rpms/scap-security-guide
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import scap-security-guide-0.1.60-7.el8

Browse Source
This commit is contained in:
CentOS Sources 2022-03-29 13:34:21 -04:00 committed by Stepan Oksanichenko
parent 50c5787af3
commit f339ff864a
105 changed files with 22891 additions and 38847 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,2 +1,2 @@
SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
SOURCES/scap-security-guide-0.1.57.tar.bz2
SOURCES/scap-security-guide-0.1.60.tar.bz2

2
.scap-security-guide.metadata
View File

@ -1,2 +1,2 @@
b22b45d29ad5a97020516230a6ef3140a91d050a SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
d78bdc956df4301c3b3bbb2f9f24d809d7b1d08c SOURCES/scap-security-guide-0.1.57.tar.bz2
6768818c9bd6f9f35596f2fe23c50ffe52b974c3 SOURCES/scap-security-guide-0.1.60.tar.bz2

24
SOURCES/disable-not-in-good-shape-profiles.patch
View File

@ -1,23 +1,15 @@
diff --git a/rhel8/CMakeLists.txt b/rhel8/CMakeLists.txt
index d61689c97..5e444a101 100644
diff --git a/products/rhel8/CMakeLists.txt b/products/rhel8/CMakeLists.txt
index 5258591c7f..cc4b9c5720 100644
--- a/products/rhel8/CMakeLists.txt
+++ b/products/rhel8/CMakeLists.txt
@@ -14,15 +14,9 @@ ssg_build_html_table_by_ref(${PRODUCT} "cis")
ssg_build_html_table_by_ref(${PRODUCT} "pcidss")
ssg_build_html_table_by_ref(${PRODUCT} "anssi")
@@ -11,7 +11,6 @@ ssg_build_product(${PRODUCT})
ssg_build_html_ref_tables("${PRODUCT}" "table-${PRODUCT}-{ref_id}refs" "anssi;cis;cui;nist;pcidss")
-ssg_build_html_nistrefs_table(${PRODUCT} "standard")
ssg_build_html_nistrefs_table(${PRODUCT} "ospp")
ssg_build_html_nistrefs_table(${PRODUCT} "stig")
ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-ospp" "${PRODUCT}" "ospp" "nist")
-ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-standard" "${PRODUCT}" "standard" "nist")
ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-stig" "${PRODUCT}" "stig" "nist")
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_minimal")
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_intermediary")
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_enhanced")
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_high")
-
ssg_build_html_cce_table(${PRODUCT})
ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE})
ssg_build_html_profile_table("table-${PRODUCT}-anssirefs-bp28_minimal" "${PRODUCT}" "anssi_bp28_minimal" "anssi")
diff --git a/products/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile
index 035d2705b..c6475f33e 100644
--- a/products/rhel8/profiles/cjis.profile

240
SOURCES/scap-security-guide-0.1.58-RHEL_08_010001-PR_7344.patch
View File

@ -1,240 +0,0 @@
From bb5c2983be3b11c3cd1070cf1d3daca27cb700ee Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 19 Aug 2021 08:02:55 -0500
Subject: [PATCH] Add a new rules RHEL-08-010001 and RHEL-07-020019
---
.../agent_mfetpd_running/oval/shared.xml | 16 ++++++
.../agent_mfetpd_running/rule.yml | 39 ++++++++++++++
.../group.yml | 7 +++
.../package_mcafeetp_installed/rule.yml | 51 +++++++++++++++++++
products/rhel7/profiles/stig.profile | 2 +
products/rhel8/profiles/stig.profile | 4 ++
shared/references/cce-redhat-avail.txt | 4 --
.../data/profile_stability/rhel8/stig.profile | 2 +
.../profile_stability/rhel8/stig_gui.profile | 2 +
9 files changed, 123 insertions(+), 4 deletions(-)
create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
new file mode 100644
index 00000000000..9900d8bd724
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
@@ -0,0 +1,16 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Ensure that McAfee Endpoint Security for Linux (ENSL) is running.") }}}
+ <criteria>
+ <criterion comment="McAfee ENSL is running" test_ref="test_{{{ rule_id }}}"/>
+ </criteria>
+ </definition>
+ <unix:process58_test check="all" id="test_{{{ rule_id }}}" comment="is mfetpd running" version="1">
+ <unix:object object_ref="obj_{{{ rule_id }}}"/>
+ </unix:process58_test>
+
+ <unix:process58_object id="obj_{{{ rule_id }}}" version="1">
+ <unix:command_line operation="pattern match">^mfetpd.*$</unix:command_line>
+ <unix:pid datatype="int" operation="greater than">0</unix:pid>
+ </unix:process58_object>
+</def-group>
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
new file mode 100644
index 00000000000..32c934467da
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
@@ -0,0 +1,39 @@
+documentation_complete: true
+
+prodtype: rhel7,rhel8
+
+title: 'Ensure McAfee Endpoint Security for Linux (ENSL) is running'
+
+description: |-
+ Install McAfee Endpoint Security for Linux antivirus software
+ which is provided for DoD systems and uses signatures to search for the
+ presence of viruses on the filesystem.
+
+rationale: |-
+ Virus scanning software can be used to detect if a system has been compromised by
+ computer viruses, as well as to limit their spread to other systems.
+
+severity: high
+
+identifiers:
+ cce@rhel7: CCE-86262-3
+ cce@rhel8: CCE-86261-5
+
+references:
+ disa: CCI-001233
+ nist: SI-2(2)
+ srg: SRG-OS-000191-GPOS-00080
+ stigid@rhel7: RHEL-07-020019
+ stigid@rhel8: RHEL-08-010001
+
+ocil_clause: 'virus scanning software is not running'
+
+ocil: |-
+ To verify that McAfee Endpoint Security for Linux is
+ running, run the following command:
+ <pre>$ sudo ps -ef | grep -i mfetpd</pre>
+
+warnings:
+ - general: |-
+ Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
+ automated remediation is not available for this configuration check.
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
new file mode 100644
index 00000000000..f2e4e89851a
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
@@ -0,0 +1,7 @@
+documentation_complete: true
+
+title: 'McAfee Endpoint Security for Linux (ENSL)'
+
+description: |-
+ McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
+ used to monitor, detect, and defend computer networks and systems.
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
new file mode 100644
index 00000000000..16587792eff
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
@@ -0,0 +1,51 @@
+documentation_complete: true
+
+prodtype: rhel7,rhel8
+
+title: 'Install McAfee Endpoint Security for Linux (ENSL)'
+
+description: |-
+ Install McAfee Endpoint Security for Linux antivirus software
+ which is provided for DoD systems and uses signatures to search for the
+ presence of viruses on the filesystem.
+
+ {{{ describe_package_install(package="mcafeetp") }}}
+
+rationale: |-
+ Virus scanning software can be used to detect if a system has been compromised by
+ computer viruses, as well as to limit their spread to other systems.
+
+severity: high
+
+identifiers:
+ cce@rhel7: CCE-86257-3
+ cce@rhel8: CCE-86260-7
+
+references:
+ disa: CCI-001233
+ nist: SI-2(2)
+ srg: SRG-OS-000191-GPOS-00080
+ stigid@rhel7: RHEL-07-020019
+ stigid@rhel8: RHEL-08-010001
+
+ocil_clause: 'the package is not installed'
+
+ocil: '{{{ ocil_package(package="mcafeetp") }}}'
+
+warnings:
+ - general: |-
+ Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
+ automated remediation is not available for this configuration check.
+
+platform: machine
+
+template:
+ name: package_installed
+ vars:
+ pkgname: mcafeetp
+ backends:
+ bash: "off"
+ ansible: "off"
+ anaconda: "off"
+ puppet: "off"
+ blueprint: "off"
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index f5761c891f2..9ca13600057 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -316,3 +316,5 @@ selections:
- file_permissions_var_log_audit
- sysctl_net_ipv4_conf_all_rp_filter
- sysctl_net_ipv4_conf_default_rp_filter
+ - package_mcafeetp_installed
+ - agent_mfetpd_running
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 9dc9360e899..36f384621ae 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -84,6 +84,10 @@ selections:
# RHEL-08-010000
- installed_OS_is_vendor_supported
+ # RHEL-08-010001
+ - package_mcafeetp_installed
+ - agent_mfetpd_running
+
# RHEL-08-010010
- security_patches_up_to_date
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 3b24e19da06..08013e6de22 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -372,12 +372,8 @@ CCE-86253-2
CCE-86254-0
CCE-86255-7
CCE-86256-5
-CCE-86257-3
CCE-86258-1
CCE-86259-9
-CCE-86260-7
-CCE-86261-5
-CCE-86262-3
CCE-86263-1
CCE-86264-9
CCE-86265-6
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index e9ba0f0adbf..f3e6c4fa1a1 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -65,6 +65,7 @@ selections:
- accounts_user_interactive_home_directory_defined
- accounts_user_interactive_home_directory_exists
- aide_check_audit_tools
+- agent_mfetpd_running
- aide_scan_notification
- aide_verify_acls
- aide_verify_ext_attributes
@@ -280,6 +281,7 @@ selections:
- package_gssproxy_removed
- package_iprutils_removed
- package_krb5-workstation_removed
+- package_mcafeetp_installed
- package_opensc_installed
- package_openssh-server_installed
- package_policycoreutils_installed
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index c8540f9392e..b5b60349a83 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -76,6 +76,7 @@ selections:
- accounts_user_interactive_home_directory_defined
- accounts_user_interactive_home_directory_exists
- aide_check_audit_tools
+- agent_mfetpd_running
- aide_scan_notification
- aide_verify_acls
- aide_verify_ext_attributes
@@ -291,6 +292,7 @@ selections:
- package_gssproxy_removed
- package_iprutils_removed
- package_krb5-workstation_removed
+- package_mcafeetp_installed
- package_opensc_installed
- package_openssh-server_installed
- package_policycoreutils_installed

118
SOURCES/scap-security-guide-0.1.58-RHEL_08_010360-PR_7209.patch
View File

@ -1,118 +0,0 @@
From 386f9787ceac9b0fc732bcd5fd5f7174254922b3 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 15 Jul 2021 14:33:44 -0500
Subject: [PATCH] Update 'Configure Notification of Post-AIDE Scan Details'
Added
- Ansible fix for this rule
- Configurable email for sending notification email for AIDE alerts
---
.../aide_scan_notification/ansible/shared.yml | 28 +++++++++++++++++++
.../aide_scan_notification/bash/shared.sh | 18 ++++++++----
.../aide/aide_scan_notification/rule.yml | 2 ++
.../var_aide_scan_notification_email.var | 16 +++++++++++
4 files changed, 58 insertions(+), 6 deletions(-)
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
new file mode 100644
index 00000000000..5c11fc1719e
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
@@ -0,0 +1,28 @@
+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol,multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+{{% if product in ["sle12", "sle15"] %}}
+ {{% set aide_path = "/usr/bin/aide" %}}
+{{% else %}}
+ {{% set aide_path = "/usr/sbin/aide" %}}
+{{% endif %}}
+
+- (xccdf-var var_aide_scan_notification_email)
+
+- name: "Ensure AIDE is installed"
+ package:
+ name: "{{ item }}"
+ state: present
+ with_items:
+ - aide
+
+- name: "{{{ rule_title }}}"
+ cron:
+ name: "run AIDE check"
+ minute: 05
+ hour: 04
+ weekday: 0
+ user: root
+ job: '{{{aide_path}}} --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" {{ var_aide_scan_notification_email }}'
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
index 2f129e568b2..3cb8b72a0bd 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
@@ -1,6 +1,16 @@
# platform = multi_platform_all
+. /usr/share/scap-security-guide/remediation_functions
+
{{{ bash_package_install("aide") }}}
+{{{ bash_instantiate_variables("var_aide_scan_notification_email") }}}
+{{% if product in ["sle12", "sle15"] %}}
+ {{% set aide_path = "/usr/bin/aide" %}}
+{{% else %}}
+ {{% set aide_path = "/usr/sbin/aide" %}}
+{{% endif %}}
+
+
CRONTAB=/etc/crontab
CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
@@ -14,11 +24,7 @@ if [ -f /var/spool/cron/root ]; then
VARSPOOL=/var/spool/cron/root
fi
-if ! grep -qR '^.*\/usr\/sbin\/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*root@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
-{{% if product in ["sle12", "sle15"] %}}
- echo '0 5 * * * root /usr/bin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost' >> $CRONTAB
-{{% else %}}
- echo '0 5 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost' >> $CRONTAB
-{{% endif %}}
+if ! grep -qR '^.*{{{aide_path}}}\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
+ echo "0 5 * * * root {{{ aide_path }}} --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" >> $CRONTAB
fi
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
index 51dae72ee6d..cb35c5c642d 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
@@ -57,3 +57,5 @@ ocil: |-
<pre>$ grep aide /etc/crontab</pre>
The output should return something similar to the following:
<pre>05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost</pre>
+ The email address that the notifications are sent to can be changed by overriding
+ <pre><sub idref="var_aide_scan_notification_email" /></pre>.
diff --git a/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var b/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
new file mode 100644
index 00000000000..75b9f5d2650
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+title: Integrity Scan Notification Email Address
+
+description: |-
+ Specify the email address for designated personnel if baseline
+ configurations are changed in an unauthorized manner.
+
+type: string
+
+operator: equals
+
+interactive: true
+
+options:
+ default: root@localhost

151
SOURCES/scap-security-guide-0.1.58-RHEL_08_010420-PR_7227.patch
View File

@ -1,151 +0,0 @@
From 278f3b476291d69e45da4dcdfca5a308646224f2 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 19 Jul 2021 09:49:57 -0500
Subject: [PATCH 1/2] Add more checks for bios_enable_execution_restrictions to
ensure we don't miss anything
---
.../oval/shared.xml | 18 ++++++++++++++++++
.../rule.yml | 3 ++-
products/rhel8/profiles/stig.profile | 1 +
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
5 files changed, 23 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
new file mode 100644
index 00000000000..622a183f99f
--- /dev/null
+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
@@ -0,0 +1,18 @@
+<def-group>
+ <definition class="compliance" id="bios_enable_execution_restrictions" version="2">
+ {{{ oval_metadata("The NX (no-execution) bit flag should be set on the system.") }}}
+ <criteria>
+ <criterion comment="NX bit is set" test_ref="test_NX_cpu_support" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support for NX bit" id="test_NX_cpu_support" version="1">
+ <ind:object object_ref="obj_NX_cpu_support" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_NX_cpu_support" version="1">
+ <ind:filepath>/proc/cpuinfo</ind:filepath>
+ <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
index 4ca003520ac..b037e374f5b 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
@@ -14,7 +14,7 @@ rationale: |-
Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
allow users to turn the feature on or off at will.
-severity: unknown
+severity: medium
identifiers:
cce@rhel7: CCE-27099-1
@@ -31,5 +31,6 @@ references:
iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
nist: SC-39,CM-6(a)
nist-csf: PR.IP-1
+ stig@rhel8: RHEL-08-010420
platform: machine
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 5a0a520ee0a..6372d13cfc9 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -260,6 +260,7 @@ selections:
- package_opensc_installed
# RHEL-08-010420
+ - bios_enable_execution_restrictions
# RHEL-08-010421
- grub2_page_poison_argument
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 4be3cf93c25..32f1a24a7a4 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -74,6 +74,7 @@ selections:
- auditd_log_format
- auditd_name_format
- banner_etc_issue
+- bios_enable_execution_restrictions
- chronyd_client_only
- chronyd_no_chronyc_network
- chronyd_or_ntpd_set_maxpoll
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 20b8a54861e..d6a27c67dc0 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -85,6 +85,7 @@ selections:
- auditd_log_format
- auditd_name_format
- banner_etc_issue
+- bios_enable_execution_restrictions
- chronyd_client_only
- chronyd_no_chronyc_network
- chronyd_or_ntpd_set_maxpoll
From dac8111b4d89a31cbaa5648f876bd58575a93e86 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 19 Jul 2021 09:51:34 -0500
Subject: [PATCH 2/2] Add oval check for bios_enable_execution_restrictions
---
.../oval/shared.xml | 24 ++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
index 622a183f99f..7cc448f8cce 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
@@ -1,8 +1,10 @@
<def-group>
<definition class="compliance" id="bios_enable_execution_restrictions" version="2">
{{{ oval_metadata("The NX (no-execution) bit flag should be set on the system.") }}}
- <criteria>
+ <criteria operator="AND">
<criterion comment="NX bit is set" test_ref="test_NX_cpu_support" />
+ <criterion comment="No log messages about NX being disabled" test_ref="test_messages_nx_active" />
+ <criterion comment="NX is not disabled in the kernel command line" test_ref="test_noexec_cmd_line" />
</criteria>
</definition>
@@ -10,9 +12,29 @@
<ind:object object_ref="obj_NX_cpu_support" />
</ind:textfilecontent54_test>
+ <ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_messages_nx_active" version="1" comment="No log messages about NX being disabled">
+ <ind:object object_ref="obj_messages_nx_active" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_noexec_cmd_line" version="1" comment="NX is not disabled in the kernel command line">
+ <ind:object object_ref="obj_noexec_cmd_line" />
+ </ind:textfilecontent54_test>
+
<ind:textfilecontent54_object id="obj_NX_cpu_support" version="1">
<ind:filepath>/proc/cpuinfo</ind:filepath>
<ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_object id="obj_messages_nx_active" version="1">
+ <ind:filepath>/var/log/messages</ind:filepath>
+ <ind:pattern operation="pattern match">^.+protection: disabled.+</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_object id="obj_noexec_cmd_line" version="1">
+ <ind:filepath>/proc/cmdline</ind:filepath>
+ <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
</def-group>

47
SOURCES/scap-security-guide-0.1.58-RHEL_08_010630-PR_7250.patch
View File

@ -1,47 +0,0 @@
From 4ac2a6db67e03e616b26d39fb0620d4656bac65b Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 14 Jul 2021 13:19:42 -0500
Subject: [PATCH] Add RHEL-08-010590 STIG to existing rule
---
products/rhel8/profiles/stig.profile | 1 +
tests/data/profile_stability/rhel8/stig.profile | 1 +
tests/data/profile_stability/rhel8/stig_gui.profile | 1 +
3 files changed, 3 insertions(+)
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 2508008d511..fef1965fb1d 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -341,6 +341,7 @@ selections:
- mount_option_nodev_nonroot_local_partitions
# RHEL-08-010590
+ - mount_option_home_noexec
# RHEL-08-010600
- mount_option_nodev_removable_partitions
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 765487c6f16..843d8eb7d0a 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -156,6 +156,7 @@ selections:
- mount_option_dev_shm_nodev
- mount_option_dev_shm_noexec
- mount_option_dev_shm_nosuid
+- mount_option_home_noexec
- mount_option_home_nosuid
- mount_option_nodev_nonroot_local_partitions
- mount_option_nodev_remote_filesystems
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 9fd80aac727..6dd0f08b142 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -167,6 +167,7 @@ selections:
- mount_option_dev_shm_nodev
- mount_option_dev_shm_noexec
- mount_option_dev_shm_nosuid
+- mount_option_home_noexec
- mount_option_home_nosuid
- mount_option_nodev_nonroot_local_partitions
- mount_option_nodev_remote_filesystems

153
SOURCES/scap-security-guide-0.1.58-RHEL_08_020090-PR_7313.patch
View File

@ -1,153 +0,0 @@
From 6eeef4054d707b8b255e9fa600c4c7babffbf5f7 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 2 Aug 2021 08:37:04 -0500
Subject: [PATCH] Add rule for RHEL-08-020090
---
.../sssd/sssd_enable_certmap/rule.yml | 58 +++++++++++++++++++
.../sssd_enable_certmap/tests/default.fail.sh | 4 ++
.../tests/with_section.pass.sh | 7 +++
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
7 files changed, 72 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
new file mode 100644
index 0000000000..0614a2f4a0
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
@@ -0,0 +1,58 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Enable Certmap in SSSD'
+
+description: |-
+ SSSD should be configured to verify the certificate of the user or group. To set this up
+ ensure that section like <tt>certmap/testing.test/rule_name</tt> is setup in
+ <tt>/etc/sssd/sssd.conf</tt>. For example
+ <pre>
+ [certmap/testing.test/rule_name]
+ matchrule =&lt;SAN&gt;.*EDIPI@mil
+ maprule = (userCertificate;binary={cert!bin})
+ domains = testing.test
+ </pre>
+
+rationale: |-
+ Without mapping the certificate used to authenticate to the user account, the ability to
+ determine the identity of the individual user or group will not be available for forensic
+ analysis.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-86060-1
+
+references:
+ disa: CCI-000187
+ nist: IA-5 (2) (c)
+ stigid@rhel8: RHEL-08-020090
+
+warnings:
+ - general: |-
+ Automatic remediation of this control is not available, since all of the settings in
+ in the certmap need to be customized.
+
+ocil_clause: 'Certmap is not configured in SSSD'
+
+ocil: |-
+ To verify Certmap is enabled in SSSD, run the following command:
+ <pre>$ cat sudo cat /etc/sssd/sssd.conf</pre>
+ If configured properly, output should contain section like the following
+ <pre>
+ [certmap/testing.test/rule_name]
+ matchrule =&lt;SAN&gt;.*EDIPI@mil
+ maprule = (userCertificate;binary={cert!bin})
+ domains = testing.test
+ </pre>
+
+template:
+ name: lineinfile
+ vars:
+ path: '/etc/sssd/sssd.conf'
+ text: '^\[certmap\/.+\/.+\]$'
+ backends:
+ ansible: "off"
+ bash: "off"
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
new file mode 100644
index 0000000000..1e31c0da19
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+touch /etc/sssd/sssd.conf
+sed -i "s/\[certmap.*//g" /etc/sssd/sssd.conf
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
new file mode 100644
index 0000000000..911e095f5d
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+cat >> /etc/sssd/sssd.conf<< EOF
+[certmap/testing.test/rule_name]
+matchrule =<SAN>.*EDIPI@mil
+maprule = (userCertificate;binary={cert!bin})
+domains = testing.test
+EOF
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index f17a7b88b1..ec0a3b1753 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -503,6 +503,7 @@ selections:
# RHEL-08-020080
# RHEL-08-020090
+ - sssd_enable_certmap
# RHEL-08-020100
- accounts_password_pam_retry
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 73d025484e..e80557f033 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -186,7 +186,6 @@ CCE-86056-9
CCE-86057-7
CCE-86058-5
CCE-86059-3
-CCE-86060-1
CCE-86061-9
CCE-86062-7
CCE-86063-5
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 236e595604..bffa509b69 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -275,6 +275,7 @@ selections:
- sshd_set_keepalive_0
- sshd_use_strong_rng
- sshd_x11_use_localhost
+- sssd_enable_certmap
- sssd_enable_smartcards
- sssd_offline_cred_expiration
- sudo_remove_no_authenticate
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 9973b5adef..c84ac75c7b 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -286,6 +286,7 @@ selections:
- sshd_set_keepalive_0
- sshd_use_strong_rng
- sshd_x11_use_localhost
+- sssd_enable_certmap
- sssd_enable_smartcards
- sssd_offline_cred_expiration
- sudo_remove_no_authenticate

194
SOURCES/scap-security-guide-0.1.58-RHEL_08_020300-PR_7289.patch
View File

@ -1,194 +0,0 @@
From 2af7d6d8f86f80dbac088d115a50162cfc28c542 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 27 Jul 2021 07:49:50 -0500
Subject: [PATCH] Add rule for RHEL-08-020300
---
.../accounts_password_pam_dictcheck/rule.yml | 45 +++++++++++++++++++
.../tests/disabled.fail.sh | 3 ++
.../tests/enable.pass.sh | 3 ++
.../tests/not_defined.fail.sh | 3 ++
.../var_password_pam_dictcheck.var | 16 +++++++
products/rhel8/profiles/stig.profile | 2 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 2 +
.../profile_stability/rhel8/stig_gui.profile | 2 +
9 files changed, 76 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
new file mode 100644
index 0000000000..2990150c0a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -0,0 +1,45 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
+
+description: |-
+ The pam_pwquality module's <tt>dictcheck</tt> check if passwords contains dictionary words. When
+ <tt>dictcheck</tt> is set to <tt>1</tt> passwords will be checked for dictionary words.
+
+rationale: |-
+ Use of a complex password helps to increase the time and resources required to compromise the password.
+ Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
+ guessing and brute-force attacks.
+ <br /><br />
+ Password complexity is one factor of several that determines how long it takes to crack a password. The more
+ complex the password, the greater the number of possible combinations that need to be tested before the
+ password is compromised.
+ <br /><br />
+ Passwords with dictionary words may be more vulnerable to password-guessing attacks.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-86233-4
+
+references:
+ disa: CCI-000366
+ nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
+ stigid@rhel8: RHEL-08-020300
+
+ocil_clause: 'dictcheck is not found or not equal to the required value'
+
+ocil: |-
+ To check if dictionary words are disallowed run the following command:
+ <pre>$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf</pre>
+ The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
+ <pre>dictcheck=1</pre>
+
+
+template:
+ name: accounts_password
+ vars:
+ variable: dictcheck
+ operation: equals
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
new file mode 100644
index 0000000000..cb84c6d968
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=0" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
new file mode 100644
index 0000000000..ceb9f7ec44
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=1" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
new file mode 100644
index 0000000000..57e54b6623
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+sed -i s/dictcheck.+//g /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
new file mode 100644
index 0000000000..26452c3a8e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+title: dictcheck
+
+description: |-
+ Prevent the use of dictionary words for passwords.
+
+type: number
+
+operator: equals
+
+interactive: false
+
+options:
+ 1: 1
+ default: 1
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index bf410c2087..f17a7b88b1 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -45,6 +45,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+ - var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
@@ -567,6 +568,7 @@ selections:
- sssd_offline_cred_expiration
# RHEL-08-020300
+ - accounts_password_pam_dictcheck
# RHEL-08-020310
- accounts_logon_fail_delay
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 0b794d5c2a..dae4495b2d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -362,7 +362,6 @@ CCE-86229-2
CCE-86230-0
CCE-86231-8
CCE-86232-6
-CCE-86233-4
CCE-86234-2
CCE-86235-9
CCE-86236-7
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ddfa13e731..236e595604 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -35,6 +35,7 @@ selections:
- accounts_password_all_shadowed_sha512
- accounts_password_minlen_login_defs
- accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
- accounts_password_pam_difok
- accounts_password_pam_lcredit
- accounts_password_pam_maxclassrepeat
@@ -332,6 +333,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 017ab8c0e3..9973b5adef 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -46,6 +46,7 @@ selections:
- accounts_password_all_shadowed_sha512
- accounts_password_minlen_login_defs
- accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
- accounts_password_pam_difok
- accounts_password_pam_lcredit
- accounts_password_pam_maxclassrepeat
@@ -342,6 +343,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3

220
SOURCES/scap-security-guide-0.1.58-RHEL_08_020320-PR_7303.patch
View File

@ -1,220 +0,0 @@
From d6f7334d642fb311d32d7a171c460cd05e6625b8 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Fri, 6 Aug 2021 10:48:46 -0500
Subject: [PATCH] Add rule for RHEL-08-020320
---
.../ansible/shared.yml | 0
.../bash/shared.sh | 2 +-
.../oval/shared.xml | 2 +-
.../accounts_authorized_local_users/rule.yml | 12 +++++++++---
.../tests/bad_user.fail.sh | 2 ++
.../tests/default.pass.sh | 16 ++++++++++++++++
...var_accounts_authorized_local_users_regex.var | 1 +
products/rhel8/profiles/stig.profile | 3 ++-
shared/references/cce-redhat-avail.txt | 1 -
tests/data/profile_stability/rhel8/stig.profile | 2 ++
.../profile_stability/rhel8/stig_gui.profile | 2 ++
11 files changed, 36 insertions(+), 7 deletions(-)
rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/ansible/shared.yml (100%)
rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/bash/shared.sh (95%)
rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/oval/shared.xml (98%)
rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/rule.yml (88%)
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/var_accounts_authorized_local_users_regex.var (81%)
diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/ansible/shared.yml
similarity index 100%
rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/ansible/shared.yml
rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/ansible/shared.yml
diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
similarity index 95%
rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh
rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
index c342acf36d1..fedb02d84ce 100644
--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
@@ -10,7 +10,7 @@ default_os_user="root"
for username in $( sed 's/:.*//' /etc/passwd ) ; do
if [[ ! "$username" =~ ($default_os_user|$var_accounts_authorized_local_users_regex) ]];
then
- userdel $username ;
+ userdel $username ;
fi
done
diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
similarity index 98%
rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml
rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
index 4e42081d0dc..c56799ded20 100644
--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
@@ -32,6 +32,6 @@
var_ref="var_accounts_authorized_local_users_regex"></ind:subexpression>
</ind:textfilecontent54_state>
- <external_variable id="var_accounts_authorized_local_users_regex" version="1" datatype="string"
+ <external_variable id="var_accounts_authorized_local_users_regex" version="1" datatype="string"
comment="accounts authorized local users on operating system"/>
</def-group>
diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
similarity index 88%
rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml
rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
index ddbda30afe6..e2311f6a5c3 100644
--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: ol7,sle12,sle15
+prodtype: ol7,sle12,sle15,fedora,rhel8
title: 'Only Authorized Local User Accounts Exist on Operating System'
@@ -26,11 +26,10 @@ rationale: |-
severity: medium
identifiers:
+ cce@rhel8: CCE-85987-6
cce@sle12: CCE-83195-8
cce@sle15: CCE-85561-9
-severity: medium
-
references:
disa: CCI-000366
nist@sle12: CM-6(b),CM-6.1(iv)
@@ -41,6 +40,13 @@ references:
ocil_clause: 'there are unauthorized local user accounts on the system'
+{{% if 'rhel' in product %}}
+warnings:
+ - general: |-
+ Automatic remediation of this control is not available. Due the unique
+ requirements of each system.
+{{% endif %}}
+
ocil: |-
To verify that there are no unauthorized local user accounts, run the following command:
<pre>$ less /etc/passwd </pre>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
new file mode 100644
index 00000000000..6dabaff6bc6
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
@@ -0,0 +1,2 @@
+#! /bin/bash
+adduser testuser
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
new file mode 100644
index 00000000000..d942f81d04f
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
@@ -0,0 +1,16 @@
+#! /bin/bash
+# platform = multi_platform_rhel
+
+var_accounts_authorized_local_users_regex="^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$"
+
+# never delete the root user
+default_os_user="root"
+
+# delete users that is in /etc/passwd but neither in default_os_user
+# nor in var_accounts_authorized_local_users_regex
+for username in $( sed 's/:.*//' /etc/passwd ) ; do
+ if [[ ! "$username" =~ ($default_os_user|$var_accounts_authorized_local_users_regex) ]];
+ then
+ echo $username ;
+ fi
+done
diff --git a/linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
similarity index 81%
rename from linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var
rename to linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
index 81626307321..2f456764617 100644
--- a/linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var
+++ b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
@@ -22,5 +22,6 @@ operator: pattern match
interactive: true
options:
+ rhel8: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$"
ol7forsap: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$"
saponol7 : "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$"
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index f66b2a24a75..ec2929e8dc4 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -54,6 +54,7 @@ selections:
- sshd_approved_macs=stig
- sshd_approved_ciphers=stig
- sshd_idle_timeout_value=10_minutes
+ - var_accounts_authorized_local_users_regex=rhel8
- var_accounts_passwords_pam_faillock_deny=3
- var_accounts_passwords_pam_faillock_fail_interval=900
- var_accounts_passwords_pam_faillock_unlock_time=never
@@ -576,7 +577,7 @@ selections:
- accounts_logon_fail_delay
# RHEL-08-020320
- # - accounts_authorized_local_users
+ - accounts_authorized_local_users
# RHEL-08-020330
- sshd_disable_empty_passwords
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 1d54e8ec15f..3047c2d9b92 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -115,7 +115,6 @@ CCE-85983-5
CCE-85984-3
CCE-85985-0
CCE-85986-8
-CCE-85987-6
CCE-85988-4
CCE-85989-2
CCE-85990-0
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index fcae79f6d88..9496f1e1d1d 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -27,6 +27,7 @@ selections:
- account_emergency_expire_date
- account_temp_expire_date
- account_unique_id
+- accounts_authorized_local_users
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay
- accounts_max_concurrent_login_sessions
@@ -358,6 +359,7 @@ selections:
- var_auditd_disk_error_action=halt
- var_auditd_max_log_file_action=syslog
- var_auditd_disk_full_action=halt
+- var_accounts_authorized_local_users_regex=rhel8
- var_system_crypto_policy=fips
- var_sudo_timestamp_timeout=always_prompt
title: DISA STIG for Red Hat Enterprise Linux 8
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 2bbd1881f51..9e0c648a5f8 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -38,6 +38,7 @@ selections:
- account_emergency_expire_date
- account_temp_expire_date
- account_unique_id
+- accounts_authorized_local_users
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay
- accounts_max_concurrent_login_sessions
@@ -368,6 +369,7 @@ selections:
- var_auditd_disk_error_action=halt
- var_auditd_max_log_file_action=syslog
- var_auditd_disk_full_action=halt
+- var_accounts_authorized_local_users_regex=rhel8
- var_system_crypto_policy=fips
- var_sudo_timestamp_timeout=always_prompt
title: DISA STIG with GUI for Red Hat Enterprise Linux 8

211
SOURCES/scap-security-guide-0.1.58-RHEL_08_030610-PR_7256.patch
View File

@ -1,211 +0,0 @@
From 8455c8556a6d828b15ebc62cf511e484dd626a36 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Fri, 16 Jul 2021 13:16:12 -0500
Subject: [PATCH] Add rules for RHEL-08-030610
Added two rules, one for each of the paths mentioned in the STIG.
---
.../rule.yml | 35 ++++++++++++++++++
.../tests/correct_permissions.pass.sh | 6 ++++
.../tests/incorrect_permissions.fail.sh | 6 ++++
.../rule.yml | 36 +++++++++++++++++++
.../tests/correct_permissions.pass.sh | 6 ++++
.../tests/incorrect_permissions.fail.sh | 6 ++++
products/rhel8/profiles/stig.profile | 2 ++
shared/references/cce-redhat-avail.txt | 2 --
.../data/profile_stability/rhel8/stig.profile | 2 ++
.../profile_stability/rhel8/stig_gui.profile | 2 ++
10 files changed, 101 insertions(+), 2 deletions(-)
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
new file mode 100644
index 0000000000..1cde3ded5f
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
@@ -0,0 +1,35 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Verify Permissions on /etc/audit/auditd.conf'
+
+description: |-
+ {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0640") }}}
+
+
+rationale: |-
+ Without the capability to restrict the roles and individuals that can select which events
+ are audited, unauthorized personnel may be able to prevent the auditing of critical
+ events. Misconfigured audits may degrade the system's performance by overwhelming
+ the audit log. Misconfigured audits may also make it more difficult to establish,
+ correlate, and investigate the events relating to an incident or identify
+ those responsible for one.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85871-2
+
+references:
+ disa: CCI-000171
+ nist: AU-12(b)
+ srg: SRG-OS-000063-GPOS-00032
+ stigid@rhel8: RHEL-08-030610
+
+template:
+ name: file_permissions
+ vars:
+ filepath: /etc/audit/auditd.conf
+ allow_stricter_permissions: "true"
+ filemode: '0640'
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
new file mode 100644
index 0000000000..8c9b782920
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+export TESTFILE=/etc/audit/auditd.conf
+mkdir -p /etc/audit/
+touch $TESTFILE
+chmod 0640 $TESTFILE
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
new file mode 100644
index 0000000000..a460e0dddd
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+export TESTFILLE=/etc/audit/auditd.conf
+mkdir -p /etc/audit/
+touch $TESTFILLE
+chmod 0644 $TESTFILLE
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
new file mode 100644
index 0000000000..34e1f30367
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Verify Permissions on /etc/audit/rules.d/*.rules'
+
+description: |-
+ {{{ describe_file_permissions(file="/etc/audit/rules.d/*.rules", perms="0640") }}}
+
+
+rationale: |-
+ Without the capability to restrict the roles and individuals that can select which events
+ are audited, unauthorized personnel may be able to prevent the auditing of critical
+ events. Misconfigured audits may degrade the system's performance by overwhelming
+ the audit log. Misconfigured audits may also make it more difficult to establish,
+ correlate, and investigate the events relating to an incident or identify
+ those responsible for one.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85875-3
+
+references:
+ disa: CCI-000171
+ nist: AU-12(b)
+ srg: SRG-OS-000063-GPOS-00032
+ stigid@rhel8: RHEL-08-030610
+
+template:
+ name: file_permissions
+ vars:
+ filepath: /etc/audit/rules.d/
+ file_regex: ^.*rules$
+ allow_stricter_permissions: "true"
+ filemode: '0640'
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
new file mode 100644
index 0000000000..b0a20248c3
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+mkdir -p /etc/audit/rules.d/
+touch $TESTFILE
+chmod 0640 $TESTFILE
diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
new file mode 100644
index 0000000000..c7fd3a95e9
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+export TESTFILLE=/etc/audit/rules.d/test_rule.rules
+mkdir -p /etc/audit/rules.d/
+touch $TESTFILLE
+chmod 0644 $TESTFILLE
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 26d0aa9922..5a0a520ee0 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -801,6 +801,8 @@ selections:
- configure_usbguard_auditbackend
# RHEL-08-030610
+ - file_permissions_etc_audit_auditd
+ - file_permissions_etc_audit_rulesd
# RHEL-08-030620
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index ae3375fd4d..24e8149168 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -11,11 +11,9 @@ CCE-85867-0
CCE-85868-8
CCE-85869-6
CCE-85870-4
-CCE-85871-2
CCE-85872-0
CCE-85873-8
CCE-85874-6
-CCE-85875-3
CCE-85876-1
CCE-85877-9
CCE-85878-7
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index a1de1f5561..4be3cf93c2 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -123,6 +123,8 @@ selections:
- file_ownership_var_log_audit
- file_permission_user_init_files
- file_permissions_binary_dirs
+- file_permissions_etc_audit_auditd
+- file_permissions_etc_audit_rulesd
- file_permissions_home_directories
- file_permissions_library_dirs
- file_permissions_sshd_private_key
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index b7d2be3af3..20b8a54861 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -134,6 +134,8 @@ selections:
- file_ownership_var_log_audit
- file_permission_user_init_files
- file_permissions_binary_dirs
+- file_permissions_etc_audit_auditd
+- file_permissions_etc_audit_rulesd
- file_permissions_home_directories
- file_permissions_library_dirs
- file_permissions_sshd_private_key

327
SOURCES/scap-security-guide-0.1.58-RHEL_08_030650-PR_7283.patch
View File

@ -1,327 +0,0 @@
From 065b6e540a2aa437ddf5239c97ed4e1fddf43b50 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 26 Jul 2021 09:00:49 -0500
Subject: [PATCH] Update rule aide_check_audit_tools for RHEL-08-030650
---
.../aide_check_audit_tools/ansible/shared.yml | 27 ++++++++++++------
.../aide_check_audit_tools/bash/shared.sh | 25 +++++++++++++++++
.../aide_check_audit_tools/oval/shared.xml | 20 +++++++++++++
.../aide/aide_check_audit_tools/rule.yml | 28 ++++++++++++-------
.../tests/correct.pass.sh | 15 ++++++++++
.../tests/correct_with_selinux.pass.sh | 12 ++++++++
.../tests/not_config.fail.sh | 14 ++++++++++
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
11 files changed, 126 insertions(+), 19 deletions(-)
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
index 73afaeff869..edef272183d 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
@@ -1,18 +1,29 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,multi_platform_rhel
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
-- name: Install aide package
- zypper:
- name: aide
- state: latest
+{{% if 'rhel' not in product %}}
+{{% set aide_string = 'p+i+n+u+g+s+b+acl+selinux+xattrs+sha512' %}}
+{{% else %}}
+{{% set aide_string = 'p+i+n+u+g+s+b+acl+xattrs+sha512' %}}
+{{% endif %}}
+
+
+
+- name: Ensure aide is installed
+ package:
+ name: "{{ item }}"
+ state: present
+ with_items:
+ - aide
+
- name: Set audit_tools fact
set_fact:
audit_tools:
- - /usr/sbin/audispd
+ {{% if 'rhel' not in product %}}- /usr/sbin/audispd{{% endif %}}
- /usr/sbin/auditctl
- /usr/sbin/auditd
- /usr/sbin/augenrules
@@ -24,11 +35,11 @@
lineinfile:
path: /etc/aide.conf
regexp: ^{{ item }}\s
- line: "{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512"
+ line: "{{ item }} {{{ aide_string }}}"
with_items: "{{ audit_tools }}"
- name: Configure AIDE to properly protect audit tools
lineinfile:
path: /etc/aide.conf
- line: "{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512"
+ line: "{{ item }} {{{ aide_string }}}"
with_items: "{{ audit_tools }}"
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
new file mode 100644
index 00000000000..0875eeec648
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
@@ -0,0 +1,25 @@
+# platform = multi_platform_rhel
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+. /usr/share/scap-security-guide/remediation_functions
+
+{{{ bash_package_install("aide") }}}
+
+{{% set configString = "p+i+n+u+g+s+b+acl+xattrs+sha512" %}}
+{{% set configFile = "/etc/aide.conf" %}}
+{{% for file in (
+ "/usr/sbin/auditctl",
+ "/usr/sbin/auditd",
+ "/usr/sbin/ausearch",
+ "/usr/sbin/aureport",
+ "/usr/sbin/autrace",
+ "/usr/sbin/augenrules" ) %}}
+
+if grep -i '^.*{{{file}}}.*$' {{{ configFile }}}; then
+sed -i "s#.*{{{file}}}.*#{{{file}}} {{{ configString }}}#" {{{ configFile }}}
+else
+echo "{{{ file }}} {{{ configString }}}" >> {{{ configFile }}}
+fi
+{{% endfor %}}
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
index 32e6325a3ab..22c6276a1f5 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
@@ -8,13 +8,19 @@
<criterion comment="ausearch is checked in /etc/aide.conf" test_ref="test_aide_verify_ausearch" />
<criterion comment="aureport is checked in /etc/aide.conf" test_ref="test_aide_verify_aureport" />
<criterion comment="autrace is checked in /etc/aide.conf" test_ref="test_aide_verify_autrace" />
+ {{% if 'rhel' not in product %}}
<criterion comment="audispd is checked in /etc/aide.conf" test_ref="test_aide_verify_audispd" />
+ {{% endif %}}
<criterion comment="augenrules is checked in /etc/aide.conf" test_ref="test_aide_verify_augenrules" />
</criteria>
</definition>
<ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
+ {{% if 'rhel' not in product %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
+ {{% else %}}
+ <ind:subexpression operation="pattern match">p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512</ind:subexpression>
+ {{% endif %}}
</ind:textfilecontent54_state>
<ind:textfilecontent54_test id="test_aide_verify_auditctl"
@@ -95,6 +101,20 @@
<ind:instance datatype="int" operation="equals">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_test id="test_aide_verify_rsyslogd"
+ comment="rsyslogd is checked in /etc/aide.conf" check="all"
+ check_existence="all_exist" version="1">
+ <ind:object object_ref="object_aide_verify_rsyslogd" />
+ <ind:state state_ref="state_aide_check_attributes" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_aide_verify_rsyslogd"
+ version="1">
+ <ind:filepath>/etc/aide.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
+ <ind:instance datatype="int" operation="equals">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+
<ind:textfilecontent54_test id="test_aide_verify_augenrules"
comment="augenrules is checked in /etc/aide.conf" check="all"
check_existence="all_exist" version="1">
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
index 126ee756cc0..17a95bf4b31 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
@@ -1,11 +1,11 @@
documentation_complete: true
-prodtype: sle12,sle15,ubuntu2004
+prodtype: sle12,sle15,ubuntu2004,rhel8,fedora
title: 'Configure AIDE to Verify the Audit Tools'
description: |-
- The SUSE operating system file integrity tool must be configured to protect the integrity of the audit tools.
+ The operating system file integrity tool must be configured to protect the integrity of the audit tools.
rationale: |-
Protecting the integrity of the tools used for auditing purposes is a
@@ -31,32 +31,40 @@ rationale: |-
severity: medium
identifiers:
+ cce@rhel8: CCE-85964-5
cce@sle12: CCE-83204-8
cce@sle15: CCE-85610-4
references:
disa: CCI-001496
- nist@sle12: AU-9(3),AU-9(3).1
+ nist: AU-9(3),AU-9(3).1
srg: SRG-OS-000278-GPOS-00108
+ stigid@rhel8: RHEL-08-030650
stigid@sle12: SLES-12-010540
stigid@sle15: SLES-15-030630
stigid@ubuntu2004: UBTU-20-010205
ocil_clause: 'integrity checks of the audit tools are missing or incomplete'
+{{% if 'rhel' not in product %}}
+{{% set aide_string = 'p+i+n+u+g+s+b+acl+selinux+xattrs+sha512' %}}
+{{% else %}}
+{{% set aide_string = 'p+i+n+u+g+s+b+acl+xattrs+sha512' %}}
+{{% endif %}}
+
ocil: |-
Check that AIDE is properly configured to protect the integrity of the
audit tools by running the following command:
<pre># sudo cat /etc/aide.conf | grep /usr/sbin/au
- /usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
- /usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</pre>
+ /usr/sbin/auditctl {{{ aide_string }}}
+ /usr/sbin/auditd {{{ aide_string }}}
+ /usr/sbin/ausearch {{{ aide_string }}}
+ /usr/sbin/aureport {{{ aide_string }}}
+ /usr/sbin/autrace {{{ aide_string }}}
+ {{% if 'rhel' not in product %}}/usr/sbin/audispd {{{ aide_string }}}{{% endif %}}
+ /usr/sbin/augenrules {{{ aide_string }}}</pre>
If AIDE is configured properly to protect the integrity of the audit tools,
all lines listed above will be returned from the command.
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
new file mode 100644
index 00000000000..756b88d8a23
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora
+
+
+yum -y install aide
+aide --init
+
+
+declare -a bins
+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
+
+for theFile in "${bins[@]}"
+do
+ echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf
+done
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
new file mode 100644
index 00000000000..f3a2a126d3d
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora
+
+yum -y install aide
+
+declare -a bins
+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
+
+for theFile in "${bins[@]}"
+do
+ echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> /etc/aide.conf
+done
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
new file mode 100644
index 00000000000..4315cef2073
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora
+
+
+yum -y install aide
+aide --init
+
+declare -a bins
+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
+
+for theFile in "${bins[@]}"
+do
+ echo sed -i "s#^.*${theFile}.*##g" /etc/aide.conf
+done
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 7270a8f91f2..6b3232a9e00 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -822,6 +822,7 @@ selections:
# RHEL-08-030640
# RHEL-08-030650
+ - aide_check_audit_tools
# RHEL-08-030660
- auditd_audispd_configure_sufficiently_large_partition
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 665f903ead4..ff557cc2323 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -97,7 +97,6 @@ CCE-85960-3
CCE-85961-1
CCE-85962-9
CCE-85963-7
-CCE-85964-5
CCE-85965-2
CCE-85966-0
CCE-85967-8
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 7d59cfff625..692a1690b19 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -60,6 +60,7 @@ selections:
- accounts_user_home_paths_only
- accounts_user_interactive_home_directory_defined
- accounts_user_interactive_home_directory_exists
+- aide_check_audit_tools
- aide_scan_notification
- aide_verify_acls
- aide_verify_ext_attributes
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 2c2daad6f6d..cf119c02a17 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -71,6 +71,7 @@ selections:
- accounts_user_home_paths_only
- accounts_user_interactive_home_directory_defined
- accounts_user_interactive_home_directory_exists
+- aide_check_audit_tools
- aide_scan_notification
- aide_verify_acls
- aide_verify_ext_attributes

241
SOURCES/scap-security-guide-0.1.58-RHEL_08_030700-PR_7264.patch
View File

@ -1,241 +0,0 @@
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
new file mode 100644
index 0000000000..4f88ed361d
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
@@ -0,0 +1,8 @@
+# platform = multi_platform_fedora,multi_platform_rhel
+
+{{{ ansible_set_config_file(file="/etc/audit/auditd.conf",
+ parameter="overflow_action",
+ value="syslog",
+ separator="=",
+ separator_regex="=",
+ prefix_regex="^\s*") }}}
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh
new file mode 100644
index 0000000000..539b9b6582
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh
@@ -0,0 +1,12 @@
+# platform = multi_platform_fedora,multi_platform_rhel
+# reboot = true
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{{set_config_file(path="/etc/audit/auditd.conf",
+ parameter="overflow_action",
+ value="syslog",
+ separator="=",
+ separator_regex="=",
+ prefix_regex="^\s*")}}}
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml
new file mode 100644
index 0000000000..fd45280e4e
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml
@@ -0,0 +1,6 @@
+{{{ oval_check_config_file(
+ path="/etc/audit/auditd.conf",
+ prefix_regex="^(?:.*\\n)*\s*",
+ parameter="overflow_action",
+ value="syslog|single|halt",
+ separator_regex="\s*=\s*") }}}
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
new file mode 100644
index 0000000000..d41ca00076
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+title: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full
+
+description: |-
+ The audit system should have an action setup in the event the internal event queue becomes full.
+ To setup an overflow action edit <tt>/etc/audit/auditd.conf</tt>. Set <tt>overflow_action</tt>
+ to one of the following values: <tt>syslog</tt>, <tt>single</tt>, <tt>halt</tt>.
+
+
+rationale: |-
+ The audit system should have an action setup in the event the internal event queue becomes full
+ so that no data is lost.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85889-4
+
+references:
+ disa: CCI-001851
+ nist: AU-4(1)
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
+ stigid@rhel8: RHEL-08-030700
+
+ocil_clause: 'auditd overflow action is not setup correctly'
+
+ocil: |-
+ Verify the audit system is configured to take an appropriate action when the internal event queue is full:
+ <pre>$ sudo grep -i overflow_action /etc/audit/auditd.conf</pre>
+
+ The output should contain be like <tt>overflow_action = syslog</tt>
+
+ If the value of the "overflow_action" option is not set to <tt>syslog</tt>,
+ <tt>single</tt>, <tt>halt</tt> or the line is commented out, ask the System Administrator
+ to indicate how the audit logs are off-loaded to a different system or media.
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh
new file mode 100644
index 0000000000..ec7525b195
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+echo "# overflow_action = syslog" >> /etc/audit/auditd.conf
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh
new file mode 100644
index 0000000000..e4d173ab37
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+if [[ -f $config_file ]]; then
+ echo '' > $config_file
+fi
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh
new file mode 100644
index 0000000000..f26cd7cddf
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+config_file=/etc/audit/auditd.conf
+
+if [[ -f $config_file ]]; then
+ rm -f $config_file
+fi
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh
new file mode 100644
index 0000000000..0ec591b25b
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+echo "overflow_action = halt" >> /etc/audit/auditd.conf
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh
new file mode 100644
index 0000000000..236ad543fe
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+echo "overflow_action = ignore" >> /etc/audit/auditd.conf
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh
new file mode 100644
index 0000000000..74efdcafee
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+config_file=/etc/audit/auditd.conf
+sed -i "s/^.*overflow_action.*$//" $config_file
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh
new file mode 100644
index 0000000000..de11126320
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Use this script to ensure the audit directory structure and audit conf file
+# exist in the test env.
+config_file=/etc/audit/auditd.conf
+
+# Ensure directory structure exists (useful for container based testing)
+test -d /etc/audit/ || mkdir -p /etc/audit/
+
+test -f $config_file || touch $config_file
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh
new file mode 100644
index 0000000000..f9fa7a935c
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+echo "overflow_action = single" >> /etc/audit/auditd.conf
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh
new file mode 100644
index 0000000000..1c625fb752
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Ensure test system has proper directories/files for test scenario
+bash -x setup.sh
+
+echo "overflow_action = syslog" >> /etc/audit/auditd.conf
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 6372d13cfc..5cac78e00d 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -826,6 +826,7 @@ selections:
- rsyslog_remote_loghost
# RHEL-08-030700
+ - auditd_overflow_action
# RHEL-08-030710
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 24e8149168..b3d9596e1f 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -27,7 +27,6 @@ CCE-85885-2
CCE-85886-0
CCE-85887-8
CCE-85888-6
-CCE-85889-4
CCE-85890-2
CCE-85891-0
CCE-85892-8
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 32f1a24a7a..c9d23ed1dc 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -73,6 +73,7 @@ selections:
- auditd_local_events
- auditd_log_format
- auditd_name_format
+- auditd_overflow_action
- banner_etc_issue
- bios_enable_execution_restrictions
- chronyd_client_only
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index d6a27c67dc..7303145141 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -84,6 +84,7 @@ selections:
- auditd_local_events
- auditd_log_format
- auditd_name_format
+- auditd_overflow_action
- banner_etc_issue
- bios_enable_execution_restrictions
- chronyd_client_only

480
SOURCES/scap-security-guide-0.1.58-RHEL_08_030710-PR_7268.patch
View File

@ -1,480 +0,0 @@
From 2f38b61e9b6b26dab05443a9bf03642971cbeeef Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Fri, 23 Jul 2021 16:32:15 -0500
Subject: [PATCH] Add new rule for RHEL-08-030710
---
.../ansible/shared.yml | 5 +++
.../bash/shared.sh | 6 +++
.../oval/shared.xml | 44 +++++++++++++++++++
.../rule.yml | 38 ++++++++++++++++
.../tests/default_no_pass.fail.sh | 7 +++
.../tests/rsyslog.pass.sh | 4 ++
.../tests/rsyslog_wrong_value.fail.sh | 4 ++
.../tests/rsyslogd.pass.sh | 4 ++
.../tests/rsyslogd_wrong_value.fail.sh | 4 ++
.../tests/setup.sh | 9 ++++
.../ansible/shared.yml | 5 +++
.../bash/shared.sh | 5 +++
.../oval/shared.xml | 44 +++++++++++++++++++
.../rule.yml | 38 ++++++++++++++++
.../tests/default_no_pass.fail.sh | 7 +++
.../tests/rsyslog.pass.sh | 4 ++
.../tests/rsyslog_wrong_value.fail.sh | 4 ++
.../tests/rsyslogd.pass.sh | 4 ++
.../tests/rsyslogd_wrong_value.fail.sh | 4 ++
.../tests/setup.sh | 9 ++++
products/rhel8/profiles/stig.profile | 2 +
shared/references/cce-redhat-avail.txt | 2 -
.../data/profile_stability/rhel8/stig.profile | 2 +
.../profile_stability/rhel8/stig_gui.profile | 2 +
24 files changed, 255 insertions(+), 2 deletions(-)
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
new file mode 100644
index 0000000000..2d6c5227a8
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
@@ -0,0 +1,5 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+
+{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
+ parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
+}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
new file mode 100644
index 0000000000..36853d1786
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+
+{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
+ parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
+}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
new file mode 100644
index 0000000000..d21f8af1e4
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
@@ -0,0 +1,44 @@
+
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
+ <criteria operator="AND">
+ <criteria operator="OR">
+ <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
+ <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
+ </criteria>
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" version="1">
+
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog"
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
+ version="1">
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" version="1">
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir"
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d"
+ version="1">
+ <ind:path>/etc/rsyslog.d</ind:path>
+ <ind:filename operation="pattern match">^.*conf$</ind:filename>
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
new file mode 100644
index 0000000000..1bcc33927b
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
@@ -0,0 +1,38 @@
+documentation_complete: true
+
+title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
+
+description: |-
+ Rsyslogd is a system utility providing support for message logging. Support
+ for both internet and UNIX domain sockets enables this utility to support both local
+ and remote logging. Couple this utility with <tt>gnutls</tt> (which is a secure communications
+ library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
+ encrypt and off-load auditing.
+
+ When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
+
+rationale: |-
+ The audit records generated by Rsyslog contain valuable information regarding system
+ configuration, user authentication, and other such information. Audit records should be
+ protected from unauthorized access.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-86098-1
+
+references:
+ disa: CCI-001851
+ nist: AU-4(1)
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
+ stigid@rhel8: RHEL-08-030710
+
+ocil_clause: 'rsyslogd ActionSendStreamDriverMode not set to 1'
+
+ocil: |-
+ Verify the operating system encrypts audit records off-loaded onto a different system
+ or media from the system being audited with the following commands:
+
+ <pre>$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
+ The output should be
+ <pre>/etc/rsyslog.conf:$ActionSendStreamDriverMode 1</pre>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
new file mode 100644
index 0000000000..3ee5384371
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+bash -x setup.sh
+
+if [[ -f encrypt.conf ]]; then
+ sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.d/encrypt.conf
+fi
+ sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
new file mode 100644
index 0000000000..34105aaa85
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
new file mode 100644
index 0000000000..db87b2956c
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
new file mode 100644
index 0000000000..25e7cdf783
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
new file mode 100644
index 0000000000..d37882acf3
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
new file mode 100644
index 0000000000..9686f16bcc
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Use this script to ensure the rsyslog directory structure and rsyslog conf file
+# exist in the test env.
+config_file=/etc/rsyslog.conf
+
+# Ensure directory structure exists (useful for container based testing)
+test -f $config_file || touch $config_file
+
+test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
new file mode 100644
index 0000000000..2ddbfb871f
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
@@ -0,0 +1,5 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+
+{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
+ parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
+}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
new file mode 100644
index 0000000000..3955346cd3
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
+ parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
+}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
new file mode 100644
index 0000000000..71d39c179d
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
@@ -0,0 +1,44 @@
+
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
+ <criteria operator="AND">
+ <criteria operator="OR">
+ <criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
+ test_ref="test_{{{rule_id}}}_default_netstream_rsyslog" />
+ <criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d"
+ test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_dir" />
+ </criteria>
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_default_netstream_rsyslog" version="1">
+
+ <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog"
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
+ version="1">
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_default_netstream_rsyslog_dir" version="1">
+ <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog_dir" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog_dir"
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d"
+ version="1">
+ <ind:path>/etc/rsyslog.d</ind:path>
+ <ind:filename operation="pattern match">^.*conf$</ind:filename>
+ <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
new file mode 100644
index 0000000000..eff85d3fae
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
@@ -0,0 +1,38 @@
+documentation_complete: true
+
+title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
+
+description: |-
+ Rsyslogd is a system utility providing support for message logging. Support
+ for both internet and UNIX domain sockets enables this utility to support both local
+ and remote logging. Couple this utility with <tt>gnutls</tt> (which is a secure communications
+ library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
+ encrypt and off-load auditing.
+
+ When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
+
+rationale: |-
+ The audit records generated by Rsyslog contain valuable information regarding system
+ configuration, user authentication, and other such information. Audit records should be
+ protected from unauthorized access.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85992-6
+
+references:
+ disa: CCI-001851
+ nist: AU-4(1)
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
+ stigid@rhel8: RHEL-08-030710
+
+ocil_clause: 'rsyslogd DefaultNetstreamDriver not set to gtls'
+
+ocil: |-
+ Verify the operating system encrypts audit records off-loaded onto a different system
+ or media from the system being audited with the following commands:
+
+ <pre>$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
+ The output should be
+ <pre>/etc/rsyslog.conf:$DefaultNetstreamDriver gtls</pre>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
new file mode 100644
index 0000000000..6ab43bfc0d
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+bash -x setup.sh
+
+if [[ -f encrypt.conf ]]; then
+ sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.d/encrypt.conf
+fi
+ sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
new file mode 100644
index 0000000000..40f1bfe087
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
new file mode 100644
index 0000000000..30a1d5b43a
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
new file mode 100644
index 0000000000..44715bca66
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
new file mode 100644
index 0000000000..30a1d5b43a
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
new file mode 100644
index 0000000000..9686f16bcc
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Use this script to ensure the rsyslog directory structure and rsyslog conf file
+# exist in the test env.
+config_file=/etc/rsyslog.conf
+
+# Ensure directory structure exists (useful for container based testing)
+test -f $config_file || touch $config_file
+
+test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 6372d13cfc..1cc53cf1e1 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -828,6 +828,8 @@ selections:
- auditd_overflow_action
# RHEL-08-030710
+ - rsyslog_encrypt_offload_defaultnetstreamdriver
+ - rsyslog_encrypt_offload_actionsendstreamdrivermode
# RHEL-08-030720
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 24e8149168..fdf69f6baa 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -129,7 +129,6 @@ CCE-85988-4
CCE-85989-2
CCE-85990-0
CCE-85991-8
-CCE-85992-6
CCE-85993-4
CCE-85994-2
CCE-85995-9
@@ -235,7 +234,6 @@ CCE-86094-0
CCE-86095-7
CCE-86096-5
CCE-86097-3
-CCE-86098-1
CCE-86099-9
CCE-86100-5
CCE-86101-3
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 32f1a24a7a..c0ef381696 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -228,6 +228,8 @@ selections:
- require_singleuser_auth
- root_permissions_syslibrary_files
- rsyslog_cron_logging
+- rsyslog_encrypt_offload_actionsendstreamdrivermode
+- rsyslog_encrypt_offload_defaultnetstreamdriver
- rsyslog_remote_access_monitoring
- rsyslog_remote_loghost
- security_patches_up_to_date
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index d6a27c67dc..5adeea4a35 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -239,6 +239,8 @@ selections:
- require_singleuser_auth
- root_permissions_syslibrary_files
- rsyslog_cron_logging
+- rsyslog_encrypt_offload_actionsendstreamdrivermode
+- rsyslog_encrypt_offload_defaultnetstreamdriver
- rsyslog_remote_access_monitoring
- rsyslog_remote_loghost
- security_patches_up_to_date

389
SOURCES/scap-security-guide-0.1.58-RHEL_08_030720-PR_7288.patch
View File

@ -1,389 +0,0 @@
From fbaa0ae639fbb001e4c9e92d9e35f9dd9309d605 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 9 Aug 2021 10:56:36 -0500
Subject: [PATCH 1/2] Allow set_config_file bash macro and lineinfile to set a
custom sed path separator
So that if the text has '/' in it the sed path separator can be changed.
---
.../developer/06_contributing_with_content.md | 3 +++
shared/macros-bash.jinja | 23 ++++++++++---------
shared/templates/lineinfile/bash.template | 6 ++++-
3 files changed, 20 insertions(+), 12 deletions(-)
diff --git a/docs/manual/developer/06_contributing_with_content.md b/docs/manual/developer/06_contributing_with_content.md
index 245db1550de..c0d62bef5ca 100644
--- a/docs/manual/developer/06_contributing_with_content.md
+++ b/docs/manual/developer/06_contributing_with_content.md
@@ -1572,6 +1572,9 @@ the following to `rule.yml`:
- **oval_extend_definitions** - optional, list of additional OVAL
definitions that have to pass along the generated check.
+ **sed_path_separator** - optional, default is `/`, sets the sed path separator. Set this
+ to a character like `#` if `/` is in use in your text.
+
- Languages: Ansible, Bash, OVAL
diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
index d654a0e0e89..7af8038a783 100644
--- a/shared/macros-bash.jinja
+++ b/shared/macros-bash.jinja
@@ -444,11 +444,12 @@ printf '%s\n' "{{{ message | replace('"', '\\"') }}}" >&2
# separator_regex: regular expression that describes the separator and surrounding whitespace
# prefix_regex: regular expression describing allowed leading characters at each line
#}}
-{{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*") -%}}
- {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
+
+{{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", sed_path_separator="/") -%}}
{{%- set new_line = parameter+separator+value -%}}
+ {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
if [ -e "{{{ path }}}" ] ; then
- {{{ lineinfile_absent(path, line_regex, insensitive) | indent(4) }}}
+ {{{ lineinfile_absent(path, line_regex, insensitive, sed_path_separator=sed_path_separator) | indent(4) }}}
else
{{%- if create %}}
touch "{{{ path }}}"
@@ -456,19 +457,19 @@ else
{{{ die("Path '" + path + "' wasn't found on this system. Refusing to continue.", action="return") | indent(4) }}}
{{%- endif %}}
fi
-{{{ lineinfile_present(path, new_line, insert_after, insert_before, insensitive) }}}
+{{{ lineinfile_present(path, new_line, insert_after, insert_before, insensitive, sed_path_separator=sed_path_separator) }}}
{{%- endmacro -%}}
-{{%- macro lineinfile_absent(path, regex, insensitive=true) -%}}
+{{%- macro lineinfile_absent(path, regex, insensitive=true, sed_path_separator="/") -%}}
{{%- if insensitive -%}}
{{%- set modifier="Id" -%}}
{{%- else -%}}
{{%- set modifier="d" -%}}
{{%- endif -%}}
- {{% if '/' in regex %}}
- {{{ raise("regex (" + regex + ") uses sed path separator (/) in " + rule_id) }}}
+ {{% if sed_path_separator in regex %}}
+ {{{ raise("regex (" + regex + ") uses sed path separator (" + sed_path_separator + ") in " + rule_id) }}}
{{% endif %}}
-LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
+LC_ALL=C sed -i "{{{ sed_path_separator }}}{{{ regex }}}{{{ sed_path_separator }}}{{{ modifier }}}" "{{{ path }}}"
{{%- endmacro -%}}
{{%- macro lineinfile_absent_in_directory(dirname, regex, insensitive=true) -%}}
@@ -480,7 +481,7 @@ LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ dirname }}}"/*
{{%- endmacro -%}}
-{{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true) -%}}
+{{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true, sed_path_separator="/") -%}}
{{%- if insensitive -%}}
{{%- set grep_args="-q -m 1 -i" -%}}
{{%- else -%}}
@@ -496,7 +497,7 @@ printf '%s\n' "{{{ line }}}" > "{{{ path }}}"
cat "{{{ path }}}.bak" >> "{{{ path }}}"
{{%- elif insert_after %}}
# Insert after the line matching the regex '{{{ insert_after }}}'
-line_number="$(LC_ALL=C grep -n "{{{ insert_after }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's/:.*//g')"
+line_number="$(LC_ALL=C grep -n "{{{ insert_after }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's{{{sed_path_separator}}}:.*{{{sed_path_separator}}}{{{sed_path_separator}}}g')"
if [ -z "$line_number" ]; then
# There was no match of '{{{ insert_after }}}', insert at
# the end of the file.
@@ -508,7 +509,7 @@ else
fi
{{%- elif insert_before %}}
# Insert before the line matching the regex '{{{ insert_before }}}'.
-line_number="$(LC_ALL=C grep -n "{{{ insert_before }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's/:.*//g')"
+line_number="$(LC_ALL=C grep -n "{{{ insert_before }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's{{{sed_path_separator}}}:.*{{{sed_path_separator}}}{{{sed_path_separator}}}g')"
if [ -z "$line_number" ]; then
# There was no match of '{{{ insert_before }}}', insert at
# the end of the file.
diff --git a/shared/templates/lineinfile/bash.template b/shared/templates/lineinfile/bash.template
index 0e43e88842a..6d1ca349268 100644
--- a/shared/templates/lineinfile/bash.template
+++ b/shared/templates/lineinfile/bash.template
@@ -4,4 +4,8 @@
# complexity = low
# disruption = low
-{{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*") -}}}
+{{% if SED_PATH_SEPARATOR %}}
+ {{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*", sed_path_separator=SED_PATH_SEPARATOR) -}}}
+{{% else %}}
+ {{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*") -}}}
+{{% endif %}}
From 4b3182bd5d5308fed16f58da9656aa76a4275569 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 9 Aug 2021 13:56:32 -0500
Subject: [PATCH 2/2] Add new rule for RHEL-08-030720
---
.../ansible/shared.yml | 9 ++++
.../bash/shared.sh | 11 +++++
.../oval/shared.xml | 43 +++++++++++++++++++
.../rule.yml | 40 +++++++++++++++++
.../tests/default_no_pass.fail.sh | 7 +++
.../tests/rsyslog.pass.sh | 4 ++
.../tests/rsyslog_wrong_value.fail.sh | 4 ++
.../tests/rsyslogd.pass.sh | 4 ++
.../tests/rsyslogd_wrong_value.fail.sh | 4 ++
.../tests/setup.sh | 9 ++++
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
14 files changed, 138 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
new file mode 100644
index 00000000000..637f90003b2
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
@@ -0,0 +1,9 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf",
+ "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s',
+ value="x509/name", create='yes') }}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
new file mode 100644
index 00000000000..71d312f332f
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
@@ -0,0 +1,11 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+if ! grep -s "\$ActionSendStreamDriverAuthMode\s*x509/name" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
+ mkdir -p /etc/rsyslog.d
+ sed -i '/^.*\$ActionSendStreamDriverAuthMode.*/d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
+ echo "\$ActionSendStreamDriverAuthMode x509/name" > /etc/rsyslog.d/stream_driver_auth.conf
+fi
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
new file mode 100644
index 00000000000..8e1ec48a974
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
@@ -0,0 +1,43 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
+ <criteria operator="AND">
+ <criteria operator="OR">
+ <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
+ <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
+ </criteria>
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" version="1">
+
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode"
+ comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
+ version="1">
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
+ id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" version="1">
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir"
+ comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d"
+ version="1">
+ <ind:path>/etc/rsyslog.d</ind:path>
+ <ind:filename operation="pattern match">^.*conf$</ind:filename>
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
new file mode 100644
index 00000000000..beaf8ce96da
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
@@ -0,0 +1,40 @@
+documentation_complete: true
+
+title: Ensure Rsyslog Authenticates Off-Loaded Audit Records
+
+description: |-
+ Rsyslogd is a system utility providing support for message logging. Support
+ for both internet and UNIX domain sockets enables this utility to support both local
+ and remote logging. Couple this utility with <tt>gnutls</tt> (which is a secure communications
+ library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
+ encrypt and off-load auditing.
+
+ When using <tt>rsyslogd</tt> to off-load logs the remote system must be authenticated.
+
+rationale: |-
+ The audit records generated by Rsyslog contain valuable information regarding system
+ configuration, user authentication, and other such information. Audit records should be
+ protected from unauthorized access.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-86339-9
+
+references:
+ disa: CCI-001851
+ nist: AU-4(1)
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
+ stigid@rhel8: RHEL-08-030720
+
+
+ocil_clause: '$ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name'
+
+ocil: |-
+ Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command:
+
+ <pre>$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
+ The output should be
+ <pre>$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name</pre>
+
+
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
new file mode 100644
index 00000000000..54d70f6b85f
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+bash -x setup.sh
+
+if [[ -f encrypt.conf ]]; then
+ sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
+fi
+ sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
new file mode 100644
index 00000000000..fe3db6f9c41
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
new file mode 100644
index 00000000000..bad06fba0e9
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverAuthMode 0" >> /etc/rsyslog.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
new file mode 100644
index 00000000000..ab511daecc7
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
new file mode 100644
index 00000000000..02bf64747a7
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+bash -x setup.sh
+
+echo "\$ActionSendStreamDriverAuthMode x509/certvalid" >> /etc/rsyslog.d/encrypt.conf
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
new file mode 100644
index 00000000000..9686f16bcc9
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Use this script to ensure the rsyslog directory structure and rsyslog conf file
+# exist in the test env.
+config_file=/etc/rsyslog.conf
+
+# Ensure directory structure exists (useful for container based testing)
+test -f $config_file || touch $config_file
+
+test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index ec0a3b17537..382247057cd 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -854,6 +854,7 @@ selections:
- rsyslog_encrypt_offload_actionsendstreamdrivermode
# RHEL-08-030720
+ - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
# RHEL-08-030730
# this rule expects configuration in MB instead percentage as how STIG demands
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 61384c108a0..03211442aba 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -460,7 +460,6 @@ CCE-86335-7
CCE-86336-5
CCE-86337-3
CCE-86338-1
-CCE-86339-9
CCE-86340-7
CCE-86341-5
CCE-86342-3
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index bffa509b698..481e7b28228 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -238,6 +238,7 @@ selections:
- require_singleuser_auth
- root_permissions_syslibrary_files
- rsyslog_cron_logging
+- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
- rsyslog_encrypt_offload_actionsendstreamdrivermode
- rsyslog_encrypt_offload_defaultnetstreamdriver
- rsyslog_remote_access_monitoring
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index c84ac75c7bf..7fb3d892a30 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -249,6 +249,7 @@ selections:
- require_singleuser_auth
- root_permissions_syslibrary_files
- rsyslog_cron_logging
+- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
- rsyslog_encrypt_offload_actionsendstreamdrivermode
- rsyslog_encrypt_offload_defaultnetstreamdriver
- rsyslog_remote_access_monitoring

