index 3f7239deef9..af078463b05 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
find "$dirPath" -perm /022 -type d -exec chmod go-w '{}' \;
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
index 1f68586853d..d58616bcafb 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
||||
@@ -1,5 +1,6 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
+ chmod -R 755 "$dirPath"
|
||||
mkdir -p "$dirPath/testme" && chmod 700 "$dirPath/testme"
|
||||
done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
index b60a7269568..98d18cde3ea 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
DIRS="/lib /lib64"
|
||||
for dirPath in $DIRS; do
|
||||
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
index 5438b51bb6a..6df6e2f8f9b 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_ubuntu
|
||||
DIRS="/usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..da42e997478
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: ubuntu2004
|
||||
+
|
||||
+title: 'Verify that audit tools Have Mode 0755 or less'
|
||||
+
|
||||
+description: |-
|
||||
+ The {{{ full_name }}} operating system audit tools must have the proper
|
||||
+ permissions configured to protected against unauthorized access.
|
||||
+
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl 755
|
||||
+ /sbin/aureport 755
|
||||
+ /sbin/ausearch 755
|
||||
+ /sbin/autrace 755
|
||||
+ /sbin/auditd 755
|
||||
+ /sbin/audispd 755
|
||||
+ /sbin/augenrules 755
|
||||
+ </pre>
|
||||
+
|
||||
+ Audit tools needed to successfully view and manipulate audit information
|
||||
+ system activity and records. Audit tools include custom queries and report
|
||||
+ generators
|
||||
+
|
||||
+rationale: |-
|
||||
+ Protecting audit information also includes identifying and protecting the
|
||||
+ tools used to view and manipulate log data. Therefore, protecting audit
|
||||
+ tools is necessary to prevent unauthorized operation on audit information.
|
||||
+
|
||||
+ Operating systems providing tools to interface with audit information
|
||||
+ will leverage user permissions and roles identifying the user accessing the
|
||||
+ tools and the corresponding rights the user enjoys to make access decisions
|
||||
+ regarding the access to audit tools.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+references:
|
||||
+ disa: CCI-001493,CCI-001494
|
||||
+ srg: SRG-OS-000256-GPOS-00097,SRG-OS-000257-GPOS-00098
|
||||
+ stigid@ubuntu2004: UBTU-20-010199
|
||||
+
|
||||
+ocil: |-
|
||||
+ Verify it by running the following command:
|
||||
+ <pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
|
||||
+
|
||||
+ /sbin/auditctl 755
|
||||
+ /sbin/aureport 755
|
||||
+ /sbin/ausearch 755
|
||||
+ /sbin/autrace 755
|
||||
+ /sbin/auditd 755
|
||||
+ /sbin/audispd 755
|
||||
+ /sbin/augenrules 755
|
||||
+ </pre>
|
||||
+
|
||||
+ If the command does not return all the above lines, the missing ones
|
||||
+ need to be added.
|
||||
+
|
||||
+ Run the following command to correct the permissions of the missing
|
||||
+ entries:
|
||||
+ <pre>$ sudo chmod 0755 [audit_tool] </pre>
|
||||
+
|
||||
+ Replace "[audit_tool]" with the audit tool that does not have the
|
||||
+ correct permissions.
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /sbin/auditctl
|
||||
+ - /sbin/aureport
|
||||
+ - /sbin/ausearch
|
||||
+ - /sbin/autrace
|
||||
+ - /sbin/auditd
|
||||
+ - /sbin/audispd
|
||||
+ - /sbin/augenrules
|
||||
+ filemode: '0755'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
|
||||
index de2e1e98dfa..ab89b277a52 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle
|
||||
+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
|
||||
DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
|
||||
for dirPath in $DIRS; do
|
||||
find "$dirPath" -perm /022 -exec chmod go-w '{}' \;
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..59b8838581c
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
|
||||
+for dirPath in $DIRS; do
|
||||
+ find "$dirPath" -perm /022 -type f -exec chmod 0755 '{}' \;
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..9d9ce30064b
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
|
||||
+for dirPath in $DIRS; do
|
||||
+ find "$dirPath" -type f -exec chmod 0777 '{}' \;
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..de388e63325
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
+for dirPath in $DIRS; do
|
||||
+ chmod -R 755 "$dirPath"
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..913e75e7b17
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
+for dirPath in $DIRS; do
|
||||
+ find "$dirPath" -type d -exec chmod go-w '{}' \;
|
||||
+ find "$dirPath" -type f -exec chmod go+w '{}' \;
|
||||
+done
|
||||
diff --git a/shared/templates/file_permissions/oval.template b/shared/templates/file_permissions/oval.template
|
||||
index 89083e812c1..6b3616a7f42 100644
|
||||
--- a/shared/templates/file_permissions/oval.template
|
||||
+++ b/shared/templates/file_permissions/oval.template
|
||||
@@ -67,6 +67,11 @@
|
||||
#}}
|
||||
<filter action="include">state_file_permissions{{{ FILEID }}}_{{{ loop.index0 }}}_mode_not_{{{ FILEMODE }}}</filter>
|
||||
{{%- endif %}}
|
||||
+ <filter action="exclude">exclude_symlinks_{{{ FILEID }}}</filter>
|
||||
</unix:file_object>
|
||||
{{% endfor %}}
|
||||
+
|
||||
+ <unix:file_state id="exclude_symlinks_{{{ FILEID }}}" version="1">
|
||||
+ <unix:type operation="equals">symbolic link</unix:type>
|
||||
+ </unix:file_state>
|
||||
</def-group>
|
||||
@ -1,44 +0,0 @@
|
||||
From 1c054ed40a4dbc2a48ffe7720d018c317cad8105 Mon Sep 17 00:00:00 2001
|
||||
From: Watson Sato <wsato@redhat.com>
|
||||
Date: Tue, 15 Feb 2022 14:12:55 +0100
|
||||
Subject: [PATCH] Simply mask services that should be disabled
|
||||
|
||||
At some point Ansible started to return much more services in
|
||||
ansible_facts.services, including services that are not installed.
|
||||
This caused the task to think that the service exists, attempt to stop
|
||||
and mask the service.
|
||||
But systemd module fatal errors on non existing services, although the
|
||||
module ends up masking the service in question.
|
||||
|
||||
The bash remediations simply mask the service, even if it is not
|
||||
installed.
|
||||
Let's do the same with Ansible, mask the service and ignore errors.
|
||||
|
||||
One down side is that every non-existing service is reported as an
|
||||
error, which is ignored. But still a fatal error.
|
||||
---
|
||||
shared/templates/service_disabled/ansible.template | 5 +----
|
||||
1 file changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
diff --git a/shared/templates/service_disabled/ansible.template b/shared/templates/service_disabled/ansible.template
|
||||
index 550ed563056..254f41ac7fd 100644
|
||||
--- a/shared/templates/service_disabled/ansible.template
|
||||
+++ b/shared/templates/service_disabled/ansible.template
|
||||
@@ -6,16 +6,13 @@
|
||||
{{%- if init_system == "systemd" %}}
|
||||
- name: Disable service {{{ SERVICENAME }}}
|
||||
block:
|
||||
- - name: Gather the service facts
|
||||
- service_facts:
|
||||
-
|
||||
- name: Disable service {{{ SERVICENAME }}}
|
||||
systemd:
|
||||
name: "{{{ DAEMONNAME }}}.service"
|
||||
enabled: "no"
|
||||
state: "stopped"
|
||||
masked: "yes"
|
||||
- when: '"{{{ DAEMONNAME }}}.service" in ansible_facts.services'
|
||||
+ ignore_errors: 'yes'
|
||||
|
||||
- name: "Unit Socket Exists - {{{ DAEMONNAME }}}.socket"
|
||||
command: systemctl list-unit-files {{{ DAEMONNAME }}}.socket
|
||||
@ -1,22 +0,0 @@
|
||||
From 50eb163d9e9751c2e8cf8129523a8cf7e07a5930 Mon Sep 17 00:00:00 2001
|
||||
From: Matthew Burket <mburket@redhat.com>
|
||||
Date: Thu, 17 Feb 2022 12:49:32 -0600
|
||||
Subject: [PATCH] get_implemented_stigs in utils/create_scap_delta_tailoring.py
|
||||
should return the implemented stig items
|
||||
|
||||
---
|
||||
utils/create_scap_delta_tailoring.py | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/utils/create_scap_delta_tailoring.py b/utils/create_scap_delta_tailoring.py
|
||||
index 2c3c5d0df32..25ad1aef66e 100755
|
||||
--- a/utils/create_scap_delta_tailoring.py
|
||||
+++ b/utils/create_scap_delta_tailoring.py
|
||||
@@ -127,6 +127,7 @@ def get_implemented_stigs(product, root_path, build_config_yaml_path,
|
||||
known_rules[ref].append(rule['id'])
|
||||
else:
|
||||
known_rules[ref] = [rule['id']]
|
||||
+ return known_rules
|
||||
|
||||
|
||||
get_implemented_stigs.__annotations__ = {'product': str, 'root_path': str,
|
||||
@ -1,116 +0,0 @@
|
||||
From bc2f72ff8a23b508cef88a363e75e73474625775 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Tue, 22 Feb 2022 17:15:43 +0100
|
||||
Subject: [PATCH 1/3] remove extend definition from ovals
|
||||
|
||||
---
|
||||
.../software/integrity/fips/enable_fips_mode/oval/rhcos4.xml | 1 -
|
||||
.../software/integrity/fips/enable_fips_mode/oval/shared.xml | 1 -
|
||||
2 files changed, 2 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
|
||||
index c5ae0550e6b..52d86fd4478 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
|
||||
@@ -5,7 +5,6 @@
|
||||
<extend_definition comment="check /etc/system-fips exists" definition_ref="etc_system_fips_exists" />
|
||||
<extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="proc_sys_crypto_fips_enabled" />
|
||||
<extend_definition comment="system cryptography policy is configured" definition_ref="configure_crypto_policy" />
|
||||
- <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
|
||||
<criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="test_system_crypto_policy_value" />
|
||||
</criteria>
|
||||
</definition>
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
|
||||
index 699dca06dd1..6c3f57e143f 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
|
||||
@@ -6,7 +6,6 @@
|
||||
<extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="sysctl_crypto_fips_enabled" />
|
||||
<extend_definition comment="Dracut FIPS module is enabled" definition_ref="enable_dracut_fips_module" />
|
||||
<extend_definition comment="system cryptography policy is configured" definition_ref="configure_crypto_policy" />
|
||||
- <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
|
||||
<criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="test_system_crypto_policy_value" />
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
From dbbea1998e189c4a27edc700478f55e2dfda56f8 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Tue, 22 Feb 2022 17:17:28 +0100
|
||||
Subject: [PATCH 2/3] chang warning and description
|
||||
|
||||
---
|
||||
.../integrity/fips/enable_fips_mode/rule.yml | 25 ++++---------------
|
||||
1 file changed, 5 insertions(+), 20 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
index 9d89114b07f..6b055eac8ff 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
@@ -13,11 +13,9 @@ description: |-
|
||||
<ul>
|
||||
<li>Setting the kernel FIPS mode flag (<tt>/proc/sys/crypto/fips_enabled</tt>) to <tt>1</tt></li>
|
||||
<li>Creating <tt>/etc/system-fips</tt></li>
|
||||
- <li>Setting the system crypto policy in <tt>/etc/crypto-policies/config</tt> to <tt>FIPS</tt></li>
|
||||
+ <li>Setting the system crypto policy in <tt>/etc/crypto-policies/config</tt> to <tt>{{{ xccdf_value("var_system_crypto_policy") }}}</tt></li>
|
||||
<li>Loading the Dracut <tt>fips</tt> module</li>
|
||||
</ul>
|
||||
- This rule also ensures that the system policy is set to <tt>{{{ xccdf_value("var_system_crypto_policy") }}}</tt>.
|
||||
- Furthermore, the system running in FIPS mode should be FIPS certified by NIST.
|
||||
|
||||
rationale: |-
|
||||
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
|
||||
@@ -48,7 +46,7 @@ references:
|
||||
ocil_clause: 'FIPS mode is not enabled'
|
||||
|
||||
ocil: |-
|
||||
- To verify that FIPS is enabled properly, run the following command:
|
||||
+ To verify that FIPS mode is enabled properly, run the following command:
|
||||
<pre>fips-mode-setup --check</pre>
|
||||
The output should contain the following:
|
||||
<pre>FIPS mode is enabled.</pre>
|
||||
@@ -61,19 +59,6 @@ warnings:
|
||||
- general: |-
|
||||
The system needs to be rebooted for these changes to take effect.
|
||||
- regulatory: |-
|
||||
- System Crypto Modules must be provided by a vendor that undergoes
|
||||
- FIPS-140 certifications.
|
||||
- FIPS-140 is applicable to all Federal agencies that use
|
||||
- cryptographic-based security systems to protect sensitive information
|
||||
- in computer and telecommunication systems (including voice systems) as
|
||||
- defined in Section 5131 of the Information Technology Management Reform
|
||||
- Act of 1996, Public Law 104-106. This standard shall be used in
|
||||
- designing and implementing cryptographic modules that Federal
|
||||
- departments and agencies operate or are operated for them under
|
||||
- contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
|
||||
- To meet this, the system has to have cryptographic software provided by
|
||||
- a vendor that has undergone this certification. This means providing
|
||||
- documentation, test results, design information, and independent third
|
||||
- party review by an accredited lab. While open source software is
|
||||
- capable of meeting this, it does not meet FIPS-140 unless the vendor
|
||||
- submits to this process.
|
||||
+ This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
|
||||
+ You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.rip/groups/STM/cmvp/documents/140-1/1401vend.htm") }}}.
|
||||
+ This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.
|
||||
|
||||
From 3c72eec95c617ee295099522d2817c6d217a7e63 Mon Sep 17 00:00:00 2001
|
||||
From: vojtapolasek <krecoun@gmail.com>
|
||||
Date: Wed, 23 Feb 2022 09:16:09 +0100
|
||||
Subject: [PATCH 3/3] Update
|
||||
linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
|
||||
Co-authored-by: Gabriel Becker <ggasparb@redhat.com>
|
||||
---
|
||||
.../system/software/integrity/fips/enable_fips_mode/rule.yml | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
index 6b055eac8ff..30cbc939bed 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
@@ -60,5 +60,5 @@ warnings:
|
||||
The system needs to be rebooted for these changes to take effect.
|
||||
- regulatory: |-
|
||||
This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
|
||||
- You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.rip/groups/STM/cmvp/documents/140-1/1401vend.htm") }}}.
|
||||
+ You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search") }}}.
|
||||
This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.
|
||||
@ -1,854 +0,0 @@
|
||||
From 51a826878ade2ebb564405991937ba0e2b2b7717 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 2 Feb 2022 14:25:30 +0100
|
||||
Subject: [PATCH 1/8] create two macros
|
||||
|
||||
one provides description for grub2_argument templated rules
|
||||
the second provides ocil for those cases
|
||||
---
|
||||
shared/macros.jinja | 56 +++++++++++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 56 insertions(+)
|
||||
|
||||
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
||||
index 00358e2f67c..3d41c998b0c 100644
|
||||
--- a/shared/macros.jinja
|
||||
+++ b/shared/macros.jinja
|
||||
@@ -1620,3 +1620,59 @@ The audit daemon must be restarted for the changes to take effect.
|
||||
- no_ovirt
|
||||
{{%- endif %}}
|
||||
{{% endmacro %}}
|
||||
+
|
||||
+{{#
|
||||
+ Describe how to configure Grub2 to add an argument to the default kernel command line.
|
||||
+ The parameter should be in form `parameter=value`.
|
||||
+#}}
|
||||
+{{%- macro describe_grub2_argument(arg_name_value) -%}}
|
||||
+{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
|
||||
+To ensure that <tt>{{{ arg_name_value }}}</tt> is added as a kernel command line
|
||||
+argument to newly installed kernels, ad <tt>{{{ arg_name_value }}}</tt> to the
|
||||
+default Grub2 command line for Linux operating systems. Modify the line within
|
||||
+<tt>/etc/default/grub</tt> as shown below:
|
||||
+<pre>GRUB_CMDLINE_LINUX="... {{{ arg_name_value }}} ..."</pre>
|
||||
+Run the following command to update command line for already installed kernels:
|
||||
+{{%- if 'ubuntu' in product -%}}
|
||||
+<pre># update-grub</pre>
|
||||
+{{%- else -%}}
|
||||
+<pre># grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"</pre>
|
||||
+{{%- endif -%}}
|
||||
+{{%- else -%}}
|
||||
+Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}} as follows:
|
||||
+<pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) {{{ arg_name_value }}}"</pre>
|
||||
+{{%- endif -%}}
|
||||
+{{%- endmacro -%}}
|
||||
+
|
||||
+{{#
|
||||
+ Provide OCIL for checking if an argument for kernel command line is configured with Grub2.
|
||||
+ The parameter should have form `parameter=value`.
|
||||
+#}}
|
||||
+{{%- macro ocil_grub2_argument(arg_name_value) -%}}
|
||||
+{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
|
||||
+Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
+in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
|
||||
+then auditinng will be enabled for newly installed kernels.
|
||||
+First check if the GRUB recovery is enabled:
|
||||
+<pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
|
||||
+If this option is set to true, then check that a line is output by the following command:
|
||||
+<pre>$ grep 'GRUB_CMDLINE_LINUX_DEFAULT.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>
|
||||
+If the recovery is disabled, check the line with
|
||||
+<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
|
||||
+{{%- if 'ubuntu' in product -%}}
|
||||
+Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
|
||||
+<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
|
||||
+This command should not return any output.
|
||||
+{{%- else -%}}
|
||||
+Moreover, command line parameters for currently installed kernels should be checked as well.
|
||||
+Run the following command:
|
||||
+<pre># grubby --info=ALL | grep args | grep -v '{{{ arg_name_value }}}'</pre>
|
||||
+The command should not return any output.
|
||||
+{{%- endif -%}}
|
||||
+{{%- else -%}}
|
||||
+Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then auditing
|
||||
+is enabled at boot time.
|
||||
+<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
+{{%- endif -%}}
|
||||
+{{%- endmacro -%}}
|
||||
|
||||
From c8cb579db19bd55eebcb0bdc4b1432368a5c1b77 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 2 Feb 2022 14:26:26 +0100
|
||||
Subject: [PATCH 2/8] use new macros in grub2_audit_argument
|
||||
|
||||
---
|
||||
.../auditing/grub2_audit_argument/rule.yml | 45 ++-----------------
|
||||
1 file changed, 3 insertions(+), 42 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
index 96dbe67699e..aff0521ee73 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
@@ -7,15 +7,8 @@ title: 'Enable Auditing for Processes Which Start Prior to the Audit Daemon'
|
||||
description: |-
|
||||
To ensure all processes can be audited, even those which start
|
||||
prior to the audit daemon, add the argument <tt>audit=1</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
-{{% if product in ["rhel7", "ol7"] %}}
|
||||
- <tt>/etc/default/grub</tt>, so that the line looks similar to
|
||||
- <pre>GRUB_CMDLINE_LINUX="... audit=1 ..."</pre>
|
||||
- In case the <tt>GRUB_DISABLE_RECOVERY</tt> is set to true, then the parameter should be added to the <tt>GRUB_CMDLINE_LINUX_DEFAULT</tt> instead.
|
||||
-{{% else %}}
|
||||
- <tt>{{{ grub2_boot_path }}}/grubenv</tt>, in the manner below:
|
||||
- <pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</pre>
|
||||
-{{% endif %}}
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("audit=1") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Each process on the system carries an "auditable" flag which indicates whether
|
||||
@@ -59,39 +52,7 @@ references:
|
||||
ocil_clause: 'auditing is not enabled at boot time'
|
||||
|
||||
ocil: |-
|
||||
-{{% if product in ["rhel7", "ol7", "sle12","sle15"] %}}
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If it includes <tt>audit=1</tt>, then auditing
|
||||
- is enabled at boot time.
|
||||
- First check if the GRUB recovery is enabled:
|
||||
- <pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
|
||||
- If this option is set to true, then check that a line is output by the following command:
|
||||
- <pre>$ grep 'GRUB_CMDLINE_LINUX_DEFAULT.*audit=1.*' /etc/default/grub</pre>
|
||||
- If the recovery is disabled, check the line with
|
||||
- <pre>$ grep 'GRUB_CMDLINE_LINUX.*audit=1.*' /etc/default/grub</pre>.
|
||||
- Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
|
||||
- <pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v 'audit=1'</pre>
|
||||
- This command should not return any output. If it does, update the configuration with
|
||||
- <pre># grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
|
||||
- <br /><br />
|
||||
- Alternatively, to ensure <tt>audit=1</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="audit=1"</pre>
|
||||
- <br />
|
||||
-{{% else %}}
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>audit=1</tt>, then auditing
|
||||
- is enabled at boot time.
|
||||
- <pre># grep 'kernelopts.*audit=1.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
- <br /><br />
|
||||
- To ensure <tt>audit=1</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</pre>
|
||||
- <br />
|
||||
-{{% endif %}}
|
||||
-
|
||||
+ {{{ ocil_grub2_argument("audit=1") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
|
||||
From 3ff2c245408d3fe892222eee8171e2f84868f705 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Thu, 3 Feb 2022 14:25:34 +0100
|
||||
Subject: [PATCH 3/8] fix omission in ocil jinja macro
|
||||
|
||||
---
|
||||
shared/macros.jinja | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
||||
index 3d41c998b0c..16a0404b668 100644
|
||||
--- a/shared/macros.jinja
|
||||
+++ b/shared/macros.jinja
|
||||
@@ -1652,7 +1652,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
|
||||
{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
|
||||
Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
|
||||
-then auditinng will be enabled for newly installed kernels.
|
||||
+then the parameter will be configured for newly installed kernels.
|
||||
First check if the GRUB recovery is enabled:
|
||||
<pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
|
||||
If this option is set to true, then check that a line is output by the following command:
|
||||
@@ -1671,8 +1671,8 @@ The command should not return any output.
|
||||
{{%- endif -%}}
|
||||
{{%- else -%}}
|
||||
Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
-in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then auditing
|
||||
-is enabled at boot time.
|
||||
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
|
||||
+is configured at boot time.
|
||||
<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
{{%- endif -%}}
|
||||
{{%- endmacro -%}}
|
||||
|
||||
From 976da69681d03d9b9380fc57216c30c7b4891f50 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Thu, 3 Feb 2022 14:26:33 +0100
|
||||
Subject: [PATCH 4/8] use new jinja macros in all grub2 related rules
|
||||
|
||||
---
|
||||
.../rule.yml | 15 ++-----
|
||||
.../grub2_enable_iommu_force/rule.yml | 9 +++-
|
||||
.../grub2_init_on_alloc_argument/rule.yml | 18 ++------
|
||||
.../grub2_kernel_trust_cpu_rng/rule.yml | 11 ++---
|
||||
.../grub2_pti_argument/rule.yml | 15 ++-----
|
||||
.../grub2_vsyscall_argument/rule.yml | 15 ++-----
|
||||
.../grub2_ipv6_disable_argument/rule.yml | 45 ++-----------------
|
||||
.../grub2_page_poison_argument/rule.yml | 15 ++-----
|
||||
.../grub2_slub_debug_argument/rule.yml | 15 ++-----
|
||||
9 files changed, 33 insertions(+), 125 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
index f94ddab2fe1..868d525014f 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
@@ -7,9 +7,8 @@ title: 'Extend Audit Backlog Limit for the Audit Daemon'
|
||||
description: |-
|
||||
To improve the kernel capacity to queue all log events, even those which occurred
|
||||
prior to the audit daemon, add the argument <tt>audit_backlog_limit=8192</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
- <tt>/etc/default/grub</tt>, in the manner below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192"</pre>
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
audit_backlog_limit sets the queue length for audit events awaiting transfer
|
||||
@@ -40,15 +39,7 @@ references:
|
||||
ocil_clause: 'audit backlog limit is not configured'
|
||||
|
||||
ocil: |-
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If they include <tt>audit=1</tt>, then auditing
|
||||
- is enabled at boot time.
|
||||
- <br /><br />
|
||||
- To ensure <tt>audit_backlog_limit=8192</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"</pre>
|
||||
- <br />
|
||||
+ {{{ ocil_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
|
||||
index 0a0d76aeb23..1ff5a4d5f26 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
|
||||
@@ -5,9 +5,10 @@ title: 'IOMMU configuration directive'
|
||||
description: |-
|
||||
On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some
|
||||
of the system critical units such as the memory.
|
||||
+ {{{ describe_grub2_argument("iommu=force") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
- On x86 architectures, activating the I/OMMU prevents the system from arbritrary accesses potentially made by
|
||||
+ On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by
|
||||
hardware devices.
|
||||
|
||||
severity: unknown
|
||||
@@ -22,6 +23,12 @@ references:
|
||||
|
||||
platform: machine
|
||||
|
||||
+ocil_clause: 'I/OMMU is not activated'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_grub2_argument("iommu=force") | indent(4) }}}
|
||||
+
|
||||
+
|
||||
warnings:
|
||||
- functionality:
|
||||
Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities.
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
index a9253c74cc6..3bb645dadb7 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
@@ -6,12 +6,8 @@ title: 'Configure kernel to zero out memory before allocation'
|
||||
|
||||
description: |-
|
||||
To configure the kernel to zero out memory before allocating it, add the
|
||||
- <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line for
|
||||
- the Linux operating system in <tt>/etc/default/grub</tt>, in the manner
|
||||
- below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="crashkernel=auto quiet rd.shell=0 audit=1 audit_backlog_limit=8192 init_on_alloc=1"</pre>
|
||||
- Update the boot parameter for existing kernels by running the following command:
|
||||
- <pre># grubby --update-kernel=ALL --args="init_on_alloc=1"</pre>
|
||||
+ <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line.
|
||||
+ {{{ describe_grub2_argument("init_on_alloc=1") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
|
||||
@@ -27,15 +23,7 @@ identifiers:
|
||||
ocil_clause: 'the kernel is not configured to zero out memory before allocation'
|
||||
|
||||
ocil: |-
|
||||
- Make sure that the kernel is configured to zero out memory before
|
||||
- allocation. Ensure that the parameter is configured in
|
||||
- <tt>/etc/default/grub</tt>:
|
||||
- <pre>grep GRUB_CMDLINE_LINUX /etc/default/grub</pre>
|
||||
- The output should contain <tt>init_on_alloc=1</tt>.
|
||||
- Run the following command to display command line parameters of all
|
||||
- installed kernels:
|
||||
- <pre># grubby --info=ALL | grep args</pre>
|
||||
- Ensure that each line contains the <tt>init_on_alloc=1</tt> parameter.
|
||||
+ {{{ ocil_grub2_argument("init_on_alloc=1") | indent(4) }}}
|
||||
|
||||
platform: machine
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
|
||||
index 308ae9cb735..d6bfc02f345 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
|
||||
@@ -11,8 +11,8 @@ description: |-
|
||||
<tt>Y</tt>, make sure that it is not overridden with the boot parameter.
|
||||
There must not exist the boot parameter <tt>random.trust_cpu=off</tt>. If
|
||||
the option is not compiled in, make sure that <tt>random.trust_cpu=on</tt>
|
||||
- is configured as a boot parameter by running the following command:
|
||||
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) random.trust_cpu=on"</pre>
|
||||
+ is configured as a boot parameter.
|
||||
+ {{{ describe_grub2_argument("random.trust_cpu=on") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
The Linux kernel offers an option which signifies if the kernel should trust
|
||||
@@ -44,11 +44,8 @@ ocil: |-
|
||||
option is not overridden through a boot parameter:
|
||||
<pre>sudo grep 'kernelopts.*random\.trust_cpu=off.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
The command should not return any output. If the option is not compiled into
|
||||
- the kernel, check that the option is configured through boot parameter with
|
||||
- the following command:
|
||||
- <pre>sudo grep 'kernelopts.*random\.trust_cpu=on.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
- If the command does not return any output, then the boot parameter is
|
||||
- missing.
|
||||
+ the kernel, check that the option is configured through boot parameter.
|
||||
+ {{{ ocil_grub2_argument("random.trust_cpu=on") | indent(4) }}}
|
||||
|
||||
platform: machine
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
index f4f3fa39510..51b0a284746 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
@@ -7,9 +7,8 @@ title: 'Enable Kernel Page-Table Isolation (KPTI)'
|
||||
description: |-
|
||||
To enable Kernel page-table isolation,
|
||||
add the argument <tt>pti=on</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
- <tt>/etc/default/grub</tt>, in the manner below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="pti=on"</pre>
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("pti=on") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Kernel page-table isolation is a kernel feature that mitigates
|
||||
@@ -33,15 +32,7 @@ references:
|
||||
ocil_clause: 'Kernel page-table isolation is not enabled'
|
||||
|
||||
ocil: |-
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If they include <tt>pti=on</tt>,
|
||||
- then Kernel page-table isolation is enabled at boot time.
|
||||
- <br /><br />
|
||||
- To ensure <tt>pti=on</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="pti=on</pre>
|
||||
- <br />
|
||||
+ {{{ ocil_grub2_argument("pti=on") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
index 9f38a1c13b9..1b88d13bd3c 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
@@ -7,9 +7,8 @@ title: 'Disable vsyscalls'
|
||||
description: |-
|
||||
To disable use of virtual syscalls,
|
||||
add the argument <tt>vsyscall=none</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
- <tt>/etc/default/grub</tt>, in the manner below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="vsyscall=none"</pre>
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("vsyscall=none") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Virtual Syscalls provide an opportunity of attack for a user who has control
|
||||
@@ -33,15 +32,7 @@ references:
|
||||
ocil_clause: 'vsyscalls are enabled'
|
||||
|
||||
ocil: |-
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If they include <tt>vsyscall=none</tt>,
|
||||
- then virtyal syscalls are not enabled at boot time.
|
||||
- <br /><br />
|
||||
- To ensure <tt>vsyscall=none</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="vsyscall=none</pre>
|
||||
- <br />
|
||||
+ {{{ ocil_grub2_argument("vsyscall=none") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
index b8ff66c7d6e..c0fda343a1a 100644
|
||||
--- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
@@ -7,20 +7,8 @@ title: 'Ensure IPv6 is disabled through kernel boot parameter'
|
||||
description: |-
|
||||
To disable IPv6 protocol support in the Linux kernel,
|
||||
add the argument <tt>ipv6.disable=1</tt> to the default
|
||||
- GRUB2 command line for the Linux operating system in
|
||||
-{{% if product in ["rhel7", "ol7"] %}}
|
||||
- <tt>/etc/default/grub</tt>, so that the line looks similar to
|
||||
- <pre>GRUB_CMDLINE_LINUX="... ipv6.disable=1 ..."</pre>
|
||||
- In case the <tt>GRUB_DISABLE_RECOVERY</tt> is set to true, then the parameter should be added to the <tt>GRUB_CMDLINE_LINUX_DEFAULT</tt> instead.
|
||||
- Run one of following command to ensure that the configuration is applied when booting currently installed kernels:
|
||||
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
|
||||
- or
|
||||
- <pre>sudo /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"</pre>
|
||||
-{{% else %}}
|
||||
- <tt>{{{ grub2_boot_path }}}/grubenv</tt>, in the manner below:
|
||||
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</pre>
|
||||
-{{% endif %}}
|
||||
-
|
||||
+ GRUB2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("ipv6.disable=1") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Any unnecessary network stacks, including IPv6, should be disabled to reduce
|
||||
@@ -40,34 +28,7 @@ references:
|
||||
ocil_clause: 'IPv6 is not disabled'
|
||||
|
||||
ocil: |-
|
||||
- {{% if product in ["rhel7", "ol7"] %}}
|
||||
- Inspect the form of default GRUB2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. Check if it includes <tt>ipv6.disable=1</tt>.
|
||||
- First check if the GRUB recovery is enabled:
|
||||
- <pre>grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
|
||||
- If this option is set to true, then check that the following line is output by the following command:
|
||||
- <pre>grep 'GRUB_CMDLINE_LINUX_DEFAULT.*ipv6.disable=1.*' /etc/default/grub</pre>
|
||||
- If the recovery is disabled, check the line with
|
||||
- <pre>grep 'GRUB_CMDLINE_LINUX.*ipv6.disable=1.*' /etc/default/grub</pre>.
|
||||
- Moreover, current GRUB2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
|
||||
- <pre>sudo grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v 'ipv6.disable=1'</pre>
|
||||
- This command should not return any output. If it does, update the configuration with one of following commands:
|
||||
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
|
||||
- or
|
||||
- <pre>sudo /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"</pre>
|
||||
- <br />
|
||||
-{{% else %}}
|
||||
- Inspect the form of default GRUB2 command line for the Linux operating system
|
||||
- in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. Check if it includes <tt>ipv6.disable=1</tt>.
|
||||
- <pre>sudo grep 'kernelopts.*ipv6.disable=1.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
- <br /><br />
|
||||
- To ensure <tt>ipv6.disable=1</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</pre>
|
||||
- <br />
|
||||
-{{% endif %}}
|
||||
-
|
||||
+ {{{ ocil_grub2_argument("ipv6.disable=1") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
index 3bf592fb4d8..1f4e183d9e7 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
@@ -7,9 +7,8 @@ title: 'Enable page allocator poisoning'
|
||||
description: |-
|
||||
To enable poisoning of free pages,
|
||||
add the argument <tt>page_poison=1</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
- <tt>/etc/default/grub</tt>, in the manner below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="page_poison=1"</pre>
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("page_poison=1") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Poisoning writes an arbitrary value to freed pages, so any modification or
|
||||
@@ -35,15 +34,7 @@ references:
|
||||
ocil_clause: 'page allocator poisoning is not enabled'
|
||||
|
||||
ocil: |-
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If they include <tt>page_poison=1</tt>,
|
||||
- then page poisoning is enabled at boot time.
|
||||
- <br /><br />
|
||||
- To ensure <tt>page_poison=1</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="page_poison=1</pre>
|
||||
- <br />
|
||||
+ {{{ ocil_grub2_argument("page_poison=1") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
index 9964399650a..bb5dbc6c125 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
@@ -7,9 +7,8 @@ title: 'Enable SLUB/SLAB allocator poisoning'
|
||||
description: |-
|
||||
To enable poisoning of SLUB/SLAB objects,
|
||||
add the argument <tt>slub_debug=P</tt> to the default
|
||||
- GRUB 2 command line for the Linux operating system in
|
||||
- <tt>/etc/default/grub</tt>, in the manner below:
|
||||
- <pre>GRUB_CMDLINE_LINUX="slub_debug=P"</pre>
|
||||
+ GRUB 2 command line for the Linux operating system.
|
||||
+ {{{ describe_grub2_argument("slub_debug=P") | indent(4) }}}
|
||||
|
||||
rationale: |-
|
||||
Poisoning writes an arbitrary value to freed objects, so any modification or
|
||||
@@ -35,15 +34,7 @@ references:
|
||||
ocil_clause: 'SLUB/SLAB poisoning is not enabled'
|
||||
|
||||
ocil: |-
|
||||
- Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
- in <tt>/etc/default/grub</tt>. If they include <tt>slub_debug=P</tt>,
|
||||
- then SLUB/SLAB poisoning is enabled at boot time.
|
||||
- <br /><br />
|
||||
- To ensure <tt>slub_debug=P</tt> is configured on all installed kernels, the
|
||||
- following command may be used:
|
||||
- <br />
|
||||
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="slub_debug=P</pre>
|
||||
- <br />
|
||||
+ {{{ ocil_grub2_argument("slub_debug=P") | indent(4) }}}
|
||||
|
||||
warnings:
|
||||
- management: |-
|
||||
|
||||
From 5c39cf81d49f0eb5bb73337057fb95356784e5c6 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 16:05:59 +0100
|
||||
Subject: [PATCH 5/8] fix an error in ubuntu version of macro
|
||||
|
||||
---
|
||||
shared/macros.jinja | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
||||
index 16a0404b668..54d2b299a47 100644
|
||||
--- a/shared/macros.jinja
|
||||
+++ b/shared/macros.jinja
|
||||
@@ -1660,7 +1660,7 @@ If this option is set to true, then check that a line is output by the following
|
||||
If the recovery is disabled, check the line with
|
||||
<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
|
||||
{{%- if 'ubuntu' in product -%}}
|
||||
-Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
|
||||
+Moreover, current Grub2 config file in <tt>{{{ grub2_boot_path }}}/grub.cfg</tt> must be checked.
|
||||
<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
|
||||
This command should not return any output.
|
||||
{{%- else -%}}
|
||||
|
||||
From f100d190833d168127715215e788347f806736f3 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 16:16:21 +0100
|
||||
Subject: [PATCH 6/8] remove warnings from rules
|
||||
|
||||
they are no longer relevant, we do not use grub2-mkconfig anymore
|
||||
---
|
||||
.../auditing/grub2_audit_argument/rule.yml | 18 ------------------
|
||||
.../rule.yml | 18 ------------------
|
||||
.../grub2_pti_argument/rule.yml | 18 ------------------
|
||||
.../grub2_vsyscall_argument/rule.yml | 18 ------------------
|
||||
.../grub2_ipv6_disable_argument/rule.yml | 18 ------------------
|
||||
.../grub2_page_poison_argument/rule.yml | 18 ------------------
|
||||
.../grub2_slub_debug_argument/rule.yml | 18 ------------------
|
||||
7 files changed, 126 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
index aff0521ee73..00a4ded2738 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
|
||||
@@ -54,24 +54,6 @@ ocil_clause: 'auditing is not enabled at boot time'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("audit=1") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: grub2
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
index 868d525014f..efbc3dae1c1 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
|
||||
@@ -41,24 +41,6 @@ ocil_clause: 'audit backlog limit is not configured'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: grub2
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
index 51b0a284746..52a308e3247 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
|
||||
@@ -34,24 +34,6 @@ ocil_clause: 'Kernel page-table isolation is not enabled'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("pti=on") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel8", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: machine
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
index 1b88d13bd3c..93eb31dad7b 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
@@ -34,24 +34,6 @@ ocil_clause: 'vsyscalls are enabled'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("vsyscall=none") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: machine
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
index c0fda343a1a..9e1ca48efe0 100644
|
||||
--- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
|
||||
@@ -30,24 +30,6 @@ ocil_clause: 'IPv6 is not disabled'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("ipv6.disable=1") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command:
|
||||
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command:
|
||||
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}}
|
||||
- <pre>sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>sudo grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: grub2
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
index 1f4e183d9e7..1ad6c6b3c44 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
|
||||
@@ -36,24 +36,6 @@ ocil_clause: 'page allocator poisoning is not enabled'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("page_poison=1") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: grub2
|
||||
|
||||
template:
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
index bb5dbc6c125..e40f5377c61 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
|
||||
@@ -36,24 +36,6 @@ ocil_clause: 'SLUB/SLAB poisoning is not enabled'
|
||||
ocil: |-
|
||||
{{{ ocil_grub2_argument("slub_debug=P") | indent(4) }}}
|
||||
|
||||
-warnings:
|
||||
- - management: |-
|
||||
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
|
||||
- is automatically updated each time a new kernel is installed. Note that any
|
||||
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
|
||||
- file. To update the GRUB 2 configuration file manually, use the
|
||||
- <pre>grub2-mkconfig -o</pre> command as follows:
|
||||
- <ul>
|
||||
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
|
||||
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
|
||||
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
|
||||
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
|
||||
-{{% else %}}
|
||||
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
|
||||
-{{% endif %}}
|
||||
- </ul>
|
||||
-
|
||||
platform: grub2
|
||||
|
||||
template:
|
||||
|
||||
From bbc3cc093004efd0457ccb33722a4fb14b0b2fb8 Mon Sep 17 00:00:00 2001
|
||||
From: vojtapolasek <krecoun@gmail.com>
|
||||
Date: Mon, 14 Feb 2022 14:29:15 +0100
|
||||
Subject: [PATCH 7/8] Update shared/macros.jinja
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Co-authored-by: Matěj Týč <matej.tyc@gmail.com>
|
||||
---
|
||||
shared/macros.jinja | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
||||
index 54d2b299a47..392181e2b24 100644
|
||||
--- a/shared/macros.jinja
|
||||
+++ b/shared/macros.jinja
|
||||
@@ -1671,7 +1671,12 @@ The command should not return any output.
