AlmaLinux changes

.gitignore

@@ -1,2 +1,2 @@
 SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
-SOURCES/scap-security-guide-0.1.54.tar.bz2
+SOURCES/scap-security-guide-0.1.57.tar.bz2

.scap-security-guide.metadata

@@ -1,2 +1,2 @@
 b22b45d29ad5a97020516230a6ef3140a91d050a SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
-9c53524d1f6741913b19394fad9216f25f3ae05d SOURCES/scap-security-guide-0.1.54.tar.bz2
+d78bdc956df4301c3b3bbb2f9f24d809d7b1d08c SOURCES/scap-security-guide-0.1.57.tar.bz2

SOURCES/disable-not-in-good-shape-profiles.patch

@@ -1,23 +1,7 @@
-From 48e959ebf2b892fefa642f19bc8cc1d2d639fb29 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Thu, 3 Dec 2020 14:35:47 +0100
-Subject: [PATCH] Disable profiles that are not in good shape for RHEL8
-
----
- rhel8/CMakeLists.txt                           | 6 ------
- rhel8/profiles/anssi_bp28_high.profile         | 2 +-
- rhel8/profiles/cjis.profile                    | 2 +-
- rhel8/profiles/ism_o.profile                   | 2 +-
- rhel8/profiles/rhelh-stig.profile              | 2 +-
- rhel8/profiles/rhelh-vpp.profile               | 2 +-
- rhel8/profiles/rht-ccp.profile                 | 2 +-
- rhel8/profiles/standard.profile                | 2 +-
- 11 files changed, 10 insertions(+), 16 deletions(-)
-
 diff --git a/rhel8/CMakeLists.txt b/rhel8/CMakeLists.txt
 index d61689c97..5e444a101 100644
---- a/rhel8/CMakeLists.txt
+--- a/products/rhel8/CMakeLists.txt
-+++ b/rhel8/CMakeLists.txt
++++ b/products/rhel8/CMakeLists.txt
 @@ -14,15 +14,9 @@ ssg_build_html_table_by_ref(${PRODUCT} "cis")
  ssg_build_html_table_by_ref(${PRODUCT} "pcidss")
  ssg_build_html_table_by_ref(${PRODUCT} "anssi")
@@ -34,70 +18,30 @@ index d61689c97..5e444a101 100644
  ssg_build_html_cce_table(${PRODUCT})
  
  ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE})
-diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
+diff --git a/products/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile
-index ccad93d67..6a854378c 100644
---- a/rhel8/profiles/anssi_bp28_high.profile
-+++ b/rhel8/profiles/anssi_bp28_high.profile
-@@ -1,4 +1,4 @@
--documentation_complete: true
-+documentation_complete: false
- 
- title: 'ANSSI BP-028 (high)'
- 
-diff --git a/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile
 index 035d2705b..c6475f33e 100644
---- a/rhel8/profiles/cjis.profile
+--- a/products/rhel8/profiles/cjis.profile
-+++ b/rhel8/profiles/cjis.profile
++++ b/products/rhel8/profiles/cjis.profile
 @@ -1,4 +1,4 @@
 -documentation_complete: true
 +documentation_complete: false
  
  metadata:
      version: 5.4
-diff --git a/rhel8/profiles/ism_o.profile b/rhel8/profiles/ism_o.profile
+diff --git a/products/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile
-index a3c427c01..4605dea3b 100644
---- a/rhel8/profiles/ism_o.profile
-+++ b/rhel8/profiles/ism_o.profile
-@@ -1,4 +1,4 @@
--documentation_complete: true
-+documentation_complete: false
- 
- metadata:
-     SMEs:
-diff --git a/rhel8/profiles/rhelh-stig.profile b/rhel8/profiles/rhelh-stig.profile
-index 1efca5f44..c3d0b0964 100644
---- a/rhel8/profiles/rhelh-stig.profile
-+++ b/rhel8/profiles/rhelh-stig.profile
-@@ -1,4 +1,4 @@
--documentation_complete: true
-+documentation_complete: false
- 
- title: '[DRAFT] DISA STIG for Red Hat Enterprise Linux Virtualization Host (RHELH)'
- 
-diff --git a/rhel8/profiles/rhelh-vpp.profile b/rhel8/profiles/rhelh-vpp.profile
-index 2baee6d66..8592d7aaf 100644
---- a/rhel8/profiles/rhelh-vpp.profile
-+++ b/rhel8/profiles/rhelh-vpp.profile
-@@ -1,4 +1,4 @@
--documentation_complete: true
-+documentation_complete: false
- 
- title: 'VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Enterprise Linux Hypervisor (RHELH)'
- 
-diff --git a/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile
 index c84579592..164ec98c4 100644
---- a/rhel8/profiles/rht-ccp.profile
+--- a/products/rhel8/profiles/rht-ccp.profile
-+++ b/rhel8/profiles/rht-ccp.profile
++++ b/products/rhel8/profiles/rht-ccp.profile
 @@ -1,4 +1,4 @@
 -documentation_complete: true
 +documentation_complete: false
  
  title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)'
  