357
SOURCES/scap-security-guide-0.1.58-RHEL_08_030730-PR_7323.patch
View File

@ -1,357 +0,0 @@
From 2f4ddb4297f2a14e2bde3b32f76347e2bbe2cb2d Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 19 Aug 2021 09:47:42 -0500
Subject: [PATCH] Add new rule for RHEL-07-030330 and RHEL-08-030730
This new rule is copy of auditd_data_retention_space_left, but
setup to allow for percentages.
---
.../auditd_data_retention_space_left/rule.yml | 2 -
.../ansible/shared.yml | 15 ++++++
.../bash/shared.sh | 7 +++
.../oval/shared.xml | 32 +++++++++++++
.../rule.yml | 47 +++++++++++++++++++
.../tests/no_percent_sign.fail.sh | 6 +++
.../space_left_greater_than_minimum.pass.sh | 6 +++
.../tests/space_left_minimum_value.pass.sh | 6 +++
.../tests/space_left_not_enough.fail.sh | 6 +++
.../tests/space_left_not_there.fail.sh | 6 +++
.../var_auditd_space_left_percentage.var | 15 ++++++
products/rhel7/profiles/stig.profile | 3 +-
products/rhel8/profiles/stig.profile | 7 +--
shared/references/cce-redhat-avail.txt | 2 -
.../data/profile_stability/rhel8/stig.profile | 3 +-
.../profile_stability/rhel8/stig_gui.profile | 3 +-
16 files changed, 156 insertions(+), 10 deletions(-)
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
index 7fd0470df8..a652d15d0d 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
@@ -39,8 +39,6 @@ references:
pcidss: Req-10.7
srg: SRG-OS-000343-GPOS-00134
stigid@ol7: OL07-00-030330
- stigid@rhel7: RHEL-07-030330
- stigid@rhel8: RHEL-08-030730
stigid@sle12: SLES-12-020030
stigid@sle15: SLES-15-030700
stigid@ubuntu2004: UBTU-20-010217
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
new file mode 100644
index 0000000000..ea52773bd3
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
@@ -0,0 +1,15 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+{{{ ansible_instantiate_variables("var_auditd_space_left_percentage") }}}
+
+- name: Configure auditd space_left on Low Disk Space
+ lineinfile:
+ dest: /etc/audit/auditd.conf
+ line: "space_left = {{ var_auditd_space_left_percentage }}%"
+ regexp: '^\s*space_left\s*=\s*.*$'
+ state: present
+ create: yes
+ #notify: reload auditd
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
new file mode 100644
index 0000000000..6cc3e9ecbe
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_all
+. /usr/share/scap-security-guide/remediation_functions
+{{{ bash_instantiate_variables("var_auditd_space_left_percentage") }}}
+
+grep -q "^space_left[[:space:]]*=.*$" /etc/audit/auditd.conf && \
+ sed -i "s/^space_left[[:space:]]*=.*$/space_left = $var_auditd_space_left_percentage%/g" /etc/audit/auditd.conf || \
+ echo "space_left = $var_auditd_space_left_percentage%" >> /etc/audit/auditd.conf
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
new file mode 100644
index 0000000000..2fcd222d29
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
@@ -0,0 +1,32 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="2">
+ {{{ oval_metadata("space_left setting in /etc/audit/auditd.conf is set to at least a certain value") }}}
+
+ <criteria>
+ <criterion comment="space_left setting in auditd.conf" test_ref="test_auditd_data_retention_space_left_percentage" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_space_left_percentage" version="1">
+ <ind:object object_ref="object_auditd_data_retention_space_left_percentage" />
+ <ind:state state_ref="state_auditd_data_retention_space_left_percentage" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_percentage" version="2">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
+ <!-- Require at least one space before and after the equal sign -->
+ <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_space_left_percentage" version="1">
+ <ind:subexpression operation="greater than or equal" var_ref="var_auditd_space_left_percentage" datatype="int" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit space_left setting" datatype="int" id="var_auditd_space_left_percentage" version="1" />
+
+
+</def-group>
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
new file mode 100644
index 0000000000..ea9d9fcc6b
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
@@ -0,0 +1,47 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9
+
+title: 'Configure auditd space_left on Low Disk Space'
+
+description: |-
+ The <tt>auditd</tt> service can be configured to take an action
+ when disk space is running low but prior to running out of space completely.
+ Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
+ substituting <i>PERCENTAGE</i> appropriately:
+ <pre>space_left = <i>PERCENTAGE</i>%</pre>
+ Set this value to at least 25 to cause the system to
+ notify the user of an issue.
+
+rationale: |-
+ Notifying administrators of an impending disk space problem may allow them to
+ take corrective action prior to any disruption.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-86056-9
+ cce@rhel8: CCE-86055-1
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8
+ cobit5: APO11.04,APO12.06,APO13.01,BAI03.05,BAI04.04,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,MEA02.01
+ disa: CCI-001855
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 6.1,SR 7.1,SR 7.2'
+ iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.16.1.4,A.16.1.5,A.16.1.7,A.17.2.1
+ nist: AU-5(b),AU-5(2),AU-5(1),AU-5(4),CM-6(a)
+ nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.7
+ srg: SRG-OS-000343-GPOS-00134
+ stigid@rhel7: RHEL-07-030330
+ stigid@rhel8: RHEL-08-030730
+ vmmsrg: SRG-OS-000343-VMM-001240
+
+ocil_clause: 'the system is not configured with a specific percentage to notify administrators of an issue'
+
+ocil: |-
+ Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
+ determine if the system is configured correctly:
+ <pre>space_left <i>PERCENTAGE</i>%</pre>
+
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
new file mode 100644
index 0000000000..2e90ce1d7b
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# variables = var_auditd_space_left_percentage=25
+
+. $SHARED/auditd_utils.sh
+prepare_auditd_test_enviroment
+set_parameters_value /etc/audit/auditd.conf "space_left" "25"
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
new file mode 100644
index 0000000000..135d6e4258
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# variables = var_auditd_space_left_percentage=25
+
+. $SHARED/auditd_utils.sh
+prepare_auditd_test_enviroment
+set_parameters_value /etc/audit/auditd.conf "space_left" "35%"
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
new file mode 100644
index 0000000000..10d652e80e
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# variables = var_auditd_space_left_percentage=25
+
+. $SHARED/auditd_utils.sh
+prepare_auditd_test_enviroment
+set_parameters_value /etc/audit/auditd.conf "space_left" "25%"
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
new file mode 100644
index 0000000000..0bf7694b15
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# variables = var_auditd_space_left_percentage=25
+
+. $SHARED/auditd_utils.sh
+prepare_auditd_test_enviroment
+set_parameters_value /etc/audit/auditd.conf "space_left" "15%"
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
new file mode 100644
index 0000000000..34ac5595c6
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# variables = var_auditd_space_left_percentage=25
+
+. $SHARED/auditd_utils.sh
+prepare_auditd_test_enviroment
+delete_parameter /etc/audit/auditd.conf "space_left"
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var b/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
new file mode 100644
index 0000000000..427a1d4bfa
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
@@ -0,0 +1,15 @@
+documentation_complete: true
+
+title: 'The percentage remaining in disk space before prompting space_left_action'
+
+description: 'The setting for space_left as a percentage in /etc/audit/auditd.conf'
+
+type: number
+
+interactive: true
+
+options:
+ 25pc: 25
+ 50pc: 50
+ 75pc: 75
+ default: 25
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index 9ca1360005..67e22982cd 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -50,6 +50,7 @@ selections:
- var_removable_partition=dev_cdrom
- var_auditd_action_mail_acct=root
- var_auditd_space_left_action=email
+ - var_auditd_space_left_percentage=25pc
- var_accounts_user_umask=077
- var_password_pam_retry=3
- var_accounts_max_concurrent_login_sessions=10
@@ -178,8 +179,8 @@ selections:
- auditd_audispd_configure_remote_server
- auditd_audispd_encrypt_sent_records
- auditd_audispd_disk_full_action
- - auditd_data_retention_space_left
- auditd_data_retention_space_left_action
+ - auditd_data_retention_space_left_percentage
- auditd_data_retention_action_mail_acct
- audit_rules_suid_privilege_function
- audit_rules_dac_modification_chown
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 36f384621a..10dbc1501b 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -65,7 +65,7 @@ selections:
- var_auditd_action_mail_acct=root
- var_time_service_set_maxpoll=18_hours
- var_accounts_maximum_age_login_defs=60
- - var_auditd_space_left=250MB
+ - var_auditd_space_left_percentage=25pc
- var_auditd_space_left_action=email
- var_auditd_disk_error_action=halt
- var_auditd_max_log_file_action=syslog
@@ -922,8 +922,9 @@ selections:
- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
# RHEL-08-030730
- # this rule expects configuration in MB instead percentage as how STIG demands
- # - auditd_data_retention_space_left
+ - auditd_data_retention_space_left_percentage
+
+ # RHEL-08-030731
- auditd_data_retention_space_left_action
# RHEL-08-030740
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 6c33c2e85f..fcb8125ca4 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -170,8 +170,6 @@ CCE-86051-0
CCE-86052-8
CCE-86053-6
CCE-86054-4
-CCE-86055-1
-CCE-86056-9
CCE-86057-7
CCE-86058-5
CCE-86059-3
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index f3e6c4fa1a..09a5bc3174 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -140,6 +140,7 @@ selections:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_max_log_file_action
- auditd_data_retention_space_left_action
+- auditd_data_retention_space_left_percentage
- auditd_local_events
- auditd_log_format
- auditd_name_format
@@ -422,7 +423,7 @@ selections:
- var_auditd_action_mail_acct=root
- var_time_service_set_maxpoll=18_hours
- var_accounts_maximum_age_login_defs=60
-- var_auditd_space_left=250MB
+- var_auditd_space_left_percentage=25pc
- var_auditd_space_left_action=email
- var_auditd_disk_error_action=halt
- var_auditd_max_log_file_action=syslog
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index b5b60349a8..5b631a3fe0 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -151,6 +151,7 @@ selections:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_max_log_file_action
- auditd_data_retention_space_left_action
+- auditd_data_retention_space_left_percentage
- auditd_local_events
- auditd_log_format
- auditd_name_format
@@ -432,7 +433,7 @@ selections:
- var_auditd_action_mail_acct=root
- var_time_service_set_maxpoll=18_hours
- var_accounts_maximum_age_login_defs=60
-- var_auditd_space_left=250MB
+- var_auditd_space_left_percentage=25pc
- var_auditd_space_left_action=email
- var_auditd_disk_error_action=halt
- var_auditd_max_log_file_action=syslog

66
SOURCES/scap-security-guide-0.1.58-RHEL_08_040286-PR_7354.patch
View File

@ -1,66 +0,0 @@
From 994b50e9a47e222c2a27fde231cbf3e2f6f77aed Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Fri, 6 Aug 2021 15:26:28 -0500
Subject: [PATCH] Select sysctl_net_core_bpf_jit_harden for RHEL-08-040286
---
.../restrictions/sysctl_net_core_bpf_jit_harden/rule.yml | 3 +++
products/rhel8/profiles/stig.profile | 3 +++
tests/data/profile_stability/rhel8/stig.profile | 1 +
tests/data/profile_stability/rhel8/stig_gui.profile | 1 +
4 files changed, 8 insertions(+)
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
index 9a1096cc72..31b7183b87 100644
--- a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
@@ -19,8 +19,11 @@ identifiers:
cce@rhel9: CCE-83966-2
references:
+ disa: CCI-000366
+ nist: CM-6b
ospp: FMT_SMF_EXT.1
srg: SRG-OS-000480-GPOS-00227
+ stigid@rhel8: RHEL-08-040286
{{{ complete_ocil_entry_sysctl_option_value(sysctl="net.core.bpf_jit_harden", value="2") }}}
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 0a1fdd15ca..a358f61dba 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1149,6 +1149,9 @@ selections:
# RHEL-08-040285
- sysctl_net_ipv4_conf_all_rp_filter
+ # RHEL-08-040286
+ - sysctl_net_core_bpf_jit_harden
+
# RHEL-08-040290
# /etc/postfix/main.cf does not exist on default installation resulting in error during remediation
# there needs to be a new platform check to identify when postfix is installed or not
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index d7e2f71376..7d54a7505f 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -359,6 +359,7 @@ selections:
- sysctl_kernel_randomize_va_space
- sysctl_kernel_unprivileged_bpf_disabled
- sysctl_kernel_yama_ptrace_scope
+- sysctl_net_core_bpf_jit_harden
- sysctl_net_ipv4_conf_all_accept_redirects
- sysctl_net_ipv4_conf_all_accept_source_route
- sysctl_net_ipv4_conf_all_rp_filter
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 7c95e31545..97291230e7 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -370,6 +370,7 @@ selections:
- sysctl_kernel_randomize_va_space
- sysctl_kernel_unprivileged_bpf_disabled
- sysctl_kernel_yama_ptrace_scope
+- sysctl_net_core_bpf_jit_harden
- sysctl_net_ipv4_conf_all_accept_redirects
- sysctl_net_ipv4_conf_all_accept_source_route
- sysctl_net_ipv4_conf_all_rp_filter

121
SOURCES/scap-security-guide-0.1.58-add_RHEL_08_020240-PR_7330.patch
View File

@ -1,121 +0,0 @@
From 3d24d93e200f53f3845fffbc8764b8e48517c7b2 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Wed, 4 Aug 2021 16:57:50 +0200
Subject: [PATCH] Assign RHEL-08-020240 to account_unique_id and add test
scenarios.
---
.../accounts-restrictions/account_unique_id/oval/shared.xml | 2 +-
.../accounts-restrictions/account_unique_id/rule.yml | 4 +++-
.../account_unique_id/tests/correct_value.pass.sh | 2 ++
.../account_unique_id/tests/wrong_value.fail.sh | 5 +++++
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
tests/data/profile_stability/rhel8/stig.profile | 1 +
tests/data/profile_stability/rhel8/stig_gui.profile | 1 +
8 files changed, 14 insertions(+), 3 deletions(-)
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
index be45c518115..491ad4587ee 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
@@ -7,7 +7,7 @@
</definition>
- <!-- collect informatino about all users -->
+ <!-- collect information about all users -->
<unix:password_object id="obj_all_uids" version="1">
<unix:username operation="pattern match">.*</unix:username>
</unix:password_object>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
index 731632f7f5a..e55901dbdc5 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
@@ -12,6 +12,7 @@ severity: medium
identifiers:
cce@rhel7: CCE-85857-1
+ cce@rhel8: CCE-89903-9
cce@sle12: CCE-83196-6
cce@sle15: CCE-83277-4
@@ -19,7 +20,8 @@ references:
cis@rhel7: 6.2.7
disa: CCI-000764,CCI-000804
nist@sle12: IA-2,IA-2.1,IA-8,IA-8.1
- srg: SRG-OS-000104-GPOS-00051,SRG-OS-000121-GPOS-00062
+ srg: SRG-OS-000104-GPOS-00051,SRG-OS-000121-GPOS-00062,SRG-OS-000042-GPOS-00020
+ stigid@rhel8: RHEL-08-020240
stigid@sle12: SLES-12-010640
stigid@sle15: SLES-15-010230
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..645c46eb847
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+# remediation = none
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..cc7f2215041
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# remediation = none
+
+echo "test_user:x:30090:30090:Test User:/home/test_user:/usr/bin/bash" >> /etc/passwd
+echo "test_user_2:x:30090:30090:Test User 2:/home/test_user_2:/usr/bin/bash" >> /etc/passwd
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index ec0a3b17537..bdddfef846f 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -552,6 +552,7 @@ selections:
- accounts_password_minlen_login_defs
# RHEL-08-020240
+ - account_unique_id
# RHEL-08-020250
- sssd_enable_smartcards
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 61384c108a0..1d54e8ec15f 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -3969,7 +3969,6 @@ CCE-89899-9
CCE-89900-5
CCE-89901-3
CCE-89902-1
-CCE-89903-9
CCE-89904-7
CCE-89905-4
CCE-89906-2
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index bffa509b698..71dd6330a16 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -26,6 +26,7 @@ selections:
- account_disable_post_pw_expiration
- account_emergency_expire_date
- account_temp_expire_date
+- account_unique_id
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay
- accounts_max_concurrent_login_sessions
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index c84ac75c7bf..3e788b27bac 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -37,6 +37,7 @@ selections:
- account_disable_post_pw_expiration
- account_emergency_expire_date
- account_temp_expire_date
+- account_unique_id
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay
- accounts_max_concurrent_login_sessions

80
SOURCES/scap-security-guide-0.1.58-add_missing_unit_test_playbook-PR_7431.patch
View File

@ -1,80 +0,0 @@
From 86dad83f4e6c5b823882ec736d27410570f5b69a Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Fri, 20 Aug 2021 16:03:33 +0200
Subject: [PATCH] Add missing unit test playbook
The playbook is used on
test-function-check_playbook_file_removed_and_added
---
.../file_block_removed_and_not_added.yml | 62 +++++++++++++++++++
1 file changed, 62 insertions(+)
create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
new file mode 100644
index 0000000000..8391d1bc99
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
@@ -0,0 +1,62 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - block:
+ - name: Remove Rsh Trust Files
+ file:
+ path: '/root/shosts.equiv'
+ state: absent
+ tags:
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+ - no_rsh_trust_files
+ - restrict_strategy
+

179
SOURCES/scap-security-guide-0.1.58-add_rhel_minor_check-PR_7251.patch
View File

@ -1,179 +0,0 @@
From b814fc94d0fb360ef53a6b735e9520df5b484589 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 14 Jul 2021 12:52:13 -0500
Subject: [PATCH 1/3] Add Jinja-based RHEL 8 minor check
---
shared/checks/oval/installed_OS_is_rhel8.xml | 29 ++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/shared/checks/oval/installed_OS_is_rhel8.xml b/shared/checks/oval/installed_OS_is_rhel8.xml
index a9699411ce7..fdd3c870d43 100644
--- a/shared/checks/oval/installed_OS_is_rhel8.xml
+++ b/shared/checks/oval/installed_OS_is_rhel8.xml
@@ -44,6 +44,35 @@
<linux:name>redhat-release</linux:name>
</linux:rpminfo_object>
+ {{% for minorversion in range(0, 9) %}}
+ <definition class="inventory" id="installed_OS_is_rhel8_{{{ minorversion }}}" version="1">
+ <metadata>
+ <title>Red Hat Enterprise Linux 8.{{{ minorversion }}}</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 8.{{{ minorversion }}}</platform>
+ </affected>
+ <reference ref_id="cpe:/o:redhat:enterprise_linux:8.{{{ minorversion }}}" source="CPE" />
+ <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{ minorversion}}}</description>
+ </metadata>
+ </definition>
+
+ <criteria>
+ <criterion comment="RHEL.{{{ minorversion }}} 8 is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
+ </criteria>
+
+ <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.{{{ minorversion }}}"
+ id="test_rhel8_{{{ minorversion }}}" version="1">
+ <linux:object object_ref="obj_rhel8_{{{ minorversion }}}" />
+ <linux:state state_ref="state_rhel8_{{{ minorversion }}}" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_state id="state_rhel8_{{{ minorversion }}}" version="1">
+ <linux:version operation="pattern match">^8.{{{ minorversion }}}*$</linux:version>
+ </linux:rpminfo_state>
+ <linux:rpminfo_object id="obj_rhel8_{{{ minorversion }}}" version="1">
+ <linux:name>redhat-release</linux:name>
+ </linux:rpminfo_object>
+ {{% endfor %}}
+
<ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="test_rhevh_rhel8_version" version="1">
<ind:object object_ref="obj_rhevh_rhel8_version" />
<ind:state state_ref="state_rhevh_rhel8_version" />
From d37d303654be74758c19615ef027b3bafa2d7217 Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Wed, 14 Jul 2021 15:30:02 -0400
Subject: [PATCH 2/3] Adding cpe's to product.yml
---
products/rhel8/product.yml | 45 ++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/products/rhel8/product.yml b/products/rhel8/product.yml
index 3278207fcb4..14336bfddf1 100644
--- a/products/rhel8/product.yml
+++ b/products/rhel8/product.yml
@@ -27,6 +27,51 @@ cpes:
title: "Red Hat Enterprise Linux 8"
check_id: installed_OS_is_rhel8
+ - rhel8.0:
+ name: "cpe:/o:redhat:enterprise_linux:8.0"
+ title: "Red Hat Enterprise Linux 8.0"
+ check_id: installed_OS_is_rhel8_0
+
+ - rhel8.1:
+ name: "cpe:/o:redhat:enterprise_linux:8.1"
+ title: "Red Hat Enterprise Linux 8.1"
+ check_id: installed_OS_is_rhel8_1
+
+ - rhel8.2:
+ name: "cpe:/o:redhat:enterprise_linux:8.2"
+ title: "Red Hat Enterprise Linux 8.2"
+ check_id: installed_OS_is_rhel8_2
+
+ - rhel8.3:
+ name: "cpe:/o:redhat:enterprise_linux:8.3"
+ title: "Red Hat Enterprise Linux 8.3"
+ check_id: installed_OS_is_rhel8_3
+
+ - rhel8.4:
+ name: "cpe:/o:redhat:enterprise_linux:8.4"
+ title: "Red Hat Enterprise Linux 8.4"
+ check_id: installed_OS_is_rhel8_4
+
+ - rhel8.5:
+ name: "cpe:/o:redhat:enterprise_linux:8.5"
+ title: "Red Hat Enterprise Linux 8.5"
+ check_id: installed_OS_is_rhel8_5
+
+ - rhel8.6:
+ name: "cpe:/o:redhat:enterprise_linux:8.6"
+ title: "Red Hat Enterprise Linux 8.6"
+ check_id: installed_OS_is_rhel8_6
+
+ - rhel8.7:
+ name: "cpe:/o:redhat:enterprise_linux:8.7"
+ title: "Red Hat Enterprise Linux 8.7"
+ check_id: installed_OS_is_rhel8_7
+
+ - rhel8.8:
+ name: "cpe:/o:redhat:enterprise_linux:8.8"
+ title: "Red Hat Enterprise Linux 8.8"
+ check_id: installed_OS_is_rhel8_8
+
# Mapping of CPE platform to package
platform_package_overrides:
login_defs: "shadow-utils"
From c4e4fd7b0449ba4655020fc0dc99ae3c4523b8cc Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 19 Jul 2021 08:12:34 -0500
Subject: [PATCH 3/3] Add checks to go up to RHEL 8.10
This also makes the checks work.
---
products/rhel8/product.yml | 10 ++++++++++
shared/checks/oval/installed_OS_is_rhel8.xml | 10 +++++-----
2 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/products/rhel8/product.yml b/products/rhel8/product.yml
index 14336bfddf1..78c987b2457 100644
--- a/products/rhel8/product.yml
+++ b/products/rhel8/product.yml
@@ -72,6 +72,16 @@ cpes:
title: "Red Hat Enterprise Linux 8.8"
check_id: installed_OS_is_rhel8_8
+ - rhel8.9:
+ name: "cpe:/o:redhat:enterprise_linux:8.9"
+ title: "Red Hat Enterprise Linux 8.9"
+ check_id: installed_OS_is_rhel8_9
+
+ - rhel8.10:
+ name: "cpe:/o:redhat:enterprise_linux:8.10"
+ title: "Red Hat Enterprise Linux 8.10"
+ check_id: installed_OS_is_rhel8_10
+
# Mapping of CPE platform to package
platform_package_overrides:
login_defs: "shadow-utils"
diff --git a/shared/checks/oval/installed_OS_is_rhel8.xml b/shared/checks/oval/installed_OS_is_rhel8.xml
index fdd3c870d43..feab963b941 100644
--- a/shared/checks/oval/installed_OS_is_rhel8.xml
+++ b/shared/checks/oval/installed_OS_is_rhel8.xml
@@ -44,7 +44,7 @@
<linux:name>redhat-release</linux:name>
</linux:rpminfo_object>
- {{% for minorversion in range(0, 9) %}}
+ {{% for minorversion in range(0, 11) %}}
<definition class="inventory" id="installed_OS_is_rhel8_{{{ minorversion }}}" version="1">
<metadata>
<title>Red Hat Enterprise Linux 8.{{{ minorversion }}}</title>
@@ -52,13 +52,13 @@
<platform>Red Hat Enterprise Linux 8.{{{ minorversion }}}</platform>
</affected>
<reference ref_id="cpe:/o:redhat:enterprise_linux:8.{{{ minorversion }}}" source="CPE" />
- <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{ minorversion}}}</description>
+ <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{ minorversion }}}</description>
</metadata>
+ <criteria>
+ <criterion comment="RHEL 8.{{{ minorversion }}} is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
+ </criteria>
</definition>
- <criteria>
- <criterion comment="RHEL.{{{ minorversion }}} 8 is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
- </criteria>
<linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.{{{ minorversion }}}"
id="test_rhel8_{{{ minorversion }}}" version="1">

50
SOURCES/scap-security-guide-0.1.58-ansible_missing_metadata-PR_7357.patch
View File

@ -1,50 +0,0 @@
From 5d4726bb609f463956c03909891f8fbd1975d222 Mon Sep 17 00:00:00 2001
From: Milan Lysonek <mlysonek@redhat.com>
Date: Mon, 9 Aug 2021 14:00:19 +0200
Subject: [PATCH] Add missing ansible remediation metadata
---
.../auditd_overflow_action/ansible/shared.yml | 4 ++++
.../ansible/shared.yml | 4 ++++
.../ansible/shared.yml | 4 ++++
3 files changed, 12 insertions(+)
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
index 166054a95a..e1569b2254 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
@@ -1,4 +1,8 @@
# platform = multi_platform_fedora,multi_platform_rhel
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
{{{ ansible_set_config_file(file="/etc/audit/auditd.conf",
parameter="overflow_action",
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
index 2d6c5227a8..bbd27a0061 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
@@ -1,4 +1,8 @@
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
index 2ddbfb871f..b215daaef4 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
@@ -1,4 +1,8 @@
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")

92
SOURCES/scap-security-guide-0.1.58-audit_privileged_rhel_cis-PR_7353.patch
View File

@ -1,92 +0,0 @@
From 01397cbe2a62303ef001ab5e5821ffafd6929e41 Mon Sep 17 00:00:00 2001
From: Alex Haydock <alex@alexhaydock.co.uk>
Date: Fri, 6 Aug 2021 16:46:22 +0100
Subject: [PATCH] Update CCEs and identifiers on rules that make up RHEL 8 CIS
4.1.15
---
.../audit_rules_privileged_commands_insmod/rule.yml | 2 ++
.../audit_rules_privileged_commands_modprobe/rule.yml | 2 ++
.../audit_rules_privileged_commands_rmmod/rule.yml | 2 ++
shared/references/cce-redhat-avail.txt | 3 ---
4 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
index 5c3a99447c..a4ecb0d1e0 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
@@ -28,10 +28,12 @@ severity: medium
identifiers:
cce@rhel7: CCE-85851-4
+ cce@rhel8: CCE-85919-9
cce@sle15: CCE-85744-1
references:
cis@rhel7: 4.1.16
+ cis@rhel8: 4.1.15
cis@ubuntu2004: 4.1.16
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
nist: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
index 5e03dde851..f70c537064 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
@@ -32,10 +32,12 @@ severity: medium
identifiers:
cce@rhel7: CCE-85853-0
+ cce@rhel8: CCE-85973-6
cce@sle15: CCE-85731-8
references:
cis@rhel7: 4.1.16
+ cis@rhel8: 4.1.15
cis@ubuntu2004: 4.1.16
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
nist: AU-12(a),AU-12.1(ii),AU-3,AU-3.1,AU-12(c),AU-12.1(iv),MA-4(1)(a)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
index 1535041672..113c8fc4bc 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
@@ -28,10 +28,12 @@ severity: medium
identifiers:
cce@rhel7: CCE-85852-2
+ cce@rhel8: CCE-86017-1
cce@sle15: CCE-85732-6
references:
cis@rhel7: 4.1.16
+ cis@rhel8: 4.1.15
cis@ubuntu2004: 4.1.16
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
nist@sle15: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 001262c6ee..aaa631515b 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -49,7 +49,6 @@ CCE-85915-7
CCE-85916-5
CCE-85917-3
CCE-85918-1
-CCE-85919-9
CCE-85920-7
CCE-85921-5
CCE-85922-3
@@ -100,7 +99,6 @@ CCE-85968-6
CCE-85969-4
CCE-85970-2
CCE-85972-8
-CCE-85973-6
CCE-85974-4
CCE-85975-1
CCE-85976-9
@@ -143,7 +141,6 @@ CCE-86013-0
CCE-86014-8
CCE-86015-5
CCE-86016-3
-CCE-86017-1
CCE-86018-9
CCE-86019-7
CCE-86020-5

4578
SOURCES/scap-security-guide-0.1.58-audit_rhel8_stig-PR_6910.patch
View File

File diff suppressed because it is too large Load Diff

21
SOURCES/scap-security-guide-0.1.58-bios_enable_execution_restrictions_srg-PR_7284.patch
View File

@ -1,21 +0,0 @@
From df11870dd23bc5ada56acd89610c6498cbc5bc35 Mon Sep 17 00:00:00 2001
From: Milan Lysonek <mlysonek@redhat.com>
Date: Mon, 26 Jul 2021 11:49:30 +0200
Subject: [PATCH] Add bios_enable_execution_restrictions SRG reference
---
.../enable_nx/bios_enable_execution_restrictions/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
index b037e374f5..99f2c739c9 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
@@ -31,6 +31,7 @@ references:
iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
nist: SC-39,CM-6(a)
nist-csf: PR.IP-1
+ srg: SRG-OS-000433-GPOS-00192
stig@rhel8: RHEL-08-010420
platform: machine

139
SOURCES/scap-security-guide-0.1.58-cis_rhel7_updates-PR_7384.patch
View File

@ -1,139 +0,0 @@
From 44976b5fda0f34e78a0a0764add645212bd4e26d Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:08:56 +0200
Subject: [PATCH 1/4] remove automated: yes for 1.1.6, rule is missing
---
controls/cis_rhel7.yml | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 6a333693fb..7298158ad3 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -95,8 +95,7 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: yes
-# rules:
+ automated: no # rule missing
- id: 1.1.7
title: Ensure noexec option set on /dev/shm partition (Automated)
From 4dcbe4b2d4a9c14527edd06e90809630877d97aa Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:21:20 +0200
Subject: [PATCH 2/4] add rule for 3.5.1.5 - firewalld default zone
---
controls/cis_rhel7.yml | 4 +++-
.../ruleset_modifications/set_firewalld_default_zone/rule.yml | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 7298158ad3..0f3cec2a83 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -1022,7 +1022,9 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # no exact rule is present
+ automated: yes
+ rules:
+ - set_firewalld_default_zone
- id: 3.5.1.6
title: Ensure network interfaces are assigned to appropriate zone (Manual)
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
index 48de06c5bc..f4d78fb7a1 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
@@ -27,6 +27,7 @@ identifiers:
references:
cis-csc: 11,14,3,9
+ cis@rhel7: 3.5.1.5
cis@rhel8: 3.4.2.4
cis@sle15: 3.5.1.5
cjis: 5.10.1
From a13a796ee8c33ae98e93072bfc7ee15182bdfb5c Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:45:52 +0200
Subject: [PATCH 3/4] partially cover 5.5.1.4
---
controls/cis_rhel7.yml | 5 ++++-
.../account_disable_post_pw_expiration/rule.yml | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 0f3cec2a83..78ac34817f 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -1966,7 +1966,10 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # rule missing
+ automated: partially # we do not check /et/shadow
+ rules:
+ - account_disable_post_pw_expiration
+ - var_account_disable_post_pw_expiration=30
- id: 5.5.1.5
title: Ensure all users last password change date is in the past (Automated)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
index 310e234d43..a3d81cf73f 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
@@ -34,7 +34,7 @@ identifiers:
references:
cis-csc: 1,12,13,14,15,16,18,3,5,7,8
- cis@rhel7: 5.4.1.4
+ cis@rhel7: 5.5.1.4
cis@rhel8: 5.5.1.4
cis@ubuntu2004: 5.4.1.4
cjis: 5.6.2.1.1
From 31ecc1b5806e7bc14199904b0a4e4d7b027ef7c4 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:52:09 +0200
Subject: [PATCH 4/4] automate 6.2.5
---
controls/cis_rhel7.yml | 4 +++-
.../account_expiration/account_unique_name/rule.yml | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 78ac34817f..672b96cbeb 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -2205,7 +2205,9 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # rule missing
+ automated: yes
+ rules:
+ - account_unique_name
- id: 6.2.6
title: Ensure no duplicate group names exist (Automated)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
index 484b3c4f90..5f6377f194 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
@@ -20,6 +20,7 @@ identifiers:
cce@rhel9: CCE-83628-8
references:
+ cis@rhel7: 6.2.5
cis@rhel8: 6.2.17
cjis: 5.5.2
disa: CCI-000770,CCI-000804

20
SOURCES/scap-security-guide-0.1.58-disable_ctrlaltdel_reboot_fix_test_scenario-PR_7444.patch
View File

@ -1,20 +0,0 @@
From 9bb002a6870f255a8e4934fab0d1b44893f818bc Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 23 Aug 2021 12:29:13 +0200
Subject: [PATCH] disable_ctrlaltdel_reboot: disable service before masking
during test scenario setup.
---
.../disable_ctrlaltdel_reboot/tests/masked.pass.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
index cc333ea2e9e..b56b59b2fd2 100644
--- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
@@ -1,4 +1,5 @@
#!/bin/bash
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora
+systemctl disable --now ctrl-alt-del.target
systemctl mask --now ctrl-alt-del.target

28
SOURCES/scap-security-guide-0.1.58-ensure_test_helper_scripts_executable-PR_7302.patch
View File

@ -1,28 +0,0 @@
From 030557e3c4b48f568f6fef7de36de4dca6c66838 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 29 Jul 2021 19:02:11 +0200
Subject: [PATCH] Ensure test scenarios and scripts are excutable
After Jinja processing the test scenarios and test helper scripts they
lose their original permissions. This ensures they are readable and
executable.
The helper scripts are called by test scenarios and they need to be
executable.
---
tests/ssg_test_suite/common.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/ssg_test_suite/common.py b/tests/ssg_test_suite/common.py
index 3dbeaf304a..130e5c960c 100644
--- a/tests/ssg_test_suite/common.py
+++ b/tests/ssg_test_suite/common.py
@@ -245,6 +245,8 @@ def _make_file_root_owned(tarinfo):
if tarinfo:
tarinfo.uid = 0
tarinfo.gid = 0
+ # set permission to 775
+ tarinfo.mode = 509
return tarinfo

114
SOURCES/scap-security-guide-0.1.58-fix_STIG_references-PR_7371.patch
View File

@ -1,114 +0,0 @@
From 859684c560e948a439029b0d180fe23659d85141 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Tue, 10 Aug 2021 12:04:16 +0200
Subject: [PATCH] Remove inexistent and/or duplicated STIG references.
---
.../package_xorg-x11-server-common_removed/rule.yml | 1 -
.../accounts_password_pam_unix_remember/rule.yml | 1 -
.../audit_rules_sysadmin_actions/rule.yml | 1 -
.../file_ownership_var_log_audit/rule.yml | 1 -
.../auditd_data_retention_space_left_action/rule.yml | 2 +-
.../harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml | 1 -
.../rule.yml | 2 +-
.../crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml | 1 -
8 files changed, 2 insertions(+), 8 deletions(-)
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
index de8f0f6fd8..6e739d21a2 100644
--- a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
@@ -42,7 +42,6 @@ references:
nist-csf: PR.AC-3,PR.PT-4
srg: SRG-OS-000480-GPOS-00227
stigid@rhel7: RHEL-07-040730
- stigid@rhel8: RHEL-08-040320
ocil_clause: 'the X Windows package group or xorg-x11-server-common has not be removed'
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
index 9138681688..a2b66fc4d6 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
@@ -50,7 +50,6 @@ references:
srg: SRG-OS-000077-GPOS-00045
stigid@ol7: OL07-00-010270
stigid@rhel7: RHEL-07-010270
- stigid@rhel8: RHEL-08-020220
stigid@sle15: SLES-15-020250
stigid@ubuntu2004: UBTU-20-010070
vmmsrg: SRG-OS-000077-VMM-000440
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
index 12bca676d8..b4291e168c 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
@@ -50,7 +50,6 @@ references:
srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,CCI-002884,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221
stigid@ol7: OL07-00-030700
stigid@rhel7: RHEL-07-030700
- stigid@rhel8: RHEL-08-030172
stigid@sle15: SLES-15-030140
vmmsrg: SRG-OS-000462-VMM-001840,SRG-OS-000471-VMM-001910
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
index 956beef52b..96bc0fa0b8 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
@@ -35,7 +35,6 @@ references:
srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
stigid@ol7: OL07-00-910055
stigid@rhel7: RHEL-07-910055
- stigid@rhel8: RHEL-08-030080
ocil: |-
{{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
index 6e30f1c4ac..7569a6776b 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
@@ -53,7 +53,7 @@ references:
srg: SRG-OS-000343-GPOS-00134
stigid@ol7: OL07-00-030340
stigid@rhel7: RHEL-07-030340
- stigid@rhel8: RHEL-08-030730
+ stigid@rhel8: RHEL-08-030731
stigid@ubuntu2004: UBTU-20-010217
vmmsrg: SRG-OS-000343-VMM-001240
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
index 0aa310d924..682ca436b8 100644
--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
@@ -30,7 +30,6 @@ references:
disa: CCI-001453
nist: AC-17(2)
srg: SRG-OS-000250-GPOS-00093
- stigid@rhel8: RHEL-08-010291
ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
index b56f2421f2..e904bc848c 100644
--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
@@ -30,7 +30,7 @@ references:
disa: CCI-001453
nist: AC-17(2)
srg: SRG-OS-000250-GPOS-00093
- stigid@rhel8: RHEL-08-010290
+ stigid@rhel8: RHEL-08-010291
ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly'
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
index 1aeb987db2..d21f68ac17 100644
--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
@@ -28,7 +28,6 @@ references:
disa: CCI-001453
nist: AC-17(2)
srg: SRG-OS-000250-GPOS-00093
- stigid@rhel8: RHEL-08-010290
ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'

53
SOURCES/scap-security-guide-0.1.58-fix_ansible_banner_remediation-PR_7228.patch
View File

@ -1,53 +0,0 @@
From a9660f01ecd85240df9460f141387dd2874eba82 Mon Sep 17 00:00:00 2001
From: Marcus Burghardt <marcus@mbsec.com.br>
Date: Fri, 9 Jul 2021 16:15:28 +0200
Subject: [PATCH] Bug 1857179 - Improved ansible fix for banner files. Replace
files only when necessary.
---
.../banner_etc_issue/ansible/shared.yml | 12 +++---------
.../banner_etc_motd/ansible/shared.yml | 12 +++---------
2 files changed, 6 insertions(+), 18 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
index ff6b6eab42b..4f6d64fd7ac 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
@@ -5,13 +5,7 @@
# disruption = medium
{{{ ansible_instantiate_variables("login_banner_text") }}}
-- name: "{{{ rule_title }}} - remove incorrect banner"
- file:
- state: absent
- path: /etc/issue
-
-- name: "{{{ rule_title }}} - add correct banner"
- lineinfile:
+- name: "{{{ rule_title }}} - ensure correct banner"
+ copy:
dest: /etc/issue
- line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
- create: yes
+ content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
index 15eb3cc1cbd..2c645889336 100644
--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
@@ -5,13 +5,7 @@
# disruption = medium
{{{ ansible_instantiate_variables("login_banner_text") }}}
-- name: "{{{ rule_title }}} - remove incorrect banner"
- file:
- state: absent
- path: /etc/motd
-
-- name: "{{{ rule_title }}} - add correct banner"
- lineinfile:
+- name: "{{{ rule_title }}} - ensure correct banner"
+ copy:
dest: /etc/motd
- line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
- create: yes
+ content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'

58
SOURCES/scap-security-guide-0.1.58-fix_audit_file_permissions-PR_7440.patch
View File

@ -1,58 +0,0 @@
From 1dcdad51a48c17dd5dbb7eb9bbb8cef23cf00e29 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 23 Aug 2021 10:26:39 +0200
Subject: [PATCH] Fix remaining audit rule files permissions.
---
.../audit_rules_immutable/ansible/shared.yml | 1 +
.../audit_rules_immutable/bash/shared.sh | 1 +
shared/templates/audit_file_contents/ansible.template | 5 +++++
shared/templates/audit_file_contents/bash.template | 2 ++
4 files changed, 9 insertions(+)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
index 1cafb744cc3..736d4c333e4 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
@@ -22,6 +22,7 @@
path: "{{ item }}"
create: True
line: "-e 2"
+ mode: o-rwx
loop:
- "/etc/audit/audit.rules"
- "/etc/audit/rules.d/immutable.rules"
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
index 29cd4a5de6f..36e0691493f 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
@@ -20,4 +20,5 @@ do
echo '# Set the audit.rules configuration immutable per security requirements' >> $AUDIT_FILE
echo '# Reboot is required to change audit rules once this setting is applied' >> $AUDIT_FILE
echo '-e 2' >> $AUDIT_FILE
+ chmod o-rwx $AUDIT_FILE
done
diff --git a/shared/templates/audit_file_contents/ansible.template b/shared/templates/audit_file_contents/ansible.template
index c2852745451..a262386cfbf 100644
--- a/shared/templates/audit_file_contents/ansible.template
+++ b/shared/templates/audit_file_contents/ansible.template
@@ -9,3 +9,8 @@
contents=CONTENTS,
)
}}}
+
+- name: Remove any permissions from other group
+ file:
+ path: {{{ FILEPATH }}}
+ mode: o-rwx
diff --git a/shared/templates/audit_file_contents/bash.template b/shared/templates/audit_file_contents/bash.template
index f264be6f14d..d6277167892 100644
--- a/shared/templates/audit_file_contents/bash.template
+++ b/shared/templates/audit_file_contents/bash.template
@@ -11,4 +11,6 @@
)
}}}
+chmod o-rwx {{{ FILEPATH }}}
+
augenrules --load

39
SOURCES/scap-security-guide-0.1.58-fix_cis_value_selector-PR_7452.patch
View File

@ -1,39 +0,0 @@
From bd790153e02c1d1725f59f5d88c65c77eb1421e9 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Tue, 24 Aug 2021 12:48:46 +0200
Subject: [PATCH] Add a new selector for var_system_crypto_policy and use it
RHEL8 CIS.
This new selector is used to select explicit DEFAULT value in RHEL8 CIS
L1 profiles. The "default" selector cannot be selected and it causes
errors if used.
---
controls/cis_rhel8.yml | 2 +-
.../software/integrity/crypto/var_system_crypto_policy.var | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml
index 29d972427cf..c0d3f5f40de 100644
--- a/controls/cis_rhel8.yml
+++ b/controls/cis_rhel8.yml
@@ -553,7 +553,7 @@ controls:
automated: yes
rules:
- configure_crypto_policy
- - var_system_crypto_policy=default
+ - var_system_crypto_policy=default_policy
# This rule works in conjunction with the configure_crypto_policy above.
# If a system is remediated to CIS Level 1, just the rule above will apply
diff --git a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
index ce301154a39..8b89848d122 100644
--- a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
+++ b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
@@ -13,6 +13,7 @@ interactive: false
options:
default: DEFAULT
+ default_policy: DEFAULT
default_nosha1: "DEFAULT:NO-SHA1"
fips: FIPS
fips_ospp: "FIPS:OSPP"

702
SOURCES/scap-security-guide-0.1.58-fix_handling_of_variables_in_levels-PR_7226.patch
View File

@ -1,702 +0,0 @@
From 7901659fa169db8ac5ffd7c610a798c785a3556b Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 9 Jul 2021 14:41:03 +0200
Subject: [PATCH 01/12] ensure that higher policy levels can override variables
of lower levels
---
ssg/controls.py | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 297d80e46c5..165cdf0511a 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -202,9 +202,16 @@ def get_all_controls_of_level(self, policy_id, level_id):
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
- for c in all_policy_controls:
- if len(level_ids.intersection(c.levels)) > 0:
- eligible_controls.append(c)
+ defined_variables = []
+ # we will go level by level, from top to bottom
+ # this is done to enable overriding of variables by higher levels
+ for lv in level_ids:
+ for c in all_policy_controls:
+ if lv in c.levels:
+ # if the control has a variable, check if it is not already defined
+ if c.variables.keys().isdisjoint(defined_variables):
+ eligible_controls.append(c)
+ defined_variables += [*c.variables.keys()]
return eligible_controls
def get_all_controls(self, policy_id):
From 66e612a9668009cc553fcf1abbf2c9477155c0c2 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 5 Aug 2021 14:02:25 +0200
Subject: [PATCH 02/12] use ordered sets emulated by ordereddict
because of compatibility with python2
---
ssg/controls.py | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 165cdf0511a..611a647e125 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -2,6 +2,7 @@
import logging
import os
from glob import glob
+from collections import OrderedDict
import ssg.build_yaml
import ssg.yaml
@@ -152,16 +153,18 @@ def get_level(self, level_id):
raise ValueError(msg)
def get_level_with_ancestors(self, level_id):
- levels = set()
+ # use OrderedDict for Python2 compatibility instead of ordered set
+ levels = OrderedDict()
level = self.get_level(level_id)
- levels.add(level)
+ levels[level] = ""
if level.inherits_from:
for lv in level.inherits_from:
- levels.update(self.get_level_with_ancestors(lv))
+ eligible_levels = [l for l in self.get_level_with_ancestors(lv).keys() if l not in levels.keys()]
+ for l in eligible_levels:
+ levels[l] = ""
return levels
-
class ControlsManager():
def __init__(self, controls_dir, env_yaml=None):
self.controls_dir = os.path.abspath(controls_dir)
@@ -198,20 +201,24 @@ def _get_policy(self, policy_id):
def get_all_controls_of_level(self, policy_id, level_id):
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
- level_ids = set([lv.id for lv in levels])
+ # we use OrderedDict here with empty values instead of ordered set
+ # cause we want to be compatible with python 2
+ level_ids = OrderedDict()
+ for lv in levels.keys():
+ level_ids[lv.id] = ""
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
defined_variables = []
# we will go level by level, from top to bottom
# this is done to enable overriding of variables by higher levels
- for lv in level_ids:
+ for lv in level_ids.keys():
for c in all_policy_controls:
if lv in c.levels:
# if the control has a variable, check if it is not already defined
if c.variables.keys().isdisjoint(defined_variables):
eligible_controls.append(c)
- defined_variables += [*c.variables.keys()]
+ defined_variables += list(c.variables.keys())
return eligible_controls
def get_all_controls(self, policy_id):
From 95a23a31293a0a63361ddf1831866cd5ae1ab61e Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 5 Aug 2021 16:30:10 +0200
Subject: [PATCH 03/12] rework handling of variables when returning all
controls of a level
currently only the top most level variables are kept in the controls
if there is a control with lower level which has the same variable defined, it is deep copied and the variable definition is removed only from the resulting control
the original control stays in tact
---
ssg/controls.py | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 611a647e125..4ebb8bda3d7 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -1,8 +1,8 @@
import collections
import logging
import os
+import copy
from glob import glob
-from collections import OrderedDict
import ssg.build_yaml
import ssg.yaml
@@ -154,7 +154,7 @@ def get_level(self, level_id):
def get_level_with_ancestors(self, level_id):
# use OrderedDict for Python2 compatibility instead of ordered set
- levels = OrderedDict()
+ levels = collections.OrderedDict()
level = self.get_level(level_id)
levels[level] = ""
if level.inherits_from:
@@ -201,24 +201,39 @@ def _get_policy(self, policy_id):
def get_all_controls_of_level(self, policy_id, level_id):
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
+ print ("getting levels of " + level_id)
+ print ([ l.id for l in levels.keys()])
# we use OrderedDict here with empty values instead of ordered set
# cause we want to be compatible with python 2
- level_ids = OrderedDict()
+ level_ids = collections.OrderedDict()
for lv in levels.keys():
level_ids[lv.id] = ""
-
+ print (level_ids.keys())
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
defined_variables = []
# we will go level by level, from top to bottom
# this is done to enable overriding of variables by higher levels
for lv in level_ids.keys():
+ print ("going through level " +lv)
for c in all_policy_controls:
+ print (c.levels)
if lv in c.levels:
# if the control has a variable, check if it is not already defined
- if c.variables.keys().isdisjoint(defined_variables):
+ variables = list(c.variables.keys())
+ if len(variables) == 0:
eligible_controls.append(c)
- defined_variables += list(c.variables.keys())
+ for var in variables:
+ if var in defined_variables:
+ # if it is, create new instance of the control and remove the variable
+ # we are going from the top level to the bottom
+ # so we don't want to overwrite variables
+ new_c = copy.deepcopy(c)
+ del new_c.variables[var]
+ eligible_controls.append(new_c)
+ else:
+ defined_variables.append(var)
+ eligible_controls.append(c)
return eligible_controls
def get_all_controls(self, policy_id):
From a2dd7e9386c757a523b57646bdc5a9ffa99f68c5 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 5 Aug 2021 16:31:25 +0200
Subject: [PATCH 04/12] add tests for defining of variables
---
tests/unit/ssg-module/data/controls_dir/abcd-levels.yml | 6 ++++++
tests/unit/ssg-module/test_controls.py | 5 +++++
2 files changed, 11 insertions(+)
diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
index aded77c12a6..b98a7cd4e19 100644
--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
@@ -19,10 +19,14 @@ controls:
- id: S2
levels:
- low
+ rules:
+ - var_password_pam_minlen=1
- id: S3
levels:
- medium
+ rules:
+ - var_password_pam_minlen=2
- id: S4
title: Configure authentication
@@ -36,3 +40,5 @@ controls:
title: Enforce password quality standards
levels:
- high
+ rules:
+ - var_password_pam_minlen=3
diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
index ff9b04f26c9..06fcb0c375d 100644
--- a/tests/unit/ssg-module/test_controls.py
+++ b/tests/unit/ssg-module/test_controls.py
@@ -87,6 +87,11 @@ def test_controls_levels():
assert len(low_controls) == 4
assert len(medium_controls) == 5
+ # test overriding of variables in levels
+ assert c_2.variables["var_password_pam_minlen"] == "1"
+ assert c_3.variables["var_password_pam_minlen"] == "2"
+ assert c_4b.variables["var_password_pam_minlen"] == "3"
+
def test_controls_load_product():
ssg_root = \
From 82b90a9720dadab7d6060f0ccbcd902b1c097904 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 6 Aug 2021 09:30:47 +0200
Subject: [PATCH 05/12] make overriding of variables optional
---
ssg/controls.py | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 4ebb8bda3d7..90639fbe4c7 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -198,42 +198,42 @@ def _get_policy(self, policy_id):
raise ValueError(msg)
return policy
- def get_all_controls_of_level(self, policy_id, level_id):
+ def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
+ # if override_vars is enabled, then variables from higher levels will
+ # override variables efined in controls of lower levels
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
- print ("getting levels of " + level_id)
- print ([ l.id for l in levels.keys()])
# we use OrderedDict here with empty values instead of ordered set
# cause we want to be compatible with python 2
level_ids = collections.OrderedDict()
for lv in levels.keys():
level_ids[lv.id] = ""
- print (level_ids.keys())
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
defined_variables = []
# we will go level by level, from top to bottom
# this is done to enable overriding of variables by higher levels
for lv in level_ids.keys():
- print ("going through level " +lv)
for c in all_policy_controls:
- print (c.levels)
if lv in c.levels:
- # if the control has a variable, check if it is not already defined
- variables = list(c.variables.keys())
- if len(variables) == 0:
+ if override_vars == False:
eligible_controls.append(c)
- for var in variables:
- if var in defined_variables:
- # if it is, create new instance of the control and remove the variable
- # we are going from the top level to the bottom
- # so we don't want to overwrite variables
- new_c = copy.deepcopy(c)
- del new_c.variables[var]
- eligible_controls.append(new_c)
- else:
- defined_variables.append(var)
+ else:
+ # if the control has a variable, check if it is not already defined
+ variables = list(c.variables.keys())
+ if len(variables) == 0:
eligible_controls.append(c)
+ for var in variables:
+ if var in defined_variables:
+ # if it is, create new instance of the control and remove the variable
+ # we are going from the top level to the bottom
+ # so we don't want to overwrite variables
+ new_c = copy.deepcopy(c)
+ del new_c.variables[var]
+ eligible_controls.append(new_c)
+ else:
+ defined_variables.append(var)
+ eligible_controls.append(c)
return eligible_controls
def get_all_controls(self, policy_id):
From 47df80d086e96deb4eab88d5f813bffb380006a8 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 11 Aug 2021 12:38:42 +0200
Subject: [PATCH 06/12] fix a typo
---
ssg/controls.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 90639fbe4c7..10a304bf8c2 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -200,7 +200,7 @@ def _get_policy(self, policy_id):
def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
# if override_vars is enabled, then variables from higher levels will
- # override variables efined in controls of lower levels
+ # override variables defined in controls of lower levels
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
# we use OrderedDict here with empty values instead of ordered set
From 8e59037ed07aad33a55e8297ee5bce0f51c0dee6 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 11 Aug 2021 17:02:11 +0200
Subject: [PATCH 07/12] update tests to check that overriding of variables
works
---
.../ssg-module/data/controls_dir/abcd-levels.yml | 4 +---
tests/unit/ssg-module/test_controls.py | 16 ++++++++++++++--
2 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
index b98a7cd4e19..99efafd832e 100644
--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
@@ -25,8 +25,6 @@ controls:
- id: S3
levels:
- medium
- rules:
- - var_password_pam_minlen=2
- id: S4
title: Configure authentication
@@ -41,4 +39,4 @@ controls:
levels:
- high
rules:
- - var_password_pam_minlen=3
+ - var_password_pam_minlen=2
diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
index 06fcb0c375d..124b344d141 100644
--- a/tests/unit/ssg-module/test_controls.py
+++ b/tests/unit/ssg-module/test_controls.py
@@ -89,8 +89,20 @@ def test_controls_levels():
# test overriding of variables in levels
assert c_2.variables["var_password_pam_minlen"] == "1"
- assert c_3.variables["var_password_pam_minlen"] == "2"
- assert c_4b.variables["var_password_pam_minlen"] == "3"
+ assert "var_password_pam_minlen" not in c_3.variables.keys()
+ assert c_4b.variables["var_password_pam_minlen"] == "2"
+
+ for c in low_controls:
+ if "var_password_pam_minlen" in c.variables.keys():
+ assert c.variables["var_password_pam_minlen"] == "1"
+
+ for c in medium_controls:
+ if "var_password_pam_minlen" in c.variables.keys():
+ assert c.variables["var_password_pam_minlen"] == "1"
+
+ for c in high_controls:
+ if "var_password_pam_minlen" in c.variables.keys():
+ assert c.variables["var_password_pam_minlen"] == "2"
def test_controls_load_product():
From dae4fc52a627eac6595bb73e3ffb1a0c50e78fdd Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 11 Aug 2021 17:02:32 +0200
Subject: [PATCH 08/12] make overriding of variables hardcoded when requesting
controls of a certain level
---
ssg/controls.py | 34 +++++++++++++++-------------------
1 file changed, 15 insertions(+), 19 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 10a304bf8c2..7923f0cb379 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -198,9 +198,7 @@ def _get_policy(self, policy_id):
raise ValueError(msg)
return policy
- def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
- # if override_vars is enabled, then variables from higher levels will
- # override variables defined in controls of lower levels
+ def get_all_controls_of_level(self, policy_id, level_id):
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
# we use OrderedDict here with empty values instead of ordered set
@@ -216,24 +214,22 @@ def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
for lv in level_ids.keys():
for c in all_policy_controls:
if lv in c.levels:
- if override_vars == False:
+ # if the control has a variable, check if it is not already defined
+ variables = list(c.variables.keys())
+ if len(variables) == 0:
eligible_controls.append(c)
- else:
- # if the control has a variable, check if it is not already defined
- variables = list(c.variables.keys())
- if len(variables) == 0:
+ continue
+ for var in variables:
+ if var in defined_variables:
+ # if it is, create new instance of the control and remove the variable
+ # we are going from the top level to the bottom
+ # so we don't want to overwrite variables
+ new_c = copy.deepcopy(c)
+ del new_c.variables[var]
+ eligible_controls.append(new_c)
+ else:
+ defined_variables.append(var)
eligible_controls.append(c)
- for var in variables:
- if var in defined_variables:
- # if it is, create new instance of the control and remove the variable
- # we are going from the top level to the bottom
- # so we don't want to overwrite variables
- new_c = copy.deepcopy(c)
- del new_c.variables[var]
- eligible_controls.append(new_c)
- else:
- defined_variables.append(var)
- eligible_controls.append(c)
return eligible_controls
def get_all_controls(self, policy_id):
From c051e11c70b7e23ce3d4a8e0670da4fae72833c6 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 15:30:39 +0200
Subject: [PATCH 09/12] get rid of one ordereddict
---
ssg/controls.py | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 7923f0cb379..891b13c891c 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -201,19 +201,14 @@ def _get_policy(self, policy_id):
def get_all_controls_of_level(self, policy_id, level_id):
policy = self._get_policy(policy_id)
levels = policy.get_level_with_ancestors(level_id)
- # we use OrderedDict here with empty values instead of ordered set
- # cause we want to be compatible with python 2
- level_ids = collections.OrderedDict()
- for lv in levels.keys():
- level_ids[lv.id] = ""
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
defined_variables = []
# we will go level by level, from top to bottom
# this is done to enable overriding of variables by higher levels
- for lv in level_ids.keys():
+ for lv in levels.keys():
for c in all_policy_controls:
- if lv in c.levels:
+ if lv.id in c.levels:
# if the control has a variable, check if it is not already defined
variables = list(c.variables.keys())
if len(variables) == 0:
From 4dd5cb1326932cf020785a8c2472998eb2e7775e Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 16:44:57 +0200
Subject: [PATCH 10/12] fix overriding of variables
when there were multiple variables overridden, it caused problems by creating multiple copies of controls
---
ssg/controls.py | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 891b13c891c..8b69676313c 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -214,17 +214,19 @@ def get_all_controls_of_level(self, policy_id, level_id):
if len(variables) == 0:
eligible_controls.append(c)
continue
+ variables_to_remove = [] # contains list of variables which are already defined and should be removed from the control
for var in variables:
if var in defined_variables:
- # if it is, create new instance of the control and remove the variable
- # we are going from the top level to the bottom
- # so we don't want to overwrite variables
- new_c = copy.deepcopy(c)
- del new_c.variables[var]
- eligible_controls.append(new_c)
+ variables_to_remove.append(var)
else:
defined_variables.append(var)
- eligible_controls.append(c)
+ if len(variables_to_remove) == 0:
+ eligible_controls.append(c)
+ else:
+ new_c = copy.deepcopy(c)
+ for var in variables_to_remove:
+ del new_c.variables[var]
+ eligible_controls.append(new_c)
return eligible_controls
def get_all_controls(self, policy_id):
From fbebba524cab090bc4c2f92b75257a7cc881ef5e Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 16:45:38 +0200
Subject: [PATCH 11/12] extended tests to test for multiple overridden
variables
---
.../data/controls_dir/abcd-levels.yml | 2 ++
tests/unit/ssg-module/test_controls.py | 19 +++++++++++++++++++
2 files changed, 21 insertions(+)
diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
index 99efafd832e..2e60ec43532 100644
--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
@@ -21,6 +21,7 @@ controls:
- low
rules:
- var_password_pam_minlen=1
+ - var_some_variable=1
- id: S3
levels:
@@ -40,3 +41,4 @@ controls:
- high
rules:
- var_password_pam_minlen=2
+ - var_some_variable=3
diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
index 124b344d141..1465661b04a 100644
--- a/tests/unit/ssg-module/test_controls.py
+++ b/tests/unit/ssg-module/test_controls.py
@@ -104,6 +104,25 @@ def test_controls_levels():
if "var_password_pam_minlen" in c.variables.keys():
assert c.variables["var_password_pam_minlen"] == "2"
+ # now test if controls of lower level has the variable definition correctly removed
+ # because it is overriden by higher level controls
+ s2_high = [c for c in high_controls if c.id == "S2"]
+ assert len(s2_high) == 1
+ assert "var_some_variable" not in s2_high[0].variables.keys()
+ assert "var_password_pam_minlen" not in s2_high[0].variables.keys()
+ s4b_high = [c for c in high_controls if c.id == "S4.b"]
+ assert len(s4b_high) == 1
+ assert s4b_high[0].variables["var_some_variable"] == "3"
+ assert s4b_high[0].variables["var_password_pam_minlen"] == "2"
+
+ # check that in low level the variable is correctly placed there in S2
+ s2_low = [c for c in low_controls if c.id == "S2"]
+ assert len(s2_low) == 1
+ assert s2_low[0].variables["var_some_variable"] == "1"
+ assert s2_low[0].variables["var_password_pam_minlen"] == "1"
+
+
+
def test_controls_load_product():
ssg_root = \
From 369de6b8374084d9d607979b712285912dbb65aa Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Mon, 16 Aug 2021 10:39:22 +0200
Subject: [PATCH 12/12] Style improvements
- Renamed get_level_with_ancestors to get_level_with_ancestors_sequence,
and made it return a list - a dictionary result is quite confusing.
- Removed some optimization in the variable deletion loops.
- Extracted functionality to a _get_control_without_variables static
method.
- Defined variable removal steps using set operations.
---
ssg/controls.py | 54 +++++++++++++++++++++++++------------------------
1 file changed, 28 insertions(+), 26 deletions(-)
diff --git a/ssg/controls.py b/ssg/controls.py
index 8b69676313c..ca3187d5b16 100644
--- a/ssg/controls.py
+++ b/ssg/controls.py
@@ -152,17 +152,17 @@ def get_level(self, level_id):
)
raise ValueError(msg)
- def get_level_with_ancestors(self, level_id):
+ def get_level_with_ancestors_sequence(self, level_id):
# use OrderedDict for Python2 compatibility instead of ordered set
levels = collections.OrderedDict()
level = self.get_level(level_id)
levels[level] = ""
if level.inherits_from:
for lv in level.inherits_from:
- eligible_levels = [l for l in self.get_level_with_ancestors(lv).keys() if l not in levels.keys()]
+ eligible_levels = [l for l in self.get_level_with_ancestors_sequence(lv) if l not in levels.keys()]
for l in eligible_levels:
levels[l] = ""
- return levels
+ return list(levels.keys())
class ControlsManager():
@@ -200,35 +200,37 @@ def _get_policy(self, policy_id):
def get_all_controls_of_level(self, policy_id, level_id):
policy = self._get_policy(policy_id)
- levels = policy.get_level_with_ancestors(level_id)
+ levels = policy.get_level_with_ancestors_sequence(level_id)
all_policy_controls = self.get_all_controls(policy_id)
eligible_controls = []
- defined_variables = []
+ already_defined_variables = set()
# we will go level by level, from top to bottom
# this is done to enable overriding of variables by higher levels
- for lv in levels.keys():
- for c in all_policy_controls:
- if lv.id in c.levels:
- # if the control has a variable, check if it is not already defined
- variables = list(c.variables.keys())
- if len(variables) == 0:
- eligible_controls.append(c)
- continue
- variables_to_remove = [] # contains list of variables which are already defined and should be removed from the control
- for var in variables:
- if var in defined_variables:
- variables_to_remove.append(var)
- else:
- defined_variables.append(var)
- if len(variables_to_remove) == 0:
- eligible_controls.append(c)
- else:
- new_c = copy.deepcopy(c)
- for var in variables_to_remove:
- del new_c.variables[var]
- eligible_controls.append(new_c)
+ for lv in levels:
+ for control in all_policy_controls:
+ if lv.id not in control.levels:
+ continue
+
+ variables = set(control.variables.keys())
+
+ variables_to_remove = variables.intersection(already_defined_variables)
+ already_defined_variables.update(variables)
+
+ new_c = self._get_control_without_variables(variables_to_remove, control)
+ eligible_controls.append(new_c)
+
return eligible_controls
+ @staticmethod
+ def _get_control_without_variables(variables_to_remove, control):
+ if not variables_to_remove:
+ return control
+
+ new_c = copy.deepcopy(control)
+ for var in variables_to_remove:
+ del new_c.variables[var]
+ return new_c
+
def get_all_controls(self, policy_id):
policy = self._get_policy(policy_id)
return policy.controls_by_id.values()