|
||||
{{%- endif -%}}
|
||||
{{%- else -%}}
|
||||
Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
-in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
|
||||
+{{% if grub2_boot_path == grub2_uefi_boot_path or not grub2_uefi_boot_path -%}}
|
||||
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>.
|
||||
+{{%- else -%}}
|
||||
+in <tt>grubenv</tt> that can be found either in <tt>{{{ grub2_boot_path }}}</tt> in case of legacy BIOS systems, or in <tt>{{{ grub2_uefi_boot_path }}}</tt> in case of UEFI systems.
|
||||
+{{%- endif %}}
|
||||
+If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
|
||||
is configured at boot time.
|
||||
<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
{{%- endif -%}}
|
||||
|
||||
From 8121376668b43d21cf0f9700994bc011c3e313d7 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 15:17:33 +0100
|
||||
Subject: [PATCH 8/8] more modifications to description and ocil
|
||||
|
||||
final touches
|
||||
---
|
||||
shared/macros.jinja | 15 ++++++++++-----
|
||||
1 file changed, 10 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
||||
index 392181e2b24..a89bac12f53 100644
|
||||
--- a/shared/macros.jinja
|
||||
+++ b/shared/macros.jinja
|
||||
@@ -1626,7 +1626,7 @@ The audit daemon must be restarted for the changes to take effect.
|
||||
The parameter should be in form `parameter=value`.
|
||||
#}}
|
||||
{{%- macro describe_grub2_argument(arg_name_value) -%}}
|
||||
-{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
|
||||
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product -%}}
|
||||
To ensure that <tt>{{{ arg_name_value }}}</tt> is added as a kernel command line
|
||||
argument to newly installed kernels, ad <tt>{{{ arg_name_value }}}</tt> to the
|
||||
default Grub2 command line for Linux operating systems. Modify the line within
|
||||
@@ -1649,7 +1649,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
|
||||
The parameter should have form `parameter=value`.
|
||||
#}}
|
||||
{{%- macro ocil_grub2_argument(arg_name_value) -%}}
|
||||
-{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
|
||||
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product -%}}
|
||||
Inspect the form of default GRUB 2 command line for the Linux operating system
|
||||
in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
|
||||
then the parameter will be configured for newly installed kernels.
|
||||
@@ -1660,8 +1660,12 @@ If this option is set to true, then check that a line is output by the following
|
||||
If the recovery is disabled, check the line with
|
||||
<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
|
||||
{{%- if 'ubuntu' in product -%}}
|
||||
-Moreover, current Grub2 config file in <tt>{{{ grub2_boot_path }}}/grub.cfg</tt> must be checked.
|
||||
-<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
|
||||
+Moreover, current Grub config file <tt>grub.cfg</tt> must be checked. The file can be found
|
||||
+either in <tt>{{{ grub2_boot_path }}}</tt> in case of legacy BIOS systems, or in <tt>{{{ grub2_uefi_boot_path }}}</tt> in case of UEFI systems.
|
||||
+If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
|
||||
+is configured at boot time.
|
||||
+<pre># grep vmlinuz GRUB_CFG_FILE_PATH | grep -v '{{{ arg_name_value }}}'</pre>
|
||||
+Fill in <tt>GRUB_CFG_FILE_PATH</tt> based on information above.
|
||||
This command should not return any output.
|
||||
{{%- else -%}}
|
||||
Moreover, command line parameters for currently installed kernels should be checked as well.
|
||||
@@ -1678,6 +1682,7 @@ in <tt>grubenv</tt> that can be found either in <tt>{{{ grub2_boot_path }}}</tt>
|
||||
{{%- endif %}}
|
||||
If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
|
||||
is configured at boot time.
|
||||
-<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
|
||||
+<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' GRUBENV_FILE_LOCATION</pre>
|
||||
+Fill in <tt>GRUBENV_FILE_LOCATION</tt> based on information above.
|
||||
{{%- endif -%}}
|
||||
{{%- endmacro -%}}
|
||||
@ -1,842 +0,0 @@
|
||||
From 1bd88bbdc7ce8b6e2265f323cd3a777ef2240e6b Mon Sep 17 00:00:00 2001
|
||||
From: Matej Tyc <matyc@redhat.com>
|
||||
Date: Fri, 28 Jan 2022 17:11:56 +0100
|
||||
Subject: [PATCH 1/5] Change the grub2 bootloader argument template
|
||||
|
||||
- Introduce the concept of product-specific bootloader config
|
||||
properties that determine the check/remediation form.
|
||||
- Expand the RHEL8 remediation with a check for update of
|
||||
/etc/default/grub contents.
|
||||
- Add a RHEL8 check that looks for kernelopts references in loader entries.
|
||||
- Update tests.
|
||||
---
|
||||
.../grub2_entries_reference_kernelopts.xml | 25 +++++
|
||||
.../ansible.template | 35 ++++++-
|
||||
.../grub2_bootloader_argument/bash.template | 48 +++++++--
|
||||
.../grub2_bootloader_argument/oval.template | 97 +++++++++++++------
|
||||
.../arg_not_there_etcdefaultgrub.fail.sh | 2 +-
|
||||
....fail.sh => arg_not_there_grubenv.fail.sh} | 0
|
||||
6 files changed, 164 insertions(+), 43 deletions(-)
|
||||
create mode 100644 shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
rename shared/templates/grub2_bootloader_argument/tests/{arg_not_there.fail.sh => arg_not_there_grubenv.fail.sh} (100%)
|
||||
|
||||
diff --git a/shared/checks/oval/grub2_entries_reference_kernelopts.xml b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
new file mode 100644
|
||||
index 00000000000..1aec9fe64d2
|
||||
--- /dev/null
|
||||
+++ b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
@@ -0,0 +1,25 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="grub2_entries_reference_kernelopts" version="2">
|
||||
+ {{{ oval_metadata(
|
||||
+ "Ensure that grubenv-defined kernel options are referenced in individual boot loader entries",
|
||||
+ title="Use $kernelopts in /boot/loader/entries/*.conf",
|
||||
+ affected_platforms=["multi_platform_all"]) }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion test_ref="test_grub2_entries_reference_kernelopts"
|
||||
+ comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable." />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_test id="test_grub2_entries_reference_kernelopts"
|
||||
+ comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable."
|
||||
+ check="all" check_existence="all_exist" version="1">
|
||||
+ <ind:object object_ref="object_grub2_entries_reference_kernelopts" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_grub2_entries_reference_kernelopts" version="1">
|
||||
+ <ind:path>/boot/loader/entries/</ind:path>
|
||||
+ <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
|
||||
+ <ind:pattern operation="pattern match">^options .*\b\$kernelopts\b.*$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+</def-group>
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
index 58d4fab69fa..de970879c8f 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
@@ -4,7 +4,34 @@
|
||||
# complexity = medium
|
||||
# disruption = low
|
||||
|
||||
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{#
|
||||
+ See the OVAL template for more comments.
|
||||
+ Product-specific categorization should be synced across all template content types
|
||||
+-#}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
+
|
||||
+{{% if product in ["rhel9"] %}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel8"] %}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if system_with_kernel_options_in_etc_default_grub -%}}
|
||||
- name: Check {{{ ARG_NAME }}} argument exists
|
||||
command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
|
||||
failed_when: False
|
||||
@@ -27,7 +54,9 @@
|
||||
- name: Update bootloader menu
|
||||
command: /sbin/grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
|
||||
|
||||
-{{% else %}}
|
||||
+{{%- endif %}}
|
||||
+
|
||||
+{{% if system_with_kernel_options_in_grubenv -%}}
|
||||
|
||||
- name: Get current kernel parameters
|
||||
ansible.builtin.shell:
|
||||
@@ -50,4 +79,4 @@
|
||||
when:
|
||||
- kernelopts.rc != 0
|
||||
|
||||
-{{% endif %}}
|
||||
+{{%- endif %}}
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
index 631e686897e..817fd1fde23 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/bash.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
@@ -1,6 +1,41 @@
|
||||
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
|
||||
+{{#
|
||||
+ See the OVAL template for more comments.
|
||||
+ Product-specific categorization should be synced across all template content types
|
||||
+-#}}
|
||||
|
||||
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
+
|
||||
+{{% if product in ["rhel9"] %}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel8"] %}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
+{{% endif -%}}
|
||||
+
|
||||
+{{% macro update_etc_default_grub(arg_name_value) %}}
|
||||
+{{% if 'ubuntu' in product %}}
|
||||
+update-grub
|
||||
+{{% else %}}
|
||||
+grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"
|
||||
+{{% endif %}}
|
||||
+{{% endmacro -%}}
|
||||
+
|
||||
+{{% if system_with_kernel_options_in_etc_default_grub %}}
|
||||
{{% if '/' in ARG_NAME %}}
|
||||
{{{ raise("ARG_NAME (" + ARG_NAME + ") uses sed path separator (/) in " + rule_id) }}}
|
||||
{{% elif '/' in ARG_NAME_VALUE %}}
|
||||
@@ -14,14 +49,11 @@ else
|
||||
# no {{{ ARG_NAME }}}=arg is present, append it
|
||||
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
|
||||
fi
|
||||
-
|
||||
-{{% if 'ubuntu' in product %}}
|
||||
-update-grub
|
||||
-{{% else %}}
|
||||
-# Correct the form of kernel command line for each installed kernel in the bootloader
|
||||
-grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
|
||||
{{% endif %}}
|
||||
-{{% else %}}
|
||||
+
|
||||
+{{{ update_etc_default_grub(ARG_NAME_VALUE) }}}
|
||||
+
|
||||
+{{% if system_with_kernel_options_in_grubenv -%}}
|
||||
# Correct grub2 kernelopts value using grub2-editenv
|
||||
existing_kernelopts="$(grub2-editenv - list | grep kernelopts)"
|
||||
if ! printf '%s' "$existing_kernelopts" | grep -qE '^kernelopts=(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$'; then
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
index 3ea8acb2910..24258a3bcbd 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/oval.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
@@ -1,15 +1,53 @@
|
||||
+{{#-
|
||||
+ We set defaults to "off", and products should enable relevant ones depending on how the product configures grub.
|
||||
+ - /boot/loader/entries/* may not exist don't exist
|
||||
+ - If they exist, they can reference variables defined in grubenv, or they can contain literal args
|
||||
+ - The grub cfg may either use those loader entries, or it can contain literal values as well
|
||||
+ - Kernel opts can be stored in /etc/default/grub so they are persistent between kernel upgrades
|
||||
+-#}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
+
|
||||
+{{% if product in ["rhel9"] -%}}
|
||||
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
+{{%- endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel8"] -%}}
|
||||
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
|
||||
+{{% set system_with_kernel_options_in_grubenv = true %}}
|
||||
+{{%- endif -%}}
|
||||
+
|
||||
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product -%}}
|
||||
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
+{{%- endif -%}}
|
||||
+
|
||||
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
+{{%- endif -%}}
|
||||
+
|
||||
<def-group>
|
||||
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
|
||||
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
|
||||
<criteria operator="AND">
|
||||
- {{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
|
||||
- {{% if product in ['rhel9'] %}}
|
||||
+ {{% if system_with_kernel_options_in_grubenv -%}}
|
||||
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
|
||||
+ {{%- endif %}}
|
||||
+ {{% if system_with_referenced_kernel_options_in_loader_entries -%}}
|
||||
+ <extend_definition comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable" definition_ref="grub2_entries_reference_kernelopts" />
|
||||
+ {{%- endif %}}
|
||||
+ {{% if system_with_expanded_kernel_options_in_loader_entries -%}}
|
||||
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_entries"
|
||||
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the /boot/loader/entries/*.conf" />
|
||||
- {{% else %}}
|
||||
+ {{%- endif %}}
|
||||
+ {{% if system_with_expanded_kernel_options_in_grub_cfg -%}}
|
||||
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
|
||||
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_boot_path }}}/grub.cfg for all kernels" />
|
||||
- {{% endif %}}
|
||||
+ {{%- endif %}}
|
||||
+ {{% if system_with_kernel_options_in_etc_default_grub -%}}
|
||||
<criteria operator="OR">
|
||||
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
|
||||
comment="check for {{{ ARG_NAME_VALUE }}} in /etc/default/grub via GRUB_CMDLINE_LINUX" />
|
||||
@@ -20,14 +58,11 @@
|
||||
comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" />
|
||||
</criteria>
|
||||
</criteria>
|
||||
- {{% else %}}
|
||||
- <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
- comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
|
||||
- {{% endif %}}
|
||||
+ {{%- endif %}}
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
|
||||
+{{%- if system_with_kernel_options_in_etc_default_grub %}}
|
||||
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
|
||||
comment="check for {{{ ARG_NAME_VALUE }}} in /etc/default/grub via GRUB_CMDLINE_LINUX"
|
||||
check="all" check_existence="all_exist" version="1">
|
||||
@@ -54,8 +89,25 @@
|
||||
<ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
+{{%- endif %}}
|
||||
+
|
||||
+{{%- if system_with_kernel_options_in_grubenv %}}
|
||||
+ <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
+ comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
|
||||
+ check="all" check_existence="all_exist" version="1">
|
||||
+ <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
|
||||
+ <ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
|
||||
- {{% if product in ["rhel9"] %}}
|
||||
+ <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
+ version="1">
|
||||
+ <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+{{%- endif %}}
|
||||
+
|
||||
+{{%- if system_with_expanded_kernel_options_in_loader_entries %}}
|
||||
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_entries"
|
||||
comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} for all boot entries."
|
||||
check="all" check_existence="all_exist" version="1">
|
||||
@@ -69,7 +121,9 @@
|
||||
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
- {{% else %}}
|
||||
+{{%- endif %}}
|
||||
+
|
||||
+{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
|
||||
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
|
||||
comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grub.cfg for all kernels"
|
||||
check="all" check_existence="all_exist" version="1">
|
||||
@@ -87,26 +141,7 @@
|
||||
{{% endif %}}
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
-
|
||||
- {{% endif %}}
|
||||
-
|
||||
-{{% else %}}
|
||||
-
|
||||
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
- comment="check forkernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
|
||||
- check="all" check_existence="all_exist" version="1">
|
||||
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
|
||||
- <ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
|
||||
- </ind:textfilecontent54_test>
|
||||
-
|
||||
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
- version="1">
|
||||
- <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
|
||||
- <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
|
||||
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
- </ind:textfilecontent54_object>
|
||||
-
|
||||
-{{% endif %}}
|
||||
+{{%- endif %}}
|
||||
|
||||
<ind:textfilecontent54_state id="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
|
||||
version="1">
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
|
||||
index a56e6d09235..a270be45952 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
|
||||
+++ b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 9
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
|
||||
|
||||
# Removes argument from kernel command line in /etc/default/grub
|
||||
if grep -q '^GRUB_CMDLINE_LINUX=.*{{{ARG_NAME}}}=.*"' '/etc/default/grub' ; then
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_there.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_grubenv.fail.sh
|
||||
similarity index 100%
|
||||
rename from shared/templates/grub2_bootloader_argument/tests/arg_not_there.fail.sh
|
||||
rename to shared/templates/grub2_bootloader_argument/tests/arg_not_there_grubenv.fail.sh
|
||||
|
||||
From 0d10bf751d5e1d7f024cd7301f8b02b38c0e3b9c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 11:19:06 +0100
|
||||
Subject: [PATCH 2/5] Change the default product setting
|
||||
|
||||
Assume that every product stores kernel opts in the /etc/default/grub
|
||||
---
|
||||
shared/templates/grub2_bootloader_argument/ansible.template | 6 +-----
|
||||
shared/templates/grub2_bootloader_argument/bash.template | 6 +-----
|
||||
shared/templates/grub2_bootloader_argument/oval.template | 6 +-----
|
||||
3 files changed, 3 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
index de970879c8f..46de9b465c2 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
@@ -11,7 +11,7 @@
|
||||
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
|
||||
{{% if product in ["rhel9"] %}}
|
||||
@@ -27,10 +27,6 @@
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
{{% endif -%}}
|
||||
|
||||
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
{{% if system_with_kernel_options_in_etc_default_grub -%}}
|
||||
- name: Check {{{ ARG_NAME }}} argument exists
|
||||
command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
index 817fd1fde23..b188d1e3689 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/bash.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
@@ -7,7 +7,7 @@
|
||||
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
|
||||
{{% if product in ["rhel9"] %}}
|
||||
@@ -23,10 +23,6 @@
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
{{% endif -%}}
|
||||
|
||||
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
{{% macro update_etc_default_grub(arg_name_value) %}}
|
||||
{{% if 'ubuntu' in product %}}
|
||||
update-grub
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
index 24258a3bcbd..88fa7b7a3ee 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/oval.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
@@ -8,7 +8,7 @@
|
||||
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
|
||||
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
|
||||
{{% if product in ["rhel9"] -%}}
|
||||
@@ -24,10 +24,6 @@
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
{{%- endif -%}}
|
||||
|
||||
-{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
|
||||
-{{%- endif -%}}
|
||||
-
|
||||
<def-group>
|
||||
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
|
||||
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
|
||||
|
||||
From fac0aeb351d7acab1112482d11a0be73df662496 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
|
||||
Date: Fri, 11 Feb 2022 14:55:53 +0100
|
||||
Subject: [PATCH 3/5] Improve the template further
|
||||
|
||||
- Fix the $kernelopts regex - $ is not a word char.
|
||||
- Use grubby exclusively on RHEL systems and structure remediations differently than OVAL checks
|
||||
- Exclude the rescue.conf loader entry from checks, as it is not a boot entry for general use.
|
||||
---
|
||||
.../grub2_entries_reference_kernelopts.xml | 2 +-
|
||||
.../ansible.template | 72 +------------------
|
||||
.../grub2_bootloader_argument/bash.template | 67 +++++------------
|
||||
.../grub2_bootloader_argument/oval.template | 7 +-
|
||||
.../tests/invalid_rescue.pass.sh | 6 ++
|
||||
tests/test_rule_in_container.sh | 2 +-
|
||||
6 files changed, 33 insertions(+), 123 deletions(-)
|
||||
create mode 100644 shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
|
||||
|
||||
diff --git a/shared/checks/oval/grub2_entries_reference_kernelopts.xml b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
index 1aec9fe64d2..30f3965a037 100644
|
||||
--- a/shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
+++ b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
|
||||
@@ -19,7 +19,7 @@
|
||||
<ind:textfilecontent54_object id="object_grub2_entries_reference_kernelopts" version="1">
|
||||
<ind:path>/boot/loader/entries/</ind:path>
|
||||
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
|
||||
- <ind:pattern operation="pattern match">^options .*\b\$kernelopts\b.*$</ind:pattern>
|
||||
+ <ind:pattern operation="pattern match">^options(?:\s+.*)?\s+\$kernelopts\b.*$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
</def-group>
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
index 46de9b465c2..db3b4430d4b 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
|
||||
@@ -4,75 +4,5 @@
|
||||
# complexity = medium
|
||||
# disruption = low
|
||||
|
||||
-{{#
|
||||
- See the OVAL template for more comments.
|
||||
- Product-specific categorization should be synced across all template content types
|
||||
--#}}
|
||||
-{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
-{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
-{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
-{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
-
|
||||
-{{% if product in ["rhel9"] %}}
|
||||
-{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% if product in ["rhel8"] %}}
|
||||
-{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
|
||||
-{{% set system_with_kernel_options_in_grubenv = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
|
||||
-{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% if system_with_kernel_options_in_etc_default_grub -%}}
|
||||
-- name: Check {{{ ARG_NAME }}} argument exists
|
||||
- command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
|
||||
- failed_when: False
|
||||
- register: argcheck
|
||||
-
|
||||
-- name: Replace existing {{{ ARG_NAME }}} argument
|
||||
- replace:
|
||||
- path: /etc/default/grub
|
||||
- regexp: '{{{ ARG_NAME }}}=\w+'
|
||||
- replace: '{{{ ARG_NAME_VALUE }}}'
|
||||
- when: argcheck.rc == 0
|
||||
-
|
||||
-- name: Add {{{ ARG_NAME }}} argument
|
||||
- replace:
|
||||
- path: /etc/default/grub
|
||||
- regexp: '(GRUB_CMDLINE_LINUX=.*)"'
|
||||
- replace: '\1 {{{ ARG_NAME_VALUE }}}"'
|
||||
- when: argcheck.rc != 0
|
||||
-
|
||||
-- name: Update bootloader menu
|
||||
+- name: Update grub defaults and the bootloader menu
|
||||
command: /sbin/grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
|
||||
-
|
||||
-{{%- endif %}}
|
||||
-
|
||||
-{{% if system_with_kernel_options_in_grubenv -%}}
|
||||
-
|
||||
-- name: Get current kernel parameters
|
||||
- ansible.builtin.shell:
|
||||
- cmd: '/usr/bin/grub2-editenv - list | grep "kernelopts="'
|
||||
- register: kernelopts
|
||||
- ignore_errors: yes
|
||||
- changed_when: False
|
||||
-
|
||||
-- name: Update the bootloader menu
|
||||
- command: /usr/bin/grub2-editenv - set "{{ item }} {{{ ARG_NAME_VALUE }}}"
|
||||
- with_items: "{{ kernelopts.stdout_lines | select('match', '^kernelopts.*') | list }}"
|
||||
- when:
|
||||
- - kernelopts.rc == 0
|
||||
- - kernelopts.stdout_lines is defined
|
||||
- - kernelopts.stdout_lines | length > 0
|
||||
- - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?{{{ ARG_NAME_VALUE }}}(?:\s.*)?$', multiline=True) is none
|
||||
-
|
||||
-- name: Update the bootloader menu when there are no entries previously set
|
||||
- command: /usr/bin/grub2-editenv - set "kernelopts={{{ ARG_NAME_VALUE }}}"
|
||||
- when:
|
||||
- - kernelopts.rc != 0
|
||||
-
|
||||
-{{%- endif %}}
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
index b188d1e3689..5f97efd498f 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/bash.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
@@ -4,59 +4,28 @@
|
||||
Product-specific categorization should be synced across all template content types
|
||||
-#}}
|
||||
|
||||
-{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
|
||||
-{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
|
||||
-{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
-{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
-{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
+{{% set grub_helper_executable = "grubby" -%}}
|
||||
+{{% set grub_helper_args = ["--update-kernel=ALL", "--args=" ~ ARG_NAME_VALUE] -%}}
|
||||
|
||||
-{{% if product in ["rhel9"] %}}
|
||||
-{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% if product in ["rhel8"] %}}
|
||||
-{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
|
||||
-{{% set system_with_kernel_options_in_grubenv = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
|
||||
-{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
-{{% endif -%}}
|
||||
-
|
||||
-{{% macro update_etc_default_grub(arg_name_value) %}}
|
||||
-{{% if 'ubuntu' in product %}}
|
||||
-update-grub
|
||||
-{{% else %}}
|
||||
-grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"
|
||||
-{{% endif %}}
|
||||
-{{% endmacro -%}}
|
||||
-
|
||||
-{{% if system_with_kernel_options_in_etc_default_grub %}}
|
||||
-{{% if '/' in ARG_NAME %}}
|
||||
-{{{ raise("ARG_NAME (" + ARG_NAME + ") uses sed path separator (/) in " + rule_id) }}}
|
||||
-{{% elif '/' in ARG_NAME_VALUE %}}
|
||||
-{{{ raise("ARG_NAME_VALUE (" + ARG_NAME_VALUE + ") uses sed path separator (/) in " + rule_id) }}}
|
||||
-{{% endif %}}
|
||||
+{{%- macro update_etc_default_grub_manually() -%}}
|
||||
# Correct the form of default kernel command line in GRUB
|
||||
if grep -q '^GRUB_CMDLINE_LINUX=.*{{{ ARG_NAME }}}=.*"' '/etc/default/grub' ; then
|
||||
- # modify the GRUB command-line if an {{{ ARG_NAME }}}= arg already exists
|
||||
- sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\){{{ ARG_NAME }}}=[^[:space:]]*\(.*"\)/\1 {{{ ARG_NAME_VALUE }}} \2/' '/etc/default/grub'
|
||||
+ # modify the GRUB command-line if an {{{ ARG_NAME }}}= arg already exists
|
||||
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\){{{ ARG_NAME }}}=[^[:space:]]*\(.*"\)/\1 {{{ ARG_NAME_VALUE }}} \2/' '/etc/default/grub'
|
||||
else
|
||||
- # no {{{ ARG_NAME }}}=arg is present, append it
|
||||
- sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
|
||||
+ # no {{{ ARG_NAME }}}=arg is present, append it
|
||||
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
|
||||
fi
|
||||
-{{% endif %}}
|
||||
+{{%- endmacro %}}
|
||||
+
|
||||
+{{% if 'ubuntu' in product %}}
|
||||
+{{{ update_etc_default_grub_manually() }}}
|
||||
+{{% set grub_helper_executable = "update-grub" -%}}
|
||||
+{{% endif -%}}
|
||||
|
||||
-{{{ update_etc_default_grub(ARG_NAME_VALUE) }}}
|
||||
+{{% if product in ["rhel8", "ol8"] %}}
|
||||
+{{# Suppress the None output of append -#}}
|
||||
+{{{ grub_helper_args.append("--env=/boot/grub2/grubenv") or "" -}}}
|
||||
+{{% endif -%}}
|
||||
|
||||
-{{% if system_with_kernel_options_in_grubenv -%}}
|
||||
-# Correct grub2 kernelopts value using grub2-editenv
|
||||
-existing_kernelopts="$(grub2-editenv - list | grep kernelopts)"
|
||||
-if ! printf '%s' "$existing_kernelopts" | grep -qE '^kernelopts=(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$'; then
|
||||
- if test -n "$existing_kernelopts"; then
|
||||
- grub2-editenv - set "$existing_kernelopts {{{ ARG_NAME_VALUE }}}"
|
||||
- else
|
||||
- grub2-editenv - set "kernelopts={{{ ARG_NAME_VALUE }}}"
|
||||
- fi
|
||||
-fi
|
||||
-{{% endif %}}
|
||||
+{{{ grub_helper_executable }}} {{{ " ".join(grub_helper_args) }}}
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
index 88fa7b7a3ee..6981cc14045 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/oval.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
@@ -1,6 +1,6 @@
|
||||
{{#-
|
||||
We set defaults to "off", and products should enable relevant ones depending on how the product configures grub.
|
||||
- - /boot/loader/entries/* may not exist don't exist
|
||||
+ - /boot/loader/entries/* may not exist.
|
||||
- If they exist, they can reference variables defined in grubenv, or they can contain literal args
|
||||
- The grub cfg may either use those loader entries, or it can contain literal values as well
|
||||
- Kernel opts can be stored in /etc/default/grub so they are persistent between kernel upgrades
|
||||
@@ -116,7 +116,12 @@
|
||||
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
|
||||
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ <filter action="exclude">state_grub2_rescue_entry_for_{{{ _RULE_ID }}}</filter>
|
||||
</ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_state id="state_grub2_rescue_entry_for_{{{ _RULE_ID }}}" version="1">
|
||||
+ <ind:filename>rescue.conf</ind:filename>
|
||||
+ </ind:textfilecontent54_state>
|
||||
{{%- endif %}}
|
||||
|
||||
{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh b/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..ee6e2c67f34
|
||||
--- /dev/null
|
||||
+++ b/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 9
|
||||
+# packages = grub2,grubby
|
||||
+
|
||||
+{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME_VALUE) }}}
|
||||
+
|
||||
+echo "I am an invalid boot entry, but nobody should care, because I am rescue" > /boot/loader/entries/trololol-rescue.conf
|
||||
diff --git a/tests/test_rule_in_container.sh b/tests/test_rule_in_container.sh
|
||||
index 395fc4e856c..a8691ca7463 100755
|
||||
--- a/tests/test_rule_in_container.sh
|
||||
+++ b/tests/test_rule_in_container.sh
|
||||
@@ -221,7 +221,7 @@ additional_args=()
|
||||
test "$_arg_dontclean" = on && additional_args+=(--dontclean)
|
||||
|
||||
# Don't act on the default value.
|
||||
-test -n "$_arg_scenarios" && additional_args+=(--scenario "'$_arg_scenarios'")
|
||||
+test -n "$_arg_scenarios" && additional_args+=(--scenario "$_arg_scenarios")
|
||||
|
||||
test -n "$_arg_datastream" && additional_args+=(--datastream "$_arg_datastream")
|
||||
|
||||
|
||||
From 8dda6030dea885c7c7e7e8f1024f5f2edf5bc36c Mon Sep 17 00:00:00 2001
|
||||
From: Matej Tyc <matyc@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 13:45:09 +0100
|
||||
Subject: [PATCH 4/5] Add support for checks of both BIOS/UEFI systems
|
||||
|
||||
---
|
||||
.../grub2_bootloader_argument/oval.template | 57 +++++++++++++++----
|
||||
1 file changed, 46 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
index 6981cc14045..71367465663 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/oval.template
|
||||
+++ b/shared/templates/grub2_bootloader_argument/oval.template
|
||||
@@ -10,6 +10,7 @@
|
||||
{{% set system_with_kernel_options_in_grubenv = false -%}}
|
||||
{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
|
||||
+{{% set system_with_bios_and_uefi_support = false -%}}
|
||||
|
||||
{{% if product in ["rhel9"] -%}}
|
||||
{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
|
||||
@@ -24,13 +25,25 @@
|
||||
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
|
||||
{{%- endif -%}}
|
||||
|
||||
+{{% if grub2_uefi_boot_path and grub2_uefi_boot_path != grub2_boot_path -%}}
|
||||
+{{% set system_with_bios_and_uefi_support = true %}}
|
||||
+{{%- endif -%}}
|
||||
+
|
||||
<def-group>
|
||||
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
|
||||
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
|
||||
<criteria operator="AND">
|
||||
{{% if system_with_kernel_options_in_grubenv -%}}
|
||||
+ {{% if system_with_bios_and_uefi_support -%}}
|
||||
+ <criteria operator="OR">
|
||||
+ {{%- endif %}}
|
||||
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
|
||||
+ {{% if system_with_bios_and_uefi_support -%}}
|
||||
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env_uefi"
|
||||
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_uefi_boot_path }}}/grubenv" />
|
||||
+ </criteria>
|
||||
+ {{%- endif %}}
|
||||
{{%- endif %}}
|
||||
{{% if system_with_referenced_kernel_options_in_loader_entries -%}}
|
||||
<extend_definition comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable" definition_ref="grub2_entries_reference_kernelopts" />
|
||||
@@ -40,8 +53,16 @@
|
||||
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the /boot/loader/entries/*.conf" />
|
||||
{{%- endif %}}
|
||||
{{% if system_with_expanded_kernel_options_in_grub_cfg -%}}
|
||||
+ {{% if system_with_bios_and_uefi_support -%}}
|
||||
+ <criteria operator="OR">
|
||||
+ {{%- endif %}}
|
||||
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
|
||||
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_boot_path }}}/grub.cfg for all kernels" />
|
||||
+ {{% if system_with_bios_and_uefi_support -%}}
|
||||
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg_uefi"
|
||||
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_uefi_boot_path }}}/grub.cfg for all kernels" />
|
||||
+ </criteria>
|
||||
+ {{%- endif %}}
|
||||
{{%- endif %}}
|
||||
{{% if system_with_kernel_options_in_etc_default_grub -%}}
|
||||
<criteria operator="OR">
|
||||
@@ -88,19 +109,26 @@
|
||||
{{%- endif %}}
|
||||
|
||||
{{%- if system_with_kernel_options_in_grubenv %}}
|
||||
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
- comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
|
||||
+{{%- macro test_and_object_for_kernel_options_grub_env(base_name, path) %}}
|
||||
+ <ind:textfilecontent54_test id="test_{{{ base_name }}}"
|
||||
+ comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ path }}} for all kernels"
|
||||
check="all" check_existence="all_exist" version="1">
|
||||
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
|
||||
+ <ind:object object_ref="object_{{{ base_name }}}" />
|
||||
<ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
|
||||
+ <ind:textfilecontent54_object id="object_{{{ base_name }}}"
|
||||
version="1">
|
||||
- <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
|
||||
+ <ind:filepath>{{{ path }}}</ind:filepath>
|
||||
<ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
+{{%- endmacro %}}
|
||||
+
|
||||
+{{{ test_and_object_for_kernel_options_grub_env("grub2_" ~ SANITIZED_ARG_NAME ~ "_argument_grub_env", grub2_boot_path ~ "/grubenv") }}}
|
||||
+{{% if system_with_bios_and_uefi_support -%}}
|
||||
+{{{ test_and_object_for_kernel_options_grub_env("grub2_" ~ SANITIZED_ARG_NAME ~ "_argument_grub_env_uefi", grub2_uefi_boot_path ~ "/grubenv") }}}
|
||||
+{{%- endif %}}
|
||||
{{%- endif %}}
|
||||
|
||||
{{%- if system_with_expanded_kernel_options_in_loader_entries %}}
|
||||
@@ -120,21 +148,22 @@
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
<ind:textfilecontent54_state id="state_grub2_rescue_entry_for_{{{ _RULE_ID }}}" version="1">
|
||||
- <ind:filename>rescue.conf</ind:filename>
|
||||
+ <ind:filename operation="pattern match">.*rescue.conf$</ind:filename>
|
||||
</ind:textfilecontent54_state>
|
||||
{{%- endif %}}
|
||||
|
||||
{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
|
||||
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
|
||||
- comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grub.cfg for all kernels"
|
||||
+{{%- macro test_and_object_for_kernel_options_grub_cfg(base_name, path) %}}
|
||||
+ <ind:textfilecontent54_test id="test_{{{ base_name }}}"
|
||||
+ comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ path }}} for all kernels"
|
||||
check="all" check_existence="all_exist" version="1">
|
||||
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg" />
|
||||
+ <ind:object object_ref="object_{{{ base_name }}}" />
|
||||
<ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
|
||||
+ <ind:textfilecontent54_object id="object_{{{ base_name }}}"
|
||||
version="1">
|
||||
- <ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
|
||||
+ <ind:filepath>{{{ path }}}</ind:filepath>
|
||||
{{% if product in ["rhel7"] or 'ubuntu' in product %}}
|
||||
<ind:pattern operation="pattern match">^.*/vmlinuz.*(root=.*)$</ind:pattern>
|
||||
{{% else %}}
|
||||
@@ -142,6 +171,12 @@
|
||||
{{% endif %}}
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
+{{%- endmacro %}}
|
||||
+
|
||||
+{{{ test_and_object_for_kernel_options_grub_cfg("grub2_" + SANITIZED_ARG_NAME + "_argument_grub_cfg", grub2_boot_path ~ "/grub.cfg") }}}
|
||||
+{{% if system_with_bios_and_uefi_support -%}}
|
||||
+{{{ test_and_object_for_kernel_options_grub_cfg("grub2_" + SANITIZED_ARG_NAME + "_argument_grub_cfg_uefi", grub2_uefi_boot_path ~ "/grub.cfg") }}}
|
||||
+{{%- endif %}}
|
||||
{{%- endif %}}
|
||||
|
||||
<ind:textfilecontent54_state id="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
|
||||
|
||||
From df44b5d7017328d05c0671397edcfed019a2a448 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 14:49:34 +0100
|
||||
Subject: [PATCH 5/5] Correct test scenario metadata
|
||||
|
||||
- Grubenv doesn't relate to anything else than RHEL8
|
||||
- The grubby remediation has different behavior in corner-cases
|
||||
that are technically unsupported, so the corresponding test scenario has been dropped.
|
||||
---
|
||||
.../grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh | 1 +
|
||||
.../auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh | 2 +-
|
||||
2 files changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh b/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
|
||||
index 5af2acc317e..956c8ac79fd 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
|
||||
@@ -1,6 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# platform = Red Hat Enterprise Linux 8
|
||||
+# remediation = none
|
||||
|
||||
# Removes audit argument from kernel command line in /boot/grub2/grubenv
|
||||
file="/boot/grub2/grubenv"
|
||||
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh b/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
|
||||
index 0ec9a1d6e38..9823b08dff9 100644
|
||||
--- a/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
|
||||
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
|
||||
+# platform = Red Hat Enterprise Linux 8
|
||||
|
||||
grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"
|
||||
@ -1,22 +0,0 @@
|
||||
From 1ff5b861e51e62602386524820b4382976540f03 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 9 Feb 2022 19:26:54 +0100
|
||||
Subject: [PATCH] drop not needed rules
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 065681d93a7..c3f4e2d26eb 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -149,8 +149,6 @@ selections:
|
||||
- service_auditd_enabled
|
||||
- var_auditd_flush=incremental_async
|
||||
- auditd_data_retention_flush
|
||||
- - auditd_local_events
|
||||
- - auditd_write_logs
|
||||
- auditd_log_format
|
||||
- auditd_freq
|
||||
- auditd_name_format
|
||||
@ -1,397 +0,0 @@
|
||||
From 742e103392746dac771663247d169cfe498ee658 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 21 Jan 2022 14:02:16 +0100
|
||||
Subject: [PATCH 1/7] modify vsyscall rules according to rhel9 ospp
|
||||
|
||||
add references
|
||||
make rules scored in th e profile
|
||||
---
|
||||
.../system/bootloader-grub2/grub2_vsyscall_argument/rule.yml | 1 +
|
||||
.../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml | 3 +++
|
||||
products/rhel9/profiles/ospp.profile | 4 ----
|
||||
3 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
index 1dd26fea9b6..9f38a1c13b9 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
|
||||
@@ -25,6 +25,7 @@ identifiers:
|
||||
references:
|
||||
disa: CCI-001084
|
||||
nist: CM-7(a)
|
||||
+ ospp: FPT_ASLR_EXT.1
|
||||
srg: SRG-OS-000480-GPOS-00227,SRG-OS-000134-GPOS-00068
|
||||
stigid@ol8: OL08-00-010422
|
||||
stigid@rhel8: RHEL-08-010422
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
|
||||
index 52b192ffc52..9d645c8876e 100644
|
||||
--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
|
||||
@@ -21,6 +21,9 @@ identifiers:
|
||||
cce@rhel8: CCE-83381-4
|
||||
cce@rhel9: CCE-84100-7
|
||||
|
||||
+references:
|
||||
+ ospp: FPT_ASLR_EXT.1
|
||||
+
|
||||
ocil_clause: 'vsyscalls are enabled'
|
||||
|
||||
ocil: |-
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 287a28c43c5..f0b850a4ced 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -128,8 +128,6 @@ selections:
|
||||
- grub2_slub_debug_argument
|
||||
- grub2_page_poison_argument
|
||||
- grub2_vsyscall_argument
|
||||
- - grub2_vsyscall_argument.role=unscored
|
||||
- - grub2_vsyscall_argument.severity=info
|
||||
- grub2_pti_argument
|
||||
- grub2_kernel_trust_cpu_rng
|
||||
|
||||
@@ -421,5 +419,3 @@ selections:
|
||||
- zipl_slub_debug_argument
|
||||
- zipl_page_poison_argument
|
||||
- zipl_vsyscall_argument
|
||||
- - zipl_vsyscall_argument.role=unscored
|
||||
- - zipl_vsyscall_argument.severity=info
|
||||
|
||||
From d167658d46accbc75200a5d145a746322f1c2d4a Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 21 Jan 2022 14:05:24 +0100
|
||||
Subject: [PATCH 2/7] add ospp references to fips rules
|
||||
|
||||
---
|
||||
.../software/integrity/fips/enable_dracut_fips_module/rule.yml | 1 +
|
||||
.../system/software/integrity/fips/enable_fips_mode/rule.yml | 2 +-
|
||||
2 files changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
|
||||
index f342b9b8d95..3b7c3229b6f 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
|
||||
@@ -29,6 +29,7 @@ references:
|
||||
ism: "1446"
|
||||
nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
|
||||
nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12
|
||||
+ ospp: FCS_RBG_EXT.1
|
||||
srg: SRG-OS-000478-GPOS-00223
|
||||
stigid@ol8: OL08-00-010020
|
||||
stigid@rhel8: RHEL-08-010020
|
||||
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
index 7559e61600d..9d89114b07f 100644
|
||||
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
|
||||
@@ -39,7 +39,7 @@ references:
|
||||
ism: "1446"
|
||||
nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
|
||||
nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12
|
||||
- ospp: FCS_COP.1(1),FCS_COP.1(2),FCS_COP.1(3),FCS_COP.1(4),FCS_CKM.1,FCS_CKM.2,FCS_TLSC_EXT.1
|
||||
+ ospp: FCS_COP.1(1),FCS_COP.1(2),FCS_COP.1(3),FCS_COP.1(4),FCS_CKM.1,FCS_CKM.2,FCS_TLSC_EXT.1,FCS_RBG_EXT.1
|
||||
srg: SRG-OS-000478-GPOS-00223,SRG-OS-000396-GPOS-00176
|
||||
stigid@ol8: OL08-00-010020
|
||||
stigid@rhel8: RHEL-08-010020
|
||||
|
||||
From f05e895bb96b64a5142e62e3dd0f7208633d5c23 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 21 Jan 2022 14:08:36 +0100
|
||||
Subject: [PATCH 3/7] drop no longer needed rules from ospp rhel9 profile
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 6 ------
|
||||
1 file changed, 6 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index f0b850a4ced..7e30054bc98 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -125,11 +125,7 @@ selections:
|
||||
## Boot prompt
|
||||
- grub2_audit_argument
|
||||
- grub2_audit_backlog_limit_argument
|
||||
- - grub2_slub_debug_argument
|
||||
- - grub2_page_poison_argument
|
||||
- grub2_vsyscall_argument
|
||||
- - grub2_pti_argument
|
||||
- - grub2_kernel_trust_cpu_rng
|
||||
|
||||
## Security Settings
|
||||
- sysctl_kernel_kptr_restrict
|
||||
@@ -416,6 +412,4 @@ selections:
|
||||
- zipl_bootmap_is_up_to_date
|
||||
- zipl_audit_argument
|
||||
- zipl_audit_backlog_limit_argument
|
||||
- - zipl_slub_debug_argument
|
||||
- - zipl_page_poison_argument
|
||||
- zipl_vsyscall_argument
|
||||
|
||||
From 972ae269eff95de8a6914056d38e58b7aeafb8c3 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 21 Jan 2022 15:12:46 +0100
|
||||
Subject: [PATCH 4/7] add grub2_init_on_alloc rule
|
||||
|
||||
---
|
||||
.../grub2_init_on_alloc_argument/rule.yml | 46 +++++++++++++++++++
|
||||
shared/references/cce-redhat-avail.txt | 1 -
|
||||
2 files changed, 46 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..592e2fb117d
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
@@ -0,0 +1,46 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: rhel9
|
||||
+
|
||||
+title: 'Configure kernel to zero out memory before allocation (through Grub2)'
|
||||
+
|
||||
+description: |-
|
||||
+ To configure the kernel to zero out memory before allocating it, add the
|
||||
+ <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line for
|
||||
+ the Linux operating system in <tt>/etc/default/grub</tt>, in the manner
|
||||
+ below:
|
||||
+ <pre>GRUB_CMDLINE_LINUX="crashkernel=auto quiet rd.shell=0 audit=1 audit_backlog_limit=8192 init_on_alloc=1"</pre>
|
||||
+ Update the boot parameter for existing kernels by running the following command:
|
||||
+ <pre># grubby --update-kernel=ALL --args="init_on_alloc=1"</pre>
|
||||
+
|
||||
+rationale: |-
|
||||
+ When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
|
||||
+ all page allocator and slab allocator memory will be zeroed when allocated,
|
||||
+ eliminating many kinds of "uninitialized heap memory" flaws, effectively
|
||||
+ preventing data leaks.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-85867-0
|
||||
+
|
||||
+ocil_clause: 'the kernel is not configured to zero out memory before allocation'
|
||||
+
|
||||
+ocil: |-
|
||||
+ Make sure that the kernel is configured to zero out memory before
|
||||
+ allocation. Ensure that the parameter is configured in
|
||||
+ <tt>/etc/default/grub</tt>:
|
||||
+ <pre>grep GRUB_CMDLINE_LINUX /etc/default/grub</pre>
|
||||
+ The output should contain <tt>init_on_alloc=1</tt>.
|
||||
+ Run the following command to display command line parameters of all
|
||||
+ installed kernels:
|
||||
+ <pre># grubby --info=ALL | grep args</pre>
|
||||
+ Ensure that each line contains the <tt>init_on_alloc=1</tt> parameter.
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: grub2_bootloader_argument
|
||||
+ vars:
|
||||
+ arg_name: init_on_alloc
|
||||
+ arg_value: '1'
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 8aad24b20f7..6835189cd99 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -1,4 +1,3 @@
|
||||
-CCE-85867-0
|
||||
CCE-85868-8
|
||||
CCE-85872-0
|
||||
CCE-85873-8
|
||||
|
||||
From a865514257c85d79aaf7e4286d8723aa1ad8de03 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 24 Jan 2022 10:01:23 +0100
|
||||
Subject: [PATCH 5/7] add zipl_init_on_alloc_argument rule
|
||||
|
||||
---
|
||||
.../zipl_init_on_alloc_argument/rule.yml | 41 +++++++++++++++++++
|
||||
.../tests/correct_option.pass.sh | 15 +++++++
|
||||
.../tests/missing_in_cmdline.fail.sh | 13 ++++++
|
||||
.../tests/missing_in_entry.fail.sh | 13 ++++++
|
||||
shared/references/cce-redhat-avail.txt | 1 -
|
||||
5 files changed, 82 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
|
||||
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
|
||||
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..b47a7757327
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
@@ -0,0 +1,41 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: rhel9
|
||||
+
|
||||
+title: 'Configure kernel to zero out memory before allocation (through zIPl)'
|
||||
+
|
||||
+description: |-
|
||||
+ To ensure that the kernel is configured to zero out memory before
|
||||
+ allocation, check that all boot entries in
|
||||
+ <tt>/boot/loader/entries/*.conf</tt> have <tt>init_on_alloc=1</tt>
|
||||
+ included in its options.<br />
|
||||
+
|
||||
+ To ensure that new kernels and boot entries continue to zero out memory
|
||||
+ before allocation, add <tt>init_on_alloc=1</tt> to <tt>/etc/kernel/cmdline</tt>.
|
||||
+
|
||||
+rationale: |-
|
||||
+ When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
|
||||
+ all page allocator and slab allocator memory will be zeroed when allocated,
|
||||
+ eliminating many kinds of "uninitialized heap memory" flaws, effectively
|
||||
+ preventing data leaks.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-85868-8
|
||||
+
|
||||
+ocil_clause: 'the kernel is not configured to zero out memory before allocation'
|
||||
+
|
||||
+ocil: |-
|
||||
+ To check that the kernel is configured to zero out memory before allocation
|
||||
+ time, check all boot entries with following command:
|
||||
+ <pre>sudo grep -L"^options\s+.*\binit_on_alloc=1\b" /boot/loader/entries/*.conf</pre>
|
||||
+ No line should be returned, each line returned is a boot entry that doesn't enable audit.
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: zipl_bls_entries_option
|
||||
+ vars:
|
||||
+ arg_name: init_on_alloc
|
||||
+ arg_value: '1'
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..50cf1b78f70
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
|
||||
@@ -0,0 +1,15 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
|
||||
+
|
||||
+# Make sure boot loader entries contain init_on_alloc=1
|
||||
+for file in /boot/loader/entries/*.conf
|
||||
+do
|
||||
+ if ! grep -q '^options.*init_on_alloc=1.*$' "$file" ; then
|
||||
+ sed -i '/^options / s/$/ init_on_alloc=1/' "$file"
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+# Make sure /etc/kernel/cmdline contains init_on_alloc=1
|
||||
+if ! grep -qs '^(.*\s)?init_on_alloc=1(\s.*)?$' /etc/kernel/cmdline ; then
|
||||
+ echo "init_on_alloc=1" >> /etc/kernel/cmdline
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..7c0d9154776
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
|
||||
+
|
||||
+# Make sure boot loader entries contain init_on_alloc=1
|
||||
+for file in /boot/loader/entries/*.conf
|
||||
+do
|
||||
+ if ! grep -q '^options.*init_on_alloc=1.*$' "$file" ; then
|
||||
+ sed -i '/^options / s/$/ init_on_alloc=1/' "$file"
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+# Make sure /etc/kernel/cmdline doesn't contain init_on_alloc=1
|
||||
+sed -Ei 's/(^.*)init_on_alloc=1(.*?)$/\1\2/' /etc/kernel/cmdline || true
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..9d330c9192d
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
|
||||
+
|
||||
+# Remove init_on_alloc=1 from all boot entries
|
||||
+sed -Ei 's/(^options.*\s)init_on_alloc=1(.*?)$/\1\2/' /boot/loader/entries/*
|
||||
+# But make sure one boot loader entry contains init_on_alloc=1
|
||||
+sed -i '/^options / s/$/ init_on_alloc=1/' /boot/loader/entries/*rescue.conf
|
||||
+sed -Ei 's/(^options.*\s)\$kernelopts(.*?)$/\1\2/' /boot/loader/entries/*rescue.conf
|
||||
+
|
||||
+# Make sure /etc/kernel/cmdline contains init_on_alloc=1
|
||||
+if ! grep -qs '^(.*\s)?init_on_alloc=1(\s.*)?$' /etc/kernel/cmdline ; then
|
||||
+ echo "init_on_alloc=1" >> /etc/kernel/cmdline
|
||||
+fi
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 6835189cd99..05a641aeaf0 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -1,4 +1,3 @@
|
||||
-CCE-85868-8
|
||||
CCE-85872-0
|
||||
CCE-85873-8
|
||||
CCE-85874-6
|
||||
|
||||
From 9ca5ec04e734941b1c401369b6da6672b42824b1 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 24 Jan 2022 10:07:24 +0100
|
||||
Subject: [PATCH 6/7] add new rules to rhel9 ospp
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 7e30054bc98..28c7e92d298 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -126,6 +126,7 @@ selections:
|
||||
- grub2_audit_argument
|
||||
- grub2_audit_backlog_limit_argument
|
||||
- grub2_vsyscall_argument
|
||||
+ - grub2_init_on_alloc_argument
|
||||
|
||||
## Security Settings
|
||||
- sysctl_kernel_kptr_restrict
|
||||
@@ -413,3 +414,4 @@ selections:
|
||||
- zipl_audit_argument
|
||||
- zipl_audit_backlog_limit_argument
|
||||
- zipl_vsyscall_argument
|
||||
+ - zipl_init_on_alloc_argument
|
||||
|
||||
From 42a118bcc615051ae4cd268a5fc758aa5d75108d Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Thu, 27 Jan 2022 14:08:20 +0100
|
||||
Subject: [PATCH 7/7] make rule names consistent
|
||||
|
||||
---
|
||||
.../bootloader-grub2/grub2_init_on_alloc_argument/rule.yml | 2 +-
|
||||
.../system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
index 592e2fb117d..a9253c74cc6 100644
|
||||
--- a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
|
||||
@@ -2,7 +2,7 @@ documentation_complete: true
|
||||
|
||||
prodtype: rhel9
|
||||
|
||||
-title: 'Configure kernel to zero out memory before allocation (through Grub2)'
|
||||
+title: 'Configure kernel to zero out memory before allocation'
|
||||
|
||||
description: |-
|
||||
To configure the kernel to zero out memory before allocating it, add the
|
||||
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
index b47a7757327..fa272250a28 100644
|
||||
--- a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
|
||||
@@ -2,7 +2,7 @@ documentation_complete: true
|
||||
|
||||
prodtype: rhel9
|
||||
|
||||
-title: 'Configure kernel to zero out memory before allocation (through zIPl)'
|
||||
+title: 'Configure kernel to zero out memory before allocation in zIPL'
|
||||
|
||||
description: |-
|
||||
To ensure that the kernel is configured to zero out memory before
|
||||
@ -1,25 +0,0 @@
|
||||
From e38df8801bd2c1bb1e419151f4f0fe8923287bfc Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 24 Jan 2022 10:13:13 +0100
|
||||
Subject: [PATCH] drop rules
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 3 ---
|
||||
1 file changed, 3 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 287a28c43c5..436ea1f3a49 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -161,11 +161,8 @@ selections:
|
||||
- auditd_name_format
|
||||
|
||||
### Module Blacklist
|
||||
- - kernel_module_cramfs_disabled
|
||||
- kernel_module_bluetooth_disabled
|
||||
- kernel_module_sctp_disabled
|
||||
- - kernel_module_firewire-core_disabled
|
||||
- - kernel_module_atm_disabled
|
||||
- kernel_module_can_disabled
|
||||
- kernel_module_tipc_disabled
|
||||
|
||||
@ -1,855 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml
|
||||
new file mode 100644
|
||||
index 00000000000..b44c91cbf4a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml
|
||||
@@ -0,0 +1,150 @@
|
||||
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
|
||||
+# reboot = false
|
||||
+# strategy = configure
|
||||
+# complexity = low
|
||||
+# disruption = medium
|
||||
+
|
||||
+- name: Check for existing pam_pwquality.so entry
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ path: "/etc/pam.d/password-auth"
|
||||
+ create: no
|
||||
+ regexp: '^password.*pam_pwquality.so.*'
|
||||
+ state: absent
|
||||
+ check_mode: true
|
||||
+ changed_when: false
|
||||
+ register: result_pam_pwquality_present
|
||||
+
|
||||
+- name: Check if system relies on authselect
|
||||
+ ansible.builtin.stat:
|
||||
+ path: /usr/bin/authselect
|
||||
+ register: result_authselect_present
|
||||
+
|
||||
+- name: "Remediation where authselect tool is present"
|
||||
+ block:
|
||||
+ - name: Check the integrity of the current authselect profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect check
|
||||
+ register: result_authselect_check_cmd
|
||||
+ changed_when: false
|
||||
+ ignore_errors: true
|
||||
+
|
||||
+ - name: Informative message based on the authselect integrity check result
|
||||
+ ansible.builtin.assert:
|
||||
+ that:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ fail_msg:
|
||||
+ - authselect integrity check failed. Remediation aborted!
|
||||
+ - This remediation could not be applied because the authselect profile is not intact.
|
||||
+ - It is not recommended to manually edit the PAM files when authselect is available.
|
||||
+ - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
|
||||
+ success_msg:
|
||||
+ - authselect integrity check passed
|
||||
+
|
||||
+ - name: Get authselect current profile
|
||||
+ ansible.builtin.shell:
|
||||
+ cmd: authselect current -r | awk '{ print $1 }'
|
||||
+ register: result_authselect_profile
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+
|
||||
+ - name: Define the current authselect profile as a local fact
|
||||
+ ansible.builtin.set_fact:
|
||||
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ authselect_custom_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_profile.stdout is match("custom/")
|
||||
+
|
||||
+ - name: Define the new authselect custom profile as a local fact
|
||||
+ ansible.builtin.set_fact:
|
||||
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ authselect_custom_profile: "custom/hardening"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_profile.stdout is not match("custom/")
|
||||
+
|
||||
+ - name: Get authselect current features to also enable them in the custom profile
|
||||
+ ansible.builtin.shell:
|
||||
+ cmd: authselect current | tail -n+3 | awk '{ print $2 }'
|
||||
+ register: result_authselect_features
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+
|
||||
+ - name: Check if any custom profile with the same name was already created in the past
|
||||
+ ansible.builtin.stat:
|
||||
+ path: /etc/authselect/{{ authselect_custom_profile }}
|
||||
+ register: result_authselect_custom_profile_present
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+
|
||||
+ - name: Create a custom profile based on the current profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect create-profile hardening -b sssd
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - not result_authselect_custom_profile_present.stat.exists
|
||||
+
|
||||
+ - name: Ensure the desired configuration is present in the custom profile
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ dest: "/etc/authselect/{{ authselect_custom_profile }}/password-auth"
|
||||
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
|
||||
+ line: "password requisite pam_pwquality.so"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_pam_pwquality_present.found == 0
|
||||
+
|
||||
+ - name: Ensure a backup of current authselect profile before selecting the custom profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
|
||||
+ register: result_authselect_backup
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - authselect_custom_profile is not match(authselect_current_profile)
|
||||
+
|
||||
+ - name: Ensure the custom profile is selected
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect select {{ authselect_custom_profile }} --force
|
||||
+ register: result_pam_authselect_select_profile
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - authselect_custom_profile is not match(authselect_current_profile)
|
||||
+
|
||||
+ - name: Restore the authselect features in the custom profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect enable-feature {{ item }}
|
||||
+ loop: "{{ result_authselect_features.stdout_lines }}"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_features is not skipped
|
||||
+ - result_pam_authselect_select_profile is not skipped
|
||||
+
|
||||
+ - name: Ensure the custom profile changes are applied
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ when:
|
||||
+ - result_authselect_present.stat.exists
|
||||
+
|
||||
+# For systems without authselect
|
||||
+- name: "Remediation where authselect tool is not present and PAM files are directly edited"
|
||||
+ block:
|
||||
+ - name: Ensure the desired configuration is present in the custom profile
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ dest: "/etc/pam.d/password-auth"
|
||||
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
|
||||
+ line: "password requisite pam_pwquality.so"
|
||||
+ when:
|
||||
+ - result_pam_pwquality_present.found == 0
|
||||
+ when:
|
||||
+ - not result_authselect_present.stat.exists
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..d2fca2a79ca
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh
|
||||
@@ -0,0 +1,41 @@
|
||||
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
|
||||
+
|
||||
+PAM_FILE="password-auth"
|
||||
+
|
||||
+if [ -f /usr/bin/authselect ]; then
|
||||
+ if authselect check; then
|
||||
+ CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
|
||||
+ # Standard profiles delivered with authselect should not be modified.
|
||||
+ # If not already in use, a custom profile is created preserving the enabled features.
|
||||
+ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
|
||||
+ ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
|
||||
+ authselect create-profile hardening -b $CURRENT_PROFILE
|
||||
+ CURRENT_PROFILE="custom/hardening"
|
||||
+ # Ensure a backup before changing the profile
|
||||
+ authselect apply-changes -b --backup=before-pwquality-hardening.backup
|
||||
+ authselect select $CURRENT_PROFILE
|
||||
+ for feature in $ENABLED_FEATURES; do
|
||||
+ authselect enable-feature $feature;
|
||||
+ done
|
||||
+ fi
|
||||
+ # Include the desired configuration in the custom profile
|
||||
+ CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
|
||||
+ # The line should be included on the top password section
|
||||
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_FILE) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_FILE
|
||||
+ fi
|
||||
+ authselect apply-changes -b --backup=after-pwquality-hardening.backup
|
||||
+ else
|
||||
+ echo "
|
||||
+authselect integrity check failed. Remediation aborted!
|
||||
+This remediation could not be applied because the authselect profile is not intact.
|
||||
+It is not recommended to manually edit the PAM files when authselect is available.
|
||||
+In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
|
||||
+ false
|
||||
+ fi
|
||||
+else
|
||||
+ FILE_PATH="/etc/pam.d/$PAM_FILE"
|
||||
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $FILE_PATH) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $FILE_PATH
|
||||
+ fi
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..84f32456beb
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml
|
||||
@@ -0,0 +1,21 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
||||
+ {{{ oval_metadata("The PAM module pam_pwquality is used in password-auth") }}}
|
||||
+ <criteria comment="Condition for pam_pwquality in password-auth is satisfied">
|
||||
+ <criterion comment="pam_pwquality password-auth"
|
||||
+ test_ref="test_accounts_password_pam_pwquality_password_auth"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_accounts_password_pam_pwquality_password_auth" version="1">
|
||||
+ <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="equals">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1"
|
||||
+ id="test_accounts_password_pam_pwquality_password_auth"
|
||||
+ comment="check the configuration of /etc/pam.d/password-auth">
|
||||
+ <ind:object object_ref="object_accounts_password_pam_pwquality_password_auth"/>
|
||||
+ </ind:textfilecontent54_test>
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..6c7bb1ad7a0
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
|
||||
@@ -0,0 +1,35 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
|
||||
+
|
||||
+title: 'Ensure PAM password complexity module is enabled in password-auth'
|
||||
+
|
||||
+description: |-
|
||||
+ To enable PAM password complexity in password-auth file:
|
||||
+ Edit the <tt>password</tt> section in
|
||||
+ <tt>/etc/pam.d/password-auth</tt> to show
|
||||
+ <tt>password requisite pam_pwquality.so</tt>.
|
||||
+
|
||||
+rationale: |-
|
||||
+ Enabling PAM password complexity permits to enforce strong passwords and consequently
|
||||
+ makes the system less prone to dictionary attacks.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel7: CCE-85876-1
|
||||
+ cce@rhel8: CCE-85877-9
|
||||
+ cce@rhel9: CCE-85878-7
|
||||
+
|
||||
+references:
|
||||
+ stigid@rhel8: RHEL-08-020100
|
||||
+
|
||||
+ocil_clause: 'pam_pwquality.so is not enabled in password-auth'
|
||||
+
|
||||
+ocil: |-
|
||||
+ To check if pam_pwhistory.so is enabled in password-auth, run the following command:
|
||||
+ <pre>$ grep pam_pwquality /etc/pam.d/password-auth</pre></pre>
|
||||
+ The output should be similar to the following:
|
||||
+ <pre>password requisite pam_pwquality.so</pre>
|
||||
+
|
||||
+platform: pam
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..3d696c36b76
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
|
||||
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $CUSTOM_SYSTEM_AUTH
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..0435899262b
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
|
||||
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_SYSTEM_AUTH) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_SYSTEM_AUTH
|
||||
+fi
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..472616a51f6
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
|
||||
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $CUSTOM_SYSTEM_AUTH
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..59f9d6f77c4
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+# remediation = none
|
||||
+
|
||||
+SYSTEM_AUTH_FILE="/etc/pam.d/password-auth"
|
||||
+
|
||||
+# This modification will break the integrity checks done by authselect.
|
||||
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $SYSTEM_AUTH_FILE
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..71f87b19045
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+# packages = pam
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
|
||||
+
|
||||
+config_file=/etc/pam.d/password-auth
|
||||
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $config_file) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $config_file
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..95b73b24d26
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
|
||||
+# packages = pam
|
||||
+
|
||||
+config_file=/etc/pam.d/password-auth
|
||||
+
|
||||
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $config_file
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml
|
||||
new file mode 100644
|
||||
index 00000000000..13cd20458ed
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml
|
||||
@@ -0,0 +1,150 @@
|
||||
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
|
||||
+# reboot = false
|
||||
+# strategy = configure
|
||||
+# complexity = low
|
||||
+# disruption = medium
|
||||
+
|
||||
+- name: Check for existing pam_pwquality.so entry
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ path: "/etc/pam.d/system-auth"
|
||||
+ create: no
|
||||
+ regexp: '^password.*pam_pwquality.so.*'
|
||||
+ state: absent
|
||||
+ check_mode: true
|
||||
+ changed_when: false
|
||||
+ register: result_pam_pwquality_present
|
||||
+
|
||||
+- name: Check if system relies on authselect
|
||||
+ ansible.builtin.stat:
|
||||
+ path: /usr/bin/authselect
|
||||
+ register: result_authselect_present
|
||||
+
|
||||
+- name: "Remediation where authselect tool is present"
|
||||
+ block:
|
||||
+ - name: Check the integrity of the current authselect profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect check
|
||||
+ register: result_authselect_check_cmd
|
||||
+ changed_when: false
|
||||
+ ignore_errors: true
|
||||
+
|
||||
+ - name: Informative message based on the authselect integrity check result
|
||||
+ ansible.builtin.assert:
|
||||
+ that:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ fail_msg:
|
||||
+ - authselect integrity check failed. Remediation aborted!
|
||||
+ - This remediation could not be applied because the authselect profile is not intact.
|
||||
+ - It is not recommended to manually edit the PAM files when authselect is available.
|
||||
+ - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
|
||||
+ success_msg:
|
||||
+ - authselect integrity check passed
|
||||
+
|
||||
+ - name: Get authselect current profile
|
||||
+ ansible.builtin.shell:
|
||||
+ cmd: authselect current -r | awk '{ print $1 }'
|
||||
+ register: result_authselect_profile
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+
|
||||
+ - name: Define the current authselect profile as a local fact
|
||||
+ ansible.builtin.set_fact:
|
||||
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ authselect_custom_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_profile.stdout is match("custom/")
|
||||
+
|
||||
+ - name: Define the new authselect custom profile as a local fact
|
||||
+ ansible.builtin.set_fact:
|
||||
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
|
||||
+ authselect_custom_profile: "custom/hardening"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_profile.stdout is not match("custom/")
|
||||
+
|
||||
+ - name: Get authselect current features to also enable them in the custom profile
|
||||
+ ansible.builtin.shell:
|
||||
+ cmd: authselect current | tail -n+3 | awk '{ print $2 }'
|
||||
+ register: result_authselect_features
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+
|
||||
+ - name: Check if any custom profile with the same name was already created in the past
|
||||
+ ansible.builtin.stat:
|
||||
+ path: /etc/authselect/{{ authselect_custom_profile }}
|
||||
+ register: result_authselect_custom_profile_present
|
||||
+ changed_when: false
|
||||
+ when:
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+
|
||||
+ - name: Create a custom profile based on the current profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect create-profile hardening -b sssd
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - not result_authselect_custom_profile_present.stat.exists
|
||||
+
|
||||
+ - name: Ensure the desired configuration is present in the custom profile
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ dest: "/etc/authselect/{{ authselect_custom_profile }}/system-auth"
|
||||
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
|
||||
+ line: "password requisite pam_pwquality.so"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_pam_pwquality_present.found == 0
|
||||
+
|
||||
+ - name: Ensure a backup of current authselect profile before selecting the custom profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
|
||||
+ register: result_authselect_backup
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - authselect_custom_profile is not match(authselect_current_profile)
|
||||
+
|
||||
+ - name: Ensure the custom profile is selected
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect select {{ authselect_custom_profile }} --force
|
||||
+ register: result_pam_authselect_select_profile
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - authselect_current_profile is not match("custom/")
|
||||
+ - authselect_custom_profile is not match(authselect_current_profile)
|
||||
+
|
||||
+ - name: Restore the authselect features in the custom profile
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect enable-feature {{ item }}
|
||||
+ loop: "{{ result_authselect_features.stdout_lines }}"
|
||||
+ when:
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ - result_authselect_features is not skipped
|
||||
+ - result_pam_authselect_select_profile is not skipped
|
||||
+
|
||||
+ - name: Ensure the custom profile changes are applied
|
||||
+ ansible.builtin.command:
|
||||
+ cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
|
||||
+ when:
|
||||
+ - result_authselect_check_cmd is success
|
||||
+ - result_authselect_profile is not skipped
|
||||
+ when:
|
||||
+ - result_authselect_present.stat.exists
|
||||
+
|
||||
+# For systems without authselect
|
||||
+- name: "Remediation where authselect tool is not present and PAM files are directly edited"
|
||||
+ block:
|
||||
+ - name: Ensure the desired configuration is present in the custom profile
|
||||
+ ansible.builtin.lineinfile:
|
||||
+ dest: "/etc/pam.d/system-auth"
|
||||
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
|
||||
+ line: "password requisite pam_pwquality.so"
|
||||
+ when:
|
||||
+ - result_pam_pwquality_present.found == 0
|
||||
+ when:
|
||||
+ - not result_authselect_present.stat.exists
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..9a7972a3f93
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh
|
||||
@@ -0,0 +1,41 @@
|
||||
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
|
||||
+
|
||||
+PAM_FILE="system-auth"
|
||||
+
|
||||
+if [ -f /usr/bin/authselect ]; then
|
||||
+ if authselect check; then
|
||||
+ CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
|
||||
+ # Standard profiles delivered with authselect should not be modified.
|
||||
+ # If not already in use, a custom profile is created preserving the enabled features.
|
||||
+ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
|
||||
+ ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
|
||||
+ authselect create-profile hardening -b $CURRENT_PROFILE
|
||||
+ CURRENT_PROFILE="custom/hardening"
|
||||
+ # Ensure a backup before changing the profile
|
||||
+ authselect apply-changes -b --backup=before-pwquality-hardening.backup
|
||||
+ authselect select $CURRENT_PROFILE
|
||||
+ for feature in $ENABLED_FEATURES; do
|
||||
+ authselect enable-feature $feature;
|
||||
+ done
|
||||
+ fi
|
||||
+ # Include the desired configuration in the custom profile
|
||||
+ CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
|
||||
+ # The line should be included on the top password section
|
||||
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_FILE) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_FILE
|
||||
+ fi
|
||||
+ authselect apply-changes -b --backup=after-pwquality-hardening.backup
|
||||
+ else
|
||||
+ echo "
|
||||
+authselect integrity check failed. Remediation aborted!
|
||||
+This remediation could not be applied because the authselect profile is not intact.
|
||||
+It is not recommended to manually edit the PAM files when authselect is available.
|
||||
+In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
|
||||
+ false
|
||||
+ fi
|
||||
+else
|
||||
+ FILE_PATH="/etc/pam.d/$PAM_FILE"
|
||||
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $FILE_PATH) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $FILE_PATH
|
||||
+ fi
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..f8d241f1ff2
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml
|
||||
@@ -0,0 +1,21 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
||||
+ {{{ oval_metadata("The PAM module pam_pwquality is used in system-auth") }}}
|
||||
+ <criteria comment="Condition for pam_pwquality in system-auth is satisfied">
|
||||
+ <criterion comment="pam_pwquality system-auth"
|
||||
+ test_ref="test_accounts_password_pam_pwquality_system_auth"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_accounts_password_pam_pwquality_system_auth" version="1">
|
||||
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="equals">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1"
|
||||
+ id="test_accounts_password_pam_pwquality_system_auth"
|
||||
+ comment="check the configuration of /etc/pam.d/system-auth">
|
||||
+ <ind:object object_ref="object_accounts_password_pam_pwquality_system_auth"/>
|
||||
+ </ind:textfilecontent54_test>
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..ea42ff9b07a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
|
||||
@@ -0,0 +1,35 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
|
||||
+
|
||||
+title: 'Ensure PAM password complexity module is enabled in system-auth'
|
||||
+
|
||||
+description: |-
|
||||
+ To enable PAM password complexity in system-auth file:
|
||||
+ Edit the <tt>password</tt> section in
|
||||
+ <tt>/etc/pam.d/system-auth</tt> to show
|
||||
+ <tt>password requisite pam_pwquality.so</tt>.
|
||||
+
|
||||
+rationale: |-
|
||||
+ Enabling PAM password complexity permits to enforce strong passwords and consequently
|
||||
+ makes the system less prone to dictionary attacks.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel7: CCE-85874-6
|
||||
+ cce@rhel8: CCE-85872-0
|
||||
+ cce@rhel9: CCE-85873-8
|
||||
+
|
||||
+references:
|
||||
+ stigid@rhel8: RHEL-08-020101
|
||||
+
|
||||
+ocil_clause: 'pam_pwquality.so is not enabled in system-auth'
|
||||
+
|
||||
+ocil: |-
|
||||
+ To check if pam_pwhistory.so is enabled in system-auth, run the following command:
|
||||
+ <pre>$ grep pam_pwquality /etc/pam.d/system-auth</pre></pre>
|
||||
+ The output should be similar to the following:
|
||||
+ <pre>password requisite pam_pwquality.so</pre>
|
||||
+
|
||||
+platform: pam
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..849f16d0f93
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
|
||||
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $CUSTOM_SYSTEM_AUTH
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6a98c244980
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
|
||||
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_SYSTEM_AUTH) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_SYSTEM_AUTH
|
||||
+fi
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6786f6c13d7
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+
|
||||
+authselect create-profile hardening -b sssd
|
||||
+CUSTOM_PROFILE="custom/hardening"
|
||||
+authselect select $CUSTOM_PROFILE --force
|
||||
+
|
||||
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
|
||||
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $CUSTOM_SYSTEM_AUTH
|
||||
+authselect apply-changes -b
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..b3d9e5884f5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# packages = authselect
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
|
||||
+# remediation = none
|
||||
+
|
||||
+SYSTEM_AUTH_FILE="/etc/pam.d/system-auth"
|
||||
+
|
||||
+# This modification will break the integrity checks done by authselect.
|
||||
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $SYSTEM_AUTH_FILE
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..71f87b19045
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+# packages = pam
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
|
||||
+
|
||||
+config_file=/etc/pam.d/password-auth
|
||||
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $config_file) -eq 0 ]; then
|
||||
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $config_file
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..3c8f6f79fe9
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
|
||||
+# packages = pam
|
||||
+
|
||||
+config_file=/etc/pam.d/system-auth
|
||||
+
|
||||
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $config_file
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
|
||||
index eeb55a6ff5c..6b2219a3eab 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
|
||||
@@ -6,13 +6,16 @@ title: 'Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
|
||||
|
||||
description: |-
|
||||
To configure the number of retry prompts that are permitted per-session:
|
||||
+ {{% if product in ['rhel8', 'rhel9'] %}}
|
||||
+ Edit the <tt>/etc/security/pwquality.conf</tt> to include
|
||||
+ {{% else %}}
|
||||
Edit the <tt>pam_pwquality.so</tt> statement in
|
||||
{{% if 'ubuntu' not in product %}}
|
||||
- <tt>/etc/pam.d/system-auth</tt> {{% if product in ['rhel8', 'rhel9'] %}} and
|
||||
- <tt>/etc/pam.d/password-auth</tt> {{% endif %}} to show
|
||||
+ <tt>/etc/pam.d/system-auth</tt> to show
|
||||
{{% else %}}
|
||||
<tt>/etc/pam.d/common-password</tt> to show
|
||||
{{% endif %}}
|
||||
+ {{% endif %}}
|
||||
<tt>retry={{{xccdf_value("var_password_pam_retry") }}}</tt>, or a lower value if site
|
||||
policy is more restrictive. The DoD requirement is a maximum of 3 prompts
|
||||
per session.
|
||||
@@ -48,17 +51,21 @@ references:
|
||||
stigid@ol7: OL07-00-010119
|
||||
stigid@ol8: OL08-00-020100
|
||||
stigid@rhel7: RHEL-07-010119
|
||||
- stigid@rhel8: RHEL-08-020100
|
||||
+ stigid@rhel8: RHEL-08-020104
|
||||
stigid@ubuntu2004: UBTU-20-010057
|
||||
|
||||
ocil_clause: 'it is not the required value'
|
||||
|
||||
ocil: |-
|
||||
To check how many retry attempts are permitted on a per-session basis, run the following command:
|
||||
+ {{% if product in ['rhel8', 'rhel9'] %}}
|
||||
+ <pre>$ grep retry /etc/security/pwquality.conf</pre>
|
||||
+ {{% else %}}
|
||||
{{% if 'ubuntu' in product %}}
|
||||
<pre>$ grep pam_pwquality /etc/pam.d/common-password</pre>
|
||||
{{% else %}}
|
||||
- <pre>$ grep pam_pwquality /etc/pam.d/system-auth {{% if product in ['rhel8', 'rhel9'] %}}/etc/pam.d/password-auth{{% endif %}}</pre>
|
||||
+ <pre>$ grep pam_pwquality /etc/pam.d/system-auth</pre>
|
||||
+ {{% endif %}}
|
||||
{{% endif %}}
|
||||
The <tt>retry</tt> parameter will indicate how many attempts are permitted.
|
||||
The DoD required value is less than or equal to 3.