43
SOURCES/scap-security-guide-0.1.58-fix_missing_srgs-PR_7362.patch
View File

@ -1,43 +0,0 @@
From 90cbb9fc2662cd2b7652d1f012ece74e8cf41c5d Mon Sep 17 00:00:00 2001
From: Milan Lysonek <mlysonek@redhat.com>
Date: Mon, 9 Aug 2021 15:22:59 +0200
Subject: [PATCH 1/2] Add SRG for sssd_enable_certmap
---
linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
index 0614a2f4a0..67c02f4fb7 100644
--- a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
@@ -28,6 +28,7 @@ identifiers:
references:
disa: CCI-000187
nist: IA-5 (2) (c)
+ srg: SRG-OS-000068-GPOS-00036
stigid@rhel8: RHEL-08-020090
warnings:
From b15299568849111d142c27f99dff7052afd96c07 Mon Sep 17 00:00:00 2001
From: Milan Lysonek <mlysonek@redhat.com>
Date: Mon, 9 Aug 2021 15:23:16 +0200
Subject: [PATCH 2/2] Add SRG for accounts_password_pam_dictcheck
---
.../accounts_password_pam_dictcheck/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
index 2990150c0a..5956718a70 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -27,6 +27,7 @@ identifiers:
references:
disa: CCI-000366
nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
+ srg: SRG-OS-000480-GPOS-00225
stigid@rhel8: RHEL-08-020300
ocil_clause: 'dictcheck is not found or not equal to the required value'

22
SOURCES/scap-security-guide-0.1.58-fix_rhel7_doc_link-PR_7443.patch
View File

@ -1,22 +0,0 @@
From 3866ba4f0ce678b68de0ff5f1dc7edbea6a904bb Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 23 Aug 2021 12:10:01 +0200
Subject: [PATCH] Fix RHEL7 documentation link.
---
.../screen_locking/smart_card_login/smartcard_auth/rule.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
index 62a343cf39..8153b31177 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
@@ -8,7 +8,7 @@ description: |-
To enable smart card authentication, consult the documentation at:
<ul>
{{% if product == "rhel7" %}}
- <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards.html#authconfig-smartcards") }}}</b></li>
+ <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards#authconfig-smartcards") }}}</b></li>
{{% elif product == "ol7" %}}
<li><b>{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s4-auth") }}}</b></li>
{{% endif %}}

160
SOURCES/scap-security-guide-0.1.58-fix_rhel7_links-PR_7409.patch
View File

@ -1,160 +0,0 @@
From ac416fb6b73135b6fdeae850740ca4e10ad9fa1e Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Wed, 18 Aug 2021 15:16:59 +0200
Subject: [PATCH] Fix RHEL7 documentation links.
---
linux_os/guide/services/ldap/openldap_client/group.yml | 2 +-
linux_os/guide/services/ldap/openldap_server/group.yml | 2 +-
.../ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml | 2 +-
.../ntp/chronyd_or_ntpd_specify_remote_server/rule.yml | 2 +-
linux_os/guide/services/ntp/group.yml | 2 +-
.../services/ntp/service_chronyd_or_ntpd_enabled/rule.yml | 2 +-
linux_os/guide/services/sssd/group.yml | 2 +-
.../screen_locking/smart_card_login/smartcard_auth/rule.yml | 4 +---
linux_os/guide/system/auditing/group.yml | 2 +-
.../software/disk_partitioning/encrypt_partitions/rule.yml | 2 +-
.../guide/system/software/gnome/gnome_login_screen/group.yml | 2 +-
11 files changed, 11 insertions(+), 13 deletions(-)
diff --git a/linux_os/guide/services/ldap/openldap_client/group.yml b/linux_os/guide/services/ldap/openldap_client/group.yml
index bf17a053cd5..a64f105395f 100644
--- a/linux_os/guide/services/ldap/openldap_client/group.yml
+++ b/linux_os/guide/services/ldap/openldap_client/group.yml
@@ -13,7 +13,7 @@ description: |-
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on {{{ full_name }}} is available at
{{% if product == "rhel7" %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}.
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/openldap") }}}.
{{% elif product == "ol7" %}}
{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s9-auth") }}}.
{{% endif %}}
diff --git a/linux_os/guide/services/ldap/openldap_server/group.yml b/linux_os/guide/services/ldap/openldap_server/group.yml
index c180820e9fc..d571867a7f8 100644
--- a/linux_os/guide/services/ldap/openldap_server/group.yml
+++ b/linux_os/guide/services/ldap/openldap_server/group.yml
@@ -7,5 +7,5 @@ description: |-
for an OpenLDAP server.
{{% if product == "rhel7" %}}
Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 7 is available at:
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}.
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/openldap") }}}.
{{% endif %}}
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
index 8f939356ab1..7dc188589ee 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
@@ -14,7 +14,7 @@ description: |-
{{% elif product == "ol8" %}}
{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
{{% else %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
{{% endif %}}
for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
index 503aecc0de2..27df8595efa 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
@@ -14,7 +14,7 @@ description: |-
{{% elif product == "ol8" %}}
{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
{{% else %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
{{% endif %}}
for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
diff --git a/linux_os/guide/services/ntp/group.yml b/linux_os/guide/services/ntp/group.yml
index 181b10dfd65..b944ee03116 100644
--- a/linux_os/guide/services/ntp/group.yml
+++ b/linux_os/guide/services/ntp/group.yml
@@ -54,7 +54,7 @@ description: |-
{{% elif product == "ol8" %}}
{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
{{% elif product == "rhel7" %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
{{% elif "ubuntu" in product %}}
{{{ weblink(link="https://help.ubuntu.com/lts/serverguide/NTP.html") }}}
{{% elif "debian" in product %}}
diff --git a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
index 065cf301b95..00739816f5e 100644
--- a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
+++ b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
@@ -17,7 +17,7 @@ description: |-
{{% elif product == "ol8" %}}
{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
{{% else %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
{{% endif %}}
for guidance which NTP daemon to choose depending on the environment used.
diff --git a/linux_os/guide/services/sssd/group.yml b/linux_os/guide/services/sssd/group.yml
index 5b0caf7d64b..3f4eced7ca7 100644
--- a/linux_os/guide/services/sssd/group.yml
+++ b/linux_os/guide/services/sssd/group.yml
@@ -11,7 +11,7 @@ description: |-
<br /><br />
For more information, see
{{%- if product == "rhel7" -%}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/SSSD.html") }}}
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/sssd") }}}
{{%- elif product == "rhel8" -%}}
{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/installing-an-ipa-client-basic-scenario_installing-identity-management#sssd-deployment-operations_install-client-basic") }}}
{{%- elif product == "ol7" -%}}
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
index fc7f149bf40..62a343cf396 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
@@ -8,9 +8,7 @@ description: |-
To enable smart card authentication, consult the documentation at:
<ul>
{{% if product == "rhel7" %}}
- <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li>
- {{% elif product == "rhel8" %}}
- <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li>
+ <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards.html#authconfig-smartcards") }}}</b></li>
{{% elif product == "ol7" %}}
<li><b>{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s4-auth") }}}</b></li>
{{% endif %}}
diff --git a/linux_os/guide/system/auditing/group.yml b/linux_os/guide/system/auditing/group.yml
index 82f87e81c47..5fce88db032 100644
--- a/linux_os/guide/system/auditing/group.yml
+++ b/linux_os/guide/system/auditing/group.yml
@@ -38,7 +38,7 @@ description: |-
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Fedora Documentation available at
- <tt>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages") }}}</tt>
+ <tt>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages") }}}</tt>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
index add0a41fa94..cd07fb4c0ca 100644
--- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
+++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
@@ -38,7 +38,7 @@ description: |-
{{% elif product in ["sle12", "sle15"] %}}
{{{ weblink(link="https://www.suse.com/documentation/sled-12/book_security/data/sec_security_cryptofs_y2.html") }}}
{{% elif product == "rhel7" %}}
- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html") }}}.
+ {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-encryption") }}}.
{{% else %}}
{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening") }}}.
{{% endif %}}
diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
index 8e8b32f1d79..299b96c0592 100644
--- a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
@@ -14,5 +14,5 @@ description: |-
the man page <tt>dconf(1)</tt>.
{{% else %}}
For more information about enforcing preferences in the GNOME3 environment using the DConf
- configuration system, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Desktop_Migration_and_Administration_Guide/index.html") }}}/></b> and the man page <tt>dconf(1)</tt>.
+ configuration system, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide") }}}/></b> and the man page <tt>dconf(1)</tt>.
{{% endif %}}

27
SOURCES/scap-security-guide-0.1.58-fix_stig_overlay_python2-PR_7317.patch
View File

@ -1,27 +0,0 @@
From a032960b4fb8e50386fa02739b6b107b233b64ca Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 2 Aug 2021 18:39:58 +0200
Subject: [PATCH] Fix a python2 issue with STIG overlay generation.
---
utils/create-stig-overlay.py | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/utils/create-stig-overlay.py b/utils/create-stig-overlay.py
index 02deb0b5b2..5d4bb835ca 100755
--- a/utils/create-stig-overlay.py
+++ b/utils/create-stig-overlay.py
@@ -107,7 +107,12 @@ def new_stig_overlay(xccdftree, ssgtree, outfile, quiet):
lines = new_stig_overlay.findall("overlay")
new_stig_overlay[:] = sorted(lines, key=getkey)
- dom = xml.dom.minidom.parseString(ET.tostring(new_stig_overlay, encoding="UTF-8", xml_declaration=True))
+ try:
+ et_str = ET.tostring(new_stig_overlay, encoding="UTF-8", xml_declaration=True)
+ except TypeError:
+ et_str = ET.tostring(new_stig_overlay, encoding="UTF-8")
+
+ dom = xml.dom.minidom.parseString(et_str)
pretty_xml_as_string = dom.toprettyxml(indent=' ', encoding="UTF-8")
overlay_directory = os.path.dirname(outfile)

4263
SOURCES/scap-security-guide-0.1.58-group_audit_syscalls-PR_7329.patch
View File

File diff suppressed because it is too large Load Diff

256
SOURCES/scap-security-guide-0.1.58-ism_ks-PR_7392.patch
View File

@ -1,256 +0,0 @@
From 86e1556555fde19d3b6bfa7e280c8d9faf6243d3 Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Mon, 16 Aug 2021 13:08:10 +0200
Subject: [PATCH] Add ISM Official kickstarts
---
.../rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg | 116 ++++++++++++++++++
.../rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg | 116 ++++++++++++++++++
2 files changed, 232 insertions(+)
create mode 100644 products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
create mode 100644 products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
diff --git a/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
new file mode 100644
index 0000000000..d84d98b12d
--- /dev/null
+++ b/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
@@ -0,0 +1,116 @@
+# SCAP Security Guide ISM Official profile kickstart for Red Hat Enterprise Linux 8 Server
+# Version: 0.0.1
+# Date: 2021-08-16
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# sssd profile sets sha512 to hash passwords
+# passwords are shadowed by default
+# See the manual page for authselect-profile for a complete list of possible options.
+authselect select sssd
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet"
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+autopart
+
+# Harden installation with Essential Eight profile
+# For more details and configuration options see
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_ism_o
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
diff --git a/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg b/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
new file mode 100644
index 0000000000..517919539a
--- /dev/null
+++ b/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
@@ -0,0 +1,116 @@
+# SCAP Security Guide ISM Official profile kickstart for Red Hat Enterprise Linux 9 Server
+# Version: 0.0.1
+# Date: 2021-08-16
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# sssd profile sets sha512 to hash passwords
+# passwords are shadowed by default
+# See the manual page for authselect-profile for a complete list of possible options.
+authselect select sssd
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet"
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+autopart
+
+# Harden installation with Essential Eight profile
+# For more details and configuration options see
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
+%addon com_redhat_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_ism_o
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject

33
SOURCES/scap-security-guide-0.1.58-mark_rule_as_machine_only-PR_7442.patch
View File

@ -1,33 +0,0 @@
From 0d04f65d53b83690769f7baee48ec64e785b0e00 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 23 Aug 2021 11:33:28 +0200
Subject: [PATCH] Mark agent_mfetpd_running as machine only.
---
.../mcafee_endpoint_security_software/group.yml | 2 ++
.../package_mcafeetp_installed/rule.yml | 2 --
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
index f2e4e89851..b915311533 100644
--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
@@ -5,3 +5,5 @@ title: 'McAfee Endpoint Security for Linux (ENSL)'
description: |-
McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.
+
+platform: machine
diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
index 16587792ef..4c7dc8d7a2 100644
--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
@@ -37,8 +37,6 @@ warnings:
Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
automated remediation is not available for this configuration check.
-platform: machine
-
template:
name: package_installed
vars:

63
SOURCES/scap-security-guide-0.1.58-remove_RHEL_08_040162-PR_7369.patch
View File

@ -1,63 +0,0 @@
From 8fa9ca61649a36dd1f3d5e5c72c0162a4dbfe694 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Tue, 10 Aug 2021 09:45:56 +0200
Subject: [PATCH] Remove RHEL-08-040162 from STIG profile.
This item has been removed in version RHEL8 DISA STIG V1R3.
---
.../services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml | 1 -
products/rhel8/profiles/stig.profile | 3 ---
tests/data/profile_stability/rhel8/stig.profile | 1 -
tests/data/profile_stability/rhel8/stig_gui.profile | 1 -
4 files changed, 6 deletions(-)
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
index 1852313216a..f43f92c2f15 100644
--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
@@ -32,7 +32,6 @@ references:
disa: CCI-000068
ospp: FCS_SSHS_EXT.1
srg: SRG-OS-000423-GPOS-00187,SRG-OS-000033-GPOS-00014
- stigid@rhel8: RHEL-08-040162
ocil_clause: 'it is commented out or is not set'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index a358f61dba5..9d4d1965141 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1071,9 +1071,6 @@ selections:
# RHEL-08-040161
- sshd_rekey_limit
- # RHEL-08-040162
- - ssh_client_rekey_limit
-
# RHEL-08-040170
- disable_ctrlaltdel_reboot
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 7d54a7505fb..fca5842cf22 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -323,7 +323,6 @@ selections:
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
-- ssh_client_rekey_limit
- sshd_disable_compression
- sshd_disable_empty_passwords
- sshd_disable_gssapi_auth
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 97291230e7c..35fa9ddea2b 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -334,7 +334,6 @@ selections:
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
-- ssh_client_rekey_limit
- sshd_disable_compression
- sshd_disable_empty_passwords
- sshd_disable_gssapi_auth

490
SOURCES/scap-security-guide-0.1.58-rhel7_cis_kickstarts-PR_7382.patch
View File

@ -1,490 +0,0 @@
From ee2da171d5a76202b2aef8231c5af6f97ef156ef Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 10:36:30 +0200
Subject: [PATCH 1/2] add rhel7 kickstarts for cis
---
products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg | 4 +-
.../kickstart/ssg-rhel7-cis_server_l1-ks.cfg | 136 ++++++++++++++++
.../ssg-rhel7-cis_workstation_l1-ks.cfg | 137 ++++++++++++++++
.../ssg-rhel7-cis_workstation_l2-ks.cfg | 147 ++++++++++++++++++
4 files changed, 422 insertions(+), 2 deletions(-)
create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
diff --git a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
index 6ead435b978..00edb9d536c 100644
--- a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+++ b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
@@ -1,6 +1,6 @@
-# SCAP Security Guide CIS profile kickstart for Red Hat Enterprise Linux 7 Server
+# SCAP Security Guide CIS profile (Leve 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
# Version: 0.0.1
-# Date: 2020-03-30
+# Date: 2021-08-12
#
# Based on:
# https://pykickstart.readthedocs.io/en/latest/
diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
new file mode 100644
index 00000000000..333105c4f9e
--- /dev/null
+++ b/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
@@ -0,0 +1,136 @@
+# SCAP Security Guide CIS profile (Level 1 - Server) kickstart for Red Hat Enterprise Linux 7 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
+
+# Install a fresh new system (optional)
+install
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# --enableshadow enable shadowed passwords by default
+# --passalgo hash / crypt algorithm for new passwords
+# See the manual page for authconfig for a complete list of possible options.
+authconfig --enableshadow --passalgo=sha512
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see command %addon org_fedora_oscap in
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_server_l1
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
new file mode 100644
index 00000000000..7ca9fe8558b
--- /dev/null
+++ b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
@@ -0,0 +1,137 @@
+# SCAP Security Guide CIS profile (Level 1 - Workstation) kickstart for Red Hat Enterprise Linux 7 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
+
+# Install a fresh new system (optional)
+install
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# --enableshadow enable shadowed passwords by default
+# --passalgo hash / crypt algorithm for new passwords
+# See the manual page for authconfig for a complete list of possible options.
+authconfig --enableshadow --passalgo=sha512
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see command %addon org_fedora_oscap in
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l1
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
new file mode 100644
index 00000000000..b9bff5f390e
--- /dev/null
+++ b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
@@ -0,0 +1,147 @@
+# SCAP Security Guide CIS profile (Level 2 - Workstation) kickstart for Red Hat Enterprise Linux 7 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
+
+# Install a fresh new system (optional)
+install
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# --enableshadow enable shadowed passwords by default
+# --passalgo hash / crypt algorithm for new passwords
+# See the manual page for authconfig for a complete list of possible options.
+authconfig --enableshadow --passalgo=sha512
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
+# Ensure /home Located On Separate Partition
+logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+# Ensure /var/tmp Located On Separate Partition
+logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
+# Ensure /var Located On Separate Partition
+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048
+# Ensure /var/log Located On Separate Partition
+logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024
+# Ensure /var/log/audit Located On Separate Partition
+logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see command %addon org_fedora_oscap in
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l2
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
From 92e84a2c1b302291aa8ffbc08ae3e4ffabd5dfe7 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Wed, 18 Aug 2021 14:24:34 +0200
Subject: [PATCH 2/2] Fix typo in the CIS kickstart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Jan Černý <jcerny@redhat.com>
---
products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
index 00edb9d536c..7062e2974ad 100644
--- a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+++ b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
@@ -1,4 +1,4 @@
-# SCAP Security Guide CIS profile (Leve 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
+# SCAP Security Guide CIS profile (Level 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
# Version: 0.0.1
# Date: 2021-08-12
#

302
SOURCES/scap-security-guide-0.1.58-rhel8_cis_identifier_update_1-PR_7356.patch
View File

@ -1,302 +0,0 @@
From 5f8264ed7c5580fdd013810a713ab9b3b296bf4a Mon Sep 17 00:00:00 2001
From: Alex Haydock <alex@alexhaydock.co.uk>
Date: Mon, 9 Aug 2021 11:46:22 +0100
Subject: [PATCH] Update RHEL 8 CIS references to match benchmark 1.0.1
---
.../file_groupowner_backup_etc_group/rule.yml | 2 +-
.../file_groupowner_backup_etc_gshadow/rule.yml | 2 +-
.../file_groupowner_backup_etc_passwd/rule.yml | 2 +-
.../file_groupowner_backup_etc_shadow/rule.yml | 2 +-
.../file_groupowner_etc_group/rule.yml | 2 +-
.../file_groupowner_etc_gshadow/rule.yml | 2 +-
.../file_groupowner_etc_shadow/rule.yml | 2 +-
.../file_owner_backup_etc_group/rule.yml | 2 +-
.../file_owner_backup_etc_gshadow/rule.yml | 2 +-
.../file_owner_backup_etc_passwd/rule.yml | 2 +-
.../file_owner_backup_etc_shadow/rule.yml | 2 +-
.../file_owner_etc_group/rule.yml | 2 +-
.../file_owner_etc_gshadow/rule.yml | 2 +-
.../file_owner_etc_shadow/rule.yml | 2 +-
.../file_permissions_backup_etc_group/rule.yml | 2 +-
.../file_permissions_backup_etc_gshadow/rule.yml | 2 +-
.../file_permissions_backup_etc_passwd/rule.yml | 2 +-
.../file_permissions_backup_etc_shadow/rule.yml | 2 +-
.../file_permissions_etc_group/rule.yml | 2 +-
.../file_permissions_etc_gshadow/rule.yml | 2 +-
.../file_permissions_etc_shadow/rule.yml | 2 +-
21 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
index c4a7f19b94..fdbdbb08ad 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@rhel7: 6.1.9
- cis@rhel8: 6.1.8
+ cis@rhel8: 6.1.9
cis@ubuntu2004: 6.1.8
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/group-", group="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
index 5348e80954..f1f7c7a4d6 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
@@ -23,7 +23,7 @@ identifiers:
references:
cis@rhel7: 6.1.6
- cis@rhel8: 6.1.9
+ cis@rhel8: 6.1.7
cis@ubuntu2004: 6.1.3
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/gshadow-", group=target_group) }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
index 170f6412cf..26ff82fb51 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@rhel7: 6.1.3
- cis@rhel8: 6.1.6
+ cis@rhel8: 6.1.3
cis@ubuntu2004: 6.1.6
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/passwd-", group="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
index ce50f98e3f..07a3d919e2 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
@@ -24,7 +24,7 @@ identifiers:
references:
cis@rhel7: 6.1.5
- cis@rhel8: 6.1.7
+ cis@rhel8: 6.1.5
cis@ubuntu2004: 6.1.7
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/shadow-", group=target_group) }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
index 050dd198c3..7c3c3ac1d2 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.8
- cis@rhel8: 6.1.4
+ cis@rhel8: 6.1.8
cis@ubuntu2004: 6.1.5
cjis: 5.5.2.2
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
index 4d4e3ff788..ca65dbc5af 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
@@ -24,7 +24,7 @@ identifiers:
references:
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.7
- cis@rhel8: 6.1.5
+ cis@rhel8: 6.1.6
cis@ubuntu2004: 6.1.9
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
isa-62443-2009: 4.3.3.7.3
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
index 2af088f528..d59a34ef04 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
@@ -24,7 +24,7 @@ identifiers:
references:
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.4
- cis@rhel8: 6.1.3
+ cis@rhel8: 6.1.4
cis@ubuntu2004: 6.1.4
cjis: 5.5.2.2
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
index 9021403357..2f2f475abf 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@rhel7: 6.1.9
- cis@rhel8: 6.1.8
+ cis@rhel8: 6.1.9
cis@ubuntu2004: 6.1.8
ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/group-", owner="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
index 3f25afef5f..afbcd11696 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
@@ -17,7 +17,7 @@ identifiers:
references:
cis@rhel7: 6.1.6
- cis@rhel8: 6.1.9
+ cis@rhel8: 6.1.7
cis@ubuntu2004: 6.1.3
ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/gshadow-", owner="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
index d16f370572..8a3af3ae70 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@rhel7: 6.1.3
- cis@rhel8: 6.1.6
+ cis@rhel8: 6.1.3
cis@ubuntu2004: 6.1.6
ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/passwd-", owner="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
index 7ef757c006..508bc355c3 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@rhel7: 6.1.5
- cis@rhel8: 6.1.7
+ cis@rhel8: 6.1.5
cis@ubuntu2004: 6.1.7
ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/shadow-", owner="root") }}}'
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
index 90fd7b08eb..8e2cb53c67 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.8
- cis@rhel8: 6.1.4
+ cis@rhel8: 6.1.8
cis@sle15: 6.1.6
cis@ubuntu2004: 6.1.5
cjis: 5.5.2.2
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
index cb16d61e88..fb91cee6d7 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
@@ -19,7 +19,7 @@ references:
anssi: BP28(R36)
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.7
- cis@rhel8: 6.1.5
+ cis@rhel8: 6.1.6
cis@ubuntu2004: 6.1.9
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
isa-62443-2009: 4.3.3.7.3
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
index 7c56014953..1099e5e7cc 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
@@ -22,7 +22,7 @@ references:
anssi: BP28(R36)
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.4
- cis@rhel8: 6.1.3
+ cis@rhel8: 6.1.4
cis@ubuntu2004: 6.1.4
cjis: 5.5.2.2
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
index 11f3818332..5d165a606e 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
@@ -19,7 +19,7 @@ identifiers:
references:
cis@rhel7: 6.1.9
- cis@rhel8: 6.1.8
+ cis@rhel8: 6.1.9
cis@sle15: 6.1.9
cis@ubuntu2004: 6.1.8
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
index 05208fee37..9fd8981485 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
@@ -26,7 +26,7 @@ identifiers:
references:
cis@rhel7: 6.1.6
- cis@rhel8: 6.1.9
+ cis@rhel8: 6.1.7
cis@sle15: 6.1.3
cis@ubuntu2004: 6.1.3
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
index 6de0c5f703..67191c872d 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
@@ -19,7 +19,7 @@ identifiers:
references:
cis@rhel7: 6.1.3
- cis@rhel8: 6.1.6
+ cis@rhel8: 6.1.3
cis@sle15: 6.1.7
cis@ubuntu2004: 6.1.6
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
index c9a4fce34c..685427c0a0 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
@@ -27,7 +27,7 @@ identifiers:
references:
cis@rhel7: 6.1.5
- cis@rhel8: 6.1.7
+ cis@rhel8: 6.1.5
cis@sle15: 6.1.8
cis@ubuntu2004: 6.1.7
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
index 1333bcb57b..fbf650b26d 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
@@ -20,7 +20,7 @@ references:
anssi: BP28(R36)
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.8
- cis@rhel8: 6.1.4
+ cis@rhel8: 6.1.8
cis@sle15: 6.1.6
cis@ubuntu2004: 6.1.5
cjis: 5.5.2.2
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
index c9b3495381..02404617c1 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
@@ -28,7 +28,7 @@ references:
anssi: BP28(R36)
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.7
- cis@rhel8: 6.1.5
+ cis@rhel8: 6.1.6
cis@sle15: 6.1.2
cis@ubuntu2004: 6.1.9
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
index acbc478ce9..ff4db782f0 100644
--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
@@ -31,7 +31,7 @@ references:
anssi: BP28(R36)
cis-csc: 12,13,14,15,16,18,3,5
cis@rhel7: 6.1.4
- cis@rhel8: 6.1.3
+ cis@rhel8: 6.1.4
cis@sle15: 6.1.5
cis@ubuntu2004: 6.1.4
cjis: 5.5.2.2

455
SOURCES/scap-security-guide-0.1.58-rhel8_cis_kickstarts-PR_7383.patch
View File

@ -1,455 +0,0 @@
From b3dc8273ded33d8357239482cf07186b14e3cdd2 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 10:54:59 +0200
Subject: [PATCH] add kickstarts for rhel8 CIS profiles
---
products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg | 4 +-
.../kickstart/ssg-rhel8-cis_server_l1-ks.cfg | 133 ++++++++++++++++
.../ssg-rhel8-cis_workstation_l1-ks.cfg | 133 ++++++++++++++++
.../ssg-rhel8-cis_workstation_l2-ks.cfg | 143 ++++++++++++++++++
4 files changed, 411 insertions(+), 2 deletions(-)
create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
diff --git a/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
index c3f31429036..d1bbb09c422 100644
--- a/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
+++ b/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
@@ -1,6 +1,6 @@
-# SCAP Security Guide CIS profile kickstart for Red Hat Enterprise Linux 8 Server
+# SCAP Security Guide CIS profile (Level 2 - Server) kickstart for Red Hat Enterprise Linux 8 Server
# Version: 0.0.1
-# Date: 2020-03-30
+# Date: 2021-08-12
#
# Based on:
# https://pykickstart.readthedocs.io/en/latest/
diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
new file mode 100644
index 00000000000..b73d5c12d21
--- /dev/null
+++ b/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
@@ -0,0 +1,133 @@
+# SCAP Security Guide CIS profile (Level 1 - Server) kickstart for Red Hat Enterprise Linux 8 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# sssd profile sets sha512 to hash passwords
+# passwords are shadowed by default
+# See the manual page for authselect-profile for a complete list of possible options.
+authselect select sssd
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_server_l1
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
new file mode 100644
index 00000000000..33bd9dd2560
--- /dev/null
+++ b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
@@ -0,0 +1,133 @@
+# SCAP Security Guide CIS profile (Level 1 - Workstation) kickstart for Red Hat Enterprise Linux 8 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# sssd profile sets sha512 to hash passwords
+# passwords are shadowed by default
+# See the manual page for authselect-profile for a complete list of possible options.
+authselect select sssd
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l1
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject
diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
new file mode 100644
index 00000000000..79ca7fbc201
--- /dev/null
+++ b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
@@ -0,0 +1,143 @@
+# SCAP Security Guide CIS profile (Level 2 - Workstation) kickstart for Red Hat Enterprise Linux 8 Server
+# Version: 0.0.1
+# Date: 2021-08-12
+#
+# Based on:
+# https://pykickstart.readthedocs.io/en/latest/
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
+
+# Specify installation method to use for installation
+# To use a different one comment out the 'url' one below, update
+# the selected choice with proper options & un-comment it
+#
+# Install from an installation tree on a remote server via FTP or HTTP:
+# --url the URL to install from
+#
+# Example:
+#
+# url --url=http://192.168.122.1/image
+#
+# Modify concrete URL in the above example appropriately to reflect the actual
+# environment machine is to be installed in
+#
+# Other possible / supported installation methods:
+# * install from the first CD-ROM/DVD drive on the system:
+#
+# cdrom
+#
+# * install from a directory of ISO images on a local drive:
+#
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
+#
+# * install from provided NFS server:
+#
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
+#
+
+# Set language to use during installation and the default language to use on the installed system (required)
+lang en_US.UTF-8
+
+# Set system keyboard type / layout (required)
+keyboard us
+
+# Configure network information for target system and activate network devices in the installer environment (optional)
+# --onboot enable device at a boot time
+# --device device to be activated and / or configured with the network command
+# --bootproto method to obtain networking configuration for device (default dhcp)
+# --noipv6 disable IPv6 on this device
+#
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
+# "--bootproto=static" must be used. For example:
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
+#
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
+
+# Set the system's root password (required)
+# Plaintext password is: server
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
+
+# The selected profile will restrict root login
+# Add a user that can login and escalate privileges
+# Plaintext password is: admin123
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
+
+# Configure firewall settings for the system (optional)
+# --enabled reject incoming connections that are not in response to outbound requests
+# --ssh allow sshd service through the firewall
+firewall --enabled --ssh
+
+# Set up the authentication options for the system (required)
+# sssd profile sets sha512 to hash passwords
+# passwords are shadowed by default
+# See the manual page for authselect-profile for a complete list of possible options.
+authselect select sssd
+
+# State of SELinux on the installed system (optional)
+# Defaults to enforcing
+selinux --enforcing
+
+# Set the system time zone (required)
+timezone --utc America/New_York
+
+# Specify how the bootloader should be installed (required)
+# Plaintext password is: password
+# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
+# encrypted password form for different plaintext password
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
+
+# Initialize (format) all disks (optional)
+zerombr
+
+# The following partition layout scheme assumes disk of size 20GB or larger
+# Modify size of partitions appropriately to reflect actual machine's hardware
+#
+# Remove Linux partitions from the system prior to creating new ones (optional)
+# --linux erase all Linux partitions
+# --initlabel initialize the disk label to the default based on the underlying architecture
+clearpart --linux --initlabel
+
+# Create primary system partitions (required for installs)
+part /boot --fstype=xfs --size=512
+part pv.01 --grow --size=1
+
+# Create a Logical Volume Management (LVM) group (optional)
+volgroup VolGroup --pesize=4096 pv.01
+
+# Create particular logical volumes (optional)
+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
+# Ensure /home Located On Separate Partition
+logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
+# Ensure /tmp Located On Separate Partition
+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
+# Ensure /var/tmp Located On Separate Partition
+logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
+# Ensure /var Located On Separate Partition
+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072
+# Ensure /var/log Located On Separate Partition
+logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024
+# Ensure /var/log/audit Located On Separate Partition
+logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512
+logvol swap --name=lv_swap --vgname=VolGroup --size=2016
+
+
+# Harden installation with CIS profile
+# For more details and configuration options see
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
+%addon org_fedora_oscap
+ content-type = scap-security-guide
+ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l2
+%end
+
+# Packages selection (%packages section is required)
+%packages
+
+# Require @Base
+@Base
+
+%end # End of %packages section
+
+# Reboot after the installation is complete (optional)
+# --eject attempt to eject CD or DVD media before rebooting
+reboot --eject

687
SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_010290-PR_7151.patch
View File

@ -1,687 +0,0 @@
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
index 194d7dfe2dc..b6c5e7f4b0d 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
@@ -37,7 +37,7 @@ ocil: |-
MACs are in use, run the following command:
<pre>$ sudo grep -i macs /etc/ssh/sshd_config</pre>
The output should contain only following MACs (or a subset) in the exact order:
- <pre>hmac-sha2-512,hmac-sha2-256</pre>
+ <pre>MACs {{{ xccdf_value("sshd_approved_macs") }}}</pre>
warnings:
- general: |-
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml
new file mode 100644
index 00000000000..1c9dde77ee2
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml
@@ -0,0 +1,16 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+# reboot = true
+# strategy = restrict
+# complexity = low
+# disruption = low
+{{{ ansible_instantiate_variables("sshd_approved_macs") }}}
+
+{{{ ansible_set_config_file(
+ msg='Configure SSH Daemon to Use FIPS 140-2 Validated MACs: openssh.config',
+ file='/etc/crypto-policies/back-ends/openssh.config',
+ parameter='MACs',
+ value="{{ sshd_approved_macs }}",
+ create='yes',
+ prefix_regex='^.*'
+ )
+}}}
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh
new file mode 100644
index 00000000000..b26992ce183
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh
@@ -0,0 +1,13 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+. /usr/share/scap-security-guide/remediation_functions
+{{{ bash_instantiate_variables("sshd_approved_macs") }}}
+
+{{{ set_config_file(
+ path="/etc/crypto-policies/back-ends/openssh.config",
+ parameter="MACs",
+ value="${sshd_approved_macs}",
+ create=true,
+ insensitive=false,
+ prefix_regex="^.*"
+ )
+}}}
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml
new file mode 100644
index 00000000000..5239af10612
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml
@@ -0,0 +1,35 @@
+{{%- set PATH = "/etc/crypto-policies/back-ends/openssh.config" -%}}
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.") }}}
+ <criteria operator="AND" comment="Test conditions - presence of the file plus.">
+ <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD MACs" test_ref="test_{{{ rule_id }}}" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all"
+ comment="test the value of MACs setting in the {{{ PATH }}} file"
+ id="test_{{{ rule_id }}}" version="1">
+ <ind:object object_ref="obj_{{{ rule_id }}}" />
+ <ind:state state_ref="ste_{{{ rule_id }}}" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
+ <ind:filepath>{{{ PATH }}}</ind:filepath>
+ <ind:pattern operation="pattern match">^MACs.*$</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
+ <ind:text var_ref="sshd_macs_crypto" operation="equals"></ind:text>
+ </ind:textfilecontent54_state>
+
+ <local_variable id="sshd_macs_crypto" datatype="string" comment="The regex of the directive" version="1">
+ <concat>
+ <literal_component>MACs </literal_component>
+ <variable_component var_ref="sshd_approved_macs"/>
+ </concat>
+ </local_variable>
+
+ <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="sshd_approved_macs" version="1" />
+</def-group>
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
new file mode 100644
index 00000000000..1aeb987db2d
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
@@ -0,0 +1,60 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config'
+
+description: |-
+ Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
+ OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
+ set up incorrectly.
+
+ To check that Crypto Policies settings are configured correctly, ensure that
+ <tt>/etc/crypto-policies/back-ends/openssh.config</tt> contains the following
+ line and is not commented out:
+ <tt>MACs hmac-sha2-512,hmac-sha2-256</tt>
+
+rationale: |-
+ Overriding the system crypto policy makes the behavior of the OpenSSH
+ client violate expectations, and makes system configuration more
+ fragmented.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85870-4
+
+references:
+ disa: CCI-001453
+ nist: AC-17(2)
+ srg: SRG-OS-000250-GPOS-00093
+ stigid@rhel8: RHEL-08-010290
+
+ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'
+
+ocil: |-
+ To verify if the OpenSSH client uses defined MACs in the Crypto Policy, run:
+ <pre>$ grep -i macs /etc/crypto-policies/back-ends/openssh.config</pre>
+ and verify that the line matches:
+ <pre>MACs hmac-sha2-512,hmac-sha2-256</pre>
+
+warnings:
+ - general: |-
+ The system needs to be rebooted for these changes to take effect.
+ - regulatory: |-
+ System Crypto Modules must be provided by a vendor that undergoes
+ FIPS-140 certifications.
+ FIPS-140 is applicable to all Federal agencies that use
+ cryptographic-based security systems to protect sensitive information
+ in computer and telecommunication systems (including voice systems) as
+ defined in Section 5131 of the Information Technology Management Reform
+ Act of 1996, Public Law 104-106. This standard shall be used in
+ designing and implementing cryptographic modules that Federal
+ departments and agencies operate or are operated for them under
+ contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
+ To meet this, the system has to have cryptographic software provided by
+ a vendor that has undergone this certification. This means providing
+ documentation, test results, design information, and independent third
+ party review by an accredited lab. While open source software is
+ capable of meeting this, it does not meet FIPS-140 unless the vendor
+ submits to this process.
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh
new file mode 100644
index 00000000000..5a4b6887cba
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/MACs ${sshd_approved_macs}/" $configfile
+else
+ echo "MACs ${sshd_approved_macs}" > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh
new file mode 100644
index 00000000000..e713d254f9c
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/#MACs ${sshd_approved_macs}/" $configfile
+else
+ echo "#MACs ${sshd_approved_macs}" > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh
new file mode 100644
index 00000000000..b8a63bec194
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/MACs ${sshd_approved_macs}/" $configfile
+else
+ echo "MACs ${sshd_approved_macs}" > "$configfile"
+fi
+
+# follow up with incorrect
+echo "#MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512" >> $configfile
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh
new file mode 100644
index 00000000000..55ef3f58422
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+echo "" > $configfile
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh
new file mode 100644
index 00000000000..9980a45681c
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/MACs /" $configfile
+else
+ echo "MACs " > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh
new file mode 100644
index 00000000000..d1303d60746
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
+incorrect_sshd_approved_macs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/MACs ${incorrect_sshd_approved_macs}/" $configfile
+else
+ echo "MACs ${incorrect_sshd_approved_macs}" > "$configfile"
+fi
+
+# follow up with correct value
+echo "MACs ${sshd_approved_macs}" >> $configfile
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh
new file mode 100644
index 00000000000..8b21af46896
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i "s/^.*MACs.*$/MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512/" $configfile
+else
+ echo "MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512" > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh
new file mode 100644
index 00000000000..2138caad319
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/openssh.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+# If file exists, remove it
+test -f $configfile && rm -f $configfile
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml
new file mode 100644
index 00000000000..5ed618586ae
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml
@@ -0,0 +1,45 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+# reboot = true
+# strategy = restrict
+# complexity = low
+# disruption = low
+{{{ ansible_instantiate_variables("sshd_approved_macs") }}}
+
+- name: "{{{ rule_title }}}: Set facts"
+ set_fact:
+ path: /etc/crypto-policies/back-ends/opensshserver.config
+ correct_value: "-oMACs={{ sshd_approved_macs }}"
+
+- name: "{{{ rule_title }}}: Stat"
+ stat:
+ path: "{{ path }}"
+ follow: yes
+ register: opensshserver_file
+
+- name: "{{{ rule_title }}}: Create"
+ lineinfile:
+ path: "{{ path }}"
+ line: "CRYPTO_POLICY='{{ correct_value }}'"
+ create: yes
+ when: not opensshserver_file.stat.exists or opensshserver_file.stat.size <= correct_value|length
+
+- name: "{{{ rule_title }}}"
+ block:
+ - name: "Existing value check"
+ lineinfile:
+ path: "{{ path }}"
+ create: false
+ regexp: "{{ correct_value }}"
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: opensshserver
+
+ - name: "Update/Correct value"
+ replace:
+ path: "{{ path }}"
+ regexp: (-oMACs=\S+)
+ replace: "{{ correct_value }}"
+ when: opensshserver.found is defined and opensshserver.found != 1
+
+ when: opensshserver_file.stat.exists and opensshserver_file.stat.size > correct_value|length
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh
new file mode 100644
index 00000000000..790a2951bab
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh
@@ -0,0 +1,31 @@
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
+. /usr/share/scap-security-guide/remediation_functions
+{{{ bash_instantiate_variables("sshd_approved_macs") }}}
+
+CONF_FILE=/etc/crypto-policies/back-ends/opensshserver.config
+correct_value="-oMACs=${sshd_approved_macs}"
+
+# Test if file exists
+test -f ${CONF_FILE} || touch ${CONF_FILE}
+
+# Ensure CRYPTO_POLICY is not commented out
+sed -i 's/#CRYPTO_POLICY=/CRYPTO_POLICY=/' ${CONF_FILE}
+
+grep -q "'${correct_value}'" ${CONF_FILE}
+
+if [[ $? -ne 0 ]]; then
+ # We need to get the existing value, using PCRE to maintain same regex
+ existing_value=$(grep -Po '(-oMACs=\S+)' ${CONF_FILE})
+
+ if [[ ! -z ${existing_value} ]]; then
+ # replace existing_value with correct_value
+ sed -i "s/${existing_value}/${correct_value}/g" ${CONF_FILE}
+ else
+ # ***NOTE*** #
+ # This probably means this file is not here or it's been modified
+ # unintentionally.
+ # ********** #
+ # echo correct_value to end
+ echo "CRYPTO_POLICY='${correct_value}'" >> ${CONF_FILE}
+ fi
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml
new file mode 100644
index 00000000000..18028157032
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml
@@ -0,0 +1,35 @@
+{{%- set PATH = "/etc/crypto-policies/back-ends/opensshserver.config" -%}}
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.") }}}
+ <criteria operator="AND" comment="Test conditions - presence of the file plus.">
+ <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD MACs" test_ref="test_{{{ rule_id }}}" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all"
+ comment="test the value of MACs setting in the {{{ PATH }}} file"
+ id="test_{{{ rule_id }}}" version="1">
+ <ind:object object_ref="obj_{{{ rule_id }}}" />
+ <ind:state state_ref="ste_{{{ rule_id }}}" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
+ <ind:filepath>{{{ PATH }}}</ind:filepath>
+ <ind:pattern operation="pattern match">^(?!#).*(-oMACs=\S+).+$</ind:pattern>
+ <ind:instance operation="equals" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
+ <ind:subexpression var_ref="sshd_macs_crypto_opensshserver" operation="equals" />
+ </ind:textfilecontent54_state>
+
+ <local_variable id="sshd_macs_crypto_opensshserver" datatype="string" comment="The regex of the directive" version="1">
+ <concat>
+ <literal_component>-oMACs=</literal_component>
+ <variable_component var_ref="sshd_approved_macs"/>
+ </concat>
+ </local_variable>
+
+ <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="sshd_approved_macs" version="1" />
+</def-group>
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml
new file mode 100644
index 00000000000..0fd107a1bbe
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml
@@ -0,0 +1,60 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config'
+
+description: |-
+ Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
+ OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
+ set up incorrectly.
+
+ To check that Crypto Policies settings are configured correctly, ensure that
+ <tt>/etc/crypto-policies/back-ends/opensshserver.config</tt> contains the following
+ text and is not commented out:
+ <tt>-oMACS=hmac-sha2-512,hmac-sha2-256</tt>
+
+rationale: |-
+ Overriding the system crypto policy makes the behavior of the OpenSSH
+ server violate expectations, and makes system configuration more
+ fragmented.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85899-3
+
+references:
+ disa: CCI-001453
+ nist: AC-17(2)
+ srg: SRG-OS-000250-GPOS-00093
+ stigid@rhel8: RHEL-08-010290
+
+ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly'
+
+ocil: |-
+ To verify if the OpenSSH server uses defined MACs in the Crypto Policy, run:
+ <pre>$ grep -Po '(-oMACs=\S+)' /etc/crypto-policies/back-ends/opensshserver.config</pre>
+ and verify that the line matches:
+ <pre>-oMACS=hmac-sha2-512,hmac-sha2-256</pre>
+
+warnings:
+ - general: |-
+ The system needs to be rebooted for these changes to take effect.
+ - regulatory: |-
+ System Crypto Modules must be provided by a vendor that undergoes
+ FIPS-140 certifications.
+ FIPS-140 is applicable to all Federal agencies that use
+ cryptographic-based security systems to protect sensitive information
+ in computer and telecommunication systems (including voice systems) as
+ defined in Section 5131 of the Information Technology Management Reform
+ Act of 1996, Public Law 104-106. This standard shall be used in
+ designing and implementing cryptographic modules that Federal
+ departments and agencies operate or are operated for them under
+ contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
+ To meet this, the system has to have cryptographic software provided by
+ a vendor that has undergone this certification. This means providing
+ documentation, test results, design information, and independent third
+ party review by an accredited lab. While open source software is
+ capable of meeting this, it does not meet FIPS-140 unless the vendor
+ submits to this process.
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh
new file mode 100644
index 00000000000..14da92218dc
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
+configfile=/etc/crypto-policies/back-ends/opensshserver.config
+correct_value="-oMACs=${sshd_approved_macs}"
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+# Proceed when file exists
+if [[ -f $configfile ]]; then
+ sed -i -r "s/-oMACs=\S+/${correct_value}/" $configfile
+else
+ echo "${correct_value}" > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh
new file mode 100644
index 00000000000..3dde1479296
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/opensshserver.config
+
+echo "" > "$configfile"
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh
new file mode 100644
index 00000000000..a50a0fc02bf
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/opensshserver.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+if [[ -f $configfile ]]; then
+ sed -i -r "s/-oMACs=\S+/-oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com/" $configfile
+else
+ echo "-oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com" > "$configfile"
+fi
diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh
new file mode 100644
index 00000000000..11e596ced87
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+configfile=/etc/crypto-policies/back-ends/opensshserver.config
+
+# Ensure directory + file is there
+test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
+
+# If file exists, remove it
+test -f $configfile && rm -f $configfile
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 6372d13cfc9..28b47cca487 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -50,6 +50,7 @@ selections:
- var_password_pam_retry=3
- var_password_pam_minlen=15
- var_sshd_set_keepalive=0
+ - sshd_approved_macs=stig
- sshd_idle_timeout_value=10_minutes
- var_accounts_passwords_pam_faillock_deny=3
- var_accounts_passwords_pam_faillock_fail_interval=900
@@ -174,11 +175,17 @@ selections:
# RHEL-08-010260
- file_groupowner_var_log
+ # *** SHARED *** #
# RHEL-08-010290 && RHEL-08-010291
- ### NOTE: This will get split out in future STIG releases, as well as we will break
- ### these rules up to be more flexible in meeting the requirements.
+ # *** SHARED *** #
- configure_ssh_crypto_policy
+ # RHEL-08-010290
+ - harden_sshd_macs_openssh_conf_crypto_policy
+ - harden_sshd_macs_opensshserver_conf_crypto_policy
+
+ # RHEL-08-010291
+
# RHEL-08-010292
- sshd_use_strong_rng
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 24e81491683..036d34cea1d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -10,7 +10,6 @@ CCE-85866-2
CCE-85867-0
CCE-85868-8
CCE-85869-6
-CCE-85870-4
CCE-85872-0
CCE-85873-8
CCE-85874-6
@@ -36,7 +35,6 @@ CCE-85895-1
CCE-85896-9
CCE-85897-7
CCE-85898-5
-CCE-85899-3
CCE-85900-9
CCE-85901-7
CCE-85902-5
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 32f1a24a7a4..393051a34ea 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -145,6 +145,8 @@ selections:
- grub2_uefi_admin_username
- grub2_uefi_password
- grub2_vsyscall_argument
+- harden_sshd_macs_openssh_conf_crypto_policy
+- harden_sshd_macs_opensshserver_conf_crypto_policy
- install_smartcard_packages
- installed_OS_is_vendor_supported
- kerberos_disable_no_keytab
@@ -325,6 +327,7 @@ selections:
- var_password_pam_lcredit=1
- var_password_pam_retry=3
- var_sshd_set_keepalive=0
+- sshd_approved_macs=stig
- sshd_idle_timeout_value=10_minutes
- var_accounts_passwords_pam_faillock_deny=3
- var_accounts_passwords_pam_faillock_fail_interval=900
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index d6a27c67dc0..de82fb34518 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -156,6 +156,8 @@ selections:
- grub2_uefi_admin_username
- grub2_uefi_password
- grub2_vsyscall_argument
+- harden_sshd_macs_openssh_conf_crypto_policy
+- harden_sshd_macs_opensshserver_conf_crypto_policy
- install_smartcard_packages
- installed_OS_is_vendor_supported
- kerberos_disable_no_keytab
@@ -335,6 +337,7 @@ selections:
- var_password_pam_lcredit=1
- var_password_pam_retry=3
- var_sshd_set_keepalive=0
+- sshd_approved_macs=stig
- sshd_idle_timeout_value=10_minutes
- var_accounts_passwords_pam_faillock_deny=3
- var_accounts_passwords_pam_faillock_fail_interval=900

1057
SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_010291-PR_7169.patch
View File

File diff suppressed because it is too large Load Diff

546
SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_010350-PR_7231.patch
View File

@ -1,546 +0,0 @@
From f7bb6fc32091ad9d10ec8253505086670eb135ba Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Mon, 12 Jul 2021 10:06:41 -0400
Subject: [PATCH 1/4] Initial commit for RHEL-08-010350 STIG rule
---
.../ansible/shared.yml | 2 +-
.../bash/shared.sh | 2 +-
.../oval/shared.xml | 44 +++++++++++++------
.../rule.yml | 26 ++++++-----
.../tests/correct_group.pass.sh | 2 +-
.../tests/incorrect_group.fail.sh | 8 +++-
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
10 files changed, 57 insertions(+), 31 deletions(-)
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
index f90c8e26b15..e0bb6b0dc1a 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
# reboot = false
# strategy = restrict
# complexity = high
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
index fba25be6132..d5fb89487d5 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
find /lib \
/lib64 \
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
index 00f733ddc78..e3d64a8390e 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
@@ -1,27 +1,45 @@
<def-group>
- <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
+ <definition class="compliance" id="root_permissions_syslibrary_files" version="1">
{{{ oval_metadata("
- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
- are owned by root.
+ Checks that /lib, /lib64, /usr/lib, /usr/lib64, and
+ objects therein, are group-owned by root.
") }}}
- <criteria >
- <criterion test_ref="test_root_permissions_for_syslibrary_files" />
+ <criteria operator="AND">
+ <criterion test_ref="test_group_ownership_lib_dir" />
+ <criterion test_ref="test_group_ownership_lib_files" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
- <unix:object object_ref="root_permissions_for_system_wide_library_files" />
+ <unix:file_test check="all" check_existence="none_exist" comment="library directories gid root" id="test_group_ownership_lib_dir" version="1">
+ <unix:object object_ref="object_group_ownership_lib_dir" />
</unix:file_test>
- <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
- <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
- are owned by root. -->
- <unix:path operation="pattern match">^\/lib(64)?|^\/usr\/lib(64)?</unix:path >
+ <unix:file_test check="all" check_existence="none_exist" comment="library files gid root" id="test_group_ownership_lib_files" version="1">
+ <unix:object object_ref="object_group_ownership_lib_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="library directories" id="object_group_ownership_lib_dir" version="1">
+ <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
+ <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_group_ownership_libraries_not_root</filter>
+ <filter action="exclude">group_dir_perms_state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="library files" id="object_group_ownership_lib_files" version="1">
+ <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
+ <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
+ <filter action="include">state_group_ownership_libraries_not_root</filter>
+ <filter action="exclude">group_dir_perms_state_symlink</filter>
</unix:file_object>
- <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
+ <unix:file_state id="state_group_ownership_libraries_not_root" version="1">
<unix:group_id datatype="int" operation="not equal">0</unix:group_id>
</unix:file_state>
+
+ <unix:file_state id="group_dir_perms_state_symlink" version="1">
+ <unix:type operation="equals">symbolic link</unix:type>
+ </unix:file_state>
+
</def-group>
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
index ff905dd08d..83371b8b9b 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: sle12,sle15
+prodtype: sle12,sle15,rhel8,fedora
title: |-
Verify the system-wide library files in directories
@@ -17,18 +17,18 @@ description: |-
All system-wide shared library files should be protected from unauthorised
access. If any of these files is not owned by root, correct its owner with
the following command:
- <pre>$ sudo chgrp root <i>DIR</i></pre>
+ <pre>$ sudo chgrp root <i>FILE</i></pre>
rationale: |-
- If the operating system were to allow any user to make changes to software libraries,
- then those changes might be implemented without undergoing the appropriate testing and
- approvals that are part of a robust change management process.
+ If the operating system were to allow any user to make changes to software libraries,
+ then those changes might be implemented without undergoing the appropriate testing and
+ approvals that are part of a robust change management process.
- This requirement applies to operating systems with software libraries that are
- accessible and configurable, as in the case of interpreted languages. Software libraries
- also include privileged programs which execute with escalated privileges. Only qualified
- and authorized individuals must be allowed to obtain access to information system components
- for purposes of initiating changes, including upgrades and modifications.
+ This requirement applies to operating systems with software libraries that are
+ accessible and configurable, as in the case of interpreted languages. Software libraries
+ also include privileged programs which execute with escalated privileges. Only qualified
+ and authorized individuals must be allowed to obtain access to information system components
+ for purposes of initiating changes, including upgrades and modifications.
severity: medium
@@ -45,7 +45,7 @@ references:
stigid@sle12: SLES-12-010875
stigid@sle15: SLES-15-010355
-ocil_clause: 'any system wide library directory is returned'
+ocil_clause: 'system wide library files are not group owned by root'
ocil: |-
System-wide library files are stored in the following directories:
@@ -54,6 +54,6 @@ ocil: |-
/usr/lib
/usr/lib64
</pre>
- To find if system-wide library files stored in these directories are group-owned by
+ To find if system-wide library files stored in these directories are not group-owned by
root run the following command for each directory <i>DIR</i>:
<pre>$ sudo find -L <i>DIR</i> ! -group root -type f </pre>
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
index 7a8e65b4f3a..8722c2add65 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
@@ -4,6 +4,6 @@ for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
do
if [[ -d $SYSLIBDIRS ]]
then
- find $SYSLIBDIRS ! -group root -type f -exec chgrp root '{}' \;
+ find $SYSLIBDIRS ! -group root -exec chgrp root '{}' \;
fi
done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
index a4b99a9da14..1079046d14e 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
@@ -1,6 +1,10 @@
#!/bin/bash
-
-for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
+
+# There is a high probability that there will be nested subdirectories within the
+# shared system library directories, therefore we should test to make sure we
+# cover this. - cmm
+test -d /usr/lib/test_dir || mkdir -p /usr/lib/test_dir && chown nobody.nobody /usr/lib/test_dir
+for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me /usr/lib/test_dir/test_me
do
if [[ ! -f $TESTFILE ]]
then
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 2508008d511..9569b2ad629 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -207,6 +207,7 @@ selections:
- file_ownership_library_dirs
# RHEL-08-010350
+ - root_permissions_syslibrary_files
# RHEL-08-010360
- package_aide_installed
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index f139d2ed76f..e0eb5ac045c 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -662,7 +662,6 @@ CCE-86518-8
CCE-86520-4
CCE-86521-2
CCE-86522-0
-CCE-86523-8
CCE-86524-6
CCE-86525-3
CCE-86526-1
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 765487c6f16..ebe7a91f45d 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -221,6 +221,7 @@ selections:
- postfix_client_configure_mail_alias
- require_emergency_target_auth
- require_singleuser_auth
+- root_permissions_syslibrary_files
- rsyslog_cron_logging
- rsyslog_remote_access_monitoring
- rsyslog_remote_loghost
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 9fd80aac727..97f940dc9ed 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -232,6 +232,7 @@ selections:
- postfix_client_configure_mail_alias
- require_emergency_target_auth
- require_singleuser_auth
+- root_permissions_syslibrary_files
- rsyslog_cron_logging
- rsyslog_remote_access_monitoring
- rsyslog_remote_loghost
From f16c085894e4dc7974637d44bf226d3acf19f3d1 Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Mon, 12 Jul 2021 16:17:23 -0400
Subject: [PATCH 2/4] Updated existing rules for syslibrary files/dirs
---
.../ansible/shared.yml | 6 ++-
.../bash/shared.sh | 7 +++
.../dir_group_ownership_library_dirs/rule.yml | 4 ++
.../tests/all_dirs_ok.pass.sh | 3 +-
.../nobody_group_owned_dir_on_lib.fail.sh | 3 +-
.../ansible/shared.yml | 23 ++++++++--
.../oval/shared.xml | 44 ++++++-------------
.../tests/correct_group.pass.sh | 4 +-
.../tests/incorrect_group.fail.sh | 8 +---
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
13 files changed, 59 insertions(+), 47 deletions(-)
create mode 100644 linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
index 80562991ac5..f6f2ab48afd 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
# reboot = false
# strategy = restrict
# complexity = medium
@@ -20,4 +20,6 @@
state: "directory"
mode: "{{ item.mode }}"
with_items: "{{ library_dirs_not_group_owned_by_root.files }}"
- when: library_dirs_not_group_owned_by_root.matched > 0
+ when:
+ - library_dirs_not_group_owned_by_root.matched > 0
+ - item.gid != 0
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
new file mode 100644
index 00000000000..365b9833188
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+
+find /lib \
+/lib64 \
+/usr/lib \
+/usr/lib64 \
+\! -group root -type d -exec chgrp root '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
index 4ff043270c8..cd02d95cb1c 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
@@ -1,5 +1,7 @@
documentation_complete: true
+prodtype: sle12,sle15,rhel8,fedora
+
title: 'Verify that Shared Library Directories Have Root Group Ownership'
description: |-
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
index 2a38e9a88bc..50fdb17bd2e 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
@@ -1,4 +1,5 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
find "$dirPath" -type d -exec chgrp root '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
index f794d9e878f..277bd7d60de 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
@@ -1,4 +1,5 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+
DIRS="/lib /lib64"
for dirPath in $DIRS; do
mkdir -p "$dirPath/testme" && chown root:nogroup "$dirPath/testme"
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
index e0bb6b0dc1a..ab3e85c4f7c 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
@@ -4,7 +4,24 @@
# complexity = high
# disruption = medium
-- name: "Set ownership to root of system-wide library files"
- command: "find {{ item }} ! -group root -type f -exec chgrp root '{}' \\;"
- with_items: [ '/lib', '/lib64', '/usr/lib', '/usr/lib64' ]
+- name: "Read list libraries without root ownership"
+ find:
+ paths:
+ - "/usr/lib"
+ - "/usr/lib64"
+ - "/lib"
+ - "/lib64"
+ file_type: "file"
+ register: library_files_not_group_owned_by_root
+
+- name: "Set group ownership of system library files to root"
+ file:
+ path: "{{ item.path }}"
+ group: "root"
+ state: "file"
+ mode: "{{ item.mode }}"
+ with_items: "{{ library_files_not_group_owned_by_root.files }}"
+ when:
+ - library_files_not_group_owned_by_root.matched > 0
+ - item.gid != 0
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
index e3d64a8390e..926ff70d1e4 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
@@ -1,45 +1,27 @@
<def-group>
- <definition class="compliance" id="root_permissions_syslibrary_files" version="1">
+ <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
{{{ oval_metadata("
- Checks that /lib, /lib64, /usr/lib, /usr/lib64, and
- objects therein, are group-owned by root.
+ Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
+ are owned by root.
") }}}
- <criteria operator="AND">
- <criterion test_ref="test_group_ownership_lib_dir" />
- <criterion test_ref="test_group_ownership_lib_files" />
+ <criteria >
+ <criterion test_ref="test_root_permissions_for_syslibrary_files" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="none_exist" comment="library directories gid root" id="test_group_ownership_lib_dir" version="1">
- <unix:object object_ref="object_group_ownership_lib_dir" />
+ <unix:file_test check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
+ <unix:object object_ref="root_permissions_for_system_wide_library_files" />
</unix:file_test>
- <unix:file_test check="all" check_existence="none_exist" comment="library files gid root" id="test_group_ownership_lib_files" version="1">
- <unix:object object_ref="object_group_ownership_lib_files" />
- </unix:file_test>
-
- <unix:file_object comment="library directories" id="object_group_ownership_lib_dir" version="1">
- <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
- <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_group_ownership_libraries_not_root</filter>
- <filter action="exclude">group_dir_perms_state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="library files" id="object_group_ownership_lib_files" version="1">
- <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
- <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
+ <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
+ <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
+ are owned by root. -->
+ <unix:path operation="pattern match">^\/lib\/|^\/lib64\/|^\/usr\/lib\/|^\/usr\/lib64\/</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_group_ownership_libraries_not_root</filter>
- <filter action="exclude">group_dir_perms_state_symlink</filter>
+ <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
</unix:file_object>
- <unix:file_state id="state_group_ownership_libraries_not_root" version="1">
+ <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
<unix:group_id datatype="int" operation="not equal">0</unix:group_id>
</unix:file_state>
-
- <unix:file_state id="group_dir_perms_state_symlink" version="1">
- <unix:type operation="equals">symbolic link</unix:type>
- </unix:file_state>
-
</def-group>
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
index 8722c2add65..a4ae2854db1 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
@@ -1,9 +1,9 @@
-#!/bin/bash
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
do
if [[ -d $SYSLIBDIRS ]]
then
- find $SYSLIBDIRS ! -group root -exec chgrp root '{}' \;
+ find $SYSLIBDIRS ! -group root -type f -exec chgrp root '{}' \;
fi
done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
index 1079046d14e..c96f65b989c 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
@@ -1,10 +1,6 @@
-#!/bin/bash
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
-# There is a high probability that there will be nested subdirectories within the
-# shared system library directories, therefore we should test to make sure we
-# cover this. - cmm
-test -d /usr/lib/test_dir || mkdir -p /usr/lib/test_dir && chown nobody.nobody /usr/lib/test_dir
-for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me /usr/lib/test_dir/test_me
+for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
do
if [[ ! -f $TESTFILE ]]
then
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 9569b2ad629..059750f59d0 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -208,6 +208,7 @@ selections:
# RHEL-08-010350
- root_permissions_syslibrary_files
+ - dir_group_ownership_library_dirs
# RHEL-08-010360
- package_aide_installed
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index e0eb5ac045c..ae3375fd4d4 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -34,7 +34,6 @@ CCE-85890-2
CCE-85891-0
CCE-85892-8
CCE-85893-6
-CCE-85894-4
CCE-85895-1
CCE-85896-9
CCE-85897-7
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ebe7a91f45d..49cce4d81cc 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -99,6 +99,7 @@ selections:
- dconf_gnome_login_banner_text
- dconf_gnome_screensaver_idle_delay
- dconf_gnome_screensaver_lock_enabled
+- dir_group_ownership_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
- directory_permissions_var_log_audit
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 97f940dc9ed..943a57d3eb8 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -110,6 +110,7 @@ selections:
- dconf_gnome_login_banner_text
- dconf_gnome_screensaver_idle_delay
- dconf_gnome_screensaver_lock_enabled
+- dir_group_ownership_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
- directory_permissions_var_log_audit
From 71deac482753a13a9f98d6d7382b13e9031a2ce4 Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Tue, 13 Jul 2021 13:40:25 -0400
Subject: [PATCH 3/4] Updated test for nobody_group_owned_dir rule
---
.../tests/nobody_group_owned_dir_on_lib.fail.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
index 277bd7d60de..043ad6b2dee 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
@@ -1,6 +1,6 @@
# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
-DIRS="/lib /lib64"
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
- mkdir -p "$dirPath/testme" && chown root:nogroup "$dirPath/testme"
+ mkdir -p "$dirPath/testme" && chgrp nobody "$dirPath/testme"
done
From 087359679e4f6794054b6772df6c84c4cd1fee94 Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Wed, 14 Jul 2021 10:04:25 -0400
Subject: [PATCH 4/4] Added recommended $ to end of regex pattern to properly
match dirs
---
.../root_permissions_syslibrary_files/oval/shared.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
index 926ff70d1e4..f5ca9380b55 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
@@ -16,7 +16,7 @@
<unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
<!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
are owned by root. -->
- <unix:path operation="pattern match">^\/lib\/|^\/lib64\/|^\/usr\/lib\/|^\/usr\/lib64\/</unix:path>
+ <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
<filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
</unix:file_object>

120
SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_020270-PR_7276.patch
View File

@ -1,120 +0,0 @@
From eed29b1db9dd62d014842340abb8601570fe6655 Mon Sep 17 00:00:00 2001
From: Carlos Matos <cmatos@redhat.com>
Date: Thu, 22 Jul 2021 14:26:49 -0400
Subject: [PATCH] New rule for RHEL-08-020270
---
.../account_emergency_expire_date/rule.yml | 52 +++++++++++++++++++
products/rhel8/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
5 files changed, 55 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
new file mode 100644
index 0000000000..a47c7f39bc
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
@@ -0,0 +1,52 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Assign Expiration Date to Emergency Accounts'
+
+description: |-
+ Emergency accounts are privileged accounts established in response to
+ crisis situations where the need for rapid account activation is required.
+ In the event emergency accounts are required, configure the system to
+ terminate them after a documented time period. For every emergency account,
+ run the following command to set an expiration date on it, substituting
+ <tt><i>ACCOUNT_NAME</i></tt> and <tt><i>YYYY-MM-DD</i></tt>
+ appropriately:
+ <pre>$ sudo chage -E <i>YYYY-MM-DD ACCOUNT_NAME</i></pre>
+ <tt><i>YYYY-MM-DD</i></tt> indicates the documented expiration date for the
+ account. For U.S. Government systems, the operating system must be
+ configured to automatically terminate these types of accounts after a
+ period of 72 hours.
+
+rationale: |-
+ If emergency user accounts remain active when no longer needed or for
+ an excessive period, these accounts may be used to gain unauthorized access.
+ To mitigate this risk, automated termination of all emergency accounts
+ must be set upon account creation.
+ <br />
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-85910-8
+
+references:
+ cis-csc: 1,12,13,14,15,16,18,3,5,7,8
+ cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS06.03
+ disa: CCI-000016,CCI-001682
+ isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
+ isa-62443-2013: 'SR 1.1,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 6.2'
+ iso27001-2013: A.12.4.1,A.12.4.3,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
+ nist: AC-2(2),AC-2(3),CM-6(a)
+ nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6
+ srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002
+ stigid@rhel8: RHEL-08-020270
+ vmmsrg: SRG-OS-000002-VMM-000020,SRG-OS-000123-VMM-000620
+
+ocil_clause: 'any emergency accounts have no expiration date set or do not expire within a documented time frame'
+
+ocil: |-
+ For every emergency account, run the following command
+ to obtain its account aging and expiration information:
+ <pre>$ sudo chage -l <i>ACCOUNT_NAME</i></pre>
+ Verify each of these accounts has an expiration date set as documented.
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 7270a8f91f..c4b9d02af5 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -558,6 +558,7 @@ selections:
- account_disable_post_pw_expiration
# RHEL-08-020270
+ - account_emergency_expire_date
# RHEL-08-020280
- accounts_password_pam_ocredit
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 665f903ead..f500179292 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -43,7 +43,6 @@ CCE-85906-6
CCE-85907-4
CCE-85908-2
CCE-85909-0
-CCE-85910-8
CCE-85911-6
CCE-85912-4
CCE-85913-2
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 7d59cfff62..72e205b695 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -24,6 +24,7 @@ documentation_complete: true
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
selections:
- account_disable_post_pw_expiration
+- account_emergency_expire_date
- account_temp_expire_date
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 2c2daad6f6..cc21621617 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -35,6 +35,7 @@ documentation_complete: true
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
selections:
- account_disable_post_pw_expiration
+- account_emergency_expire_date
- account_temp_expire_date
- accounts_have_homedir_login_defs
- accounts_logon_fail_delay