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index d92bc72971c..62fc512f05e 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -523,6 +523,20 @@ selections:
|
||||
- sssd_enable_certmap
|
||||
|
||||
# RHEL-08-020100
|
||||
+ - accounts_password_pam_pwquality_password_auth
|
||||
+
|
||||
+ # RHEL-08-020101
|
||||
+ - accounts_password_pam_pwquality_system_auth
|
||||
+
|
||||
+ # RHEL-08-020102
|
||||
+ # This is only required for RHEL8 systems below version 8.4 where the
|
||||
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
|
||||
+
|
||||
+ # RHEL-08-020103
|
||||
+ # This is only required for RHEL8 systems below version 8.4 where the
|
||||
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
|
||||
+
|
||||
+ # RHEL-08-020104
|
||||
- accounts_password_pam_retry
|
||||
|
||||
# RHEL-08-020110
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 42c6d0e9aca..ad08a6d3410 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -524,6 +524,20 @@ selections:
|
||||
- sssd_enable_certmap
|
||||
|
||||
# RHEL-08-020100
|
||||
+ - accounts_password_pam_pwquality_password_auth
|
||||
+
|
||||
+ # RHEL-08-020101
|
||||
+ - accounts_password_pam_pwquality_system_auth
|
||||
+
|
||||
+ # RHEL-08-020102
|
||||
+ # This is only required for RHEL8 systems below version 8.4 where the
|
||||
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
|
||||
+
|
||||
+ # RHEL-08-020103
|
||||
+ # This is only required for RHEL8 systems below version 8.4 where the
|
||||
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
|
||||
+
|
||||
+ # RHEL-08-020104
|
||||
- accounts_password_pam_retry
|
||||
|
||||
# RHEL-08-020110
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index e4fee44f9f9..33e82401c3d 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -53,6 +53,8 @@ selections:
|
||||
- accounts_password_pam_ocredit
|
||||
- accounts_password_pam_pwhistory_remember_password_auth
|
||||
- accounts_password_pam_pwhistory_remember_system_auth
|
||||
+- accounts_password_pam_pwquality_password_auth
|
||||
+- accounts_password_pam_pwquality_system_auth
|
||||
- accounts_password_pam_retry
|
||||
- accounts_password_pam_ucredit
|
||||
- accounts_password_pam_unix_rounds_password_auth
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 83d04775e3a..5beeb4f28af 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -64,6 +64,8 @@ selections:
|
||||
- accounts_password_pam_ocredit
|
||||
- accounts_password_pam_pwhistory_remember_password_auth
|
||||
- accounts_password_pam_pwhistory_remember_system_auth
|
||||
+- accounts_password_pam_pwquality_password_auth
|
||||
+- accounts_password_pam_pwquality_system_auth
|
||||
- accounts_password_pam_retry
|
||||
- accounts_password_pam_ucredit
|
||||
- accounts_password_pam_unix_rounds_password_auth
|
||||
@ -1,126 +0,0 @@
|
||||
From 622558873703704bd97fde1874a9a782d4cb8b0e Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 17:51:50 +0100
|
||||
Subject: [PATCH] Introduce CPE for aarch64 and make package_rear_installed n/a
|
||||
aarch64.
|
||||
|
||||
This rule is not applicable for RHEL9 only.
|
||||
---
|
||||
.../package_rear_installed/rule.yml | 4 +++
|
||||
shared/applicability/arch.yml | 12 +++++++
|
||||
...proc_sys_kernel_osrelease_arch_aarch64.xml | 33 +++++++++++++++++++
|
||||
..._sys_kernel_osrelease_arch_not_aarch64.xml | 16 +++++++++
|
||||
ssg/constants.py | 2 ++
|
||||
5 files changed, 67 insertions(+)
|
||||
create mode 100644 shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
|
||||
create mode 100644 shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
|
||||
|
||||
diff --git a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
|
||||
index 6e3c11e5749..efb591654a9 100644
|
||||
--- a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
|
||||
+++ b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
|
||||
@@ -25,6 +25,10 @@ ocil: '{{{ ocil_package(package="rear") }}}'
|
||||
# The package is not available for s309x on RHEL<8.5
|
||||
# platform: not_s390x_arch
|
||||
|
||||
+{{%- if product == "rhel9" %}}
|
||||
+platform: not_aarch64_arch
|
||||
+{{%- endif %}}
|
||||
+
|
||||
template:
|
||||
name: package_installed
|
||||
vars:
|
||||
diff --git a/shared/applicability/arch.yml b/shared/applicability/arch.yml
|
||||
index d2cbd102310..9ac05317a95 100644
|
||||
--- a/shared/applicability/arch.yml
|
||||
+++ b/shared/applicability/arch.yml
|
||||
@@ -12,3 +12,15 @@ cpes:
|
||||
check_id: proc_sys_kernel_osrelease_arch_s390x
|
||||
bash_conditional: 'grep -q s390x /proc/sys/kernel/osrelease'
|
||||
|
||||
+ - not_aarch64_arch:
|
||||
+ name: "cpe:/a:not_aarch64_arch"
|
||||
+ title: "System architecture is not AARCH64"
|
||||
+ check_id: proc_sys_kernel_osrelease_arch_not_aarch64
|
||||
+ bash_conditional: "! grep -q aarch64 /proc/sys/kernel/osrelease"
|
||||
+
|
||||
+ - aarch64_arch:
|
||||
+ name: "cpe:/a:aarch64_arch"
|
||||
+ title: "System architecture is AARCH64"
|
||||
+ check_id: proc_sys_kernel_osrelease_arch_aarch64
|
||||
+ bash_conditional: 'grep -q aarch64 /proc/sys/kernel/osrelease'
|
||||
+
|
||||
diff --git a/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml b/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
|
||||
new file mode 100644
|
||||
index 00000000000..3d54f81e6d4
|
||||
--- /dev/null
|
||||
+++ b/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
|
||||
@@ -0,0 +1,33 @@
|
||||
+<def-group>
|
||||
+ <definition class="inventory" id="proc_sys_kernel_osrelease_arch_aarch64"
|
||||
+ version="1">
|
||||
+ <metadata>
|
||||
+ <title>Test that the architecture is aarch64</title>
|
||||
+ <affected family="unix">
|
||||
+ <platform>multi_platform_all</platform>
|
||||
+ </affected>
|
||||
+ <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</description>
|
||||
+ </metadata>
|
||||
+ <criteria>
|
||||
+ <criterion comment="Architecture is aarch64"
|
||||
+ test_ref="test_proc_sys_kernel_osrelease_arch_aarch64" />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
|
||||
+ comment="proc_sys_kernel is for aarch64 architecture"
|
||||
+ id="test_proc_sys_kernel_osrelease_arch_aarch64"
|
||||
+ version="1">
|
||||
+ <ind:object object_ref="object_proc_sys_kernel_osrelease_arch_aarch64" />
|
||||
+ <ind:state state_ref="state_proc_sys_kernel_osrelease_arch_aarch64" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_proc_sys_kernel_osrelease_arch_aarch64" version="1">
|
||||
+ <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_state id="state_proc_sys_kernel_osrelease_arch_aarch64" version="1">
|
||||
+ <ind:subexpression datatype="string" operation="pattern match">^aarch64$</ind:subexpression>
|
||||
+ </ind:textfilecontent54_state>
|
||||
+</def-group>
|
||||
diff --git a/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml b/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
|
||||
new file mode 100644
|
||||
index 00000000000..3fce66ee00a
|
||||
--- /dev/null
|
||||
+++ b/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
|
||||
@@ -0,0 +1,16 @@
|
||||
+<def-group>
|
||||
+ <definition class="inventory" id="proc_sys_kernel_osrelease_arch_not_aarch64"
|
||||
+ version="1">
|
||||
+ <metadata>
|
||||
+ <title>Test for different architecture than aarch64</title>
|
||||
+ <affected family="unix">
|
||||
+ <platform>multi_platform_all</platform>
|
||||
+ </affected>
|
||||
+ <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</description>
|
||||
+ </metadata>
|
||||
+ <criteria>
|
||||
+ <extend_definition comment="Architecture is not aarch64"
|
||||
+ definition_ref="proc_sys_kernel_osrelease_arch_aarch64" negate="true"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+</def-group>
|
||||
diff --git a/ssg/constants.py b/ssg/constants.py
|
||||
index 64d7d36c989..92cc2f8de34 100644
|
||||
--- a/ssg/constants.py
|
||||
+++ b/ssg/constants.py
|
||||
@@ -424,6 +424,8 @@
|
||||
"non-uefi": None,
|
||||
"not_s390x_arch": None,
|
||||
"s390x_arch": None,
|
||||
+ "not_aarch64_arch": None,
|
||||
+ "aarch64_arch": None,
|
||||
"ovirt": None,
|
||||
"no_ovirt": None,
|
||||
}
|
||||
@ -1,44 +0,0 @@
|
||||
diff --git a/controls/stig_rhel8.yml b/controls/stig_rhel8.yml
|
||||
index d7821c2e3b8..fe6b0f01186 100644
|
||||
--- a/controls/stig_rhel8.yml
|
||||
+++ b/controls/stig_rhel8.yml
|
||||
@@ -584,11 +584,6 @@ controls:
|
||||
rules:
|
||||
- sshd_disable_root_login
|
||||
status: automated
|
||||
- - id: RHEL-08-010560
|
||||
- levels:
|
||||
- - medium
|
||||
- title: The auditd service must be running in RHEL 8.
|
||||
- status: pending
|
||||
- id: RHEL-08-010561
|
||||
levels:
|
||||
- medium
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 7c89bcbf659..09fa85df181 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -368,9 +368,6 @@ selections:
|
||||
# RHEL-08-010550
|
||||
- sshd_disable_root_login
|
||||
|
||||
- # RHEL-08-010560
|
||||
- - service_auditd_enabled
|
||||
-
|
||||
# RHEL-08-010561
|
||||
- service_rsyslog_enabled
|
||||
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 690991f697b..eb2cac913bd 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -369,9 +369,6 @@ selections:
|
||||
# RHEL-08-010550
|
||||
- sshd_disable_root_login
|
||||
|
||||
- # RHEL-08-010560
|
||||
- - service_auditd_enabled
|
||||
-
|
||||
# RHEL-08-010561
|
||||
- service_rsyslog_enabled
|
||||
|
||||
@ -1,106 +0,0 @@
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index d92bc72971c..98cabee38dd 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -51,7 +51,7 @@ selections:
|
||||
- var_password_pam_lcredit=1
|
||||
- var_password_pam_retry=3
|
||||
- var_password_pam_minlen=15
|
||||
- - var_sshd_set_keepalive=0
|
||||
+ # - var_sshd_set_keepalive=0
|
||||
- sshd_approved_macs=stig
|
||||
- sshd_approved_ciphers=stig
|
||||
- sshd_idle_timeout_value=10_minutes
|
||||
@@ -170,11 +170,13 @@ selections:
|
||||
# RHEL-08-010190
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
|
||||
- # RHEL-08-010200
|
||||
- - sshd_set_keepalive_0
|
||||
-
|
||||
- # RHEL-08-010201
|
||||
- - sshd_set_idle_timeout
|
||||
+ # These two items don't behave as they used to in RHEL8.6 and RHEL9
|
||||
+ # anymore. They will be disabled for now until an alternative
|
||||
+ # solution is found.
|
||||
+ # # RHEL-08-010200
|
||||
+ # - sshd_set_keepalive_0
|
||||
+ # # RHEL-08-010201
|
||||
+ # - sshd_set_idle_timeout
|
||||
|
||||
# RHEL-08-010210
|
||||
- file_permissions_var_log_messages
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 42c6d0e9aca..842f17c7021 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -52,7 +52,7 @@ selections:
|
||||
- var_password_pam_lcredit=1
|
||||
- var_password_pam_retry=3
|
||||
- var_password_pam_minlen=15
|
||||
- - var_sshd_set_keepalive=0
|
||||
+ # - var_sshd_set_keepalive=0
|
||||
- sshd_approved_macs=stig
|
||||
- sshd_approved_ciphers=stig
|
||||
- sshd_idle_timeout_value=10_minutes
|
||||
@@ -171,11 +171,13 @@ selections:
|
||||
# RHEL-08-010190
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
|
||||
- # RHEL-08-010200
|
||||
- - sshd_set_keepalive_0
|
||||
-
|
||||
- # RHEL-08-010201
|
||||
- - sshd_set_idle_timeout
|
||||
+ # These two items don't behave as they used to in RHEL8.6 and RHEL9
|
||||
+ # anymore. They will be disabled for now until an alternative
|
||||
+ # solution is found.
|
||||
+ # # RHEL-08-010200
|
||||
+ # - sshd_set_keepalive_0
|
||||
+ # # RHEL-08-010201
|
||||
+ # - sshd_set_idle_timeout
|
||||
|
||||
# RHEL-08-010210
|
||||
- file_permissions_var_log_messages
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index e4fee44f9f9..e3c8ebfc9a5 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -353,8 +353,6 @@ selections:
|
||||
- sshd_enable_warning_banner
|
||||
- sshd_print_last_log
|
||||
- sshd_rekey_limit
|
||||
-- sshd_set_idle_timeout
|
||||
-- sshd_set_keepalive_0
|
||||
- sshd_use_strong_rng
|
||||
- sshd_x11_use_localhost
|
||||
- sssd_certificate_verification
|
||||
@@ -423,7 +421,6 @@ selections:
|
||||
- var_password_pam_ucredit=1
|
||||
- var_password_pam_lcredit=1
|
||||
- var_password_pam_retry=3
|
||||
-- var_sshd_set_keepalive=0
|
||||
- sshd_approved_macs=stig
|
||||
- sshd_approved_ciphers=stig
|
||||
- sshd_idle_timeout_value=10_minutes
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 83d04775e3a..8ef48e0654b 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -364,8 +364,6 @@ selections:
|
||||
- sshd_enable_warning_banner
|
||||
- sshd_print_last_log
|
||||
- sshd_rekey_limit
|
||||
-- sshd_set_idle_timeout
|
||||
-- sshd_set_keepalive_0
|
||||
- sshd_use_strong_rng
|
||||
- sshd_x11_use_localhost
|
||||
- sssd_certificate_verification
|
||||
@@ -432,7 +430,6 @@ selections:
|
||||
- var_password_pam_ucredit=1
|
||||
- var_password_pam_lcredit=1
|
||||
- var_password_pam_retry=3
|
||||
-- var_sshd_set_keepalive=0
|
||||
- sshd_approved_macs=stig
|
||||
- sshd_approved_ciphers=stig
|
||||
- sshd_idle_timeout_value=10_minutes
|
||||
@ -1,146 +0,0 @@
|
||||
From 0ffb73fe67cb5773037f62895e6fdc93195f7c38 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Mon, 21 Feb 2022 12:55:10 +0100
|
||||
Subject: [PATCH] Remove tmux process runinng check from
|
||||
configure_bashrc_exec_tmux.
|
||||
|
||||
This check can cause troubles since the user must be logged to show up
|
||||
as tmux running. For example, an evaluation happening through a cron job
|
||||
wouldn't be able to make this rule work, since no terminal is being
|
||||
used.
|
||||
---
|
||||
.../configure_bashrc_exec_tmux/oval/shared.xml | 10 ----------
|
||||
.../configure_bashrc_exec_tmux/rule.yml | 14 +-------------
|
||||
.../tests/correct_value.pass.sh | 1 -
|
||||
.../tests/correct_value_d_directory.pass.sh | 1 -
|
||||
.../tests/duplicate_value_multiple_files.pass.sh | 1 -
|
||||
.../tests/tmux_not_running.fail.sh | 13 -------------
|
||||
.../tests/wrong_value.fail.sh | 2 --
|
||||
7 files changed, 1 insertion(+), 41 deletions(-)
|
||||
delete mode 100644 linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
index 4cb2f9e0e04..58f91eadf66 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
@@ -4,7 +4,6 @@
|
||||
<criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
|
||||
<criterion comment="check tmux is configured to exec on the last line of /etc/bashrc"
|
||||
test_ref="test_configure_bashrc_exec_tmux" />
|
||||
- <criterion comment="check tmux is running" test_ref="test_tmux_running"/>
|
||||
</criteria>
|
||||
</definition>
|
||||
<ind:textfilecontent54_test check="all" check_existence="all_exist"
|
||||
@@ -18,13 +17,4 @@
|
||||
<ind:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
-
|
||||
- <unix:process58_test check="all" id="test_tmux_running" comment="is tmux running" version="1">
|
||||
- <unix:object object_ref="obj_tmux_running"/>
|
||||
- </unix:process58_test>
|
||||
-
|
||||
- <unix:process58_object id="obj_tmux_running" version="1">
|
||||
- <unix:command_line operation="pattern match">^tmux(?:|[\s]+.*)$</unix:command_line>
|
||||
- <unix:pid datatype="int" operation="greater than">0</unix:pid>
|
||||
- </unix:process58_object>
|
||||
</def-group>
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
index 7afc5fc5e6b..9f224748894 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
@@ -8,19 +8,11 @@ description: |-
|
||||
The <tt>tmux</tt> terminal multiplexer is used to implement
|
||||
automatic session locking. It should be started from
|
||||
<tt>/etc/bashrc</tt> or drop-in files within <tt>/etc/profile.d/</tt>.
|
||||
- Additionally it must be ensured that the <tt>tmux</tt> process is running
|
||||
- and it can be verified with the following command:
|
||||
- <pre>ps all | grep tmux | grep -v grep</pre>
|
||||
|
||||
rationale: |-
|
||||
Unlike <tt>bash</tt> itself, the <tt>tmux</tt> terminal multiplexer
|
||||
provides a mechanism to lock sessions after period of inactivity.
|
||||
|
||||
-warnings:
|
||||
- - general: |-
|
||||
- The remediation does not start the tmux process, so it must be
|
||||
- manually started or have the system rebooted after applying the fix.
|
||||
-
|
||||
severity: medium
|
||||
|
||||
identifiers:
|
||||
@@ -34,7 +26,7 @@ references:
|
||||
stigid@ol8: OL08-00-020041
|
||||
stigid@rhel8: RHEL-08-020041
|
||||
|
||||
-ocil_clause: 'exec tmux is not present at the end of bashrc or tmux process is not running'
|
||||
+ocil_clause: 'exec tmux is not present at the end of bashrc'
|
||||
|
||||
ocil: |-
|
||||
To verify that tmux is configured to execute,
|
||||
@@ -46,9 +38,5 @@ ocil: |-
|
||||
name=$(ps -o comm= -p $parent)
|
||||
case "$name" in sshd|login) exec tmux ;; esac
|
||||
fi</pre>
|
||||
- To verify that the tmux process is running,
|
||||
- run the following command:
|
||||
- <pre>ps all | grep tmux | grep -v grep</pre>
|
||||
- If the command does not produce output, this is a finding.
|
||||
|
||||
platform: machine
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
|
||||
index 221c18665ef..fbc7590f27d 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
|
||||
@@ -9,4 +9,3 @@ if [ "$PS1" ]; then
|
||||
fi
|
||||
EOF
|
||||
|
||||
-tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
|
||||
index 1702bb17e79..6107f86f248 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
|
||||
@@ -10,4 +10,3 @@ if [ "$PS1" ]; then
|
||||
fi
|
||||
EOF
|
||||
|
||||
-tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
|
||||
index 16d4acfcb5a..c662221eca1 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
|
||||
@@ -17,4 +17,3 @@ if [ "$PS1" ]; then
|
||||
fi
|
||||
EOF
|
||||
|
||||
-tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
|
||||
deleted file mode 100644
|
||||
index 6cb9d83efc5..00000000000
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,13 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-# packages = tmux
|
||||
-# remediation = none
|
||||
-
|
||||
-cat >> /etc/bashrc <<'EOF'
|
||||
-if [ "$PS1" ]; then
|
||||
- parent=$(ps -o ppid= -p $$)
|
||||
- name=$(ps -o comm= -p $parent)
|
||||
- case "$name" in sshd|login) exec tmux ;; esac
|
||||
-fi
|
||||
-EOF
|
||||
-
|
||||
-killall tmux || true
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
|
||||
index f13a8b038e4..9b461654572 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
|
||||
@@ -101,5 +101,3 @@ if [ -z "$BASHRCSOURCED" ]; then
|
||||
fi
|
||||
# vim:ts=4:sw=4
|
||||
EOF
|
||||
-
|
||||
-tmux new-session -s root -d
|
||||
@ -1,285 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
|
||||
index 09dc1566bbf..26c7eea79d1 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
|
||||
@@ -6,10 +6,10 @@ title: 'Configure auditing of unsuccessful file accesses'
|
||||
|
||||
{{% set file_contents_audit_access_failed =
|
||||
"## Unsuccessful file access (any other opens) This has to go last.
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access" %}}
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access" %}}
|
||||
|
||||
description: |-
|
||||
Ensure that unsuccessful attempts to access a file are audited.
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
|
||||
index 5ce9fe6799c..262cf290ec0 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
|
||||
@@ -7,8 +7,8 @@ title: 'Configure auditing of successful file accesses'
|
||||
{{% set file_contents_audit_access_success =
|
||||
"## Successful file access (any other opens) This has to go last.
|
||||
## These next two are likely to result in a whole lot of events
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access" %}}
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access" %}}
|
||||
|
||||
description: |-
|
||||
Ensure that successful attempts to access a file are audited.
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
|
||||
index e37291c68a1..bdc59faa5f7 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
|
||||
@@ -4,7 +4,7 @@ prodtype: ol8,rhcos4,rhel8,rhel9
|
||||
|
||||
title: 'Perform general configuration of Audit for OSPP'
|
||||
|
||||
-{{% if product == "rhel9" %}}
|
||||
+
|
||||
{{% set file_contents_audit_ospp_general =
|
||||
"## The purpose of these rules is to meet the requirements for Operating
|
||||
## System Protection Profile (OSPP)v4.2. These rules depends on having
|
||||
@@ -90,89 +90,7 @@ title: 'Perform general configuration of Audit for OSPP'
|
||||
## state results from that policy. This would be handled entirely by
|
||||
## that daemon.
|
||||
" %}}
|
||||
-{{% else %}}
|
||||
-{{% set file_contents_audit_ospp_general =
|
||||
-"## The purpose of these rules is to meet the requirements for Operating
|
||||
-## System Protection Profile (OSPP)v4.2. These rules depends on having
|
||||
-## the following rule files copied to /etc/audit/rules.d:
|
||||
-##
|
||||
-## 10-base-config.rules, 11-loginuid.rules,
|
||||
-## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
|
||||
-## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
|
||||
-## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
|
||||
-## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
|
||||
-## 30-ospp-v42-5-perm-change-failed.rules,
|
||||
-## 30-ospp-v42-5-perm-change-success.rules,
|
||||
-## 30-ospp-v42-6-owner-change-failed.rules,
|
||||
-## 30-ospp-v42-6-owner-change-success.rules
|
||||
-##
|
||||
-## original copies may be found in /usr/share/audit/sample-rules/
|
||||
-
|
||||
-
|
||||
-## User add delete modify. This is covered by pam. However, someone could
|
||||
-## open a file and directly create or modify a user, so we'll watch passwd and
|
||||
-## shadow for writes
|
||||
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
-
|
||||
-## User enable and disable. This is entirely handled by pam.
|
||||
-
|
||||
-## Group add delete modify. This is covered by pam. However, someone could
|
||||
-## open a file and directly create or modify a user, so we'll watch group and
|
||||
-## gshadow for writes
|
||||
--a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||
--a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||
-
|
||||
|
||||
-## Use of special rights for config changes. This would be use of setuid
|
||||
-## programs that relate to user accts. This is not all setuid apps because
|
||||
-## requirements are only for ones that affect system configuration.
|
||||
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
-
|
||||
-## Privilege escalation via su or sudo. This is entirely handled by pam.
|
||||
-
|
||||
-## Audit log access
|
||||
--a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
|
||||
-## Attempts to Alter Process and Session Initiation Information
|
||||
--a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
--a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
--a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
-
|
||||
-## Attempts to modify MAC controls
|
||||
--a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy
|
||||
-
|
||||
-## Software updates. This is entirely handled by rpm.
|
||||
-
|
||||
-## System start and shutdown. This is entirely handled by systemd
|
||||
-
|
||||
-## Kernel Module loading. This is handled in 43-module-load.rules
|
||||
-
|
||||
-## Application invocation. The requirements list an optional requirement
|
||||
-## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
|
||||
-## state results from that policy. This would be handled entirely by
|
||||
-## that daemon.
|
||||
-" %}}
|
||||
-{{% endif %}}
|
||||
|
||||
description: |-
|
||||
Configure some basic <tt>Audit</tt> parameters specific for OSPP profile.
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
|
||||
index ffe2344db56..c59e7e5e1f2 100644
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
|
||||
+++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
|
||||
@@ -1,3 +1,3 @@
|
||||
-# platform = Red Hat Enterprise Linux 8
|
||||
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
|
||||
|
||||
cp $SHARED/audit/30-ospp-v42.rules /etc/audit/rules.d/
|
||||
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh
|
||||
deleted file mode 100644
|
||||
index 96ef5ae0a23..00000000000
|
||||
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh
|
||||
+++ /dev/null
|
||||
@@ -1,3 +0,0 @@
|
||||
-# platform = Red Hat Enterprise Linux 9
|
||||
-
|
||||
-cp $SHARED/audit/30-ospp-v42_rhel9.rules /etc/audit/rules.d/30-ospp-v42.rules
|
||||
diff --git a/tests/shared/audit/30-ospp-v42-3-access-failed.rules b/tests/shared/audit/30-ospp-v42-3-access-failed.rules
|
||||
index a5aad3a95ce..39ac7a883ca 100644
|
||||
--- a/tests/shared/audit/30-ospp-v42-3-access-failed.rules
|
||||
+++ b/tests/shared/audit/30-ospp-v42-3-access-failed.rules
|
||||
@@ -1,5 +1,5 @@
|
||||
## Unsuccessful file access (any other opens) This has to go last.
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
|
||||
diff --git a/tests/shared/audit/30-ospp-v42-3-access-success.rules b/tests/shared/audit/30-ospp-v42-3-access-success.rules
|
||||
index 0c8a6b65760..79004ce0c21 100644
|
||||
--- a/tests/shared/audit/30-ospp-v42-3-access-success.rules
|
||||
+++ b/tests/shared/audit/30-ospp-v42-3-access-success.rules
|
||||
@@ -1,4 +1,4 @@
|
||||
## Successful file access (any other opens) This has to go last.
|
||||
## These next two are likely to result in a whole lot of events
|
||||
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
|
||||
diff --git a/tests/shared/audit/30-ospp-v42.rules b/tests/shared/audit/30-ospp-v42.rules
|
||||
index 3dced17255c..2d3c48265b6 100644
|
||||
--- a/tests/shared/audit/30-ospp-v42.rules
|
||||
+++ b/tests/shared/audit/30-ospp-v42.rules
|
||||
@@ -57,6 +57,10 @@
|
||||
|
||||
## Privilege escalation via su or sudo. This is entirely handled by pam.
|
||||
|
||||
+## Watch for configuration changes to privilege escalation.
|
||||
+-a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
|
||||
+-a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
|
||||
+
|
||||
## Audit log access
|
||||
-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
|
||||
## Attempts to Alter Process and Session Initiation Information
|
||||
diff --git a/tests/shared/audit/30-ospp-v42_rhel9.rules b/tests/shared/audit/30-ospp-v42_rhel9.rules
|
||||
deleted file mode 100644
|
||||
index 2d3c48265b6..00000000000
|
||||
--- a/tests/shared/audit/30-ospp-v42_rhel9.rules
|
||||
+++ /dev/null
|
||||
@@ -1,84 +0,0 @@
|
||||
-## The purpose of these rules is to meet the requirements for Operating
|
||||
-## System Protection Profile (OSPP)v4.2. These rules depends on having
|
||||
-## the following rule files copied to /etc/audit/rules.d:
|
||||
-##
|
||||
-## 10-base-config.rules, 11-loginuid.rules,
|
||||
-## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
|
||||
-## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
|
||||
-## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
|
||||
-## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
|
||||
-## 30-ospp-v42-5-perm-change-failed.rules,
|
||||
-## 30-ospp-v42-5-perm-change-success.rules,
|
||||
-## 30-ospp-v42-6-owner-change-failed.rules,
|
||||
-## 30-ospp-v42-6-owner-change-success.rules
|
||||
-##
|
||||
-## original copies may be found in /usr/share/audit/sample-rules/
|
||||
-
|
||||
-
|
||||
-## User add delete modify. This is covered by pam. However, someone could
|
||||
-## open a file and directly create or modify a user, so we'll watch passwd and
|
||||
-## shadow for writes
|
||||
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
-
|
||||
-## User enable and disable. This is entirely handled by pam.
|
||||
-
|
||||
-## Group add delete modify. This is covered by pam. However, someone could
|
||||
-## open a file and directly create or modify a user, so we'll watch group and
|
||||
-## gshadow for writes
|
||||
--a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
|
||||
--a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||
--a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
|
||||
-
|
||||
-
|
||||
-## Use of special rights for config changes. This would be use of setuid
|
||||
-## programs that relate to user accts. This is not all setuid apps because
|
||||
-## requirements are only for ones that affect system configuration.
|
||||
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
|
||||
-
|
||||
-## Privilege escalation via su or sudo. This is entirely handled by pam.
|
||||
-
|
||||
-## Watch for configuration changes to privilege escalation.
|
||||
--a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
|
||||
--a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
|
||||
-
|
||||
-## Audit log access
|
||||
--a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
|
||||
-## Attempts to Alter Process and Session Initiation Information
|
||||
--a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
--a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
--a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
|
||||
-
|
||||
-## Attempts to modify MAC controls
|
||||
--a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy
|
||||
-
|
||||
-## Software updates. This is entirely handled by rpm.
|
||||
-
|
||||
-## System start and shutdown. This is entirely handled by systemd
|
||||
-
|
||||
-## Kernel Module loading. This is handled in 43-module-load.rules
|
||||
-
|
||||
-## Application invocation. The requirements list an optional requirement
|
||||
-## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
|
||||
-## state results from that policy. This would be handled entirely by
|
||||
-## that daemon.
|
||||
-
|
||||
@ -1,493 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
||||
index a0b3efcbf79..1bc7afbb224 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
||||
@@ -58,7 +58,7 @@ references:
|
||||
stigid@ol7: OL07-00-030410
|
||||
stigid@ol8: OL08-00-030540
|
||||
stigid@rhel7: RHEL-07-030420
|
||||
- stigid@rhel8: RHEL-08-030540
|
||||
+ stigid@rhel8: RHEL-08-030490
|
||||
stigid@sle12: SLES-12-020470
|
||||
stigid@sle15: SLES-15-030300
|
||||
stigid@ubuntu2004: UBTU-20-010153
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
||||
index 83dd57f2b6d..dc8211684f2 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
||||
@@ -58,7 +58,7 @@ references:
|
||||
stigid@ol7: OL07-00-030410
|
||||
stigid@ol8: OL08-00-030530
|
||||
stigid@rhel7: RHEL-07-030430
|
||||
- stigid@rhel8: RHEL-08-030530
|
||||
+ stigid@rhel8: RHEL-08-030490
|
||||
stigid@sle12: SLES-12-020480
|
||||
stigid@sle15: SLES-15-030310
|
||||
stigid@ubuntu2004: UBTU-20-010154
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
||||
index 1b78aab4a1a..07592bb2fd9 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
||||
@@ -61,7 +61,7 @@ references:
|
||||
stigid@ol7: OL07-00-030370
|
||||
stigid@ol8: OL08-00-030520
|
||||
stigid@rhel7: RHEL-07-030380
|
||||
- stigid@rhel8: RHEL-08-030520
|
||||
+ stigid@rhel8: RHEL-08-030480
|
||||
stigid@sle12: SLES-12-020430
|
||||
stigid@sle15: SLES-15-030260
|
||||
stigid@ubuntu2004: UBTU-20-010149
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
||||
index 360c60de06d..084970765b2 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
||||
@@ -58,7 +58,7 @@ references:
|
||||
stigid@ol7: OL07-00-030370
|
||||
stigid@ol8: OL08-00-030510
|
||||
stigid@rhel7: RHEL-07-030400
|
||||
- stigid@rhel8: RHEL-08-030510
|
||||
+ stigid@rhel8: RHEL-08-030480
|
||||
stigid@sle12: SLES-12-020450
|
||||
stigid@sle15: SLES-15-030280
|
||||
stigid@ubuntu2004: UBTU-20-010150
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
||||
index 19bf8a5b981..5695440ad7d 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
||||
@@ -75,7 +75,7 @@ references:
|
||||
stigid@ol7: OL07-00-030440
|
||||
stigid@ol8: OL08-00-030240
|
||||
stigid@rhel7: RHEL-07-030480
|
||||
- stigid@rhel8: RHEL-08-030240
|
||||
+ stigid@rhel8: RHEL-08-030200
|
||||
stigid@sle12: SLES-12-020410
|
||||
stigid@sle15: SLES-15-030210
|
||||
stigid@ubuntu2004: UBTU-20-010147
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
||||
index 40cd114042e..ab536a8ae0a 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
||||
@@ -70,7 +70,7 @@ references:
|
||||
stigid@ol7: OL07-00-030440
|
||||
stigid@ol8: OL08-00-030230
|
||||
stigid@rhel7: RHEL-07-030450
|
||||
- stigid@rhel8: RHEL-08-030230
|
||||
+ stigid@rhel8: RHEL-08-030200
|
||||
stigid@sle12: SLES-12-020380
|
||||
stigid@sle15: SLES-15-030230
|
||||
stigid@ubuntu2004: UBTU-20-010144
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
||||
index 81dddd9fb71..d1f4ee35ccb 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
||||
@@ -58,7 +58,7 @@ references:
|
||||
stigid@ol7: OL07-00-030370
|
||||
stigid@ol8: OL08-00-030500
|
||||
stigid@rhel7: RHEL-07-030390
|
||||
- stigid@rhel8: RHEL-08-030500
|
||||
+ stigid@rhel8: RHEL-08-030480
|
||||
stigid@sle12: SLES-12-020440
|
||||
stigid@sle15: SLES-15-030270
|
||||
stigid@ubuntu2004: UBTU-20-010151
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
||||
index fa15012b05f..a2425e373bc 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
||||
@@ -69,7 +69,7 @@ references:
|
||||
stigid@ol7: OL07-00-030440
|
||||
stigid@ol8: OL08-00-030220
|
||||
stigid@rhel7: RHEL-07-030460
|
||||
- stigid@rhel8: RHEL-08-030220
|
||||
+ stigid@rhel8: RHEL-08-030200
|
||||
stigid@sle15: SLES-15-030240
|
||||
stigid@ubuntu2004: UBTU-20-010143
|
||||
vmmsrg: SRG-OS-000458-VMM-001810,SRG-OS-000474-VMM-001940
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
||||
index 6d15eecee2c..0be27fbe860 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
||||
@@ -74,7 +74,7 @@ references:
|
||||
stigid@ol7: OL07-00-030440
|
||||
stigid@ol8: OL08-00-030210
|
||||
stigid@rhel7: RHEL-07-030470
|
||||
- stigid@rhel8: RHEL-08-030210
|
||||
+ stigid@rhel8: RHEL-08-030200
|
||||
stigid@sle12: SLES-12-020390
|
||||
stigid@sle15: SLES-15-030190
|
||||
stigid@ubuntu2004: UBTU-20-010145
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
||||
index 6f7cea26e16..5dc13a0a43a 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
||||
@@ -70,7 +70,7 @@ references:
|
||||
stigid@ol7: OL07-00-030440
|
||||
stigid@ol8: OL08-00-030270
|
||||
stigid@rhel7: RHEL-07-030440
|
||||
- stigid@rhel8: RHEL-08-030270
|
||||
+ stigid@rhel8: RHEL-08-030200
|
||||
stigid@sle12: SLES-12-020370
|
||||
stigid@sle15: SLES-15-030220
|
||||
stigid@ubuntu2004: UBTU-20-010142
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
||||
index 718dcb8a9d9..120d6fa84d3 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
||||
@@ -52,7 +52,7 @@ references:
|
||||
stigid@ol7: OL07-00-030910
|
||||
stigid@ol8: OL08-00-030362
|
||||
stigid@rhel7: RHEL-07-030890
|
||||
- stigid@rhel8: RHEL-08-030362
|
||||
+ stigid@rhel8: RHEL-08-030361
|
||||
stigid@ubuntu2004: UBTU-20-010270
|
||||
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
||||
index 643f075f46a..4caa7c66986 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
||||
@@ -49,7 +49,7 @@ references:
|
||||
stigid@ol7: OL07-00-030910
|
||||
stigid@ol8: OL08-00-030363
|
||||
stigid@rhel7: RHEL-07-030900
|
||||
- stigid@rhel8: RHEL-08-030363
|
||||
+ stigid@rhel8: RHEL-08-030361
|
||||
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
||||
|
||||
{{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}}
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
||||
index 9cf3c4668bc..8fea9dc4582 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
||||
@@ -52,7 +52,7 @@ references:
|
||||
stigid@ol7: OL07-00-030910
|
||||
stigid@ol8: OL08-00-030364
|
||||
stigid@rhel7: RHEL-07-030910
|
||||
- stigid@rhel8: RHEL-08-030364
|
||||
+ stigid@rhel8: RHEL-08-030361
|
||||
stigid@ubuntu2004: UBTU-20-010267
|
||||
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
||||
index d0ebbdbd723..bee18e99b52 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
||||
@@ -52,7 +52,7 @@ references:
|
||||
stigid@ol7: OL07-00-030910
|
||||
stigid@ol8: OL08-00-030365
|
||||
stigid@rhel7: RHEL-07-030920
|
||||
- stigid@rhel8: RHEL-08-030365
|
||||
+ stigid@rhel8: RHEL-08-030361
|
||||
stigid@ubuntu2004: UBTU-20-010268
|
||||
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
||||
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
||||
index 373b12525e1..736c6643b57 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
||||
@@ -63,7 +63,7 @@ references:
|
||||
stigid@ol7: OL07-00-030510
|
||||
stigid@ol8: OL08-00-030470
|
||||
stigid@rhel7: RHEL-07-030500
|
||||
- stigid@rhel8: RHEL-08-030470
|
||||
+ stigid@rhel8: RHEL-08-030420
|
||||
stigid@sle12: SLES-12-020520
|
||||
stigid@sle15: SLES-15-030160
|
||||
stigid@ubuntu2004: UBTU-20-010158
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
||||
index 2b2d82a736b..6b4176d53e3 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
||||
@@ -66,7 +66,7 @@ references:
|
||||
stigid@ol7: OL07-00-030510
|
||||
stigid@ol8: OL08-00-030460
|
||||
stigid@rhel7: RHEL-07-030550
|
||||
- stigid@rhel8: RHEL-08-030460
|
||||
+ stigid@rhel8: RHEL-08-030420
|
||||
stigid@sle12: SLES-12-020510
|
||||
stigid@sle15: SLES-15-030320
|
||||
stigid@ubuntu2004: UBTU-20-010157
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
||||
index dcb3d0f0525..90d45b6787e 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
||||
@@ -66,7 +66,7 @@ references:
|
||||
stigid@ol7: OL07-00-030510
|
||||
stigid@ol8: OL08-00-030440
|
||||
stigid@rhel7: RHEL-07-030510
|
||||
- stigid@rhel8: RHEL-08-030440
|
||||
+ stigid@rhel8: RHEL-08-030420
|
||||
stigid@sle12: SLES-12-020490
|
||||
stigid@sle15: SLES-15-030150
|
||||
stigid@ubuntu2004: UBTU-20-010155
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
||||
index e68d892bb90..6df936e489c 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
||||
@@ -60,7 +60,7 @@ references:
|
||||
stigid@ol7: OL07-00-030510
|
||||
stigid@ol8: OL08-00-030450
|
||||
stigid@rhel7: RHEL-07-030530
|
||||
- stigid@rhel8: RHEL-08-030450
|
||||
+ stigid@rhel8: RHEL-08-030420
|
||||
stigid@sle12: SLES-12-020540
|
||||
stigid@sle15: SLES-15-030180
|
||||
stigid@ubuntu2004: UBTU-20-010160
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
||||
index cd6bd545e71..1b6ae818e48 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
||||
@@ -66,7 +66,7 @@ references:
|
||||
stigid@ol7: OL07-00-030510
|
||||
stigid@ol8: OL08-00-030430
|
||||
stigid@rhel7: RHEL-07-030520
|
||||
- stigid@rhel8: RHEL-08-030430
|
||||
+ stigid@rhel8: RHEL-08-030420
|
||||
stigid@sle12: SLES-12-020530
|
||||
stigid@sle15: SLES-15-030170
|
||||
stigid@ubuntu2004: UBTU-20-010159
|
||||
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
||||
index 50e5b4e4f02..2f1c6d0bf22 100644
|
||||
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
||||
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
||||
@@ -51,7 +51,7 @@ references:
|
||||
stigid@ol7: OL07-00-030820
|
||||
stigid@ol8: OL08-00-030380
|
||||
stigid@rhel7: RHEL-07-030821
|
||||
- stigid@rhel8: RHEL-08-030380
|
||||
+ stigid@rhel8: RHEL-08-030360
|
||||
stigid@sle12: SLES-12-020740
|
||||
stigid@sle15: SLES-15-030530
|
||||
stigid@ubuntu2004: UBTU-20-010180
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index ffca983d0bd..d92bc72971c 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -560,6 +560,8 @@ selections:
|
||||
|
||||
# RHEL-08-020220
|
||||
- accounts_password_pam_pwhistory_remember_system_auth
|
||||
+
|
||||
+ # RHEL-08-020221
|
||||
- accounts_password_pam_pwhistory_remember_password_auth
|
||||
|
||||
# RHEL-08-020230
|
||||
@@ -712,18 +714,11 @@ selections:
|
||||
|
||||
# RHEL-08-030200
|
||||
- audit_rules_dac_modification_lremovexattr
|
||||
-
|
||||
- # RHEL-08-030210
|
||||
- audit_rules_dac_modification_removexattr
|
||||
-
|
||||
- # RHEL-08-030220
|
||||
- audit_rules_dac_modification_lsetxattr
|
||||
-
|
||||
- # RHEL-08-030230
|
||||
- audit_rules_dac_modification_fsetxattr
|
||||
-
|
||||
- # RHEL-08-030240
|
||||
- audit_rules_dac_modification_fremovexattr
|
||||
+ - audit_rules_dac_modification_setxattr
|
||||
|
||||
# RHEL-08-030250
|
||||
- audit_rules_privileged_commands_chage
|
||||
@@ -731,8 +726,6 @@ selections:
|
||||
# RHEL-08-030260
|
||||
- audit_rules_execution_chcon
|
||||
|
||||
- # RHEL-08-030270
|
||||
- - audit_rules_dac_modification_setxattr
|
||||
|
||||
# RHEL-08-030280
|
||||
- audit_rules_privileged_commands_ssh_agent
|
||||
@@ -787,28 +780,18 @@ selections:
|
||||
|
||||
# RHEL-08-030360
|
||||
- audit_rules_kernel_module_loading_init
|
||||
+ - audit_rules_kernel_module_loading_finit
|
||||
|
||||
# RHEL-08-030361
|
||||
- audit_rules_file_deletion_events_rename
|
||||
-
|
||||
- # RHEL-08-030362
|
||||
- audit_rules_file_deletion_events_renameat
|
||||
-
|
||||
- # RHEL-08-030363
|
||||
- audit_rules_file_deletion_events_rmdir
|
||||
-
|
||||
- # RHEL-08-030364
|
||||
- audit_rules_file_deletion_events_unlink
|
||||
-
|
||||
- # RHEL-08-030365
|
||||
- audit_rules_file_deletion_events_unlinkat
|
||||
|
||||
# RHEL-08-030370
|
||||
- audit_rules_privileged_commands_gpasswd
|
||||
|
||||
- # RHEL-08-030380
|
||||
- - audit_rules_kernel_module_loading_finit
|
||||
-
|
||||
# RHEL-08-030390
|
||||
- audit_rules_kernel_module_loading_delete
|
||||
|
||||
@@ -820,41 +803,21 @@ selections:
|
||||
|
||||
# RHEL-08-030420
|
||||
- audit_rules_unsuccessful_file_modification_truncate
|
||||
-
|
||||
- # RHEL-08-030430
|
||||
- audit_rules_unsuccessful_file_modification_openat
|
||||
-
|
||||
- # RHEL-08-030440
|
||||
- audit_rules_unsuccessful_file_modification_open
|
||||
-
|
||||
- # RHEL-08-030450
|
||||
- audit_rules_unsuccessful_file_modification_open_by_handle_at
|
||||
-
|
||||
- # RHEL-08-030460
|
||||
- audit_rules_unsuccessful_file_modification_ftruncate
|
||||
-
|
||||
- # RHEL-08-030470
|
||||
- audit_rules_unsuccessful_file_modification_creat
|
||||
|
||||
# RHEL-08-030480
|
||||
- audit_rules_dac_modification_chown
|
||||
-
|
||||
- # RHEL-08-030490
|
||||
- - audit_rules_dac_modification_chmod
|
||||
-
|
||||
- # RHEL-08-030500
|
||||
- audit_rules_dac_modification_lchown
|
||||
-
|
||||
- # RHEL-08-030510
|
||||
- audit_rules_dac_modification_fchownat
|
||||
-
|
||||
- # RHEL-08-030520
|
||||
- audit_rules_dac_modification_fchown
|
||||
|
||||
- # RHEL-08-030530
|
||||
+ # RHEL-08-030490
|
||||
+ - audit_rules_dac_modification_chmod
|
||||
- audit_rules_dac_modification_fchmodat
|
||||
-
|
||||
- # RHEL-08-030540
|
||||
- audit_rules_dac_modification_fchmod
|
||||
|
||||
# RHEL-08-030550
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index eb2cac913bd..42c6d0e9aca 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -561,6 +561,8 @@ selections:
|
||||
|
||||
# RHEL-08-020220
|
||||
- accounts_password_pam_pwhistory_remember_system_auth
|
||||
+
|
||||
+ # RHEL-08-020221
|
||||
- accounts_password_pam_pwhistory_remember_password_auth
|
||||
|
||||
# RHEL-08-020230
|
||||
@@ -713,18 +715,11 @@ selections:
|
||||
|
||||
# RHEL-08-030200
|
||||
- audit_rules_dac_modification_lremovexattr
|
||||
-
|
||||
- # RHEL-08-030210
|
||||
- audit_rules_dac_modification_removexattr
|
||||
-
|
||||
- # RHEL-08-030220
|
||||
- audit_rules_dac_modification_lsetxattr
|
||||
-
|
||||
- # RHEL-08-030230
|
||||
- audit_rules_dac_modification_fsetxattr
|
||||
-
|
||||
- # RHEL-08-030240
|
||||
- audit_rules_dac_modification_fremovexattr
|
||||
+ - audit_rules_dac_modification_setxattr
|
||||
|
||||
# RHEL-08-030250
|
||||
- audit_rules_privileged_commands_chage
|
||||
@@ -732,9 +727,6 @@ selections:
|
||||
# RHEL-08-030260
|
||||
- audit_rules_execution_chcon
|
||||
|
||||
- # RHEL-08-030270
|
||||
- - audit_rules_dac_modification_setxattr
|
||||
-
|
||||
# RHEL-08-030280
|
||||
- audit_rules_privileged_commands_ssh_agent
|
||||
|
||||
@@ -788,28 +780,18 @@ selections:
|
||||
|
||||
# RHEL-08-030360
|
||||
- audit_rules_kernel_module_loading_init
|
||||
+ - audit_rules_kernel_module_loading_finit
|
||||
|
||||
# RHEL-08-030361
|
||||
- audit_rules_file_deletion_events_rename
|
||||
-
|
||||
- # RHEL-08-030362
|
||||
- audit_rules_file_deletion_events_renameat
|
||||
-
|
||||
- # RHEL-08-030363
|
||||
- audit_rules_file_deletion_events_rmdir
|
||||
-
|
||||
- # RHEL-08-030364
|
||||
- audit_rules_file_deletion_events_unlink
|
||||
-
|
||||
- # RHEL-08-030365
|
||||
- audit_rules_file_deletion_events_unlinkat
|
||||
|
||||
# RHEL-08-030370
|
||||
- audit_rules_privileged_commands_gpasswd
|
||||
|
||||
- # RHEL-08-030380
|
||||
- - audit_rules_kernel_module_loading_finit
|
||||
-
|
||||
# RHEL-08-030390
|
||||
- audit_rules_kernel_module_loading_delete
|
||||
|
||||
@@ -821,41 +803,21 @@ selections:
|
||||
|
||||
# RHEL-08-030420
|
||||
- audit_rules_unsuccessful_file_modification_truncate
|
||||
-
|
||||
- # RHEL-08-030430
|
||||
- audit_rules_unsuccessful_file_modification_openat
|
||||
-
|
||||
- # RHEL-08-030440
|
||||
- audit_rules_unsuccessful_file_modification_open
|
||||
-
|
||||
- # RHEL-08-030450
|
||||
- audit_rules_unsuccessful_file_modification_open_by_handle_at
|
||||
-
|
||||
- # RHEL-08-030460
|
||||
- audit_rules_unsuccessful_file_modification_ftruncate
|
||||
-
|
||||
- # RHEL-08-030470
|
||||
- audit_rules_unsuccessful_file_modification_creat
|
||||
|
||||
# RHEL-08-030480
|
||||
- audit_rules_dac_modification_chown
|
||||
-
|
||||
- # RHEL-08-030490
|
||||
- - audit_rules_dac_modification_chmod
|
||||
-
|
||||
- # RHEL-08-030500
|
||||
- audit_rules_dac_modification_lchown
|
||||
-
|
||||
- # RHEL-08-030510
|
||||
- audit_rules_dac_modification_fchownat
|
||||
-
|
||||
- # RHEL-08-030520
|
||||
- audit_rules_dac_modification_fchown
|
||||
|
||||
- # RHEL-08-030530
|
||||
+ # RHEL-08-030490
|
||||
+ - audit_rules_dac_modification_chmod
|
||||
- audit_rules_dac_modification_fchmodat
|
||||
-
|
||||
- # RHEL-08-030540
|
||||
- audit_rules_dac_modification_fchmod
|
||||
|
||||
# RHEL-08-030550
|
||||
@ -1,375 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..1c151a1ec1a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
|
||||
@@ -0,0 +1,5 @@
|
||||
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhv
|
||||
+
|
||||
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
|
||||
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..24fdbe4c1d4
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
|
||||
@@ -0,0 +1,19 @@
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="set_password_hashing_algorithm_passwordauth" version="1">
|
||||
+ {{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.") }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion test_ref="test_pam_unix_passwordauth_sha512" />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/password-auth for correct settings" id="test_pam_unix_passwordauth_sha512" version="1">
|
||||
+ <ind:object object_ref="object_pam_unix_passwordauth_sha512" />
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_object comment="check /etc/pam.d/password-auth for correct settings" id="object_pam_unix_passwordauth_sha512" version="1">
|
||||
+ <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
|
||||
+ <ind:instance datatype="int">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..9375269161d
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
|
||||
@@ -0,0 +1,72 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
|
||||
+
|
||||
+title: "Set PAM's Password Hashing Algorithm - password-auth"
|
||||
+
|
||||
+description: |-
|
||||
+ The PAM system service can be configured to only store encrypted
|
||||
+ representations of passwords. In
|
||||
+ <tt>/etc/pam.d/password-auth</tt>,
|
||||
+ the
|
||||
+ <tt>password</tt> section of the file controls which PAM modules execute
|
||||
+ during a password change. Set the <tt>pam_unix.so</tt> module in the
|
||||
+ <tt>password</tt> section to include the argument <tt>sha512</tt>, as shown
|
||||
+ below:
|
||||
+ <br />
|
||||
+ <pre>password sufficient pam_unix.so sha512 <i>other arguments...</i></pre>
|
||||
+ <br />
|
||||
+ This will help ensure when local users change their passwords, hashes for
|
||||
+ the new passwords will be generated using the SHA-512 algorithm. This is
|
||||
+ the default.
|
||||
+
|
||||
+rationale: |-
|
||||
+ Passwords need to be protected at all times, and encryption is the standard
|
||||
+ method for protecting passwords. If passwords are not encrypted, they can
|
||||
+ be plainly read (i.e., clear text) and easily compromised. Passwords that
|
||||
+ are encrypted with a weak algorithm are no more protected than if they are
|
||||
+ kepy in plain text.
|
||||
+ <br /><br />
|
||||
+ This setting ensures user and group account administration utilities are
|
||||
+ configured to store only encrypted representations of passwords.
|
||||
+ Additionally, the <tt>crypt_style</tt> configuration option ensures the use
|
||||
+ of a strong hashing algorithm that makes password cracking attacks more
|
||||
+ difficult.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel7: CCE-85943-9
|
||||
+ cce@rhel8: CCE-85945-4
|
||||
+ cce@rhel9: CCE-85946-2
|
||||
+
|
||||
+references:
|
||||
+ anssi: BP28(R32)
|
||||
+ cis-csc: 1,12,15,16,5
|
||||
+ cis@rhel7: 5.4.3
|
||||
+ cis@rhel8: 5.4.4
|
||||
+ cjis: 5.6.2.2
|
||||
+ cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
|
||||
+ cui: 3.13.11
|
||||
+ disa: CCI-000196
|
||||
+ isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
|
||||
+ isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1'
|
||||
+ ism: 0418,1055,1402
|
||||
+ iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
|
||||
+ nist: IA-5(c),IA-5(1)(c),CM-6(a)
|
||||
+ nist-csf: PR.AC-1,PR.AC-6,PR.AC-7
|
||||
+ pcidss: Req-8.2.1
|
||||
+ srg: SRG-OS-000073-GPOS-00041
|
||||
+ stigid@rhel7: RHEL-07-010200
|
||||
+ stigid@rhel8: RHEL-08-010160
|
||||
+ vmmsrg: SRG-OS-000480-VMM-002000
|
||||
+
|
||||
+ocil_clause: 'it does not'
|
||||
+
|
||||
+ocil: |-
|
||||
+ Inspect the <tt>password</tt> section of <tt>/etc/pam.d/password-auth</tt>
|
||||
+ and ensure that the <tt>pam_unix.so</tt> module includes the argument
|
||||
+ <tt>sha512</tt>:
|
||||
+ <pre>$ grep sha512 /etc/pam.d/password-auth</pre>
|
||||
+
|
||||
+platform: pam
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..a924fe5bd97
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
|
||||
@@ -0,0 +1,5 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
|
||||
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..68e925a645f
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
|
||||
@@ -0,0 +1,3 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/sha512//g" "/etc/pam.d/password-auth"
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
|
||||
index 542ea521a6c..e7503feeecb 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
|
||||
@@ -1,7 +1,9 @@
|
||||
-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
|
||||
+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
|
||||
|
||||
AUTH_FILES[0]="/etc/pam.d/system-auth"
|
||||
+{{%- if product == "rhel7" %}}
|
||||
AUTH_FILES[1]="/etc/pam.d/password-auth"
|
||||
+{{%- endif %}}
|
||||
|
||||
for pamFile in "${AUTH_FILES[@]}"
|
||||
do
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
|
||||
index d76b6f80c0c..a754a84df6c 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
|
||||
@@ -3,6 +3,9 @@
|
||||
{{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.") }}}
|
||||
<criteria operator="AND">
|
||||
<criterion test_ref="test_pam_unix_sha512" />
|
||||
+ {{%- if product == "rhel7" %}}
|
||||
+ <extend_definition comment="check /etc/pam.d/password-auth for correct settings" definition_ref="set_password_hashing_algorithm_passwordauth" />
|
||||
+ {{%- endif %}}
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
|
||||
index 13da9dd4086..59fb48e93b5 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
|
||||
@@ -70,7 +70,7 @@ references:
|
||||
stigid@ol7: OL07-00-010200
|
||||
stigid@ol8: OL08-00-010160
|
||||
stigid@rhel7: RHEL-07-010200
|
||||
- stigid@rhel8: RHEL-08-010160
|
||||
+ stigid@rhel8: RHEL-08-010159
|
||||
stigid@sle12: SLES-12-010230
|
||||
stigid@sle15: SLES-15-020170
|
||||
vmmsrg: SRG-OS-000480-VMM-002000
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
|
||||
index 7e481760670..fb9feec4d27 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
|
||||
@@ -1,7 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
AUTH_FILES[0]="/etc/pam.d/system-auth"
|
||||
+{{%- if product == "rhel7" %}}
|
||||
AUTH_FILES[1]="/etc/pam.d/password-auth"
|
||||
+{{%- endif %}}
|
||||
|
||||
for pamFile in "${AUTH_FILES[@]}"
|
||||
do
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
|
||||
index 09bb82dd1d7..2f35381d475 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
|
||||
@@ -1,7 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
AUTH_FILES[0]="/etc/pam.d/system-auth"
|
||||
+{{%- if product == "rhel7" %}}
|
||||
AUTH_FILES[1]="/etc/pam.d/password-auth"
|
||||
+{{%- endif %}}
|
||||
|
||||
for pamFile in "${AUTH_FILES[@]}"
|
||||
do
|
||||
diff --git a/products/rhel8/profiles/pci-dss.profile b/products/rhel8/profiles/pci-dss.profile
|
||||
index 3ada8e6fe49..4df21f4ae6e 100644
|
||||
--- a/products/rhel8/profiles/pci-dss.profile
|
||||
+++ b/products/rhel8/profiles/pci-dss.profile
|
||||
@@ -126,6 +126,7 @@ selections:
|
||||
- service_pcscd_enabled
|
||||
- sssd_enable_smartcards
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- file_owner_etc_shadow
|
||||
diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile
|
||||
index 15abd98a6a5..7188062df72 100644
|
||||
--- a/products/rhel8/profiles/rht-ccp.profile
|
||||
+++ b/products/rhel8/profiles/rht-ccp.profile
|
||||
@@ -54,6 +54,7 @@ selections:
|
||||
- accounts_password_pam_difok
|
||||
- accounts_passwords_pam_faillock_deny
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- require_singleuser_auth
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 04f158116ee..8d69bb48d38 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -149,6 +149,9 @@ selections:
|
||||
# RHEL-08-010152
|
||||
- require_emergency_target_auth
|
||||
|
||||
+ # RHEL-08-010159
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
+
|
||||
# RHEL-08-010160
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
|
||||
diff --git a/products/rhel9/profiles/pci-dss.profile b/products/rhel9/profiles/pci-dss.profile
|
||||
index beb1acda31d..1e4044f4e7e 100644
|
||||
--- a/products/rhel9/profiles/pci-dss.profile
|
||||
+++ b/products/rhel9/profiles/pci-dss.profile
|
||||
@@ -123,6 +123,7 @@ selections:
|
||||
- service_pcscd_enabled
|
||||
- sssd_enable_smartcards
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- file_owner_etc_shadow
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 8f79b22e3e4..b9f557de030 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -150,6 +150,9 @@ selections:
|
||||
# RHEL-08-010152
|
||||
- require_emergency_target_auth
|
||||
|
||||
+ # RHEL-08-010159
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
+
|
||||
# RHEL-08-010160
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
|
||||
diff --git a/products/rhv4/profiles/pci-dss.profile b/products/rhv4/profiles/pci-dss.profile
|
||||
index c4ed0ec2d48..d00f44996d8 100644
|
||||
--- a/products/rhv4/profiles/pci-dss.profile
|
||||
+++ b/products/rhv4/profiles/pci-dss.profile
|
||||
@@ -121,6 +121,7 @@ selections:
|
||||
- service_pcscd_enabled
|
||||
- sssd_enable_smartcards
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- file_owner_etc_shadow
|
||||
diff --git a/products/rhv4/profiles/rhvh-stig.profile b/products/rhv4/profiles/rhvh-stig.profile
|
||||
index 01c2fd8cc2d..9cf416665ab 100644
|
||||
--- a/products/rhv4/profiles/rhvh-stig.profile
|
||||
+++ b/products/rhv4/profiles/rhvh-stig.profile
|
||||
@@ -356,6 +356,7 @@ selections:
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- package_opensc_installed
|
||||
- var_smartcard_drivers=cac
|
||||
- configure_opensc_card_drivers
|
||||
diff --git a/products/rhv4/profiles/rhvh-vpp.profile b/products/rhv4/profiles/rhvh-vpp.profile
|
||||
index c2b6c106937..e66fe435508 100644
|
||||
--- a/products/rhv4/profiles/rhvh-vpp.profile
|
||||
+++ b/products/rhv4/profiles/rhvh-vpp.profile
|
||||
@@ -201,6 +201,7 @@ selections:
|
||||
- accounts_password_pam_unix_remember
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
+ - set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- no_empty_passwords
|
||||
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 3f6ec5e17c4..4aa925037b1 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -53,9 +53,6 @@ CCE-85939-7
|
||||
CCE-85940-5
|
||||
CCE-85941-3
|
||||
CCE-85942-1
|
||||
-CCE-85943-9
|
||||
-CCE-85945-4
|
||||
-CCE-85946-2
|
||||
CCE-85947-0
|
||||
CCE-85948-8
|
||||
CCE-85949-6
|
||||
diff --git a/tests/data/profile_stability/rhel8/pci-dss.profile b/tests/data/profile_stability/rhel8/pci-dss.profile
|
||||
index f58bcf91cf2..e235d492438 100644
|
||||
--- a/tests/data/profile_stability/rhel8/pci-dss.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/pci-dss.profile
|
||||
@@ -1,5 +1,9 @@
|
||||
+title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
|
||||
description: Ensures PCI-DSS v3.2.1 security configuration settings are applied.
|
||||
-documentation_complete: true
|
||||
+extends: null
|
||||
+metadata:
|
||||
+ SMEs:
|
||||
+ - yuumasato
|
||||
reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
|
||||
selections:
|
||||
- account_disable_post_pw_expiration
|
||||
@@ -120,6 +124,7 @@ selections:
|
||||
- service_pcscd_enabled
|
||||
- set_password_hashing_algorithm_libuserconf
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
+- set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
- sshd_set_idle_timeout
|
||||
- sshd_set_keepalive_0
|
||||
@@ -136,4 +141,8 @@ selections:
|
||||
- var_multiple_time_servers=rhel
|
||||
- var_sshd_set_keepalive=0
|
||||
- var_smartcard_drivers=cac
|
||||
-title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
|
||||
+platforms: !!set {}
|
||||
+cpe_names: !!set {}
|
||||
+platform: null
|
||||
+filter_rules: ''
|
||||
+documentation_complete: true
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index ed739e724f4..c5fcbf47de2 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -336,6 +337,7 @@ selections:
|
||||
- service_systemd-coredump_disabled
|
||||
- service_usbguard_enabled
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
+- set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
- sshd_disable_compression
|
||||
- sshd_disable_empty_passwords
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 56c3fcb9f59..49ec4ae41ac 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -347,6 +348,7 @@ selections:
|
||||
- service_systemd-coredump_disabled
|
||||
- service_usbguard_enabled
|
||||
- set_password_hashing_algorithm_logindefs
|
||||
+- set_password_hashing_algorithm_passwordauth
|
||||
- set_password_hashing_algorithm_systemauth
|
||||
- sshd_disable_compression
|
||||
- sshd_disable_empty_passwords
|
||||
@ -1,155 +0,0 @@
|
||||
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
||||
index ff3736711dd..5c3d5f34ea8 100644
|
||||
--- a/controls/anssi.yml
|
||||
+++ b/controls/anssi.yml
|
||||
@@ -72,6 +72,7 @@ controls:
|
||||
SELinux policies limit the privileges of services and daemons to only what they require.
|
||||
rules:
|
||||
- selinux_state
|
||||
+ - var_selinux_state=enforcing
|
||||
|
||||
- id: R4
|
||||
levels:
|
||||
diff --git a/products/rhel8/profiles/anssi_bp28_enhanced.profile b/products/rhel8/profiles/anssi_bp28_enhanced.profile
|
||||
index 2a49527c10a..8f2ee31493b 100644
|
||||
--- a/products/rhel8/profiles/anssi_bp28_enhanced.profile
|
||||
+++ b/products/rhel8/profiles/anssi_bp28_enhanced.profile
|
||||
@@ -17,4 +17,3 @@ description: |-
|
||||
|
||||
selections:
|
||||
- anssi:all:enhanced
|
||||
- - '!selinux_state'
|
||||
diff --git a/products/rhel9/profiles/anssi_bp28_enhanced.profile b/products/rhel9/profiles/anssi_bp28_enhanced.profile
|
||||
index 89e0d260390..da048c9b556 100644
|
||||
--- a/products/rhel9/profiles/anssi_bp28_enhanced.profile
|
||||
+++ b/products/rhel9/profiles/anssi_bp28_enhanced.profile
|
||||
@@ -17,4 +17,3 @@ description: |-
|
||||
|
||||
selections:
|
||||
- anssi:all:enhanced
|
||||
- - '!selinux_state'
|
||||
diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
|
||||
index 2e60ec43532..b201c495b8d 100644
|
||||
--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
|
||||
+++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
|
||||
@@ -42,3 +42,29 @@ controls:
|
||||
rules:
|
||||
- var_password_pam_minlen=2
|
||||
- var_some_variable=3
|
||||
+
|
||||
+ # S5, S6 and S7 are used to test if level inheritance is working corectly
|
||||
+ # when multiple levels select the same rule
|
||||
+ - id: S5
|
||||
+ title: Default Crypto Policy
|
||||
+ levels:
|
||||
+ - low
|
||||
+ rules:
|
||||
+ - configure_crypto_policy
|
||||
+ - var_system_crypto_policy=default_policy
|
||||
+
|
||||
+ - id: S6
|
||||
+ title: FIPS Crypto Policy
|
||||
+ levels:
|
||||
+ - medium
|
||||
+ rules:
|
||||
+ - configure_crypto_policy
|
||||
+ - var_system_crypto_policy=fips
|
||||
+
|
||||
+ - id: S7
|
||||
+ title: Future Crypto Policy
|
||||
+ levels:
|
||||
+ - high
|
||||
+ rules:
|
||||
+ - configure_crypto_policy
|
||||
+ - var_system_crypto_policy=future
|
||||
diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
|
||||
index d3d6280042a..fb569280736 100644
|
||||
--- a/tests/unit/ssg-module/test_controls.py
|
||||
+++ b/tests/unit/ssg-module/test_controls.py
|
||||
@@ -92,6 +92,20 @@ def test_controls_levels():
|
||||
c_4b = controls_manager.get_control("abcd-levels", "S4.b")
|
||||
assert c_4b.levels == ["high"]
|
||||
|
||||
+ c_5 = controls_manager.get_control("abcd-levels", "S5")
|
||||
+ assert c_5.levels == ["low"]
|
||||
+
|
||||
+ c_6 = controls_manager.get_control("abcd-levels", "S6")
|
||||
+ assert c_6.levels == ["medium"]
|
||||
+
|
||||
+ c_7 = controls_manager.get_control("abcd-levels", "S7")
|
||||
+ assert c_7.levels == ["high"]
|
||||
+
|
||||
+ # test if all crypto-policy controls have the rule selected
|
||||
+ assert "configure_crypto_policy" in c_5.selections
|
||||
+ assert "configure_crypto_policy" in c_6.selections
|
||||
+ assert "configure_crypto_policy" in c_7.selections
|
||||
+
|
||||
# just the essential controls
|
||||
low_controls = controls_manager.get_all_controls_of_level(
|
||||
"abcd-levels", "low")
|
||||
@@ -104,25 +118,34 @@ def test_controls_levels():
|
||||
|
||||
assert len(high_controls) == len(all_controls)
|
||||
assert len(low_controls) <= len(high_controls)
|
||||
- assert len(low_controls) == 4
|
||||
- assert len(medium_controls) == 5
|
||||
+ assert len(low_controls) == 5
|
||||
+ assert len(medium_controls) == 7
|
||||
|
||||
# test overriding of variables in levels
|
||||
assert c_2.variables["var_password_pam_minlen"] == "1"
|
||||
assert "var_password_pam_minlen" not in c_3.variables.keys()
|
||||
assert c_4b.variables["var_password_pam_minlen"] == "2"
|
||||
|
||||
+ variable_found = False
|
||||
for c in low_controls:
|
||||
if "var_password_pam_minlen" in c.variables.keys():
|
||||
+ variable_found = True
|
||||
assert c.variables["var_password_pam_minlen"] == "1"
|
||||
+ assert variable_found
|
||||
|
||||
+ variable_found = False
|
||||
for c in medium_controls:
|
||||
if "var_password_pam_minlen" in c.variables.keys():
|
||||
+ variable_found = True
|
||||
assert c.variables["var_password_pam_minlen"] == "1"
|
||||
+ assert variable_found
|
||||
|
||||
+ variable_found = False
|
||||
for c in high_controls:
|
||||
if "var_password_pam_minlen" in c.variables.keys():
|
||||
+ variable_found = True
|
||||
assert c.variables["var_password_pam_minlen"] == "2"
|
||||
+ assert variable_found
|
||||
|
||||
# now test if controls of lower level has the variable definition correctly removed
|
||||
# because it is overriden by higher level controls
|
||||
@@ -141,6 +164,28 @@ def test_controls_levels():
|
||||
assert s2_low[0].variables["var_some_variable"] == "1"
|
||||
assert s2_low[0].variables["var_password_pam_minlen"] == "1"
|
||||
|
||||
+ # check that low, medium and high levels have crypto policy selected
|
||||
+ s5_low = [c for c in low_controls if c.id == "S5"]
|
||||
+ assert len(s5_low) == 1
|
||||
+ assert "configure_crypto_policy" in s5_low[0].selections
|
||||
+
|
||||
+ s5_medium = [c for c in medium_controls if c.id == "S5"]
|
||||
+ assert len(s5_medium) == 1
|
||||
+ assert "configure_crypto_policy" in s5_medium[0].selections
|
||||
+ s6_medium = [c for c in medium_controls if c.id == "S6"]
|
||||
+ assert len(s6_medium) == 1
|
||||
+ assert "configure_crypto_policy" in s6_medium[0].selections
|
||||
+
|
||||
+ s5_high = [c for c in high_controls if c.id == "S5"]
|
||||
+ assert len(s5_high) == 1
|
||||
+ assert "configure_crypto_policy" in s5_high[0].selections
|
||||
+ s6_high = [c for c in high_controls if c.id == "S6"]
|
||||
+ assert len(s6_high) == 1
|
||||
+ assert "configure_crypto_policy" in s6_high[0].selections
|
||||
+ s7_high = [c for c in high_controls if c.id == "S7"]
|
||||
+ assert len(s7_high) == 1
|
||||
+ assert "configure_crypto_policy" in s7_high[0].selections
|
||||
+
|
||||
|
||||
def test_controls_load_product():
|
||||
product_yaml = os.path.join(ssg_root, "products", "rhel8", "product.yml")
|
||||
@ -1,163 +0,0 @@
|
||||
From 573ae69742cf372d41da6c56a3051745326055cd Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Mon, 14 Feb 2022 15:54:37 +0100
|
||||
Subject: [PATCH] Update RHEL-08-010385 to allow only one occurrence of config.
|
||||
|
||||
This configuration must appear at only one place so it doesn't get
|
||||
overriden by a different file that can loaded on a different order and
|
||||
the intended configuration is replaced by non-compliant value.
|
||||
---
|
||||
.../ansible/shared.yml | 36 ++++++++++++++++++
|
||||
.../bash/shared.sh | 38 +++++++++++++++++++
|
||||
.../oval/shared.xml | 4 +-
|
||||
.../sudo_require_reauthentication/rule.yml | 14 +------
|
||||
.../tests/multiple_correct_value.fail.sh | 10 +++++
|
||||
5 files changed, 87 insertions(+), 15 deletions(-)
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
|
||||
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
|
||||
new file mode 100644
|
||||
index 00000000000..b0c67a69af9
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
|
||||
@@ -0,0 +1,36 @@
|
||||
+# platform = multi_platform_all
|
||||
+# reboot = false
|
||||
+# strategy = restrict
|
||||
+# complexity = low
|
||||
+# disruption = low
|
||||
+
|
||||
+{{{ ansible_instantiate_variables("var_sudo_timestamp_timeout") }}}
|
||||
+- name: "Find out if /etc/sudoers.d/* files contain 'Defaults timestamp_timeout' to be deduplicated"
|
||||
+ find:
|
||||
+ path: "/etc/sudoers.d"
|
||||
+ patterns: "*"
|
||||
+ contains: '^[\s]*Defaults\s.*\btimestamp_timeout=.*'
|
||||
+ register: sudoers_d_defaults_timestamp_timeout
|
||||
+
|
||||
+- name: "Remove found occurrences of 'Defaults timestamp_timeout' from /etc/sudoers.d/* files"
|
||||
+ lineinfile:
|
||||
+ path: "{{ item.path }}"
|
||||
+ regexp: '^[\s]*Defaults\s.*\btimestamp_timeout=.*'
|
||||
+ state: absent
|
||||
+ with_items: "{{ sudoers_d_defaults_timestamp_timeout.files }}"
|
||||
+
|
||||
+- name: Ensure timestamp_timeout is enabled with the appropriate value in /etc/sudoers
|
||||
+ lineinfile:
|
||||
+ path: /etc/sudoers
|
||||
+ regexp: '^[\s]*Defaults\s(.*)\btimestamp_timeout=[-]?\w+\b(.*)$'
|
||||
+ line: 'Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2'
|
||||
+ validate: /usr/sbin/visudo -cf %s
|
||||
+ backrefs: yes
|
||||
+ register: edit_sudoers_timestamp_timeout_option
|
||||
+
|
||||
+- name: Enable timestamp_timeout option with appropriate value in /etc/sudoers
|
||||
+ lineinfile: # noqa 503
|
||||
+ path: /etc/sudoers
|
||||
+ line: 'Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}'
|
||||
+ validate: /usr/sbin/visudo -cf %s
|
||||
+ when: edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..0b623ed4a49
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
|
||||
@@ -0,0 +1,38 @@
|
||||
+# platform = multi_platform_all
|
||||
+# reboot = false
|
||||
+# strategy = restrict
|
||||
+# complexity = low
|
||||
+# disruption = low
|
||||
+
|
||||
+
|
||||
+{{{ bash_instantiate_variables("var_sudo_timestamp_timeout") }}}
|
||||
+
|
||||
+if grep -x '^[\s]*Defaults.*\btimestamp_timeout=.*' /etc/sudoers.d/*; then
|
||||
+ find /etc/sudoers.d/ -type f -exec sed -i "/^[\s]*Defaults.*\btimestamp_timeout=.*/d" {} \;
|
||||
+fi
|
||||
+
|
||||
+if /usr/sbin/visudo -qcf /etc/sudoers; then
|
||||
+ cp /etc/sudoers /etc/sudoers.bak
|
||||
+ if ! grep -P '^[\s]*Defaults.*\btimestamp_timeout=[-]?\w+\b\b.*$' /etc/sudoers; then
|
||||
+ # sudoers file doesn't define Option timestamp_timeout
|
||||
+ echo "Defaults timestamp_timeout=${var_sudo_timestamp_timeout}" >> /etc/sudoers
|
||||
+ else
|
||||
+ # sudoers file defines Option timestamp_timeout, remediate if appropriate value is not set
|
||||
+ if ! grep -P "^[\s]*Defaults.*\btimestamp_timeout=${var_sudo_timestamp_timeout}\b.*$" /etc/sudoers; then
|
||||
+
|
||||
+ sed -Ei "s/(^[\s]*Defaults.*\btimestamp_timeout=)[-]?\w+(\b.*$)/\1${var_sudo_timestamp_timeout}\2/" /etc/sudoers
|
||||
+ fi
|
||||
+ fi
|
||||
+
|
||||
+ # Check validity of sudoers and cleanup bak
|
||||
+ if /usr/sbin/visudo -qcf /etc/sudoers; then
|
||||
+ rm -f /etc/sudoers.bak
|
||||
+ else
|
||||
+ echo "Fail to validate remediated /etc/sudoers, reverting to original file."
|
||||
+ mv /etc/sudoers.bak /etc/sudoers
|
||||
+ false
|
||||
+ fi
|
||||
+else
|
||||
+ echo "Skipping remediation, /etc/sudoers failed to validate"
|
||||
+ false
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
|
||||
index 8f404ca6065..dfc319b6f1f 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
|
||||
@@ -6,13 +6,13 @@
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check correct configuration in /etc/sudoers" id="test_sudo_timestamp_timeout" version="1">
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="check correct configuration in /etc/sudoers" id="test_sudo_timestamp_timeout" version="1">
|
||||
<ind:object object_ref="obj_sudo_timestamp_timeout"/>
|
||||
<ind:state state_ref="state_sudo_timestamp_timeout" />
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
<ind:textfilecontent54_object id="obj_sudo_timestamp_timeout" version="1">
|
||||
- <ind:filepath>/etc/sudoers</ind:filepath>
|
||||
+ <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
|
||||
<ind:pattern operation="pattern match">^[\s]*Defaults[\s]+timestamp_timeout=([-]?[\d]+)$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
|
||||
index 42c6e28f9e6..eebb96678f1 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
|
||||
@@ -50,16 +50,4 @@ ocil: |-
|
||||
<pre>sudo grep -ri '^Defaults.*timestamp_timeout' /etc/sudoers /etc/sudoers.d</pre>
|
||||
The output should be:
|
||||
<pre>/etc/sudoers:Defaults timestamp_timeout=0</pre> or "timestamp_timeout" is set to a positive number.
|
||||
-
|
||||
-template:
|
||||
- name: sudo_defaults_option
|
||||
- vars:
|
||||
- option: timestamp_timeout
|
||||
- variable_name: "var_sudo_timestamp_timeout"
|
||||
- # optional minus char added so remediation can detect properly if item is already configured
|
||||
- option_regex_suffix: '=[-]?\w+\b'
|
||||
- backends:
|
||||
- # Template is not able to accomodate this particular check.
|
||||
- # It needs to check for an integer greater than or equal to zero
|
||||
- oval: "off"
|
||||
-
|
||||
+ If results are returned from more than one file location, this is a finding.
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..a258d6632b5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+
|
||||
+if grep -q 'timestamp_timeout' /etc/sudoers; then
|
||||
+ sed -i 's/.*timestamp_timeout.*/Defaults timestamp_timeout=3/' /etc/sudoers
|
||||
+else
|
||||
+ echo "Defaults timestamp_timeout=3" >> /etc/sudoers
|
||||
+fi
|
||||
+
|
||||
+echo "Defaults timestamp_timeout=3" > /etc/sudoers.d/00-complianceascode-test.conf
|
||||
@ -1,23 +0,0 @@
|
||||
From 7345dfea41ddf9cafc2b91b5c90f12ca9ceaffd6 Mon Sep 17 00:00:00 2001
|
||||
From: Matej Tyc <matyc@redhat.com>
|
||||
Date: Thu, 10 Feb 2022 19:11:57 +0100
|
||||
Subject: [PATCH] RHEL9 is supported
|
||||
|
||||
State that rhel9 will be supported by the vendor (as soon as it starts
|
||||
to exist)
|
||||
---
|
||||
.../installed_OS_is_vendor_supported/oval/shared.xml | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
|
||||
index 931be7e8959..16c3847adb7 100644
|
||||
--- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
|
||||
@@ -6,6 +6,7 @@
|
||||
<criteria comment="Installed operating system is supported by a vendor" operator="OR">
|
||||
<extend_definition comment="Installed OS is RHEL7" definition_ref="installed_OS_is_rhel7" />
|
||||
<extend_definition comment="Installed OS is RHEL8" definition_ref="installed_OS_is_rhel8" />
|
||||
+ <extend_definition comment="Installed OS is RHEL9" definition_ref="installed_OS_is_rhel9" />
|
||||
<extend_definition comment="Installed OS is OL7" definition_ref="installed_OS_is_ol7_family" />
|
||||
<extend_definition comment="Installed OS is OL8" definition_ref="installed_OS_is_ol8_family" />
|
||||
<extend_definition comment="Installed OS is SLE12" definition_ref="installed_OS_is_sle12" />
|
||||
@ -1,57 +0,0 @@
|
||||
From ca715d7c17056b6f4cfc2ed3ee2ca68b4388a729 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 16 Feb 2022 09:53:53 +0100
|
||||
Subject: [PATCH 1/2] update description of rhel9 ospp profile
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 14 ++++++--------
|
||||
1 file changed, 6 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index c3f4e2d26eb..cb19227a3bd 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -11,14 +11,12 @@ reference: https://www.niap-ccevs.org/Profile/PP.cfm
|
||||
title: '[DRAFT] Protection Profile for General Purpose Operating Systems'
|
||||
|
||||
description: |-
|
||||
- This profile reflects mandatory configuration controls identified in the
|
||||
- NIAP Configuration Annex to the Protection Profile for General Purpose
|
||||
- Operating Systems (Protection Profile Version 4.2.1).
|
||||
-
|
||||
- This configuration profile is consistent with CNSSI-1253, which requires
|
||||
- U.S. National Security Systems to adhere to certain configuration
|
||||
- parameters. Accordingly, this configuration profile is suitable for
|
||||
- use in U.S. National Security Systems.
|
||||
+ This profile is part of Red Hat Enterprise Linux 9 Common Criteria Guidance
|
||||
+ documentation for Target of Evaluation based on Protection Profile for
|
||||
+ General Purpose Operating Systems (OSPP) version 4.2.1 and Functional
|
||||
+ Package for SSH version 1.0.
|
||||
+ Where appropriate, CNSSI 1253 or DoD-specific values are used for
|
||||
+ configuration, based on Configuration Annex to the OSPP.
|
||||
|
||||
selections:
|
||||
|
||||
|
||||
From 11061228944b3a33a482289dfef5e6a034c39ae4 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Wed, 16 Feb 2022 11:32:09 +0100
|
||||
Subject: [PATCH 2/2] Add newline in the RHEL9 OSPP description
|
||||
|
||||
To be nicely rendered in the guide and OAA.
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index cb19227a3bd..f25abd7e4c4 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -15,6 +15,7 @@ description: |-
|
||||
documentation for Target of Evaluation based on Protection Profile for
|
||||
General Purpose Operating Systems (OSPP) version 4.2.1 and Functional
|
||||
Package for SSH version 1.0.
|
||||
+
|
||||
Where appropriate, CNSSI 1253 or DoD-specific values are used for
|
||||
configuration, based on Configuration Annex to the OSPP.