5348
SOURCES/scap-security-guide-0.1.58-rhel_modular_cis-PR_6976.patch
View File

File diff suppressed because it is too large Load Diff

699
SOURCES/scap-security-guide-0.1.58-split_file_ownership_var_log_audit-PR_7129.patch
View File

@ -1,699 +0,0 @@
From ad2267a48db738fe69bed6cc009d8be7bbc61c87 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Thu, 17 Jun 2021 17:46:26 +0200
Subject: [PATCH] Add /var/log/audit individual ownership rules.
---
.../bash/shared.sh | 12 +++++
.../oval/shared.xml | 44 +++++++++++++++++++
.../rule.yml | 39 ++++++++++++++++
.../tests/correct_value.pass.sh | 5 +++
.../correct_value_non-root_group.pass.sh | 8 ++++
.../tests/wrong_value.fail.sh | 6 +++
.../bash/shared.sh | 3 ++
.../oval/shared.xml | 24 ++++++++++
.../rule.yml | 37 ++++++++++++++++
.../tests/correct_value.pass.sh | 3 ++
.../tests/wrong_value.fail.sh | 4 ++
.../bash/shared.sh | 12 +++++
.../oval/shared.xml | 44 +++++++++++++++++++
.../rule.yml | 39 ++++++++++++++++
.../tests/correct_value.pass.sh | 5 +++
.../correct_value_non-root_group.pass.sh | 8 ++++
.../tests/wrong_value.fail.sh | 7 +++
.../bash/shared.sh | 3 ++
.../oval/shared.xml | 24 ++++++++++
.../rule.yml | 36 +++++++++++++++
.../tests/correct_value.pass.sh | 3 ++
.../tests/wrong_value.fail.sh | 5 +++
products/rhel8/profiles/stig.profile | 15 +++++--
.../oval/auditd_conf_log_group_not_root.xml | 20 ++++++++-
shared/references/cce-redhat-avail.txt | 4 --
.../data/profile_stability/rhel8/stig.profile | 5 ++-
.../profile_stability/rhel8/stig_gui.profile | 5 ++-
27 files changed, 409 insertions(+), 11 deletions(-)
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
new file mode 100644
index 00000000000..685aa0cf3f2
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
@@ -0,0 +1,12 @@
+# platform = multi_platform_all
+
+if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
+ GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
+ if ! [ "${GROUP}" == 'root' ] ; then
+ chgrp ${GROUP} /var/log/audit
+ else
+ chgrp root /var/log/audit
+ fi
+else
+ chgrp root /var/log/audit
+fi
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
new file mode 100644
index 00000000000..4d6eee02a30
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
@@ -0,0 +1,44 @@
+<def-group>
+ <definition class="compliance" id="directory_group_ownership_var_log_audit" version="1">
+ {{{ oval_metadata("Checks that all /var/log/audit directories are group owned by the root user.") }}}
+ <criteria operator="OR">
+ <criterion test_ref="test_group_ownership_var_log_audit_directories" />
+ <criteria operator="AND" comment="log_group in auditd.conf is not root">
+ <extend_definition comment="log_group in auditd.conf is not root"
+ definition_ref="auditd_conf_log_group_not_root" />
+ <criterion test_ref="test_group_ownership_var_log_audit_directories-non_root" />
+ </criteria>
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_group_ownership_var_log_audit_directories" version="1">
+ <unix:object object_ref="object_group_ownership_var_log_audit_directories" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit directories" id="object_group_ownership_var_log_audit_directories" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_group_owner_not_root_var_log_audit_directories</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_group_owner_not_root_var_log_audit_directories" version="1" operator="OR">
+ <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+ </unix:file_state>
+
+ <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="test_group_ownership_var_log_audit_directories-non_root" version="1">
+ <unix:object object_ref="object_group_ownership_var_log_audit_directories-non_root" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit directories" id="object_group_ownership_var_log_audit_directories-non_root" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_group_owner_not_root_var_log_audit_directories-non_root</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_group_owner_not_root_var_log_audit_directories-non_root" version="1" operator="OR">
+ <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+ </unix:file_state>
+
+</def-group>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
new file mode 100644
index 00000000000..3915300c106
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
@@ -0,0 +1,39 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'System Audit Directories Must Be Group Owned By Root'
+
+description: |-
+ All audit directories must be group owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
+ {{{ describe_file_group_owner(file="/var/log/audit", group="root") }}}
+ If <tt>log_group</tt> in <tt>/etc/audit/auditd.conf</tt> is set to a group other than the <tt>root</tt>
+ group account, change the group ownership of the audit directories to this specific group.
+
+rationale: |-
+ Unauthorized disclosure of audit records can reveal system and configuration data to
+ attackers, thus compromising its confidentiality.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-88225-8
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
+ cjis: 5.4.1.1
+ cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
+ cui: 3.3.1
+ disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
+ iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
+ nist: CM-6(a),AC-6(1),AU-9(4)
+ nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.5.1
+ srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
+ stigid@rhel8: RHEL-08-030110
+
+ocil: |-
+ {{{ describe_file_group_owner(file="/var/log/audit", group="root") }}}
+
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..4e68a450c3d
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = root" >> /etc/audit/auditd.conf
+chgrp root /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
new file mode 100644
index 00000000000..89995b11954
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+groupadd group_test
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = group_test" >> /etc/audit/auditd.conf
+
+chgrp group_test /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..13d22ca8361
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = root" >> /etc/audit/auditd.conf
+groupadd group_test
+chgrp group_test /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
new file mode 100644
index 00000000000..de63152c410
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
@@ -0,0 +1,3 @@
+# platform = multi_platform_all
+
+chown root /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
new file mode 100644
index 00000000000..fad17abe39a
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
@@ -0,0 +1,24 @@
+<def-group>
+ <definition class="compliance" id="directory_ownership_var_log_audit" version="1">
+ {{{ oval_metadata("Checks that all /var/log/audit directories are owned by the root user.") }}}
+ <criteria comment="directories are root owned">
+ <criterion test_ref="test_user_ownership_var_log_audit_directories" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_user_ownership_var_log_audit_directories" version="1">
+ <unix:object object_ref="object_user_ownership_var_log_audit_directories" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit directories" id="object_user_ownership_var_log_audit_directories" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_owner_not_root_var_log_audit_directories</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_owner_not_root_var_log_audit_directories" version="1" operator="OR">
+ <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
+ </unix:file_state>
+
+</def-group>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
new file mode 100644
index 00000000000..cd6c45e249b
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
@@ -0,0 +1,37 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'System Audit Directories Must Be Owned By Root'
+
+description: |-
+ All audit directories must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
+ {{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
+
+rationale: |-
+ Unauthorized disclosure of audit records can reveal system and configuration data to
+ attackers, thus compromising its confidentiality.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-88226-6
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
+ cjis: 5.4.1.1
+ cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
+ cui: 3.3.1
+ disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
+ iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
+ nist: CM-6(a),AC-6(1),AU-9(4)
+ nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.5.1
+ srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
+ stigid@rhel8: RHEL-08-030100
+
+ocil: |-
+ {{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
+
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..fa70fdc9494
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+chown root /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..f65a1e67241
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+useradd testuser_123
+chown testuser_123 /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
new file mode 100644
index 00000000000..3f53de5ba26
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
@@ -0,0 +1,12 @@
+# platform = multi_platform_all
+
+if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
+ GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
+ if ! [ "${GROUP}" == 'root' ] ; then
+ chgrp ${GROUP} /var/log/audit/audit.log*
+ else
+ chgrp root /var/log/audit/audit.log*
+ fi
+else
+ chgrp root /var/log/audit/audit.log*
+fi
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
new file mode 100644
index 00000000000..af5414a6c9c
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
@@ -0,0 +1,44 @@
+<def-group>
+ <definition class="compliance" id="file_group_ownership_var_log_audit" version="1">
+ {{{ oval_metadata("Checks that all /var/log/audit files are group owned by the root user.") }}}
+ <criteria operator="OR">
+ <criterion comment="files are root group owned" test_ref="test_group_ownership_var_log_audit_files"/>
+ <criteria operator="AND" comment="log_group in auditd.conf is not root">
+ <extend_definition comment="log_group in auditd.conf is not root"
+ definition_ref="auditd_conf_log_group_not_root" />
+ <criterion test_ref="test_group_ownership_var_log_audit_files-non_root" />
+ </criteria>
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files gid root" id="test_group_ownership_var_log_audit_files" version="1">
+ <unix:object object_ref="object_group_ownership_var_log_audit_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit files" id="object_group_ownership_var_log_audit_files" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_group_owner_not_root_var_log_audit</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_group_owner_not_root_var_log_audit" version="1" operator="OR">
+ <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+ </unix:file_state>
+
+ <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root " id="test_group_ownership_var_log_audit_files-non_root" version="1">
+ <unix:object object_ref="object_group_ownership_var_log_audit_files-non_root" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit files" id="object_group_ownership_var_log_audit_files-non_root" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_group_owner_not_root_var_log_audit-non_root</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_group_owner_not_root_var_log_audit-non_root" version="1" operator="OR">
+ <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+ </unix:file_state>
+
+</def-group>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
new file mode 100644
index 00000000000..767c8c89bf7
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
@@ -0,0 +1,39 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'System Audit Logs Must Be Group Owned By Root'
+
+description: |-
+ All audit logs must be group owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
+ {{{ describe_file_group_owner(file="/var/log/audit/*", group="root") }}}
+ If <tt>log_group</tt> in <tt>/etc/audit/auditd.conf</tt> is set to a group other than the <tt>root</tt>
+ group account, change the group ownership of the audit logs to this specific group.
+
+rationale: |-
+ Unauthorized disclosure of audit records can reveal system and configuration data to
+ attackers, thus compromising its confidentiality.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-88227-4
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
+ cjis: 5.4.1.1
+ cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
+ cui: 3.3.1
+ disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
+ iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
+ nist: CM-6(a),AC-6(1),AU-9(4)
+ nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.5.1
+ srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
+ stigid@rhel8: RHEL-08-030090
+
+ocil: |-
+ {{{ describe_file_group_owner(file="/var/log/audit/*", group="root") }}}
+
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..e4e69bff538
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = root" >> /etc/audit/auditd.conf
+chgrp root /var/log/audit/audit.log*
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
new file mode 100644
index 00000000000..89995b11954
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+groupadd group_test
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = group_test" >> /etc/audit/auditd.conf
+
+chgrp group_test /var/log/audit
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..37c0f070ae1
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
+echo "log_group = root" >> /etc/audit/auditd.conf
+touch /var/log/audit/audit.log.1
+groupadd group_test
+chgrp group_test /var/log/audit/audit.log.1
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
new file mode 100644
index 00000000000..ee2364a4a69
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
@@ -0,0 +1,3 @@
+# platform = multi_platform_all
+
+chown root /var/log/audit/audit.log*
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
new file mode 100644
index 00000000000..c20353b5926
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
@@ -0,0 +1,24 @@
+<def-group>
+ <definition class="compliance" id="file_ownership_var_log_audit_stig" version="1">
+ {{{ oval_metadata("Checks that all /var/log/audit files are owned by the root user.") }}}
+ <criteria comment="files are root owned">
+ <criterion test_ref="test_user_ownership_var_log_audit_files" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root" id="test_user_ownership_var_log_audit_files" version="1">
+ <unix:object object_ref="object_user_ownership_var_log_audit_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/var/log/audit files" id="object_user_ownership_var_log_audit_files" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/var/log/audit</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_group_user_owner_not_root_var_log_audit</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_group_user_owner_not_root_var_log_audit" version="1" operator="OR">
+ <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
+ </unix:file_state>
+
+</def-group>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
new file mode 100644
index 00000000000..7f895759486
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'System Audit Logs Must Be Owned By Root'
+
+description: |-
+ All audit logs must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
+ {{{ describe_file_owner(file="/var/log/audit/*", owner="root") }}}
+
+rationale: |-
+ Unauthorized disclosure of audit records can reveal system and configuration data to
+ attackers, thus compromising its confidentiality.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-88228-2
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
+ cjis: 5.4.1.1
+ cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
+ cui: 3.3.1
+ disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
+ iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
+ nist: CM-6(a),AC-6(1),AU-9(4)
+ nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.5.1
+ srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
+ stigid@rhel8: RHEL-08-030080
+
+ocil: |-
+ {{{ describe_file_owner(file="/var/log/audit/*", owner="root") }}}
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..eed3164eb31
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+chown root /var/log/audit/audit.log*
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..32a678562cf
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+touch /var/log/audit/audit.log.1
+useradd testuser_123
+chown testuser_123 /var/log/audit/audit.log.1
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 7270a8f91f2..7d2d386604e 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -625,10 +625,17 @@ selections:
# RHEL-08-030070
- file_permissions_var_log_audit
- # RHEL-08-030080, RHEL-08-030090, RHEL-08-030100, RHEL-08-030110
- ### NOTE: These might get broken up, but currently the following
- ### rule accounts for these STIG ID's
- - file_ownership_var_log_audit
+ # RHEL-08-030080
+ - file_ownership_var_log_audit_stig
+
+ # RHEL-08-030090
+ - file_group_ownership_var_log_audit
+
+ # RHEL-08-030100
+ - directory_ownership_var_log_audit
+
+ # RHEL-08-030110
+ - directory_group_ownership_var_log_audit
# RHEL-08-030120
- directory_permissions_var_log_audit
diff --git a/shared/checks/oval/auditd_conf_log_group_not_root.xml b/shared/checks/oval/auditd_conf_log_group_not_root.xml
index 93e47d119ef..2871052796e 100644
--- a/shared/checks/oval/auditd_conf_log_group_not_root.xml
+++ b/shared/checks/oval/auditd_conf_log_group_not_root.xml
@@ -8,9 +8,11 @@
<description>Verify 'log_group' is not set to 'root' in
/etc/audit/auditd.conf.</description>
</metadata>
- <criteria>
+ <criteria operator="AND">
<criterion test_ref="test_auditd_conf_log_group_not_root"
comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf" />
+ <criterion test_ref="test_auditd_conf_log_group_is_set"
+ comment="Verify 'log_group' is set in /etc/audit/auditd.conf" />
</criteria>
</definition>
@@ -26,4 +28,20 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <!--
+ By default, log_group is set to root, so we need to make sure something is set
+ to meet this criterion.
+ -->
+ <ind:textfilecontent54_test id="test_auditd_conf_log_group_is_set" check="all"
+ check_existence="all_exist" comment="log_group is set" version="1">
+ <ind:object object_ref="object_auditd_conf_log_group_is_set" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_conf_log_group_is_set"
+ comment="log_group is set" version="1">
+ <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
</def-group>
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 665f903ead4..b77e9abeb0b 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -2355,10 +2355,6 @@ CCE-88221-7
CCE-88222-5
CCE-88223-3
CCE-88224-1
-CCE-88225-8
-CCE-88226-6
-CCE-88227-4
-CCE-88228-2
CCE-88229-0
CCE-88230-8
CCE-88231-6
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 7d59cfff625..6c97a5a8ca3 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -103,6 +103,8 @@ selections:
- dir_group_ownership_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
+- directory_group_ownership_var_log_audit
+- directory_ownership_var_log_audit
- directory_permissions_var_log_audit
- disable_ctrlaltdel_burstaction
- disable_ctrlaltdel_reboot
@@ -113,6 +115,7 @@ selections:
- encrypt_partitions
- ensure_gpgcheck_globally_activated
- ensure_gpgcheck_local_packages
+- file_group_ownership_var_log_audit
- file_groupowner_var_log
- file_groupowner_var_log_messages
- file_groupownership_home_directories
@@ -121,7 +124,7 @@ selections:
- file_owner_var_log_messages
- file_ownership_binary_dirs
- file_ownership_library_dirs
-- file_ownership_var_log_audit
+- file_ownership_var_log_audit_stig
- file_permission_user_init_files
- file_permissions_binary_dirs
- file_permissions_etc_audit_auditd
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 2c2daad6f6d..d026a40a02b 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -114,6 +114,8 @@ selections:
- dir_group_ownership_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
+- directory_group_ownership_var_log_audit
+- directory_ownership_var_log_audit
- directory_permissions_var_log_audit
- disable_ctrlaltdel_burstaction
- disable_ctrlaltdel_reboot
@@ -124,6 +126,7 @@ selections:
- encrypt_partitions
- ensure_gpgcheck_globally_activated
- ensure_gpgcheck_local_packages
+- file_group_ownership_var_log_audit
- file_groupowner_var_log
- file_groupowner_var_log_messages
- file_groupownership_home_directories
@@ -132,7 +135,7 @@ selections:
- file_owner_var_log_messages
- file_ownership_binary_dirs
- file_ownership_library_dirs
-- file_ownership_var_log_audit
+- file_ownership_var_log_audit_stig
- file_permission_user_init_files
- file_permissions_binary_dirs
- file_permissions_etc_audit_auditd

664
SOURCES/scap-security-guide-0.1.58-sshd_directory_config-PR_6926.patch
View File

@ -1,664 +0,0 @@
From b951a896d3ef1e678e5d6b580521053e7a076ab0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Thu, 29 Apr 2021 16:54:03 +0200
Subject: [PATCH 1/6] Updated checks and remediations of the sshd template.
Configuration of sshd moves from one config file to a config directory.
Therefore, checks should consider all those files, and the remediation should aim
to deliver fixes to one of those files in the config directory.
Tests that interact with this behavior have been added and are applicable for Fedora and RHEL9 products.
---
.../tests/commented.fail.sh | 7 ++
.../tests/conflict.fail.sh | 15 ++++
.../tests/correct_value_directory.pass.sh | 14 ++++
shared/macros-bash.jinja | 9 +++
shared/macros-oval.jinja | 61 +++++++++++------
.../templates/sshd_lineinfile/bash.template | 22 ++++++
.../templates/sshd_lineinfile/oval.template | 68 +++++++++++++++++--
7 files changed, 168 insertions(+), 28 deletions(-)
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
new file mode 100644
index 00000000000..484c2165532
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config; then
+ sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config
+else
+ echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
+fi
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
new file mode 100644
index 00000000000..177a99e0b82
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# platform = Fedora,Red Hat Enterprise Linux 9
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+else
+ echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
+fi
+
+echo "PubkeyAuthentication no" > /etc/ssh/sshd_config.d/good_config
+echo "PubkeyAuthentication yes" > /etc/ssh/sshd_config.d/rogue_config
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
new file mode 100644
index 00000000000..0aa2e775dbe
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# platform = Fedora,Red Hat Enterprise Linux 9
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+else
+ echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
+fi
+
+echo "PubkeyAuthentication no" > /etc/ssh/sshd_config.d/correct
diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
index 1cd2c62b5e0..b4518d83c19 100644
--- a/shared/macros-bash.jinja
+++ b/shared/macros-bash.jinja
@@ -471,6 +471,15 @@ fi
LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
{{%- endmacro -%}}
+{{%- macro lineinfile_absent_in_directory(dirname, regex, insensitive=true) -%}}
+ {{%- if insensitive -%}}
+ {{%- set modifier="Id" -%}}
+ {{%- else -%}}
+ {{%- set modifier="d" -%}}
+ {{%- endif -%}}
+LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ dirname }}}"/*
+{{%- endmacro -%}}
+
{{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true) -%}}
{{%- if insensitive -%}}
{{%- set grep_args="-q -m 1 -i" -%}}
diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
index be2ac268206..d38db96d9e3 100644
--- a/shared/macros-oval.jinja
+++ b/shared/macros-oval.jinja
@@ -92,15 +92,18 @@
- parameter (String): The parameter to be checked in the configuration file.
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
-{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
+{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem=rule_id) -%}}
{{%- set suffix_id = "" -%}}
{{%- set prefix_text = "Check the" -%}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- set prefix_text = prefix_text + " absence of" -%}}
{{%- endif %}}
- <criterion comment="{{{ prefix_text }}} {{{ parameter }}} in {{{ path }}}"
- test_ref="test_{{{ rule_id }}}{{{ suffix_id }}}" />
+{{%- if not comment -%}}
+{{%- set comment = prefix_text ~ " " ~ parameter ~ " in " ~ path -%}}
+{{%- endif -%}}
+<criterion comment="{{{ comment }}}"
+ test_ref="test_{{{ id_stem }}}{{{ suffix_id }}}" />
{{%- endmacro %}}
{{#
@@ -110,7 +113,7 @@
- parameter (String): The parameter to be checked in the configuration file.
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
-{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false) -%}}
+{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem=rule_id) -%}}
{{%- set suffix_id = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set check_existence = "none_exist" -%}}
@@ -120,14 +123,14 @@
{{%- set check_existence = "all_exist" -%}}
{{%- set prefix_text = "value" -%}}
{{%- endif %}}
- <ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
+<ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
comment="tests the {{{ prefix_text }}} of {{{ parameter }}} setting in the {{{ path }}} file"
- id="test_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
- <ind:object object_ref="obj_{{{ rule_id }}}{{{ suffix_id }}}" />
+ id="test_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
+ <ind:object object_ref="obj_{{{ id_stem }}}{{{ suffix_id }}}" />
{{%- if not missing_parameter_pass %}}
- <ind:state state_ref="state_{{{ rule_id }}}{{{ suffix_id }}}" />
+ <ind:state state_ref="state_{{{ id_stem }}}{{{ suffix_id }}}" />
{{%- endif %}}
- </ind:textfilecontent54_test>
+</ind:textfilecontent54_test>
{{%- endmacro %}}
{{#
@@ -141,7 +144,7 @@
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
- multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
#}}
-{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='') -%}}
+{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem=rule_id) -%}}
{{%- set suffix_id = "" -%}}
{{%- if multi_value -%}}
{{%- set group_regex = "([^#]*).*$" -%}}
@@ -173,16 +176,16 @@
{{%- set regex = prefix_regex+parameter+separator_regex+group_regex -%}}
{{%- endif %}}
{{%- endif %}}
- <ind:textfilecontent54_object id="obj_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
+<ind:textfilecontent54_object id="obj_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
{{%- if filepath_regex %}}
- <ind:path>{{{ path }}}</ind:path>
- <ind:filename operation="pattern match">{{{ filepath_regex }}}</ind:filename>
+ <ind:path>{{{ path }}}</ind:path>
+ <ind:filename operation="pattern match">{{{ filepath_regex }}}</ind:filename>
{{%- else %}}
- <ind:filepath>{{{ path }}}</ind:filepath>
+ <ind:filepath>{{{ path }}}</ind:filepath>
{{%- endif %}}
- <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
- <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+ <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+</ind:textfilecontent54_object>
{{%- endmacro %}}
{{#
@@ -193,7 +196,7 @@
- quotes (String): If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.
For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
#}}
-{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='') -%}}
+{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem=rule_id) -%}}
{{%- set regex = value -%}}
{{%- if quotes != "" %}}
{{%- if "\\1" in value > 0 %}}
@@ -206,9 +209,25 @@
{{%- else %}}
{{%- set regex = "^"+regex+"$" -%}}
{{%- endif %}}
- <ind:textfilecontent54_state id="state_{{{ rule_id }}}" version="1">
- <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
- </ind:textfilecontent54_state>
+<ind:textfilecontent54_state id="state_{{{ id_stem }}}" version="1">
+ <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
+</ind:textfilecontent54_state>
+{{%- endmacro %}}
+
+{{%- macro oval_line_in_directory_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
+{{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") -}}}
+{{%- endmacro %}}
+
+{{%- macro oval_line_in_directory_test(path='', parameter='', missing_parameter_pass=false) -%}}
+{{{ oval_line_in_file_test(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") }}}
+{{%- endmacro %}}
+
+{{%- macro oval_line_in_directory_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false) -%}}
+{{{- oval_line_in_file_object(path=path, section=section, prefix_regex=prefix_regex, parameter=parameter, separator_regex=separator_regex, missing_parameter_pass=missing_parameter_pass, multi_value=multi_value, filepath_regex=".*", id_stem=rule_id ~ "_config_dir") -}}}
+{{%- endmacro %}}
+
+{{%- macro oval_line_in_directory_state(value='', multi_value='', quotes='') -%}}
+{{{- oval_line_in_file_state(value, multi_value, quotes, id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}
{{#
diff --git a/shared/templates/sshd_lineinfile/bash.template b/shared/templates/sshd_lineinfile/bash.template
index ca1b512bb3d..eac758e310b 100644
--- a/shared/templates/sshd_lineinfile/bash.template
+++ b/shared/templates/sshd_lineinfile/bash.template
@@ -3,4 +3,26 @@
# strategy = restrict
# complexity = low
# disruption = low
+{{%- if product in ("fedora", "rhel9") %}}
+{{%- set prefix_regex = "^\s*" -%}}
+{{%- set separator_regex = "\s\+" -%}}
+{{%- set line_regex = prefix_regex ~ PARAMETER ~ separator_regex %}}
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/hardening
+{{{ lineinfile_absent("/etc/ssh/sshd_config", line_regex, insensitive=true) }}}
+{{{ lineinfile_absent_in_directory("/etc/ssh/sshd_config.d", line_regex, insensitive=true) }}}
+{{{ set_config_file(
+ path="/etc/ssh/sshd_config.d/hardening",
+ parameter=PARAMETER,
+ value=VALUE,
+ create=true,
+ insert_after="",
+ insert_before="^Match",
+ insensitive=true,
+ separator=" ",
+ separator_regex=separator_regex,
+ prefix_regex=prefix_regex)
+ }}}
+{{%- else %}}
{{{ bash_sshd_config_set(parameter=PARAMETER, value=VALUE) }}}
+{{%- endif %}}
diff --git a/shared/templates/sshd_lineinfile/oval.template b/shared/templates/sshd_lineinfile/oval.template
index df63d542505..2cc38776eb2 100644
--- a/shared/templates/sshd_lineinfile/oval.template
+++ b/shared/templates/sshd_lineinfile/oval.template
@@ -1,7 +1,61 @@
-{{{
-oval_sshd_config(
- parameter=PARAMETER,
- value=VALUE,
- missing_parameter_pass=MISSING_PARAMETER_PASS
-)
-}}}
+{{%- set config_path = "/etc/ssh/sshd_config" %}}
+{{%- set config_dir = "/etc/ssh/sshd_config.d" -%}}
+{{%- set products_with_distributed_configuration = ("rhel9", "fedora") -%}}
+{{%- set description = "Ensure '" ~ PARAMETER ~ "' is configured with value '" ~ VALUE ~ "' in " ~ config_path %}}
+{{%- if product in products_with_distributed_configuration %}}
+{{%- set description = description ~ " and in " ~ config_dir -%}}
+{{%- endif %}}
+{{%- set case_insensitivity_kwargs = dict(prefix_regex="^[ \\t]*(?i)", separator_regex = "(?-i)[ \\t]+") -%}}
+
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata(description) }}}
+ <criteria comment="sshd is configured correctly or is not installed" operator="OR">
+ <criteria comment="sshd is not installed" operator="AND">
+ <extend_definition comment="sshd is not required or requirement is unset"
+ definition_ref="sshd_not_required_or_unset" />
+ <extend_definition comment="rpm package openssh-server removed"
+ definition_ref="package_openssh-server_removed" />
+ </criteria>
+ <criteria comment="sshd is installed and configured" operator="AND">
+ <extend_definition comment="sshd is required or requirement is unset"
+ definition_ref="sshd_required_or_unset" />
+ <extend_definition comment="rpm package openssh-server installed"
+ definition_ref="package_openssh-server_installed" />
+ <criteria comment="sshd is configured correctly" operator="OR">
+ {{{- oval_line_in_file_criterion(config_path, PARAMETER) | indent(8) }}}
+ {{%- if MISSING_PARAMETER_PASS %}}
+ <criteria comment="sshd is not configured incorrectly" operator="AND">
+ {{{- oval_line_in_file_criterion(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(10)}}}
+ {{%- if product in products_with_distributed_configuration %}}
+ {{{- oval_line_in_directory_criterion(config_dir, PARAMETER, MISSING_PARAMETER_PASS) | indent(10) }}}
+ {{%- endif %}}
+ </criteria>
+ {{%- endif %}}
+ {{%- if product in products_with_distributed_configuration %}}
+ {{{- oval_line_in_directory_criterion(config_dir, PARAMETER) | indent(8) }}}
+ {{%- endif %}}
+ </criteria>
+ </criteria>
+ </criteria>
+ </definition>
+ {{{ oval_line_in_file_test(config_path, PARAMETER) | indent (2) }}}
+ {{{ oval_line_in_file_object(config_path, parameter=PARAMETER, ** case_insensitivity_kwargs)| indent (2) }}}
+ {{{ oval_line_in_file_state(VALUE) | indent (2) }}}
+
+ {{%- if MISSING_PARAMETER_PASS %}}
+ {{{ oval_line_in_file_test(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(2) }}}
+ {{{ oval_line_in_file_object(config_path, parameter=PARAMETER, missing_parameter_pass=MISSING_PARAMETER_PASS, ** case_insensitivity_kwargs) | indent(2) }}}
+ {{%- endif %}}
+
+ {{%- if product in products_with_distributed_configuration %}}
+ {{{ oval_line_in_directory_test(config_dir, PARAMETER) | indent (2) }}}
+ {{{ oval_line_in_directory_object(config_dir, parameter=PARAMETER, ** case_insensitivity_kwargs) | indent (2) }}}
+ {{{ oval_line_in_directory_state(VALUE) | indent (2) }}}
+
+ {{%- if MISSING_PARAMETER_PASS %}}
+ {{{ oval_line_in_directory_test(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(2) }}}
+ {{{ oval_line_in_directory_object(config_path, parameter=PARAMETER, missing_parameter_pass=MISSING_PARAMETER_PASS, ** case_insensitivity_kwargs) | indent(2) }}}
+ {{%- endif %}}
+ {{%- endif %}}
+</def-group>
From b0f86c11fa0fb45b32b53833b5d3565c7eb73cfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Fri, 30 Apr 2021 11:52:22 +0200
Subject: [PATCH 2/6] Improved the lineinfile template.
It now escapes the text contents if parts of them could be incorrectly interpreted as regexes.
---
shared/macros-bash.jinja | 2 +-
shared/templates/lineinfile/oval.template | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
index b4518d83c19..d654a0e0e89 100644
--- a/shared/macros-bash.jinja
+++ b/shared/macros-bash.jinja
@@ -445,7 +445,7 @@ printf '%s\n' "{{{ message | replace('"', '\\"') }}}" >&2
# prefix_regex: regular expression describing allowed leading characters at each line
#}}
{{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*") -%}}
- {{%- set line_regex = prefix_regex+parameter+separator_regex -%}}
+ {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
{{%- set new_line = parameter+separator+value -%}}
if [ -e "{{{ path }}}" ] ; then
{{{ lineinfile_absent(path, line_regex, insensitive) | indent(4) }}}
diff --git a/shared/templates/lineinfile/oval.template b/shared/templates/lineinfile/oval.template
index a38856d9177..644327b7d6e 100644
--- a/shared/templates/lineinfile/oval.template
+++ b/shared/templates/lineinfile/oval.template
@@ -1,4 +1,4 @@
-{{%- set regex = "^[\s]*" + TEXT + "[\s]*$" -%}}
+{{%- set regex = "^[\s]*" ~ (TEXT | escape_regex) ~ "[\s]*$" -%}}
<def-group>
<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Check presence of " + TEXT + " in " + PATH) }}}
From 6953f74d1ab168e7ccc3f28877621edff317fef2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Fri, 30 Apr 2021 11:54:12 +0200
Subject: [PATCH 3/6] Introduced the sshd_use_directory_configuration rule.
The rule makes sure that the sshd configuration is distributed in the
/etc/ssh/sshd_config.d/ directory, and therefore it makes sense to scan that directory
in another rules.
---
.../bash/shared.sh | 15 ++++++++++
.../oval/shared.xml | 29 +++++++++++++++++++
.../sshd_use_directory_configuration/rule.yml | 26 +++++++++++++++++
.../tests/match.fail.sh | 4 +++
.../tests/simple.fail.sh | 3 ++
.../tests/simple.pass.sh | 4 +++
shared/references/cce-redhat-avail.txt | 1 -
shared/templates/extra_ovals.yml | 6 ++++
8 files changed, 87 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
new file mode 100644
index 00000000000..2ff58ec373c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
@@ -0,0 +1,15 @@
+# platform = multi_platform_all
+
+{{% set target_file = "/etc/ssh/sshd_config.d/sshd_config_original.conf" -%}}
+if test -f {{{ target_file}}}; then
+ {{{ die("Remediation probably already happened, '" ~ target_file ~ "' already exists, not doing anything.", action="false") }}}
+else
+ mkdir -p /etc/ssh/sshd_config.d
+ mv /etc/ssh/sshd_config {{{ target_file }}}
+cat > /etc/ssh/sshd_config << EOF
+# To modify the system-wide sshd configuration, create a *.conf file under
+# /etc/ssh/sshd_config.d/ which will be automatically included below
+
+Include /etc/ssh/sshd_config.d/*.conf
+EOF
+fi
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
new file mode 100644
index 00000000000..0ffb429adff
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
@@ -0,0 +1,29 @@
+{{%- set config_path = "/etc/ssh/sshd_config" %}}
+
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("foo") }}}
+ <criteria comment="sshd is configured correctly or is not installed" operator="OR">
+ <criteria comment="sshd is not installed" operator="AND">
+ <extend_definition comment="sshd is not required or requirement is unset"
+ definition_ref="sshd_not_required_or_unset" />
+ <extend_definition comment="rpm package openssh-server removed"
+ definition_ref="package_openssh-server_removed" />
+ </criteria>
+ <criteria comment="sshd is installed and configured" operator="AND">
+ <extend_definition comment="sshd is required or requirement is unset"
+ definition_ref="sshd_required_or_unset" />
+ <extend_definition comment="rpm package openssh-server installed"
+ definition_ref="package_openssh-server_installed" />
+ <criteria comment="sshd is configured correctly" operator="AND">
+ <extend_definition comment="sshd includes config files from its .d directory"
+ definition_ref="sshd_includes_config_files" />
+ {{{- oval_line_in_file_criterion(config_path, "match", missing_parameter_pass=true) | indent(8) }}}
+ </criteria>
+ </criteria>
+ </criteria>
+ </definition>
+ {{{ oval_line_in_file_test(config_path, "match", missing_parameter_pass=true) | indent (2) }}}
+ {{{ oval_line_in_file_object(config_path, parameter="match", missing_parameter_pass=true, prefix_regex="^[ \\t]*(?i)", separator_regex="(?-i)\s+\S+") | indent (2) }}}
+</def-group>
+
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
new file mode 100644
index 00000000000..8c370036e61
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
@@ -0,0 +1,26 @@
+documentation_complete: true
+
+prodtype: fedora,rhel9
+
+title: 'Distribute the SSH Server configuration to multiple files in a config directory.'
+
+description: |-
+ Make sure to have the <tt>Include /etc/ssh/sshd_config.d/*.conf</tt> line in the <tt>/etc/ssh/sshd_config</tt> file.
+ Ideally, don't have any active configuration directives in that file, and distribute the service configuration
+ to several files in the <tt>/etc/ssh/sshd_config.d</tt> directory.
+
+rationale: |-
+ This form of distributed configuration is considered as a good practice, and as other sshd rules assume that directives in files in the <tt>/etc/ssh/sshd_config.d</tt> config directory are effective, there has to be a rule that ensures this.
+ Aside from that, having multiple configuration files makes the SSH Server configuration changes easier to partition according to the reason that they were introduced, and therefore it should help to perform merges of hardening updates.
+
+severity: medium
+
+identifiers:
+ cce@rhel9: CCE-87681-3
+
+ocil_clause: "you don't include other configuration files from the main configuration file"
+
+ocil: |-
+ To determine whether the SSH server includes configuration files from the right directory, run the following command:
+ <pre>$ sudo grep -i '^Include' /etc/ssh/sshd_config</pre>
+ If a line <tt>Include /etc/ssh/sshd_config.d/*.conf</tt> is returned, then the configuration file inclusion is set correctly.
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
new file mode 100644
index 00000000000..fa2ee0654f2
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
@@ -0,0 +1,4 @@
+# platform = multi_platform_all
+
+echo "Match something" >> /etc/ssh/sshd_config
+echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
new file mode 100644
index 00000000000..a6013ad7cfa
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
@@ -0,0 +1,3 @@
+# platform = multi_platform_all
+
+echo "include /etc/ssh/sshd_config.d/.*" > /etc/ssh/sshd_config
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
new file mode 100644
index 00000000000..7a26f521415
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
@@ -0,0 +1,4 @@
+# platform = multi_platform_all
+
+# Handling of case-insensitivity of include is tricky
+echo "Include /etc/ssh/sshd_config.d/*.conf" > /etc/ssh/sshd_config
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 73d025484e6..40a2b9b5868 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -1780,7 +1780,6 @@ CCE-87677-1
CCE-87678-9
CCE-87679-7
CCE-87680-5
-CCE-87681-3
CCE-87682-1
CCE-87683-9
CCE-87684-7
diff --git a/shared/templates/extra_ovals.yml b/shared/templates/extra_ovals.yml
index 095d911ee1c..69062ebe541 100644
--- a/shared/templates/extra_ovals.yml
+++ b/shared/templates/extra_ovals.yml
@@ -57,3 +57,9 @@ service_syslog_disabled:
vars:
servicename: syslog
packagename: rsyslog
+
+sshd_includes_config_files:
+ name: lineinfile
+ vars:
+ path: /etc/ssh/sshd_config
+ text: "Include /etc/ssh/sshd_config.d/*.conf"
From d7fcab7ad66e77bb7ccba507e3f024bc892c3864 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Tue, 11 May 2021 16:06:29 +0200
Subject: [PATCH 4/6] Improved error reporting related to macros.
---
ssg/jinja.py | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/ssg/jinja.py b/ssg/jinja.py
index a46246ad0fb..28edd9a6dcd 100644
--- a/ssg/jinja.py
+++ b/ssg/jinja.py
@@ -153,16 +153,20 @@ def load_macros(substitutions_dict=None):
add_python_functions(substitutions_dict)
try:
- update_substitutions_dict(JINJA_MACROS_BASE_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_HIGHLEVEL_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_ANSIBLE_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_BASH_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_OVAL_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_IGNITION_DEFINITIONS, substitutions_dict)
- update_substitutions_dict(JINJA_MACROS_KUBERNETES_DEFINITIONS, substitutions_dict)
+ filenames = [
+ JINJA_MACROS_BASE_DEFINITIONS,
+ JINJA_MACROS_HIGHLEVEL_DEFINITIONS,
+ JINJA_MACROS_ANSIBLE_DEFINITIONS,
+ JINJA_MACROS_BASH_DEFINITIONS,
+ JINJA_MACROS_OVAL_DEFINITIONS,
+ JINJA_MACROS_IGNITION_DEFINITIONS,
+ JINJA_MACROS_KUBERNETES_DEFINITIONS,
+ ]
+ for filename in filenames:
+ update_substitutions_dict(filename, substitutions_dict)
except Exception as exc:
- msg = ("Error extracting macro definitions: {0}"
- .format(str(exc)))
+ msg = ("Error extracting macro definitions from '{1}': {0}"
+ .format(str(exc), filename))
raise RuntimeError(msg)
return substitutions_dict
From df45c3fa295a2dc5a23cc347657964df6453cbae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Tue, 11 May 2021 16:44:50 +0200
Subject: [PATCH 5/6] Removed devault values that are variables from Jinja
Support in older jinja2 packages is not in a good shape.
---
shared/macros-oval.jinja | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
index d38db96d9e3..87e0fd7d87d 100644
--- a/shared/macros-oval.jinja
+++ b/shared/macros-oval.jinja
@@ -92,7 +92,8 @@
- parameter (String): The parameter to be checked in the configuration file.
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
-{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem=rule_id) -%}}
+{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem='') -%}}
+{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- set prefix_text = "Check the" -%}}
{{%- if missing_parameter_pass %}}
@@ -113,7 +114,8 @@
- parameter (String): The parameter to be checked in the configuration file.
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
-{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem=rule_id) -%}}
+{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem='') -%}}
+{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set check_existence = "none_exist" -%}}
@@ -144,7 +146,8 @@
- missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
- multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
#}}
-{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem=rule_id) -%}}
+{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem='') -%}}
+{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- if multi_value -%}}
{{%- set group_regex = "([^#]*).*$" -%}}
@@ -196,7 +199,8 @@
- quotes (String): If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.
For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
#}}
-{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem=rule_id) -%}}
+{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem='') -%}}
+{{%- set id_stem = id_stem or rule_id -%}}
{{%- set regex = value -%}}
{{%- if quotes != "" %}}
{{%- if "\\1" in value > 0 %}}
From a3ec49f75ac3059d7096985e08e10005db96330a Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Fri, 30 Jul 2021 17:25:25 +0200
Subject: [PATCH 6/6] Don't remediate when it is inappropriate
Don't remediate when the config file already contains the include
directive.
---
.../sshd_use_directory_configuration/bash/shared.sh | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
index 2ff58ec373c..9317b23992d 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
@@ -1,12 +1,15 @@
# platform = multi_platform_all
{{% set target_file = "/etc/ssh/sshd_config.d/sshd_config_original.conf" -%}}
+{{% set base_config = "/etc/ssh/sshd_config" -%}}
if test -f {{{ target_file}}}; then
{{{ die("Remediation probably already happened, '" ~ target_file ~ "' already exists, not doing anything.", action="false") }}}
+elif grep -Eq '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf' {{{ base_config }}} && ! grep -Eq '^\s*Match\s' {{{ base_config }}}; then
+ {{{ die("Remediation probably already happened, '" ~ base_config ~ "' already contains the include directive.", action="false") }}}
else
mkdir -p /etc/ssh/sshd_config.d
- mv /etc/ssh/sshd_config {{{ target_file }}}
-cat > /etc/ssh/sshd_config << EOF
+ mv {{{ base_config }}} {{{ target_file }}}
+cat > {{{ base_config }}} << EOF
# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below