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
|
||||
index e9d25a34fbd..13231dc2cc9 100644
|
||||
--- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
|
||||
+++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
|
||||
@@ -90,6 +90,7 @@ ocil: |-
|
||||
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
|
||||
" TYPE="crypto_LUKS"</pre>
|
||||
<br /><br />
|
||||
- Pseudo-file systems, such as /proc, /sys, and tmpfs, are not required to use disk encryption and are not a finding.
|
||||
+ The boot partition and pseudo-file systems, such as /proc, /sys, and tmpfs,
|
||||
+ are not required to use disk encryption and are not a finding.
|
||||
|
||||
platform: machine
|
||||
@ -1,43 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
|
||||
index 395129acb66..60b0ce0eb7d 100644
|
||||
--- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
|
||||
@@ -30,7 +30,7 @@ references:
|
||||
nist: AC-17(a),AC-17(2),CM-6(a),MA-4(6),SC-13
|
||||
srg: SRG-OS-000250-GPOS-00093
|
||||
stigid@ol8: OL08-00-010020
|
||||
- stigid@rhel8: RHEL-08-010020
|
||||
+ stigid@rhel8: RHEL-08-010287
|
||||
|
||||
ocil_clause: 'the CRYPTO_POLICY variable is not set or is commented in the /etc/sysconfig/sshd'
|
||||
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index 04f158116ee..60eafa9c566 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -191,9 +191,7 @@ selections:
|
||||
# RHEL-08-010260
|
||||
- file_groupowner_var_log
|
||||
|
||||
- # *** SHARED *** #
|
||||
- # RHEL-08-010290 && RHEL-08-010291
|
||||
- # *** SHARED *** #
|
||||
+ # RHEL-08-010287
|
||||
- configure_ssh_crypto_policy
|
||||
|
||||
# RHEL-08-010290
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 8f79b22e3e4..9bd1a2b0f51 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -192,9 +192,7 @@ selections:
|
||||
# RHEL-08-010260
|
||||
- file_groupowner_var_log
|
||||
|
||||
- # *** SHARED *** #
|
||||
- # RHEL-08-010290 && RHEL-08-010291
|
||||
- # *** SHARED *** #
|
||||
+ # RHEL-08-010287
|
||||
- configure_ssh_crypto_policy
|
||||
|
||||
# RHEL-08-010290
|
||||
@ -1,146 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
|
||||
index 08ffd76aed6..399ca1ea3ce 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
|
||||
@@ -4,6 +4,26 @@
|
||||
# complexity = low
|
||||
# disruption = low
|
||||
|
||||
-{{{ ansible_lineinfile(msg='Ensure that Defaults !targetpw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !targetpw', create='yes', state='present') }}}
|
||||
-{{{ ansible_lineinfile(msg='Ensure that Defaults !rootpw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !rootpw', create='yes', state='present') }}}
|
||||
-{{{ ansible_lineinfile(msg='Ensure that Defaults !runaspw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !runaspw', create='yes', state='present') }}}
|
||||
+{{%- macro delete_line_in_sudoers_d(line) %}}
|
||||
+- name: "Find out if /etc/sudoers.d/* files contain {{{ line }}} to be deduplicated"
|
||||
+ find:
|
||||
+ path: "/etc/sudoers.d"
|
||||
+ patterns: "*"
|
||||
+ contains: '^{{{ line }}}$'
|
||||
+ register: sudoers_d_defaults
|
||||
+
|
||||
+- name: "Remove found occurrences of {{{ line }}} from /etc/sudoers.d/* files"
|
||||
+ lineinfile:
|
||||
+ path: "{{ item.path }}"
|
||||
+ regexp: "^{{{ line }}}$"
|
||||
+ state: absent
|
||||
+ with_items: "{{ sudoers_d_defaults.files }}"
|
||||
+{{%- endmacro %}}
|
||||
+
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !targetpw") }}}
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !rootpw") }}}
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !runaspw") }}}
|
||||
+
|
||||
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !targetpw is defined in sudoers', line_regex='^Defaults !targetpw$', path='/etc/sudoers', new_line='Defaults !targetpw') }}}
|
||||
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !rootpw is defined in sudoers', line_regex='^Defaults !rootpw$', path='/etc/sudoers', new_line='Defaults !rootpw') }}}
|
||||
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !runaspw is defined in sudoers', line_regex='^Defaults !runaspw$', path='/etc/sudoers', new_line='Defaults !runaspw') }}}
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
|
||||
index ea0ac67fa1c..3b327f3fc88 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
|
||||
@@ -1,5 +1,17 @@
|
||||
# platform = multi_platform_all
|
||||
|
||||
+{{%- macro delete_line_in_sudoers_d(line) %}}
|
||||
+if grep -x '^{{{line}}}$' /etc/sudoers.d/*; then
|
||||
+ find /etc/sudoers.d/ -type f -exec sed -i "/{{{line}}}/d" {} \;
|
||||
+fi
|
||||
+{{%- endmacro %}}
|
||||
+
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !targetpw") }}}
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !rootpw") }}}
|
||||
+{{{- delete_line_in_sudoers_d("Defaults !runaspw") }}}
|
||||
+
|
||||
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !targetpw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
|
||||
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !rootpw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
|
||||
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !runaspw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
|
||||
+
|
||||
+
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
|
||||
index 646e6bfb7c0..b3fadd53bee 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
|
||||
@@ -8,17 +8,17 @@
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
id="test_sudoers_targetpw_config" version="1">
|
||||
<ind:object object_ref="object_test_sudoers_targetpw_config" />
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
id="test_sudoers_rootpw_config" version="1">
|
||||
<ind:object object_ref="object_test_sudoers_rootpw_config" />
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
|
||||
id="test_sudoers_runaspw_config" version="1">
|
||||
<ind:object object_ref="object_test_sudoers_runaspw_config" />
|
||||
</ind:textfilecontent54_test>
|
||||
@@ -26,19 +26,19 @@
|
||||
<ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">
|
||||
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
|
||||
<ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
|
||||
- <ind:instance datatype="int">1</ind:instance>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
<ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">
|
||||
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
|
||||
<ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
|
||||
- <ind:instance datatype="int">1</ind:instance>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
<ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">
|
||||
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
|
||||
<ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
|
||||
- <ind:instance datatype="int">1</ind:instance>
|
||||
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
</def-group>
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
|
||||
index ccc29b77d15..698021d8fd0 100644
|
||||
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
|
||||
@@ -42,7 +42,8 @@ ocil_clause: 'invoke user passwd when using sudo'
|
||||
ocil: |-
|
||||
Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
|
||||
<pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
|
||||
- If no results are returned, this is a finding
|
||||
+ If no results are returned, this is a finding.
|
||||
+ If results are returned from more than one file location, this is a finding.
|
||||
If "Defaults !targetpw" is not defined, this is a finding.
|
||||
If "Defaults !rootpw" is not defined, this is a finding.
|
||||
If "Defaults !runaspw" is not defined, this is a finding.
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..a258d108a00
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15
|
||||
+# packages = sudo
|
||||
+
|
||||
+echo 'Defaults !targetpw' >> /etc/sudoers
|
||||
+echo 'Defaults !rootpw' >> /etc/sudoers
|
||||
+echo 'Defaults !runaspw' >> /etc/sudoers
|
||||
+echo 'Defaults !targetpw' >> /etc/sudoers.d/00-complianceascode.conf
|
||||
+echo 'Defaults !rootpw' >> /etc/sudoers.d/00-complianceascode.conf
|
||||
+echo 'Defaults !runaspw' >> /etc/sudoers.d/00-complianceascode.conf
|
||||
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6247b5230e4
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15
|
||||
+# packages = sudo
|
||||
+
|
||||
+echo 'Defaults !targetpw' >> /etc/sudoers
|
||||
+echo 'Defaults !rootpw' >> /etc/sudoers
|
||||
+echo 'Defaults !runaspw' >> /etc/sudoers
|
||||
+echo 'Defaults !runaspw' >> /etc/sudoers
|
||||
@ -1,300 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
|
||||
index 737d725872d..08b62057bde 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
|
||||
@@ -1,7 +1,11 @@
|
||||
# platform = multi_platform_all
|
||||
+# reboot = true
|
||||
+# strategy = enable
|
||||
+# complexity = low
|
||||
+# disruption = low
|
||||
|
||||
if ! grep -x ' case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then
|
||||
- cat >> /etc/bashrc <<'EOF'
|
||||
+ cat >> /etc/profile.d/tmux.sh <<'EOF'
|
||||
if [ "$PS1" ]; then
|
||||
parent=$(ps -o ppid= -p $$)
|
||||
name=$(ps -o comm= -p $parent)
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
index 00ac349e292..4cb2f9e0e04 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
|
||||
@@ -4,21 +4,27 @@
|
||||
<criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
|
||||
<criterion comment="check tmux is configured to exec on the last line of /etc/bashrc"
|
||||
test_ref="test_configure_bashrc_exec_tmux" />
|
||||
+ <criterion comment="check tmux is running" test_ref="test_tmux_running"/>
|
||||
</criteria>
|
||||
</definition>
|
||||
- <ind:textfilecontent54_test check="only one" check_existence="only_one_exists"
|
||||
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
|
||||
comment="check tmux is configured to exec on the last line of /etc/bashrc"
|
||||
id="test_configure_bashrc_exec_tmux" version="1">
|
||||
<ind:object object_ref="obj_configure_bashrc_exec_tmux" />
|
||||
- <ind:state state_ref="state_configure_bashrc_exec_tmux" />
|
||||
</ind:textfilecontent54_test>
|
||||
<ind:textfilecontent54_object id="obj_configure_bashrc_exec_tmux" version="1">
|
||||
<ind:behaviors singleline="true" multiline="false" />
|
||||
- <ind:filepath>/etc/bashrc</ind:filepath>
|
||||
- <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
|
||||
- <ind:instance datatype="int">1</ind:instance>
|
||||
+ <ind:filepath operation="pattern match">^/etc/bashrc$|^/etc/profile\.d/.*$</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
- <ind:textfilecontent54_state id="state_configure_bashrc_exec_tmux" version="1">
|
||||
- <ind:subexpression datatype="string" operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:subexpression>
|
||||
- </ind:textfilecontent54_state>
|
||||
+
|
||||
+ <unix:process58_test check="all" id="test_tmux_running" comment="is tmux running" version="1">
|
||||
+ <unix:object object_ref="obj_tmux_running"/>
|
||||
+ </unix:process58_test>
|
||||
+
|
||||
+ <unix:process58_object id="obj_tmux_running" version="1">
|
||||
+ <unix:command_line operation="pattern match">^tmux(?:|[\s]+.*)$</unix:command_line>
|
||||
+ <unix:pid datatype="int" operation="greater than">0</unix:pid>
|
||||
+ </unix:process58_object>
|
||||
</def-group>
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
index 3ba0f4a2d8f..7afc5fc5e6b 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
|
||||
@@ -7,12 +7,20 @@ title: 'Support session locking with tmux'
|
||||
description: |-
|
||||
The <tt>tmux</tt> terminal multiplexer is used to implement
|
||||
automatic session locking. It should be started from
|
||||
- <tt>/etc/bashrc</tt>.
|
||||
+ <tt>/etc/bashrc</tt> or drop-in files within <tt>/etc/profile.d/</tt>.
|
||||
+ Additionally it must be ensured that the <tt>tmux</tt> process is running
|
||||
+ and it can be verified with the following command:
|
||||
+ <pre>ps all | grep tmux | grep -v grep</pre>
|
||||
|
||||
rationale: |-
|
||||
Unlike <tt>bash</tt> itself, the <tt>tmux</tt> terminal multiplexer
|
||||
provides a mechanism to lock sessions after period of inactivity.
|
||||
|
||||
+warnings:
|
||||
+ - general: |-
|
||||
+ The remediation does not start the tmux process, so it must be
|
||||
+ manually started or have the system rebooted after applying the fix.
|
||||
+
|
||||
severity: medium
|
||||
|
||||
identifiers:
|
||||
@@ -26,17 +34,21 @@ references:
|
||||
stigid@ol8: OL08-00-020041
|
||||
stigid@rhel8: RHEL-08-020041
|
||||
|
||||
-ocil_clause: 'exec tmux is not present at the end of bashrc'
|
||||
+ocil_clause: 'exec tmux is not present at the end of bashrc or tmux process is not running'
|
||||
|
||||
ocil: |-
|
||||
To verify that tmux is configured to execute,
|
||||
run the following command:
|
||||
- <pre>$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc</pre>
|
||||
+ <pre>$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc /etc/profile.d/*</pre>
|
||||
The output should return the following:
|
||||
<pre>if [ "$PS1" ]; then
|
||||
parent=$(ps -o ppid= -p $$)
|
||||
name=$(ps -o comm= -p $parent)
|
||||
case "$name" in sshd|login) exec tmux ;; esac
|
||||
fi</pre>
|
||||
+ To verify that the tmux process is running,
|
||||
+ run the following command:
|
||||
+ <pre>ps all | grep tmux | grep -v grep</pre>
|
||||
+ If the command does not produce output, this is a finding.
|
||||
|
||||
platform: machine
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..221c18665ef
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
|
||||
@@ -0,0 +1,12 @@
|
||||
+#!/bin/bash
|
||||
+# packages = tmux
|
||||
+
|
||||
+cat >> /etc/bashrc <<'EOF'
|
||||
+if [ "$PS1" ]; then
|
||||
+ parent=$(ps -o ppid= -p $$)
|
||||
+ name=$(ps -o comm= -p $parent)
|
||||
+ case "$name" in sshd|login) exec tmux ;; esac
|
||||
+fi
|
||||
+EOF
|
||||
+
|
||||
+tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..1702bb17e79
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# packages = tmux
|
||||
+
|
||||
+
|
||||
+cat >> /etc/profile.d/00-complianceascode.conf <<'EOF'
|
||||
+if [ "$PS1" ]; then
|
||||
+ parent=$(ps -o ppid= -p $$)
|
||||
+ name=$(ps -o comm= -p $parent)
|
||||
+ case "$name" in sshd|login) exec tmux ;; esac
|
||||
+fi
|
||||
+EOF
|
||||
+
|
||||
+tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..16d4acfcb5a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
|
||||
@@ -0,0 +1,20 @@
|
||||
+#!/bin/bash
|
||||
+# packages = tmux
|
||||
+
|
||||
+cat >> /etc/profile.d/00-complianceascode.conf <<'EOF'
|
||||
+if [ "$PS1" ]; then
|
||||
+ parent=$(ps -o ppid= -p $$)
|
||||
+ name=$(ps -o comm= -p $parent)
|
||||
+ case "$name" in sshd|login) exec tmux ;; esac
|
||||
+fi
|
||||
+EOF
|
||||
+
|
||||
+cat >> /etc/bashrc <<'EOF'
|
||||
+if [ "$PS1" ]; then
|
||||
+ parent=$(ps -o ppid= -p $$)
|
||||
+ name=$(ps -o comm= -p $parent)
|
||||
+ case "$name" in sshd|login) exec tmux ;; esac
|
||||
+fi
|
||||
+EOF
|
||||
+
|
||||
+tmux new-session -s root -d
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6cb9d83efc5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
|
||||
@@ -0,0 +1,13 @@
|
||||
+#!/bin/bash
|
||||
+# packages = tmux
|
||||
+# remediation = none
|
||||
+
|
||||
+cat >> /etc/bashrc <<'EOF'
|
||||
+if [ "$PS1" ]; then
|
||||
+ parent=$(ps -o ppid= -p $$)
|
||||
+ name=$(ps -o comm= -p $parent)
|
||||
+ case "$name" in sshd|login) exec tmux ;; esac
|
||||
+fi
|
||||
+EOF
|
||||
+
|
||||
+killall tmux || true
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..f13a8b038e4
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
|
||||
@@ -0,0 +1,105 @@
|
||||
+#!/bin/bash
|
||||
+# packages = tmux
|
||||
+
|
||||
+cat > /etc/bashrc <<'EOF'
|
||||
+# /etc/bashrc
|
||||
+
|
||||
+# System wide functions and aliases
|
||||
+# Environment stuff goes in /etc/profile
|
||||
+
|
||||
+# It's NOT a good idea to change this file unless you know what you
|
||||
+# are doing. It's much better to create a custom.sh shell script in
|
||||
+# /etc/profile.d/ to make custom changes to your environment, as this
|
||||
+# will prevent the need for merging in future updates.
|
||||
+
|
||||
+# Prevent doublesourcing
|
||||
+if [ -z "$BASHRCSOURCED" ]; then
|
||||
+ BASHRCSOURCED="Y"
|
||||
+
|
||||
+ # are we an interactive shell?
|
||||
+ if [ "$PS1" ]; then
|
||||
+ if [ -z "$PROMPT_COMMAND" ]; then
|
||||
+ case $TERM in
|
||||
+ xterm*|vte*)
|
||||
+ if [ -e /etc/sysconfig/bash-prompt-xterm ]; then
|
||||
+ PROMPT_COMMAND=/etc/sysconfig/bash-prompt-xterm
|
||||
+ elif [ "${VTE_VERSION:-0}" -ge 3405 ]; then
|
||||
+ PROMPT_COMMAND="__vte_prompt_command"
|
||||
+ else
|
||||
+ PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"'
|
||||
+ fi
|
||||
+ ;;
|
||||
+ screen*)
|
||||
+ if [ -e /etc/sysconfig/bash-prompt-screen ]; then
|
||||
+ PROMPT_COMMAND=/etc/sysconfig/bash-prompt-screen
|
||||
+ else
|
||||
+ PROMPT_COMMAND='printf "\033k%s@%s:%s\033\\" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"'
|
||||
+ fi
|
||||
+ ;;
|
||||
+ *)
|
||||
+ [ -e /etc/sysconfig/bash-prompt-default ] && PROMPT_COMMAND=/etc/sysconfig/bash-prompt-default
|
||||
+ ;;
|
||||
+ esac
|
||||
+ fi
|
||||
+ # Turn on parallel history
|
||||
+ shopt -s histappend
|
||||
+ history -a
|
||||
+ # Turn on checkwinsize
|
||||
+ shopt -s checkwinsize
|
||||
+ [ "$PS1" = "\\s-\\v\\\$ " ] && PS1="[\u@\h \W]\\$ "
|
||||
+ # You might want to have e.g. tty in prompt (e.g. more virtual machines)
|
||||
+ # and console windows
|
||||
+ # If you want to do so, just add e.g.
|
||||
+ # if [ "$PS1" ]; then
|
||||
+ # PS1="[\u@\h:\l \W]\\$ "
|
||||
+ # fi
|
||||
+ # to your custom modification shell script in /etc/profile.d/ directory
|
||||
+ fi
|
||||
+
|
||||
+ if ! shopt -q login_shell ; then # We're not a login shell
|
||||
+ # Need to redefine pathmunge, it gets undefined at the end of /etc/profile
|
||||
+ pathmunge () {
|
||||
+ case ":${PATH}:" in
|
||||
+ *:"$1":*)
|
||||
+ ;;
|
||||
+ *)
|
||||
+ if [ "$2" = "after" ] ; then
|
||||
+ PATH=$PATH:$1
|
||||
+ else
|
||||
+ PATH=$1:$PATH
|
||||
+ fi
|
||||
+ esac
|
||||
+ }
|
||||
+
|
||||
+ # By default, we want umask to get set. This sets it for non-login shell.
|
||||
+ # Current threshold for system reserved uid/gids is 200
|
||||
+ # You could check uidgid reservation validity in
|
||||
+ # /usr/share/doc/setup-*/uidgid file
|
||||
+ if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then
|
||||
+ umask 002
|
||||
+ else
|
||||
+ umask 022
|
||||
+ fi
|
||||
+
|
||||
+ SHELL=/bin/bash
|
||||
+ # Only display echos from profile.d scripts if we are no login shell
|
||||
+ # and interactive - otherwise just process them to set envvars
|
||||
+ for i in /etc/profile.d/*.sh; do
|
||||
+ if [ -r "$i" ]; then
|
||||
+ if [ "$PS1" ]; then
|
||||
+ . "$i"
|
||||
+ else
|
||||
+ . "$i" >/dev/null
|
||||
+ fi
|
||||
+ fi
|
||||
+ done
|
||||
+
|
||||
+ unset i
|
||||
+ unset -f pathmunge
|
||||
+ fi
|
||||
+
|
||||
+fi
|
||||
+# vim:ts=4:sw=4
|
||||
+EOF
|
||||
+
|
||||
+tmux new-session -s root -d
|
||||
@ -1,209 +0,0 @@
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
||||
index 5b3afb324df..67d6836e873 100644
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
||||
@@ -14,12 +14,3 @@
|
||||
- xorg-x11-server-Xwayland
|
||||
{{% endif %}}
|
||||
state: absent
|
||||
-
|
||||
-
|
||||
-- name: Switch to multi-user runlevel
|
||||
- file:
|
||||
- src: /usr/lib/systemd/system/multi-user.target
|
||||
- dest: /etc/systemd/system/default.target
|
||||
- state: link
|
||||
- force: yes
|
||||
-
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
||||
index dbabe572d2a..496dc74be7c 100644
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
||||
@@ -12,6 +12,3 @@
|
||||
{{% if product not in ["rhel7", "ol7"] %}}
|
||||
{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
||||
{{% endif %}}
|
||||
-
|
||||
-# configure run level
|
||||
-systemctl set-default multi-user.target
|
||||
\ No newline at end of file
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
||||
index 0710efe9f1b..0868ec6eae7 100644
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
||||
@@ -2,10 +2,6 @@
|
||||
<definition class="compliance" id="xwindows_remove_packages" version="1">
|
||||
{{{ oval_metadata("Ensure that the default runlevel target is set to multi-user.target.") }}}
|
||||
<criteria>
|
||||
- {{%- if init_system == "systemd" and target_oval_version != [5, 10] %}}
|
||||
- <extend_definition comment="system is configured to boot into multi-user.target"
|
||||
- definition_ref="xwindows_runlevel_target" />
|
||||
- {{%- endif %}}
|
||||
<criterion comment="package xorg-x11-server-Xorg is not installed"
|
||||
test_ref="package_xorg-x11-server-Xorg_removed" />
|
||||
<extend_definition comment="package xorg-x11-server-common is removed"
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
||||
index 10e51577a12..6ceb07bd574 100644
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
||||
@@ -19,14 +19,6 @@ description: |-
|
||||
{{% else %}}
|
||||
<pre>sudo {{{ pkg_manager }}} remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</pre>
|
||||
{{% endif %}}
|
||||
- Additionally, setting the system's default target to
|
||||
- <tt>multi-user.target</tt> will prevent automatic startup of the X server.
|
||||
- To do so, run:
|
||||
- <pre>$ systemctl set-default multi-user.target</pre>
|
||||
- You should see the following output:
|
||||
- <pre>Removed symlink /etc/systemd/system/default.target.
|
||||
- Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.</pre>
|
||||
-
|
||||
|
||||
rationale: |-
|
||||
Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
|
||||
@@ -72,6 +64,8 @@ warnings:
|
||||
The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
|
||||
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
|
||||
which might bring your system to an inconsistent state requiring additional configuration to access the system
|
||||
- again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
|
||||
+ again.
|
||||
+ The rule <tt>xwindows_runlevel_target</tt> can be used to configure the system to boot into the multi-user.target.
|
||||
+ If a GUI is an operational requirement, a tailored profile that removes this rule should be used before
|
||||
continuing installation.
|
||||
{{{ ovirt_rule_notapplicable_warning("X11 graphic libraries are dependency of OpenStack Cinderlib storage provider") | indent(4) }}}
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh
|
||||
deleted file mode 100644
|
||||
index 9bf62a42d28..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-
|
||||
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
||||
-
|
||||
-systemctl set-default multi-user.target
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh
|
||||
deleted file mode 100644
|
||||
index 4eeb6971486..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-
|
||||
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
||||
-
|
||||
-ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..b3908cff002
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+{{{ bash_package_install("xorg-x11-server-Xorg") }}}
|
||||
+{{{ bash_package_install("xorg-x11-server-utils") }}}
|
||||
+{{{ bash_package_install("xorg-x11-server-common") }}}
|
||||
+{{% if product not in ["rhel7", "ol7"] %}}
|
||||
+{{{ bash_package_install("xorg-x11-server-Xwayland") }}}
|
||||
+{{% endif %}}
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..abafdbd624a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh
|
||||
@@ -0,0 +1,16 @@
|
||||
+#!/bin/bash
|
||||
+# based on shared/templates/package_removed/tests/package-installed-removed.pass.sh
|
||||
+
|
||||
+{{{ bash_package_install("xorg-x11-server-Xorg") }}}
|
||||
+{{{ bash_package_install("xorg-x11-server-utils") }}}
|
||||
+{{{ bash_package_install("xorg-x11-server-common") }}}
|
||||
+{{% if product not in ["rhel7", "ol7"] %}}
|
||||
+{{{ bash_package_install("xorg-x11-server-Xwayland") }}}
|
||||
+{{% endif %}}
|
||||
+
|
||||
+{{{ bash_package_remove("xorg-x11-server-Xorg") }}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-utils") }}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-common") }}}
|
||||
+{{% if product not in ["rhel7", "ol7"] %}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
||||
+{{% endif %}}
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..a403e108082
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+{{{ bash_package_remove("xorg-x11-server-Xorg") }}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-utils") }}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-common") }}}
|
||||
+{{% if product not in ["rhel7", "ol7"] %}}
|
||||
+{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
||||
+{{% endif %}}
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh
|
||||
deleted file mode 100644
|
||||
index ff7d0efda29..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,4 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-# platform = Red Hat Enterprise Linux 7
|
||||
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils
|
||||
-
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh
|
||||
deleted file mode 100644
|
||||
index d8ecd8c7361..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-# platform = Red Hat Enterprise Linux 7
|
||||
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils
|
||||
-
|
||||
-systemctl set-default graphical.target
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh
|
||||
deleted file mode 100644
|
||||
index 14f1a97bc4f..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,4 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-# platform = Red Hat Enterprise Linux 8
|
||||
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland
|
||||
-
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh
|
||||
deleted file mode 100644
|
||||
index c678ef711d9..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-# platform = Red Hat Enterprise Linux 8
|
||||
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland
|
||||
-
|
||||
-systemctl set-default graphical.target
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh
|
||||
deleted file mode 100644
|
||||
index bf8a615b1dc..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-
|
||||
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
||||
-
|
||||
-systemctl set-default graphical.target
|
||||
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh
|
||||
deleted file mode 100644
|
||||
index 652088b85ae..00000000000
|
||||
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-#!/bin/bash
|
||||
-
|
||||
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
||||
-
|
||||
-ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target
|
||||
File diff suppressed because one or more lines are too long
@ -1,685 +0,0 @@
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
|
||||
index dac47a1c6d1..3a6167a5717 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
|
||||
@@ -39,7 +39,7 @@ references:
|
||||
nist: CM-5(6),CM-5(6).1
|
||||
srg: SRG-OS-000259-GPOS-00100
|
||||
stigid@ol8: OL08-00-010350
|
||||
- stigid@rhel8: RHEL-08-010350
|
||||
+ stigid@rhel8: RHEL-08-010351
|
||||
stigid@sle12: SLES-12-010876
|
||||
stigid@sle15: SLES-15-010356
|
||||
stigid@ubuntu2004: UBTU-20-010431
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
index 50fdb17bd2e..6a05a2b82ea 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora
|
||||
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/correct_groupowner.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/correct_groupowner.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6a05a2b82ea
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/correct_groupowner.pass.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora
|
||||
+
|
||||
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
+for dirPath in $DIRS; do
|
||||
+ find "$dirPath" -type d -exec chgrp root '{}' \;
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..36461f5e5c3
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner.fail.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora
|
||||
+
|
||||
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
+for dirPath in $DIRS; do
|
||||
+ mkdir -p "$dirPath/testme" && chgrp nobody "$dirPath/testme"
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner_2.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner_2.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..3f09e3dd018
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/incorrect_groupowner_2.fail.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora
|
||||
+
|
||||
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
+for dirPath in $DIRS; do
|
||||
+ mkdir -p "$dirPath/testme/test2" && chgrp nobody "$dirPath/testme/test2"
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
|
||||
index 043ad6b2dee..36461f5e5c3 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora
|
||||
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
|
||||
index e2362388678..ba923d8ac55 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
|
||||
@@ -27,7 +27,7 @@ references:
|
||||
srg: SRG-OS-000258-GPOS-00099
|
||||
stigid@ubuntu2004: UBTU-20-010424
|
||||
|
||||
-ocil_clause: 'any system exectables directories are found to not be owned by root'
|
||||
+ocil_clause: 'any system executables directories are found to not be owned by root'
|
||||
|
||||
ocil: |-
|
||||
System executables are stored in the following directories by default:
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/oval/shared.xml
|
||||
deleted file mode 100644
|
||||
index 28e193f827c..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/oval/shared.xml
|
||||
+++ /dev/null
|
||||
@@ -1,28 +0,0 @@
|
||||
-<def-group>
|
||||
- <definition class="compliance" id="dir_ownership_library_dirs" version="1">
|
||||
- {{{ oval_metadata("
|
||||
- Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
|
||||
- directories therein, are owned by root.
|
||||
- ") }}}
|
||||
- <criteria operator="AND">
|
||||
- <criterion test_ref="test_dir_ownership_lib_dir" />
|
||||
- </criteria>
|
||||
- </definition>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="test_dir_ownership_lib_dir" version="1">
|
||||
- <unix:object object_ref="object_dir_ownership_lib_dir" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
-
|
||||
- <unix:file_object comment="library directories" id="object_dir_ownership_lib_dir" version="1">
|
||||
- <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
|
||||
- <unix:filename xsi:nil="true" />
|
||||
- <filter action="include">state_owner_library_dirs_not_root</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_state id="state_owner_library_dirs_not_root" version="1">
|
||||
- <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
|
||||
- </unix:file_state>
|
||||
-
|
||||
-</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/rule.yml
|
||||
index d6a0beddf6e..f0781b307b3 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/rule.yml
|
||||
@@ -27,6 +27,8 @@ rationale: |-
|
||||
severity: medium
|
||||
|
||||
identifiers:
|
||||
+ cce@rhel8: CCE-89021-0
|
||||
+ cce@rhel9: CCE-89022-8
|
||||
cce@sle12: CCE-83236-0
|
||||
cce@sle15: CCE-85735-9
|
||||
|
||||
@@ -34,6 +36,7 @@ references:
|
||||
disa: CCI-001499
|
||||
nist: CM-5(6),CM-5(6).1
|
||||
srg: SRG-OS-000259-GPOS-00100
|
||||
+ stigid@rhel8: RHEL-08-010341
|
||||
stigid@sle12: SLES-12-010874
|
||||
stigid@sle15: SLES-15-010354
|
||||
stigid@ubuntu2004: UBTU-20-010429
|
||||
@@ -49,3 +52,14 @@ ocil: |-
|
||||
For each of these directories, run the following command to find files not
|
||||
owned by root:
|
||||
<pre>$ sudo find -L <i>$DIR</i> ! -user root -type d -exec chown root {} \;</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /lib/
|
||||
+ - /lib64/
|
||||
+ - /usr/lib/
|
||||
+ - /usr/lib64/
|
||||
+ recursive: 'true'
|
||||
+ fileuid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/correct_owner.pass.sh
|
||||
similarity index 69%
|
||||
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/correct_owner.pass.sh
|
||||
index 01891664f64..a0d4990582e 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/all_dirs_ok.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/correct_owner.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_rhel
|
||||
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
for dirPath in $DIRS; do
|
||||
find "$dirPath" -type d -exec chown root '{}' \;
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/nobody_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/incorrect_owner.fail.sh
|
||||
similarity index 63%
|
||||
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/nobody_owned_dir_on_lib.fail.sh
|
||||
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/incorrect_owner.fail.sh
|
||||
index 59b8a1867eb..f366c2d7922 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/nobody_owned_dir_on_lib.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/tests/incorrect_owner.fail.sh
|
||||
@@ -1,4 +1,5 @@
|
||||
-# platform = multi_platform_sle
|
||||
+# platform = multi_platform_sle,multi_platform_rhel
|
||||
+groupadd nogroup
|
||||
DIRS="/lib /lib64"
|
||||
for dirPath in $DIRS; do
|
||||
mkdir -p "$dirPath/testme" && chown nobody:nogroup "$dirPath/testme"
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml
|
||||
index a0e4e24b4f4..add26b2e778 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/oval/shared.xml
|
||||
@@ -1,8 +1,8 @@
|
||||
<def-group>
|
||||
<definition class="compliance" id="dir_permissions_library_dirs" version="1">
|
||||
{{{ oval_metadata("
|
||||
- Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
|
||||
- objects therein, are not group-writable or world-writable.
|
||||
+ Checks that the directories /lib, /lib64, /usr/lib and /usr/lib64
|
||||
+ are not group-writable or world-writable.
|
||||
") }}}
|
||||
<criteria operator="AND">
|
||||
<criterion test_ref="dir_test_perms_lib_dir" />
|
||||
@@ -19,7 +19,7 @@
|
||||
<unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
|
||||
<unix:filename xsi:nil="true" />
|
||||
<filter action="include">dir_state_perms_nogroupwrite_noworldwrite</filter>
|
||||
- <filter action="exclude">dir_perms_state_symlink</filter>
|
||||
+ <filter action="exclude">dir_perms_state_nogroupwrite_noworldwrite_symlink</filter>
|
||||
</unix:file_object>
|
||||
|
||||
<unix:file_state id="dir_state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
|
||||
@@ -27,7 +27,7 @@
|
||||
<unix:owrite datatype="boolean">true</unix:owrite>
|
||||
</unix:file_state>
|
||||
|
||||
- <unix:file_state id="dir_perms_state_symlink" version="1">
|
||||
+ <unix:file_state id="dir_perms_state_nogroupwrite_noworldwrite_symlink" version="1">
|
||||
<unix:type operation="equals">symbolic link</unix:type>
|
||||
</unix:file_state>
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
index db89a5e47a1..6e62e8c6bbf 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
||||
@@ -60,3 +60,14 @@ ocil: |-
|
||||
To find shared libraries that are group-writable or world-writable,
|
||||
run the following command for each directory <i>DIR</i> which contains shared libraries:
|
||||
<pre>$ sudo find -L <i>DIR</i> -perm /022 -type d</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /lib/
|
||||
+ - /lib64/
|
||||
+ - /usr/lib/
|
||||
+ - /usr/lib64/
|
||||
+ recursive: 'true'
|
||||
+ filemode: '0755'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml
|
||||
index 6b3a2905068..eec7485f90c 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
|
||||
+# platform = multi_platform_sle,Oracle Linux 8,multi_platform_rhel,multi_platform_fedora
|
||||
# reboot = false
|
||||
# strategy = restrict
|
||||
# complexity = medium
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
index a9e8c7d8e25..e352dd34a67 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,Oracle Linux 8,multi_platform_rhel,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
|
||||
do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml
|
||||
deleted file mode 100644
|
||||
index de81a3703b4..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml
|
||||
+++ /dev/null
|
||||
@@ -1,18 +0,0 @@
|
||||
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
|
||||
-# reboot = false
|
||||
-# strategy = restrict
|
||||
-# complexity = medium
|
||||
-# disruption = medium
|
||||
-- name: "Read list libraries without root ownership"
|
||||
- command: "find -L /usr/lib /usr/lib64 /lib /lib64 \\! -user root"
|
||||
- register: libraries_not_owned_by_root
|
||||
- changed_when: False
|
||||
- failed_when: False
|
||||
- check_mode: no
|
||||
-
|
||||
-- name: "Set ownership of system libraries to root"
|
||||
- file:
|
||||
- path: "{{ item }}"
|
||||
- owner: "root"
|
||||
- with_items: "{{ libraries_not_owned_by_root.stdout_lines }}"
|
||||
- when: libraries_not_owned_by_root | length > 0
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh
|
||||
deleted file mode 100644
|
||||
index c75167d2fe7..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh
|
||||
+++ /dev/null
|
||||
@@ -1,8 +0,0 @@
|
||||
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
|
||||
-for LIBDIR in /usr/lib /usr/lib64 /lib /lib64
|
||||
-do
|
||||
- if [ -d $LIBDIR ]
|
||||
- then
|
||||
- find -L $LIBDIR \! -user root -exec chown root {} \;
|
||||
- fi
|
||||
-done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/oval/shared.xml
|
||||
deleted file mode 100644
|
||||
index 59ee3d82a21..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/oval/shared.xml
|
||||
+++ /dev/null
|
||||
@@ -1,39 +0,0 @@
|
||||
-<def-group>
|
||||
- <definition class="compliance" id="file_ownership_library_dirs" version="1">
|
||||
- {{{ oval_metadata("
|
||||
- Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
|
||||
- objects therein, are owned by root.
|
||||
- ") }}}
|
||||
- <criteria operator="AND">
|
||||
- <criterion test_ref="test_ownership_lib_dir" />
|
||||
- <criterion test_ref="test_ownership_lib_files" />
|
||||
- </criteria>
|
||||
- </definition>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="test_ownership_lib_dir" version="1">
|
||||
- <unix:object object_ref="object_file_ownership_lib_dir" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="library files uid root" id="test_ownership_lib_files" version="1">
|
||||
- <unix:object object_ref="object_file_ownership_lib_files" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_object comment="library directories" id="object_file_ownership_lib_dir" version="1">
|
||||
- <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
|
||||
- <unix:filename xsi:nil="true" />
|
||||
- <filter action="include">state_owner_libraries_not_root</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_object comment="library files" id="object_file_ownership_lib_files" version="1">
|
||||
- <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
|
||||
- <unix:filename operation="pattern match">^.*$</unix:filename>
|
||||
- <filter action="include">state_owner_libraries_not_root</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_state id="state_owner_libraries_not_root" version="1">
|
||||
- <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
|
||||
- </unix:file_state>
|
||||
-
|
||||
-</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml
|
||||
index d80681c1e65..b6bc18e8310 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml
|
||||
@@ -60,3 +60,14 @@ ocil: |-
|
||||
For each of these directories, run the following command to find files not
|
||||
owned by root:
|
||||
<pre>$ sudo find -L <i>$DIR</i> ! -user root -exec chown root {} \;</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_owner
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /lib/
|
||||
+ - /lib64/
|
||||
+ - /usr/lib/
|
||||
+ - /usr/lib64/
|
||||
+ file_regex: ^.*$
|
||||
+ fileuid: '0'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/correct_owner.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/correct_owner.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..92c6a0889d4
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/correct_owner.pass.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora,multi_platform_ubuntu
|
||||
+
|
||||
+for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
|
||||
+do
|
||||
+ if [[ -d $SYSLIBDIRS ]]
|
||||
+ then
|
||||
+ find $SYSLIBDIRS ! -user root -type f -exec chown root '{}' \;
|
||||
+ fi
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/incorrect_owner.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/incorrect_owner.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..84da71f45f7
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/tests/incorrect_owner.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora,multi_platform_ubuntu
|
||||
+
|
||||
+useradd user_test
|
||||
+for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
|
||||
+do
|
||||
+ if [[ ! -f $TESTFILE ]]
|
||||
+ then
|
||||
+ touch $TESTFILE
|
||||
+ fi
|
||||
+ chown user_test $TESTFILE
|
||||
+done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml
|
||||
deleted file mode 100644
|
||||
index cf9eebace8b..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml
|
||||
+++ /dev/null
|
||||
@@ -1,18 +0,0 @@
|
||||
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
|
||||
-# reboot = false
|
||||
-# strategy = restrict
|
||||
-# complexity = high
|
||||
-# disruption = medium
|
||||
-- name: "Read list of world and group writable files in libraries directories"
|
||||
- command: "find /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f"
|
||||
- register: world_writable_library_files
|
||||
- changed_when: False
|
||||
- failed_when: False
|
||||
- check_mode: no
|
||||
-
|
||||
-- name: "Disable world/group writability to library files"
|
||||
- file:
|
||||
- path: "{{ item }}"
|
||||
- mode: "go-w"
|
||||
- with_items: "{{ world_writable_library_files.stdout_lines }}"
|
||||
- when: world_writable_library_files.stdout_lines | length > 0
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh
|
||||
deleted file mode 100644
|
||||
index af04ad625d3..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh
|
||||
+++ /dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
-# platform = multi_platform_all
|
||||
-DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
||||
-for dirPath in $DIRS; do
|
||||
- find "$dirPath" -perm /022 -type f -exec chmod go-w '{}' \;
|
||||
-done
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/oval/shared.xml
|
||||
deleted file mode 100644
|
||||
index f25c52260c4..00000000000
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/oval/shared.xml
|
||||
+++ /dev/null
|
||||
@@ -1,46 +0,0 @@
|
||||
-<def-group>
|
||||
- <definition class="compliance" id="file_permissions_library_dirs" version="1">
|
||||
- {{{ oval_metadata("
|
||||
- Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
|
||||
- objects therein, are not group-writable or world-writable.