524
SOURCES/scap-security-guide-0.1.58-tests_for_playbooks_that_change_banners-PR_7376.patch
View File

@ -1,524 +0,0 @@
From bf018e9f8327b231b967db8ec74fabf01802b6a8 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:45:04 +0200
Subject: [PATCH 1/3] Add test for ansible files removed and readded
Check if any playbook removes a file and then add it back again.
The file removal is based on the 'file' module with 'state: absent', and
the reintroduction of the file is based on 'lineinfile', 'blockinfile'
and 'copy' modules.
---
CMakeLists.txt | 2 +
tests/CMakeLists.txt | 8 ++
tests/test_ansible_file_removed_and_added.py | 97 ++++++++++++++++++++
3 files changed, 107 insertions(+)
create mode 100644 tests/test_ansible_file_removed_and_added.py
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 330b869d0f9..e41f2caa630 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -129,6 +129,7 @@ find_python_module(jinja2 REQUIRED)
find_python_module(pytest)
find_python_module(pytest_cov)
find_python_module(json2html)
+find_python_module(yamlpath)
# sphinx documentation requirements
find_python_module(sphinx)
@@ -231,6 +232,7 @@ message(STATUS "python pytest module (optional): ${PY_PYTEST}")
message(STATUS "ansible-playbook module (optional): ${ANSIBLE_PLAYBOOK_EXECUTABLE}")
message(STATUS "ansible-lint module (optional): ${ANSIBLE_LINT_EXECUTABLE}")
message(STATUS "yamllint module (optional): ${YAMLLINT_EXECUTABLE}")
+message(STATUS "yamlpath module (optional): ${PY_YAMLPATH}")
message(STATUS "BATS framework (optional): ${BATS_EXECUTABLE}")
message(STATUS "python sphinx module (optional): ${PY_SPHINX}")
message(STATUS "python sphinxcontrib.autojinja module (optional): ${PY_SPHINXCONTRIB.AUTOJINJA}")
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 3e2d8a4ec31..739cc124035 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -121,3 +121,11 @@ add_test(
)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
+
+if (PY_YAMLPATH)
+ add_test(
+ NAME "ansible-file-removed-and-added"
+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
+ )
+ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
+endif()
diff --git a/tests/test_ansible_file_removed_and_added.py b/tests/test_ansible_file_removed_and_added.py
new file mode 100644
index 00000000000..23f6f888bda
--- /dev/null
+++ b/tests/test_ansible_file_removed_and_added.py
@@ -0,0 +1,97 @@
+#!/usr/bin/python3
+
+import argparse
+import os
+import sys
+from types import SimpleNamespace
+from yamlpath import Processor
+from yamlpath import YAMLPath
+from yamlpath.common import Parsers
+from yamlpath.exceptions import YAMLPathException
+from yamlpath.wrappers import ConsolePrinter
+
+
+def parse_command_line_args():
+ parser = argparse.ArgumentParser(
+ description="Checks if an Ansible Playbook removes a file and then adds it again.")
+ parser.add_argument("--ansible_dir", required=True,
+ help="Directory containing Ansible Playbooks")
+ args = parser.parse_args()
+ return args
+
+
+def check_playbook_file_removed_and_added(playbook_path):
+ playbook_ok = True
+
+ yaml_parser = Parsers.get_yaml_editor()
+
+ logging_args = SimpleNamespace(quiet=False, verbose=False, debug=False)
+ log = ConsolePrinter(logging_args)
+
+ # Find every path removed by a file Task (also matches tasks within blocks)
+ files_absent_string = "tasks.**.file[state=absent][parent()].path"
+ files_absent_yamlpath = YAMLPath(files_absent_string)
+ path_editing_tasks_yamlpath = ""
+
+ log.info("Info: Evaluating playbook '{}'".format(playbook_path))
+ (yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml_parser, log, playbook_path)
+ if not doc_loaded:
+ # There was an issue loading the file; an error message has already been
+ # printed via ConsolePrinter.
+ return False
+
+ processor = Processor(log, yaml_data)
+ try:
+ for node in processor.get_nodes(files_absent_yamlpath, mustexist=False):
+ path = str(node)
+ # 'node' is a NodeCoords.
+ if path == 'None':
+ continue
+ elif "{{" in path:
+ # Identified path is a Jinja expression, unfortunately there is no easy way to get
+ # the actual path without making this test very complicated
+ continue
+
+ # Check if this paths is used in any of the following ansible modules
+ ansible_modules = ["lineinfile", "blockinfile", "copy"]
+ path_editing_tasks_string = "tasks.**.[.=~/{modules}/][*='{path}'][parent()].name"
+ path_editing_tasks_yamlpath = YAMLPath(path_editing_tasks_string.format(
+ modules="|".join(ansible_modules),
+ path=node)
+ )
+ for task in processor.get_nodes(path_editing_tasks_yamlpath, mustexist=False):
+ log.info("Error: Task '{}' manipulates a file that is removed by another task"
+ .format(task))
+ playbook_ok = False
+ except YAMLPathException as ex:
+ no_file_msg = ("Cannot add PathSegmentTypes.TRAVERSE subreference to lists at 'None' "
+ "in '{}'.")
+ if str(ex) == no_file_msg.format(files_absent_string):
+ log.info("Info: Playbook {} has no 'file' tasks.".format(playbook_path))
+ elif path_editing_tasks_yamlpath and str(ex) == no_file_msg.format(
+ path_editing_tasks_yamlpath):
+ log.info("Info: Playbook {} has no '{}' tasks.".format(
+ playbook_path, " ".join(ansible_modules)))
+ else:
+ log.info("Error: {}.".format(ex))
+
+ return playbook_ok
+
+
+def main():
+ args = parse_command_line_args()
+
+ all_playbooks_ok = True
+ for dir_item in os.listdir(args.ansible_dir):
+ if dir_item.endswith(".yml"):
+ playbook_path = os.path.join(args.ansible_dir, dir_item)
+
+ if not check_playbook_file_removed_and_added(playbook_path):
+ all_playbooks_ok = False
+
+ if not all_playbooks_ok:
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
From e6d727762ba446cad94f1e002fa7a7fef0f1a4cb Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 11 Aug 2021 09:48:14 +0200
Subject: [PATCH 2/3] Unit tests the function for file removed and added
Add a unit test for the core function that checks if any playbook
removes a file and then reintroduces it back.
---
tests/CMakeLists.txt | 6 ++
.../file_block_removed_and_added.yml | 69 +++++++++++++++++++
.../file_not_removed_and_added.yml | 49 +++++++++++++
.../file_removed_and_added.yml | 62 +++++++++++++++++
.../file_removed_and_not_added.yml | 46 +++++++++++++
...t_check_playbook_file_removed_and_added.py | 39 +++++++++++
6 files changed, 271 insertions(+)
create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_added.yml
create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
create mode 100644 tests/test_check_playbook_file_removed_and_added.py
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 739cc124035..000a1b1385d 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -123,6 +123,12 @@ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
if (PY_YAMLPATH)
+ if (PY_PYTEST)
+ add_test(
+ NAME "test-function-check_playbook_file_removed_and_added"
+ COMMAND "${PYTHON_EXECUTABLE}" -m pytest ${PYTEST_COVERAGE_OPTIONS} "${CMAKE_CURRENT_SOURCE_DIR}/test_check_playbook_file_removed_and_added.py"
+ )
+ endif()
add_test(
NAME "ansible-file-removed-and-added"
COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
new file mode 100644
index 00000000000..8863b333129
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
@@ -0,0 +1,69 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - block:
+
+ - name: Remove Rsh Trust Files
+ file:
+ path: /root/shosts.equiv
+ state: absent
+
+ - name: Add line to /root/shosts.equiv
+ lineinfile:
+ dest: /root/shosts.equiv
+ line: 'test host'
+ create: true
+ tags:
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+ - no_rsh_trust_files
+ - restrict_strategy
+
diff --git a/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
new file mode 100644
index 00000000000..3d3e53b958f
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
@@ -0,0 +1,49 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
new file mode 100644
index 00000000000..a44c39a9db2
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
@@ -0,0 +1,62 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - remove incorrect banner
+ file:
+ state: absent
+ path: /etc/issue
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Modify the System Login Banner - add correct banner
+ lineinfile:
+ dest: /etc/issue
+ line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
+ "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
+ "\n") | regex_replace("\\", "") | wordwrap() }}'
+ create: true
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
new file mode 100644
index 00000000000..08cda7e5063
--- /dev/null
+++ b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
@@ -0,0 +1,46 @@
+---
+
+- hosts: all
+ vars:
+ var_system_crypto_policy: !!str FUTURE
+ var_sudo_logfile: !!str /var/log/sudo.log
+
+ tasks:
+ - name: Modify the System Login Banner - remove incorrect banner
+ file:
+ state: absent
+ path: /etc/issue
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - banner_etc_issue
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+
+ - name: Test for existence /etc/issue
+ stat:
+ path: /etc/issue
+ register: file_exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
+ - name: Ensure permission 0644 on /etc/issue
+ file:
+ path: /etc/issue
+ mode: '0644'
+ when: file_exists.stat is defined and file_exists.stat.exists
+ tags:
+ - configure_strategy
+ - file_permissions_etc_issue
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+
diff --git a/tests/test_check_playbook_file_removed_and_added.py b/tests/test_check_playbook_file_removed_and_added.py
new file mode 100644
index 00000000000..181bb14ed46
--- /dev/null
+++ b/tests/test_check_playbook_file_removed_and_added.py
@@ -0,0 +1,39 @@
+import os
+import pytest
+
+from .test_ansible_file_removed_and_added import check_playbook_file_removed_and_added
+
+
+def test_file_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_removed_and_added.yml")
+ assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_removed_and_not_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_removed_and_not_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_not_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_not_removed_and_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_block_removed_and_added.yml")
+ assert not check_playbook_file_removed_and_added(playbook_path)
+
+
+def test_file_block_removed_and_not_added():
+ playbook_path = os.path.join(os.path.dirname(__file__),
+ "ansible_file_removed_and_added",
+ "file_block_removed_and_not_added.yml")
+ assert check_playbook_file_removed_and_added(playbook_path)
From 741ec823ac39341f8aa0649031b72d2ac36e8a64 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 12 Aug 2021 10:36:47 +0200
Subject: [PATCH 3/3] Mention Ansible static yamlpath test in docs
---
.../developer/02_building_complianceascode.md | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/docs/manual/developer/02_building_complianceascode.md b/docs/manual/developer/02_building_complianceascode.md
index d536df0a259..87469bf5f9b 100644
--- a/docs/manual/developer/02_building_complianceascode.md
+++ b/docs/manual/developer/02_building_complianceascode.md
@@ -64,6 +64,20 @@ yum install yamllint ansible-lint
apt-get install yamllint ansible-lint
```
+### Static Ansible Playbooks tests
+
+Install `yamlpath` and `pytest` to run tests cases that analyse the Ansible
+Playbooks' yaml nodes.
+```bash
+pip3 install yamlpath
+
+# Fedora/RHEL
+yum install python3-pytest
+
+# Ubuntu/Debian
+apt-get install python-pytest
+```
+
### Ninja (Faster Builds)
Install the `ninja` build system if you want to use it instead of

21
SOURCES/scap-security-guide-0.1.58-update_rhel7_stig-PR_7217.patch
View File

@ -1,21 +0,0 @@
From 2452c1c69e6bda3b6130d8cf80c69c711c438fd0 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Wed, 7 Jul 2021 18:59:10 +0200
Subject: [PATCH] Select two more rules in RHEL7 STIG.
- sysctl_net_ipv4_conf_all_rp_filter
- sysctl_net_ipv4_conf_default_rp_filter
---
products/rhel7/profiles/stig.profile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
index 23635ffed91..78133180ecc 100644
--- a/products/rhel7/profiles/stig.profile
+++ b/products/rhel7/profiles/stig.profile
@@ -314,3 +314,5 @@ selections:
- package_MFEhiplsm_installed
- file_ownership_var_log_audit
- file_permissions_var_log_audit
+ - sysctl_net_ipv4_conf_all_rp_filter
+ - sysctl_net_ipv4_conf_default_rp_filter

3258
SOURCES/scap-security-guide-0.1.58-update_stig_benchmark-PR_7326.patch
View File

File diff suppressed because one or more lines are too long

34
SOURCES/scap-security-guide-0.1.58-update_stig_gui_rhel7_version-PR_7340.patch
View File

@ -1,34 +0,0 @@
From f151a439ce9199a0a4496c0bc55811b47bfd8b78 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 5 Aug 2021 16:45:29 +0200
Subject: [PATCH] update version of rhel7 stig_gui profile
---
products/rhel7/profiles/stig_gui.profile | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/products/rhel7/profiles/stig_gui.profile b/products/rhel7/profiles/stig_gui.profile
index d41d2ef4f80..6dd433d6c21 100644
--- a/products/rhel7/profiles/stig_gui.profile
+++ b/products/rhel7/profiles/stig_gui.profile
@@ -1,9 +1,9 @@
documentation_complete: true
metadata:
- version: V3R3
+ version: V3R4
SMEs:
- - carlosmmatos
+ - ggbecker
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
@@ -11,7 +11,7 @@ title: 'DISA STIG with GUI for Red Hat Enterprise Linux 7'
description: |-
This profile contains configuration checks that align to the
- DISA STIG with GUI for Red Hat Enterprise Linux V3R3.
+ DISA STIG with GUI for Red Hat Enterprise Linux V3R4.
In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this
configuration baseline as applicable to the operating system tier of

120
SOURCES/scap-security-guide-0.1.58-update_stig_mapping_table-PR_7327.patch
View File

@ -1,120 +0,0 @@
From ea1bab197a17dd944e41a583c82c3cc757bb566b Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Wed, 4 Aug 2021 12:23:05 +0200
Subject: [PATCH] Update STIG mapping table to reflect statistics of coverage.
---
.../shared_xccdf-apply-overlay-stig.xslt | 59 +++++++++++++------
.../transforms/shared_xccdf2table-stig.xslt | 28 +++++++++
2 files changed, 68 insertions(+), 19 deletions(-)
diff --git a/shared/transforms/shared_xccdf-apply-overlay-stig.xslt b/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
index 945f709b95..b7c000608c 100644
--- a/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
+++ b/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
@@ -28,26 +28,47 @@
<xsl:variable name="overlay_ref" select="@disa"/>
<xsl:variable name="overlay_title" select="xccdf:title/@text"/>
- <xsl:for-each select="$rules">
- <xsl:if test="@id=$overlay_rule">
- <Group id="V-{$overlay_id}">
- <title>SRG-OS-ID</title>
- <description></description>
- <Rule id="{$overlay_rule}" severity="{$overlay_severity}" >
- <version><xsl:value-of select="$overlay_version"/></version>
- <title><xsl:value-of select="$overlay_title"/></title>
- <description><xsl:copy-of select="xccdf:rationale/node()" /></description>
- <check system="C-{$overlay_id}_chk">
- <check-content>
- <xsl:apply-templates select="xccdf:check[@system='http://scap.nist.gov/schema/ocil/2']"/>
- </check-content>
- </check>
- <ident system="https://public.cyber.mil/stigs/cci"><xsl:value-of select="$overlay_ref" /></ident>
- <fixtext><xsl:copy-of select="xccdf:description/node()" /></fixtext>
- </Rule>
+ <xsl:choose>
+ <xsl:when test="$overlay_rule='XXXX'">
+ <Group id="V-{$overlay_id}">
+ <title>SRG-OS-ID</title>
+ <description></description>
+ <Rule id="Missing Rule" severity="{$overlay_severity}" >
+ <version><xsl:value-of select="$overlay_version"/></version>
+ <title><xsl:value-of select="$overlay_title"/></title>
+ <description></description>
+ <check system="C-{$overlay_id}_chk">
+ <check-content>
+ </check-content>
+ </check>
+ <ident></ident>
+ <fixtext></fixtext>
+ </Rule>
</Group>
- </xsl:if>
- </xsl:for-each>
+ </xsl:when>
+ <xsl:otherwise>
+ <xsl:for-each select="$rules">
+ <xsl:if test="@id=$overlay_rule">
+ <Group id="V-{$overlay_id}">
+ <title>SRG-OS-ID</title>
+ <description></description>
+ <Rule id="{$overlay_rule}" severity="{$overlay_severity}" >
+ <version><xsl:value-of select="$overlay_version"/></version>
+ <title><xsl:value-of select="$overlay_title"/></title>
+ <description><xsl:copy-of select="xccdf:rationale/node()" /></description>
+ <check system="C-{$overlay_id}_chk">
+ <check-content>
+ <xsl:apply-templates select="xccdf:check[@system='http://scap.nist.gov/schema/ocil/2']"/>
+ </check-content>
+ </check>
+ <ident system="https://public.cyber.mil/stigs/cci"><xsl:value-of select="$overlay_ref" /></ident>
+ <fixtext><xsl:copy-of select="xccdf:description/node()" /></fixtext>
+ </Rule>
+ </Group>
+ </xsl:if>
+ </xsl:for-each>
+ </xsl:otherwise>
+ </xsl:choose>
</xsl:for-each>
</xsl:copy>
diff --git a/shared/transforms/shared_xccdf2table-stig.xslt b/shared/transforms/shared_xccdf2table-stig.xslt
index 3746c386c0..4c477542f4 100644
--- a/shared/transforms/shared_xccdf2table-stig.xslt
+++ b/shared/transforms/shared_xccdf2table-stig.xslt
@@ -20,6 +20,34 @@
</div>
<br/>
<br/>
+
+ <div>
+ <table>
+ <thead>
+ <tr>
+ <th>Total</th>
+ <th>Missing</th>
+ <th>Implemented</th>
+ <th>Coverage</th>
+ <th>STIG ids missing rule</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule))"/></td>
+ <td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id='Missing Rule']))"/></td>
+ <td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id!='Missing Rule']))"/></td>
+ <td><xsl:value-of select="format-number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id!='Missing Rule']) div count(/cdf:Benchmark/cdf:Group/cdf:Rule)*100, '#.00')"/>%</td>
+ <td>
+ <xsl:for-each select="/cdf:Benchmark/cdf:Group/cdf:Rule[@id='Missing Rule']">
+ <xsl:value-of select="cdf:version/node()"/><xsl:text>&#xd;</xsl:text>
+ </xsl:for-each>
+ </td>
+ </tr>
+ </tbody>
+ </table>
+ </div>
+
<xsl:apply-templates select="cdf:Benchmark"/>
</body>
</html>

9202
SOURCES/scap-security-guide-0.1.58-update_stig_overlay-PR_7287.patch
View File

File diff suppressed because one or more lines are too long

89
SOURCES/scap-security-guide-0.1.58-update_stig_references-PR_7366.patch
View File

@ -1,89 +0,0 @@
From 3d7b01a7fdc27f7e5a31ba508f7f84dab446aa4b Mon Sep 17 00:00:00 2001
From: Eduardo Barretto <eduardo.barretto@canonical.com>
Date: Wed, 16 Jun 2021 16:34:59 +0200
Subject: [PATCH 1/5] Add accounts_password_pam_dictcheck to UBTU-20-010056
---
products/ubuntu2004/profiles/stig.profile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/products/ubuntu2004/profiles/stig.profile b/products/ubuntu2004/profiles/stig.profile
index 4d03bfe7ae..ac9685809c 100644
--- a/products/ubuntu2004/profiles/stig.profile
+++ b/products/ubuntu2004/profiles/stig.profile
@@ -113,6 +113,8 @@ selections:
- accounts_password_pam_ocredit
# UBTU-20-010056 The Ubuntu operating system must prevent the use of dictionary words for passwords.
+ - var_password_pam_dictcheck=1
+ - accounts_password_pam_dictcheck
# UBTU-20-010057 The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.
- var_password_pam_retry=3
From 6c3c586a7fe27d68052428e02843c573f9cbd559 Mon Sep 17 00:00:00 2001
From: Eduardo Barretto <eduardo.barretto@canonical.com>
Date: Wed, 4 Aug 2021 18:11:48 +0200
Subject: [PATCH 2/5] Add ubuntu2004 to prodtype in
accounts_password_pam_dictcheck
---
.../accounts_password_pam_dictcheck/rule.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
index 2990150c0a..00da0397b0 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,rhel8
+prodtype: fedora,rhel8,ubuntu2004
title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
From b523676430765ab7fff09f790618f091d3f916e2 Mon Sep 17 00:00:00 2001
From: Eduardo Barretto <eduardo.barretto@canonical.com>
Date: Wed, 4 Aug 2021 18:12:59 +0200
Subject: [PATCH 4/5] Add stigid@ubuntu2004 to accounts_password_pam_dictcheck
---
.../accounts_password_pam_dictcheck/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
index bae2db25fe..226329d752 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -29,6 +29,7 @@ references:
nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
srg: SRG-OS-000480-GPOS-00225
stigid@rhel8: RHEL-08-020300
+ stigid@ubuntu2004: UBTU-20-010056
ocil_clause: 'dictcheck is not found or not equal to the required value'
From 39973c39ea17fb13730f1bef239783464c1b4b01 Mon Sep 17 00:00:00 2001
From: Eduardo Barretto <eduardo.barretto@canonical.com>
Date: Wed, 4 Aug 2021 18:13:16 +0200
Subject: [PATCH 5/5] Add pam platform to accounts_password_pam_dictcheck
---
.../accounts_password_pam_dictcheck/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
index 226329d752..d0d4b8c5c5 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -39,6 +39,7 @@ ocil: |-
The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
<pre>dictcheck=1</pre>
+platform: pam
template:
name: accounts_password

821
SOURCES/scap-security-guide-0.1.58-update_stig_references_for_servives_rhel8_v1r3-PR_7299.patch
View File

@ -1,821 +0,0 @@
From 7899e18d486b6181f3213c3c1351f24cdce84bf8 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 10:34:47 -0500
Subject: [PATCH 01/20] Split RHEL-08-040100 into two rules
One for the firewalld package and one for the firewalld service.
---
.../firewalld_activation/service_firewalld_enabled/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
index cff9581e76..42849bdd5a 100644
--- a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
+++ b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
@@ -40,7 +40,7 @@ references:
srg: SRG-OS-000096-GPOS-00050,SRG-OS-000297-GPOS-00115,SRG-OS-000480-GPOS-00227,SRG-OS-000480-GPOS-00231,SRG-OS-000480-GPOS-00232
stigid@ol7: OL07-00-040520
stigid@rhel7: RHEL-07-040520
- stigid@rhel8: RHEL-08-040100
+ stigid@rhel8: RHEL-08-040101
stigid@sle15: SLES-15-010220
ocil: |-
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 965068a691..9d0145a96f 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -968,9 +968,11 @@ selections:
# RHEL-08-040090
# RHEL-08-040100
- - service_firewalld_enabled
- package_firewalld_installed
+ # RHEL-08-040101
+ - service_firewalld_enabled
+
# RHEL-08-040110
- wireless_disable_interfaces
From 7396acddc284acc54d66640e7e0bc5251334bc0b Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 11:44:59 -0500
Subject: [PATCH 02/20] Split the rule for RHEL-08-020040
Split and package_tmux_installed and configure_tmux_lock_command
---
.../console_screen_locking/package_tmux_installed/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
index 550eaea8bb..120d1c49e0 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
@@ -40,7 +40,7 @@ references:
nist-csf: PR.AC-7
ospp: FMT_MOF_EXT.1
srg: SRG-OS-000030-GPOS-00011,SRG-OS-000028-GPOS-00009
- stigid@rhel8: RHEL-08-020040
+ stigid@rhel8: RHEL-08-020039
vmmsrg: SRG-OS-000030-VMM-000110
ocil_clause: 'the package is not installed'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 9d0145a96f..9f57b28f4f 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -481,8 +481,10 @@ selections:
# RHEL-08-020030
- dconf_gnome_screensaver_lock_enabled
- # RHEL-08-020040
+ # RHEL-08-020039
- package_tmux_installed
+
+ # RHEL-08-020040
- configure_tmux_lock_command
# RHEL-08-020041
From 6e3a93e173fbd12640e585d579f1e1d0afd3f419 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 11:49:59 -0500
Subject: [PATCH 03/20] Split RHEL-08-040100
One for the openssh-server package and one for the openssh-server service.
---
.../services/ssh/package_openssh-server_installed/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
index 0b2a660c29..b551f08f38 100644
--- a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
+++ b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
@@ -30,7 +30,7 @@ references:
srg: SRG-OS-000423-GPOS-00187,SRG-OS-000424-GPOS-00188,SRG-OS-000425-GPOS-00189,SRG-OS-000426-GPOS-00190
stigid@ol7: OL07-00-040300
stigid@rhel7: RHEL-07-040300
- stigid@rhel8: RHEL-08-040160
+ stigid@rhel8: RHEL-08-040159
stigid@ubuntu2004: UBTU-20-010042
ocil_clause: 'the package is not installed'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 9f57b28f4f..66f70cdfd5 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1037,8 +1037,10 @@ selections:
# RHEL-08-040150
- # RHEL-08-040160
+ # RHEL-08-040159
- package_openssh-server_installed
+
+ # RHEL-08-040160
- service_sshd_enabled
# RHEL-08-040161
From 097682c4e225b7bdefd7b38c89cadf984540da04 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 11:56:17 -0500
Subject: [PATCH 04/20] Split RHEL-08-040140
Package usbguard and service usbguard are split out into their own
STIG ID. now.
---
.../services/usbguard/package_usbguard_installed/rule.yml | 2 +-
.../services/usbguard/service_usbguard_enabled/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 8 ++++++--
3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
index 333718182e..19ef8aaca6 100644
--- a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
+++ b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
@@ -48,7 +48,7 @@ references:
disa: CCI-001958
ism: "1418"
srg: SRG-OS-000378-GPOS-00163
- stigid@rhel8: RHEL-08-040140
+ stigid@rhel8: RHEL-08-040139
ocil_clause: 'the package is not installed'
diff --git a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
index 86adda9ecc..4f008129ea 100644
--- a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
+++ b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
@@ -27,7 +27,7 @@ references:
nist: CM-8(3)(a),IA-3
ospp: FMT_SMF_EXT.1
srg: SRG-OS-000378-GPOS-00163
- stigid@rhel8: RHEL-08-040140
+ stigid@rhel8: RHEL-08-040141
ocil_clause: 'the service is not enabled'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 66f70cdfd5..fd090e4058 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1030,11 +1030,15 @@ selections:
- package_fapolicyd_installed
- service_fapolicyd_enabled
- # RHEL-08-040140
+ # RHEL-08-040139
- package_usbguard_installed
- - service_usbguard_enabled
+
+ # RHEL-08-040140
- usbguard_generate_policy
+ # RHEL-08-040141
+ - service_usbguard_enabled
+
# RHEL-08-040150
# RHEL-08-040159
From 1b28e2bed919e7f16519b051d39f7df640498d4f Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:01:13 -0500
Subject: [PATCH 05/20] Split RHEL-08-030180
One for the auditd package and one for the auditd service.
---
linux_os/guide/system/auditing/service_auditd_enabled/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 3 +++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
index e10e8c7782..c7ce75e87c 100644
--- a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
+++ b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
@@ -55,7 +55,7 @@ references:
stigid@sle12: SLES-12-020010
stigid@sle15: SLES-15-030050
nist@sle12: AU-3,AU-3(1),AU-3(1).1(ii),AU-3.1,AU-6(4),AU-6(4).1,AU-7(1),AU-7(1).1,AU-7(a),AU-14(1),AU-14(1).1,CM-6(b),CM-6.1(iv),MA-4(1)(a)
- stigid@rhel8: RHEL-08-010560
+ stigid@rhel8: RHEL-08-030381
ocil: |-
{{{ ocil_service_enabled(service="auditd") }}}
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index fd090e4058..682034af4d 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -683,6 +683,9 @@ selections:
# RHEL-08-030180
- package_audit_installed
+ # RHEL-08-030181
+ - service_auditd_enabled
+
# RHEL-08-030190
- audit_rules_privileged_commands_su
From 0cf0bb3f6153be26abd4622221d73356be667d1f Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:04:34 -0500
Subject: [PATCH 06/20] Split RHEL-08-010521
Disabling Kerb5 and gssapi auth for sshd move split into two STIG ids.
---
.../services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
index 946ba7f1d6..2134da2839 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
@@ -36,7 +36,7 @@ references:
srg: SRG-OS-000364-GPOS-00151,SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-040430
stigid@rhel7: RHEL-07-040430
- stigid@rhel8: RHEL-08-010521
+ stigid@rhel8: RHEL-08-010522
vmmsrg: SRG-OS-000480-VMM-002000
ocil_clause: 'it is commented out or is not disabled'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 682034af4d..f913545106 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -318,6 +318,8 @@ selections:
# RHEL-08-010521
- sshd_disable_kerb_auth
+
+ # RHEL-08-010522
- sshd_disable_gssapi_auth
# RHEL-08-010540
From 994b19da2cb0f88d6eb0533d1ba4cae362351e56 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:10:06 -0500
Subject: [PATCH 07/20] Split RHEL-08-010471
One for the rng-tools package and one for the rngd service.
---
.../software/system-tools/package_rng-tools_installed/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
index 33d5625fee..663a270626 100644
--- a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
+++ b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
@@ -21,7 +21,7 @@ identifiers:
references:
disa: CCI-000366
srg: SRG-OS-000480-GPOS-00227
- stigid@rhel8: RHEL-08-010471
+ stigid@rhel8: RHEL-08-010472
ocil_clause: 'the package is not installed'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index f913545106..e6ef5ee42c 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -299,6 +299,8 @@ selections:
# RHEL-08-010471
- service_rngd_enabled
+
+ # RHEL-08-010472
- package_rng-tools_installed
# RHEL-08-010480
From 2d1756e3fe017645922b1622dac139a249c48a12 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:14:53 -0500
Subject: [PATCH 08/20] Split RHEL-08-010200
idle timeout and keepalive are now split
---
.../services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
index 95c840fc5f..5a44255013 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
@@ -53,7 +53,7 @@ references:
srg: SRG-OS-000126-GPOS-00066,SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109,SRG-OS-000395-GPOS-00175
stigid@ol7: OL07-00-040320
stigid@rhel7: RHEL-07-040320
- stigid@rhel8: RHEL-08-010200
+ stigid@rhel8: RHEL-08-010201
stigid@sle12: SLES-12-030190
stigid@sle15: SLES-15-010280
stigid@ubuntu2004: UBTU-20-010037
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index e6ef5ee42c..036fd00808 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -156,9 +156,11 @@ selections:
- dir_perms_world_writable_sticky_bits
# RHEL-08-010200
- - sshd_set_idle_timeout
- sshd_set_keepalive_0
+ # RHEL-08-010201
+ - sshd_set_idle_timeout
+
# RHEL-08-010210
- file_permissions_var_log_messages
From 0823a6f84d32338223502dfc93b09df5225debf6 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:23:31 -0500
Subject: [PATCH 09/20] Split RHEL-08-010141
GRUB2 UEFI username and password split
---
.../bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
index a5f9349882..8a98cbdc95 100644
--- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
@@ -56,7 +56,7 @@ references:
srg: SRG-OS-000080-GPOS-00048
stigid@ol7: OL07-00-010490
stigid@rhel7: RHEL-07-010490
- stigid@rhel8: RHEL-08-010140
+ stigid@rhel8: RHEL-08-010141
ocil_clause: 'it does not'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 036fd00808..83500c35b3 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -121,6 +121,8 @@ selections:
# RHEL-08-010140
- grub2_uefi_password
+
+ # RHEL-08-010141
- grub2_uefi_admin_username
# RHEL-08-010150
From a4dd46d84d9ab8a9fd4984cbc1b9432e2920d3f5 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:24:18 -0500
Subject: [PATCH 10/20] Split RHEL-08-010150
GRUB admin username and password split
---
.../bootloader-grub2/non-uefi/grub2_admin_username/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
index f5cf144e0b..bb2f1bae21 100644
--- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
@@ -49,7 +49,7 @@ references:
srg: SRG-OS-000080-GPOS-00048
stigid@ol7: OL07-00-010480
stigid@rhel7: RHEL-07-010480
- stigid@rhel8: RHEL-08-010150
+ stigid@rhel8: RHEL-08-010149
ocil_clause: 'it does not'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 83500c35b3..10d6fd6ebd 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -125,9 +125,11 @@ selections:
# RHEL-08-010141
- grub2_uefi_admin_username
+ # RHEL-08-010149
+ - grub2_admin_username
+
# RHEL-08-010150
- grub2_password
- - grub2_admin_username
# RHEL-08-010151
- require_singleuser_auth
From e1950738e3d5a35027d322589e736e8bfdba98b3 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 28 Jul 2021 12:44:27 -0500
Subject: [PATCH 11/20] Split RHEL-08-040135
Package fapolicyd and service fapolicyd have been split.
---
.../guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
index 6c2663de9f..4a1cd16608 100644
--- a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
+++ b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
@@ -24,7 +24,7 @@ references:
nist: CM-6(a),SI-4(22)
ospp: FMT_SMF_EXT.1
srg: SRG-OS-000370-GPOS-00155,SRG-OS-000368-GPOS-00154
- stigid@rhel8: RHEL-08-040135
+ stigid@rhel8: RHEL-08-040136
ocil_clause: 'the service is not enabled'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 10d6fd6ebd..8272b25057 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1041,6 +1041,8 @@ selections:
# RHEL-08-040135
- package_fapolicyd_installed
+
+ # RHEL-08-040136
- service_fapolicyd_enabled
# RHEL-08-040139
From e259cdaeb85f7f1f371fa11c08a615d1828fe30e Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:42:38 -0500
Subject: [PATCH 12/20] Split RHEL-08-020330
Also added a placeholder for RHEL-08-020332
---
.../password_storage/no_empty_passwords/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
index 19e5e95d60..75f988ffb2 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
@@ -53,7 +53,7 @@ references:
srg: SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-010290
stigid@rhel7: RHEL-07-010290
- stigid@rhel8: RHEL-08-020330
+ stigid@rhel8: RHEL-08-020331
stigid@sle12: SLES-12-010231
stigid@sle15: SLES-15-020300
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 8272b25057..793fdd1e87 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -591,9 +591,13 @@ selections:
# - accounts_authorized_local_users
# RHEL-08-020330
- - no_empty_passwords
- sshd_disable_empty_passwords
+ # RHEL-08-020331
+ - no_empty_passwords
+
+ # RHEL-08-020332
+
# RHEL-08-020340
- display_login_attempts
From 5c2b73b5a4462225e876b29ead9f92da3c5f4331 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:45:28 -0500
Subject: [PATCH 13/20] Split RHEL-08-010050
---
.../gui_login_banner/dconf_gnome_banner_enabled/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
index c84cff33f3..b6ba3edc47 100644
--- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
@@ -54,7 +54,7 @@ references:
srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088
stigid@ol7: OL07-00-010030
stigid@rhel7: RHEL-07-010030
- stigid@rhel8: RHEL-08-010050
+ stigid@rhel8: RHEL-08-010049
stigid@sle12: SLES-12-010040
stigid@sle15: SLES-15-010080
stigid@ubuntu2004: UBTU-20-010002
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 793fdd1e87..976c3f1892 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -95,8 +95,10 @@ selections:
# RHEL-08-010040
- sshd_enable_warning_banner
- # RHEL-08-010050
+ # RHEL-08-010049
- dconf_gnome_banner_enabled
+
+ # RHEL-08-010050
- dconf_gnome_login_banner_text
# RHEL-08-010060
From d7c7cefd39de31bb484faad49766bbca22469aea Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:47:50 -0500
Subject: [PATCH 14/20] Split RHEL-08-010130
---
.../accounts_password_pam_unix_rounds_system_auth/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
index d44119622a..0b694b0e0b 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
@@ -32,7 +32,7 @@ references:
anssi: BP28(R32)
disa: CCI-000196
srg: SRG-OS-000073-GPOS-00041
- stigid@rhel8: RHEL-08-010130
+ stigid@rhel8: RHEL-08-010131
ocil_clause: 'it does not set the appropriate number of hashing rounds'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 976c3f1892..5230dcd9c5 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -118,9 +118,11 @@ selections:
- accounts_password_all_shadowed_sha512
# RHEL-08-010130
- - accounts_password_pam_unix_rounds_system_auth
- accounts_password_pam_unix_rounds_password_auth
+ # RHEL-08-010131
+ - accounts_password_pam_unix_rounds_system_auth
+
# RHEL-08-010140
- grub2_uefi_password
From f78b565e1f15cff194aef78af2184088fc41782a Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:50:42 -0500
Subject: [PATCH 15/20] Split RHEL-08-010151
---
.../accounts-physical/require_emergency_target_auth/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +---
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
index 930d3a09fd..e2f61432ba 100644
--- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
@@ -42,7 +42,7 @@ references:
srg: SRG-OS-000080-GPOS-00048
stigid@ol7: OL07-00-010481
stigid@rhel7: RHEL-07-010481
- stigid@rhel8: RHEL-08-010151
+ stigid@rhel8: RHEL-08-010152
ocil_clause: 'the output is different'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 5230dcd9c5..040228b832 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -137,11 +137,9 @@ selections:
# RHEL-08-010151
- require_singleuser_auth
- - require_emergency_target_auth
# RHEL-08-010152
- # To be released in V1R3
- # - require_emergency_target_auth
+ - require_emergency_target_auth
# RHEL-08-010160
- set_password_hashing_algorithm_systemauth
From a7766cf4ccfd00eaad910fb98b02694868000410 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 08:57:18 -0500
Subject: [PATCH 16/20] Split RHEL-08-040210
---
.../sysctl_net_ipv4_conf_default_accept_redirects/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
index e8555a4895..bee6c117f3 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
@@ -43,7 +43,7 @@ references:
srg: SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-040640
stigid@rhel7: RHEL-07-040640
- stigid@rhel8: RHEL-08-040210
+ stigid@rhel8: RHEL-08-040209
stigid@sle12: SLES-12-030400
stigid@sle15: SLES-15-040340
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 040228b832..394a460c51 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1092,8 +1092,10 @@ selections:
# RHEL-08-040200
- accounts_no_uid_except_zero
- # RHEL-08-040210
+ # RHEL-08-040209
- sysctl_net_ipv4_conf_default_accept_redirects
+
+ # RHEL-08-040210
- sysctl_net_ipv6_conf_default_accept_redirects
# RHEL-08-040220
From ac28c4231415be5e58bcea6f9fdd8652c6d39c45 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 09:08:27 -0500
Subject: [PATCH 17/20] Split RHEL-08-040240
---
.../sysctl_net_ipv4_conf_all_accept_source_route/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
index b56f2891f5..f92772eb57 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
@@ -45,7 +45,7 @@ references:
srg: SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-040610
stigid@rhel7: RHEL-07-040610
- stigid@rhel8: RHEL-08-040240
+ stigid@rhel8: RHEL-08-040239
stigid@sle12: SLES-12-030360
stigid@sle15: SLES-15-040300
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 394a460c51..9cccd25963 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1104,8 +1104,10 @@ selections:
# RHEL-08-040230
- sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- # RHEL-08-040240
+ # RHEL-08-040239
- sysctl_net_ipv4_conf_all_accept_source_route
+
+ # RHEL-08-040240
- sysctl_net_ipv6_conf_all_accept_source_route
# RHEL-08-040250
From 717ed63c6ad9b69b75aee69bbf1198515011499f Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 09:11:08 -0500
Subject: [PATCH 18/20] Split RHEL-08-040250
---
.../sysctl_net_ipv4_conf_default_accept_source_route/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
index 4df2465995..b1e7f247e2 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
@@ -46,7 +46,7 @@ references:
srg: SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-040620
stigid@rhel7: RHEL-07-040620
- stigid@rhel8: RHEL-08-040250
+ stigid@rhel8: RHEL-08-040249
stigid@sle12: SLES-12-030370
stigid@sle15: SLES-15-040320
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 9cccd25963..4d1869c629 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1110,8 +1110,10 @@ selections:
# RHEL-08-040240
- sysctl_net_ipv6_conf_all_accept_source_route
- # RHEL-08-040250
+ # RHEL-08-040249
- sysctl_net_ipv4_conf_default_accept_source_route
+
+ # RHEL-08-040250
- sysctl_net_ipv6_conf_default_accept_source_route
# RHEL-08-040260
From 9b244bc0828e2eb6ffe389d7ef590e6b967a4c07 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 4 Aug 2021 09:13:19 -0500
Subject: [PATCH 19/20] Split RHEL-08-040280
---
.../sysctl_net_ipv4_conf_all_accept_redirects/rule.yml | 2 +-
products/rhel8/profiles/stig.profile | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
index d5e7fe4599..726042198e 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
@@ -44,7 +44,7 @@ references:
srg: SRG-OS-000480-GPOS-00227
stigid@ol7: OL07-00-040641
stigid@rhel7: RHEL-07-040641
- stigid@rhel8: RHEL-08-040280
+ stigid@rhel8: RHEL-08-040279
stigid@sle12: SLES-12-030390
stigid@sle15: SLES-15-040330
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 4d1869c629..0a1fdd15ca 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1128,8 +1128,10 @@ selections:
# RHEL-08-040270
- sysctl_net_ipv4_conf_default_send_redirects
- # RHEL-08-040280
+ # RHEL-08-040279
- sysctl_net_ipv4_conf_all_accept_redirects
+
+ # RHEL-08-040280
- sysctl_net_ipv6_conf_all_accept_redirects
# RHEL-08-040281
From 7723ff37c5abd8681b70ad686c5df45d7d0b44ed Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 5 Aug 2021 14:46:46 -0500
Subject: [PATCH 20/20] Update couple of references for RHEL8 STIG
---
.../enable_nx/bios_enable_execution_restrictions/rule.yml | 2 +-
.../software/disk_partitioning/partition_for_var_tmp/rule.yml | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
index 99f2c739c9..2176a0bb9b 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
@@ -32,6 +32,6 @@ references:
nist: SC-39,CM-6(a)
nist-csf: PR.IP-1
srg: SRG-OS-000433-GPOS-00192
- stig@rhel8: RHEL-08-010420
+ stigid@rhel8: RHEL-08-010420
platform: machine
diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
index 726975e808..d57c0f0ce9 100644
--- a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
+++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
@@ -30,6 +30,7 @@ references:
cis@ubuntu1804: 1.1.6
cis@ubuntu2004: 1.1.11
srg: SRG-OS-000480-GPOS-00227
+ stigid@rhel8: RHEL-08-010544
{{{ complete_ocil_entry_separate_partition(part="/var/tmp") }}}

24
SOURCES/scap-security-guide-0.1.61-RC_244-PR_8133.patch Normal file
View File

@ -0,0 +1,24 @@
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
index 9f036f83015..f94ddab2fe1 100644
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
@@ -32,6 +32,7 @@ references:
cis@ubuntu2004: 4.1.1.4
disa: CCI-001849
nist: CM-6(a)
+ ospp: FAU_STG.1,FAU_STG.3
srg: SRG-OS-000254-GPOS-00095,SRG-OS-000341-GPOS-00132
stigid@ol8: OL08-00-030602
stigid@rhel8: RHEL-08-030602
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
index 6d76e896ffc..7396b9167c6 100644
--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
@@ -25,6 +25,7 @@ identifiers:
references:
cis@ubuntu2004: 4.1.1.4
+ ospp: FAU_STG.1,FAU_STG.3
ocil_clause: 'audit backlog limit is not configured'

26
SOURCES/scap-security-guide-0.1.61-RC_246_250-PR_8070.patch Normal file
View File

@ -0,0 +1,26 @@
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
index 5841f378fe6..f4780b4ae6d 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml
@@ -22,7 +22,7 @@ identifiers:
references:
disa: CCI-000366
nist: CM-6
- ospp: FAU_GEN.1.1.c
+ ospp: FAU_GEN.1
srg: SRG-OS-000062-GPOS-00031,SRG-OS-000480-GPOS-00227
stigid@ol8: OL08-00-030061
stigid@rhel8: RHEL-08-030061
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
index ba60b9b2c98..19dc3320e85 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
+++ b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml
@@ -47,7 +47,7 @@ identifiers:
references:
nist: AU-2(a)
- ospp: FAU_GEN.1.1.c
+ ospp: FAU_GEN.1
srg: SRG-OS-000365-GPOS-00152,SRG-OS-000475-GPOS-00220
ocil_clause: 'the file does not exist or the content differs'

13
SOURCES/scap-security-guide-0.1.61-RC_247-PR_8114.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
index 6c39a05550c..f169cba9f6b 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/rule.yml
@@ -21,7 +21,7 @@ identifiers:
references:
nist: CM-6
- ospp: FAU_GEN.1.1.c
+ ospp: FAU_STG.1
srg: SRG-OS-000480-GPOS-00227
ocil_clause: write_logs isn't set to yes

26
SOURCES/scap-security-guide-0.1.61-RC_248_249-PR_8071.patch Normal file
View File

@ -0,0 +1,26 @@
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
index 48ed2f31795..b536a68cf2a 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml
@@ -23,7 +23,7 @@ identifiers:
references:
disa: CCI-000366
nist: CM-6,AU-3
- ospp: FAU_GEN.1
+ ospp: FAU_GEN.1.2
srg: SRG-OS-000255-GPOS-00096,SRG-OS-000480-GPOS-00227
stigid@ol8: OL08-00-030063
stigid@rhel8: RHEL-08-030063
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
index a31e975c1c9..8da90cd760f 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml
@@ -24,7 +24,7 @@ identifiers:
references:
disa: CCI-001851
nist: CM-6,AU-3
- ospp: FAU_GEN.1
+ ospp: FAU_GEN.1.2
srg: SRG-OS-000039-GPOS-00017,SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
stigid@ol7: OL07-00-030211
stigid@ol8: OL08-00-030062

13
SOURCES/scap-security-guide-0.1.61-RC_251-PR_8072.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
index ac43b654188..70357c153be 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
+++ b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml
@@ -37,7 +37,7 @@ identifiers:
references:
disa: CCI-000162
nist: AU-2(a)
- ospp: FAU_GEN.1.1.c
+ ospp: FAU_GEN.1.2
srg: SRG-OS-000462-GPOS-00206,SRG-OS-000475-GPOS-00220,SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029
stigid@ol8: OL08-00-030122
stigid@rhel8: RHEL-08-030122

12
SOURCES/scap-security-guide-0.1.61-RC_253-PR_8111.patch Normal file
View File

@ -0,0 +1,12 @@
diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
index 5af94a56910..7968d90331e 100644
--- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
+++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
@@ -31,6 +31,7 @@ references:
iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
nist: CM-6(a)
nist-csf: PR.PT-1
+ ospp: FTP_ITC_EXT.1.1
srg: SRG-OS-000479-GPOS-00224,SRG-OS-000051-GPOS-00024,SRG-OS-000480-GPOS-00227
stigid@ol8: OL08-00-030670
stigid@rhel8: RHEL-08-030670

13
SOURCES/scap-security-guide-0.1.61-RC_254-PR_8113.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
index d5d49bf7426..83c6d9339de 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml
@@ -29,7 +29,7 @@ references:
anssi: BP28(R43)
ism: 0988,1405
nist: AU-9(3),CM-6(a)
- ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1
+ ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1,FIA_X509_EXT.1.1,FMT_SMF_EXT.1.1
srg: SRG-OS-000480-GPOS-00227,SRG-OS-000120-GPOS-00061
ocil_clause: 'omfwd is not configured with gtls and AuthMode'

13
SOURCES/scap-security-guide-0.1.61-RC_255-PR_8112.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
index 635207b571f..818f24718a0 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml
@@ -27,7 +27,7 @@ identifiers:
references:
anssi: BP28(R43)
ism: 0988,1405
- ospp: FCS_TLSC_EXT.1,FTP_ITC_EXT.1.1
+ ospp: FCS_TLSC_EXT.1
srg: SRG-OS-000480-GPOS-00227
ocil_clause: 'CA certificate for rsyslog remote logging via TLS is not set'

24
SOURCES/scap-security-guide-0.1.61-RC_277_245-PR_8069.patch Normal file
View File

@ -0,0 +1,24 @@
diff --git a/linux_os/guide/system/auditing/package_audit_installed/rule.yml b/linux_os/guide/system/auditing/package_audit_installed/rule.yml
index 8b36f0c2fa3..795089c8b83 100644
--- a/linux_os/guide/system/auditing/package_audit_installed/rule.yml
+++ b/linux_os/guide/system/auditing/package_audit_installed/rule.yml
@@ -27,6 +27,7 @@ references:
nerc-cip: CIP-004-6 R3.3,CIP-007-3 R6.5
nist: AC-7(a),AU-7(1),AU-7(2),AU-14,AU-12(2),AU-2(a),CM-6(a)
nist@sle12: AU-7(a),AU-7(b),AU-8(b),AU-12.1(iv),AU-12(3),AU-12(c),CM-5(1)
+ ospp: FAU_GEN.1
srg: SRG-OS-000122-GPOS-00063,SRG-OS-000337-GPOS-00129,SRG-OS-000348-GPOS-00136,SRG-OS-000349-GPOS-00137,SRG-OS-000350-GPOS-00138,SRG-OS-000351-GPOS-00139,SRG-OS-000352-GPOS-00140,SRG-OS-000353-GPOS-00141,SRG-OS-000354-GPOS-00142,SRG-OS-000358-GPOS-00145,SRG-OS-000359-GPOS-00146,SRG-OS-000365-GPOS-00152,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000480-GPOS-00227,SRG-OS-000062-GPOS-00031
stigid@ol8: OL08-00-030180
stigid@rhel8: RHEL-08-030180
diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
index 320b69c3179..99edca3e270 100644
--- a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
+++ b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
@@ -50,6 +50,7 @@ references:
nist: AC-2(g),AU-3,AU-10,AU-2(d),AU-12(c),AU-14(1),AC-6(9),CM-6(a),SI-4(23)
nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
nist@sle12: AU-3,AU-3(1),AU-3(1).1(ii),AU-3.1,AU-6(4),AU-6(4).1,AU-7(1),AU-7(1).1,AU-7(a),AU-14(1),AU-14(1).1,CM-6(b),CM-6.1(iv),MA-4(1)(a)
+ ospp: FAU_GEN.1
pcidss: Req-10.1
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000038-GPOS-00016,SRG-OS-000039-GPOS-00017,SRG-OS-000040-GPOS-00018,SRG-OS-000041-GPOS-00019,SRG-OS-000042-GPOS-00021,SRG-OS-000051-GPOS-00024,SRG-OS-000054-GPOS-00025,SRG-OS-000122-GPOS-00063,SRG-OS-000254-GPOS-00095,SRG-OS-000255-GPOS-00096,SRG-OS-000365-GPOS-00152,SRG-OS-000392-GPOS-00172,SRG-OS-000480-GPOS-00227,SRG-OS-000062-GPOS-00031
stigid@ol7: OL07-00-030000

165
SOURCES/scap-security-guide-0.1.61-add_RHEL_08_010331-PR_8055.patch Normal file
View File

@ -0,0 +1,165 @@
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
index 8a28af022a7..02c69bddd27 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = high
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
index a7182849548..db89a5e47a1 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
@@ -31,6 +31,8 @@ rationale: |-
of initiating changes, including upgrades and modifications.
identifiers:
+ cce@rhel8: CCE-88692-9
+ cce@rhel9: CCE-88693-7
cce@sle12: CCE-83234-5
cce@sle15: CCE-85753-2
@@ -40,6 +42,8 @@ references:
disa: CCI-001499
nerc-cip: CIP-003-8 R6
nist: CM-5,CM-5(6),CM-5(6).1
+ srg: SRG-OS-000259-GPOS-00100
+ stigid@rhel8: RHEL-08-010331
stigid@sle12: SLES-12-010872
stigid@sle15: SLES-15-010352
stigid@ubuntu2004: UBTU-20-010427
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
index af078463b05..6e957c302ac 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
find "$dirPath" -perm /022 -type d -exec chmod go-w '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
index d58616bcafb..55ff9cebd4f 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
chmod -R 755 "$dirPath"
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
index 98d18cde3ea..c2b5b6bf029 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
DIRS="/lib /lib64"
for dirPath in $DIRS; do
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
index 6df6e2f8f9b..40e6c42c829 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
DIRS="/usr/lib /usr/lib64"
for dirPath in $DIRS; do
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
diff --git a/products/rhel8/profiles/cjis.profile b/products/rhel8/profiles/cjis.profile
index decba0087e8..920a55659fd 100644
--- a/products/rhel8/profiles/cjis.profile
+++ b/products/rhel8/profiles/cjis.profile
@@ -77,6 +77,7 @@ selections:
- accounts_password_pam_difok
- accounts_max_concurrent_login_sessions
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- file_owner_etc_shadow
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 04f158116ee..5d98b1c894e 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -228,6 +228,9 @@ selections:
# RHEL-08-010330
- file_permissions_library_dirs
+ # RHEL-08-010331
+ - dir_permissions_library_dirs
+
# RHEL-08-010340
- file_ownership_library_dirs
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 8f79b22e3e4..2614504e9cd 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -229,6 +229,9 @@ selections:
# RHEL-08-010330
- file_permissions_library_dirs
+ # RHEL-08-010331
+ - dir_permissions_library_dirs
+
# RHEL-08-010340
- file_ownership_library_dirs
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 3f6ec5e17c4..4a926bce5de 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -2645,8 +2645,6 @@ CCE-88688-7
CCE-88689-5
CCE-88690-3
CCE-88691-1
-CCE-88692-9
-CCE-88693-7
CCE-88694-5
CCE-88695-2
CCE-88696-0
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ed739e724f4..4df5c4a2e21 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -25,6 +25,7 @@ extends: null
metadata:
version: V1R4
SMEs:
+ - mab879
- ggbecker
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
selections:
@@ -180,6 +181,7 @@ selections:
- dconf_gnome_screensaver_idle_delay
- dconf_gnome_screensaver_lock_enabled
- dir_group_ownership_library_dirs
+- dir_permissions_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
- directory_group_ownership_var_log_audit
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 56c3fcb9f59..98746158aed 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -36,6 +36,7 @@ extends: null
metadata:
version: V1R4
SMEs:
+ - mab879
- ggbecker
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
selections:
@@ -191,6 +192,7 @@ selections:
- dconf_gnome_screensaver_idle_delay
- dconf_gnome_screensaver_lock_enabled
- dir_group_ownership_library_dirs
+- dir_permissions_library_dirs
- dir_perms_world_writable_root_owned
- dir_perms_world_writable_sticky_bits
- directory_group_ownership_var_log_audit

57
SOURCES/scap-security-guide-0.1.61-add_RHEL_08_010359-PR_8131.patch Normal file
View File

@ -0,0 +1,57 @@
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
index 68b353965ec..ff106996f00 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
@@ -28,7 +28,7 @@ references:
cis@ubuntu2004: 1.4.1
cjis: 5.10.1.3
cobit5: APO01.06,BAI01.06,BAI02.01,BAI03.05,BAI06.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS03.05,DSS04.07,DSS05.02,DSS05.03,DSS05.05,DSS05.07,DSS06.02,DSS06.06
- disa: CCI-002699,CCI-001744
+ disa: CCI-002696,CCI-002699,CCI-001744
isa-62443-2009: 4.3.4.3.2,4.3.4.3.3,4.3.4.4.4
isa-62443-2013: 'SR 3.1,SR 3.3,SR 3.4,SR 3.8,SR 4.1,SR 6.2,SR 7.6'
ism: 1034,1288,1341,1417
@@ -36,9 +36,9 @@ references:
nist: CM-6(a)
nist-csf: DE.CM-1,DE.CM-7,PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1,PR.IP-3
pcidss: Req-11.5
- srg: SRG-OS-000363-GPOS-00150
+ srg: SRG-OS-000363-GPOS-00150,SRG-OS-000445-GPOS-00199
stigid@ol8: OL08-00-010360
- stigid@rhel8: RHEL-08-010360
+ stigid@rhel8: RHEL-08-010359
stigid@sle12: SLES-12-010500
stigid@sle15: SLES-15-010420
stigid@ubuntu2004: UBTU-20-010450
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index ff23f83cfbf..cb72403e81a 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -239,8 +239,10 @@ selections:
- root_permissions_syslibrary_files
- dir_group_ownership_library_dirs
- # RHEL-08-010360
+ # RHEL-08-010359
- package_aide_installed
+
+ # RHEL-08-010360
- aide_scan_notification
# RHEL-08-010370
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 31015d4b83c..93ecc404dc2 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -240,8 +240,10 @@ selections:
- root_permissions_syslibrary_files
- dir_group_ownership_library_dirs
- # RHEL-08-010360
+ # RHEL-08-010359
- package_aide_installed
+
+ # RHEL-08-010360
- aide_scan_notification
# RHEL-08-010370

596
SOURCES/scap-security-guide-0.1.61-add_RHEL_08_0103789_include_sudoers-PR_8196.patch Normal file
View File

@ -0,0 +1,596 @@
From 19bd5adfd804590b15e42cc75287b792706286d5 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 10 Feb 2022 15:25:06 +0100
Subject: [PATCH 1/9] Add rule to check for default sudoers includedir
This rule supports RHEL-08-010379.
---
.../ansible/shared.yml | 7 ++++
.../sudoers_default_includedir/bash/shared.sh | 11 ++++++
.../oval/shared.xml | 23 +++++++++++
.../sudo/sudoers_default_includedir/rule.yml | 38 +++++++++++++++++++
.../tests/default_includedir.pass.sh | 7 ++++
.../tests/duplicate_includedir.fail.sh | 7 ++++
.../tests/no_includedir.fail.sh | 4 ++
.../tests/two_includedir.fail.sh | 8 ++++
shared/references/cce-redhat-avail.txt | 3 --
9 files changed, 105 insertions(+), 3 deletions(-)
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
new file mode 100644
index 00000000000..d9d5933285f
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
@@ -0,0 +1,7 @@
+# platform = multi_platform_all
+# # reboot = false
+# # strategy = configure
+# # complexity = low
+# # disruption = low
+
+{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
new file mode 100644
index 00000000000..3a9e2da985b
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
@@ -0,0 +1,11 @@
+# platform = multi_platform_all
+
+sudoers_config_file="/etc/sudoers"
+sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
+if [ "$sudoers_includedir_count" -gt 1 ]; then
+ sed -i "/#includedir.*/d" "$sudoers_config_file"
+ echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
+fi
+if [ "$sudoers_includedir_count" -eq 0 ]; then
+ echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
new file mode 100644
index 00000000000..5618c64291c
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
@@ -0,0 +1,23 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Check if sudo includes only the default includedir") }}}
+ <criteria operator="AND">
+ <criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists"
+ comment="audit augenrules rmmod" id="test_sudoers_default_includedir" version="1">
+ <ind:object object_ref="object_sudoers_default_includedir" />
+ <ind:state state_ref="state_sudoers_default_includedir" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_sudoers_default_includedir" version="1">
+ <ind:filepath>/etc/sudoers</ind:filepath>
+ <ind:pattern operation="pattern match">^#includedir[\s]+(.*)$</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_state id="state_sudoers_default_includedir" version="1">
+ <ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
+ </ind:textfilecontent54_state>
+
+</def-group>
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
new file mode 100644
index 00000000000..5c33121f911
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
@@ -0,0 +1,38 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9
+
+title: 'Ensure sudo only includes the default configuration directory'
+
+description: |-
+ Administrators can configure authorized <tt>sudo</tt> users via drop-in files, and it is possible to include
+ other directories and configuration files from the file currently being parsed.
+
+ Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>.
+ The <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
+ <tt>/etc/sudoers.d</tt>
+ Note that the '#' character doesn't denote a comment in the configuration file.
+
+rationale: |-
+ Some <tt>sudo</tt> configurtion options allow users to run programs without re-authenticating.
+ Use of these configuration options makes it easier for one compromised accound to be used to
+ compromise other accounts.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-86277-1
+ cce@rhel8: CCE-86377-9
+ cce@rhel9: CCE-86477-7
+
+references:
+ disa: CCI-000366
+ stigid@rhel8: RHEL-08-010379
+
+ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other directories?"
+
+ocil: |-
+ To determine whether <tt>sudo</tt> command includes configuration files from the appropriate directory,
+ run the following command:
+ <pre>$ sudo grep 'include' /etc/sudoers</pre>
+ If only the line <tt>#includedir /etc/sudoers> is returned, then the drop-in file configuration is set correctly.
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
new file mode 100644
index 00000000000..ac0c808ccd6
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/default_includedir.pass.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Ensure default config is there
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
new file mode 100644
index 00000000000..5bad8225625
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/duplicate_includedir.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# duplicate default entry
+if grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
new file mode 100644
index 00000000000..1e0ab8aea92
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+sed -i "/#includedir.*/d" /etc/sudoers
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
new file mode 100644
index 00000000000..09d14eab630
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/two_includedir.fail.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Ensure that there are two different indludedirs
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
+echo "#includedir /opt/extra_config.d" >> /etc/sudoers
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 41caad9f0d0..f2990adb537 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -340,7 +340,6 @@ CCE-86273-0
CCE-86274-8
CCE-86275-5
CCE-86276-3
-CCE-86277-1
CCE-86278-9
CCE-86279-7
CCE-86281-3
@@ -428,7 +427,6 @@ CCE-86373-8
CCE-86374-6
CCE-86375-3
CCE-86376-1
-CCE-86377-9
CCE-86378-7
CCE-86379-5
CCE-86380-3
@@ -524,7 +522,6 @@ CCE-86473-6
CCE-86474-4
CCE-86475-1
CCE-86476-9
-CCE-86477-7
CCE-86478-5
CCE-86479-3
CCE-86480-1
From 99fe46922243e8dff5822e2ed6eb49addd000baa Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 10 Feb 2022 16:21:46 +0100
Subject: [PATCH 2/9] Select rule in RHEL8 STIG
Select sudoers_default_indludedir aligning to RHEL8 STIG V1R5
---
products/rhel8/profiles/stig.profile | 3 +++
1 file changed, 3 insertions(+)
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index d92bc72971c..e13bda7a787 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -271,6 +271,9 @@ selections:
# RHEL-08-010376
- sysctl_kernel_perf_event_paranoid
+ # RHEL-08-010379
+ - sudoers_default_includedir
+
# RHEL-08-010380
- sudo_remove_nopasswd
From 3686fe72a6e27049f1c46d0a4efa07e1b42b6a20 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 10 Feb 2022 17:26:59 +0100
Subject: [PATCH 3/9] Add test and fix for case when the single includedir is
wrong
---
.../sudo/sudoers_default_includedir/bash/shared.sh | 7 +++++--
.../tests/wrong_includedir.fail.sh | 5 +++++
2 files changed, 10 insertions(+), 2 deletions(-)
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
index 3a9e2da985b..258af02c121 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
@@ -5,7 +5,10 @@ sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
if [ "$sudoers_includedir_count" -gt 1 ]; then
sed -i "/#includedir.*/d" "$sudoers_config_file"
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
-fi
-if [ "$sudoers_includedir_count" -eq 0 ]; then
+elif [ "$sudoers_includedir_count" -eq 0 ]; then
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
+else
+ if ! grep -q "^#includedir /etc/sudoers.d" /etc/sudoers; then
+ sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" /etc/sudoers
+ fi
fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
new file mode 100644
index 00000000000..55a072adf3c
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/wrong_includedir.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+sed -i "/#includedir.*/d" /etc/sudoers
+echo "#includedir /opt/extra_config.d" >> /etc/sudoers
From 0b20b495ed82cead1a033170b900c13da5260603 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 14:50:11 +0100
Subject: [PATCH 4/9] Add tests for sudo file and dir includes in
/etc/sudoers.d
---
.../tests/sudoers.d_with_include.fail.sh | 9 +++++++++
.../tests/sudoers.d_with_includedir.fail.sh | 9 +++++++++
.../tests/sudoers_with_include.fail.sh | 11 +++++++++++
3 files changed, 29 insertions(+)
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
create mode 100644 linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
new file mode 100644
index 00000000000..554ef2e060d
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Ensure default config is there
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
+
+echo "#include /etc/my-sudoers" > /etc/sudoers.d/my-sudoers
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
new file mode 100644
index 00000000000..516b68b5a3e
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Ensure default config is there
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
+
+echo "#includedir /etc/my-sudoers.d" > /etc/sudoers.d/my-sudoers
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
new file mode 100644
index 00000000000..ad04880e334
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers_with_include.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Ensure default config is there
+if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
+ echo "#includedir /etc/sudoers.d" >> /etc/sudoers
+fi
+
+if ! grep -q "#include " /etc/sudoers; then
+ echo "#include /etc/my-sudoers" >> /etc/sudoers
+fi
From d91e3eefe6c265c27634cb15b0f276a298f81645 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 14:59:18 +0100
Subject: [PATCH 5/9] Update rule catch and remove other sudo includes
Any other #include or #includedir besides:
"/etc/sudoers: #includedir /etc/sudoers.d" should be removed.
---
.../ansible/shared.yml | 14 +++++++++++
.../sudoers_default_includedir/bash/shared.sh | 7 ++++--
.../oval/shared.xml | 23 +++++++++++++++++++
.../sudo/sudoers_default_includedir/rule.yml | 7 +++---
4 files changed, 46 insertions(+), 5 deletions(-)
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
index d9d5933285f..175a447e0d9 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
@@ -5,3 +5,17 @@
# # disruption = low
{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
+{{{ ansible_lineinfile(msg='Ensure sudoers doesn\'t include other non-default file', regex='^#include[\s]+.*$', path='/etc/sudoers', state='absent') }}}
+- name: "Find out if /etc/sudoers.d/* files contain file or directory includes"
+ find:
+ path: "/etc/sudoers.d"
+ patterns: "*"
+ contains: '^#include(dir)?\s.*$'
+ register: sudoers_d_includes
+
+- name: "Remove found occurrences of file and directory inclues from /etc/sudoers.d/* files"
+ lineinfile:
+ path: "{{ item.path }}"
+ regexp: '^#include(dir)?\s.*$'
+ state: absent
+ with_items: "{{ sudoers_d_includes.files }}"
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
index 258af02c121..2d00b471677 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
@@ -1,6 +1,7 @@
# platform = multi_platform_all
sudoers_config_file="/etc/sudoers"
+sudoers_config_dir="/etc/sudoers.d"
sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
if [ "$sudoers_includedir_count" -gt 1 ]; then
sed -i "/#includedir.*/d" "$sudoers_config_file"
@@ -8,7 +9,9 @@ if [ "$sudoers_includedir_count" -gt 1 ]; then
elif [ "$sudoers_includedir_count" -eq 0 ]; then
echo "#includedir /etc/sudoers.d" >> "$sudoers_config_file"
else
- if ! grep -q "^#includedir /etc/sudoers.d" /etc/sudoers; then
- sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" /etc/sudoers
+ if ! grep -q "^#includedir /etc/sudoers.d" "$sudoers_config_file"; then
+ sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" "$sudoers_config_file"
fi
fi
+sed -i "/^#include\s\+.*/d" "$sudoers_config_file" "${sudoers_config_dir}"/*
+sed -i "/^#includedir\s\+.*/d" "${sudoers_config_dir}"/*
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
index 5618c64291c..59cab0b89de 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
@@ -3,6 +3,8 @@
{{{ oval_metadata("Check if sudo includes only the default includedir") }}}
<criteria operator="AND">
<criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
+ <criterion comment="Check /etc/sudoers for #include" test_ref="test_sudoers_without_include" />
+ <criterion comment="Check /etc/sudoers.d for includes" test_ref="test_sudoersd_without_includes" />
</criteria>
</definition>
@@ -20,4 +22,25 @@
<ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
</ind:textfilecontent54_state>
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
+ comment="audit augenrules rmmod" id="test_sudoers_without_include" version="1">
+ <ind:object object_ref="object_sudoers_without_include" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_sudoers_without_include" version="1">
+ <ind:filepath>/etc/sudoers</ind:filepath>
+ <ind:pattern operation="pattern match">^#include[\s]+.*$</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
+ comment="audit augenrules rmmod" id="test_sudoersd_without_includes" version="1">
+ <ind:object object_ref="object_sudoersd_without_includes" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_sudoersd_without_includes" version="1">
+ <ind:path>/etc/sudoers.d/</ind:path>
+ <ind:filename operation="pattern match">.*</ind:filename>
+ <ind:pattern operation="pattern match">^#include(dir)?[\s]+.*$</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
</def-group>
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
index 5c33121f911..3a8c22ac8af 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
@@ -10,7 +10,7 @@ description: |-
Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>.
The <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
- <tt>/etc/sudoers.d</tt>
+ <tt>/etc/sudoers.d</tt>, and no file in <tt>/etc/sudoers.d/</tt> should include other files or directories.
Note that the '#' character doesn't denote a comment in the configuration file.
rationale: |-
@@ -34,5 +34,6 @@ ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other
ocil: |-
To determine whether <tt>sudo</tt> command includes configuration files from the appropriate directory,
run the following command:
- <pre>$ sudo grep 'include' /etc/sudoers</pre>
- If only the line <tt>#includedir /etc/sudoers> is returned, then the drop-in file configuration is set correctly.
+ <pre>$ sudo grep -rP '^#include(dir)?' /etc/sudoers /etc/sudoers.d</pre>
+ If only the line <tt>/etc/sudoers:#includedir /etc/sudoers.d</tt> is returned, then the drop-in include configuration is set correctly.
+ Any other line returned is a finding.
From ead72b744f1fc03893184079c079df27780044c2 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 15:00:46 +0100
Subject: [PATCH 6/9] Add SRG to sudoers_default_includedir
---
.../system/software/sudo/sudoers_default_includedir/rule.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
index 3a8c22ac8af..a97bd3efb2c 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
@@ -27,6 +27,7 @@ identifiers:
references:
disa: CCI-000366
+ srg: SRG-OS-000480-GPOS-00227
stigid@rhel8: RHEL-08-010379
ocil_clause: "the /etc/sudoers doesn't include /etc/sudores.d or includes other directories?"
From c1a08fe6b8e6388b89b190ca74e57af06e7c999c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 16:12:32 +0100
Subject: [PATCH 7/9] Update RHEL8 STIG profile stability data
---
tests/data/profile_stability/rhel8/stig.profile | 1 +
tests/data/profile_stability/rhel8/stig_gui.profile | 1 +
2 files changed, 2 insertions(+)
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index e4fee44f9f9..974b28757e9 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -365,6 +365,7 @@ selections:
- sudo_remove_nopasswd
- sudo_require_reauthentication
- sudo_restrict_privilege_elevation_to_authorized
+- sudoers_default_includedir
- sudoers_validate_passwd
- sysctl_crypto_fips_enabled
- sysctl_fs_protected_hardlinks
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 83d04775e3a..99e0af4f5a6 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -376,6 +376,7 @@ selections:
- sudo_remove_nopasswd
- sudo_require_reauthentication
- sudo_restrict_privilege_elevation_to_authorized
+- sudoers_default_includedir
- sudoers_validate_passwd
- sysctl_crypto_fips_enabled
- sysctl_fs_protected_hardlinks
From adae3ecbda4362e23cd1f30e053db37d6a1d403b Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 16:59:22 +0100
Subject: [PATCH 8/9] Fix Ansible remediation metadata
---
.../sudo/sudoers_default_includedir/ansible/shared.yml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
index 175a447e0d9..0d8c9e75184 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/ansible/shared.yml
@@ -1,8 +1,8 @@
# platform = multi_platform_all
-# # reboot = false
-# # strategy = configure
-# # complexity = low
-# # disruption = low
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
{{{ ansible_only_lineinfile(msg='Ensure sudo only has the default includedir', line_regex='^#includedir.*$', path='/etc/sudoers', new_line='#includedir /etc/sudoers.d') }}}
{{{ ansible_lineinfile(msg='Ensure sudoers doesn\'t include other non-default file', regex='^#include[\s]+.*$', path='/etc/sudoers', state='absent') }}}
From d3f048456908b316c0dcc0bff2328cf87fe6e7de Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 14 Feb 2022 17:39:39 +0100
Subject: [PATCH 9/9] Handle case when /etc/sudoers.d doesn't exist
The remediation skips the directory, and the test scenarios create the
dir to ensure the test scenario works.
---
.../sudo/sudoers_default_includedir/bash/shared.sh | 8 ++++++--
.../tests/sudoers.d_with_include.fail.sh | 1 +
.../tests/sudoers.d_with_includedir.fail.sh | 1 +
3 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
index 2d00b471677..fbff5eb6f30 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/bash/shared.sh
@@ -13,5 +13,9 @@ else
sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" "$sudoers_config_file"
fi
fi
-sed -i "/^#include\s\+.*/d" "$sudoers_config_file" "${sudoers_config_dir}"/*
-sed -i "/^#includedir\s\+.*/d" "${sudoers_config_dir}"/*
+
+sed -i "/^#include\s\+.*/d" "$sudoers_config_file"
+
+if grep -Pr "^#include(dir)? .*" "$sudoers_config_dir" ; then
+ sed -i "/^#include\(dir\)\?\s\+.*/d" "$sudoers_config_dir"/*
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
index 554ef2e060d..3f14ecc1627 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_include.fail.sh
@@ -1,6 +1,7 @@
#!/bin/bash
# platform = multi_platform_all
+mkdir -p /etc/sudoers.d
# Ensure default config is there
if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
echo "#includedir /etc/sudoers.d" >> /etc/sudoers
diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
index 516b68b5a3e..89515076ff1 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/sudoers.d_with_includedir.fail.sh
@@ -1,6 +1,7 @@
#!/bin/bash
# platform = multi_platform_all
+mkdir -p /etc/sudoers.d
# Ensure default config is there
if ! grep -q "#includedir /etc/sudoers.d" /etc/sudoers; then
echo "#includedir /etc/sudoers.d" >> /etc/sudoers

13
SOURCES/scap-security-guide-0.1.61-add_RHEL_08_020221-PR_8173.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
index 5353f60975c..69a36c4959a 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
@@ -43,7 +43,7 @@ references:
stigid@ol7: OL07-00-010270
stigid@ol8: OL08-00-020220
stigid@rhel7: RHEL-07-010270
- stigid@rhel8: RHEL-08-020220
+ stigid@rhel8: RHEL-08-020221
vmmsrg: SRG-OS-000077-VMM-000440
ocil_clause: |-

49
SOURCES/scap-security-guide-0.1.61-add_RHEL_08_040321-PR_8169.patch Normal file
View File

@ -0,0 +1,49 @@
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
index de0e359a44e..df56a30be80 100644
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml
@@ -39,6 +39,7 @@ references:
nist: CM-7(a),CM-7(b),CM-6(a)
nist-csf: PR.AC-3,PR.PT-4
srg: SRG-OS-000480-GPOS-00227
+ stigid@rhel8: RHEL-08-040321
ocil_clause: 'the X windows display server is running and/or has not been disabled'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 09fa85df181..ffca983d0bd 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -1169,6 +1169,9 @@ selections:
# RHEL-08-040320
- xwindows_remove_packages
+ # RHEL-08-040321
+ - xwindows_runlevel_target
+
# RHEL-08-040330
- network_sniffer_disabled
diff --git a/products/rhel8/profiles/stig_gui.profile b/products/rhel8/profiles/stig_gui.profile
index d1577215b07..d29ceb9c54e 100644
--- a/products/rhel8/profiles/stig_gui.profile
+++ b/products/rhel8/profiles/stig_gui.profile
@@ -35,3 +35,6 @@ extends: stig
selections:
# RHEL-08-040320
- '!xwindows_remove_packages'
+
+ # RHEL-08-040321
+ - '!xwindows_runlevel_target'
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 9c05c27117c..e4fee44f9f9 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -398,6 +398,7 @@ selections:
- usbguard_generate_policy
- wireless_disable_interfaces
- xwindows_remove_packages
+- xwindows_runlevel_target
- var_rekey_limit_size=1G
- var_rekey_limit_time=1hour
- var_accounts_user_umask=077

38
SOURCES/scap-security-guide-0.1.61-add_missing_srgs-PR_8218.patch Normal file
View File

@ -0,0 +1,38 @@
From 8605b236665b1022c7379e87d9445c9ca42e78f3 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 14 Feb 2022 11:41:15 +0100
Subject: [PATCH] Add SRG references to STIG rules.
Rules accounts_password_pam_pwquality_password_auth and accounts_password_pam_pwquality_system_auth
were missing SRG required references.
---
.../accounts_password_pam_pwquality_password_auth/rule.yml | 2 ++
.../accounts_password_pam_pwquality_system_auth/rule.yml | 2 ++
2 files changed, 4 insertions(+)
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
index 6c7bb1ad7a0..34dd6e2fcca 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
@@ -22,6 +22,8 @@ identifiers:
cce@rhel9: CCE-85878-7
references:
+ disa: CCI-000366
+ srg: SRG-OS-000480-GPOS-00227
stigid@rhel8: RHEL-08-020100
ocil_clause: 'pam_pwquality.so is not enabled in password-auth'
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
index ea42ff9b07a..a5189c61608 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
@@ -22,6 +22,8 @@ identifiers:
cce@rhel9: CCE-85873-8
references:
+ disa: CCI-000366
+ srg: SRG-OS-000480-GPOS-00227
stigid@rhel8: RHEL-08-020101
ocil_clause: 'pam_pwquality.so is not enabled in system-auth'

369
SOURCES/scap-security-guide-0.1.61-chrony_maxpoll-PR_8187.patch Normal file
View File

@ -0,0 +1,369 @@
From bbafe0a7b4b9eb50bc622d9f9f3c0074fca932f9 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 9 Feb 2022 16:17:52 +0100
Subject: [PATCH 1/2] Pass the rule when no time server nor pool is set
If no time server or pool is configured, there is no entry to add
maxpoll option to, so the rule should evaluate to pass.
---
.../oval/shared.xml | 50 +++++++++++++++----
.../ntp/chronyd_or_ntpd_set_maxpoll/rule.yml | 2 +
.../tests/chrony_no_pool_nor_servers.pass.sh | 12 +++++
3 files changed, 54 insertions(+), 10 deletions(-)
create mode 100644 linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
index 780c2e2d0ba..76f810123f3 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/oval/shared.xml
@@ -3,17 +3,25 @@
{{{ oval_metadata("Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
to continuously poll the time source servers.") }}}
<criteria operator="OR">
- <criteria operator="AND">
- <criterion comment="check if maxpoll is set in /etc/ntp.conf"
- test_ref="test_ntp_set_maxpoll" />
- <criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf"
- test_ref="test_ntp_all_server_has_maxpoll"/>
+ <criteria operator="OR">
+ <criterion comment="check if no server or pool entry is set in /etc/chrony.conf"
+ test_ref="test_ntp_no_server"/>
+ <criteria operator="AND">
+ <criterion comment="check if maxpoll is set in /etc/ntp.conf"
+ test_ref="test_ntp_set_maxpoll" />
+ <criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf"
+ test_ref="test_ntp_all_server_has_maxpoll"/>
+ </criteria>
</criteria>
- <criteria operator="AND">
- <criterion comment="check if maxpoll is set in /etc/chrony.conf"
- test_ref="test_chrony_set_maxpoll" />
- <criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf"
- test_ref="test_chrony_all_server_has_maxpoll"/>
+ <criteria operator="OR">
+ <criterion comment="check if no server or pool entry is set in /etc/chrony.conf"
+ test_ref="test_chrony_no_server_nor_pool"/>
+ <criteria operator="AND">
+ <criterion comment="check if maxpoll is set in /etc/chrony.conf"
+ test_ref="test_chrony_set_maxpoll" />
+ <criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf"
+ test_ref="test_chrony_all_server_has_maxpoll"/>
+ </criteria>
</criteria>
</criteria>
</definition>
@@ -77,4 +85,26 @@
<ind:subexpression operation="pattern match" datatype="string">maxpoll \d+</ind:subexpression>
</ind:textfilecontent54_state>
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
+ comment="check if no server entries have server or pool set in /etc/chrony.conf"