|
||||
- ") }}}
|
||||
- <criteria operator="AND">
|
||||
- <criterion test_ref="test_perms_lib_dir" />
|
||||
- <criterion test_ref="test_perms_lib_files" />
|
||||
- </criteria>
|
||||
- </definition>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="test_perms_lib_dir" version="1">
|
||||
- <unix:object object_ref="object_file_permissions_lib_dir" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_test check="all" check_existence="none_exist" comment="library files go-w" id="test_perms_lib_files" version="1">
|
||||
- <unix:object object_ref="object_file_permissions_lib_files" />
|
||||
- </unix:file_test>
|
||||
-
|
||||
- <unix:file_object comment="library directories" id="object_file_permissions_lib_dir" version="1">
|
||||
- <!-- Check that /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
|
||||
- <unix:filename xsi:nil="true" />
|
||||
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
|
||||
- <filter action="exclude">perms_state_symlink</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_object comment="library files" id="object_file_permissions_lib_files" version="1">
|
||||
- <!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
|
||||
- <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
|
||||
- <unix:filename operation="pattern match">^.*$</unix:filename>
|
||||
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
|
||||
- <filter action="exclude">perms_state_symlink</filter>
|
||||
- </unix:file_object>
|
||||
-
|
||||
- <unix:file_state id="state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
|
||||
- <unix:gwrite datatype="boolean">true</unix:gwrite>
|
||||
- <unix:owrite datatype="boolean">true</unix:owrite>
|
||||
- </unix:file_state>
|
||||
-
|
||||
- <unix:file_state id="perms_state_symlink" version="1">
|
||||
- <unix:type operation="equals">symbolic link</unix:type>
|
||||
- </unix:file_state>
|
||||
-
|
||||
-</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml
|
||||
index 9a07e76929e..5a708cf78c3 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml
|
||||
@@ -61,3 +61,14 @@ ocil: |-
|
||||
To find shared libraries that are group-writable or world-writable,
|
||||
run the following command for each directory <i>DIR</i> which contains shared libraries:
|
||||
<pre>$ sudo find -L <i>DIR</i> -perm /022 -type f</pre>
|
||||
+
|
||||
+template:
|
||||
+ name: file_permissions
|
||||
+ vars:
|
||||
+ filepath:
|
||||
+ - /lib/
|
||||
+ - /lib64/
|
||||
+ - /usr/lib/
|
||||
+ - /usr/lib64/
|
||||
+ file_regex: ^.*$
|
||||
+ filemode: '0755'
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/lenient_permissions.fail.sh
|
||||
similarity index 100%
|
||||
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh
|
||||
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/lenient_permissions.fail.sh
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
index eaf04c8d36c..ec135b5279c 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
|
||||
@@ -4,7 +4,7 @@ prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15,ubuntu2004
|
||||
|
||||
title: |-
|
||||
Verify the system-wide library files in directories
|
||||
- "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are owned by root.
|
||||
+ "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.
|
||||
|
||||
description: |-
|
||||
System-wide library files are stored in the following directories
|
||||
@@ -15,7 +15,7 @@ description: |-
|
||||
/usr/lib64
|
||||
</pre>
|
||||
All system-wide shared library files should be protected from unauthorised
|
||||
- access. If any of these files is not owned by root, correct its owner with
|
||||
+ access. If any of these files is not group-owned by root, correct its group-owner with
|
||||
the following command:
|
||||
<pre>$ sudo chgrp root <i>FILE</i></pre>
|
||||
|
||||
@@ -48,7 +48,7 @@ references:
|
||||
stigid@sle15: SLES-15-010355
|
||||
stigid@ubuntu2004: UBTU-20-01430
|
||||
|
||||
-ocil_clause: 'system wide library files are not group owned by root'
|
||||
+ocil_clause: 'system wide library files are not group-owned by root'
|
||||
|
||||
ocil: |-
|
||||
System-wide library files are stored in the following directories:
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
index 0e982c3b8ca..5356d3742d3 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
|
||||
do
|
||||
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
index 23a7703f57d..7352b60aa4b 100644
|
||||
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
|
||||
+# platform = multi_platform_sle,multi_platform_rhel,multi_platform_fedora,multi_platform_ubuntu
|
||||
|
||||
groupadd group_test
|
||||
for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
|
||||
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
||||
index ff23f83cfbf..88b3a7e3783 100644
|
||||
--- a/products/rhel8/profiles/stig.profile
|
||||
+++ b/products/rhel8/profiles/stig.profile
|
||||
@@ -235,8 +235,13 @@ selections:
|
||||
# RHEL-08-010340
|
||||
- file_ownership_library_dirs
|
||||
|
||||
+ # RHEL-08-010341
|
||||
+ - dir_ownership_library_dirs
|
||||
+
|
||||
# RHEL-08-010350
|
||||
- root_permissions_syslibrary_files
|
||||
+
|
||||
+ # RHEL-08-010351
|
||||
- dir_group_ownership_library_dirs
|
||||
|
||||
# RHEL-08-010360
|
||||
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
||||
index 8cc6d132591..65465be2c07 100644
|
||||
--- a/products/rhel9/profiles/stig.profile
|
||||
+++ b/products/rhel9/profiles/stig.profile
|
||||
@@ -236,8 +236,13 @@ selections:
|
||||
# RHEL-08-010340
|
||||
- file_ownership_library_dirs
|
||||
|
||||
+ # RHEL-08-010341
|
||||
+ - dir_ownership_library_dirs
|
||||
+
|
||||
# RHEL-08-010350
|
||||
- root_permissions_syslibrary_files
|
||||
+
|
||||
+ # RHEL-08-010351
|
||||
- dir_group_ownership_library_dirs
|
||||
|
||||
# RHEL-08-010360
|
||||
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
||||
index 8aad24b20f7..eb3f17f4f3d 100644
|
||||
--- a/shared/references/cce-redhat-avail.txt
|
||||
+++ b/shared/references/cce-redhat-avail.txt
|
||||
@@ -2957,8 +2957,6 @@ CCE-89017-8
|
||||
CCE-89018-6
|
||||
CCE-89019-4
|
||||
CCE-89020-2
|
||||
-CCE-89021-0
|
||||
-CCE-89022-8
|
||||
CCE-89023-6
|
||||
CCE-89024-4
|
||||
CCE-89025-1
|
||||
diff --git a/shared/templates/file_groupowner/ansible.template b/shared/templates/file_groupowner/ansible.template
|
||||
index 68fc2e1e17e..0b4ab594155 100644
|
||||
--- a/shared/templates/file_groupowner/ansible.template
|
||||
+++ b/shared/templates/file_groupowner/ansible.template
|
||||
@@ -12,6 +12,7 @@
|
||||
paths: "{{{ path }}}"
|
||||
patterns: {{{ FILE_REGEX[loop.index0] }}}
|
||||
use_regex: yes
|
||||
+ hidden: yes
|
||||
register: files_found
|
||||
|
||||
- name: Ensure group owner on {{{ path }}} file(s) matching {{{ FILE_REGEX[loop.index0] }}}
|
||||
diff --git a/shared/templates/file_groupowner/oval.template b/shared/templates/file_groupowner/oval.template
|
||||
index fd2e5db5d93..64a494471a8 100644
|
||||
--- a/shared/templates/file_groupowner/oval.template
|
||||
+++ b/shared/templates/file_groupowner/oval.template
|
||||
@@ -45,6 +45,10 @@
|
||||
{{%- else %}}
|
||||
<unix:filepath{{% if FILEPATH_IS_REGEX %}} operation="pattern match"{{% endif %}}>{{{ filepath }}}</unix:filepath>
|
||||
{{%- endif %}}
|
||||
+ <filter action="exclude">symlink_file_groupowner{{{ FILEID }}}_uid_{{{ FILEGID }}}</filter>
|
||||
</unix:file_object>
|
||||
{{% endfor %}}
|
||||
+ <unix:file_state id="symlink_file_groupowner{{{ FILEID }}}_uid_{{{ FILEGID }}}" version="1">
|
||||
+ <unix:type operation="equals">symbolic link</unix:type>
|
||||
+ </unix:file_state>
|
||||
</def-group>
|
||||
diff --git a/shared/templates/file_owner/ansible.template b/shared/templates/file_owner/ansible.template
|
||||
index 590c9fc6055..dba9e65a277 100644
|
||||
--- a/shared/templates/file_owner/ansible.template
|
||||
+++ b/shared/templates/file_owner/ansible.template
|
||||
@@ -12,6 +12,7 @@
|
||||
paths: "{{{ path }}}"
|
||||
patterns: {{{ FILE_REGEX[loop.index0] }}}
|
||||
use_regex: yes
|
||||
+ hidden: yes
|
||||
register: files_found
|
||||
|
||||
- name: Ensure group owner on {{{ path }}} file(s) matching {{{ FILE_REGEX[loop.index0] }}}
|
||||
diff --git a/shared/templates/file_owner/oval.template b/shared/templates/file_owner/oval.template
|
||||
index 105e29c81c8..777831d790d 100644
|
||||
--- a/shared/templates/file_owner/oval.template
|
||||
+++ b/shared/templates/file_owner/oval.template
|
||||
@@ -44,6 +44,10 @@
|
||||
{{%- else %}}
|
||||
<unix:filepath{{% if FILEPATH_IS_REGEX %}} operation="pattern match"{{% endif %}}>{{{ filepath }}}</unix:filepath>
|
||||
{{%- endif %}}
|
||||
+ <filter action="exclude">symlink_file_owner{{{ FILEID }}}_uid_{{{ FILEUID }}}</filter>
|
||||
</unix:file_object>
|
||||
{{% endfor %}}
|
||||
+ <unix:file_state id="symlink_file_owner{{{ FILEID }}}_uid_{{{ FILEUID }}}" version="1">
|
||||
+ <unix:type operation="equals">symbolic link</unix:type>
|
||||
+ </unix:file_state>
|
||||
</def-group>
|
||||
diff --git a/shared/templates/file_permissions/ansible.template b/shared/templates/file_permissions/ansible.template
|
||||
index fc211bdc4c3..6d4dedcee51 100644
|
||||
--- a/shared/templates/file_permissions/ansible.template
|
||||
+++ b/shared/templates/file_permissions/ansible.template
|
||||
@@ -12,6 +12,7 @@
|
||||
paths: "{{{ path }}}"
|
||||
patterns: {{{ FILE_REGEX[loop.index0] }}}
|
||||
use_regex: yes
|
||||
+ hidden: yes
|
||||
register: files_found
|
||||
|
||||
- name: Set permissions for {{{ path }}} file(s)
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
||||
index b5621425b96..c5a9b6a32ad 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
||||
@@ -181,6 +181,7 @@ selections:
|
||||
- dconf_gnome_screensaver_idle_delay
|
||||
- dconf_gnome_screensaver_lock_enabled
|
||||
- dir_group_ownership_library_dirs
|
||||
+- dir_ownership_library_dirs
|
||||
- dir_permissions_library_dirs
|
||||
- dir_perms_world_writable_root_owned
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
index 31221ed632c..32d195e28aa 100644
|
||||
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
||||
@@ -192,6 +192,7 @@ selections:
|
||||
- dconf_gnome_screensaver_idle_delay
|
||||
- dconf_gnome_screensaver_lock_enabled
|
||||
- dir_group_ownership_library_dirs
|
||||
+- dir_ownership_library_dirs
|
||||
- dir_permissions_library_dirs
|
||||
- dir_perms_world_writable_root_owned
|
||||
- dir_perms_world_writable_sticky_bits
|
||||
@ -1,161 +0,0 @@
|
||||
diff --git a/docs/templates/template_reference.md b/docs/templates/template_reference.md
|
||||
index 65bc439225e..fef4679be39 100644
|
||||
--- a/docs/templates/template_reference.md
|
||||
+++ b/docs/templates/template_reference.md
|
||||
@@ -2,17 +2,20 @@
|
||||
|
||||
#### accounts_password
|
||||
- Checks if PAM enforces password quality requirements. Checks the
|
||||
- configuration in `/etc/pam.d/system-auth` (for RHEL 6 systems) or
|
||||
- `/etc/security/pwquality.conf` (on other systems).
|
||||
+ configuration in `/etc/security/pwquality.conf`.
|
||||
|
||||
- Parameters:
|
||||
|
||||
- - **variable** - PAM `pam_cracklib` (on RHEL 6) or `pam_pwquality`
|
||||
- (on other systems) module name, eg. `ucredit`, `ocredit`
|
||||
+ - **variable** - PAM `pam_pwquality` password quality
|
||||
+ requirement, eg. `ucredit`, `ocredit`
|
||||
|
||||
- **operation** - OVAL operation, eg. `less than or equal`
|
||||
|
||||
-- Languages: OVAL
|
||||
+ - **zero_comparison_operation** - (optional) OVAL operation, eg. `greater than`.
|
||||
+ When set, it will test if the **variable** value matches the OVAL operation
|
||||
+ when compared to zero.
|
||||
+
|
||||
+- Languages: Ansible, Bash, OVAL
|
||||
|
||||
#### auditd_lineinfile
|
||||
- Checks configuration options of the Audit Daemon in
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml
|
||||
index 912c783650a..9a829ac5119 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml
|
||||
@@ -47,7 +47,7 @@ ocil_clause: 'that is not the case'
|
||||
ocil: |-
|
||||
To check the value for maximum consecutive repeating characters, run the following command:
|
||||
<pre>$ grep maxclassrepeat /etc/security/pwquality.conf</pre>
|
||||
- For DoD systems, the output should show <tt>maxclassrepeat</tt>=4.
|
||||
+ For DoD systems, the output should show <tt>maxclassrepeat</tt>=4 or less but greater than zero.
|
||||
|
||||
platform: pam
|
||||
|
||||
@@ -56,3 +56,4 @@ template:
|
||||
vars:
|
||||
variable: maxclassrepeat
|
||||
operation: less than or equal
|
||||
+ zero_comparison_operation: greater than
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..5d91559d4a2
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then
|
||||
+ sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 4/' /etc/security/pwquality.conf
|
||||
+else
|
||||
+ echo "maxclassrepeat = 4" >> /etc/security/pwquality.conf
|
||||
+fi
|
||||
+
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..4bd8070eb7e
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then
|
||||
+ sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 2/' /etc/security/pwquality.conf
|
||||
+else
|
||||
+ echo "maxclassrepeat = 2" >> /etc/security/pwquality.conf
|
||||
+fi
|
||||
+
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..61538a4945f
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then
|
||||
+ sed -i 's/.*maxclassrepeat.*/maxclassrepeat = -1/' /etc/security/pwquality.conf
|
||||
+else
|
||||
+ echo "maxclassrepeat = -1" >> /etc/security/pwquality.conf
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..2218250ec7b
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then
|
||||
+ sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 5/' /etc/security/pwquality.conf
|
||||
+else
|
||||
+ echo "maxclassrepeat = 5" >> /etc/security/pwquality.conf
|
||||
+fi
|
||||
+
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..780873c6a86
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh
|
||||
@@ -0,0 +1,8 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then
|
||||
+ sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 0/' /etc/security/pwquality.conf
|
||||
+else
|
||||
+ echo "maxclassrepeat = 0" >> /etc/security/pwquality.conf
|
||||
+fi
|
||||
+
|
||||
diff --git a/shared/templates/accounts_password/oval.template b/shared/templates/accounts_password/oval.template
|
||||
index 332a2800317..b995db11ea4 100644
|
||||
--- a/shared/templates/accounts_password/oval.template
|
||||
+++ b/shared/templates/accounts_password/oval.template
|
||||
@@ -7,11 +7,14 @@
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
- <ind:textfilecontent54_test check="all"
|
||||
+ <ind:textfilecontent54_test check="all" state_operator="AND"
|
||||
comment="check the configuration of /etc/security/pwquality.conf"
|
||||
id="test_password_pam_pwquality_{{{ VARIABLE }}}" version="3">
|
||||
<ind:object object_ref="obj_password_pam_pwquality_{{{ VARIABLE }}}" />
|
||||
<ind:state state_ref="state_password_pam_{{{ VARIABLE }}}" />
|
||||
+ {{%- if ZERO_COMPARISON_OPERATION %}}
|
||||
+ <ind:state state_ref="state_password_pam_{{{ VARIABLE }}}_zero_comparison" />
|
||||
+ {{%- endif %}}
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
<ind:textfilecontent54_object id="obj_password_pam_pwquality_{{{ VARIABLE }}}" version="3">
|
||||
@@ -24,5 +27,11 @@
|
||||
<ind:subexpression datatype="int" operation="{{{ OPERATION }}}" var_ref="var_password_pam_{{{ VARIABLE }}}" />
|
||||
</ind:textfilecontent54_state>
|
||||
|
||||
+ {{%- if ZERO_COMPARISON_OPERATION %}}
|
||||
+ <ind:textfilecontent54_state id="state_password_pam_{{{ VARIABLE }}}_zero_comparison" version="1">
|
||||
+ <ind:subexpression datatype="int" operation="{{{ ZERO_COMPARISON_OPERATION }}}" >0</ind:subexpression>
|
||||
+ </ind:textfilecontent54_state>
|
||||
+ {{%- endif %}}
|
||||
+
|
||||
<external_variable comment="External variable for pam_{{{ VARIABLE }}}" datatype="int" id="var_password_pam_{{{ VARIABLE }}}" version="3" />
|
||||
</def-group>
|
||||
diff --git a/shared/templates/accounts_password/template.py b/shared/templates/accounts_password/template.py
|
||||
index 65c25ec7991..ab849d1fa72 100644
|
||||
--- a/shared/templates/accounts_password/template.py
|
||||
+++ b/shared/templates/accounts_password/template.py
|
||||
@@ -1,4 +1,7 @@
|
||||
+from ssg.utils import parse_template_boolean_value
|
||||
+
|
||||
def preprocess(data, lang):
|
||||
if lang == "oval":
|
||||
data["sign"] = "-?" if data["variable"].endswith("credit") else ""
|
||||
+ data["zero_comparison_operation"] = data.get("zero_comparison_operation", None)
|
||||
return data
|
||||
@ -1,29 +0,0 @@
|
||||
From 26ea4a0c3b31677ac3d4dc466fd9a917f526f129 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Wed, 23 Mar 2022 09:56:48 +0100
|
||||
Subject: [PATCH] Update RHEL9 auxiliary gpg key to auxiliary key 3.
|
||||
|
||||
Key fingerprint: DA7F68E3872D6E7BDCE05225E7EB5F3ACDD9699F
|
||||
---
|
||||
products/rhel9/product.yml | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/product.yml b/products/rhel9/product.yml
|
||||
index ce86b172b70..6771ae5f6a8 100644
|
||||
--- a/products/rhel9/product.yml
|
||||
+++ b/products/rhel9/product.yml
|
||||
@@ -22,11 +22,11 @@ dconf_gdm_dir: "distro.d"
|
||||
# The fingerprints below are retrieved from https://access.redhat.com/security/team/key
|
||||
pkg_release: "4ae0493b"
|
||||
pkg_version: "fd431d51"
|
||||
-aux_pkg_release: "5b32db75"
|
||||
-aux_pkg_version: "d4082792"
|
||||
+aux_pkg_release: "6229229e"
|
||||
+aux_pkg_version: "5a6340b3"
|
||||
|
||||
release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
|
||||
-auxiliary_key_fingerprint: "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792"
|
||||
+auxiliary_key_fingerprint: "7E4624258C406535D56D6F135054E4A45A6340B3"
|
||||
oval_feed_url: "https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2"
|
||||
|
||||
cpes_root: "../../shared/applicability"
|
||||
@ -0,0 +1,60 @@
|
||||
From be2aba89ab61767fd301ee1ac4f4e64bf5a66887 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Thu, 11 Aug 2022 16:53:48 +0200
|
||||
Subject: [PATCH] add 4 rules back to RHEL9 datastream
|
||||
|
||||
---
|
||||
.../services/kerberos/package_krb5-server_removed/rule.yml | 2 +-
|
||||
.../guide/services/obsolete/nis/package_ypbind_removed/rule.yml | 2 +-
|
||||
.../guide/services/obsolete/nis/package_ypserv_removed/rule.yml | 2 +-
|
||||
.../system-tools/package_krb5-workstation_removed/rule.yml | 2 +-
|
||||
4 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml b/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml
|
||||
index 78577046409..17d742d9692 100644
|
||||
--- a/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml
|
||||
+++ b/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml
|
||||
@@ -1,6 +1,6 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: ol7,ol8,rhel7,rhel8
|
||||
+prodtype: ol7,ol8,rhel7,rhel8,rhel9
|
||||
|
||||
title: 'Remove the Kerberos Server Package'
|
||||
|
||||
diff --git a/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml b/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml
|
||||
index d8a3910ff4d..9be95ffed5c 100644
|
||||
--- a/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml
|
||||
+++ b/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml
|
||||
@@ -1,6 +1,6 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: alinux2,alinux3,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15
|
||||
+prodtype: alinux2,alinux3,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15
|
||||
|
||||
title: 'Remove NIS Client'
|
||||
|
||||
diff --git a/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml b/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml
|
||||
index ee7ccb2d8da..0f7ad7c0431 100644
|
||||
--- a/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml
|
||||
+++ b/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml
|
||||
@@ -1,6 +1,6 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15
|
||||
+prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15
|
||||
|
||||
title: 'Uninstall ypserv Package'
|
||||
|
||||
diff --git a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
|
||||
index 7a02459825d..4750fd6b266 100644
|
||||
--- a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
|
||||
+++ b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
|
||||
@@ -1,6 +1,6 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8
|
||||
+prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9
|
||||
|
||||
title: 'Uninstall krb5-workstation Package'
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -0,0 +1,90 @@
|
||||
From 4ef59d44355179b6450ac493d4417a8b29d8ccf1 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 11:45:15 +0200
|
||||
Subject: [PATCH 1/4] fix ospp references
|
||||
|
||||
---
|
||||
linux_os/guide/system/accounts/enable_authselect/rule.yml | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/enable_authselect/rule.yml b/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
||||
index c151d3c4aa1..f9b46c51ddd 100644
|
||||
--- a/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
||||
@@ -34,6 +34,7 @@ references:
|
||||
disa: CCI-000213
|
||||
hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii) # taken from require_singleuser_auth
|
||||
nist: AC-3
|
||||
+ ospp: FIA_UAU.1,FIA_AFL.1
|
||||
srg: SRG-OS-000480-GPOS-00227
|
||||
|
||||
ocil: |-
|
||||
|
||||
From 05a0414b565097c155d0c4a1696d8c4f2da91298 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 11:45:42 +0200
|
||||
Subject: [PATCH 2/4] change authselect profile to minimal in rhel9 ospp
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index b47630c62b0..dcc41970043 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -115,7 +115,7 @@ selections:
|
||||
- coredump_disable_storage
|
||||
- coredump_disable_backtraces
|
||||
- service_systemd-coredump_disabled
|
||||
- - var_authselect_profile=sssd
|
||||
+ - var_authselect_profile=minimal
|
||||
- enable_authselect
|
||||
- use_pam_wheel_for_su
|
||||
|
||||
|
||||
From 350135aa0c49a8a383103f88034acbb3925bb556 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 11:45:54 +0200
|
||||
Subject: [PATCH 3/4] change authselect profile to minimal in rhel8 ospp
|
||||
|
||||
---
|
||||
products/rhel8/profiles/ospp.profile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile
|
||||
index 39ad1797c7a..ebec8a3a6f9 100644
|
||||
--- a/products/rhel8/profiles/ospp.profile
|
||||
+++ b/products/rhel8/profiles/ospp.profile
|
||||
@@ -220,7 +220,7 @@ selections:
|
||||
- var_accounts_max_concurrent_login_sessions=10
|
||||
- accounts_max_concurrent_login_sessions
|
||||
- securetty_root_login_console_only
|
||||
- - var_authselect_profile=sssd
|
||||
+ - var_authselect_profile=minimal
|
||||
- enable_authselect
|
||||
- var_password_pam_unix_remember=5
|
||||
- accounts_password_pam_unix_remember
|
||||
|
||||
From 9d6014242b3fcda06b38ac35d73d5d4df75313a3 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 13:55:05 +0200
|
||||
Subject: [PATCH 4/4] update profile stability test
|
||||
|
||||
---
|
||||
tests/data/profile_stability/rhel8/ospp.profile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
|
||||
index 5d73a8c6fef..21e93e310d5 100644
|
||||
--- a/tests/data/profile_stability/rhel8/ospp.profile
|
||||
+++ b/tests/data/profile_stability/rhel8/ospp.profile
|
||||
@@ -242,7 +242,7 @@ selections:
|
||||
- var_slub_debug_options=P
|
||||
- var_auditd_flush=incremental_async
|
||||
- var_accounts_max_concurrent_login_sessions=10
|
||||
-- var_authselect_profile=sssd
|
||||
+- var_authselect_profile=minimal
|
||||
- var_password_pam_unix_remember=5
|
||||
- var_selinux_state=enforcing
|
||||
- var_selinux_policy_name=targeted
|
||||
@ -0,0 +1,302 @@
|
||||
From 694af59f0c400d34b11e80b29b66cdb82ad080b6 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 27 Jul 2022 13:49:05 +0200
|
||||
Subject: [PATCH 1/8] remove unneeded coredump related rules from rhel9 ospp
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 3 ---
|
||||
1 file changed, 3 deletions(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index dcc41970043..0902abf58db 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -110,10 +110,7 @@ selections:
|
||||
- package_gnutls-utils_installed
|
||||
|
||||
### Login
|
||||
- - disable_users_coredumps
|
||||
- sysctl_kernel_core_pattern
|
||||
- - coredump_disable_storage
|
||||
- - coredump_disable_backtraces
|
||||
- service_systemd-coredump_disabled
|
||||
- var_authselect_profile=minimal
|
||||
- enable_authselect
|
||||
|
||||
From da50ca7abc0358b6b5db72f26173843454461dcf Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 3 Aug 2022 12:17:27 +0200
|
||||
Subject: [PATCH 2/8] remove conditional from sysctl templated OVAL
|
||||
|
||||
actually now it is quite common that the sysctlval can be undefined. In this case, XCCDF variable is used. See documentation for sysctl template.
|
||||
I don't think there is a need to have this special regex. Moreover, the regex was checking only for numbers.
|
||||
---
|
||||
shared/templates/sysctl/oval.template | 5 -----
|
||||
1 file changed, 5 deletions(-)
|
||||
|
||||
diff --git a/shared/templates/sysctl/oval.template b/shared/templates/sysctl/oval.template
|
||||
index 1a7c4979bbe..e0c6f72f928 100644
|
||||
--- a/shared/templates/sysctl/oval.template
|
||||
+++ b/shared/templates/sysctl/oval.template
|
||||
@@ -17,13 +17,8 @@
|
||||
{{% endif %}}
|
||||
{{%- endmacro -%}}
|
||||
{{%- macro sysctl_match() -%}}
|
||||
-{{%- if SYSCTLVAL == "" -%}}
|
||||
- <ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
|
||||
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
-{{%- else -%}}
|
||||
<ind:pattern operation="pattern match">^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
-{{%- endif -%}}
|
||||
{{%- endmacro -%}}
|
||||
{{%- if "P" in FLAGS -%}}
|
||||
|
||||
|
||||
From 9b9110cd969afe7ba3796030a33dd795432a9373 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 3 Aug 2022 13:00:45 +0200
|
||||
Subject: [PATCH 3/8] add new rule sysctl_kernel_core_uses_pid
|
||||
|
||||
---
|
||||
.../sysctl_kernel_core_uses_pid/rule.yml | 36 +++++++++++++++++++
|
||||
2 files changed, 36 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..7fa36fb940e
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
@@ -0,0 +1,36 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9
|
||||
+
|
||||
+title: 'Configure file name of core dumps'
|
||||
+
|
||||
+description: '{{{ describe_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}}'
|
||||
+
|
||||
+rationale: |-
|
||||
+ The default coredump filename is <pre>core</pre>. By setting
|
||||
+ <pre>core_uses_pid</pre> to <pre>1</pre>, the coredump filename becomes
|
||||
+ <pre>core.PID</pre>. If <pre>core_pattern</pre> does not include
|
||||
+ <pre>%p</pre> (default does not) and <pre>core_uses_pid</pre> is set, then
|
||||
+ <pre>.PID</pre> will be appended to the filename.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-86003-1
|
||||
+
|
||||
+references:
|
||||
+ ospp: FMT_SMF_EXT.1
|
||||
+
|
||||
+ocil_clause: 'the returned line does not have a value of 0, or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement'
|
||||
+
|
||||
+ocil: |-
|
||||
+ {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value=0) }}}
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: sysctl
|
||||
+ vars:
|
||||
+ sysctlvar: kernel.core_uses_pid
|
||||
+ datatype: int
|
||||
+ sysctlval: '0'
|
||||
|
||||
From 04dbd2db9469082a450e9b062d91e47190abe552 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 09:08:37 +0200
|
||||
Subject: [PATCH 4/8] add new rule setting kernel.core_pattern to empty string
|
||||
|
||||
---
|
||||
.../rule.yml | 49 +++++++++++++++++++
|
||||
2 files changed, 49 insertions(+), 1 deletion(-)
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
new file mode 100644
|
||||
index 00000000000..089bb1481aa
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
@@ -0,0 +1,49 @@
|
||||
+documentation_complete: true
|
||||
+
|
||||
+prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9
|
||||
+
|
||||
+title: 'Disable storing core dumps'
|
||||
+
|
||||
+description: |-
|
||||
+ The <tt>kernel.core_pattern</tt> option specifies the core dumpfile pattern
|
||||
+ name. It can be set to an empty string <tt>''</tt>. In this case, the kernel
|
||||
+ behaves differently based on another related option. If
|
||||
+ <tt>kernel.core_uses_pid</tt> is set to <tt>1</tt>, then a file named as
|
||||
+ <tt>.PID</tt> (where <tt>PID</tt> is process ID of the crashed process) is
|
||||
+ created in the working directory. If <tt>kernel.core_uses_pid</tt> is set to
|
||||
+ <tt>0</tt>, no coredump is saved.
|
||||
+ {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}'
|
||||
+
|
||||
+rationale: |-
|
||||
+ A core dump includes a memory image taken at the time the operating system
|
||||
+ terminates an application. The memory image could contain sensitive data and is generally useful
|
||||
+ only for developers trying to debug problems.
|
||||
+
|
||||
+severity: medium
|
||||
+
|
||||
+requires:
|
||||
+ - sysctl_kernel_core_uses_pid
|
||||
+
|
||||
+conflicts:
|
||||
+ - sysctl_kernel_core_pattern
|
||||
+
|
||||
+identifiers:
|
||||
+ cce@rhel9: CCE-86005-6
|
||||
+
|
||||
+references:
|
||||
+ ospp: FMT_SMF_EXT.1
|
||||
+
|
||||
+ocil_clause: |-
|
||||
+ the returned line does not have a value of ''.
|
||||
+
|
||||
+ocil: |
|
||||
+ {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}
|
||||
+
|
||||
+platform: machine
|
||||
+
|
||||
+template:
|
||||
+ name: sysctl
|
||||
+ vars:
|
||||
+ sysctlvar: kernel.core_pattern
|
||||
+ sysctlval: "''"
|
||||
+ datatype: string
|
||||
|
||||
From 42690d39487d5483693fc4ce32c0c95d11ee3203 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 10:40:47 +0200
|
||||
Subject: [PATCH 5/8] add rule to RHEL9 OSPP profile
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 0902abf58db..b1b18261d48 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -110,7 +110,8 @@ selections:
|
||||
- package_gnutls-utils_installed
|
||||
|
||||
### Login
|
||||
- - sysctl_kernel_core_pattern
|
||||
+ - sysctl_kernel_core_pattern_empty_string
|
||||
+ - sysctl_kernel_core_uses_pid
|
||||
- service_systemd-coredump_disabled
|
||||
- var_authselect_profile=minimal
|
||||
- enable_authselect
|
||||
|
||||
From d7e194f1998757d3b5a7691c598a71549215f97b Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 3 Aug 2022 13:01:12 +0200
|
||||
Subject: [PATCH 6/8] describe beneficial dependency between
|
||||
sysctl_kernel_core_pattern_empty_string and sysctl:kernel_core_uses_pid
|
||||
|
||||
---
|
||||
.../sysctl_kernel_core_uses_pid/rule.yml | 13 ++++++++-----
|
||||
1 file changed, 8 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
index 7fa36fb940e..d6d2c468c10 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
@@ -7,11 +7,14 @@ title: 'Configure file name of core dumps'
|
||||
description: '{{{ describe_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}}'
|
||||
|
||||
rationale: |-
|
||||
- The default coredump filename is <pre>core</pre>. By setting
|
||||
- <pre>core_uses_pid</pre> to <pre>1</pre>, the coredump filename becomes
|
||||
- <pre>core.PID</pre>. If <pre>core_pattern</pre> does not include
|
||||
- <pre>%p</pre> (default does not) and <pre>core_uses_pid</pre> is set, then
|
||||
- <pre>.PID</pre> will be appended to the filename.
|
||||
+ The default coredump filename is <tt>core</tt>. By setting
|
||||
+ <tt>core_uses_pid</tt> to <tt>1</tt>, the coredump filename becomes
|
||||
+ <tt>core.PID</tt>. If <tt>core_pattern</tt> does not include
|
||||
+ <tt>%p</tt> (default does not) and <tt>core_uses_pid</tt> is set, then
|
||||
+ <tt>.PID</tt> will be appended to the filename.
|
||||
+ When combined with <tt>kernel.core_pattern = ""</tt> configuration, it
|
||||
+ is ensured that no core dumps are generated and also no confusing error
|
||||
+ messages are printed by a shell.
|
||||
|
||||
severity: medium
|
||||
|
||||
|
||||
From cd0f5491d57bf42e5901c681e290a9378eade3e6 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Fri, 5 Aug 2022 10:53:37 +0200
|
||||
Subject: [PATCH 7/8] make sysctl_kernel_core_pattern conflicting with
|
||||
sysctl_kernel_core_pattern_empty_string
|
||||
|
||||
they are modifying the same configuration
|
||||
---
|
||||
.../restrictions/sysctl_kernel_core_pattern/rule.yml | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
index 771c4d40e0f..c27a9e7ecf3 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
@@ -13,6 +13,9 @@ rationale: |-
|
||||
|
||||
severity: medium
|
||||
|
||||
+conflicts:
|
||||
+ - sysctl_kernel_core_pattern_empty_string
|
||||
+
|
||||
identifiers:
|
||||
cce@rhcos4: CCE-82527-3
|
||||
cce@rhel8: CCE-82215-5
|
||||
|
||||
From 62b0e48e7db9ed7e82940d7ca3a34a121f67c6cf Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Tue, 9 Aug 2022 16:43:20 +0200
|
||||
Subject: [PATCH 8/8] fix ocils
|
||||
|
||||
---
|
||||
.../restrictions/sysctl_kernel_core_pattern/rule.yml | 5 ++++-
|
||||
.../restrictions/sysctl_kernel_core_uses_pid/rule.yml | 4 ++--
|
||||
2 files changed, 6 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
index c27a9e7ecf3..1a540ce20b3 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
@@ -29,7 +29,10 @@ references:
|
||||
stigid@ol8: OL08-00-010671
|
||||
stigid@rhel8: RHEL-08-010671
|
||||
|
||||
-ocil_clause: 'the returned line does not have a value of "|/bin/false", or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement'
|
||||
+ocil_clause: |-
|
||||
+ the returned line does not have a value of "|/bin/false", or a line is not
|
||||
+ returned and the need for core dumps is not documented with the Information
|
||||
+ System Security Officer (ISSO) as an operational requirement
|
||||
|
||||
ocil: |
|
||||
{{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="|/bin/false") }}}
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
index d6d2c468c10..8f51f97c16c 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml
|
||||
@@ -24,10 +24,10 @@ identifiers:
|
||||
references:
|
||||
ospp: FMT_SMF_EXT.1
|
||||
|
||||
-ocil_clause: 'the returned line does not have a value of 0, or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement'
|
||||
+ocil_clause: 'the returned line does not have a value of 0'
|
||||
|
||||
ocil: |-
|
||||
- {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value=0) }}}
|
||||
+ {{{ ocil_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}}
|
||||
|
||||
platform: machine
|
||||
|
||||
@ -0,0 +1,826 @@
|
||||
From 796d3630621847b478896ee4a773cdb605821882 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 18 Aug 2022 13:06:49 +0200
|
||||
Subject: [PATCH 1/8] Create custom sysctl_kernel_core_pattern_empty_string
|
||||
content.
|
||||
|
||||
---
|
||||
.../ansible/shared.yml | 32 +++
|
||||
.../bash/shared.sh | 60 +++++
|
||||
.../oval/shared.xml | 221 ++++++++++++++++++
|
||||
.../rule.yml | 23 +-
|
||||
.../tests/correct_value.pass.sh | 10 +
|
||||
.../tests/wrong_value.fail.sh | 10 +
|
||||
.../tests/wrong_value_three_entries.fail.sh | 11 +
|
||||
.../tests/wrong_value_two_entries.fail.sh | 10 +
|
||||
products/rhel9/profiles/ospp.profile | 2 +-
|
||||
9 files changed, 366 insertions(+), 13 deletions(-)
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
new file mode 100644
|
||||
index 00000000000..a6e7bf54b56
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
@@ -0,0 +1,32 @@
|
||||
+# platform = multi_platform_all
|
||||
+# reboot = true
|
||||
+# strategy = disable
|
||||
+# complexity = low
|
||||
+# disruption = medium
|
||||
+- name: List /etc/sysctl.d/*.conf files
|
||||
+ find:
|
||||
+ paths:
|
||||
+ - /etc/sysctl.d/
|
||||
+ - /run/sysctl.d/
|
||||
+ contains: ^[\s]*kernel.core_pattern.*$
|
||||
+ patterns: '*.conf'
|
||||
+ file_type: any
|
||||
+ register: find_sysctl_d
|
||||
+- name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf
|
||||
+ files
|
||||
+ replace:
|
||||
+ path: '{{ item.path }}'
|
||||
+ regexp: ^[\s]*kernel.core_pattern
|
||||
+ replace: '#kernel.core_pattern'
|
||||
+ loop: '{{ find_sysctl_d.files }}'
|
||||
+- name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files
|
||||
+ replace:
|
||||
+ path: /etc/sysctl.conf
|
||||
+ regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+
|
||||
+ replace: '#kernel.core_pattern'
|
||||
+- name: Ensure sysctl kernel.core_pattern is set to empty
|
||||
+ sysctl:
|
||||
+ name: kernel.core_pattern
|
||||
+ value: ' ' # ansible sysctl module doesn't allow empty string, a space string is allowed and has the same semantics as sysctl will ignore spaces
|
||||
+ state: present
|
||||
+ reload: true
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 00000000000..989987250bc
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
@@ -0,0 +1,60 @@
|
||||
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
|
||||
+# reboot = true
|
||||
+# strategy = disable
|
||||
+# complexity = low
|
||||
+# disruption = medium
|
||||
+# Remediation is applicable only in certain platforms
|
||||
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
|
||||
+
|
||||
+# Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files
|
||||
+
|
||||
+for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
|
||||
+
|
||||
+ matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_pattern.*$' $f | uniq )
|
||||
+ if ! test -z "$matching_list"; then
|
||||
+ while IFS= read -r entry; do
|
||||
+ escaped_entry=$(sed -e 's|/|\\/|g' <<< "$entry")
|
||||
+ # comment out "kernel.core_pattern" matches to preserve user data
|
||||
+ sed -i "s/^${escaped_entry}$/# &/g" $f
|
||||
+ done <<< "$matching_list"
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+#
|
||||
+# Set runtime for kernel.core_pattern
|
||||
+#
|
||||
+/sbin/sysctl -q -n -w kernel.core_pattern=""
|
||||
+
|
||||
+#
|
||||
+# If kernel.core_pattern present in /etc/sysctl.conf, change value to empty
|
||||
+# else, add "kernel.core_pattern =" to /etc/sysctl.conf
|
||||
+#
|
||||
+# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
|
||||
+# Otherwise, regular sed command will do.