+ id="test_chrony_no_server_nor_pool" version="1">
+ <ind:object object_ref="obj_chrony_no_server_nor_pool" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_chrony_no_server_nor_pool" version="1">
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
+ <ind:pattern operation="pattern match">^(?:server|pool).*</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="check if all server entries have maxpoll set in /etc/ntp.conf"
+ id="test_ntp_no_server" version="1">
+ <ind:object object_ref="obj_ntp_no_server_nor_pool" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_ntp_no_server_nor_pool" version="1">
+ <ind:filepath>/etc/ntp.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^server.*</ind:pattern>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
</def-group>
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
index 20e7467a7b5..c115ad3c115 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml
@@ -13,6 +13,8 @@ description: |-
<pre>maxpoll {{{ xccdf_value("var_time_service_set_maxpoll") }}}</pre>
to <pre>server</pre> directives. If using chrony any <pre>pool</pre> directives
should be configured too.
+ If no <tt>server</tt> or <tt>pool</tt> directives are configured, the rule evaluates
+ to pass.
{{% if product == "rhcos4" %}}
<p>
Note that if the remediation shipping with this content is being used, the
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
new file mode 100644
index 00000000000..bbae20fc696
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/tests/chrony_no_pool_nor_servers.pass.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+# packages = chrony
+#
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+yum remove -y ntp
+
+# Remove all pool and server options
+sed -i "/^pool.*/d" /etc/chrony.conf
+sed -i "/^server.*/d" /etc/chrony.conf
+
+systemctl enable chronyd.service
From 60ef6eb2cce9e53ea256738ff2583b332155a318 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Fri, 11 Feb 2022 12:14:30 +0100
Subject: [PATCH 2/2] Add rule ensuring Chrony only uses server directive
This new rule only asserts that Chrony has at least one time source configured,
and that it is done with the 'server' directive.
No remediation is provided for rule, that is left for other specialized
rules.
---
.../chronyd_server_directive/oval/shared.xml | 33 +++++++++++++++++++
.../ntp/chronyd_server_directive/rule.yml | 32 ++++++++++++++++++
.../tests/file_empty.fail.sh | 6 ++++
.../tests/file_missing.fail.sh | 6 ++++
.../tests/line_missing.fail.sh | 7 ++++
.../tests/multiple_servers.pass.sh | 8 +++++
.../tests/only_pool.fail.sh | 9 +++++
.../tests/only_server.pass.sh | 6 ++++
products/rhel8/profiles/stig.profile | 1 +
products/rhel9/profiles/stig.profile | 1 +
shared/references/cce-redhat-avail.txt | 2 --
.../data/profile_stability/rhel8/stig.profile | 1 +
.../profile_stability/rhel8/stig_gui.profile | 1 +
13 files changed, 111 insertions(+), 2 deletions(-)
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
create mode 100644 linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml b/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
new file mode 100644
index 00000000000..2244e608047
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/oval/shared.xml
@@ -0,0 +1,33 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("Ensure Chrony has time sources configured with server directive") }}}
+ <criteria comment="chrony.conf only has server directive">
+ <criterion test_ref="test_chronyd_server_directive_with_server" />
+ <criterion test_ref="test_chronyd_server_directive_no_pool" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+ comment="Ensure at least one time source is set with server directive" id="test_chronyd_server_directive_with_server"
+ version="1">
+ <ind:object object_ref="object_chronyd_server_directive" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="Matches server entries in Chrony conf files"
+ id="object_chronyd_server_directive" version="1">
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*server.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
+ comment="Ensure no time source is set with pool directive" id="test_chronyd_server_directive_no_pool"
+ version="1">
+ <ind:object object_ref="object_chronyd_no_pool_directive" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="Matches pool entires in Chrony conf files"
+ id="object_chronyd_no_pool_directive" version="1">
+ <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]+pool.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml b/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
new file mode 100644
index 00000000000..6dc24f1be85
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/rule.yml
@@ -0,0 +1,32 @@
+documentation_complete: true
+
+title: 'Ensure Chrony is only configured with the server directive'
+
+description: |-
+ Check that Chrony only has time sources configured with the <tt>server</tt> directive.
+
+rationale: |-
+ Depending on the infrastruture being used the <tt>pool</tt> directive may not be supported.
+
+severity: medium
+
+platform: chrony
+
+warnings:
+ - general: This rule doesn't come with a remediation, the time source needs to be added by the adminstrator.
+
+identifiers:
+ cce@rhel8: CCE-86077-5
+ cce@rhel9: CCE-87077-4
+
+references:
+ disa: CCI-001891
+ srg: SRG-OS-000355-GPOS-00143,SRG-OS-000356-GPOS-00144,SRG-OS-000359-GPOS-00146
+ stigid@rhel8: RHEL-08-030740
+
+ocil_clause: 'a remote time server is not configured or configured with pool directive'
+
+ocil: |-
+ Run the following command and verify that time sources are only configure with <tt>server</tt> directive:
+ <pre># grep -E "^(server|pool)" /etc/chrony.conf</pre>
+ A line with the appropriate server should be returned, any line returned starting with <tt>pool</tt> is a finding.
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
new file mode 100644
index 00000000000..d1ba0755198
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_empty.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+# remediation = none
+
+echo "" > /etc/chrony.conf
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
new file mode 100644
index 00000000000..12a50ebc3d2
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/file_missing.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+# remediation = none
+
+rm -f /etc/chrony.conf
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
new file mode 100644
index 00000000000..bffa8b62b1b
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/line_missing.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+# remediation = none
+
+echo "some line" > /etc/chrony.conf
+echo "another line" >> /etc/chrony.conf
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
new file mode 100644
index 00000000000..5527f389316
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/multiple_servers.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+# remediation = none
+
+sed -i "^pool.*" /etc/chrony.conf
+echo "server 0.pool.ntp.org" > /etc/chrony.conf
+echo "server 1.pool.ntp.org" >> /etc/chrony.conf
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
new file mode 100644
index 00000000000..616fe8844fc
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_pool.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+# remediation = none
+
+sed -i "^server.*" /etc/chrony.conf
+if ! grep "^pool.*" /etc/chrony.conf; then
+ echo "pool 0.pool.ntp.org" > /etc/chrony.conf
+fi
diff --git a/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
new file mode 100644
index 00000000000..21a70dc4900
--- /dev/null
+++ b/linux_os/guide/services/ntp/chronyd_server_directive/tests/only_server.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = chrony
+# platform = multi_platform_fedora,multi_platform_rhel
+
+sed -i "^pool.*" /etc/chrony.conf
+echo "server 0.pool.ntp.org" > /etc/chrony.conf
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 36f606ee461..2bd1fb54316 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -909,6 +909,7 @@ selections:
# RHEL-08-030740
# remediation fails because default configuration file contains pool instead of server keyword
- chronyd_or_ntpd_set_maxpoll
+ - chronyd_server_directive
# RHEL-08-030741
- chronyd_client_only
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 374932cfd32..0d4d7b0ff97 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -909,6 +909,7 @@ selections:
# RHEL-08-030740
# remediation fails because default configuration file contains pool instead of server keyword
- chronyd_or_ntpd_set_maxpoll
+ - chronyd_server_directive
# RHEL-08-030741
- chronyd_client_only
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 8c59c5d3201..0081fe1938f 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -152,7 +152,6 @@ CCE-86073-4
CCE-86074-2
CCE-86075-9
CCE-86076-7
-CCE-86077-5
CCE-86078-3
CCE-86079-1
CCE-86080-9
@@ -1079,7 +1078,6 @@ CCE-87073-3
CCE-87074-1
CCE-87075-8
CCE-87076-6
-CCE-87077-4
CCE-87078-2
CCE-87079-0
CCE-87080-8
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 5b06103d72e..7d44f8910d1 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -160,6 +160,7 @@ selections:
- chronyd_client_only
- chronyd_no_chronyc_network
- chronyd_or_ntpd_set_maxpoll
+- chronyd_server_directive
- clean_components_post_updating
- configure_bashrc_exec_tmux
- configure_bind_crypto_policy
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 11e0ee9515a..91546d1d418 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -171,6 +171,7 @@ selections:
- chronyd_client_only
- chronyd_no_chronyc_network
- chronyd_or_ntpd_set_maxpoll
+- chronyd_server_directive
- clean_components_post_updating
- configure_bashrc_exec_tmux
- configure_bind_crypto_policy

50
SOURCES/scap-security-guide-0.1.61-delta_tailoring_fix-PR_8262.patch Normal file
View File

@ -0,0 +1,50 @@
From cd544b1ceec3cfc799faf24fc83e99f950d1c9c9 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 23 Feb 2022 12:21:17 -0600
Subject: [PATCH] Ensure that get_implemented_stigs in
utils/create_scap_delta_tailoring.py works for all case
Before this commit using resolved_rules_dir would deselect all rules
---
utils/create_scap_delta_tailoring.py | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/utils/create_scap_delta_tailoring.py b/utils/create_scap_delta_tailoring.py
index 90e131cd01a..b1a44858a0f 100755
--- a/utils/create_scap_delta_tailoring.py
+++ b/utils/create_scap_delta_tailoring.py
@@ -103,24 +103,22 @@ def get_implemented_stigs(product, root_path, build_config_yaml_path,
build_root):
platform_rules = get_platform_rules(product, json_path, resolved_rules_dir, build_root)
- if resolved_rules_dir:
- platform_rules_dict = dict()
- for rule in platform_rules:
- platform_rules_dict[rule['id']] = rule
- return platform_rules_dict
product_dir = os.path.join(root_path, "products", product)
product_yaml_path = os.path.join(product_dir, "product.yml")
env_yaml = ssg.environment.open_environment(build_config_yaml_path, str(product_yaml_path))
known_rules = dict()
for rule in platform_rules:
- try:
- rule_obj = handle_rule_yaml(product, rule['id'],
- rule['dir'], rule['guide'], env_yaml)
- except ssg.yaml.DocumentationNotComplete:
- sys.stderr.write('Rule %s throw DocumentationNotComplete' % rule['id'])
- # Happens on non-debug build when a rule is "documentation-incomplete"
- continue
+ if resolved_rules_dir:
+ rule_obj = rule
+ else:
+ try:
+ rule_obj = handle_rule_yaml(product, rule['id'],
+ rule['dir'], rule['guide'], env_yaml)
+ except ssg.yaml.DocumentationNotComplete:
+ sys.stderr.write('Rule %s throw DocumentationNotComplete' % rule['id'])
+ # Happens on non-debug build when a rule is "documentation-incomplete"
+ continue
if reference_str in rule_obj['references'].keys():
ref = rule_obj['references'][reference_str]

26
SOURCES/scap-security-guide-0.1.61-dont-remove-krb5-workstation-on-ovirt-PR_8233.patch Normal file
View File

@ -0,0 +1,26 @@
From 9c57a8718f82458fe3784263fdb1e51bd08fff83 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 16 Feb 2022 12:46:21 +0100
Subject: [PATCH] Do not remove krb5-workstation package on oVirt
---
.../system-tools/package_krb5-workstation_removed/rule.yml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
index 4d8951a9148..813474842ec 100644
--- a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
+++ b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml
@@ -27,6 +27,12 @@ references:
stigid@ol8: OL08-00-010162
stigid@rhel8: RHEL-08-010162
+platforms:
+{{{ rule_notapplicable_when_ovirt_installed() | indent(4)}}}
+
+warnings:
+{{{ ovirt_rule_notapplicable_warning("RHV hosts require ipa-client package, which has dependency on krb5-workstation") | indent(4) }}}
+
{{{ complete_ocil_entry_package(package="krb5-workstation") }}}
template:

536
SOURCES/scap-security-guide-0.1.61-file_groupowner-PR_7791.patch Normal file
View File

@ -0,0 +1,536 @@
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
new file mode 100644
index 00000000000..de85c892704
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml
@@ -0,0 +1,38 @@
+documentation_complete: true
+
+title: 'Audit Configuration Files Must Be Owned By Group root'
+
+description: |-
+ All audit configuration files must be owned by group root.
+ <pre>chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</pre>
+
+rationale: |-
+ Without the capability to restrict which roles and individuals can
+ select which events are audited, unauthorized personnel may be able
+ to prevent the auditing of critical events.
+ Misconfigured audits may degrade the system's performance by
+ overwhelming the audit log. Misconfigured audits may also make it more
+ difficult to establish, correlate, and investigate the events relating
+ to an incident or identify those responsible for one.
+
+severity: medium
+
+references:
+ disa: CCI-000171
+ srg: SRG-OS-000063-GPOS-00032
+ stigid@ubuntu2004: UBTU-20-010135
+
+ocil: |-
+ {{{ describe_file_group_owner(file="/etc/audit/", group="root") }}}
+ {{{ describe_file_group_owner(file="/etc/audit/rules.d/", group="root") }}}
+
+template:
+ name: file_groupowner
+ vars:
+ filepath:
+ - /etc/audit/
+ - /etc/audit/rules.d/
+ file_regex:
+ - ^audit(\.rules|d\.conf)$
+ - ^.*\.rules$
+ filegid: '0'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
new file mode 100644
index 00000000000..5235e0d05a3
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/correct_groupowner.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+mkdir -p /etc/audit/rules.d/
+touch $TESTFILE
+touch $AUDITFILE
+chgrp root $TESTFILE
+chgrp root $AUDITFILE
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
new file mode 100644
index 00000000000..52378d810a5
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/tests/incorrect_groupowner.fail.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+groupadd group_test
+export TESTFILLE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+mkdir -p /etc/audit/rules.d/
+touch $TESTFILLE
+touch $AUDITFILE
+chgrp group_test $TESTFILLE
+chgrp group_test $AUDITFILE
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
index 5e2cabafc34..927d08d03d4 100644
--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml
@@ -1,8 +1,15 @@
+{{% if 'ubuntu' in product %}}
+{{% set gid = 'syslog' %}}
+{{% else %}}
+{{% set gid = 'root' %}}
+{{% endif %}}
+
+
documentation_complete: true
title: 'Verify Group Who Owns /var/log Directory'
-description: '{{{ describe_file_group_owner(file="/var/log", group="root") }}}'
+description: '{{{ describe_file_group_owner(file="/var/log", group=gid) }}}'
rationale: |-
The <tt>/var/log</tt> directory contains files with logs of error
@@ -22,13 +29,16 @@ references:
stigid@rhel8: RHEL-08-010260
stigid@ubuntu2004: UBTU-20-010417
-ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group="root") }}}'
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group=gid) }}}'
ocil: |-
- {{{ ocil_file_group_owner(file="/var/log", group="root") }}}
+ {{{ ocil_file_group_owner(file="/var/log", group=gid) }}}
template:
name: file_groupowner
vars:
filepath: /var/log/
filegid: '0'
+ filegid@ubuntu1604: '110'
+ filegid@ubuntu1804: '110'
+ filegid@ubuntu2004: '110'
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
new file mode 100644
index 00000000000..f654279fe54
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_syslog/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+title: 'Verify Group Who Owns /var/log/syslog File'
+
+description: '{{{ describe_file_group_owner(file="/var/log/syslog", group="adm") }}}'
+
+rationale: |-
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
+ the system and should only be accessed by authorized personnel.
+
+severity: medium
+
+references:
+ disa: CCI-001314
+ srg: SRG-OS-000206-GPOS-00084
+ stigid@ubuntu2004: UBTU-20-010420
+
+ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log/syslog", group="adm") }}}'
+
+ocil: |-
+ {{{ ocil_file_group_owner(file="/var/log/syslog", group="adm") }}}
+
+template:
+ name: file_groupowner
+ vars:
+ filepath: /var/log/syslog
+ filegid: '4'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
new file mode 100644
index 00000000000..655b2cd1aef
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_groupownership_binary_dirs/rule.yml
@@ -0,0 +1,65 @@
+documentation_complete: true
+
+prodtype: ubuntu2004
+
+title: 'Verify that system commands directories are group owned by root'
+
+description: |-
+ System commands files are stored in the following directories by default:
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/sbin
+ /usr/local/bin
+ /usr/local/sbin
+ </pre>
+ All these directories should be owned by the <tt>root</tt> group.
+ If the directory is found to be owned by a group other than root correct
+ its ownership with the following command:
+ <pre>$ sudo chgrp root <i>DIR</i></pre>
+
+rationale: |-
+ If the operating system allows any user to make changes to software
+ libraries, then those changes might be implemented without undergoing the
+ appropriate testing and approvals that are part of a robust change management
+ process.
+ This requirement applies to operating systems with software libraries
+ that are accessible and configurable, as in the case of interpreted languages.
+ Software libraries also include privileged programs which execute with
+ escalated privileges. Only qualified and authorized individuals must be
+ allowed to obtain access to information system components for purposes
+ of initiating changes, including upgrades and modifications.
+
+severity: medium
+
+references:
+ disa: CCI-001495
+ srg: SRG-OS-000258-GPOS-00099
+ stigid@ubuntu2004: UBTU-20-010425
+
+ocil_clause: 'any of these directories are not owned by root group'
+
+ocil: |-
+ System commands are stored in the following directories:
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/sbin
+ /usr/local/bin
+ /usr/local/sbin</pre>
+ For each of these directories, run the following command to find files not
+ owned by root group:
+ <pre>$ sudo find -L <i>$DIR</i> ! -group root -type d \;</pre>
+
+template:
+ name: file_groupowner
+ vars:
+ filepath:
+ - /bin/
+ - /sbin/
+ - /usr/bin/
+ - /usr/sbin/
+ - /usr/local/bin/
+ - /usr/local/sbin/
+ recursive: 'true'
+ filegid: '0'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
deleted file mode 100644
index 28df7839430..00000000000
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_library_dirs/ansible/shared.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-# platform = multi_platform_sle
-# reboot = false
-# strategy = restrict
-# complexity = medium
-# disruption = medium
-- name: "Read list libraries without root ownership"
- find:
- paths:
- - "/usr/lib"
- - "/usr/lib64"
- - "/lib"
- - "/lib64"
- file_type: "directory"
- register: library_dirs_not_owned_by_root
-
-- name: "Set ownership of system library dirs to root"
- file:
- path: "{{ item.path }}"
- owner: "root"
- state: "directory"
- mode: "{{ item.mode }}"
- with_items: "{{ library_dirs_not_owned_by_root.files }}"
- when: library_dirs_not_owned_by_root.matched > 0
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
new file mode 100644
index 00000000000..f61a5f988dc
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_audit_binaries/rule.yml
@@ -0,0 +1,77 @@
+documentation_complete: true
+
+prodtype: ubuntu2004
+
+title: 'Verify that audit tools are owned by group root'
+
+description: |-
+ The {{{ full_name }}} operating system audit tools must have the proper
+ ownership configured to protected against unauthorized access.
+
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl root
+ /sbin/aureport root
+ /sbin/ausearch root
+ /sbin/autrace root
+ /sbin/auditd root
+ /sbin/audispd root
+ /sbin/augenrules root
+ </pre>
+
+ Audit tools needed to successfully view and manipulate audit information
+ system activity and records. Audit tools include custom queries and report
+ generators
+
+rationale: |-
+ Protecting audit information also includes identifying and protecting the
+ tools used to view and manipulate log data. Therefore, protecting audit
+ tools is necessary to prevent unauthorized operation on audit information.
+
+ Operating systems providing tools to interface with audit information
+ will leverage user permissions and roles identifying the user accessing the
+ tools and the corresponding rights the user enjoys to make access decisions
+ regarding the access to audit tools.
+
+severity: medium
+
+references:
+ disa: CCI-001493,CCI-001494
+ srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
+ stigid@ubuntu2004: UBTU-20-010201
+
+ocil: |-
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl root
+ /sbin/aureport root
+ /sbin/ausearch root
+ /sbin/autrace root
+ /sbin/auditd root
+ /sbin/audispd root
+ /sbin/augenrules root
+ </pre>
+
+ If the command does not return all the above lines, the missing ones
+ need to be added.
+
+ Run the following command to correct the permissions of the missing
+ entries:
+ <pre>$ sudo chown :root [audit_tool] </pre>
+
+ Replace "[audit_tool]" with each audit tool not group-owned by root.
+
+template:
+ name: file_groupowner
+ vars:
+ filepath:
+ - /sbin/auditctl
+ - /sbin/aureport
+ - /sbin/ausearch
+ - /sbin/autrace
+ - /sbin/auditd
+ - /sbin/audispd
+ - /sbin/augenrules
+ filegid: '0'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
index bb7c72550e9..a9e8c7d8e25 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
+# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
do
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
index 7cf507ca5f4..33a0c85d35b 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/tests/incorrect_groupownership.fail.sh
@@ -1,10 +1,12 @@
#!/bin/bash
+groupadd group_test
+
for TESTFILE in /bin/test_me /sbin/test_me /usr/bin/test_me /usr/sbin/test_me /usr/local/bin/test_me /usr/local/sbin/test_me
do
if [[ ! -f $TESTFILE ]]
then
touch $TESTFILE
fi
- chown nobody.nobody $TESTFILE
+ chgrp group_test $TESTFILE
done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
deleted file mode 100644
index 08019fd48bb..00000000000
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
-# reboot = false
-# strategy = restrict
-# complexity = high
-# disruption = medium
-
-- name: "Read list libraries without root ownership"
- find:
- paths:
- - "/usr/lib"
- - "/usr/lib64"
- - "/lib"
- - "/lib64"
- file_type: "file"
- register: library_files_not_group_owned_by_root
-
-- name: "Set group ownership of system library files to root"
- file:
- path: "{{ item.path }}"
- group: "root"
- state: "file"
- mode: "{{ item.mode }}"
- with_items: "{{ library_files_not_group_owned_by_root.files }}"
- when:
- - library_files_not_group_owned_by_root.matched > 0
- - item.gid != 0
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
deleted file mode 100644
index 3a42beafb8a..00000000000
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-# platform = multi_platform_sle,Oracle Linux 8,Red Hat Enterprise Linux 8,multi_platform_fedora
-
-find /lib \
-/lib64 \
-/usr/lib \
-/usr/lib64 \
-\! -group root -type f -exec chgrp root '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
deleted file mode 100644
index f5ca9380b55..00000000000
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+++ /dev/null
@@ -1,27 +0,0 @@
-<def-group>
- <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
- {{{ oval_metadata("
- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
- are owned by root.
- ") }}}
- <criteria >
- <criterion test_ref="test_root_permissions_for_syslibrary_files" />
- </criteria>
- </definition>
-
- <unix:file_test check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
- <unix:object object_ref="root_permissions_for_system_wide_library_files" />
- </unix:file_test>
-
- <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
- <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
- are owned by root. -->
- <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
- </unix:file_object>
-
- <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
- <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
- </unix:file_state>
-</def-group>
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
index 17923f52ea6..eaf04c8d36c 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15
+prodtype: fedora,ol8,rhel8,rhel9,sle12,sle15,ubuntu2004
title: |-
Verify the system-wide library files in directories
@@ -46,6 +46,7 @@ references:
stigid@rhel8: RHEL-08-010350
stigid@sle12: SLES-12-010875
stigid@sle15: SLES-15-010355
+ stigid@ubuntu2004: UBTU-20-01430
ocil_clause: 'system wide library files are not group owned by root'
@@ -59,3 +60,14 @@ ocil: |-
To find if system-wide library files stored in these directories are not group-owned by
root run the following command for each directory <i>DIR</i>:
<pre>$ sudo find -L <i>DIR</i> ! -group root -type f </pre>
+
+template:
+ name: file_groupowner
+ vars:
+ filepath:
+ - /lib/
+ - /lib64/
+ - /usr/lib/
+ - /usr/lib64/
+ file_regex: ^.*$
+ filegid: '0'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
similarity index 86%
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
index a4ae2854db1..0e982c3b8ca 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_groupowner.pass.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
do
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
similarity index 70%
rename from linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
rename to linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
index c96f65b989c..23a7703f57d 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_groupowner.fail.sh
@@ -1,10 +1,11 @@
-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
+groupadd group_test
for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
do
if [[ ! -f $TESTFILE ]]
then
touch $TESTFILE
fi
- chown nobody.nobody $TESTFILE
+ chgrp group_test $TESTFILE
done
diff --git a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
index 938e6b30819..015ff98c99d 100644
--- a/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
+++ b/shared/templates/file_groupowner/tests/missing_file_test.pass.sh
@@ -1,8 +1,20 @@
#!/bin/bash
#
-{{% if MISSING_FILE_PASS %}}
- rm -f {{{ FILEPATH }}}
-{{% else %}}
- true
-{{% endif %}}
+{{% for path in FILEPATH %}}
+ {{% if MISSING_FILE_PASS %}}
+ rm -f {{{ path }}}
+ {{% else %}}
+ {{% if IS_DIRECTORY and FILE_REGEX %}}
+ echo "Create specific tests for this rule because of regex"
+ {{% elif IS_DIRECTORY and RECURSIVE %}}
+ find -L {{{ path }}} -type d -exec chgrp {{{ FILEGID }}} {} \;
+ {{% else %}}
+ if [ ! -f {{{ path }}} ]; then
+ mkdir -p "$(dirname '{{{ path }}}')"
+ touch {{{ path }}}
+ fi
+ chgrp {{{ FILEGID }}} {{{ path }}}
+ {{% endif %}}
+ {{% endif %}}
+{{% endfor %}}

288
SOURCES/scap-security-guide-0.1.61-file_owner-PR_7789.patch Normal file
View File

@ -0,0 +1,288 @@
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml
new file mode 100644
index 00000000000..968ef336148
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/rule.yml
@@ -0,0 +1,39 @@
+documentation_complete: true
+
+title: 'Audit Configuration Files Must Be Owned By Root'
+
+description: |-
+ All audit configuration files must be owned by root user.
+ {{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
+ {{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
+
+rationale: |-
+ Without the capability to restrict which roles and individuals can
+ select which events are audited, unauthorized personnel may be able
+ to prevent the auditing of critical events.
+ Misconfigured audits may degrade the system's performance by
+ overwhelming the audit log. Misconfigured audits may also make it more
+ difficult to establish, correlate, and investigate the events relating
+ to an incident or identify those responsible for one.
+
+severity: medium
+
+references:
+ disa: CCI-000171
+ srg: SRG-OS-000063-GPOS-00032
+ stigid@ubuntu2004: UBTU-20-010134
+
+ocil: |-
+ {{{ describe_file_owner(file="/etc/audit/", owner="root") }}}
+ {{{ describe_file_owner(file="/etc/audit/rules.d/", owner="root") }}}
+
+template:
+ name: file_owner
+ vars:
+ filepath:
+ - /etc/audit/
+ - /etc/audit/rules.d/
+ file_regex:
+ - ^audit(\.rules|d\.conf)$
+ - ^.*\.rules$
+ fileuid: '0'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh
new file mode 100644
index 00000000000..4d67307a1ef
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/correct_owner.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = audit
+
+chown 0 /etc/audit/audit.rules
+chown 0 /etc/audit/auditd.conf
+chown 0 -R /etc/audit/rules.d/
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh
new file mode 100644
index 00000000000..337074fab92
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_audit_configuration/tests/incorrect_owner.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# packages = audit
+
+useradd testuser_123
+chown testuser_123 /etc/audit/audit.rules
+chown testuser_123 /etc/audit/auditd.conf
+chown testuser_123 -R /etc/audit/rules.d/
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml
new file mode 100644
index 00000000000..f1bf515455d
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_syslog/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+title: 'Verify User Who Owns /var/log/syslog File'
+
+description: '{{{ describe_file_owner(file="/var/log/syslog", owner="syslog") }}}'
+
+rationale: |-
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
+ the system and should only be accessed by authorized personnel.
+
+severity: medium
+
+references:
+ disa: CCI-001314
+ srg: SRG-OS-000206-GPOS-00084
+ stigid@ubuntu2004: UBTU-20-010421
+
+ocil_clause: '{{{ ocil_clause_file_owner(file="/var/log/syslog", owner="syslog") }}}'
+
+ocil: |-
+ {{{ ocil_file_owner(file="/var/log/syslog", owner="syslog") }}}
+
+template:
+ name: file_owner
+ vars:
+ filepath: /var/log/syslog
+ fileuid: '104'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
new file mode 100644
index 00000000000..e2362388678
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_ownership_binary_dirs/rule.yml
@@ -0,0 +1,55 @@
+documentation_complete: true
+
+title: 'Verify that System Executable Have Root Ownership'
+
+description: |-
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/sbin
+ /usr/local/bin
+ /usr/local/sbin</pre>
+ All these directories should be owned by the <tt>root</tt> user.
+ If any directory <i>DIR</i> in these directories is found
+ to be owned by a user other than root, correct its ownership with the
+ following command:
+ <pre>$ sudo chown root <i>DIR</i></pre>
+
+rationale: |-
+ System binaries are executed by privileged users as well as system services,
+ and restrictive permissions are necessary to ensure that their
+ execution of these programs cannot be co-opted.
+
+severity: medium
+
+references:
+ disa: CCI-001495
+ srg: SRG-OS-000258-GPOS-00099
+ stigid@ubuntu2004: UBTU-20-010424
+
+ocil_clause: 'any system exectables directories are found to not be owned by root'
+
+ocil: |-
+ System executables are stored in the following directories by default:
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/local/bin
+ /usr/local/sbin
+ /usr/sbin</pre>
+ For each of these directories, run the following command to find files
+ not owned by root:
+ <pre>$ sudo find -L <i>DIR/</i> ! -user root -type d -exec chown root {} \;</pre>
+
+template:
+ name: file_owner
+ vars:
+ filepath:
+ - /bin/
+ - /sbin/
+ - /usr/bin/
+ - /usr/sbin/
+ - /usr/local/bin/
+ - /usr/local/sbin/
+ recursive: 'true'
+ fileuid: '0'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml
new file mode 100644
index 00000000000..0c7d9b313d5
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_audit_binaries/rule.yml
@@ -0,0 +1,77 @@
+documentation_complete: true
+
+prodtype: ubuntu2004
+
+title: 'Verify that audit tools are owned by root'
+
+description: |-
+ The {{{ full_name }}} operating system audit tools must have the proper
+ ownership configured to protected against unauthorized access.
+
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl root
+ /sbin/aureport root
+ /sbin/ausearch root
+ /sbin/autrace root
+ /sbin/auditd root
+ /sbin/audispd root
+ /sbin/augenrules root
+ </pre>
+
+ Audit tools needed to successfully view and manipulate audit information
+ system activity and records. Audit tools include custom queries and report
+ generators
+
+rationale: |-
+ Protecting audit information also includes identifying and protecting the
+ tools used to view and manipulate log data. Therefore, protecting audit
+ tools is necessary to prevent unauthorized operation on audit information.
+
+ Operating systems providing tools to interface with audit information
+ will leverage user permissions and roles identifying the user accessing the
+ tools and the corresponding rights the user enjoys to make access decisions
+ regarding the access to audit tools.
+
+severity: medium
+
+references:
+ disa: CCI-001493,CCI-001494
+ srg: SRG-OS-000256-GPiOS-00097,SRG-OS-000257-GPOS-00098
+ stigid@ubuntu2004: UBTU-20-010200
+
+ocil: |-
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl root
+ /sbin/aureport root
+ /sbin/ausearch root
+ /sbin/autrace root
+ /sbin/auditd root
+ /sbin/audispd root
+ /sbin/augenrules root
+ </pre>
+
+ If the command does not return all the above lines, the missing ones
+ need to be added.
+
+ Run the following command to correct the permissions of the missing
+ entries:
+ <pre>$ sudo chown root [audit_tool] </pre>
+
+ Replace "[audit_tool]" with each audit tool not owned by root.
+
+template:
+ name: file_owner
+ vars:
+ filepath:
+ - /sbin/auditctl
+ - /sbin/aureport
+ - /sbin/ausearch
+ - /sbin/autrace
+ - /sbin/auditd
+ - /sbin/audispd
+ - /sbin/augenrules
+ fileuid: '0'
diff --git a/shared/templates/file_owner/ansible.template b/shared/templates/file_owner/ansible.template
index 80eaae8d50b..590c9fc6055 100644
--- a/shared/templates/file_owner/ansible.template
+++ b/shared/templates/file_owner/ansible.template
@@ -25,7 +25,7 @@
- name: Ensure owner on {{{ path }}} recursively
file:
- paths "{{{ path }}}"
+ path: "{{{ path }}}"
state: directory
recurse: yes
owner: "{{{ FILEUID }}}"
diff --git a/shared/templates/file_owner/tests/missing_file_test.pass.sh b/shared/templates/file_owner/tests/missing_file_test.pass.sh
index 938e6b30819..4e3683f9dcf 100644
--- a/shared/templates/file_owner/tests/missing_file_test.pass.sh
+++ b/shared/templates/file_owner/tests/missing_file_test.pass.sh
@@ -1,8 +1,18 @@
#!/bin/bash
#
-{{% if MISSING_FILE_PASS %}}
- rm -f {{{ FILEPATH }}}
-{{% else %}}
- true
-{{% endif %}}
+{{% for path in FILEPATH %}}
+ {{% if MISSING_FILE_PASS %}}
+ rm -f {{{ path }}}
+ {{% else %}}
+ {{% if IS_DIRECTORY and RECURSIVE %}}
+ find -L {{{ path }}} -type d -exec chown {{{ FILEUID }}} {} \;
+ {{% else %}}
+ if [ ! -f {{{ path }}} ]; then
+ mkdir -p "$(dirname '{{{ path }}}')"
+ touch {{{ path }}}
+ fi
+ chown {{{ FILEUID }}} {{{ path }}}
+ {{% endif %}}
+ {{% endif %}}
+{{% endfor %}}

409
SOURCES/scap-security-guide-0.1.61-file_permissions-PR_7788.patch Normal file
View File

@ -0,0 +1,409 @@
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh
new file mode 100644
index 00000000000..93fd73e6ece
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/bash/ubuntu.sh
@@ -0,0 +1,14 @@
+# platform = multi_platform_ubuntu
+
+readarray -t files < <(find /var/log/)
+for file in "${files[@]}"; do
+ if basename $file | grep -qE '^.*$'; then
+ chmod 0640 $file
+ fi
+done
+
+if grep -qE "^f \/var\/log\/(btmp|wtmp|lastlog)? " /usr/lib/tmpfiles.d/var.conf; then
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/btmp[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/wtmp[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
+ sed -i --follow-symlinks "s/\(^f[[:space:]]\+\/var\/log\/lastlog[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10640/" /usr/lib/tmpfiles.d/var.conf
+fi
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml
deleted file mode 100644
index dd95ce05936..00000000000
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/oval/shared.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-<def-group>
- <definition class="compliance" id="permissions_local_var_log" version="1">
- {{{ oval_metadata("
- Checks that files in /var/log have permission at least 0640
- ") }}}
- <criteria operator="AND">
- <criterion test_ref="test_mode_log_files" />
- </criteria>
- </definition>
-
- <unix:file_test check="all" check_existence="none_exist" comment="log file with less restrictive permission than 0640" id="test_mode_log_files" version="1">
- <unix:object object_ref="object_file_mode_log_files" />
- </unix:file_test>
-
- <unix:file_object comment="log files" id="object_file_mode_log_files" version="1">
- <unix:path operation="pattern match">^\/var\/log\/</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">log_files_permission_more_0640</filter>
- <filter action="exclude">var_log_symlinks</filter>
- </unix:file_object>
-
- <unix:file_state id="log_files_permission_more_0640" version="1" operator="OR">
- <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
- <unix:uexec datatype="boolean">true</unix:uexec>
- <unix:gwrite datatype="boolean">true</unix:gwrite>
- <unix:gexec datatype="boolean">true</unix:gexec>
- <unix:oread datatype="boolean">true</unix:oread>
- <unix:owrite datatype="boolean">true</unix:owrite>
- <unix:oexec datatype="boolean">true</unix:oexec>
- </unix:file_state>
-
- <unix:file_state id="var_log_symlinks" version="1">
- <unix:type operation="equals">symbolic link</unix:type>
- </unix:file_state>
-
-</def-group>
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
index 2b0431b7763..9ce79cfde4e 100644
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/rule.yml
@@ -47,3 +47,10 @@ ocil: |-
<pre>
sudo find /var/log -perm /137 -type f -exec stat -c "%n %a" {} \;
</pre>
+
+template:
+ name: file_permissions
+ vars:
+ filepath: /var/log/
+ file_regex: '.*'
+ filemode: '0640'
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
index 5317ef272b8..1793259cff5 100644
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/var_logfile_correct_mode.pass.sh
@@ -1,5 +1,6 @@
#!/bin/bash
+chmod -R 640 /var/log
mkdir -p /var/log/testme
touch /var/log/testme/test.log
chmod 640 /var/log/testme/test.log
diff --git a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
index 83db1acf8d3..69b081473a5 100644
--- a/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_local_var_log/tests/world_writable_dir.pass.sh
@@ -1,4 +1,5 @@
#!/bin/bash
+chmod -R 640 /var/log/
mkdir -p /var/log/testme
chmod 777 /var/log/testme
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh
new file mode 100644
index 00000000000..93962ea66a7
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/bash/ubuntu.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_ubuntu
+
+chmod 0755 /var/log/
+
+if grep -q "^z \/var\/log " /usr/lib/tmpfiles.d/00rsyslog.conf; then
+ sed -i --follow-symlinks "s/\(^z[[:space:]]\+\/var\/log[[:space:]]\+\)\(\([[:digit:]]\+\)[^ $]*\)/\10755/" /usr/lib/tmpfiles.d/00rsyslog.conf
+fi
diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml
new file mode 100644
index 00000000000..73258d40fdc
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_syslog/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+title: 'Verify Permissions on /var/log/syslog File'
+
+description: |-
+ {{{ describe_file_permissions(file="/var/log/syslog", perms="0640") }}}
+
+rationale: |-
+ The <tt>/var/log/syslog</tt> file contains logs of error messages in
+ the system and should only be accessed by authorized personnel.
+
+severity: medium
+
+references:
+ disa: CCI-001314
+ srg: SRG-OS-000206-GPOS-00084
+ stigid@ubuntu2004: UBTU-20-010422
+
+ocil_clause: '{{{ ocil_clause_file_permissions(file="/var/log/syslog", perms="-rw-r-----") }}}'
+
+ocil: |-
+ {{{ ocil_file_permissions(file="/var/log/syslog", perms="-rw-r-----") }}}
+
+template:
+ name: file_permissions
+ vars:
+ filepath: /var/log/syslog
+ filemode: '0640'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml
new file mode 100644
index 00000000000..a666c768870
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_binary_dirs/rule.yml
@@ -0,0 +1,57 @@
+documentation_complete: true
+
+title: 'Verify that System Executable Directories Have Restrictive Permissions'
+
+description: |-
+ System executables are stored in the following directories by default:
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/sbin
+ /usr/local/bin
+ /usr/local/sbin</pre>
+ These directories should not be group-writable or world-writable.
+ If any directory <i>DIR</i> in these directories is found to be
+ group-writable or world-writable, correct its permission with the
+ following command:
+ <pre>$ sudo chmod go-w <i>DIR</i></pre>
+
+rationale: |-
+ System binaries are executed by privileged users, as well as system services,
+ and restrictive permissions are necessary to ensure execution of these programs
+ cannot be co-opted.
+
+severity: medium
+
+references:
+ disa: CCI-001495
+ srg: SRG-OS-000258-GPOS-00099
+ stigid@ubuntu2004: UBTU-20-010423
+
+ocil_clause: 'any of these files are group-writable or world-writable'
+
+ocil: |-
+ System executables are stored in the following directories by default:
+ <pre>/bin
+ /sbin
+ /usr/bin
+ /usr/sbin
+ /usr/local/bin
+ /usr/local/sbin</pre>
+ To find system executables directories that are group-writable or
+ world-writable, run the following command for each directory <i>DIR</i>
+ which contains system executables:
+ <pre>$ sudo find -L <i>DIR</i> -perm /022 -type d</pre>
+
+template:
+ name: file_permissions
+ vars:
+ filepath:
+ - /bin/
+ - /sbin/
+ - /usr/bin/
+ - /usr/sbin/
+ - /usr/local/bin/
+ - /usr/local/sbin/
+ recursive: 'true'
+ filemode: '0755'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
index 3f7239deef9..af078463b05 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,multi_platform_ubuntu
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
find "$dirPath" -perm /022 -type d -exec chmod go-w '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
index 1f68586853d..d58616bcafb 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
@@ -1,5 +1,6 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,multi_platform_ubuntu
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
+ chmod -R 755 "$dirPath"
mkdir -p "$dirPath/testme" && chmod 700 "$dirPath/testme"
done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
index b60a7269568..98d18cde3ea 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,multi_platform_ubuntu
DIRS="/lib /lib64"
for dirPath in $DIRS; do
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
index 5438b51bb6a..6df6e2f8f9b 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_sle,multi_platform_ubuntu
DIRS="/usr/lib /usr/lib64"
for dirPath in $DIRS; do
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml
new file mode 100644
index 00000000000..da42e997478
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_audit_binaries/rule.yml
@@ -0,0 +1,78 @@
+documentation_complete: true
+
+prodtype: ubuntu2004
+
+title: 'Verify that audit tools Have Mode 0755 or less'
+
+description: |-
+ The {{{ full_name }}} operating system audit tools must have the proper
+ permissions configured to protected against unauthorized access.
+
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl 755
+ /sbin/aureport 755
+ /sbin/ausearch 755
+ /sbin/autrace 755
+ /sbin/auditd 755
+ /sbin/audispd 755
+ /sbin/augenrules 755
+ </pre>
+
+ Audit tools needed to successfully view and manipulate audit information
+ system activity and records. Audit tools include custom queries and report
+ generators
+
+rationale: |-
+ Protecting audit information also includes identifying and protecting the
+ tools used to view and manipulate log data. Therefore, protecting audit
+ tools is necessary to prevent unauthorized operation on audit information.
+
+ Operating systems providing tools to interface with audit information
+ will leverage user permissions and roles identifying the user accessing the
+ tools and the corresponding rights the user enjoys to make access decisions
+ regarding the access to audit tools.
+
+severity: medium
+
+references:
+ disa: CCI-001493,CCI-001494
+ srg: SRG-OS-000256-GPOS-00097,SRG-OS-000257-GPOS-00098
+ stigid@ubuntu2004: UBTU-20-010199
+
+ocil: |-
+ Verify it by running the following command:
+ <pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
+
+ /sbin/auditctl 755
+ /sbin/aureport 755
+ /sbin/ausearch 755
+ /sbin/autrace 755
+ /sbin/auditd 755
+ /sbin/audispd 755
+ /sbin/augenrules 755
+ </pre>
+
+ If the command does not return all the above lines, the missing ones
+ need to be added.
+
+ Run the following command to correct the permissions of the missing
+ entries:
+ <pre>$ sudo chmod 0755 [audit_tool] </pre>
+
+ Replace "[audit_tool]" with the audit tool that does not have the
+ correct permissions.
+
+template:
+ name: file_permissions
+ vars:
+ filepath:
+ - /sbin/auditctl
+ - /sbin/aureport
+ - /sbin/ausearch
+ - /sbin/autrace
+ - /sbin/auditd
+ - /sbin/audispd
+ - /sbin/augenrules
+ filemode: '0755'
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
index de2e1e98dfa..ab89b277a52 100644
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle
+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
for dirPath in $DIRS; do
find "$dirPath" -perm /022 -exec chmod go-w '{}' \;
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh
new file mode 100644
index 00000000000..59b8838581c
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/correct_permissions.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
+for dirPath in $DIRS; do
+ find "$dirPath" -perm /022 -type f -exec chmod 0755 '{}' \;
+done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh
new file mode 100644
index 00000000000..9d9ce30064b
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/tests/incorrect_permissions.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
+for dirPath in $DIRS; do
+ find "$dirPath" -type f -exec chmod 0777 '{}' \;
+done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh
new file mode 100644
index 00000000000..de388e63325
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/correct_permissions.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
+for dirPath in $DIRS; do
+ chmod -R 755 "$dirPath"
+done
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh
new file mode 100644
index 00000000000..913e75e7b17
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/tests/incorrect_permissions.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+DIRS="/lib /lib64 /usr/lib /usr/lib64"
+for dirPath in $DIRS; do
+ find "$dirPath" -type d -exec chmod go-w '{}' \;
+ find "$dirPath" -type f -exec chmod go+w '{}' \;
+done
diff --git a/shared/templates/file_permissions/oval.template b/shared/templates/file_permissions/oval.template
index 89083e812c1..6b3616a7f42 100644
--- a/shared/templates/file_permissions/oval.template
+++ b/shared/templates/file_permissions/oval.template
@@ -67,6 +67,11 @@
#}}
<filter action="include">state_file_permissions{{{ FILEID }}}_{{{ loop.index0 }}}_mode_not_{{{ FILEMODE }}}</filter>
{{%- endif %}}
+ <filter action="exclude">exclude_symlinks_{{{ FILEID }}}</filter>
</unix:file_object>
{{% endfor %}}
+
+ <unix:file_state id="exclude_symlinks_{{{ FILEID }}}" version="1">
+ <unix:type operation="equals">symbolic link</unix:type>
+ </unix:file_state>
</def-group>

44
SOURCES/scap-security-guide-0.1.61-fix-ansible-service-disabled-task-PR_8226.patch Normal file
View File

@ -0,0 +1,44 @@
From 1c054ed40a4dbc2a48ffe7720d018c317cad8105 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 15 Feb 2022 14:12:55 +0100
Subject: [PATCH] Simply mask services that should be disabled
At some point Ansible started to return much more services in
ansible_facts.services, including services that are not installed.
This caused the task to think that the service exists, attempt to stop
and mask the service.
But systemd module fatal errors on non existing services, although the
module ends up masking the service in question.
The bash remediations simply mask the service, even if it is not
installed.
Let's do the same with Ansible, mask the service and ignore errors.
One down side is that every non-existing service is reported as an
error, which is ignored. But still a fatal error.
---
shared/templates/service_disabled/ansible.template | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/shared/templates/service_disabled/ansible.template b/shared/templates/service_disabled/ansible.template
index 550ed563056..254f41ac7fd 100644
--- a/shared/templates/service_disabled/ansible.template
+++ b/shared/templates/service_disabled/ansible.template
@@ -6,16 +6,13 @@
{{%- if init_system == "systemd" %}}
- name: Disable service {{{ SERVICENAME }}}
block:
- - name: Gather the service facts
- service_facts:
-
- name: Disable service {{{ SERVICENAME }}}
systemd:
name: "{{{ DAEMONNAME }}}.service"
enabled: "no"
state: "stopped"
masked: "yes"
- when: '"{{{ DAEMONNAME }}}.service" in ansible_facts.services'
+ ignore_errors: 'yes'
- name: "Unit Socket Exists - {{{ DAEMONNAME }}}.socket"
command: systemctl list-unit-files {{{ DAEMONNAME }}}.socket

22
SOURCES/scap-security-guide-0.1.61-fix_bug_in_delta_tailering_script-PR_8245.patch Normal file
View File

@ -0,0 +1,22 @@
From 50eb163d9e9751c2e8cf8129523a8cf7e07a5930 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 17 Feb 2022 12:49:32 -0600
Subject: [PATCH] get_implemented_stigs in utils/create_scap_delta_tailoring.py
should return the implemented stig items
---
utils/create_scap_delta_tailoring.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/utils/create_scap_delta_tailoring.py b/utils/create_scap_delta_tailoring.py
index 2c3c5d0df32..25ad1aef66e 100755
--- a/utils/create_scap_delta_tailoring.py
+++ b/utils/create_scap_delta_tailoring.py
@@ -127,6 +127,7 @@ def get_implemented_stigs(product, root_path, build_config_yaml_path,
known_rules[ref].append(rule['id'])
else:
known_rules[ref] = [rule['id']]
+ return known_rules
get_implemented_stigs.__annotations__ = {'product': str, 'root_path': str,

116
SOURCES/scap-security-guide-0.1.61-fix_enable_fips_mode-PR_8255.patch Normal file
View File

@ -0,0 +1,116 @@
From bc2f72ff8a23b508cef88a363e75e73474625775 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Tue, 22 Feb 2022 17:15:43 +0100
Subject: [PATCH 1/3] remove extend definition from ovals
---
.../software/integrity/fips/enable_fips_mode/oval/rhcos4.xml | 1 -
.../software/integrity/fips/enable_fips_mode/oval/shared.xml | 1 -
2 files changed, 2 deletions(-)
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
index c5ae0550e6b..52d86fd4478 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml
@@ -5,7 +5,6 @@
<extend_definition comment="check /etc/system-fips exists" definition_ref="etc_system_fips_exists" />
<extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="proc_sys_crypto_fips_enabled" />
<extend_definition comment="system cryptography policy is configured" definition_ref="configure_crypto_policy" />
- <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
<criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="test_system_crypto_policy_value" />
</criteria>
</definition>
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
index 699dca06dd1..6c3f57e143f 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
@@ -6,7 +6,6 @@
<extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="sysctl_crypto_fips_enabled" />
<extend_definition comment="Dracut FIPS module is enabled" definition_ref="enable_dracut_fips_module" />
<extend_definition comment="system cryptography policy is configured" definition_ref="configure_crypto_policy" />
- <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
<criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="test_system_crypto_policy_value" />
</criteria>
</definition>
From dbbea1998e189c4a27edc700478f55e2dfda56f8 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Tue, 22 Feb 2022 17:17:28 +0100
Subject: [PATCH 2/3] chang warning and description
---
.../integrity/fips/enable_fips_mode/rule.yml | 25 ++++---------------
1 file changed, 5 insertions(+), 20 deletions(-)
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
index 9d89114b07f..6b055eac8ff 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
@@ -13,11 +13,9 @@ description: |-
<ul>
<li>Setting the kernel FIPS mode flag (<tt>/proc/sys/crypto/fips_enabled</tt>) to <tt>1</tt></li>
<li>Creating <tt>/etc/system-fips</tt></li>
- <li>Setting the system crypto policy in <tt>/etc/crypto-policies/config</tt> to <tt>FIPS</tt></li>
+ <li>Setting the system crypto policy in <tt>/etc/crypto-policies/config</tt> to <tt>{{{ xccdf_value("var_system_crypto_policy") }}}</tt></li>
<li>Loading the Dracut <tt>fips</tt> module</li>
</ul>
- This rule also ensures that the system policy is set to <tt>{{{ xccdf_value("var_system_crypto_policy") }}}</tt>.
- Furthermore, the system running in FIPS mode should be FIPS certified by NIST.
rationale: |-
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
@@ -48,7 +46,7 @@ references:
ocil_clause: 'FIPS mode is not enabled'
ocil: |-
- To verify that FIPS is enabled properly, run the following command:
+ To verify that FIPS mode is enabled properly, run the following command:
<pre>fips-mode-setup --check</pre>
The output should contain the following:
<pre>FIPS mode is enabled.</pre>
@@ -61,19 +59,6 @@ warnings:
- general: |-
The system needs to be rebooted for these changes to take effect.
- regulatory: |-
- System Crypto Modules must be provided by a vendor that undergoes
- FIPS-140 certifications.
- FIPS-140 is applicable to all Federal agencies that use
- cryptographic-based security systems to protect sensitive information
- in computer and telecommunication systems (including voice systems) as
- defined in Section 5131 of the Information Technology Management Reform
- Act of 1996, Public Law 104-106. This standard shall be used in
- designing and implementing cryptographic modules that Federal
- departments and agencies operate or are operated for them under
- contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
- To meet this, the system has to have cryptographic software provided by
- a vendor that has undergone this certification. This means providing
- documentation, test results, design information, and independent third
- party review by an accredited lab. While open source software is
- capable of meeting this, it does not meet FIPS-140 unless the vendor
- submits to this process.
+ This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
+ You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.rip/groups/STM/cmvp/documents/140-1/1401vend.htm") }}}.
+ This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.
From 3c72eec95c617ee295099522d2817c6d217a7e63 Mon Sep 17 00:00:00 2001
From: vojtapolasek <krecoun@gmail.com>
Date: Wed, 23 Feb 2022 09:16:09 +0100
Subject: [PATCH 3/3] Update
linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
Co-authored-by: Gabriel Becker <ggasparb@redhat.com>
---
.../system/software/integrity/fips/enable_fips_mode/rule.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
index 6b055eac8ff..30cbc939bed 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
@@ -60,5 +60,5 @@ warnings:
The system needs to be rebooted for these changes to take effect.
- regulatory: |-
This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
- You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.rip/groups/STM/cmvp/documents/140-1/1401vend.htm") }}}.
+ You can find the list of FIPS certified modules at {{{ weblink(link="https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search") }}}.
This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.

854
SOURCES/scap-security-guide-0.1.61-grub2_rule_desc_update-PR_8184.patch Normal file
View File

@ -0,0 +1,854 @@
From 51a826878ade2ebb564405991937ba0e2b2b7717 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 2 Feb 2022 14:25:30 +0100
Subject: [PATCH 1/8] create two macros
one provides description for grub2_argument templated rules
the second provides ocil for those cases
---
shared/macros.jinja | 56 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
diff --git a/shared/macros.jinja b/shared/macros.jinja
index 00358e2f67c..3d41c998b0c 100644
--- a/shared/macros.jinja
+++ b/shared/macros.jinja
@@ -1620,3 +1620,59 @@ The audit daemon must be restarted for the changes to take effect.
- no_ovirt
{{%- endif %}}
{{% endmacro %}}
+
+{{#
+ Describe how to configure Grub2 to add an argument to the default kernel command line.
+ The parameter should be in form `parameter=value`.
+#}}
+{{%- macro describe_grub2_argument(arg_name_value) -%}}
+{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
+To ensure that <tt>{{{ arg_name_value }}}</tt> is added as a kernel command line
+argument to newly installed kernels, ad <tt>{{{ arg_name_value }}}</tt> to the
+default Grub2 command line for Linux operating systems. Modify the line within
+<tt>/etc/default/grub</tt> as shown below:
+<pre>GRUB_CMDLINE_LINUX="... {{{ arg_name_value }}} ..."</pre>
+Run the following command to update command line for already installed kernels:
+{{%- if 'ubuntu' in product -%}}
+<pre># update-grub</pre>
+{{%- else -%}}
+<pre># grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"</pre>
+{{%- endif -%}}
+{{%- else -%}}
+Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}} as follows:
+<pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) {{{ arg_name_value }}}"</pre>
+{{%- endif -%}}
+{{%- endmacro -%}}
+
+{{#
+ Provide OCIL for checking if an argument for kernel command line is configured with Grub2.
+ The parameter should have form `parameter=value`.
+#}}
+{{%- macro ocil_grub2_argument(arg_name_value) -%}}
+{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
+Inspect the form of default GRUB 2 command line for the Linux operating system
+in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
+then auditinng will be enabled for newly installed kernels.
+First check if the GRUB recovery is enabled:
+<pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
+If this option is set to true, then check that a line is output by the following command:
+<pre>$ grep 'GRUB_CMDLINE_LINUX_DEFAULT.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>
+If the recovery is disabled, check the line with
+<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
+{{%- if 'ubuntu' in product -%}}
+Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
+<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
+This command should not return any output.
+{{%- else -%}}
+Moreover, command line parameters for currently installed kernels should be checked as well.
+Run the following command:
+<pre># grubby --info=ALL | grep args | grep -v '{{{ arg_name_value }}}'</pre>
+The command should not return any output.
+{{%- endif -%}}
+{{%- else -%}}
+Inspect the form of default GRUB 2 command line for the Linux operating system
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then auditing
+is enabled at boot time.
+<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
+{{%- endif -%}}
+{{%- endmacro -%}}
From c8cb579db19bd55eebcb0bdc4b1432368a5c1b77 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 2 Feb 2022 14:26:26 +0100
Subject: [PATCH 2/8] use new macros in grub2_audit_argument
---
.../auditing/grub2_audit_argument/rule.yml | 45 ++-----------------
1 file changed, 3 insertions(+), 42 deletions(-)
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
index 96dbe67699e..aff0521ee73 100644
--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
@@ -7,15 +7,8 @@ title: 'Enable Auditing for Processes Which Start Prior to the Audit Daemon'
description: |-
To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <tt>audit=1</tt> to the default
- GRUB 2 command line for the Linux operating system in
-{{% if product in ["rhel7", "ol7"] %}}
- <tt>/etc/default/grub</tt>, so that the line looks similar to
- <pre>GRUB_CMDLINE_LINUX="... audit=1 ..."</pre>
- In case the <tt>GRUB_DISABLE_RECOVERY</tt> is set to true, then the parameter should be added to the <tt>GRUB_CMDLINE_LINUX_DEFAULT</tt> instead.
-{{% else %}}
- <tt>{{{ grub2_boot_path }}}/grubenv</tt>, in the manner below:
- <pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</pre>
-{{% endif %}}
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("audit=1") | indent(4) }}}
rationale: |-
Each process on the system carries an "auditable" flag which indicates whether
@@ -59,39 +52,7 @@ references:
ocil_clause: 'auditing is not enabled at boot time'
ocil: |-
-{{% if product in ["rhel7", "ol7", "sle12","sle15"] %}}
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If it includes <tt>audit=1</tt>, then auditing
- is enabled at boot time.
- First check if the GRUB recovery is enabled:
- <pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
- If this option is set to true, then check that a line is output by the following command:
- <pre>$ grep 'GRUB_CMDLINE_LINUX_DEFAULT.*audit=1.*' /etc/default/grub</pre>
- If the recovery is disabled, check the line with
- <pre>$ grep 'GRUB_CMDLINE_LINUX.*audit=1.*' /etc/default/grub</pre>.
- Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
- <pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v 'audit=1'</pre>
- This command should not return any output. If it does, update the configuration with
- <pre># grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
- <br /><br />
- Alternatively, to ensure <tt>audit=1</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="audit=1"</pre>
- <br />
-{{% else %}}
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>audit=1</tt>, then auditing
- is enabled at boot time.
- <pre># grep 'kernelopts.*audit=1.*' {{{ grub2_boot_path }}}/grubenv</pre>
- <br /><br />
- To ensure <tt>audit=1</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</pre>
- <br />
-{{% endif %}}
-
+ {{{ ocil_grub2_argument("audit=1") | indent(4) }}}
warnings:
- management: |-
From 3ff2c245408d3fe892222eee8171e2f84868f705 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 3 Feb 2022 14:25:34 +0100
Subject: [PATCH 3/8] fix omission in ocil jinja macro
---
shared/macros.jinja | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/shared/macros.jinja b/shared/macros.jinja
index 3d41c998b0c..16a0404b668 100644
--- a/shared/macros.jinja
+++ b/shared/macros.jinja
@@ -1652,7 +1652,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
Inspect the form of default GRUB 2 command line for the Linux operating system
in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
-then auditinng will be enabled for newly installed kernels.
+then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
<pre>$ grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
If this option is set to true, then check that a line is output by the following command:
@@ -1671,8 +1671,8 @@ The command should not return any output.
{{%- endif -%}}
{{%- else -%}}
Inspect the form of default GRUB 2 command line for the Linux operating system
-in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then auditing
-is enabled at boot time.
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
+is configured at boot time.
<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
{{%- endif -%}}
{{%- endmacro -%}}
From 976da69681d03d9b9380fc57216c30c7b4891f50 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 3 Feb 2022 14:26:33 +0100
Subject: [PATCH 4/8] use new jinja macros in all grub2 related rules
---
.../rule.yml | 15 ++-----
.../grub2_enable_iommu_force/rule.yml | 9 +++-
.../grub2_init_on_alloc_argument/rule.yml | 18 ++------
.../grub2_kernel_trust_cpu_rng/rule.yml | 11 ++---
.../grub2_pti_argument/rule.yml | 15 ++-----
.../grub2_vsyscall_argument/rule.yml | 15 ++-----
.../grub2_ipv6_disable_argument/rule.yml | 45 ++-----------------
.../grub2_page_poison_argument/rule.yml | 15 ++-----
.../grub2_slub_debug_argument/rule.yml | 15 ++-----
9 files changed, 33 insertions(+), 125 deletions(-)
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
index f94ddab2fe1..868d525014f 100644
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
@@ -7,9 +7,8 @@ title: 'Extend Audit Backlog Limit for the Audit Daemon'
description: |-
To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument <tt>audit_backlog_limit=8192</tt> to the default
- GRUB 2 command line for the Linux operating system in
- <tt>/etc/default/grub</tt>, in the manner below:
- <pre>GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192"</pre>
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
rationale: |-
audit_backlog_limit sets the queue length for audit events awaiting transfer
@@ -40,15 +39,7 @@ references:
ocil_clause: 'audit backlog limit is not configured'
ocil: |-
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If they include <tt>audit=1</tt>, then auditing
- is enabled at boot time.
- <br /><br />
- To ensure <tt>audit_backlog_limit=8192</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"</pre>
- <br />
+ {{{ ocil_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
warnings:
- management: |-
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
index 0a0d76aeb23..1ff5a4d5f26 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
@@ -5,9 +5,10 @@ title: 'IOMMU configuration directive'
description: |-
On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some
of the system critical units such as the memory.
+ {{{ describe_grub2_argument("iommu=force") | indent(4) }}}
rationale: |-
- On x86 architectures, activating the I/OMMU prevents the system from arbritrary accesses potentially made by
+ On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by
hardware devices.
severity: unknown
@@ -22,6 +23,12 @@ references:
platform: machine
+ocil_clause: 'I/OMMU is not activated'
+
+ocil: |-
+ {{{ ocil_grub2_argument("iommu=force") | indent(4) }}}
+
+
warnings:
- functionality:
Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities.
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
index a9253c74cc6..3bb645dadb7 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
@@ -6,12 +6,8 @@ title: 'Configure kernel to zero out memory before allocation'
description: |-
To configure the kernel to zero out memory before allocating it, add the
- <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line for
- the Linux operating system in <tt>/etc/default/grub</tt>, in the manner
- below:
- <pre>GRUB_CMDLINE_LINUX="crashkernel=auto quiet rd.shell=0 audit=1 audit_backlog_limit=8192 init_on_alloc=1"</pre>
- Update the boot parameter for existing kernels by running the following command:
- <pre># grubby --update-kernel=ALL --args="init_on_alloc=1"</pre>
+ <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line.
+ {{{ describe_grub2_argument("init_on_alloc=1") | indent(4) }}}
rationale: |-
When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
@@ -27,15 +23,7 @@ identifiers:
ocil_clause: 'the kernel is not configured to zero out memory before allocation'
ocil: |-
- Make sure that the kernel is configured to zero out memory before
- allocation. Ensure that the parameter is configured in
- <tt>/etc/default/grub</tt>:
- <pre>grep GRUB_CMDLINE_LINUX /etc/default/grub</pre>
- The output should contain <tt>init_on_alloc=1</tt>.
- Run the following command to display command line parameters of all
- installed kernels:
- <pre># grubby --info=ALL | grep args</pre>
- Ensure that each line contains the <tt>init_on_alloc=1</tt> parameter.
+ {{{ ocil_grub2_argument("init_on_alloc=1") | indent(4) }}}
platform: machine
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
index 308ae9cb735..d6bfc02f345 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml
@@ -11,8 +11,8 @@ description: |-
<tt>Y</tt>, make sure that it is not overridden with the boot parameter.
There must not exist the boot parameter <tt>random.trust_cpu=off</tt>. If
the option is not compiled in, make sure that <tt>random.trust_cpu=on</tt>
- is configured as a boot parameter by running the following command:
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) random.trust_cpu=on"</pre>
+ is configured as a boot parameter.
+ {{{ describe_grub2_argument("random.trust_cpu=on") | indent(4) }}}
rationale: |-
The Linux kernel offers an option which signifies if the kernel should trust
@@ -44,11 +44,8 @@ ocil: |-
option is not overridden through a boot parameter:
<pre>sudo grep 'kernelopts.*random\.trust_cpu=off.*' {{{ grub2_boot_path }}}/grubenv</pre>
The command should not return any output. If the option is not compiled into
- the kernel, check that the option is configured through boot parameter with
- the following command:
- <pre>sudo grep 'kernelopts.*random\.trust_cpu=on.*' {{{ grub2_boot_path }}}/grubenv</pre>
- If the command does not return any output, then the boot parameter is
- missing.
+ the kernel, check that the option is configured through boot parameter.
+ {{{ ocil_grub2_argument("random.trust_cpu=on") | indent(4) }}}
platform: machine
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
index f4f3fa39510..51b0a284746 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
@@ -7,9 +7,8 @@ title: 'Enable Kernel Page-Table Isolation (KPTI)'
description: |-
To enable Kernel page-table isolation,
add the argument <tt>pti=on</tt> to the default
- GRUB 2 command line for the Linux operating system in
- <tt>/etc/default/grub</tt>, in the manner below:
- <pre>GRUB_CMDLINE_LINUX="pti=on"</pre>
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("pti=on") | indent(4) }}}
rationale: |-
Kernel page-table isolation is a kernel feature that mitigates
@@ -33,15 +32,7 @@ references:
ocil_clause: 'Kernel page-table isolation is not enabled'
ocil: |-
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If they include <tt>pti=on</tt>,
- then Kernel page-table isolation is enabled at boot time.
- <br /><br />
- To ensure <tt>pti=on</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="pti=on</pre>
- <br />
+ {{{ ocil_grub2_argument("pti=on") | indent(4) }}}
warnings:
- management: |-
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
index 9f38a1c13b9..1b88d13bd3c 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
@@ -7,9 +7,8 @@ title: 'Disable vsyscalls'
description: |-
To disable use of virtual syscalls,
add the argument <tt>vsyscall=none</tt> to the default
- GRUB 2 command line for the Linux operating system in
- <tt>/etc/default/grub</tt>, in the manner below:
- <pre>GRUB_CMDLINE_LINUX="vsyscall=none"</pre>
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("vsyscall=none") | indent(4) }}}
rationale: |-
Virtual Syscalls provide an opportunity of attack for a user who has control
@@ -33,15 +32,7 @@ references:
ocil_clause: 'vsyscalls are enabled'
ocil: |-
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If they include <tt>vsyscall=none</tt>,
- then virtyal syscalls are not enabled at boot time.
- <br /><br />
- To ensure <tt>vsyscall=none</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="vsyscall=none</pre>
- <br />
+ {{{ ocil_grub2_argument("vsyscall=none") | indent(4) }}}
warnings:
- management: |-
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
index b8ff66c7d6e..c0fda343a1a 100644
--- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
@@ -7,20 +7,8 @@ title: 'Ensure IPv6 is disabled through kernel boot parameter'
description: |-
To disable IPv6 protocol support in the Linux kernel,
add the argument <tt>ipv6.disable=1</tt> to the default
- GRUB2 command line for the Linux operating system in
-{{% if product in ["rhel7", "ol7"] %}}
- <tt>/etc/default/grub</tt>, so that the line looks similar to
- <pre>GRUB_CMDLINE_LINUX="... ipv6.disable=1 ..."</pre>
- In case the <tt>GRUB_DISABLE_RECOVERY</tt> is set to true, then the parameter should be added to the <tt>GRUB_CMDLINE_LINUX_DEFAULT</tt> instead.
- Run one of following command to ensure that the configuration is applied when booting currently installed kernels:
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
- or
- <pre>sudo /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"</pre>
-{{% else %}}
- <tt>{{{ grub2_boot_path }}}/grubenv</tt>, in the manner below:
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</pre>
-{{% endif %}}
-
+ GRUB2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("ipv6.disable=1") | indent(4) }}}
rationale: |-
Any unnecessary network stacks, including IPv6, should be disabled to reduce
@@ -40,34 +28,7 @@ references:
ocil_clause: 'IPv6 is not disabled'
ocil: |-
- {{% if product in ["rhel7", "ol7"] %}}
- Inspect the form of default GRUB2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. Check if it includes <tt>ipv6.disable=1</tt>.
- First check if the GRUB recovery is enabled:
- <pre>grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub</pre>
- If this option is set to true, then check that the following line is output by the following command:
- <pre>grep 'GRUB_CMDLINE_LINUX_DEFAULT.*ipv6.disable=1.*' /etc/default/grub</pre>
- If the recovery is disabled, check the line with
- <pre>grep 'GRUB_CMDLINE_LINUX.*ipv6.disable=1.*' /etc/default/grub</pre>.
- Moreover, current GRUB2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
- <pre>sudo grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v 'ipv6.disable=1'</pre>
- This command should not return any output. If it does, update the configuration with one of following commands:
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>
- or
- <pre>sudo /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"</pre>
- <br />
-{{% else %}}
- Inspect the form of default GRUB2 command line for the Linux operating system
- in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. Check if it includes <tt>ipv6.disable=1</tt>.
- <pre>sudo grep 'kernelopts.*ipv6.disable=1.*' {{{ grub2_boot_path }}}/grubenv</pre>
- <br /><br />
- To ensure <tt>ipv6.disable=1</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</pre>
- <br />
-{{% endif %}}
-
+ {{{ ocil_grub2_argument("ipv6.disable=1") | indent(4) }}}
warnings:
- management: |-
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
index 3bf592fb4d8..1f4e183d9e7 100644
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
@@ -7,9 +7,8 @@ title: 'Enable page allocator poisoning'
description: |-
To enable poisoning of free pages,
add the argument <tt>page_poison=1</tt> to the default
- GRUB 2 command line for the Linux operating system in
- <tt>/etc/default/grub</tt>, in the manner below:
- <pre>GRUB_CMDLINE_LINUX="page_poison=1"</pre>
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("page_poison=1") | indent(4) }}}
rationale: |-
Poisoning writes an arbitrary value to freed pages, so any modification or
@@ -35,15 +34,7 @@ references:
ocil_clause: 'page allocator poisoning is not enabled'
ocil: |-
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If they include <tt>page_poison=1</tt>,
- then page poisoning is enabled at boot time.
- <br /><br />
- To ensure <tt>page_poison=1</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="page_poison=1</pre>
- <br />
+ {{{ ocil_grub2_argument("page_poison=1") | indent(4) }}}
warnings:
- management: |-
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
index 9964399650a..bb5dbc6c125 100644
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
@@ -7,9 +7,8 @@ title: 'Enable SLUB/SLAB allocator poisoning'
description: |-
To enable poisoning of SLUB/SLAB objects,
add the argument <tt>slub_debug=P</tt> to the default
- GRUB 2 command line for the Linux operating system in
- <tt>/etc/default/grub</tt>, in the manner below:
- <pre>GRUB_CMDLINE_LINUX="slub_debug=P"</pre>
+ GRUB 2 command line for the Linux operating system.
+ {{{ describe_grub2_argument("slub_debug=P") | indent(4) }}}
rationale: |-
Poisoning writes an arbitrary value to freed objects, so any modification or
@@ -35,15 +34,7 @@ references:
ocil_clause: 'SLUB/SLAB poisoning is not enabled'
ocil: |-
- Inspect the form of default GRUB 2 command line for the Linux operating system
- in <tt>/etc/default/grub</tt>. If they include <tt>slub_debug=P</tt>,
- then SLUB/SLAB poisoning is enabled at boot time.
- <br /><br />
- To ensure <tt>slub_debug=P</tt> is configured on all installed kernels, the
- following command may be used:
- <br />
- <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="slub_debug=P</pre>
- <br />
+ {{{ ocil_grub2_argument("slub_debug=P") | indent(4) }}}
warnings:
- management: |-
From 5c39cf81d49f0eb5bb73337057fb95356784e5c6 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 9 Feb 2022 16:05:59 +0100
Subject: [PATCH 5/8] fix an error in ubuntu version of macro
---
shared/macros.jinja | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shared/macros.jinja b/shared/macros.jinja
index 16a0404b668..54d2b299a47 100644
--- a/shared/macros.jinja
+++ b/shared/macros.jinja
@@ -1660,7 +1660,7 @@ If this option is set to true, then check that a line is output by the following
If the recovery is disabled, check the line with
<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
{{%- if 'ubuntu' in product -%}}
-Moreover, current Grub2 config file in <tt>/etc/grub2/grub.cfg</tt> must be checked.
+Moreover, current Grub2 config file in <tt>{{{ grub2_boot_path }}}/grub.cfg</tt> must be checked.
<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
This command should not return any output.
{{%- else -%}}
From f100d190833d168127715215e788347f806736f3 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 9 Feb 2022 16:16:21 +0100
Subject: [PATCH 6/8] remove warnings from rules
they are no longer relevant, we do not use grub2-mkconfig anymore
---
.../auditing/grub2_audit_argument/rule.yml | 18 ------------------
.../rule.yml | 18 ------------------
.../grub2_pti_argument/rule.yml | 18 ------------------
.../grub2_vsyscall_argument/rule.yml | 18 ------------------
.../grub2_ipv6_disable_argument/rule.yml | 18 ------------------
.../grub2_page_poison_argument/rule.yml | 18 ------------------
.../grub2_slub_debug_argument/rule.yml | 18 ------------------
7 files changed, 126 deletions(-)
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
index aff0521ee73..00a4ded2738 100644
--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
@@ -54,24 +54,6 @@ ocil_clause: 'auditing is not enabled at boot time'
ocil: |-
{{{ ocil_grub2_argument("audit=1") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: grub2
template:
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
index 868d525014f..efbc3dae1c1 100644
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
@@ -41,24 +41,6 @@ ocil_clause: 'audit backlog limit is not configured'
ocil: |-
{{{ ocil_grub2_argument("audit_backlog_limit=8192") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: grub2
template:
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
index 51b0a284746..52a308e3247 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml
@@ -34,24 +34,6 @@ ocil_clause: 'Kernel page-table isolation is not enabled'
ocil: |-
{{{ ocil_grub2_argument("pti=on") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel8", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: machine
template:
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
index 1b88d13bd3c..93eb31dad7b 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
@@ -34,24 +34,6 @@ ocil_clause: 'vsyscalls are enabled'
ocil: |-
{{{ ocil_grub2_argument("vsyscall=none") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: machine
template:
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
index c0fda343a1a..9e1ca48efe0 100644
--- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml
@@ -30,24 +30,6 @@ ocil_clause: 'IPv6 is not disabled'
ocil: |-
{{{ ocil_grub2_argument("ipv6.disable=1") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command:
- <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command:
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}}
- <pre>sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>sudo grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: grub2
template:
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
index 1f4e183d9e7..1ad6c6b3c44 100644
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
@@ -36,24 +36,6 @@ ocil_clause: 'page allocator poisoning is not enabled'
ocil: |-
{{{ ocil_grub2_argument("page_poison=1") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: grub2
template:
diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
index bb5dbc6c125..e40f5377c61 100644
--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
@@ -36,24 +36,6 @@ ocil_clause: 'SLUB/SLAB poisoning is not enabled'
ocil: |-
{{{ ocil_grub2_argument("slub_debug=P") | indent(4) }}}
-warnings:
- - management: |-
- The GRUB 2 configuration file, <tt>grub.cfg</tt>,
- is automatically updated each time a new kernel is installed. Note that any
- changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
- file. To update the GRUB 2 configuration file manually, use the
- <pre>grub2-mkconfig -o</pre> command as follows:
- <ul>
- <li>On BIOS-based machines, issue the following command as <tt>root</tt>:
- <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li>
- <li>On UEFI-based machines, issue the following command as <tt>root</tt>:
-{{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
-{{% else %}}
- <pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</pre></li>
-{{% endif %}}
- </ul>
-
platform: grub2
template:
From bbc3cc093004efd0457ccb33722a4fb14b0b2fb8 Mon Sep 17 00:00:00 2001
From: vojtapolasek <krecoun@gmail.com>
Date: Mon, 14 Feb 2022 14:29:15 +0100
Subject: [PATCH 7/8] Update shared/macros.jinja
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Matěj Týč <matej.tyc@gmail.com>
---
shared/macros.jinja | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/shared/macros.jinja b/shared/macros.jinja
index 54d2b299a47..392181e2b24 100644
--- a/shared/macros.jinja
+++ b/shared/macros.jinja
@@ -1671,7 +1671,12 @@ The command should not return any output.
{{%- endif -%}}
{{%- else -%}}
Inspect the form of default GRUB 2 command line for the Linux operating system
-in <tt>{{{ grub2_boot_path }}}/grubenv</tt>. If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
+{{% if grub2_boot_path == grub2_uefi_boot_path or not grub2_uefi_boot_path -%}}
+in <tt>{{{ grub2_boot_path }}}/grubenv</tt>.
+{{%- else -%}}
+in <tt>grubenv</tt> that can be found either in <tt>{{{ grub2_boot_path }}}</tt> in case of legacy BIOS systems, or in <tt>{{{ grub2_uefi_boot_path }}}</tt> in case of UEFI systems.
+{{%- endif %}}
+If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
is configured at boot time.
<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
{{%- endif -%}}
From 8121376668b43d21cf0f9700994bc011c3e313d7 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Mon, 14 Feb 2022 15:17:33 +0100
Subject: [PATCH 8/8] more modifications to description and ocil
final touches
---
shared/macros.jinja | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/shared/macros.jinja b/shared/macros.jinja
index 392181e2b24..a89bac12f53 100644
--- a/shared/macros.jinja
+++ b/shared/macros.jinja
@@ -1626,7 +1626,7 @@ The audit daemon must be restarted for the changes to take effect.
The parameter should be in form `parameter=value`.
#}}
{{%- macro describe_grub2_argument(arg_name_value) -%}}
-{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product -%}}
To ensure that <tt>{{{ arg_name_value }}}</tt> is added as a kernel command line
argument to newly installed kernels, ad <tt>{{{ arg_name_value }}}</tt> to the
default Grub2 command line for Linux operating systems. Modify the line within
@@ -1649,7 +1649,7 @@ Configure the default Grub2 kernel command line to contain {{{ arg_name_value }}
The parameter should have form `parameter=value`.
#}}
{{%- macro ocil_grub2_argument(arg_name_value) -%}}
-{{%- if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product -%}}
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product -%}}
Inspect the form of default GRUB 2 command line for the Linux operating system
in <tt>/etc/default/grub</tt>. If it includes <tt>{{{ arg_name_value }}}</tt>,
then the parameter will be configured for newly installed kernels.
@@ -1660,8 +1660,12 @@ If this option is set to true, then check that a line is output by the following
If the recovery is disabled, check the line with
<pre>$ grep 'GRUB_CMDLINE_LINUX.*{{{ arg_name_value }}}.*' /etc/default/grub</pre>.
{{%- if 'ubuntu' in product -%}}
-Moreover, current Grub2 config file in <tt>{{{ grub2_boot_path }}}/grub.cfg</tt> must be checked.
-<pre># grep vmlinuz {{{ grub2_boot_path }}}/grub.cfg | grep -v '{{{ arg_name_value }}}'</pre>
+Moreover, current Grub config file <tt>grub.cfg</tt> must be checked. The file can be found
+either in <tt>{{{ grub2_boot_path }}}</tt> in case of legacy BIOS systems, or in <tt>{{{ grub2_uefi_boot_path }}}</tt> in case of UEFI systems.
+If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
+is configured at boot time.
+<pre># grep vmlinuz GRUB_CFG_FILE_PATH | grep -v '{{{ arg_name_value }}}'</pre>
+Fill in <tt>GRUB_CFG_FILE_PATH</tt> based on information above.
This command should not return any output.
{{%- else -%}}
Moreover, command line parameters for currently installed kernels should be checked as well.
@@ -1678,6 +1682,7 @@ in <tt>grubenv</tt> that can be found either in <tt>{{{ grub2_boot_path }}}</tt>
{{%- endif %}}
If they include <tt>{{{ arg_name_value }}}</tt>, then the parameter
is configured at boot time.
-<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' {{{ grub2_boot_path }}}/grubenv</pre>
+<pre># grep 'kernelopts.*{{{ arg_name_value }}}.*' GRUBENV_FILE_LOCATION</pre>
+Fill in <tt>GRUBENV_FILE_LOCATION</tt> based on information above.
{{%- endif -%}}
{{%- endmacro -%}}

842
SOURCES/scap-security-guide-0.1.61-grub2_template_fix-PR_8180.patch Normal file
View File

@ -0,0 +1,842 @@
From 1bd88bbdc7ce8b6e2265f323cd3a777ef2240e6b Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Fri, 28 Jan 2022 17:11:56 +0100
Subject: [PATCH 1/5] Change the grub2 bootloader argument template
- Introduce the concept of product-specific bootloader config
properties that determine the check/remediation form.
- Expand the RHEL8 remediation with a check for update of
/etc/default/grub contents.
- Add a RHEL8 check that looks for kernelopts references in loader entries.
- Update tests.
---
.../grub2_entries_reference_kernelopts.xml | 25 +++++
.../ansible.template | 35 ++++++-
.../grub2_bootloader_argument/bash.template | 48 +++++++--
.../grub2_bootloader_argument/oval.template | 97 +++++++++++++------
.../arg_not_there_etcdefaultgrub.fail.sh | 2 +-
....fail.sh => arg_not_there_grubenv.fail.sh} | 0
6 files changed, 164 insertions(+), 43 deletions(-)
create mode 100644 shared/checks/oval/grub2_entries_reference_kernelopts.xml
rename shared/templates/grub2_bootloader_argument/tests/{arg_not_there.fail.sh => arg_not_there_grubenv.fail.sh} (100%)
diff --git a/shared/checks/oval/grub2_entries_reference_kernelopts.xml b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
new file mode 100644
index 00000000000..1aec9fe64d2
--- /dev/null
+++ b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="grub2_entries_reference_kernelopts" version="2">
+ {{{ oval_metadata(
+ "Ensure that grubenv-defined kernel options are referenced in individual boot loader entries",
+ title="Use $kernelopts in /boot/loader/entries/*.conf",
+ affected_platforms=["multi_platform_all"]) }}}
+ <criteria operator="AND">
+ <criterion test_ref="test_grub2_entries_reference_kernelopts"
+ comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable." />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test id="test_grub2_entries_reference_kernelopts"
+ comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable."
+ check="all" check_existence="all_exist" version="1">
+ <ind:object object_ref="object_grub2_entries_reference_kernelopts" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_grub2_entries_reference_kernelopts" version="1">
+ <ind:path>/boot/loader/entries/</ind:path>
+ <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
+ <ind:pattern operation="pattern match">^options .*\b\$kernelopts\b.*$</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
index 58d4fab69fa..de970879c8f 100644
--- a/shared/templates/grub2_bootloader_argument/ansible.template
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
@@ -4,7 +4,34 @@
# complexity = medium
# disruption = low
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
+{{#
+ See the OVAL template for more comments.
+ Product-specific categorization should be synced across all template content types
+-#}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_kernel_options_in_grubenv = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
+
+{{% if product in ["rhel9"] %}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel8"] %}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
+{{% set system_with_kernel_options_in_grubenv = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
+{{% endif -%}}
+
+{{% if system_with_kernel_options_in_etc_default_grub -%}}
- name: Check {{{ ARG_NAME }}} argument exists
command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
failed_when: False
@@ -27,7 +54,9 @@
- name: Update bootloader menu
command: /sbin/grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
-{{% else %}}
+{{%- endif %}}
+
+{{% if system_with_kernel_options_in_grubenv -%}}
- name: Get current kernel parameters
ansible.builtin.shell:
@@ -50,4 +79,4 @@
when:
- kernelopts.rc != 0
-{{% endif %}}
+{{%- endif %}}
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
index 631e686897e..817fd1fde23 100644
--- a/shared/templates/grub2_bootloader_argument/bash.template
+++ b/shared/templates/grub2_bootloader_argument/bash.template
@@ -1,6 +1,41 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
+{{#
+ See the OVAL template for more comments.
+ Product-specific categorization should be synced across all template content types
+-#}}
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_kernel_options_in_grubenv = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
+
+{{% if product in ["rhel9"] %}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel8"] %}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
+{{% set system_with_kernel_options_in_grubenv = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
+{{% endif -%}}
+
+{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
+{{% endif -%}}
+
+{{% macro update_etc_default_grub(arg_name_value) %}}
+{{% if 'ubuntu' in product %}}
+update-grub
+{{% else %}}
+grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"
+{{% endif %}}
+{{% endmacro -%}}
+
+{{% if system_with_kernel_options_in_etc_default_grub %}}
{{% if '/' in ARG_NAME %}}
{{{ raise("ARG_NAME (" + ARG_NAME + ") uses sed path separator (/) in " + rule_id) }}}
{{% elif '/' in ARG_NAME_VALUE %}}
@@ -14,14 +49,11 @@ else
# no {{{ ARG_NAME }}}=arg is present, append it
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
fi
-
-{{% if 'ubuntu' in product %}}
-update-grub
-{{% else %}}
-# Correct the form of kernel command line for each installed kernel in the bootloader
-grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
{{% endif %}}
-{{% else %}}
+
+{{{ update_etc_default_grub(ARG_NAME_VALUE) }}}
+
+{{% if system_with_kernel_options_in_grubenv -%}}
# Correct grub2 kernelopts value using grub2-editenv
existing_kernelopts="$(grub2-editenv - list | grep kernelopts)"
if ! printf '%s' "$existing_kernelopts" | grep -qE '^kernelopts=(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$'; then
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
index 3ea8acb2910..24258a3bcbd 100644
--- a/shared/templates/grub2_bootloader_argument/oval.template
+++ b/shared/templates/grub2_bootloader_argument/oval.template
@@ -1,15 +1,53 @@
+{{#-
+ We set defaults to "off", and products should enable relevant ones depending on how the product configures grub.
+ - /boot/loader/entries/* may not exist don't exist
+ - If they exist, they can reference variables defined in grubenv, or they can contain literal args
+ - The grub cfg may either use those loader entries, or it can contain literal values as well
+ - Kernel opts can be stored in /etc/default/grub so they are persistent between kernel upgrades
+-#}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
+{{% set system_with_kernel_options_in_grubenv = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
+
+{{% if product in ["rhel9"] -%}}
+{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
+{{%- endif -%}}
+
+{{% if product in ["rhel8"] -%}}
+{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
+{{% set system_with_kernel_options_in_grubenv = true %}}
+{{%- endif -%}}
+
+{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product -%}}
+{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
+{{%- endif -%}}
+
+{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
+{{% set system_with_kernel_options_in_etc_default_grub = true %}}
+{{%- endif -%}}
+
<def-group>
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
<criteria operator="AND">
- {{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
- {{% if product in ['rhel9'] %}}
+ {{% if system_with_kernel_options_in_grubenv -%}}
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
+ {{%- endif %}}
+ {{% if system_with_referenced_kernel_options_in_loader_entries -%}}
+ <extend_definition comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable" definition_ref="grub2_entries_reference_kernelopts" />
+ {{%- endif %}}
+ {{% if system_with_expanded_kernel_options_in_loader_entries -%}}
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_entries"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the /boot/loader/entries/*.conf" />
- {{% else %}}
+ {{%- endif %}}
+ {{% if system_with_expanded_kernel_options_in_grub_cfg -%}}
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_boot_path }}}/grub.cfg for all kernels" />
- {{% endif %}}
+ {{%- endif %}}
+ {{% if system_with_kernel_options_in_etc_default_grub -%}}
<criteria operator="OR">
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
comment="check for {{{ ARG_NAME_VALUE }}} in /etc/default/grub via GRUB_CMDLINE_LINUX" />
@@ -20,14 +58,11 @@
comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" />
</criteria>
</criteria>
- {{% else %}}
- <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
- comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
- {{% endif %}}
+ {{%- endif %}}
</criteria>
</definition>
-{{% if product in ["rhel7", "ol7", "rhel9"] or 'ubuntu' in product %}}
+{{%- if system_with_kernel_options_in_etc_default_grub %}}
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
comment="check for {{{ ARG_NAME_VALUE }}} in /etc/default/grub via GRUB_CMDLINE_LINUX"
check="all" check_existence="all_exist" version="1">
@@ -54,8 +89,25 @@
<ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
+{{%- endif %}}
+
+{{%- if system_with_kernel_options_in_grubenv %}}
+ <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
+ comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
+ check="all" check_existence="all_exist" version="1">
+ <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
+ <ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
+ </ind:textfilecontent54_test>
- {{% if product in ["rhel9"] %}}
+ <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
+ version="1">
+ <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
+ <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ </ind:textfilecontent54_object>
+{{%- endif %}}
+
+{{%- if system_with_expanded_kernel_options_in_loader_entries %}}
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_entries"
comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} for all boot entries."
check="all" check_existence="all_exist" version="1">
@@ -69,7 +121,9 @@
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
- {{% else %}}
+{{%- endif %}}
+
+{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
<ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grub.cfg for all kernels"
check="all" check_existence="all_exist" version="1">
@@ -87,26 +141,7 @@
{{% endif %}}
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
-
- {{% endif %}}
-
-{{% else %}}
-
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
- comment="check forkernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
- check="all" check_existence="all_exist" version="1">
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
- <ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
- version="1">
- <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
- <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
- </ind:textfilecontent54_object>
-
-{{% endif %}}
+{{%- endif %}}
<ind:textfilecontent54_state id="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
version="1">
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
index a56e6d09235..a270be45952 100644
--- a/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
+++ b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_etcdefaultgrub.fail.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 9
+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# Removes argument from kernel command line in /etc/default/grub
if grep -q '^GRUB_CMDLINE_LINUX=.*{{{ARG_NAME}}}=.*"' '/etc/default/grub' ; then
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_there.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_there_grubenv.fail.sh
similarity index 100%
rename from shared/templates/grub2_bootloader_argument/tests/arg_not_there.fail.sh
rename to shared/templates/grub2_bootloader_argument/tests/arg_not_there_grubenv.fail.sh
From 0d10bf751d5e1d7f024cd7301f8b02b38c0e3b9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Wed, 9 Feb 2022 11:19:06 +0100
Subject: [PATCH 2/5] Change the default product setting
Assume that every product stores kernel opts in the /etc/default/grub
---
shared/templates/grub2_bootloader_argument/ansible.template | 6 +-----
shared/templates/grub2_bootloader_argument/bash.template | 6 +-----
shared/templates/grub2_bootloader_argument/oval.template | 6 +-----
3 files changed, 3 insertions(+), 15 deletions(-)
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
index de970879c8f..46de9b465c2 100644
--- a/shared/templates/grub2_bootloader_argument/ansible.template
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
@@ -11,7 +11,7 @@
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
{{% set system_with_kernel_options_in_grubenv = false -%}}
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
{{% if product in ["rhel9"] %}}
@@ -27,10 +27,6 @@
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
{{% endif -%}}
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
-{{% endif -%}}
-
{{% if system_with_kernel_options_in_etc_default_grub -%}}
- name: Check {{{ ARG_NAME }}} argument exists
command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
index 817fd1fde23..b188d1e3689 100644
--- a/shared/templates/grub2_bootloader_argument/bash.template
+++ b/shared/templates/grub2_bootloader_argument/bash.template
@@ -7,7 +7,7 @@
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
{{% set system_with_kernel_options_in_grubenv = false -%}}
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
{{% if product in ["rhel9"] %}}
@@ -23,10 +23,6 @@
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
{{% endif -%}}
-{{% if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
-{{% endif -%}}
-
{{% macro update_etc_default_grub(arg_name_value) %}}
{{% if 'ubuntu' in product %}}
update-grub
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
index 24258a3bcbd..88fa7b7a3ee 100644
--- a/shared/templates/grub2_bootloader_argument/oval.template
+++ b/shared/templates/grub2_bootloader_argument/oval.template
@@ -8,7 +8,7 @@
{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
{{% set system_with_kernel_options_in_grubenv = false -%}}
-{{% set system_with_kernel_options_in_etc_default_grub = false -%}}
+{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
{{% if product in ["rhel9"] -%}}
@@ -24,10 +24,6 @@
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
{{%- endif -%}}
-{{%- if product in ["rhel7", "ol7", "rhel8", "ol8", "rhel9"] or 'ubuntu' in product %}}
-{{% set system_with_kernel_options_in_etc_default_grub = true %}}
-{{%- endif -%}}
-
<def-group>
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
From fac0aeb351d7acab1112482d11a0be73df662496 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Fri, 11 Feb 2022 14:55:53 +0100
Subject: [PATCH 3/5] Improve the template further
- Fix the $kernelopts regex - $ is not a word char.
- Use grubby exclusively on RHEL systems and structure remediations differently than OVAL checks
- Exclude the rescue.conf loader entry from checks, as it is not a boot entry for general use.
---
.../grub2_entries_reference_kernelopts.xml | 2 +-
.../ansible.template | 72 +------------------
.../grub2_bootloader_argument/bash.template | 67 +++++------------
.../grub2_bootloader_argument/oval.template | 7 +-
.../tests/invalid_rescue.pass.sh | 6 ++
tests/test_rule_in_container.sh | 2 +-
6 files changed, 33 insertions(+), 123 deletions(-)
create mode 100644 shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
diff --git a/shared/checks/oval/grub2_entries_reference_kernelopts.xml b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
index 1aec9fe64d2..30f3965a037 100644
--- a/shared/checks/oval/grub2_entries_reference_kernelopts.xml
+++ b/shared/checks/oval/grub2_entries_reference_kernelopts.xml
@@ -19,7 +19,7 @@
<ind:textfilecontent54_object id="object_grub2_entries_reference_kernelopts" version="1">
<ind:path>/boot/loader/entries/</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
- <ind:pattern operation="pattern match">^options .*\b\$kernelopts\b.*$</ind:pattern>
+ <ind:pattern operation="pattern match">^options(?:\s+.*)?\s+\$kernelopts\b.*$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
index 46de9b465c2..db3b4430d4b 100644
--- a/shared/templates/grub2_bootloader_argument/ansible.template
+++ b/shared/templates/grub2_bootloader_argument/ansible.template
@@ -4,75 +4,5 @@
# complexity = medium
# disruption = low
-{{#
- See the OVAL template for more comments.
- Product-specific categorization should be synced across all template content types
--#}}
-{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
-{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
-{{% set system_with_kernel_options_in_grubenv = false -%}}
-{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
-{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
-
-{{% if product in ["rhel9"] %}}
-{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
-{{% endif -%}}
-
-{{% if product in ["rhel8"] %}}
-{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
-{{% set system_with_kernel_options_in_grubenv = true %}}
-{{% endif -%}}
-
-{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
-{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
-{{% endif -%}}
-
-{{% if system_with_kernel_options_in_etc_default_grub -%}}
-- name: Check {{{ ARG_NAME }}} argument exists
- command: grep 'GRUB_CMDLINE_LINUX.*{{{ ARG_NAME }}}=' /etc/default/grub
- failed_when: False
- register: argcheck
-
-- name: Replace existing {{{ ARG_NAME }}} argument
- replace:
- path: /etc/default/grub
- regexp: '{{{ ARG_NAME }}}=\w+'
- replace: '{{{ ARG_NAME_VALUE }}}'
- when: argcheck.rc == 0
-
-- name: Add {{{ ARG_NAME }}} argument
- replace:
- path: /etc/default/grub
- regexp: '(GRUB_CMDLINE_LINUX=.*)"'
- replace: '\1 {{{ ARG_NAME_VALUE }}}"'
- when: argcheck.rc != 0
-
-- name: Update bootloader menu
+- name: Update grub defaults and the bootloader menu
command: /sbin/grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
-
-{{%- endif %}}
-
-{{% if system_with_kernel_options_in_grubenv -%}}
-
-- name: Get current kernel parameters
- ansible.builtin.shell:
- cmd: '/usr/bin/grub2-editenv - list | grep "kernelopts="'
- register: kernelopts
- ignore_errors: yes
- changed_when: False
-
-- name: Update the bootloader menu
- command: /usr/bin/grub2-editenv - set "{{ item }} {{{ ARG_NAME_VALUE }}}"
- with_items: "{{ kernelopts.stdout_lines | select('match', '^kernelopts.*') | list }}"
- when:
- - kernelopts.rc == 0
- - kernelopts.stdout_lines is defined
- - kernelopts.stdout_lines | length > 0
- - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?{{{ ARG_NAME_VALUE }}}(?:\s.*)?$', multiline=True) is none
-
-- name: Update the bootloader menu when there are no entries previously set
- command: /usr/bin/grub2-editenv - set "kernelopts={{{ ARG_NAME_VALUE }}}"
- when:
- - kernelopts.rc != 0
-
-{{%- endif %}}
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
index b188d1e3689..5f97efd498f 100644
--- a/shared/templates/grub2_bootloader_argument/bash.template
+++ b/shared/templates/grub2_bootloader_argument/bash.template
@@ -4,59 +4,28 @@
Product-specific categorization should be synced across all template content types
-#}}
-{{% set system_with_expanded_kernel_options_in_loader_entries = false -%}}
-{{% set system_with_referenced_kernel_options_in_loader_entries = false -%}}
-{{% set system_with_kernel_options_in_grubenv = false -%}}
-{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
-{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
+{{% set grub_helper_executable = "grubby" -%}}
+{{% set grub_helper_args = ["--update-kernel=ALL", "--args=" ~ ARG_NAME_VALUE] -%}}
-{{% if product in ["rhel9"] %}}
-{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
-{{% endif -%}}
-
-{{% if product in ["rhel8"] %}}
-{{% set system_with_referenced_kernel_options_in_loader_entries = true %}}
-{{% set system_with_kernel_options_in_grubenv = true %}}
-{{% endif -%}}
-
-{{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}}
-{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
-{{% endif -%}}
-
-{{% macro update_etc_default_grub(arg_name_value) %}}
-{{% if 'ubuntu' in product %}}
-update-grub
-{{% else %}}
-grubby --update-kernel=ALL --args="{{{ arg_name_value }}}"
-{{% endif %}}
-{{% endmacro -%}}
-
-{{% if system_with_kernel_options_in_etc_default_grub %}}
-{{% if '/' in ARG_NAME %}}
-{{{ raise("ARG_NAME (" + ARG_NAME + ") uses sed path separator (/) in " + rule_id) }}}
-{{% elif '/' in ARG_NAME_VALUE %}}
-{{{ raise("ARG_NAME_VALUE (" + ARG_NAME_VALUE + ") uses sed path separator (/) in " + rule_id) }}}
-{{% endif %}}
+{{%- macro update_etc_default_grub_manually() -%}}
# Correct the form of default kernel command line in GRUB
if grep -q '^GRUB_CMDLINE_LINUX=.*{{{ ARG_NAME }}}=.*"' '/etc/default/grub' ; then
- # modify the GRUB command-line if an {{{ ARG_NAME }}}= arg already exists
- sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\){{{ ARG_NAME }}}=[^[:space:]]*\(.*"\)/\1 {{{ ARG_NAME_VALUE }}} \2/' '/etc/default/grub'
+ # modify the GRUB command-line if an {{{ ARG_NAME }}}= arg already exists
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\){{{ ARG_NAME }}}=[^[:space:]]*\(.*"\)/\1 {{{ ARG_NAME_VALUE }}} \2/' '/etc/default/grub'
else
- # no {{{ ARG_NAME }}}=arg is present, append it
- sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
+ # no {{{ ARG_NAME }}}=arg is present, append it
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 {{{ ARG_NAME_VALUE }}}"/' '/etc/default/grub'
fi
-{{% endif %}}
+{{%- endmacro %}}
+
+{{% if 'ubuntu' in product %}}
+{{{ update_etc_default_grub_manually() }}}
+{{% set grub_helper_executable = "update-grub" -%}}
+{{% endif -%}}
-{{{ update_etc_default_grub(ARG_NAME_VALUE) }}}
+{{% if product in ["rhel8", "ol8"] %}}
+{{# Suppress the None output of append -#}}
+{{{ grub_helper_args.append("--env=/boot/grub2/grubenv") or "" -}}}
+{{% endif -%}}
-{{% if system_with_kernel_options_in_grubenv -%}}
-# Correct grub2 kernelopts value using grub2-editenv
-existing_kernelopts="$(grub2-editenv - list | grep kernelopts)"
-if ! printf '%s' "$existing_kernelopts" | grep -qE '^kernelopts=(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$'; then
- if test -n "$existing_kernelopts"; then
- grub2-editenv - set "$existing_kernelopts {{{ ARG_NAME_VALUE }}}"
- else
- grub2-editenv - set "kernelopts={{{ ARG_NAME_VALUE }}}"
- fi
-fi
-{{% endif %}}
+{{{ grub_helper_executable }}} {{{ " ".join(grub_helper_args) }}}
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
index 88fa7b7a3ee..6981cc14045 100644
--- a/shared/templates/grub2_bootloader_argument/oval.template
+++ b/shared/templates/grub2_bootloader_argument/oval.template
@@ -1,6 +1,6 @@
{{#-
We set defaults to "off", and products should enable relevant ones depending on how the product configures grub.
- - /boot/loader/entries/* may not exist don't exist
+ - /boot/loader/entries/* may not exist.
- If they exist, they can reference variables defined in grubenv, or they can contain literal args
- The grub cfg may either use those loader entries, or it can contain literal values as well
- Kernel opts can be stored in /etc/default/grub so they are persistent between kernel upgrades
@@ -116,7 +116,12 @@
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ <filter action="exclude">state_grub2_rescue_entry_for_{{{ _RULE_ID }}}</filter>
</ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_grub2_rescue_entry_for_{{{ _RULE_ID }}}" version="1">
+ <ind:filename>rescue.conf</ind:filename>
+ </ind:textfilecontent54_state>
{{%- endif %}}
{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh b/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
new file mode 100644
index 00000000000..ee6e2c67f34
--- /dev/null
+++ b/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
@@ -0,0 +1,6 @@
+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 9
+# packages = grub2,grubby
+
+{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME_VALUE) }}}
+
+echo "I am an invalid boot entry, but nobody should care, because I am rescue" > /boot/loader/entries/trololol-rescue.conf
diff --git a/tests/test_rule_in_container.sh b/tests/test_rule_in_container.sh
index 395fc4e856c..a8691ca7463 100755
--- a/tests/test_rule_in_container.sh
+++ b/tests/test_rule_in_container.sh
@@ -221,7 +221,7 @@ additional_args=()
test "$_arg_dontclean" = on && additional_args+=(--dontclean)
# Don't act on the default value.
-test -n "$_arg_scenarios" && additional_args+=(--scenario "'$_arg_scenarios'")
+test -n "$_arg_scenarios" && additional_args+=(--scenario "$_arg_scenarios")
test -n "$_arg_datastream" && additional_args+=(--datastream "$_arg_datastream")
From 8dda6030dea885c7c7e7e8f1024f5f2edf5bc36c Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Mon, 14 Feb 2022 13:45:09 +0100
Subject: [PATCH 4/5] Add support for checks of both BIOS/UEFI systems
---
.../grub2_bootloader_argument/oval.template | 57 +++++++++++++++----
1 file changed, 46 insertions(+), 11 deletions(-)
diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template
index 6981cc14045..71367465663 100644
--- a/shared/templates/grub2_bootloader_argument/oval.template
+++ b/shared/templates/grub2_bootloader_argument/oval.template
@@ -10,6 +10,7 @@
{{% set system_with_kernel_options_in_grubenv = false -%}}
{{% set system_with_kernel_options_in_etc_default_grub = true -%}}
{{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}}
+{{% set system_with_bios_and_uefi_support = false -%}}
{{% if product in ["rhel9"] -%}}
{{% set system_with_expanded_kernel_options_in_loader_entries = true %}}
@@ -24,13 +25,25 @@
{{% set system_with_expanded_kernel_options_in_grub_cfg = true %}}
{{%- endif -%}}
+{{% if grub2_uefi_boot_path and grub2_uefi_boot_path != grub2_boot_path -%}}
+{{% set system_with_bios_and_uefi_support = true %}}
+{{%- endif -%}}
+
<def-group>
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
{{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}}
<criteria operator="AND">
{{% if system_with_kernel_options_in_grubenv -%}}
+ {{% if system_with_bios_and_uefi_support -%}}
+ <criteria operator="OR">
+ {{%- endif %}}
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_boot_path }}}/grubenv" />
+ {{% if system_with_bios_and_uefi_support -%}}
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env_uefi"
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the GRUB2 environment variable block in {{{ grub2_uefi_boot_path }}}/grubenv" />
+ </criteria>
+ {{%- endif %}}
{{%- endif %}}
{{% if system_with_referenced_kernel_options_in_loader_entries -%}}
<extend_definition comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable" definition_ref="grub2_entries_reference_kernelopts" />
@@ -40,8 +53,16 @@
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the /boot/loader/entries/*.conf" />
{{%- endif %}}
{{% if system_with_expanded_kernel_options_in_grub_cfg -%}}
+ {{% if system_with_bios_and_uefi_support -%}}
+ <criteria operator="OR">
+ {{%- endif %}}
<criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_boot_path }}}/grub.cfg for all kernels" />
+ {{% if system_with_bios_and_uefi_support -%}}
+ <criterion test_ref="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg_uefi"
+ comment="Check if {{{ ARG_NAME_VALUE }}} is present in the boot parameters in the {{{ grub2_uefi_boot_path }}}/grub.cfg for all kernels" />
+ </criteria>
+ {{%- endif %}}
{{%- endif %}}
{{% if system_with_kernel_options_in_etc_default_grub -%}}
<criteria operator="OR">
@@ -88,19 +109,26 @@
{{%- endif %}}
{{%- if system_with_kernel_options_in_grubenv %}}
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
- comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grubenv for all kernels"
+{{%- macro test_and_object_for_kernel_options_grub_env(base_name, path) %}}
+ <ind:textfilecontent54_test id="test_{{{ base_name }}}"
+ comment="check for kernel command line parameters {{{ ARG_NAME_VALUE }}} in {{{ path }}} for all kernels"
check="all" check_existence="all_exist" version="1">
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env" />
+ <ind:object object_ref="object_{{{ base_name }}}" />
<ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_env"
+ <ind:textfilecontent54_object id="object_{{{ base_name }}}"
version="1">
- <ind:filepath>{{{ grub2_boot_path }}}/grubenv</ind:filepath>
+ <ind:filepath>{{{ path }}}</ind:filepath>
<ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
+{{%- endmacro %}}
+
+{{{ test_and_object_for_kernel_options_grub_env("grub2_" ~ SANITIZED_ARG_NAME ~ "_argument_grub_env", grub2_boot_path ~ "/grubenv") }}}
+{{% if system_with_bios_and_uefi_support -%}}
+{{{ test_and_object_for_kernel_options_grub_env("grub2_" ~ SANITIZED_ARG_NAME ~ "_argument_grub_env_uefi", grub2_uefi_boot_path ~ "/grubenv") }}}
+{{%- endif %}}
{{%- endif %}}
{{%- if system_with_expanded_kernel_options_in_loader_entries %}}
@@ -120,21 +148,22 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_grub2_rescue_entry_for_{{{ _RULE_ID }}}" version="1">
- <ind:filename>rescue.conf</ind:filename>
+ <ind:filename operation="pattern match">.*rescue.conf$</ind:filename>
</ind:textfilecontent54_state>
{{%- endif %}}
{{%- if system_with_expanded_kernel_options_in_grub_cfg %}}
- <ind:textfilecontent54_test id="test_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
- comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ grub2_boot_path }}}/grub.cfg for all kernels"
+{{%- macro test_and_object_for_kernel_options_grub_cfg(base_name, path) %}}
+ <ind:textfilecontent54_test id="test_{{{ base_name }}}"
+ comment="check kernel command line parameters for {{{ ARG_NAME_VALUE }}} in {{{ path }}} for all kernels"
check="all" check_existence="all_exist" version="1">
- <ind:object object_ref="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg" />
+ <ind:object object_ref="object_{{{ base_name }}}" />
<ind:state state_ref="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_grub2_{{{ SANITIZED_ARG_NAME }}}_argument_grub_cfg"
+ <ind:textfilecontent54_object id="object_{{{ base_name }}}"
version="1">
- <ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
+ <ind:filepath>{{{ path }}}</ind:filepath>
{{% if product in ["rhel7"] or 'ubuntu' in product %}}
<ind:pattern operation="pattern match">^.*/vmlinuz.*(root=.*)$</ind:pattern>
{{% else %}}
@@ -142,6 +171,12 @@
{{% endif %}}
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
+{{%- endmacro %}}
+
+{{{ test_and_object_for_kernel_options_grub_cfg("grub2_" + SANITIZED_ARG_NAME + "_argument_grub_cfg", grub2_boot_path ~ "/grub.cfg") }}}
+{{% if system_with_bios_and_uefi_support -%}}
+{{{ test_and_object_for_kernel_options_grub_cfg("grub2_" + SANITIZED_ARG_NAME + "_argument_grub_cfg_uefi", grub2_uefi_boot_path ~ "/grub.cfg") }}}
+{{%- endif %}}
{{%- endif %}}
<ind:textfilecontent54_state id="state_grub2_{{{ SANITIZED_ARG_NAME }}}_argument"
From df44b5d7017328d05c0671397edcfed019a2a448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Mon, 14 Feb 2022 14:49:34 +0100
Subject: [PATCH 5/5] Correct test scenario metadata
- Grubenv doesn't relate to anything else than RHEL8
- The grubby remediation has different behavior in corner-cases
that are technically unsupported, so the corresponding test scenario has been dropped.
---
.../grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh | 1 +
.../auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh b/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
index 5af2acc317e..956c8ac79fd 100644
--- a/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/tests/blank_grubenv_rhel8.fail.sh
@@ -1,6 +1,7 @@
#!/bin/bash
# platform = Red Hat Enterprise Linux 8
+# remediation = none
# Removes audit argument from kernel command line in /boot/grub2/grubenv
file="/boot/grub2/grubenv"
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh b/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
index 0ec9a1d6e38..9823b08dff9 100644
--- a/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/tests/correct_grubenv.pass.sh
@@ -1,4 +1,4 @@
#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
+# platform = Red Hat Enterprise Linux 8
grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"

855
SOURCES/scap-security-guide-0.1.61-pwquality-PR_8185.patch Normal file
View File

@ -0,0 +1,855 @@
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml
new file mode 100644
index 00000000000..b44c91cbf4a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/ansible/shared.yml
@@ -0,0 +1,150 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = medium
+
+- name: Check for existing pam_pwquality.so entry
+ ansible.builtin.lineinfile:
+ path: "/etc/pam.d/password-auth"
+ create: no
+ regexp: '^password.*pam_pwquality.so.*'
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: result_pam_pwquality_present
+
+- name: Check if system relies on authselect
+ ansible.builtin.stat:
+ path: /usr/bin/authselect
+ register: result_authselect_present
+
+- name: "Remediation where authselect tool is present"
+ block:
+ - name: Check the integrity of the current authselect profile
+ ansible.builtin.command:
+ cmd: authselect check
+ register: result_authselect_check_cmd
+ changed_when: false
+ ignore_errors: true
+
+ - name: Informative message based on the authselect integrity check result
+ ansible.builtin.assert:
+ that:
+ - result_authselect_check_cmd is success
+ fail_msg:
+ - authselect integrity check failed. Remediation aborted!
+ - This remediation could not be applied because the authselect profile is not intact.
+ - It is not recommended to manually edit the PAM files when authselect is available.
+ - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
+ success_msg:
+ - authselect integrity check passed
+
+ - name: Get authselect current profile
+ ansible.builtin.shell:
+ cmd: authselect current -r | awk '{ print $1 }'
+ register: result_authselect_profile
+ changed_when: false
+ when:
+ - result_authselect_check_cmd is success
+
+ - name: Define the current authselect profile as a local fact
+ ansible.builtin.set_fact:
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
+ authselect_custom_profile: "{{ result_authselect_profile.stdout }}"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_profile.stdout is match("custom/")
+
+ - name: Define the new authselect custom profile as a local fact
+ ansible.builtin.set_fact:
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
+ authselect_custom_profile: "custom/hardening"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_profile.stdout is not match("custom/")
+
+ - name: Get authselect current features to also enable them in the custom profile
+ ansible.builtin.shell:
+ cmd: authselect current | tail -n+3 | awk '{ print $2 }'
+ register: result_authselect_features
+ changed_when: false
+ when:
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+
+ - name: Check if any custom profile with the same name was already created in the past
+ ansible.builtin.stat:
+ path: /etc/authselect/{{ authselect_custom_profile }}
+ register: result_authselect_custom_profile_present
+ changed_when: false
+ when:
+ - authselect_current_profile is not match("custom/")
+
+ - name: Create a custom profile based on the current profile
+ ansible.builtin.command:
+ cmd: authselect create-profile hardening -b sssd
+ when:
+ - result_authselect_check_cmd is success
+ - authselect_current_profile is not match("custom/")
+ - not result_authselect_custom_profile_present.stat.exists
+
+ - name: Ensure the desired configuration is present in the custom profile
+ ansible.builtin.lineinfile:
+ dest: "/etc/authselect/{{ authselect_custom_profile }}/password-auth"
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
+ line: "password requisite pam_pwquality.so"
+ when:
+ - result_authselect_profile is not skipped
+ - result_pam_pwquality_present.found == 0
+
+ - name: Ensure a backup of current authselect profile before selecting the custom profile
+ ansible.builtin.command:
+ cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
+ register: result_authselect_backup
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+ - authselect_custom_profile is not match(authselect_current_profile)
+
+ - name: Ensure the custom profile is selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} --force
+ register: result_pam_authselect_select_profile
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+ - authselect_custom_profile is not match(authselect_current_profile)
+
+ - name: Restore the authselect features in the custom profile
+ ansible.builtin.command:
+ cmd: authselect enable-feature {{ item }}
+ loop: "{{ result_authselect_features.stdout_lines }}"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_features is not skipped
+ - result_pam_authselect_select_profile is not skipped
+
+ - name: Ensure the custom profile changes are applied
+ ansible.builtin.command:
+ cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ when:
+ - result_authselect_present.stat.exists
+
+# For systems without authselect
+- name: "Remediation where authselect tool is not present and PAM files are directly edited"
+ block:
+ - name: Ensure the desired configuration is present in the custom profile
+ ansible.builtin.lineinfile:
+ dest: "/etc/pam.d/password-auth"
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
+ line: "password requisite pam_pwquality.so"
+ when:
+ - result_pam_pwquality_present.found == 0
+ when:
+ - not result_authselect_present.stat.exists
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh
new file mode 100644
index 00000000000..d2fca2a79ca
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/bash/shared.sh
@@ -0,0 +1,41 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+
+PAM_FILE="password-auth"
+
+if [ -f /usr/bin/authselect ]; then
+ if authselect check; then
+ CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
+ # Standard profiles delivered with authselect should not be modified.
+ # If not already in use, a custom profile is created preserving the enabled features.
+ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
+ ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+ authselect create-profile hardening -b $CURRENT_PROFILE
+ CURRENT_PROFILE="custom/hardening"
+ # Ensure a backup before changing the profile
+ authselect apply-changes -b --backup=before-pwquality-hardening.backup
+ authselect select $CURRENT_PROFILE
+ for feature in $ENABLED_FEATURES; do
+ authselect enable-feature $feature;
+ done
+ fi
+ # Include the desired configuration in the custom profile
+ CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
+ # The line should be included on the top password section
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_FILE) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_FILE
+ fi
+ authselect apply-changes -b --backup=after-pwquality-hardening.backup
+ else
+ echo "
+authselect integrity check failed. Remediation aborted!
+This remediation could not be applied because the authselect profile is not intact.
+It is not recommended to manually edit the PAM files when authselect is available.
+In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
+ false
+ fi
+else
+ FILE_PATH="/etc/pam.d/$PAM_FILE"
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $FILE_PATH) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $FILE_PATH
+ fi
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml
new file mode 100644
index 00000000000..84f32456beb
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/oval/shared.xml
@@ -0,0 +1,21 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("The PAM module pam_pwquality is used in password-auth") }}}
+ <criteria comment="Condition for pam_pwquality in password-auth is satisfied">
+ <criterion comment="pam_pwquality password-auth"
+ test_ref="test_accounts_password_pam_pwquality_password_auth"/>
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_object id="object_accounts_password_pam_pwquality_password_auth" version="1">
+ <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+ <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
+ <ind:instance datatype="int" operation="equals">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1"
+ id="test_accounts_password_pam_pwquality_password_auth"
+ comment="check the configuration of /etc/pam.d/password-auth">
+ <ind:object object_ref="object_accounts_password_pam_pwquality_password_auth"/>
+ </ind:textfilecontent54_test>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
new file mode 100644
index 00000000000..6c7bb1ad7a0
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/rule.yml
@@ -0,0 +1,35 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
+
+title: 'Ensure PAM password complexity module is enabled in password-auth'
+
+description: |-
+ To enable PAM password complexity in password-auth file:
+ Edit the <tt>password</tt> section in
+ <tt>/etc/pam.d/password-auth</tt> to show
+ <tt>password requisite pam_pwquality.so</tt>.
+
+rationale: |-
+ Enabling PAM password complexity permits to enforce strong passwords and consequently
+ makes the system less prone to dictionary attacks.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-85876-1
+ cce@rhel8: CCE-85877-9
+ cce@rhel9: CCE-85878-7
+
+references:
+ stigid@rhel8: RHEL-08-020100
+
+ocil_clause: 'pam_pwquality.so is not enabled in password-auth'
+
+ocil: |-
+ To check if pam_pwhistory.so is enabled in password-auth, run the following command:
+ <pre>$ grep pam_pwquality /etc/pam.d/password-auth</pre></pre>
+ The output should be similar to the following:
+ <pre>password requisite pam_pwquality.so</pre>
+
+platform: pam
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh
new file mode 100644
index 00000000000..3d696c36b76
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_commented_entry.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $CUSTOM_SYSTEM_AUTH
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh
new file mode 100644
index 00000000000..0435899262b
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_correct_entry.pass.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_SYSTEM_AUTH) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_SYSTEM_AUTH
+fi
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh
new file mode 100644
index 00000000000..472616a51f6
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_missing_entry.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/password-auth"
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $CUSTOM_SYSTEM_AUTH
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh
new file mode 100644
index 00000000000..59f9d6f77c4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/authselect_modified_pam.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+# remediation = none
+
+SYSTEM_AUTH_FILE="/etc/pam.d/password-auth"
+
+# This modification will break the integrity checks done by authselect.
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $SYSTEM_AUTH_FILE
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh
new file mode 100644
index 00000000000..71f87b19045
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/correct_entry.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = pam
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
+
+config_file=/etc/pam.d/password-auth
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $config_file) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $config_file
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh
new file mode 100644
index 00000000000..95b73b24d26
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_password_auth/tests/missing_entry.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
+# packages = pam
+
+config_file=/etc/pam.d/password-auth
+
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $config_file
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml
new file mode 100644
index 00000000000..13cd20458ed
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/ansible/shared.yml
@@ -0,0 +1,150 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = medium
+
+- name: Check for existing pam_pwquality.so entry
+ ansible.builtin.lineinfile:
+ path: "/etc/pam.d/system-auth"
+ create: no
+ regexp: '^password.*pam_pwquality.so.*'
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: result_pam_pwquality_present
+
+- name: Check if system relies on authselect
+ ansible.builtin.stat:
+ path: /usr/bin/authselect
+ register: result_authselect_present
+
+- name: "Remediation where authselect tool is present"
+ block:
+ - name: Check the integrity of the current authselect profile
+ ansible.builtin.command:
+ cmd: authselect check
+ register: result_authselect_check_cmd
+ changed_when: false
+ ignore_errors: true
+
+ - name: Informative message based on the authselect integrity check result
+ ansible.builtin.assert:
+ that:
+ - result_authselect_check_cmd is success
+ fail_msg:
+ - authselect integrity check failed. Remediation aborted!
+ - This remediation could not be applied because the authselect profile is not intact.
+ - It is not recommended to manually edit the PAM files when authselect is available.
+ - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
+ success_msg:
+ - authselect integrity check passed
+
+ - name: Get authselect current profile
+ ansible.builtin.shell:
+ cmd: authselect current -r | awk '{ print $1 }'
+ register: result_authselect_profile
+ changed_when: false
+ when:
+ - result_authselect_check_cmd is success
+
+ - name: Define the current authselect profile as a local fact
+ ansible.builtin.set_fact:
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
+ authselect_custom_profile: "{{ result_authselect_profile.stdout }}"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_profile.stdout is match("custom/")
+
+ - name: Define the new authselect custom profile as a local fact
+ ansible.builtin.set_fact:
+ authselect_current_profile: "{{ result_authselect_profile.stdout }}"
+ authselect_custom_profile: "custom/hardening"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_profile.stdout is not match("custom/")
+
+ - name: Get authselect current features to also enable them in the custom profile
+ ansible.builtin.shell:
+ cmd: authselect current | tail -n+3 | awk '{ print $2 }'
+ register: result_authselect_features
+ changed_when: false
+ when:
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+
+ - name: Check if any custom profile with the same name was already created in the past
+ ansible.builtin.stat:
+ path: /etc/authselect/{{ authselect_custom_profile }}
+ register: result_authselect_custom_profile_present
+ changed_when: false
+ when:
+ - authselect_current_profile is not match("custom/")
+
+ - name: Create a custom profile based on the current profile
+ ansible.builtin.command:
+ cmd: authselect create-profile hardening -b sssd
+ when:
+ - result_authselect_check_cmd is success
+ - authselect_current_profile is not match("custom/")
+ - not result_authselect_custom_profile_present.stat.exists
+
+ - name: Ensure the desired configuration is present in the custom profile
+ ansible.builtin.lineinfile:
+ dest: "/etc/authselect/{{ authselect_custom_profile }}/system-auth"
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
+ line: "password requisite pam_pwquality.so"
+ when:
+ - result_authselect_profile is not skipped
+ - result_pam_pwquality_present.found == 0
+
+ - name: Ensure a backup of current authselect profile before selecting the custom profile
+ ansible.builtin.command:
+ cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
+ register: result_authselect_backup
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+ - authselect_custom_profile is not match(authselect_current_profile)
+
+ - name: Ensure the custom profile is selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} --force
+ register: result_pam_authselect_select_profile
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ - authselect_current_profile is not match("custom/")
+ - authselect_custom_profile is not match(authselect_current_profile)
+
+ - name: Restore the authselect features in the custom profile
+ ansible.builtin.command:
+ cmd: authselect enable-feature {{ item }}
+ loop: "{{ result_authselect_features.stdout_lines }}"
+ when:
+ - result_authselect_profile is not skipped
+ - result_authselect_features is not skipped
+ - result_pam_authselect_select_profile is not skipped
+
+ - name: Ensure the custom profile changes are applied
+ ansible.builtin.command:
+ cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
+ when:
+ - result_authselect_check_cmd is success
+ - result_authselect_profile is not skipped
+ when:
+ - result_authselect_present.stat.exists
+
+# For systems without authselect
+- name: "Remediation where authselect tool is not present and PAM files are directly edited"
+ block:
+ - name: Ensure the desired configuration is present in the custom profile
+ ansible.builtin.lineinfile:
+ dest: "/etc/pam.d/system-auth"
+ insertbefore: ^password.*sufficient.*pam_unix.so.*
+ line: "password requisite pam_pwquality.so"
+ when:
+ - result_pam_pwquality_present.found == 0
+ when:
+ - not result_authselect_present.stat.exists
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh
new file mode 100644
index 00000000000..9a7972a3f93
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/bash/shared.sh
@@ -0,0 +1,41 @@
+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
+
+PAM_FILE="system-auth"
+
+if [ -f /usr/bin/authselect ]; then
+ if authselect check; then
+ CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
+ # Standard profiles delivered with authselect should not be modified.
+ # If not already in use, a custom profile is created preserving the enabled features.
+ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
+ ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+ authselect create-profile hardening -b $CURRENT_PROFILE
+ CURRENT_PROFILE="custom/hardening"
+ # Ensure a backup before changing the profile
+ authselect apply-changes -b --backup=before-pwquality-hardening.backup
+ authselect select $CURRENT_PROFILE
+ for feature in $ENABLED_FEATURES; do
+ authselect enable-feature $feature;
+ done
+ fi
+ # Include the desired configuration in the custom profile
+ CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
+ # The line should be included on the top password section
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_FILE) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_FILE
+ fi
+ authselect apply-changes -b --backup=after-pwquality-hardening.backup
+ else
+ echo "
+authselect integrity check failed. Remediation aborted!
+This remediation could not be applied because the authselect profile is not intact.
+It is not recommended to manually edit the PAM files when authselect is available.
+In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
+ false
+ fi
+else
+ FILE_PATH="/etc/pam.d/$PAM_FILE"
+ if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $FILE_PATH) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $FILE_PATH
+ fi
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml
new file mode 100644
index 00000000000..f8d241f1ff2
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/oval/shared.xml
@@ -0,0 +1,21 @@
+<def-group>
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
+ {{{ oval_metadata("The PAM module pam_pwquality is used in system-auth") }}}
+ <criteria comment="Condition for pam_pwquality in system-auth is satisfied">
+ <criterion comment="pam_pwquality system-auth"
+ test_ref="test_accounts_password_pam_pwquality_system_auth"/>
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_object id="object_accounts_password_pam_pwquality_system_auth" version="1">
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+ <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
+ <ind:instance datatype="int" operation="equals">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1"
+ id="test_accounts_password_pam_pwquality_system_auth"
+ comment="check the configuration of /etc/pam.d/system-auth">
+ <ind:object object_ref="object_accounts_password_pam_pwquality_system_auth"/>
+ </ind:textfilecontent54_test>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
new file mode 100644
index 00000000000..ea42ff9b07a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/rule.yml
@@ -0,0 +1,35 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
+
+title: 'Ensure PAM password complexity module is enabled in system-auth'
+
+description: |-
+ To enable PAM password complexity in system-auth file:
+ Edit the <tt>password</tt> section in
+ <tt>/etc/pam.d/system-auth</tt> to show
+ <tt>password requisite pam_pwquality.so</tt>.
+
+rationale: |-
+ Enabling PAM password complexity permits to enforce strong passwords and consequently
+ makes the system less prone to dictionary attacks.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-85874-6
+ cce@rhel8: CCE-85872-0
+ cce@rhel9: CCE-85873-8
+
+references:
+ stigid@rhel8: RHEL-08-020101
+
+ocil_clause: 'pam_pwquality.so is not enabled in system-auth'
+
+ocil: |-
+ To check if pam_pwhistory.so is enabled in system-auth, run the following command:
+ <pre>$ grep pam_pwquality /etc/pam.d/system-auth</pre></pre>
+ The output should be similar to the following:
+ <pre>password requisite pam_pwquality.so</pre>
+
+platform: pam
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh
new file mode 100644
index 00000000000..849f16d0f93
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_commented_entry.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $CUSTOM_SYSTEM_AUTH
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh
new file mode 100644
index 00000000000..6a98c244980
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_correct_entry.pass.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_SYSTEM_AUTH) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $CUSTOM_SYSTEM_AUTH
+fi
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh
new file mode 100644
index 00000000000..6786f6c13d7
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_missing_entry.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+
+authselect create-profile hardening -b sssd
+CUSTOM_PROFILE="custom/hardening"
+authselect select $CUSTOM_PROFILE --force
+
+CUSTOM_SYSTEM_AUTH="/etc/authselect/$CUSTOM_PROFILE/system-auth"
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $CUSTOM_SYSTEM_AUTH
+authselect apply-changes -b
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh
new file mode 100644
index 00000000000..b3d9e5884f5
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/authselect_modified_pam.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = authselect
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
+# remediation = none
+
+SYSTEM_AUTH_FILE="/etc/pam.d/system-auth"
+
+# This modification will break the integrity checks done by authselect.
+sed -i --follow-symlinks -e '/^password\s*requisite\s*pam_pwquality\.so/ s/^#*/#/g' $SYSTEM_AUTH_FILE
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh
new file mode 100644
index 00000000000..71f87b19045
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/correct_entry.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = pam
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
+
+config_file=/etc/pam.d/password-auth
+if [ $(grep -c "^\s*password.*requisite.*pam_pwquality.so" $config_file) -eq 0 ]; then
+ sed -i --follow-symlinks '0,/^password.*/s/^password.*/password requisite pam_pwquality.so\n&/' $config_file
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh
new file mode 100644
index 00000000000..3c8f6f79fe9
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_pwquality_system_auth/tests/missing_entry.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_fedora
+# packages = pam
+
+config_file=/etc/pam.d/system-auth
+
+sed -i --follow-symlinks '/^password\s*requisite\s*pam_pwquality\.so/d' $config_file
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
index eeb55a6ff5c..6b2219a3eab 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
@@ -6,13 +6,16 @@ title: 'Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
description: |-
To configure the number of retry prompts that are permitted per-session:
+ {{% if product in ['rhel8', 'rhel9'] %}}
+ Edit the <tt>/etc/security/pwquality.conf</tt> to include
+ {{% else %}}
Edit the <tt>pam_pwquality.so</tt> statement in
{{% if 'ubuntu' not in product %}}
- <tt>/etc/pam.d/system-auth</tt> {{% if product in ['rhel8', 'rhel9'] %}} and
- <tt>/etc/pam.d/password-auth</tt> {{% endif %}} to show
+ <tt>/etc/pam.d/system-auth</tt> to show
{{% else %}}
<tt>/etc/pam.d/common-password</tt> to show
{{% endif %}}
+ {{% endif %}}
<tt>retry={{{xccdf_value("var_password_pam_retry") }}}</tt>, or a lower value if site
policy is more restrictive. The DoD requirement is a maximum of 3 prompts
per session.
@@ -48,17 +51,21 @@ references:
stigid@ol7: OL07-00-010119
stigid@ol8: OL08-00-020100
stigid@rhel7: RHEL-07-010119
- stigid@rhel8: RHEL-08-020100
+ stigid@rhel8: RHEL-08-020104
stigid@ubuntu2004: UBTU-20-010057
ocil_clause: 'it is not the required value'
ocil: |-
To check how many retry attempts are permitted on a per-session basis, run the following command:
+ {{% if product in ['rhel8', 'rhel9'] %}}
+ <pre>$ grep retry /etc/security/pwquality.conf</pre>
+ {{% else %}}
{{% if 'ubuntu' in product %}}
<pre>$ grep pam_pwquality /etc/pam.d/common-password</pre>
{{% else %}}
- <pre>$ grep pam_pwquality /etc/pam.d/system-auth {{% if product in ['rhel8', 'rhel9'] %}}/etc/pam.d/password-auth{{% endif %}}</pre>
+ <pre>$ grep pam_pwquality /etc/pam.d/system-auth</pre>
+ {{% endif %}}
{{% endif %}}
The <tt>retry</tt> parameter will indicate how many attempts are permitted.
The DoD required value is less than or equal to 3.
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index d92bc72971c..62fc512f05e 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -523,6 +523,20 @@ selections:
- sssd_enable_certmap
# RHEL-08-020100
+ - accounts_password_pam_pwquality_password_auth
+
+ # RHEL-08-020101
+ - accounts_password_pam_pwquality_system_auth
+
+ # RHEL-08-020102
+ # This is only required for RHEL8 systems below version 8.4 where the
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
+
+ # RHEL-08-020103
+ # This is only required for RHEL8 systems below version 8.4 where the
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
+
+ # RHEL-08-020104
- accounts_password_pam_retry
# RHEL-08-020110
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 42c6d0e9aca..ad08a6d3410 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -524,6 +524,20 @@ selections:
- sssd_enable_certmap
# RHEL-08-020100
+ - accounts_password_pam_pwquality_password_auth
+
+ # RHEL-08-020101
+ - accounts_password_pam_pwquality_system_auth
+
+ # RHEL-08-020102
+ # This is only required for RHEL8 systems below version 8.4 where the
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
+
+ # RHEL-08-020103
+ # This is only required for RHEL8 systems below version 8.4 where the
+ # retry parameter was not yet available on /etc/security/pwquality.conf.
+
+ # RHEL-08-020104
- accounts_password_pam_retry
# RHEL-08-020110
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index e4fee44f9f9..33e82401c3d 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -53,6 +53,8 @@ selections:
- accounts_password_pam_ocredit
- accounts_password_pam_pwhistory_remember_password_auth
- accounts_password_pam_pwhistory_remember_system_auth
+- accounts_password_pam_pwquality_password_auth
+- accounts_password_pam_pwquality_system_auth
- accounts_password_pam_retry
- accounts_password_pam_ucredit
- accounts_password_pam_unix_rounds_password_auth
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 83d04775e3a..5beeb4f28af 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -64,6 +64,8 @@ selections:
- accounts_password_pam_ocredit
- accounts_password_pam_pwhistory_remember_password_auth
- accounts_password_pam_pwhistory_remember_system_auth
+- accounts_password_pam_pwquality_password_auth
+- accounts_password_pam_pwquality_system_auth
- accounts_password_pam_retry
- accounts_password_pam_ucredit
- accounts_password_pam_unix_rounds_password_auth

126
SOURCES/scap-security-guide-0.1.61-rear_not_applicable_aarch64-PR_8221.patch Normal file
View File

@ -0,0 +1,126 @@
From 622558873703704bd97fde1874a9a782d4cb8b0e Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 14 Feb 2022 17:51:50 +0100
Subject: [PATCH] Introduce CPE for aarch64 and make package_rear_installed n/a
aarch64.
This rule is not applicable for RHEL9 only.
---
.../package_rear_installed/rule.yml | 4 +++
shared/applicability/arch.yml | 12 +++++++
...proc_sys_kernel_osrelease_arch_aarch64.xml | 33 +++++++++++++++++++
..._sys_kernel_osrelease_arch_not_aarch64.xml | 16 +++++++++
ssg/constants.py | 2 ++
5 files changed, 67 insertions(+)
create mode 100644 shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
create mode 100644 shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
diff --git a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
index 6e3c11e5749..efb591654a9 100644
--- a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
+++ b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml
@@ -25,6 +25,10 @@ ocil: '{{{ ocil_package(package="rear") }}}'
# The package is not available for s309x on RHEL<8.5
# platform: not_s390x_arch
+{{%- if product == "rhel9" %}}
+platform: not_aarch64_arch
+{{%- endif %}}
+
template:
name: package_installed
vars:
diff --git a/shared/applicability/arch.yml b/shared/applicability/arch.yml
index d2cbd102310..9ac05317a95 100644
--- a/shared/applicability/arch.yml
+++ b/shared/applicability/arch.yml
@@ -12,3 +12,15 @@ cpes:
check_id: proc_sys_kernel_osrelease_arch_s390x
bash_conditional: 'grep -q s390x /proc/sys/kernel/osrelease'
+ - not_aarch64_arch:
+ name: "cpe:/a:not_aarch64_arch"
+ title: "System architecture is not AARCH64"
+ check_id: proc_sys_kernel_osrelease_arch_not_aarch64
+ bash_conditional: "! grep -q aarch64 /proc/sys/kernel/osrelease"
+
+ - aarch64_arch:
+ name: "cpe:/a:aarch64_arch"
+ title: "System architecture is AARCH64"
+ check_id: proc_sys_kernel_osrelease_arch_aarch64
+ bash_conditional: 'grep -q aarch64 /proc/sys/kernel/osrelease'
+
diff --git a/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml b/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
new file mode 100644
index 00000000000..3d54f81e6d4
--- /dev/null
+++ b/shared/checks/oval/proc_sys_kernel_osrelease_arch_aarch64.xml
@@ -0,0 +1,33 @@
+<def-group>
+ <definition class="inventory" id="proc_sys_kernel_osrelease_arch_aarch64"
+ version="1">
+ <metadata>
+ <title>Test that the architecture is aarch64</title>
+ <affected family="unix">
+ <platform>multi_platform_all</platform>
+ </affected>
+ <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</description>
+ </metadata>
+ <criteria>
+ <criterion comment="Architecture is aarch64"
+ test_ref="test_proc_sys_kernel_osrelease_arch_aarch64" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="proc_sys_kernel is for aarch64 architecture"
+ id="test_proc_sys_kernel_osrelease_arch_aarch64"
+ version="1">
+ <ind:object object_ref="object_proc_sys_kernel_osrelease_arch_aarch64" />
+ <ind:state state_ref="state_proc_sys_kernel_osrelease_arch_aarch64" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_proc_sys_kernel_osrelease_arch_aarch64" version="1">
+ <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
+ <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_proc_sys_kernel_osrelease_arch_aarch64" version="1">
+ <ind:subexpression datatype="string" operation="pattern match">^aarch64$</ind:subexpression>
+ </ind:textfilecontent54_state>
+</def-group>
diff --git a/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml b/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
new file mode 100644
index 00000000000..3fce66ee00a
--- /dev/null
+++ b/shared/checks/oval/proc_sys_kernel_osrelease_arch_not_aarch64.xml
@@ -0,0 +1,16 @@
+<def-group>
+ <definition class="inventory" id="proc_sys_kernel_osrelease_arch_not_aarch64"
+ version="1">
+ <metadata>
+ <title>Test for different architecture than aarch64</title>
+ <affected family="unix">
+ <platform>multi_platform_all</platform>
+ </affected>
+ <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</description>
+ </metadata>
+ <criteria>
+ <extend_definition comment="Architecture is not aarch64"
+ definition_ref="proc_sys_kernel_osrelease_arch_aarch64" negate="true"/>
+ </criteria>
+ </definition>
+</def-group>
diff --git a/ssg/constants.py b/ssg/constants.py
index 64d7d36c989..92cc2f8de34 100644
--- a/ssg/constants.py
+++ b/ssg/constants.py
@@ -424,6 +424,8 @@
"non-uefi": None,
"not_s390x_arch": None,
"s390x_arch": None,
+ "not_aarch64_arch": None,
+ "aarch64_arch": None,
"ovirt": None,
"no_ovirt": None,
}

44
SOURCES/scap-security-guide-0.1.61-remove_RHEL_08_010560-PR_8145.patch Normal file
View File

@ -0,0 +1,44 @@
diff --git a/controls/stig_rhel8.yml b/controls/stig_rhel8.yml
index d7821c2e3b8..fe6b0f01186 100644
--- a/controls/stig_rhel8.yml
+++ b/controls/stig_rhel8.yml
@@ -584,11 +584,6 @@ controls:
rules:
- sshd_disable_root_login
status: automated
- - id: RHEL-08-010560
- levels:
- - medium
- title: The auditd service must be running in RHEL 8.
- status: pending
- id: RHEL-08-010561
levels:
- medium
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 7c89bcbf659..09fa85df181 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -368,9 +368,6 @@ selections:
# RHEL-08-010550
- sshd_disable_root_login
- # RHEL-08-010560
- - service_auditd_enabled
-
# RHEL-08-010561
- service_rsyslog_enabled
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 690991f697b..eb2cac913bd 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -369,9 +369,6 @@ selections:
# RHEL-08-010550
- sshd_disable_root_login
- # RHEL-08-010560
- - service_auditd_enabled
-
# RHEL-08-010561
- service_rsyslog_enabled

106
SOURCES/scap-security-guide-0.1.61-remove_client_alive_max-PR_8197.patch Normal file
View File

@ -0,0 +1,106 @@
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index d92bc72971c..98cabee38dd 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -51,7 +51,7 @@ selections:
- var_password_pam_lcredit=1
- var_password_pam_retry=3
- var_password_pam_minlen=15
- - var_sshd_set_keepalive=0
+ # - var_sshd_set_keepalive=0
- sshd_approved_macs=stig
- sshd_approved_ciphers=stig
- sshd_idle_timeout_value=10_minutes
@@ -170,11 +170,13 @@ selections:
# RHEL-08-010190
- dir_perms_world_writable_sticky_bits
- # RHEL-08-010200
- - sshd_set_keepalive_0
-
- # RHEL-08-010201
- - sshd_set_idle_timeout
+ # These two items don't behave as they used to in RHEL8.6 and RHEL9
+ # anymore. They will be disabled for now until an alternative
+ # solution is found.
+ # # RHEL-08-010200
+ # - sshd_set_keepalive_0
+ # # RHEL-08-010201
+ # - sshd_set_idle_timeout
# RHEL-08-010210
- file_permissions_var_log_messages
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 42c6d0e9aca..842f17c7021 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -52,7 +52,7 @@ selections:
- var_password_pam_lcredit=1
- var_password_pam_retry=3
- var_password_pam_minlen=15
- - var_sshd_set_keepalive=0
+ # - var_sshd_set_keepalive=0
- sshd_approved_macs=stig
- sshd_approved_ciphers=stig
- sshd_idle_timeout_value=10_minutes
@@ -171,11 +171,13 @@ selections:
# RHEL-08-010190
- dir_perms_world_writable_sticky_bits
- # RHEL-08-010200
- - sshd_set_keepalive_0
-
- # RHEL-08-010201
- - sshd_set_idle_timeout
+ # These two items don't behave as they used to in RHEL8.6 and RHEL9
+ # anymore. They will be disabled for now until an alternative
+ # solution is found.
+ # # RHEL-08-010200
+ # - sshd_set_keepalive_0
+ # # RHEL-08-010201
+ # - sshd_set_idle_timeout
# RHEL-08-010210
- file_permissions_var_log_messages
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index e4fee44f9f9..e3c8ebfc9a5 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -353,8 +353,6 @@ selections:
- sshd_enable_warning_banner
- sshd_print_last_log
- sshd_rekey_limit
-- sshd_set_idle_timeout
-- sshd_set_keepalive_0
- sshd_use_strong_rng
- sshd_x11_use_localhost
- sssd_certificate_verification
@@ -423,7 +421,6 @@ selections:
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
-- var_sshd_set_keepalive=0
- sshd_approved_macs=stig
- sshd_approved_ciphers=stig
- sshd_idle_timeout_value=10_minutes
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 83d04775e3a..8ef48e0654b 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -364,8 +364,6 @@ selections:
- sshd_enable_warning_banner
- sshd_print_last_log
- sshd_rekey_limit
-- sshd_set_idle_timeout
-- sshd_set_keepalive_0
- sshd_use_strong_rng
- sshd_x11_use_localhost
- sssd_certificate_verification
@@ -432,7 +430,6 @@ selections:
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
-- var_sshd_set_keepalive=0
- sshd_approved_macs=stig
- sshd_approved_ciphers=stig
- sshd_idle_timeout_value=10_minutes

146
SOURCES/scap-security-guide-0.1.61-remove_tmux_process_running_check-PR_8246.patch Normal file
View File

@ -0,0 +1,146 @@
From 0ffb73fe67cb5773037f62895e6fdc93195f7c38 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 21 Feb 2022 12:55:10 +0100
Subject: [PATCH] Remove tmux process runinng check from
configure_bashrc_exec_tmux.
This check can cause troubles since the user must be logged to show up
as tmux running. For example, an evaluation happening through a cron job
wouldn't be able to make this rule work, since no terminal is being
used.
---
.../configure_bashrc_exec_tmux/oval/shared.xml | 10 ----------
.../configure_bashrc_exec_tmux/rule.yml | 14 +-------------
.../tests/correct_value.pass.sh | 1 -
.../tests/correct_value_d_directory.pass.sh | 1 -
.../tests/duplicate_value_multiple_files.pass.sh | 1 -
.../tests/tmux_not_running.fail.sh | 13 -------------
.../tests/wrong_value.fail.sh | 2 --
7 files changed, 1 insertion(+), 41 deletions(-)
delete mode 100644 linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
index 4cb2f9e0e04..58f91eadf66 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
@@ -4,7 +4,6 @@
<criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
<criterion comment="check tmux is configured to exec on the last line of /etc/bashrc"
test_ref="test_configure_bashrc_exec_tmux" />
- <criterion comment="check tmux is running" test_ref="test_tmux_running"/>
</criteria>
</definition>
<ind:textfilecontent54_test check="all" check_existence="all_exist"
@@ -18,13 +17,4 @@
<ind:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
-
- <unix:process58_test check="all" id="test_tmux_running" comment="is tmux running" version="1">
- <unix:object object_ref="obj_tmux_running"/>
- </unix:process58_test>
-
- <unix:process58_object id="obj_tmux_running" version="1">
- <unix:command_line operation="pattern match">^tmux(?:|[\s]+.*)$</unix:command_line>
- <unix:pid datatype="int" operation="greater than">0</unix:pid>
- </unix:process58_object>
</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
index 7afc5fc5e6b..9f224748894 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
@@ -8,19 +8,11 @@ description: |-
The <tt>tmux</tt> terminal multiplexer is used to implement
automatic session locking. It should be started from
<tt>/etc/bashrc</tt> or drop-in files within <tt>/etc/profile.d/</tt>.
- Additionally it must be ensured that the <tt>tmux</tt> process is running
- and it can be verified with the following command:
- <pre>ps all | grep tmux | grep -v grep</pre>
rationale: |-
Unlike <tt>bash</tt> itself, the <tt>tmux</tt> terminal multiplexer
provides a mechanism to lock sessions after period of inactivity.
-warnings:
- - general: |-
- The remediation does not start the tmux process, so it must be
- manually started or have the system rebooted after applying the fix.
-
severity: medium
identifiers:
@@ -34,7 +26,7 @@ references:
stigid@ol8: OL08-00-020041
stigid@rhel8: RHEL-08-020041
-ocil_clause: 'exec tmux is not present at the end of bashrc or tmux process is not running'
+ocil_clause: 'exec tmux is not present at the end of bashrc'
ocil: |-
To verify that tmux is configured to execute,
@@ -46,9 +38,5 @@ ocil: |-
name=$(ps -o comm= -p $parent)
case "$name" in sshd|login) exec tmux ;; esac
fi</pre>
- To verify that the tmux process is running,
- run the following command:
- <pre>ps all | grep tmux | grep -v grep</pre>
- If the command does not produce output, this is a finding.
platform: machine
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