|
||||
+sed_command=('sed' '-i')
|
||||
+if test -L "/etc/sysctl.conf"; then
|
||||
+ sed_command+=('--follow-symlinks')
|
||||
+fi
|
||||
+
|
||||
+# Strip any search characters in the key arg so that the key can be replaced without
|
||||
+# adding any search characters to the config file.
|
||||
+stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^kernel.core_pattern")
|
||||
+
|
||||
+# shellcheck disable=SC2059
|
||||
+printf -v formatted_output "%s=" "$stripped_key"
|
||||
+
|
||||
+# If the key exists, change it. Otherwise, add it to the config_file.
|
||||
+# We search for the key string followed by a word boundary (matched by \>),
|
||||
+# so if we search for 'setting', 'setting2' won't match.
|
||||
+if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_pattern\\>" "/etc/sysctl.conf"; then
|
||||
+ escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
|
||||
+ "${sed_command[@]}" "s/^kernel.core_pattern\\>.*/$escaped_formatted_output/gi" "/etc/sysctl.conf"
|
||||
+else
|
||||
+ # \n is precaution for case where file ends without trailing newline
|
||||
+
|
||||
+ printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
|
||||
+fi
|
||||
+
|
||||
+else
|
||||
+ >&2 echo 'Remediation is not applicable, nothing was done'
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
new file mode 100644
|
||||
index 00000000000..39654259dcb
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
@@ -0,0 +1,221 @@
|
||||
+
|
||||
+
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="sysctl_kernel_core_pattern_empty_string" version="3">
|
||||
+ {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to the appropriate value in both system configuration and system runtime.") }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <extend_definition comment="kernel.core_pattern configuration setting check"
|
||||
+ definition_ref="sysctl_kernel_core_pattern_empty_string_static"/>
|
||||
+ <extend_definition comment="kernel.core_pattern runtime setting check"
|
||||
+ definition_ref="sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+</def-group><def-group>
|
||||
+ <definition class="compliance" id="sysctl_kernel_core_pattern_empty_string_runtime" version="3">
|
||||
+ {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system runtime.") }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion comment="kernel runtime parameter kernel.core_pattern set to an empty string"
|
||||
+ test_ref="test_sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
+ <unix:sysctl_test id="test_sysctl_kernel_core_pattern_empty_string_runtime" version="1"
|
||||
+ comment="kernel runtime parameter kernel.core_pattern set to an empty string"
|
||||
+ check="all" check_existence="all_exist" state_operator="OR">
|
||||
+ <unix:object object_ref="object_sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
+
|
||||
+ <unix:state state_ref="state_sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
+
|
||||
+ </unix:sysctl_test>
|
||||
+
|
||||
+ <unix:sysctl_object id="object_sysctl_kernel_core_pattern_empty_string_runtime" version="1">
|
||||
+ <unix:name>kernel.core_pattern</unix:name>
|
||||
+ </unix:sysctl_object>
|
||||
+
|
||||
+
|
||||
+ <unix:sysctl_state id="state_sysctl_kernel_core_pattern_empty_string_runtime" version="1">
|
||||
+
|
||||
+ <unix:value datatype="string"
|
||||
+ operation="equals"></unix:value>
|
||||
+
|
||||
+ </unix:sysctl_state>
|
||||
+
|
||||
+</def-group>
|
||||
+<def-group>
|
||||
+ <definition class="compliance" id="sysctl_kernel_core_pattern_empty_string_static" version="3">
|
||||
+ {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system configuration.") }}}
|
||||
+ <criteria operator="AND">
|
||||
+ <criteria operator="OR">
|
||||
+ <criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /etc/sysctl.conf"
|
||||
+ test_ref="test_sysctl_kernel_core_pattern_empty_string_static"/>
|
||||
+ <!-- see sysctl.d(5) -->
|
||||
+ <criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /etc/sysctl.d/*.conf"
|
||||
+ test_ref="test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld"/>
|
||||
+ <criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /run/sysctl.d/*.conf"
|
||||
+ test_ref="test_sysctl_kernel_core_pattern_empty_string_static_run_sysctld"/>
|
||||
+
|
||||
+ </criteria>
|
||||
+
|
||||
+ <criterion comment="Check that kernel_core_pattern is defined in only one file" test_ref="test_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" />
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+ <ind:textfilecontent54_test id="test_sysctl_kernel_core_pattern_empty_string_static" version="1"
|
||||
+ check="all" check_existence="all_exist"
|
||||
+ comment="kernel.core_pattern static configuration" state_operator="OR">
|
||||
+ <ind:object object_ref="object_static_sysctl_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+ <ind:state state_ref="state_static_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_test id="test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld" version="1" check="all"
|
||||
+ comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf" state_operator="OR">
|
||||
+ <ind:object object_ref="object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+ <ind:state state_ref="state_static_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+
|
||||
+ </ind:textfilecontent54_test>
|
||||
+
|
||||
+ <ind:textfilecontent54_test id="test_sysctl_kernel_core_pattern_empty_string_static_run_sysctld" version="1" check="all"
|
||||
+ comment="kernel.core_pattern static configuration in /run/sysctl.d/*.conf" state_operator="OR">
|
||||
+ <ind:object object_ref="object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+ <ind:state state_ref="state_static_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
+
|
||||
+ </ind:textfilecontent54_test>
|
||||
+ <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_core_pattern"
|
||||
+ id="test_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" version="1">
|
||||
+ <ind:object object_ref="object_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" />
|
||||
+ <ind:state state_ref="state_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" />
|
||||
+ </ind:variable_test>
|
||||
+
|
||||
+ <ind:variable_object id="object_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" version="1">
|
||||
+ <ind:var_ref>local_var_sysctl_kernel_core_pattern_empty_string_counter</ind:var_ref>
|
||||
+ </ind:variable_object>
|
||||
+
|
||||
+ <ind:variable_state id="state_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" version="1">
|
||||
+ <ind:value operation="equals" datatype="int">1</ind:value>
|
||||
+ </ind:variable_state>
|
||||
+
|
||||
+ <local_variable comment="Count unique sysctls" datatype="int" id="local_var_sysctl_kernel_core_pattern_empty_string_counter" version="1">
|
||||
+ <count>
|
||||
+ <unique>
|
||||
+ <object_component object_ref="object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls" item_field="filepath" />
|
||||
+ </unique>
|
||||
+ </count>
|
||||
+ </local_variable>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls" version="1">
|
||||
+ <set>
|
||||
+ <object_reference>object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered</object_reference>
|
||||
+ <filter action="exclude">state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink</filter>
|
||||
+ </set>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_state id="state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink" version="1">
|
||||
+ <ind:filepath operation="equals" var_check="at least one" var_ref="local_var_sysctl_kernel_core_pattern_empty_string_safe_symlinks" datatype="string" />
|
||||
+ </ind:textfilecontent54_state>
|
||||
+
|
||||
+ <!-- <no symlink handling> -->
|
||||
+ <!-- We craft a variable with blank string to combine with the symlink paths found.
|
||||
+ This ultimately avoids referencing a variable with "no values",
|
||||
+ we reference a variable with a blank string -->
|
||||
+ <local_variable comment="Unique list of symlink conf files" datatype="string" id="local_var_sysctl_kernel_core_pattern_empty_string_safe_symlinks" version="1">
|
||||
+ <unique>
|
||||
+ <object_component object_ref="var_object_symlink_sysctl_kernel_core_pattern_empty_string" item_field="value" />
|
||||
+ </unique>
|
||||
+ </local_variable>
|
||||
+
|
||||
+ <ind:variable_object id="var_object_symlink_sysctl_kernel_core_pattern_empty_string" comment="combine the blank string with symlink paths found" version="1">
|
||||
+ <set>
|
||||
+ <object_reference>var_obj_symlink_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ <object_reference>var_obj_blank_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ </set>
|
||||
+ </ind:variable_object>
|
||||
+
|
||||
+ <ind:variable_object id="var_obj_blank_sysctl_kernel_core_pattern_empty_string" comment="variable object of the blank string" version="1">
|
||||
+ <ind:var_ref>local_var_blank_path_sysctl_kernel_core_pattern_empty_string</ind:var_ref>
|
||||
+ </ind:variable_object>
|
||||
+
|
||||
+ <local_variable comment="Blank string" datatype="string" id="local_var_blank_path_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <literal_component datatype="string"></literal_component>
|
||||
+ </local_variable>
|
||||
+
|
||||
+ <ind:variable_object id="var_obj_symlink_sysctl_kernel_core_pattern_empty_string" comment="variable object of the symlinks found" version="1">
|
||||
+ <ind:var_ref>local_var_symlinks_sysctl_kernel_core_pattern_empty_string</ind:var_ref>
|
||||
+ </ind:variable_object>
|
||||
+ <!-- </no symlink handling> -->
|
||||
+
|
||||
+ <local_variable comment="Unique list of symlink conf files" datatype="string" id="local_var_symlinks_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <unique>
|
||||
+ <object_component object_ref="object_sysctl_kernel_core_pattern_empty_string_symlinks" item_field="filepath" />
|
||||
+ </unique>
|
||||
+ </local_variable>
|
||||
+
|
||||
+ <!-- "pattern match" doesn't seem to work with symlink_object, not sure if a bug or not.
|
||||
+ Workaround by querying for all conf files found -->
|
||||
+ <unix:symlink_object comment="Symlinks referencing files in default dirs" id="object_sysctl_kernel_core_pattern_empty_string_symlinks" version="1">
|
||||
+ <unix:filepath operation="equals" var_ref="local_var_conf_files_sysctl_kernel_core_pattern_empty_string" />
|
||||
+ <filter action="exclude">state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string</filter>
|
||||
+ </unix:symlink_object>
|
||||
+
|
||||
+ <!-- The state matches symlinks that don't point to the default dirs, i.e. paths that are not:
|
||||
+ ^/etc/sysctl.conf$
|
||||
+ ^/etc/sysctl.d/.*$
|
||||
+ ^/run/sysctl.d/.*$
|
||||
+ ^/usr/lib/sysctl.d/.*$ -->
|
||||
+ <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
|
||||
+ </unix:symlink_state>
|
||||
+
|
||||
+
|
||||
+ <local_variable comment="List of conf files" datatype="string" id="local_var_conf_files_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <object_component object_ref="object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered" item_field="filepath" />
|
||||
+ </local_variable>
|
||||
+
|
||||
+ <!-- Avoid directly referencing a possibly empty collection, one empty collection will cause the
|
||||
+ variable to have no value even when there are valid objects. -->
|
||||
+ <ind:textfilecontent54_object id="object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered" version="1">
|
||||
+ <set>
|
||||
+ <object_reference>object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ <object_reference>object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ </set>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <set>
|
||||
+ <object_reference>object_static_sysctl_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ <object_reference>object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+ </set>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <set>
|
||||
+ <object_reference>object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
+
|
||||
+ </set>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_static_sysctl_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
|
||||
+ <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <ind:path>/etc/sysctl.d</ind:path>
|
||||
+ <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
|
||||
+ <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+
|
||||
+ <ind:textfilecontent54_object id="object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+ <ind:path>/run/sysctl.d</ind:path>
|
||||
+ <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
|
||||
+ <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
|
||||
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
+ </ind:textfilecontent54_object>
|
||||
+ <ind:textfilecontent54_state id="state_static_sysctld_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
+
|
||||
+ <ind:subexpression operation="equals" datatype="string"></ind:subexpression>
|
||||
+
|
||||
+ </ind:textfilecontent54_state>
|
||||
+
|
||||
+</def-group>
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
index dc21f53c98c..2babb28e361 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
@@ -1,18 +1,18 @@
|
||||
documentation_complete: true
|
||||
|
||||
-prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9
|
||||
+prodtype: rhel9
|
||||
|
||||
title: 'Disable storing core dumps'
|
||||
|
||||
description: |-
|
||||
The <tt>kernel.core_pattern</tt> option specifies the core dumpfile pattern
|
||||
- name. It can be set to an empty string <tt>''</tt>. In this case, the kernel
|
||||
+ name. It can be set to an empty string. In this case, the kernel
|
||||
behaves differently based on another related option. If
|
||||
<tt>kernel.core_uses_pid</tt> is set to <tt>1</tt>, then a file named as
|
||||
<tt>.PID</tt> (where <tt>PID</tt> is process ID of the crashed process) is
|
||||
created in the working directory. If <tt>kernel.core_uses_pid</tt> is set to
|
||||
<tt>0</tt>, no coredump is saved.
|
||||
- {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}'
|
||||
+ {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="") }}}
|
||||
|
||||
rationale: |-
|
||||
A core dump includes a memory image taken at the time the operating system
|
||||
@@ -30,17 +30,16 @@ conflicts:
|
||||
identifiers:
|
||||
cce@rhel9: CCE-86005-6
|
||||
|
||||
+references:
|
||||
+ ospp: FMT_SMF_EXT.1
|
||||
+
|
||||
ocil_clause: |-
|
||||
- the returned line does not have a value of ''.
|
||||
+ the returned line does not have an empty string
|
||||
|
||||
ocil: |
|
||||
- {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}
|
||||
+ The runtime status of the <code>kernel.core_pattern</code> kernel parameter can be queried
|
||||
+ by running the following command:
|
||||
+ <pre>$ sysctl kernel.core_pattern | cat -A</pre>
|
||||
+ <code>kernel.core_pattern = $</code>
|
||||
|
||||
platform: machine
|
||||
-
|
||||
-template:
|
||||
- name: sysctl
|
||||
- vars:
|
||||
- sysctlvar: kernel.core_pattern
|
||||
- sysctlval: "''"
|
||||
- datatype: string
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..71f0f5db142
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=" >> /etc/sysctl.conf
|
||||
+
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern=""
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..1c5fabcc136
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf
|
||||
+
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern="|/bin/false"
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..e56e927ec56
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=" >> /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern=""
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6c065b1e038
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=" >> /etc/sysctl.conf
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern=""
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index 9fdd1354e38..b1b18261d48 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -110,7 +110,7 @@ selections:
|
||||
- package_gnutls-utils_installed
|
||||
|
||||
### Login
|
||||
- - sysctl_kernel_core_pattern
|
||||
+ - sysctl_kernel_core_pattern_empty_string
|
||||
- sysctl_kernel_core_uses_pid
|
||||
- service_systemd-coredump_disabled
|
||||
- var_authselect_profile=minimal
|
||||
|
||||
From a77abaf442d411fe7bc59e94a1c0330163e03a16 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 11:13:04 +0200
|
||||
Subject: [PATCH 2/8] Make the conflicts attribute appblicable only to RHEL9.
|
||||
|
||||
The new rule empty is applicable only to RHEL9 and if there would not be
|
||||
the restriction, then dangling references would be produced.
|
||||
---
|
||||
.../restrictions/sysctl_kernel_core_pattern/rule.yml | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
index 1a540ce20b3..e369854060b 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml
|
||||
@@ -13,8 +13,10 @@ rationale: |-
|
||||
|
||||
severity: medium
|
||||
|
||||
+{{% if product in ["rhel9"] %}}
|
||||
conflicts:
|
||||
- sysctl_kernel_core_pattern_empty_string
|
||||
+{{% endif %}}
|
||||
|
||||
identifiers:
|
||||
cce@rhcos4: CCE-82527-3
|
||||
|
||||
From ec71ac98b89cc8295324c90b1610a5ff01126895 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 11:16:41 +0200
|
||||
Subject: [PATCH 3/8] Switch bash remediation applicable to all products in
|
||||
sysctl_kernel_core_pattern_empty_string.
|
||||
|
||||
---
|
||||
.../sysctl_kernel_core_pattern_empty_string/bash/shared.sh | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
index 989987250bc..9e84d41056d 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
|
||||
+# platform = multi_platform_all
|
||||
# reboot = true
|
||||
# strategy = disable
|
||||
# complexity = low
|
||||
|
||||
From bac544446d3c5a1d87a2b4934cbb94ebc00d2ce9 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 11:23:04 +0200
|
||||
Subject: [PATCH 4/8] Address feedback.
|
||||
|
||||
---
|
||||
.../ansible/shared.yml | 3 +++
|
||||
.../oval/shared.xml | 19 +++++--------------
|
||||
2 files changed, 8 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
index a6e7bf54b56..22a8d99dae8 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
@@ -12,6 +12,7 @@
|
||||
patterns: '*.conf'
|
||||
file_type: any
|
||||
register: find_sysctl_d
|
||||
+
|
||||
- name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf
|
||||
files
|
||||
replace:
|
||||
@@ -19,11 +20,13 @@
|
||||
regexp: ^[\s]*kernel.core_pattern
|
||||
replace: '#kernel.core_pattern'
|
||||
loop: '{{ find_sysctl_d.files }}'
|
||||
+
|
||||
- name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files
|
||||
replace:
|
||||
path: /etc/sysctl.conf
|
||||
regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+
|
||||
replace: '#kernel.core_pattern'
|
||||
+
|
||||
- name: Ensure sysctl kernel.core_pattern is set to empty
|
||||
sysctl:
|
||||
name: kernel.core_pattern
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
index 39654259dcb..1c3bbfd9a3e 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml
|
||||
@@ -10,7 +10,9 @@
|
||||
definition_ref="sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
</criteria>
|
||||
</definition>
|
||||
-</def-group><def-group>
|
||||
+</def-group>
|
||||
+
|
||||
+<def-group>
|
||||
<definition class="compliance" id="sysctl_kernel_core_pattern_empty_string_runtime" version="3">
|
||||
{{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system runtime.") }}}
|
||||
<criteria operator="AND">
|
||||
@@ -23,21 +25,15 @@
|
||||
comment="kernel runtime parameter kernel.core_pattern set to an empty string"
|
||||
check="all" check_existence="all_exist" state_operator="OR">
|
||||
<unix:object object_ref="object_sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
-
|
||||
<unix:state state_ref="state_sysctl_kernel_core_pattern_empty_string_runtime"/>
|
||||
-
|
||||
</unix:sysctl_test>
|
||||
|
||||
<unix:sysctl_object id="object_sysctl_kernel_core_pattern_empty_string_runtime" version="1">
|
||||
<unix:name>kernel.core_pattern</unix:name>
|
||||
</unix:sysctl_object>
|
||||
|
||||
-
|
||||
<unix:sysctl_state id="state_sysctl_kernel_core_pattern_empty_string_runtime" version="1">
|
||||
-
|
||||
- <unix:value datatype="string"
|
||||
- operation="equals"></unix:value>
|
||||
-
|
||||
+ <unix:value datatype="string" operation="equals"></unix:value>
|
||||
</unix:sysctl_state>
|
||||
|
||||
</def-group>
|
||||
@@ -53,18 +49,17 @@
|
||||
test_ref="test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld"/>
|
||||
<criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /run/sysctl.d/*.conf"
|
||||
test_ref="test_sysctl_kernel_core_pattern_empty_string_static_run_sysctld"/>
|
||||
-
|
||||
</criteria>
|
||||
|
||||
<criterion comment="Check that kernel_core_pattern is defined in only one file" test_ref="test_sysctl_kernel_core_pattern_empty_string_defined_in_one_file" />
|
||||
</criteria>
|
||||
</definition>
|
||||
+
|
||||
<ind:textfilecontent54_test id="test_sysctl_kernel_core_pattern_empty_string_static" version="1"
|
||||
check="all" check_existence="all_exist"
|
||||
comment="kernel.core_pattern static configuration" state_operator="OR">
|
||||
<ind:object object_ref="object_static_sysctl_sysctl_kernel_core_pattern_empty_string"/>
|
||||
<ind:state state_ref="state_static_sysctld_sysctl_kernel_core_pattern_empty_string"/>
|
||||
-
|
||||
</ind:textfilecontent54_test>
|
||||
|
||||
<ind:textfilecontent54_test id="test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld" version="1" check="all"
|
||||
@@ -165,7 +160,6 @@
|
||||
<unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
|
||||
</unix:symlink_state>
|
||||
|
||||
-
|
||||
<local_variable comment="List of conf files" datatype="string" id="local_var_conf_files_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
<object_component object_ref="object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered" item_field="filepath" />
|
||||
</local_variable>
|
||||
@@ -189,7 +183,6 @@
|
||||
<ind:textfilecontent54_object id="object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
<set>
|
||||
<object_reference>object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string</object_reference>
|
||||
-
|
||||
</set>
|
||||
</ind:textfilecontent54_object>
|
||||
|
||||
@@ -213,9 +206,7 @@
|
||||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
||||
</ind:textfilecontent54_object>
|
||||
<ind:textfilecontent54_state id="state_static_sysctld_sysctl_kernel_core_pattern_empty_string" version="1">
|
||||
-
|
||||
<ind:subexpression operation="equals" datatype="string"></ind:subexpression>
|
||||
-
|
||||
</ind:textfilecontent54_state>
|
||||
|
||||
</def-group>
|
||||
|
||||
From 39bb8e75c95c469a4f6428664f24f7f9688ffa87 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 14:46:15 +0200
|
||||
Subject: [PATCH 5/8] Fix test parse affected to support OVAL with multiple
|
||||
def-group tags.
|
||||
|
||||
---
|
||||
tests/test_parse_affected.py | 26 ++++++++++++++++----------
|
||||
1 file changed, 16 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/tests/test_parse_affected.py b/tests/test_parse_affected.py
|
||||
index 8407794b972..947b56636c0 100755
|
||||
--- a/tests/test_parse_affected.py
|
||||
+++ b/tests/test_parse_affected.py
|
||||
@@ -3,6 +3,7 @@
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
+import re
|
||||
import sys
|
||||
|
||||
import ssg.constants
|
||||
@@ -73,19 +74,24 @@ def parse_affected(cur_dir, env_yaml):
|
||||
if not xml_content:
|
||||
continue
|
||||
|
||||
- oval_contents = ssg.utils.split_string_content(xml_content)
|
||||
+ # split multiple def group into a list so multiple definitions in one OVAL also work
|
||||
+ # this findall does not preserv the <def-group> tag but it's not necessary for the
|
||||
+ # purpose of the test
|
||||
+ xml_content_list = re.findall(r'<def-group>(.+?)</def-group>', xml_content, re.DOTALL)
|
||||
+ for item in xml_content_list:
|
||||
+ oval_contents = ssg.utils.split_string_content(item)
|
||||
|
||||
- try:
|
||||
- results = ssg.oval.parse_affected(oval_contents)
|
||||
+ try:
|
||||
+ results = ssg.oval.parse_affected(oval_contents)
|
||||
|
||||
- assert len(results) == 3
|
||||
- assert isinstance(results[0], int)
|
||||
- assert isinstance(results[1], int)
|
||||
+ assert len(results) == 3
|
||||
+ assert isinstance(results[0], int)
|
||||
+ assert isinstance(results[1], int)
|
||||
|
||||
- except ValueError as e:
|
||||
- print("No <affected> element found in file {}. "
|
||||
- " Parsed XML was:\n{}".format(oval, xml_content))
|
||||
- raise e
|
||||
+ except ValueError as e:
|
||||
+ print("No <affected> element found in file {}. "
|
||||
+ " Parsed XML was:\n{}".format(oval, item))
|
||||
+ raise e
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
From 8d6176c1f96f983aaa0134d19cc66fd3c7b29e15 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 15:14:57 +0200
|
||||
Subject: [PATCH 6/8] Fix ansible remediation to preserve old non compliant
|
||||
values.
|
||||
|
||||
Comment out any offending line.
|
||||
---
|
||||
.../ansible/shared.yml | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
index 22a8d99dae8..f4dc5110fee 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml
|
||||
@@ -24,8 +24,8 @@
|
||||
- name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files
|
||||
replace:
|
||||
path: /etc/sysctl.conf
|
||||
- regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+
|
||||
- replace: '#kernel.core_pattern'
|
||||
+ regexp: '^[\s]*kernel.core_pattern([ \t]*=[ \t]*\S+)'
|
||||
+ replace: '#kernel.core_pattern\1'
|
||||
|
||||
- name: Ensure sysctl kernel.core_pattern is set to empty
|
||||
sysctl:
|
||||
|
||||
From c5bcea37000f54f3273d529237e02fe0979e6d6d Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 15:20:41 +0200
|
||||
Subject: [PATCH 7/8] Fix PEP8 issue.
|
||||
|
||||
---
|
||||
tests/test_parse_affected.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tests/test_parse_affected.py b/tests/test_parse_affected.py
|
||||
index 947b56636c0..53690df5ce1 100755
|
||||
--- a/tests/test_parse_affected.py
|
||||
+++ b/tests/test_parse_affected.py
|
||||
@@ -90,7 +90,7 @@ def parse_affected(cur_dir, env_yaml):
|
||||
|
||||
except ValueError as e:
|
||||
print("No <affected> element found in file {}. "
|
||||
- " Parsed XML was:\n{}".format(oval, item))
|
||||
+ " Parsed XML was:\n{}".format(oval, item))
|
||||
raise e
|
||||
|
||||
|
||||
|
||||
From 243347ad56fcd4f83f0b77e9b3b7fcd98d0d4acb Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Becker <ggasparb@redhat.com>
|
||||
Date: Thu, 25 Aug 2022 16:31:31 +0200
|
||||
Subject: [PATCH 8/8] Add more test scenarios for
|
||||
sysctl_kernel_core_pattern_empty_string.
|
||||
|
||||
---
|
||||
.../tests/correct_value_with_spaces.pass.sh | 10 ++++++++++
|
||||
.../tests/wrong_value_d_directory.fail.sh | 9 +++++++++
|
||||
.../tests/wrong_value_runtime.fail.sh | 10 ++++++++++
|
||||
3 files changed, 29 insertions(+)
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh
|
||||
create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh
|
||||
new file mode 100644
|
||||
index 00000000000..b6688e6ca91
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern= " >> /etc/sysctl.conf
|
||||
+
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern=""
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..6c574b92762
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.d/98-sysctl.conf
|
||||
+
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern=""
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh
|
||||
new file mode 100644
|
||||
index 00000000000..8c729677b86
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Clean sysctl config directories
|
||||
+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
|
||||
+
|
||||
+sed -i "/kernel.core_pattern/d" /etc/sysctl.conf
|
||||
+echo "kernel.core_pattern=" >> /etc/sysctl.conf
|
||||
+
|
||||
+# set correct runtime value to check if the filesystem configuration is evaluated properly
|
||||
+sysctl -w kernel.core_pattern="|/bin/false"
|
||||
@ -0,0 +1,47 @@
|
||||
From 21124e8524967788d4c95d47dd41259a0c7f958c Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Wed, 20 Jul 2022 14:18:13 +0200
|
||||
Subject: [PATCH] change remediations to include the "=" sign
|
||||
|
||||
---
|
||||
.../crypto/configure_openssl_crypto_policy/ansible/shared.yml | 4 ++--
|
||||
.../crypto/configure_openssl_crypto_policy/bash/shared.sh | 4 ++--
|
||||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml
|
||||
index c335a9e7fa2..852ca18cf79 100644
|
||||
--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml
|
||||
+++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml
|
||||
@@ -20,7 +20,7 @@
|
||||
lineinfile:
|
||||
create: yes
|
||||
insertafter: '^\s*\[\s*crypto_policy\s*]\s*'
|
||||
- line: ".include /etc/crypto-policies/back-ends/opensslcnf.config"
|
||||
+ line: ".include = /etc/crypto-policies/back-ends/opensslcnf.config"
|
||||
path: {{{ openssl_cnf_path }}}
|
||||
when:
|
||||
- test_crypto_policy_group.stdout is defined
|
||||
@@ -29,7 +29,7 @@
|
||||
- name: "Add crypto_policy group and set include opensslcnf.config"
|
||||
lineinfile:
|
||||
create: yes
|
||||
- line: "[crypto_policy]\n.include /etc/crypto-policies/back-ends/opensslcnf.config"
|
||||
+ line: "[crypto_policy]\n.include = /etc/crypto-policies/back-ends/opensslcnf.config"
|
||||
path: {{{ openssl_cnf_path }}}
|
||||
when:
|
||||
- test_crypto_policy_group.stdout is defined
|
||||
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh
|
||||
index 21edb780a2f..79eb5cff189 100644
|
||||
--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh
|
||||
+++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh
|
||||
@@ -2,8 +2,8 @@
|
||||
|
||||
OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
|
||||
OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
|
||||
-OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
|
||||
-OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config$'
|
||||
+OPENSSL_CRYPTO_POLICY_INCLUSION='.include = /etc/crypto-policies/back-ends/opensslcnf.config'
|
||||
+OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
|
||||
|
||||
{{% if 'sle' in product %}}
|
||||
{{% set openssl_cnf_path="/etc/ssl/openssl.cnf" %}}
|
||||
@ -0,0 +1,29 @@
|
||||
From eef5cb155b9f820439ca32f993cebf1f68b29e80 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 28 Jul 2022 15:08:15 +0200
|
||||
Subject: [PATCH] Remove a confusing sentence
|
||||
|
||||
In the rule description, there are 2 conflicting sentences, they
|
||||
both start by "By default ...", but they negate each other.
|
||||
In fact, the second of them is true, so the first one could be
|
||||
removed.
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2092799
|
||||
---
|
||||
.../accounts-physical/require_singleuser_auth/rule.yml | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
|
||||
index 932d76c36d9..332712ea1dd 100644
|
||||
--- a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
|
||||
+++ b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
|
||||
@@ -8,8 +8,7 @@ title: 'Require Authentication for Single User Mode'
|
||||
description: |-
|
||||
Single-user mode is intended as a system recovery
|
||||
method, providing a single user root access to the system by
|
||||
- providing a boot option at startup. By default, no authentication
|
||||
- is performed if single-user mode is selected.
|
||||
+ providing a boot option at startup.
|
||||
<br /><br />
|
||||
By default, single-user mode is protected by requiring a password and is set
|
||||
in <tt>/usr/lib/systemd/system/rescue.service</tt>.
|
||||
@ -0,0 +1,48 @@
|
||||
From d76e93e697755e63d5c833747adef4af23c3256b Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 22 Aug 2022 13:51:28 +0200
|
||||
Subject: [PATCH 1/2] switch sysctl_kernel_core_pattern_empty_string for
|
||||
sysctl_kernel_core_pattern
|
||||
|
||||
---
|
||||
products/rhel9/profiles/ospp.profile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
||||
index b1b18261d48..9fdd1354e38 100644
|
||||
--- a/products/rhel9/profiles/ospp.profile
|
||||
+++ b/products/rhel9/profiles/ospp.profile
|
||||
@@ -110,7 +110,7 @@ selections:
|
||||
- package_gnutls-utils_installed
|
||||
|
||||
### Login
|
||||
- - sysctl_kernel_core_pattern_empty_string
|
||||
+ - sysctl_kernel_core_pattern
|
||||
- sysctl_kernel_core_uses_pid
|
||||
- service_systemd-coredump_disabled
|
||||
- var_authselect_profile=minimal
|
||||
|
||||
From d304b9f0037bfac6e20b1365e0d320f714ce09a3 Mon Sep 17 00:00:00 2001
|
||||
From: Vojtech Polasek <vpolasek@redhat.com>
|
||||
Date: Mon, 22 Aug 2022 13:51:55 +0200
|
||||
Subject: [PATCH 2/2] remove ospp reference from
|
||||
sysctl_kernel_core_pattern_empty_string
|
||||
|
||||
---
|
||||
.../sysctl_kernel_core_pattern_empty_string/rule.yml | 3 ---
|
||||
1 file changed, 3 deletions(-)
|
||||
|
||||
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
index 089bb1481aa..dc21f53c98c 100644
|
||||
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml
|
||||
@@ -30,9 +30,6 @@ conflicts:
|
||||
identifiers:
|
||||
cce@rhel9: CCE-86005-6
|
||||
|
||||
-references:
|
||||
- ospp: FMT_SMF_EXT.1
|
||||
-
|
||||
ocil_clause: |-
|
||||
the returned line does not have a value of ''.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -5,65 +5,23 @@
|
||||
%global _default_patch_fuzz 2
|
||||
|
||||
Name: scap-security-guide
|
||||
Version: 0.1.60
|
||||
Release: 6%{?dist}
|
||||
Version: 0.1.63
|
||||
Release: 2%{?dist}
|
||||
Summary: Security guidance and baselines in SCAP formats
|
||||
License: BSD-3-Clause
|
||||
URL: https://github.com/ComplianceAsCode/content/
|
||||
Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2
|
||||
BuildArch: noarch
|
||||
|
||||
# Patch allows only OSPP, PCI-DSS, E8 and STIG profiles in RHEL8 datastream
|
||||
Patch0: scap-security-guide-0.1.61-file_groupowner-PR_7791.patch
|
||||
Patch1: scap-security-guide-0.1.61-file_owner-PR_7789.patch
|
||||
Patch2: scap-security-guide-0.1.61-file_permissions-PR_7788.patch
|
||||
Patch3: scap-security-guide-0.1.61-update_RHEL_08_010287-PR_8051.patch
|
||||
Patch4: scap-security-guide-0.1.61-add_RHEL_08_010331-PR_8055.patch
|
||||
Patch5: scap-security-guide-0.1.61-rhel8_stig_v1r5-PR_8050.patch
|
||||
Patch6: scap-security-guide-0.1.61-RC_277_245-PR_8069.patch
|
||||
Patch7: scap-security-guide-0.1.61-RC_248_249-PR_8071.patch
|
||||
Patch8: scap-security-guide-0.1.61-RC_251-PR_8072.patch
|
||||
Patch9: scap-security-guide-0.1.61-RC_246_250-PR_8070.patch
|
||||
Patch10: scap-security-guide-0.1.61-RC_247-PR_8114.patch
|
||||
Patch11: scap-security-guide-0.1.61-RC_254-PR_8113.patch
|
||||
Patch12: scap-security-guide-0.1.61-RC_253-PR_8111.patch
|
||||
Patch13: scap-security-guide-0.1.61-RC_255-PR_8112.patch
|
||||
Patch14: scap-security-guide-0.1.61-add_RHEL_08_010359-PR_8131.patch
|
||||
Patch15: scap-security-guide-0.1.61-RC_244-PR_8133.patch
|
||||
Patch16: scap-security-guide-0.1.61-update_RHEL_STIG-PR_8130.patch
|
||||
Patch17: scap-security-guide-0.1.61-update_RHEL_08_STIG-PR_8139.patch
|
||||
Patch18: scap-security-guide-0.1.61-remove_RHEL_08_010560-PR_8145.patch
|
||||
Patch19: scap-security-guide-0.1.61-add_RHEL_08_040321-PR_8169.patch
|
||||
Patch20: scap-security-guide-0.1.61-add_RHEL_08_020221-PR_8173.patch
|
||||
Patch21: scap-security-guide-0.1.61-update_RHEL_08_040320-PR_8170.patch
|
||||
Patch22: scap-security-guide-0.1.61-rhel8_stig_audit_rules-PR_8174.patch
|
||||
Patch23: scap-security-guide-0.1.61-update_RHEL_08_010030-PR_8183.patch
|
||||
Patch24: scap-security-guide-0.1.61-selinux_state_rhel8_anssi_enhanced-PR_8182.patch
|
||||
Patch25: scap-security-guide-0.1.61-update_accounts_password_template-PR_8164.patch
|
||||
Patch26: scap-security-guide-0.1.61-update_RHEL_08_010383-PR_8138.patch
|
||||
Patch27: scap-security-guide-0.1.61-remove_client_alive_max-PR_8197.patch
|
||||
Patch28: scap-security-guide-0.1.61-pwquality-PR_8185.patch
|
||||
Patch29: scap-security-guide-0.1.61-update_RHEL_08_020041-PR_8146.patch
|
||||
Patch30: scap-security-guide-0.1.61-rhel86_ospp_fix_audit_ospp_general-PR_8152.patch
|
||||
Patch31: scap-security-guide-0.1.61-ospp-remove-kernel-disable-rules-PR_8093.patch
|
||||
Patch32: scap-security-guide-0.1.61-ospp-boot-parametersb-PR_8092.patch
|
||||
Patch33: scap-security-guide-0.1.61-ospp-audit.conf-rules-PR_8188.patch
|
||||
Patch34: scap-security-guide-0.1.61-distributed-sshd-rekeylimit-PR_8148.patch
|
||||
Patch35: scap-security-guide-0.1.61-supported-rhel9-PR_8202.patch
|
||||
Patch36: scap-security-guide-0.1.61-chrony_maxpoll-PR_8187.patch
|
||||
Patch37: scap-security-guide-0.1.61-add_missing_srgs-PR_8218.patch
|
||||
Patch38: scap-security-guide-0.1.61-sudoers_timestamp_timeout-PR_8220.patch
|
||||
Patch39: scap-security-guide-0.1.61-grub2_rule_desc_update-PR_8184.patch
|
||||
Patch40: scap-security-guide-0.1.61-grub2_template_fix-PR_8180.patch
|
||||
Patch41: scap-security-guide-0.1.61-rear_not_applicable_aarch64-PR_8221.patch
|
||||
Patch42: scap-security-guide-0.1.61-add_RHEL_08_0103789_include_sudoers-PR_8196.patch
|
||||
Patch43: scap-security-guide-0.1.61-fix-ansible-service-disabled-task-PR_8226.patch
|
||||
Patch44: scap-security-guide-0.1.61-update-ospp-description-PR_8232.patch
|
||||
Patch45: scap-security-guide-0.1.61-add-rule-page_alloc_shuffle_argument-PR_8234.patch
|
||||
Patch46: scap-security-guide-0.1.61-remove_tmux_process_running_check-PR_8246.patch
|
||||
Patch47: scap-security-guide-0.1.61-fix_bug_in_delta_tailering_script-PR_8245.patch
|
||||
Patch48: scap-security-guide-0.1.61-fix_enable_fips_mode-PR_8255.patch
|
||||
Patch49: scap-security-guide-0.1.61-update_rhel9_gpg_key-PR_8411.patch
|
||||
Patch0: scap-security-guide-0.1.64-audit_rules_for_ppc64le-PR_9124.patch
|
||||
Patch1: scap-security-guide-0.1.64-fix_openssl_cryptopolicy_remediation-PR_9194.patch
|
||||
Patch2: scap-security-guide-0.1.64-sysctl_template_extension_and_bpf_rules-PR_9147.patch
|
||||
Patch3: scap-security-guide-0.1.64-fix_require_single_user_description-PR_9256.patch
|
||||
Patch4: scap-security-guide-0.1.64-authselect_minimal_for_ospp-PR_9298.patch
|
||||
Patch5: scap-security-guide-0.1.64-coredump_rules_for_ospp-PR_9285.patch
|
||||
Patch6: scap-security-guide-0.1.64-add_back_rules-PR_9334.patch
|
||||
Patch7: scap-security-guide-0.1.64-put_back_kernel_core_pattern_bin_false-PR_9384.patch
|
||||
Patch8: scap-security-guide-0.1.64-fix_core_pattern_empty_string-PR_9396.patch
|
||||
|
||||
BuildRequires: libxslt
|
||||
BuildRequires: expat
|
||||
@ -150,6 +108,12 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Aug 31 2022 Vojtech Polasek <vpolasek@redhat.com> - 0.1.63-2
|
||||
- Fix problems with sysctl_kernel_core_pattern_empty_string rule (RHBZ#2117612)
|
||||
|
||||
* Thu Aug 11 2022 Vojtech Polasek <vpolasek@redhat.com> - 0.1.63-1
|
||||
- rebase to scap-security-guide 0.1.63 (RHBZ#2116350)
|
||||
|
||||
* Thu Mar 24 2022 Gabriel Becker <ggasparb@redhat.com> - 0.1.60-6
|
||||
- Update RHEL9 auxiliary GPG key references (RHBZ#2067109)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user