index 221c18665ef..fbc7590f27d 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
@@ -9,4 +9,3 @@ if [ "$PS1" ]; then
fi
EOF
-tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
index 1702bb17e79..6107f86f248 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
@@ -10,4 +10,3 @@ if [ "$PS1" ]; then
fi
EOF
-tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
index 16d4acfcb5a..c662221eca1 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
@@ -17,4 +17,3 @@ if [ "$PS1" ]; then
fi
EOF
-tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
deleted file mode 100644
index 6cb9d83efc5..00000000000
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-# packages = tmux
-# remediation = none
-
-cat >> /etc/bashrc <<'EOF'
-if [ "$PS1" ]; then
- parent=$(ps -o ppid= -p $$)
- name=$(ps -o comm= -p $parent)
- case "$name" in sshd|login) exec tmux ;; esac
-fi
-EOF
-
-killall tmux || true
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
index f13a8b038e4..9b461654572 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
@@ -101,5 +101,3 @@ if [ -z "$BASHRCSOURCED" ]; then
fi
# vim:ts=4:sw=4
EOF
-
-tmux new-session -s root -d

79
SOURCES/scap-security-guide-0.1.61-resize-anssi-kickstart-partitions-PR_8261.patch Normal file
View File

@ -0,0 +1,79 @@
From ea49c71011c1815b2889c5a004c79c99faff4a1c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 23 Feb 2022 18:23:22 +0100
Subject: [PATCH] Adjsut partitions sizes to acomodate a GUI install
The GUI requires more room in the /usr partition.
Let's reduce /otp, /srv and /home, which should not have any data.
---
.../rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg | 8 ++++----
products/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg | 8 ++++----
.../kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg | 8 ++++----
3 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
index 9c02e5c2ac1..cc18e8cd16f 100644
--- a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
+++ b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
@@ -100,13 +100,13 @@ volgroup VolGroup --pesize=4096 pv.01
# Create particular logical volumes (optional)
logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
# Ensure /usr Located On Separate Partition
-logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
+logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=6536 --fsoptions="nodev"
# Ensure /opt Located On Separate Partition
-logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /srv Located On Separate Partition
-logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /home Located On Separate Partition
-logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=512 --fsoptions="nodev"
# Ensure /tmp Located On Separate Partition
logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
# Ensure /var/tmp Located On Separate Partition
diff --git a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
index 68729408698..3e99b4d0f99 100644
--- a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
+++ b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
@@ -104,13 +104,13 @@ volgroup VolGroup --pesize=4096 pv.01
# Create particular logical volumes (optional)
logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
# Ensure /usr Located On Separate Partition
-logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
+logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=6536 --fsoptions="nodev"
# Ensure /opt Located On Separate Partition
-logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /srv Located On Separate Partition
-logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /home Located On Separate Partition
-logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=512 --fsoptions="nodev"
# Ensure /tmp Located On Separate Partition
logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
# Ensure /var/tmp Located On Separate Partition
diff --git a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
index 1f703d127e5..31d10a7e97e 100644
--- a/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
+++ b/products/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
@@ -100,13 +100,13 @@ volgroup VolGroup --pesize=4096 pv.01
# Create particular logical volumes (optional)
logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
# Ensure /usr Located On Separate Partition
-logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
+logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=6536 --fsoptions="nodev"
# Ensure /opt Located On Separate Partition
-logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /srv Located On Separate Partition
-logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
+logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid"
# Ensure /home Located On Separate Partition
-logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=512 --fsoptions="nodev"
# Ensure /tmp Located On Separate Partition
logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
# Ensure /var/tmp Located On Separate Partition

285
SOURCES/scap-security-guide-0.1.61-rhel86_ospp_fix_audit_ospp_general-PR_8152.patch Normal file
View File

@ -0,0 +1,285 @@
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
index 09dc1566bbf..26c7eea79d1 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml
@@ -6,10 +6,10 @@ title: 'Configure auditing of unsuccessful file accesses'
{{% set file_contents_audit_access_failed =
"## Unsuccessful file access (any other opens) This has to go last.
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access" %}}
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access" %}}
description: |-
Ensure that unsuccessful attempts to access a file are audited.
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
index 5ce9fe6799c..262cf290ec0 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml
@@ -7,8 +7,8 @@ title: 'Configure auditing of successful file accesses'
{{% set file_contents_audit_access_success =
"## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access" %}}
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access" %}}
description: |-
Ensure that successful attempts to access a file are audited.
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
index e37291c68a1..bdc59faa5f7 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
+++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml
@@ -4,7 +4,7 @@ prodtype: ol8,rhcos4,rhel8,rhel9
title: 'Perform general configuration of Audit for OSPP'
-{{% if product == "rhel9" %}}
+
{{% set file_contents_audit_ospp_general =
"## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
@@ -90,89 +90,7 @@ title: 'Perform general configuration of Audit for OSPP'
## state results from that policy. This would be handled entirely by
## that daemon.
" %}}
-{{% else %}}
-{{% set file_contents_audit_ospp_general =
-"## The purpose of these rules is to meet the requirements for Operating
-## System Protection Profile (OSPP)v4.2. These rules depends on having
-## the following rule files copied to /etc/audit/rules.d:
-##
-## 10-base-config.rules, 11-loginuid.rules,
-## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
-## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
-## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
-## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
-## 30-ospp-v42-5-perm-change-failed.rules,
-## 30-ospp-v42-5-perm-change-success.rules,
-## 30-ospp-v42-6-owner-change-failed.rules,
-## 30-ospp-v42-6-owner-change-success.rules
-##
-## original copies may be found in /usr/share/audit/sample-rules/
-
-
-## User add delete modify. This is covered by pam. However, someone could
-## open a file and directly create or modify a user, so we'll watch passwd and
-## shadow for writes
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-
-## User enable and disable. This is entirely handled by pam.
-
-## Group add delete modify. This is covered by pam. However, someone could
-## open a file and directly create or modify a user, so we'll watch group and
-## gshadow for writes
--a always,exit -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
--a always,exit -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
--a always,exit -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-
-## Use of special rights for config changes. This would be use of setuid
-## programs that relate to user accts. This is not all setuid apps because
-## requirements are only for ones that affect system configuration.
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-
-## Privilege escalation via su or sudo. This is entirely handled by pam.
-
-## Audit log access
--a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
-## Attempts to Alter Process and Session Initiation Information
--a always,exit -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
--a always,exit -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
--a always,exit -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-
-## Attempts to modify MAC controls
--a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
-
-## Software updates. This is entirely handled by rpm.
-
-## System start and shutdown. This is entirely handled by systemd
-
-## Kernel Module loading. This is handled in 43-module-load.rules
-
-## Application invocation. The requirements list an optional requirement
-## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
-## state results from that policy. This would be handled entirely by
-## that daemon.
-" %}}
-{{% endif %}}
description: |-
Configure some basic <tt>Audit</tt> parameters specific for OSPP profile.
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
index ffe2344db56..c59e7e5e1f2 100644
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
+++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules.pass.sh
@@ -1,3 +1,3 @@
-# platform = Red Hat Enterprise Linux 8
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
cp $SHARED/audit/30-ospp-v42.rules /etc/audit/rules.d/
diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh
deleted file mode 100644
index 96ef5ae0a23..00000000000
--- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/tests/correct_rules_rhel9.pass.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-# platform = Red Hat Enterprise Linux 9
-
-cp $SHARED/audit/30-ospp-v42_rhel9.rules /etc/audit/rules.d/30-ospp-v42.rules
diff --git a/tests/shared/audit/30-ospp-v42-3-access-failed.rules b/tests/shared/audit/30-ospp-v42-3-access-failed.rules
index a5aad3a95ce..39ac7a883ca 100644
--- a/tests/shared/audit/30-ospp-v42-3-access-failed.rules
+++ b/tests/shared/audit/30-ospp-v42-3-access-failed.rules
@@ -1,5 +1,5 @@
## Unsuccessful file access (any other opens) This has to go last.
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
diff --git a/tests/shared/audit/30-ospp-v42-3-access-success.rules b/tests/shared/audit/30-ospp-v42-3-access-success.rules
index 0c8a6b65760..79004ce0c21 100644
--- a/tests/shared/audit/30-ospp-v42-3-access-success.rules
+++ b/tests/shared/audit/30-ospp-v42-3-access-success.rules
@@ -1,4 +1,4 @@
## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
diff --git a/tests/shared/audit/30-ospp-v42.rules b/tests/shared/audit/30-ospp-v42.rules
index 3dced17255c..2d3c48265b6 100644
--- a/tests/shared/audit/30-ospp-v42.rules
+++ b/tests/shared/audit/30-ospp-v42.rules
@@ -57,6 +57,10 @@
## Privilege escalation via su or sudo. This is entirely handled by pam.
+## Watch for configuration changes to privilege escalation.
+-a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
+-a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
+
## Audit log access
-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
## Attempts to Alter Process and Session Initiation Information
diff --git a/tests/shared/audit/30-ospp-v42_rhel9.rules b/tests/shared/audit/30-ospp-v42_rhel9.rules
deleted file mode 100644
index 2d3c48265b6..00000000000
--- a/tests/shared/audit/30-ospp-v42_rhel9.rules
+++ /dev/null
@@ -1,84 +0,0 @@
-## The purpose of these rules is to meet the requirements for Operating
-## System Protection Profile (OSPP)v4.2. These rules depends on having
-## the following rule files copied to /etc/audit/rules.d:
-##
-## 10-base-config.rules, 11-loginuid.rules,
-## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
-## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
-## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
-## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
-## 30-ospp-v42-5-perm-change-failed.rules,
-## 30-ospp-v42-5-perm-change-success.rules,
-## 30-ospp-v42-6-owner-change-failed.rules,
-## 30-ospp-v42-6-owner-change-success.rules
-##
-## original copies may be found in /usr/share/audit/sample-rules/
-
-
-## User add delete modify. This is covered by pam. However, someone could
-## open a file and directly create or modify a user, so we'll watch passwd and
-## shadow for writes
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
-
-## User enable and disable. This is entirely handled by pam.
-
-## Group add delete modify. This is covered by pam. However, someone could
-## open a file and directly create or modify a user, so we'll watch group and
-## gshadow for writes
--a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
--a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
--a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
-
-
-## Use of special rights for config changes. This would be use of setuid
-## programs that relate to user accts. This is not all setuid apps because
-## requirements are only for ones that affect system configuration.
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
-
-## Privilege escalation via su or sudo. This is entirely handled by pam.
-
-## Watch for configuration changes to privilege escalation.
--a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
--a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
-
-## Audit log access
--a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
-## Attempts to Alter Process and Session Initiation Information
--a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
--a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
--a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
-
-## Attempts to modify MAC controls
--a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy
-
-## Software updates. This is entirely handled by rpm.
-
-## System start and shutdown. This is entirely handled by systemd
-
-## Kernel Module loading. This is handled in 43-module-load.rules
-
-## Application invocation. The requirements list an optional requirement
-## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
-## state results from that policy. This would be handled entirely by
-## that daemon.
-

493
SOURCES/scap-security-guide-0.1.61-rhel8_stig_audit_rules-PR_8174.patch Normal file
View File

@ -0,0 +1,493 @@
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
index a0b3efcbf79..1bc7afbb224 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
@@ -58,7 +58,7 @@ references:
stigid@ol7: OL07-00-030410
stigid@ol8: OL08-00-030540
stigid@rhel7: RHEL-07-030420
- stigid@rhel8: RHEL-08-030540
+ stigid@rhel8: RHEL-08-030490
stigid@sle12: SLES-12-020470
stigid@sle15: SLES-15-030300
stigid@ubuntu2004: UBTU-20-010153
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
index 83dd57f2b6d..dc8211684f2 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
@@ -58,7 +58,7 @@ references:
stigid@ol7: OL07-00-030410
stigid@ol8: OL08-00-030530
stigid@rhel7: RHEL-07-030430
- stigid@rhel8: RHEL-08-030530
+ stigid@rhel8: RHEL-08-030490
stigid@sle12: SLES-12-020480
stigid@sle15: SLES-15-030310
stigid@ubuntu2004: UBTU-20-010154
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
index 1b78aab4a1a..07592bb2fd9 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
@@ -61,7 +61,7 @@ references:
stigid@ol7: OL07-00-030370
stigid@ol8: OL08-00-030520
stigid@rhel7: RHEL-07-030380
- stigid@rhel8: RHEL-08-030520
+ stigid@rhel8: RHEL-08-030480
stigid@sle12: SLES-12-020430
stigid@sle15: SLES-15-030260
stigid@ubuntu2004: UBTU-20-010149
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
index 360c60de06d..084970765b2 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
@@ -58,7 +58,7 @@ references:
stigid@ol7: OL07-00-030370
stigid@ol8: OL08-00-030510
stigid@rhel7: RHEL-07-030400
- stigid@rhel8: RHEL-08-030510
+ stigid@rhel8: RHEL-08-030480
stigid@sle12: SLES-12-020450
stigid@sle15: SLES-15-030280
stigid@ubuntu2004: UBTU-20-010150
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
index 19bf8a5b981..5695440ad7d 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
@@ -75,7 +75,7 @@ references:
stigid@ol7: OL07-00-030440
stigid@ol8: OL08-00-030240
stigid@rhel7: RHEL-07-030480
- stigid@rhel8: RHEL-08-030240
+ stigid@rhel8: RHEL-08-030200
stigid@sle12: SLES-12-020410
stigid@sle15: SLES-15-030210
stigid@ubuntu2004: UBTU-20-010147
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
index 40cd114042e..ab536a8ae0a 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
@@ -70,7 +70,7 @@ references:
stigid@ol7: OL07-00-030440
stigid@ol8: OL08-00-030230
stigid@rhel7: RHEL-07-030450
- stigid@rhel8: RHEL-08-030230
+ stigid@rhel8: RHEL-08-030200
stigid@sle12: SLES-12-020380
stigid@sle15: SLES-15-030230
stigid@ubuntu2004: UBTU-20-010144
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
index 81dddd9fb71..d1f4ee35ccb 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
@@ -58,7 +58,7 @@ references:
stigid@ol7: OL07-00-030370
stigid@ol8: OL08-00-030500
stigid@rhel7: RHEL-07-030390
- stigid@rhel8: RHEL-08-030500
+ stigid@rhel8: RHEL-08-030480
stigid@sle12: SLES-12-020440
stigid@sle15: SLES-15-030270
stigid@ubuntu2004: UBTU-20-010151
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
index fa15012b05f..a2425e373bc 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
@@ -69,7 +69,7 @@ references:
stigid@ol7: OL07-00-030440
stigid@ol8: OL08-00-030220
stigid@rhel7: RHEL-07-030460
- stigid@rhel8: RHEL-08-030220
+ stigid@rhel8: RHEL-08-030200
stigid@sle15: SLES-15-030240
stigid@ubuntu2004: UBTU-20-010143
vmmsrg: SRG-OS-000458-VMM-001810,SRG-OS-000474-VMM-001940
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
index 6d15eecee2c..0be27fbe860 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
@@ -74,7 +74,7 @@ references:
stigid@ol7: OL07-00-030440
stigid@ol8: OL08-00-030210
stigid@rhel7: RHEL-07-030470
- stigid@rhel8: RHEL-08-030210
+ stigid@rhel8: RHEL-08-030200
stigid@sle12: SLES-12-020390
stigid@sle15: SLES-15-030190
stigid@ubuntu2004: UBTU-20-010145
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
index 6f7cea26e16..5dc13a0a43a 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
@@ -70,7 +70,7 @@ references:
stigid@ol7: OL07-00-030440
stigid@ol8: OL08-00-030270
stigid@rhel7: RHEL-07-030440
- stigid@rhel8: RHEL-08-030270
+ stigid@rhel8: RHEL-08-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030220
stigid@ubuntu2004: UBTU-20-010142
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
index 718dcb8a9d9..120d6fa84d3 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
@@ -52,7 +52,7 @@ references:
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030362
stigid@rhel7: RHEL-07-030890
- stigid@rhel8: RHEL-08-030362
+ stigid@rhel8: RHEL-08-030361
stigid@ubuntu2004: UBTU-20-010270
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
index 643f075f46a..4caa7c66986 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
@@ -49,7 +49,7 @@ references:
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030363
stigid@rhel7: RHEL-07-030900
- stigid@rhel8: RHEL-08-030363
+ stigid@rhel8: RHEL-08-030361
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
{{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}}
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
index 9cf3c4668bc..8fea9dc4582 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
@@ -52,7 +52,7 @@ references:
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030364
stigid@rhel7: RHEL-07-030910
- stigid@rhel8: RHEL-08-030364
+ stigid@rhel8: RHEL-08-030361
stigid@ubuntu2004: UBTU-20-010267
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
index d0ebbdbd723..bee18e99b52 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
@@ -52,7 +52,7 @@ references:
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030365
stigid@rhel7: RHEL-07-030920
- stigid@rhel8: RHEL-08-030365
+ stigid@rhel8: RHEL-08-030361
stigid@ubuntu2004: UBTU-20-010268
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
index 373b12525e1..736c6643b57 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
@@ -63,7 +63,7 @@ references:
stigid@ol7: OL07-00-030510
stigid@ol8: OL08-00-030470
stigid@rhel7: RHEL-07-030500
- stigid@rhel8: RHEL-08-030470
+ stigid@rhel8: RHEL-08-030420
stigid@sle12: SLES-12-020520
stigid@sle15: SLES-15-030160
stigid@ubuntu2004: UBTU-20-010158
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
index 2b2d82a736b..6b4176d53e3 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
@@ -66,7 +66,7 @@ references:
stigid@ol7: OL07-00-030510
stigid@ol8: OL08-00-030460
stigid@rhel7: RHEL-07-030550
- stigid@rhel8: RHEL-08-030460
+ stigid@rhel8: RHEL-08-030420
stigid@sle12: SLES-12-020510
stigid@sle15: SLES-15-030320
stigid@ubuntu2004: UBTU-20-010157
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
index dcb3d0f0525..90d45b6787e 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
@@ -66,7 +66,7 @@ references:
stigid@ol7: OL07-00-030510
stigid@ol8: OL08-00-030440
stigid@rhel7: RHEL-07-030510
- stigid@rhel8: RHEL-08-030440
+ stigid@rhel8: RHEL-08-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2004: UBTU-20-010155
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
index e68d892bb90..6df936e489c 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
@@ -60,7 +60,7 @@ references:
stigid@ol7: OL07-00-030510
stigid@ol8: OL08-00-030450
stigid@rhel7: RHEL-07-030530
- stigid@rhel8: RHEL-08-030450
+ stigid@rhel8: RHEL-08-030420
stigid@sle12: SLES-12-020540
stigid@sle15: SLES-15-030180
stigid@ubuntu2004: UBTU-20-010160
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
index cd6bd545e71..1b6ae818e48 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
@@ -66,7 +66,7 @@ references:
stigid@ol7: OL07-00-030510
stigid@ol8: OL08-00-030430
stigid@rhel7: RHEL-07-030520
- stigid@rhel8: RHEL-08-030430
+ stigid@rhel8: RHEL-08-030420
stigid@sle12: SLES-12-020530
stigid@sle15: SLES-15-030170
stigid@ubuntu2004: UBTU-20-010159
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
index 50e5b4e4f02..2f1c6d0bf22 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
@@ -51,7 +51,7 @@ references:
stigid@ol7: OL07-00-030820
stigid@ol8: OL08-00-030380
stigid@rhel7: RHEL-07-030821
- stigid@rhel8: RHEL-08-030380
+ stigid@rhel8: RHEL-08-030360
stigid@sle12: SLES-12-020740
stigid@sle15: SLES-15-030530
stigid@ubuntu2004: UBTU-20-010180
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index ffca983d0bd..d92bc72971c 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -560,6 +560,8 @@ selections:
# RHEL-08-020220
- accounts_password_pam_pwhistory_remember_system_auth
+
+ # RHEL-08-020221
- accounts_password_pam_pwhistory_remember_password_auth
# RHEL-08-020230
@@ -712,18 +714,11 @@ selections:
# RHEL-08-030200
- audit_rules_dac_modification_lremovexattr
-
- # RHEL-08-030210
- audit_rules_dac_modification_removexattr
-
- # RHEL-08-030220
- audit_rules_dac_modification_lsetxattr
-
- # RHEL-08-030230
- audit_rules_dac_modification_fsetxattr
-
- # RHEL-08-030240
- audit_rules_dac_modification_fremovexattr
+ - audit_rules_dac_modification_setxattr
# RHEL-08-030250
- audit_rules_privileged_commands_chage
@@ -731,8 +726,6 @@ selections:
# RHEL-08-030260
- audit_rules_execution_chcon
- # RHEL-08-030270
- - audit_rules_dac_modification_setxattr
# RHEL-08-030280
- audit_rules_privileged_commands_ssh_agent
@@ -787,28 +780,18 @@ selections:
# RHEL-08-030360
- audit_rules_kernel_module_loading_init
+ - audit_rules_kernel_module_loading_finit
# RHEL-08-030361
- audit_rules_file_deletion_events_rename
-
- # RHEL-08-030362
- audit_rules_file_deletion_events_renameat
-
- # RHEL-08-030363
- audit_rules_file_deletion_events_rmdir
-
- # RHEL-08-030364
- audit_rules_file_deletion_events_unlink
-
- # RHEL-08-030365
- audit_rules_file_deletion_events_unlinkat
# RHEL-08-030370
- audit_rules_privileged_commands_gpasswd
- # RHEL-08-030380
- - audit_rules_kernel_module_loading_finit
-
# RHEL-08-030390
- audit_rules_kernel_module_loading_delete
@@ -820,41 +803,21 @@ selections:
# RHEL-08-030420
- audit_rules_unsuccessful_file_modification_truncate
-
- # RHEL-08-030430
- audit_rules_unsuccessful_file_modification_openat
-
- # RHEL-08-030440
- audit_rules_unsuccessful_file_modification_open
-
- # RHEL-08-030450
- audit_rules_unsuccessful_file_modification_open_by_handle_at
-
- # RHEL-08-030460
- audit_rules_unsuccessful_file_modification_ftruncate
-
- # RHEL-08-030470
- audit_rules_unsuccessful_file_modification_creat
# RHEL-08-030480
- audit_rules_dac_modification_chown
-
- # RHEL-08-030490
- - audit_rules_dac_modification_chmod
-
- # RHEL-08-030500
- audit_rules_dac_modification_lchown
-
- # RHEL-08-030510
- audit_rules_dac_modification_fchownat
-
- # RHEL-08-030520
- audit_rules_dac_modification_fchown
- # RHEL-08-030530
+ # RHEL-08-030490
+ - audit_rules_dac_modification_chmod
- audit_rules_dac_modification_fchmodat
-
- # RHEL-08-030540
- audit_rules_dac_modification_fchmod
# RHEL-08-030550
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index eb2cac913bd..42c6d0e9aca 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -561,6 +561,8 @@ selections:
# RHEL-08-020220
- accounts_password_pam_pwhistory_remember_system_auth
+
+ # RHEL-08-020221
- accounts_password_pam_pwhistory_remember_password_auth
# RHEL-08-020230
@@ -713,18 +715,11 @@ selections:
# RHEL-08-030200
- audit_rules_dac_modification_lremovexattr
-
- # RHEL-08-030210
- audit_rules_dac_modification_removexattr
-
- # RHEL-08-030220
- audit_rules_dac_modification_lsetxattr
-
- # RHEL-08-030230
- audit_rules_dac_modification_fsetxattr
-
- # RHEL-08-030240
- audit_rules_dac_modification_fremovexattr
+ - audit_rules_dac_modification_setxattr
# RHEL-08-030250
- audit_rules_privileged_commands_chage
@@ -732,9 +727,6 @@ selections:
# RHEL-08-030260
- audit_rules_execution_chcon
- # RHEL-08-030270
- - audit_rules_dac_modification_setxattr
-
# RHEL-08-030280
- audit_rules_privileged_commands_ssh_agent
@@ -788,28 +780,18 @@ selections:
# RHEL-08-030360
- audit_rules_kernel_module_loading_init
+ - audit_rules_kernel_module_loading_finit
# RHEL-08-030361
- audit_rules_file_deletion_events_rename
-
- # RHEL-08-030362
- audit_rules_file_deletion_events_renameat
-
- # RHEL-08-030363
- audit_rules_file_deletion_events_rmdir
-
- # RHEL-08-030364
- audit_rules_file_deletion_events_unlink
-
- # RHEL-08-030365
- audit_rules_file_deletion_events_unlinkat
# RHEL-08-030370
- audit_rules_privileged_commands_gpasswd
- # RHEL-08-030380
- - audit_rules_kernel_module_loading_finit
-
# RHEL-08-030390
- audit_rules_kernel_module_loading_delete
@@ -821,41 +803,21 @@ selections:
# RHEL-08-030420
- audit_rules_unsuccessful_file_modification_truncate
-
- # RHEL-08-030430
- audit_rules_unsuccessful_file_modification_openat
-
- # RHEL-08-030440
- audit_rules_unsuccessful_file_modification_open
-
- # RHEL-08-030450
- audit_rules_unsuccessful_file_modification_open_by_handle_at
-
- # RHEL-08-030460
- audit_rules_unsuccessful_file_modification_ftruncate
-
- # RHEL-08-030470
- audit_rules_unsuccessful_file_modification_creat
# RHEL-08-030480
- audit_rules_dac_modification_chown
-
- # RHEL-08-030490
- - audit_rules_dac_modification_chmod
-
- # RHEL-08-030500
- audit_rules_dac_modification_lchown
-
- # RHEL-08-030510
- audit_rules_dac_modification_fchownat
-
- # RHEL-08-030520
- audit_rules_dac_modification_fchown
- # RHEL-08-030530
+ # RHEL-08-030490
+ - audit_rules_dac_modification_chmod
- audit_rules_dac_modification_fchmodat
-
- # RHEL-08-030540
- audit_rules_dac_modification_fchmod
# RHEL-08-030550

375
SOURCES/scap-security-guide-0.1.61-rhel8_stig_v1r5-PR_8050.patch Normal file
View File

@ -0,0 +1,375 @@
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
new file mode 100644
index 00000000000..1c151a1ec1a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
@@ -0,0 +1,5 @@
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhv
+
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
new file mode 100644
index 00000000000..24fdbe4c1d4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/oval/shared.xml
@@ -0,0 +1,19 @@
+<def-group>
+ <definition class="compliance" id="set_password_hashing_algorithm_passwordauth" version="1">
+ {{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.") }}}
+ <criteria operator="AND">
+ <criterion test_ref="test_pam_unix_passwordauth_sha512" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/password-auth for correct settings" id="test_pam_unix_passwordauth_sha512" version="1">
+ <ind:object object_ref="object_pam_unix_passwordauth_sha512" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object comment="check /etc/pam.d/password-auth for correct settings" id="object_pam_unix_passwordauth_sha512" version="1">
+ <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
new file mode 100644
index 00000000000..9375269161d
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
@@ -0,0 +1,72 @@
+documentation_complete: true
+
+prodtype: fedora,rhel7,rhel8,rhel9,rhv4
+
+title: "Set PAM's Password Hashing Algorithm - password-auth"
+
+description: |-
+ The PAM system service can be configured to only store encrypted
+ representations of passwords. In
+ <tt>/etc/pam.d/password-auth</tt>,
+ the
+ <tt>password</tt> section of the file controls which PAM modules execute
+ during a password change. Set the <tt>pam_unix.so</tt> module in the
+ <tt>password</tt> section to include the argument <tt>sha512</tt>, as shown
+ below:
+ <br />
+ <pre>password sufficient pam_unix.so sha512 <i>other arguments...</i></pre>
+ <br />
+ This will help ensure when local users change their passwords, hashes for
+ the new passwords will be generated using the SHA-512 algorithm. This is
+ the default.
+
+rationale: |-
+ Passwords need to be protected at all times, and encryption is the standard
+ method for protecting passwords. If passwords are not encrypted, they can
+ be plainly read (i.e., clear text) and easily compromised. Passwords that
+ are encrypted with a weak algorithm are no more protected than if they are
+ kepy in plain text.
+ <br /><br />
+ This setting ensures user and group account administration utilities are
+ configured to store only encrypted representations of passwords.
+ Additionally, the <tt>crypt_style</tt> configuration option ensures the use
+ of a strong hashing algorithm that makes password cracking attacks more
+ difficult.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-85943-9
+ cce@rhel8: CCE-85945-4
+ cce@rhel9: CCE-85946-2
+
+references:
+ anssi: BP28(R32)
+ cis-csc: 1,12,15,16,5
+ cis@rhel7: 5.4.3
+ cis@rhel8: 5.4.4
+ cjis: 5.6.2.2
+ cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
+ cui: 3.13.11
+ disa: CCI-000196
+ isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
+ isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1'
+ ism: 0418,1055,1402
+ iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
+ nist: IA-5(c),IA-5(1)(c),CM-6(a)
+ nist-csf: PR.AC-1,PR.AC-6,PR.AC-7
+ pcidss: Req-8.2.1
+ srg: SRG-OS-000073-GPOS-00041
+ stigid@rhel7: RHEL-07-010200
+ stigid@rhel8: RHEL-08-010160
+ vmmsrg: SRG-OS-000480-VMM-002000
+
+ocil_clause: 'it does not'
+
+ocil: |-
+ Inspect the <tt>password</tt> section of <tt>/etc/pam.d/password-auth</tt>
+ and ensure that the <tt>pam_unix.so</tt> module includes the argument
+ <tt>sha512</tt>:
+ <pre>$ grep sha512 /etc/pam.d/password-auth</pre>
+
+platform: pam
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
new file mode 100644
index 00000000000..a924fe5bd97
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/correct.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
+ sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
+fi
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
new file mode 100644
index 00000000000..68e925a645f
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/tests/missing.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/sha512//g" "/etc/pam.d/password-auth"
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
index 542ea521a6c..e7503feeecb 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
@@ -1,7 +1,9 @@
-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
index d76b6f80c0c..a754a84df6c 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
@@ -3,6 +3,9 @@
{{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.") }}}
<criteria operator="AND">
<criterion test_ref="test_pam_unix_sha512" />
+ {{%- if product == "rhel7" %}}
+ <extend_definition comment="check /etc/pam.d/password-auth for correct settings" definition_ref="set_password_hashing_algorithm_passwordauth" />
+ {{%- endif %}}
</criteria>
</definition>
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
index 13da9dd4086..59fb48e93b5 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
@@ -70,7 +70,7 @@ references:
stigid@ol7: OL07-00-010200
stigid@ol8: OL08-00-010160
stigid@rhel7: RHEL-07-010200
- stigid@rhel8: RHEL-08-010160
+ stigid@rhel8: RHEL-08-010159
stigid@sle12: SLES-12-010230
stigid@sle15: SLES-15-020170
vmmsrg: SRG-OS-000480-VMM-002000
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
index 7e481760670..fb9feec4d27 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh
@@ -1,7 +1,9 @@
#!/bin/bash
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
index 09bb82dd1d7..2f35381d475 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh
@@ -1,7 +1,9 @@
#!/bin/bash
AUTH_FILES[0]="/etc/pam.d/system-auth"
+{{%- if product == "rhel7" %}}
AUTH_FILES[1]="/etc/pam.d/password-auth"
+{{%- endif %}}
for pamFile in "${AUTH_FILES[@]}"
do
diff --git a/products/rhel8/profiles/pci-dss.profile b/products/rhel8/profiles/pci-dss.profile
index 3ada8e6fe49..4df21f4ae6e 100644
--- a/products/rhel8/profiles/pci-dss.profile
+++ b/products/rhel8/profiles/pci-dss.profile
@@ -126,6 +126,7 @@ selections:
- service_pcscd_enabled
- sssd_enable_smartcards
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- file_owner_etc_shadow
diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile
index 15abd98a6a5..7188062df72 100644
--- a/products/rhel8/profiles/rht-ccp.profile
+++ b/products/rhel8/profiles/rht-ccp.profile
@@ -54,6 +54,7 @@ selections:
- accounts_password_pam_difok
- accounts_passwords_pam_faillock_deny
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- require_singleuser_auth
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 04f158116ee..8d69bb48d38 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -149,6 +149,9 @@ selections:
# RHEL-08-010152
- require_emergency_target_auth
+ # RHEL-08-010159
+ - set_password_hashing_algorithm_passwordauth
+
# RHEL-08-010160
- set_password_hashing_algorithm_systemauth
diff --git a/products/rhel9/profiles/pci-dss.profile b/products/rhel9/profiles/pci-dss.profile
index beb1acda31d..1e4044f4e7e 100644
--- a/products/rhel9/profiles/pci-dss.profile
+++ b/products/rhel9/profiles/pci-dss.profile
@@ -123,6 +123,7 @@ selections:
- service_pcscd_enabled
- sssd_enable_smartcards
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- file_owner_etc_shadow
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 8f79b22e3e4..b9f557de030 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -150,6 +150,9 @@ selections:
# RHEL-08-010152
- require_emergency_target_auth
+ # RHEL-08-010159
+ - set_password_hashing_algorithm_passwordauth
+
# RHEL-08-010160
- set_password_hashing_algorithm_systemauth
diff --git a/products/rhv4/profiles/pci-dss.profile b/products/rhv4/profiles/pci-dss.profile
index c4ed0ec2d48..d00f44996d8 100644
--- a/products/rhv4/profiles/pci-dss.profile
+++ b/products/rhv4/profiles/pci-dss.profile
@@ -121,6 +121,7 @@ selections:
- service_pcscd_enabled
- sssd_enable_smartcards
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
- file_owner_etc_shadow
diff --git a/products/rhv4/profiles/rhvh-stig.profile b/products/rhv4/profiles/rhvh-stig.profile
index 01c2fd8cc2d..9cf416665ab 100644
--- a/products/rhv4/profiles/rhvh-stig.profile
+++ b/products/rhv4/profiles/rhvh-stig.profile
@@ -356,6 +356,7 @@ selections:
- set_password_hashing_algorithm_libuserconf
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- package_opensc_installed
- var_smartcard_drivers=cac
- configure_opensc_card_drivers
diff --git a/products/rhv4/profiles/rhvh-vpp.profile b/products/rhv4/profiles/rhvh-vpp.profile
index c2b6c106937..e66fe435508 100644
--- a/products/rhv4/profiles/rhvh-vpp.profile
+++ b/products/rhv4/profiles/rhvh-vpp.profile
@@ -201,6 +201,7 @@ selections:
- accounts_password_pam_unix_remember
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_systemauth
+ - set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_libuserconf
- no_empty_passwords
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 3f6ec5e17c4..4aa925037b1 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -53,9 +53,6 @@ CCE-85939-7
CCE-85940-5
CCE-85941-3
CCE-85942-1
-CCE-85943-9
-CCE-85945-4
-CCE-85946-2
CCE-85947-0
CCE-85948-8
CCE-85949-6
diff --git a/tests/data/profile_stability/rhel8/pci-dss.profile b/tests/data/profile_stability/rhel8/pci-dss.profile
index f58bcf91cf2..e235d492438 100644
--- a/tests/data/profile_stability/rhel8/pci-dss.profile
+++ b/tests/data/profile_stability/rhel8/pci-dss.profile
@@ -1,5 +1,9 @@
+title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
description: Ensures PCI-DSS v3.2.1 security configuration settings are applied.
-documentation_complete: true
+extends: null
+metadata:
+ SMEs:
+ - yuumasato
reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
selections:
- account_disable_post_pw_expiration
@@ -120,6 +124,7 @@ selections:
- service_pcscd_enabled
- set_password_hashing_algorithm_libuserconf
- set_password_hashing_algorithm_logindefs
+- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_set_idle_timeout
- sshd_set_keepalive_0
@@ -136,4 +141,8 @@ selections:
- var_multiple_time_servers=rhel
- var_sshd_set_keepalive=0
- var_smartcard_drivers=cac
-title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
+platforms: !!set {}
+cpe_names: !!set {}
+platform: null
+filter_rules: ''
+documentation_complete: true
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ed739e724f4..c5fcbf47de2 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -336,6 +337,7 @@ selections:
- service_systemd-coredump_disabled
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
+- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_disable_compression
- sshd_disable_empty_passwords
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 56c3fcb9f59..49ec4ae41ac 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -347,6 +348,7 @@ selections:
- service_systemd-coredump_disabled
- service_usbguard_enabled
- set_password_hashing_algorithm_logindefs
+- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_disable_compression
- sshd_disable_empty_passwords

397
SOURCES/scap-security-guide-0.1.61-rhel9_ospp_remove_kernel_rules-PR_8092.patch Normal file
View File

@ -0,0 +1,397 @@
From 742e103392746dac771663247d169cfe498ee658 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 21 Jan 2022 14:02:16 +0100
Subject: [PATCH 1/7] modify vsyscall rules according to rhel9 ospp
add references
make rules scored in th e profile
---
.../system/bootloader-grub2/grub2_vsyscall_argument/rule.yml | 1 +
.../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml | 3 +++
products/rhel9/profiles/ospp.profile | 4 ----
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
index 1dd26fea9b6..9f38a1c13b9 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
@@ -25,6 +25,7 @@ identifiers:
references:
disa: CCI-001084
nist: CM-7(a)
+ ospp: FPT_ASLR_EXT.1
srg: SRG-OS-000480-GPOS-00227,SRG-OS-000134-GPOS-00068
stigid@ol8: OL08-00-010422
stigid@rhel8: RHEL-08-010422
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
index 52b192ffc52..9d645c8876e 100644
--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
@@ -21,6 +21,9 @@ identifiers:
cce@rhel8: CCE-83381-4
cce@rhel9: CCE-84100-7
+references:
+ ospp: FPT_ASLR_EXT.1
+
ocil_clause: 'vsyscalls are enabled'
ocil: |-
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
index 287a28c43c5..f0b850a4ced 100644
--- a/products/rhel9/profiles/ospp.profile
+++ b/products/rhel9/profiles/ospp.profile
@@ -128,8 +128,6 @@ selections:
- grub2_slub_debug_argument
- grub2_page_poison_argument
- grub2_vsyscall_argument
- - grub2_vsyscall_argument.role=unscored
- - grub2_vsyscall_argument.severity=info
- grub2_pti_argument
- grub2_kernel_trust_cpu_rng
@@ -421,5 +419,3 @@ selections:
- zipl_slub_debug_argument
- zipl_page_poison_argument
- zipl_vsyscall_argument
- - zipl_vsyscall_argument.role=unscored
- - zipl_vsyscall_argument.severity=info
From d167658d46accbc75200a5d145a746322f1c2d4a Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 21 Jan 2022 14:05:24 +0100
Subject: [PATCH 2/7] add ospp references to fips rules
---
.../software/integrity/fips/enable_dracut_fips_module/rule.yml | 1 +
.../system/software/integrity/fips/enable_fips_mode/rule.yml | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
index f342b9b8d95..3b7c3229b6f 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
+++ b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml
@@ -29,6 +29,7 @@ references:
ism: "1446"
nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12
+ ospp: FCS_RBG_EXT.1
srg: SRG-OS-000478-GPOS-00223
stigid@ol8: OL08-00-010020
stigid@rhel8: RHEL-08-010020
diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
index 7559e61600d..9d89114b07f 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml
@@ -39,7 +39,7 @@ references:
ism: "1446"
nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12
- ospp: FCS_COP.1(1),FCS_COP.1(2),FCS_COP.1(3),FCS_COP.1(4),FCS_CKM.1,FCS_CKM.2,FCS_TLSC_EXT.1
+ ospp: FCS_COP.1(1),FCS_COP.1(2),FCS_COP.1(3),FCS_COP.1(4),FCS_CKM.1,FCS_CKM.2,FCS_TLSC_EXT.1,FCS_RBG_EXT.1
srg: SRG-OS-000478-GPOS-00223,SRG-OS-000396-GPOS-00176
stigid@ol8: OL08-00-010020
stigid@rhel8: RHEL-08-010020
From f05e895bb96b64a5142e62e3dd0f7208633d5c23 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 21 Jan 2022 14:08:36 +0100
Subject: [PATCH 3/7] drop no longer needed rules from ospp rhel9 profile
---
products/rhel9/profiles/ospp.profile | 6 ------
1 file changed, 6 deletions(-)
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
index f0b850a4ced..7e30054bc98 100644
--- a/products/rhel9/profiles/ospp.profile
+++ b/products/rhel9/profiles/ospp.profile
@@ -125,11 +125,7 @@ selections:
## Boot prompt
- grub2_audit_argument
- grub2_audit_backlog_limit_argument
- - grub2_slub_debug_argument
- - grub2_page_poison_argument
- grub2_vsyscall_argument
- - grub2_pti_argument
- - grub2_kernel_trust_cpu_rng
## Security Settings
- sysctl_kernel_kptr_restrict
@@ -416,6 +412,4 @@ selections:
- zipl_bootmap_is_up_to_date
- zipl_audit_argument
- zipl_audit_backlog_limit_argument
- - zipl_slub_debug_argument
- - zipl_page_poison_argument
- zipl_vsyscall_argument
From 972ae269eff95de8a6914056d38e58b7aeafb8c3 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Fri, 21 Jan 2022 15:12:46 +0100
Subject: [PATCH 4/7] add grub2_init_on_alloc rule
---
.../grub2_init_on_alloc_argument/rule.yml | 46 +++++++++++++++++++
shared/references/cce-redhat-avail.txt | 1 -
2 files changed, 46 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
new file mode 100644
index 00000000000..592e2fb117d
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
@@ -0,0 +1,46 @@
+documentation_complete: true
+
+prodtype: rhel9
+
+title: 'Configure kernel to zero out memory before allocation (through Grub2)'
+
+description: |-
+ To configure the kernel to zero out memory before allocating it, add the
+ <tt>init_on_alloc=1</tt> argument to the default GRUB 2 command line for
+ the Linux operating system in <tt>/etc/default/grub</tt>, in the manner
+ below:
+ <pre>GRUB_CMDLINE_LINUX="crashkernel=auto quiet rd.shell=0 audit=1 audit_backlog_limit=8192 init_on_alloc=1"</pre>
+ Update the boot parameter for existing kernels by running the following command:
+ <pre># grubby --update-kernel=ALL --args="init_on_alloc=1"</pre>
+
+rationale: |-
+ When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
+ all page allocator and slab allocator memory will be zeroed when allocated,
+ eliminating many kinds of "uninitialized heap memory" flaws, effectively
+ preventing data leaks.
+
+severity: medium
+
+identifiers:
+ cce@rhel9: CCE-85867-0
+
+ocil_clause: 'the kernel is not configured to zero out memory before allocation'
+
+ocil: |-
+ Make sure that the kernel is configured to zero out memory before
+ allocation. Ensure that the parameter is configured in
+ <tt>/etc/default/grub</tt>:
+ <pre>grep GRUB_CMDLINE_LINUX /etc/default/grub</pre>
+ The output should contain <tt>init_on_alloc=1</tt>.
+ Run the following command to display command line parameters of all
+ installed kernels:
+ <pre># grubby --info=ALL | grep args</pre>
+ Ensure that each line contains the <tt>init_on_alloc=1</tt> parameter.
+
+platform: machine
+
+template:
+ name: grub2_bootloader_argument
+ vars:
+ arg_name: init_on_alloc
+ arg_value: '1'
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 8aad24b20f7..6835189cd99 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -1,4 +1,3 @@
-CCE-85867-0
CCE-85868-8
CCE-85872-0
CCE-85873-8
From a865514257c85d79aaf7e4286d8723aa1ad8de03 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Mon, 24 Jan 2022 10:01:23 +0100
Subject: [PATCH 5/7] add zipl_init_on_alloc_argument rule
---
.../zipl_init_on_alloc_argument/rule.yml | 41 +++++++++++++++++++
.../tests/correct_option.pass.sh | 15 +++++++
.../tests/missing_in_cmdline.fail.sh | 13 ++++++
.../tests/missing_in_entry.fail.sh | 13 ++++++
shared/references/cce-redhat-avail.txt | 1 -
5 files changed, 82 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
new file mode 100644
index 00000000000..b47a7757327
--- /dev/null
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
@@ -0,0 +1,41 @@
+documentation_complete: true
+
+prodtype: rhel9
+
+title: 'Configure kernel to zero out memory before allocation (through zIPl)'
+
+description: |-
+ To ensure that the kernel is configured to zero out memory before
+ allocation, check that all boot entries in
+ <tt>/boot/loader/entries/*.conf</tt> have <tt>init_on_alloc=1</tt>
+ included in its options.<br />
+
+ To ensure that new kernels and boot entries continue to zero out memory
+ before allocation, add <tt>init_on_alloc=1</tt> to <tt>/etc/kernel/cmdline</tt>.
+
+rationale: |-
+ When the kernel configuration option <tt>init_on_alloc</tt> is enabled,
+ all page allocator and slab allocator memory will be zeroed when allocated,
+ eliminating many kinds of "uninitialized heap memory" flaws, effectively
+ preventing data leaks.
+
+severity: medium
+
+identifiers:
+ cce@rhel9: CCE-85868-8
+
+ocil_clause: 'the kernel is not configured to zero out memory before allocation'
+
+ocil: |-
+ To check that the kernel is configured to zero out memory before allocation
+ time, check all boot entries with following command:
+ <pre>sudo grep -L"^options\s+.*\binit_on_alloc=1\b" /boot/loader/entries/*.conf</pre>
+ No line should be returned, each line returned is a boot entry that doesn't enable audit.
+
+platform: machine
+
+template:
+ name: zipl_bls_entries_option
+ vars:
+ arg_name: init_on_alloc
+ arg_value: '1'
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
new file mode 100644
index 00000000000..50cf1b78f70
--- /dev/null
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/correct_option.pass.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
+
+# Make sure boot loader entries contain init_on_alloc=1
+for file in /boot/loader/entries/*.conf
+do
+ if ! grep -q '^options.*init_on_alloc=1.*$' "$file" ; then
+ sed -i '/^options / s/$/ init_on_alloc=1/' "$file"
+ fi
+done
+
+# Make sure /etc/kernel/cmdline contains init_on_alloc=1
+if ! grep -qs '^(.*\s)?init_on_alloc=1(\s.*)?$' /etc/kernel/cmdline ; then
+ echo "init_on_alloc=1" >> /etc/kernel/cmdline
+fi
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
new file mode 100644
index 00000000000..7c0d9154776
--- /dev/null
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_cmdline.fail.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
+
+# Make sure boot loader entries contain init_on_alloc=1
+for file in /boot/loader/entries/*.conf
+do
+ if ! grep -q '^options.*init_on_alloc=1.*$' "$file" ; then
+ sed -i '/^options / s/$/ init_on_alloc=1/' "$file"
+ fi
+done
+
+# Make sure /etc/kernel/cmdline doesn't contain init_on_alloc=1
+sed -Ei 's/(^.*)init_on_alloc=1(.*?)$/\1\2/' /etc/kernel/cmdline || true
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
new file mode 100644
index 00000000000..9d330c9192d
--- /dev/null
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/tests/missing_in_entry.fail.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
+
+# Remove init_on_alloc=1 from all boot entries
+sed -Ei 's/(^options.*\s)init_on_alloc=1(.*?)$/\1\2/' /boot/loader/entries/*
+# But make sure one boot loader entry contains init_on_alloc=1
+sed -i '/^options / s/$/ init_on_alloc=1/' /boot/loader/entries/*rescue.conf
+sed -Ei 's/(^options.*\s)\$kernelopts(.*?)$/\1\2/' /boot/loader/entries/*rescue.conf
+
+# Make sure /etc/kernel/cmdline contains init_on_alloc=1
+if ! grep -qs '^(.*\s)?init_on_alloc=1(\s.*)?$' /etc/kernel/cmdline ; then
+ echo "init_on_alloc=1" >> /etc/kernel/cmdline
+fi
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 6835189cd99..05a641aeaf0 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -1,4 +1,3 @@
-CCE-85868-8
CCE-85872-0
CCE-85873-8
CCE-85874-6
From 9ca5ec04e734941b1c401369b6da6672b42824b1 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Mon, 24 Jan 2022 10:07:24 +0100
Subject: [PATCH 6/7] add new rules to rhel9 ospp
---
products/rhel9/profiles/ospp.profile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
index 7e30054bc98..28c7e92d298 100644
--- a/products/rhel9/profiles/ospp.profile
+++ b/products/rhel9/profiles/ospp.profile
@@ -126,6 +126,7 @@ selections:
- grub2_audit_argument
- grub2_audit_backlog_limit_argument
- grub2_vsyscall_argument
+ - grub2_init_on_alloc_argument
## Security Settings
- sysctl_kernel_kptr_restrict
@@ -413,3 +414,4 @@ selections:
- zipl_audit_argument
- zipl_audit_backlog_limit_argument
- zipl_vsyscall_argument
+ - zipl_init_on_alloc_argument
From 42a118bcc615051ae4cd268a5fc758aa5d75108d Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 27 Jan 2022 14:08:20 +0100
Subject: [PATCH 7/7] make rule names consistent
---
.../bootloader-grub2/grub2_init_on_alloc_argument/rule.yml | 2 +-
.../system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
index 592e2fb117d..a9253c74cc6 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml
@@ -2,7 +2,7 @@ documentation_complete: true
prodtype: rhel9
-title: 'Configure kernel to zero out memory before allocation (through Grub2)'
+title: 'Configure kernel to zero out memory before allocation'
description: |-
To configure the kernel to zero out memory before allocating it, add the
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
index b47a7757327..fa272250a28 100644
--- a/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
+++ b/linux_os/guide/system/bootloader-zipl/zipl_init_on_alloc_argument/rule.yml
@@ -2,7 +2,7 @@ documentation_complete: true
prodtype: rhel9
-title: 'Configure kernel to zero out memory before allocation (through zIPl)'
+title: 'Configure kernel to zero out memory before allocation in zIPL'
description: |-
To ensure that the kernel is configured to zero out memory before

155
SOURCES/scap-security-guide-0.1.61-selinux_state_rhel8_anssi_enhanced-PR_8182.patch Normal file
View File

@ -0,0 +1,155 @@
diff --git a/controls/anssi.yml b/controls/anssi.yml
index ff3736711dd..5c3d5f34ea8 100644
--- a/controls/anssi.yml
+++ b/controls/anssi.yml
@@ -72,6 +72,7 @@ controls:
SELinux policies limit the privileges of services and daemons to only what they require.
rules:
- selinux_state
+ - var_selinux_state=enforcing
- id: R4
levels:
diff --git a/products/rhel8/profiles/anssi_bp28_enhanced.profile b/products/rhel8/profiles/anssi_bp28_enhanced.profile
index 2a49527c10a..8f2ee31493b 100644
--- a/products/rhel8/profiles/anssi_bp28_enhanced.profile
+++ b/products/rhel8/profiles/anssi_bp28_enhanced.profile
@@ -17,4 +17,3 @@ description: |-
selections:
- anssi:all:enhanced
- - '!selinux_state'
diff --git a/products/rhel9/profiles/anssi_bp28_enhanced.profile b/products/rhel9/profiles/anssi_bp28_enhanced.profile
index 89e0d260390..da048c9b556 100644
--- a/products/rhel9/profiles/anssi_bp28_enhanced.profile
+++ b/products/rhel9/profiles/anssi_bp28_enhanced.profile
@@ -17,4 +17,3 @@ description: |-
selections:
- anssi:all:enhanced
- - '!selinux_state'
diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
index 2e60ec43532..b201c495b8d 100644
--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
@@ -42,3 +42,29 @@ controls:
rules:
- var_password_pam_minlen=2
- var_some_variable=3
+
+ # S5, S6 and S7 are used to test if level inheritance is working corectly
+ # when multiple levels select the same rule
+ - id: S5
+ title: Default Crypto Policy
+ levels:
+ - low
+ rules:
+ - configure_crypto_policy
+ - var_system_crypto_policy=default_policy
+
+ - id: S6
+ title: FIPS Crypto Policy
+ levels:
+ - medium
+ rules:
+ - configure_crypto_policy
+ - var_system_crypto_policy=fips
+
+ - id: S7
+ title: Future Crypto Policy
+ levels:
+ - high
+ rules:
+ - configure_crypto_policy
+ - var_system_crypto_policy=future
diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
index d3d6280042a..fb569280736 100644
--- a/tests/unit/ssg-module/test_controls.py
+++ b/tests/unit/ssg-module/test_controls.py
@@ -92,6 +92,20 @@ def test_controls_levels():
c_4b = controls_manager.get_control("abcd-levels", "S4.b")
assert c_4b.levels == ["high"]
+ c_5 = controls_manager.get_control("abcd-levels", "S5")
+ assert c_5.levels == ["low"]
+
+ c_6 = controls_manager.get_control("abcd-levels", "S6")
+ assert c_6.levels == ["medium"]
+
+ c_7 = controls_manager.get_control("abcd-levels", "S7")
+ assert c_7.levels == ["high"]
+
+ # test if all crypto-policy controls have the rule selected
+ assert "configure_crypto_policy" in c_5.selections
+ assert "configure_crypto_policy" in c_6.selections
+ assert "configure_crypto_policy" in c_7.selections
+
# just the essential controls
low_controls = controls_manager.get_all_controls_of_level(
"abcd-levels", "low")
@@ -104,25 +118,34 @@ def test_controls_levels():
assert len(high_controls) == len(all_controls)
assert len(low_controls) <= len(high_controls)
- assert len(low_controls) == 4
- assert len(medium_controls) == 5
+ assert len(low_controls) == 5
+ assert len(medium_controls) == 7
# test overriding of variables in levels
assert c_2.variables["var_password_pam_minlen"] == "1"
assert "var_password_pam_minlen" not in c_3.variables.keys()
assert c_4b.variables["var_password_pam_minlen"] == "2"
+ variable_found = False
for c in low_controls:
if "var_password_pam_minlen" in c.variables.keys():
+ variable_found = True
assert c.variables["var_password_pam_minlen"] == "1"
+ assert variable_found
+ variable_found = False
for c in medium_controls:
if "var_password_pam_minlen" in c.variables.keys():
+ variable_found = True
assert c.variables["var_password_pam_minlen"] == "1"
+ assert variable_found
+ variable_found = False
for c in high_controls:
if "var_password_pam_minlen" in c.variables.keys():
+ variable_found = True
assert c.variables["var_password_pam_minlen"] == "2"
+ assert variable_found
# now test if controls of lower level has the variable definition correctly removed
# because it is overriden by higher level controls
@@ -141,6 +164,28 @@ def test_controls_levels():
assert s2_low[0].variables["var_some_variable"] == "1"
assert s2_low[0].variables["var_password_pam_minlen"] == "1"
+ # check that low, medium and high levels have crypto policy selected
+ s5_low = [c for c in low_controls if c.id == "S5"]
+ assert len(s5_low) == 1
+ assert "configure_crypto_policy" in s5_low[0].selections
+
+ s5_medium = [c for c in medium_controls if c.id == "S5"]
+ assert len(s5_medium) == 1
+ assert "configure_crypto_policy" in s5_medium[0].selections
+ s6_medium = [c for c in medium_controls if c.id == "S6"]
+ assert len(s6_medium) == 1
+ assert "configure_crypto_policy" in s6_medium[0].selections
+
+ s5_high = [c for c in high_controls if c.id == "S5"]
+ assert len(s5_high) == 1
+ assert "configure_crypto_policy" in s5_high[0].selections
+ s6_high = [c for c in high_controls if c.id == "S6"]
+ assert len(s6_high) == 1
+ assert "configure_crypto_policy" in s6_high[0].selections
+ s7_high = [c for c in high_controls if c.id == "S7"]
+ assert len(s7_high) == 1
+ assert "configure_crypto_policy" in s7_high[0].selections
+
def test_controls_load_product():
product_yaml = os.path.join(ssg_root, "products", "rhel8", "product.yml")

163
SOURCES/scap-security-guide-0.1.61-sudoers_timestamp_timeout-PR_8220.patch Normal file
View File

@ -0,0 +1,163 @@
From 573ae69742cf372d41da6c56a3051745326055cd Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 14 Feb 2022 15:54:37 +0100
Subject: [PATCH] Update RHEL-08-010385 to allow only one occurrence of config.
This configuration must appear at only one place so it doesn't get
overriden by a different file that can loaded on a different order and
the intended configuration is replaced by non-compliant value.
---
.../ansible/shared.yml | 36 ++++++++++++++++++
.../bash/shared.sh | 38 +++++++++++++++++++
.../oval/shared.xml | 4 +-
.../sudo_require_reauthentication/rule.yml | 14 +------
.../tests/multiple_correct_value.fail.sh | 10 +++++
5 files changed, 87 insertions(+), 15 deletions(-)
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
create mode 100644 linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
new file mode 100644
index 00000000000..b0c67a69af9
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/ansible/shared.yml
@@ -0,0 +1,36 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{{ ansible_instantiate_variables("var_sudo_timestamp_timeout") }}}
+- name: "Find out if /etc/sudoers.d/* files contain 'Defaults timestamp_timeout' to be deduplicated"
+ find:
+ path: "/etc/sudoers.d"
+ patterns: "*"
+ contains: '^[\s]*Defaults\s.*\btimestamp_timeout=.*'
+ register: sudoers_d_defaults_timestamp_timeout
+
+- name: "Remove found occurrences of 'Defaults timestamp_timeout' from /etc/sudoers.d/* files"
+ lineinfile:
+ path: "{{ item.path }}"
+ regexp: '^[\s]*Defaults\s.*\btimestamp_timeout=.*'
+ state: absent
+ with_items: "{{ sudoers_d_defaults_timestamp_timeout.files }}"
+
+- name: Ensure timestamp_timeout is enabled with the appropriate value in /etc/sudoers
+ lineinfile:
+ path: /etc/sudoers
+ regexp: '^[\s]*Defaults\s(.*)\btimestamp_timeout=[-]?\w+\b(.*)$'
+ line: 'Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2'
+ validate: /usr/sbin/visudo -cf %s
+ backrefs: yes
+ register: edit_sudoers_timestamp_timeout_option
+
+- name: Enable timestamp_timeout option with appropriate value in /etc/sudoers
+ lineinfile: # noqa 503
+ path: /etc/sudoers
+ line: 'Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}'
+ validate: /usr/sbin/visudo -cf %s
+ when: edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
new file mode 100644
index 00000000000..0b623ed4a49
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/bash/shared.sh
@@ -0,0 +1,38 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+
+{{{ bash_instantiate_variables("var_sudo_timestamp_timeout") }}}
+
+if grep -x '^[\s]*Defaults.*\btimestamp_timeout=.*' /etc/sudoers.d/*; then
+ find /etc/sudoers.d/ -type f -exec sed -i "/^[\s]*Defaults.*\btimestamp_timeout=.*/d" {} \;
+fi
+
+if /usr/sbin/visudo -qcf /etc/sudoers; then
+ cp /etc/sudoers /etc/sudoers.bak
+ if ! grep -P '^[\s]*Defaults.*\btimestamp_timeout=[-]?\w+\b\b.*$' /etc/sudoers; then
+ # sudoers file doesn't define Option timestamp_timeout
+ echo "Defaults timestamp_timeout=${var_sudo_timestamp_timeout}" >> /etc/sudoers
+ else
+ # sudoers file defines Option timestamp_timeout, remediate if appropriate value is not set
+ if ! grep -P "^[\s]*Defaults.*\btimestamp_timeout=${var_sudo_timestamp_timeout}\b.*$" /etc/sudoers; then
+
+ sed -Ei "s/(^[\s]*Defaults.*\btimestamp_timeout=)[-]?\w+(\b.*$)/\1${var_sudo_timestamp_timeout}\2/" /etc/sudoers
+ fi
+ fi
+
+ # Check validity of sudoers and cleanup bak
+ if /usr/sbin/visudo -qcf /etc/sudoers; then
+ rm -f /etc/sudoers.bak
+ else
+ echo "Fail to validate remediated /etc/sudoers, reverting to original file."
+ mv /etc/sudoers.bak /etc/sudoers
+ false
+ fi
+else
+ echo "Skipping remediation, /etc/sudoers failed to validate"
+ false
+fi
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
index 8f404ca6065..dfc319b6f1f 100644
--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/oval/shared.xml
@@ -6,13 +6,13 @@
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check correct configuration in /etc/sudoers" id="test_sudo_timestamp_timeout" version="1">
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="check correct configuration in /etc/sudoers" id="test_sudo_timestamp_timeout" version="1">
<ind:object object_ref="obj_sudo_timestamp_timeout"/>
<ind:state state_ref="state_sudo_timestamp_timeout" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sudo_timestamp_timeout" version="1">
- <ind:filepath>/etc/sudoers</ind:filepath>
+ <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*Defaults[\s]+timestamp_timeout=([-]?[\d]+)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
index 42c6e28f9e6..eebb96678f1 100644
--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml
@@ -50,16 +50,4 @@ ocil: |-
<pre>sudo grep -ri '^Defaults.*timestamp_timeout' /etc/sudoers /etc/sudoers.d</pre>
The output should be:
<pre>/etc/sudoers:Defaults timestamp_timeout=0</pre> or "timestamp_timeout" is set to a positive number.
-
-template:
- name: sudo_defaults_option
- vars:
- option: timestamp_timeout
- variable_name: "var_sudo_timestamp_timeout"
- # optional minus char added so remediation can detect properly if item is already configured
- option_regex_suffix: '=[-]?\w+\b'
- backends:
- # Template is not able to accomodate this particular check.
- # It needs to check for an integer greater than or equal to zero
- oval: "off"
-
+ If results are returned from more than one file location, this is a finding.
diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
new file mode 100644
index 00000000000..a258d6632b5
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/tests/multiple_correct_value.fail.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+
+if grep -q 'timestamp_timeout' /etc/sudoers; then
+ sed -i 's/.*timestamp_timeout.*/Defaults timestamp_timeout=3/' /etc/sudoers
+else
+ echo "Defaults timestamp_timeout=3" >> /etc/sudoers
+fi
+
+echo "Defaults timestamp_timeout=3" > /etc/sudoers.d/00-complianceascode-test.conf

13
SOURCES/scap-security-guide-0.1.61-update_RHEL_08_010030-PR_8183.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
index e9d25a34fbd..13231dc2cc9 100644
--- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
+++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
@@ -90,6 +90,7 @@ ocil: |-
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
" TYPE="crypto_LUKS"</pre>
<br /><br />
- Pseudo-file systems, such as /proc, /sys, and tmpfs, are not required to use disk encryption and are not a finding.
+ The boot partition and pseudo-file systems, such as /proc, /sys, and tmpfs,
+ are not required to use disk encryption and are not a finding.
platform: machine

43
SOURCES/scap-security-guide-0.1.61-update_RHEL_08_010287-PR_8051.patch Normal file
View File

@ -0,0 +1,43 @@
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
index 395129acb66..60b0ce0eb7d 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
@@ -30,7 +30,7 @@ references:
nist: AC-17(a),AC-17(2),CM-6(a),MA-4(6),SC-13
srg: SRG-OS-000250-GPOS-00093
stigid@ol8: OL08-00-010020
- stigid@rhel8: RHEL-08-010020
+ stigid@rhel8: RHEL-08-010287
ocil_clause: 'the CRYPTO_POLICY variable is not set or is commented in the /etc/sysconfig/sshd'
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 04f158116ee..60eafa9c566 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -191,9 +191,7 @@ selections:
# RHEL-08-010260
- file_groupowner_var_log
- # *** SHARED *** #
- # RHEL-08-010290 && RHEL-08-010291
- # *** SHARED *** #
+ # RHEL-08-010287
- configure_ssh_crypto_policy
# RHEL-08-010290
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
index 8f79b22e3e4..9bd1a2b0f51 100644
--- a/products/rhel9/profiles/stig.profile
+++ b/products/rhel9/profiles/stig.profile
@@ -192,9 +192,7 @@ selections:
# RHEL-08-010260
- file_groupowner_var_log
- # *** SHARED *** #
- # RHEL-08-010290 && RHEL-08-010291
- # *** SHARED *** #
+ # RHEL-08-010287
- configure_ssh_crypto_policy
# RHEL-08-010290

146
SOURCES/scap-security-guide-0.1.61-update_RHEL_08_010383-PR_8138.patch Normal file
View File

@ -0,0 +1,146 @@
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
index 08ffd76aed6..399ca1ea3ce 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
@@ -4,6 +4,26 @@
# complexity = low
# disruption = low
-{{{ ansible_lineinfile(msg='Ensure that Defaults !targetpw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !targetpw', create='yes', state='present') }}}
-{{{ ansible_lineinfile(msg='Ensure that Defaults !rootpw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !rootpw', create='yes', state='present') }}}
-{{{ ansible_lineinfile(msg='Ensure that Defaults !runaspw is defined in sudoers', path='/etc/sudoers', new_line='Defaults !runaspw', create='yes', state='present') }}}
+{{%- macro delete_line_in_sudoers_d(line) %}}
+- name: "Find out if /etc/sudoers.d/* files contain {{{ line }}} to be deduplicated"
+ find:
+ path: "/etc/sudoers.d"
+ patterns: "*"
+ contains: '^{{{ line }}}$'
+ register: sudoers_d_defaults
+
+- name: "Remove found occurrences of {{{ line }}} from /etc/sudoers.d/* files"
+ lineinfile:
+ path: "{{ item.path }}"
+ regexp: "^{{{ line }}}$"
+ state: absent
+ with_items: "{{ sudoers_d_defaults.files }}"
+{{%- endmacro %}}
+
+{{{- delete_line_in_sudoers_d("Defaults !targetpw") }}}
+{{{- delete_line_in_sudoers_d("Defaults !rootpw") }}}
+{{{- delete_line_in_sudoers_d("Defaults !runaspw") }}}
+
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !targetpw is defined in sudoers', line_regex='^Defaults !targetpw$', path='/etc/sudoers', new_line='Defaults !targetpw') }}}
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !rootpw is defined in sudoers', line_regex='^Defaults !rootpw$', path='/etc/sudoers', new_line='Defaults !rootpw') }}}
+{{{ ansible_only_lineinfile(msg='Ensure that Defaults !runaspw is defined in sudoers', line_regex='^Defaults !runaspw$', path='/etc/sudoers', new_line='Defaults !runaspw') }}}
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
index ea0ac67fa1c..3b327f3fc88 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
@@ -1,5 +1,17 @@
# platform = multi_platform_all
+{{%- macro delete_line_in_sudoers_d(line) %}}
+if grep -x '^{{{line}}}$' /etc/sudoers.d/*; then
+ find /etc/sudoers.d/ -type f -exec sed -i "/{{{line}}}/d" {} \;
+fi
+{{%- endmacro %}}
+
+{{{- delete_line_in_sudoers_d("Defaults !targetpw") }}}
+{{{- delete_line_in_sudoers_d("Defaults !rootpw") }}}
+{{{- delete_line_in_sudoers_d("Defaults !runaspw") }}}
+
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !targetpw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !rootpw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
{{{ set_config_file(path="/etc/sudoers", parameter="Defaults !runaspw", value="", create=true, insensitive=false, separator="", separator_regex="", prefix_regex="") }}}
+
+
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
index 646e6bfb7c0..b3fadd53bee 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
@@ -8,17 +8,17 @@
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
id="test_sudoers_targetpw_config" version="1">
<ind:object object_ref="object_test_sudoers_targetpw_config" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
id="test_sudoers_rootpw_config" version="1">
<ind:object object_ref="object_test_sudoers_rootpw_config" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+ <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
id="test_sudoers_runaspw_config" version="1">
<ind:object object_ref="object_test_sudoers_runaspw_config" />
</ind:textfilecontent54_test>
@@ -26,19 +26,19 @@
<ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
<ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
<ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">
<ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
<ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
+ <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
index ccc29b77d15..698021d8fd0 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -42,7 +42,8 @@ ocil_clause: 'invoke user passwd when using sudo'
ocil: |-
Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
<pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
- If no results are returned, this is a finding
+ If no results are returned, this is a finding.
+ If results are returned from more than one file location, this is a finding.
If "Defaults !targetpw" is not defined, this is a finding.
If "Defaults !rootpw" is not defined, this is a finding.
If "Defaults !runaspw" is not defined, this is a finding.
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh
new file mode 100644
index 00000000000..a258d108a00
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.fail.sh
@@ -0,0 +1,9 @@
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15
+# packages = sudo
+
+echo 'Defaults !targetpw' >> /etc/sudoers
+echo 'Defaults !rootpw' >> /etc/sudoers
+echo 'Defaults !runaspw' >> /etc/sudoers
+echo 'Defaults !targetpw' >> /etc/sudoers.d/00-complianceascode.conf
+echo 'Defaults !rootpw' >> /etc/sudoers.d/00-complianceascode.conf
+echo 'Defaults !runaspw' >> /etc/sudoers.d/00-complianceascode.conf
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh
new file mode 100644
index 00000000000..6247b5230e4
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15
+# packages = sudo
+
+echo 'Defaults !targetpw' >> /etc/sudoers
+echo 'Defaults !rootpw' >> /etc/sudoers
+echo 'Defaults !runaspw' >> /etc/sudoers
+echo 'Defaults !runaspw' >> /etc/sudoers

300
SOURCES/scap-security-guide-0.1.61-update_RHEL_08_020041-PR_8146.patch Normal file
View File

@ -0,0 +1,300 @@
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
index 737d725872d..08b62057bde 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
@@ -1,7 +1,11 @@
# platform = multi_platform_all
+# reboot = true
+# strategy = enable
+# complexity = low
+# disruption = low
if ! grep -x ' case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then
- cat >> /etc/bashrc <<'EOF'
+ cat >> /etc/profile.d/tmux.sh <<'EOF'
if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
index 00ac349e292..4cb2f9e0e04 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
@@ -4,21 +4,27 @@
<criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
<criterion comment="check tmux is configured to exec on the last line of /etc/bashrc"
test_ref="test_configure_bashrc_exec_tmux" />
+ <criterion comment="check tmux is running" test_ref="test_tmux_running"/>
</criteria>
</definition>
- <ind:textfilecontent54_test check="only one" check_existence="only_one_exists"
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="check tmux is configured to exec on the last line of /etc/bashrc"
id="test_configure_bashrc_exec_tmux" version="1">
<ind:object object_ref="obj_configure_bashrc_exec_tmux" />
- <ind:state state_ref="state_configure_bashrc_exec_tmux" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_configure_bashrc_exec_tmux" version="1">
<ind:behaviors singleline="true" multiline="false" />
- <ind:filepath>/etc/bashrc</ind:filepath>
- <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
+ <ind:filepath operation="pattern match">^/etc/bashrc$|^/etc/profile\.d/.*$</ind:filepath>
+ <ind:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
- <ind:textfilecontent54_state id="state_configure_bashrc_exec_tmux" version="1">
- <ind:subexpression datatype="string" operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:subexpression>
- </ind:textfilecontent54_state>
+
+ <unix:process58_test check="all" id="test_tmux_running" comment="is tmux running" version="1">
+ <unix:object object_ref="obj_tmux_running"/>
+ </unix:process58_test>
+
+ <unix:process58_object id="obj_tmux_running" version="1">
+ <unix:command_line operation="pattern match">^tmux(?:|[\s]+.*)$</unix:command_line>
+ <unix:pid datatype="int" operation="greater than">0</unix:pid>
+ </unix:process58_object>
</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
index 3ba0f4a2d8f..7afc5fc5e6b 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml
@@ -7,12 +7,20 @@ title: 'Support session locking with tmux'
description: |-
The <tt>tmux</tt> terminal multiplexer is used to implement
automatic session locking. It should be started from
- <tt>/etc/bashrc</tt>.
+ <tt>/etc/bashrc</tt> or drop-in files within <tt>/etc/profile.d/</tt>.
+ Additionally it must be ensured that the <tt>tmux</tt> process is running
+ and it can be verified with the following command:
+ <pre>ps all | grep tmux | grep -v grep</pre>
rationale: |-
Unlike <tt>bash</tt> itself, the <tt>tmux</tt> terminal multiplexer
provides a mechanism to lock sessions after period of inactivity.
+warnings:
+ - general: |-
+ The remediation does not start the tmux process, so it must be
+ manually started or have the system rebooted after applying the fix.
+
severity: medium
identifiers:
@@ -26,17 +34,21 @@ references:
stigid@ol8: OL08-00-020041
stigid@rhel8: RHEL-08-020041
-ocil_clause: 'exec tmux is not present at the end of bashrc'
+ocil_clause: 'exec tmux is not present at the end of bashrc or tmux process is not running'
ocil: |-
To verify that tmux is configured to execute,
run the following command:
- <pre>$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc</pre>
+ <pre>$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc /etc/profile.d/*</pre>
The output should return the following:
<pre>if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
case "$name" in sshd|login) exec tmux ;; esac
fi</pre>
+ To verify that the tmux process is running,
+ run the following command:
+ <pre>ps all | grep tmux | grep -v grep</pre>
+ If the command does not produce output, this is a finding.
platform: machine
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
new file mode 100644
index 00000000000..221c18665ef
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+# packages = tmux
+
+cat >> /etc/bashrc <<'EOF'
+if [ "$PS1" ]; then
+ parent=$(ps -o ppid= -p $$)
+ name=$(ps -o comm= -p $parent)
+ case "$name" in sshd|login) exec tmux ;; esac
+fi
+EOF
+
+tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
new file mode 100644
index 00000000000..1702bb17e79
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# packages = tmux
+
+
+cat >> /etc/profile.d/00-complianceascode.conf <<'EOF'
+if [ "$PS1" ]; then
+ parent=$(ps -o ppid= -p $$)
+ name=$(ps -o comm= -p $parent)
+ case "$name" in sshd|login) exec tmux ;; esac
+fi
+EOF
+
+tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
new file mode 100644
index 00000000000..16d4acfcb5a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# packages = tmux
+
+cat >> /etc/profile.d/00-complianceascode.conf <<'EOF'
+if [ "$PS1" ]; then
+ parent=$(ps -o ppid= -p $$)
+ name=$(ps -o comm= -p $parent)
+ case "$name" in sshd|login) exec tmux ;; esac
+fi
+EOF
+
+cat >> /etc/bashrc <<'EOF'
+if [ "$PS1" ]; then
+ parent=$(ps -o ppid= -p $$)
+ name=$(ps -o comm= -p $parent)
+ case "$name" in sshd|login) exec tmux ;; esac
+fi
+EOF
+
+tmux new-session -s root -d
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
new file mode 100644
index 00000000000..6cb9d83efc5
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/tmux_not_running.fail.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# packages = tmux
+# remediation = none
+
+cat >> /etc/bashrc <<'EOF'
+if [ "$PS1" ]; then
+ parent=$(ps -o ppid= -p $$)
+ name=$(ps -o comm= -p $parent)
+ case "$name" in sshd|login) exec tmux ;; esac
+fi
+EOF
+
+killall tmux || true
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
new file mode 100644
index 00000000000..f13a8b038e4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/wrong_value.fail.sh
@@ -0,0 +1,105 @@
+#!/bin/bash
+# packages = tmux
+
+cat > /etc/bashrc <<'EOF'
+# /etc/bashrc
+
+# System wide functions and aliases
+# Environment stuff goes in /etc/profile
+
+# It's NOT a good idea to change this file unless you know what you
+# are doing. It's much better to create a custom.sh shell script in
+# /etc/profile.d/ to make custom changes to your environment, as this
+# will prevent the need for merging in future updates.
+
+# Prevent doublesourcing
+if [ -z "$BASHRCSOURCED" ]; then
+ BASHRCSOURCED="Y"
+
+ # are we an interactive shell?
+ if [ "$PS1" ]; then
+ if [ -z "$PROMPT_COMMAND" ]; then
+ case $TERM in
+ xterm*|vte*)
+ if [ -e /etc/sysconfig/bash-prompt-xterm ]; then
+ PROMPT_COMMAND=/etc/sysconfig/bash-prompt-xterm
+ elif [ "${VTE_VERSION:-0}" -ge 3405 ]; then
+ PROMPT_COMMAND="__vte_prompt_command"
+ else
+ PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"'
+ fi
+ ;;
+ screen*)
+ if [ -e /etc/sysconfig/bash-prompt-screen ]; then
+ PROMPT_COMMAND=/etc/sysconfig/bash-prompt-screen
+ else
+ PROMPT_COMMAND='printf "\033k%s@%s:%s\033\\" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"'
+ fi
+ ;;
+ *)
+ [ -e /etc/sysconfig/bash-prompt-default ] && PROMPT_COMMAND=/etc/sysconfig/bash-prompt-default
+ ;;
+ esac
+ fi
+ # Turn on parallel history
+ shopt -s histappend
+ history -a
+ # Turn on checkwinsize
+ shopt -s checkwinsize
+ [ "$PS1" = "\\s-\\v\\\$ " ] && PS1="[\u@\h \W]\\$ "
+ # You might want to have e.g. tty in prompt (e.g. more virtual machines)
+ # and console windows
+ # If you want to do so, just add e.g.
+ # if [ "$PS1" ]; then
+ # PS1="[\u@\h:\l \W]\\$ "
+ # fi
+ # to your custom modification shell script in /etc/profile.d/ directory
+ fi
+
+ if ! shopt -q login_shell ; then # We're not a login shell
+ # Need to redefine pathmunge, it gets undefined at the end of /etc/profile
+ pathmunge () {
+ case ":${PATH}:" in
+ *:"$1":*)
+ ;;
+ *)
+ if [ "$2" = "after" ] ; then
+ PATH=$PATH:$1
+ else
+ PATH=$1:$PATH
+ fi
+ esac
+ }
+
+ # By default, we want umask to get set. This sets it for non-login shell.
+ # Current threshold for system reserved uid/gids is 200
+ # You could check uidgid reservation validity in
+ # /usr/share/doc/setup-*/uidgid file
+ if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then
+ umask 002
+ else
+ umask 022
+ fi
+
+ SHELL=/bin/bash
+ # Only display echos from profile.d scripts if we are no login shell
+ # and interactive - otherwise just process them to set envvars
+ for i in /etc/profile.d/*.sh; do
+ if [ -r "$i" ]; then
+ if [ "$PS1" ]; then
+ . "$i"
+ else
+ . "$i" >/dev/null
+ fi
+ fi
+ done
+
+ unset i
+ unset -f pathmunge
+ fi
+
+fi
+# vim:ts=4:sw=4
+EOF
+
+tmux new-session -s root -d

Some files were not shown because too many files have changed in this diff Show More