-diff --git a/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile
+diff --git a/products/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile
 index a63ae2cf3..da669bb84 100644
---- a/rhel8/profiles/standard.profile
+--- a/products/rhel8/profiles/standard.profile
-+++ b/rhel8/profiles/standard.profile
++++ b/products/rhel8/profiles/standard.profile
 @@ -1,4 +1,4 @@
 -documentation_complete: true
 +documentation_complete: false

SOURCES/remove-ANSSI-high-ks.patch

@@ -1,187 +0,0 @@
-From 8e43a6a6432a8cbeb5742771ddbd0856669a7878 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 17 Feb 2021 15:36:59 +0100
-Subject: [PATCH] Remove kickstart for profile not shipped
-
-RHEL-8 ANSSI high is not shipped at the momment
----
- .../ssg-rhel8-anssi_bp28_high-ks.cfg          | 167 ------------------
- 1 file changed, 167 deletions(-)
- delete mode 100644 rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-deleted file mode 100644
-index b5c09253a..000000000
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-+++ /dev/null
-@@ -1,167 +0,0 @@
--# SCAP Security Guide ANSSI BP-028 (high) profile kickstart for Red Hat Enterprise Linux 8
--# Version: 0.0.1
--# Date: 2020-12-10
--#
--# Based on:
--# https://pykickstart.readthedocs.io/en/latest/
--# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
--
--# Specify installation method to use for installation
--# To use a different one comment out the 'url' one below, update
--# the selected choice with proper options & un-comment it
--#
--# Install from an installation tree on a remote server via FTP or HTTP:
--# --url		the URL to install from
--#
--# Example:
--#
--# url --url=http://192.168.122.1/image
--#
--# Modify concrete URL in the above example appropriately to reflect the actual
--# environment machine is to be installed in
--#
--# Other possible / supported installation methods:
--# * install from the first CD-ROM/DVD drive on the system:
--#
--# cdrom
--#
--# * install from a directory of ISO images on a local drive:
--#
--# harddrive --partition=hdb2 --dir=/tmp/install-tree
--#
--# * install from provided NFS server:
--#
--# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
--#
--# Set language to use during installation and the default language to use on the installed system (required)
--lang en_US.UTF-8
--
--# Set system keyboard type / layout (required)
--keyboard us
--
--# Configure network information for target system and activate network devices in the installer environment (optional)
--# --onboot	enable device at a boot time
--# --device	device to be activated and / or configured with the network command
--# --bootproto	method to obtain networking configuration for device (default dhcp)
--# --noipv6	disable IPv6 on this device
--#
--# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
--#       "--bootproto=static" must be used. For example:
--# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
--#
--network --onboot yes --bootproto dhcp --noipv6
--
--# Set the system's root password (required)
--# Plaintext password is: server
--# Refer to e.g.
--#   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
--# to see how to create encrypted password form for different plaintext password
--rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220
--
--# The selected profile will restrict root login
--# Add a user that can login and escalate privileges
--# Plaintext password is: admin123
--user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
--
--# Configure firewall settings for the system (optional)
--# --enabled	reject incoming connections that are not in response to outbound requests
--# --ssh		allow sshd service through the firewall
--firewall --enabled --ssh
--
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
--# Set the system time zone (required)
--timezone --utc America/New_York
--
--# Specify how the bootloader should be installed (required)
--# Plaintext password is: password
--# Refer to e.g.
--#   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
--# to see how to create encrypted password form for different plaintext password
--bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
--
--# Initialize (format) all disks (optional)
--zerombr
--
--# The following partition layout scheme assumes disk of size 20GB or larger
--# Modify size of partitions appropriately to reflect actual machine's hardware
--# 
--# Remove Linux partitions from the system prior to creating new ones (optional)
--# --linux	erase all Linux partitions
--# --initlabel	initialize the disk label to the default based on the underlying architecture
--clearpart --linux --initlabel
--
--# Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
--part pv.01 --grow --size=1
--
--# Create a Logical Volume Management (LVM) group (optional)
--volgroup VolGroup --pesize=4096 pv.01
--
--# Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
--# Ensure /usr Located On Separate Partition
--logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
--# Ensure /opt Located On Separate Partition
--logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /srv Located On Separate Partition
--logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /home Located On Separate Partition
--logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
--# Ensure /tmp Located On Separate Partition
--logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var/tmp Located On Separate Partition
--logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
--# Ensure /var/log Located On Separate Partition
--logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var/log/audit Located On Separate Partition
--logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec"
--logvol swap --name=swap --vgname=VolGroup --size=2016
--
--# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol)
--# content - security policies - on the installed system.This add-on has been enabled by default
--# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this 
--# functionality will automatically be installed. However, by default, no policies are enforced,
--# meaning that no checks are performed during or after installation unless specifically configured.
--#  
--#  Important
--#   Applying a security policy is not necessary on all systems. This screen should only be used
--#   when a specific policy is mandated by your organization rules or government regulations.
--#   Unlike most other commands, this add-on does not accept regular options, but uses key-value
--#   pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic.
--#   Values can be optionally enclosed in single quotes (') or double quotes (").
--#   
--#  The following keys are recognized by the add-on:
--#    content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide.
--#      - If the content-type is scap-security-guide, the add-on will use content provided by the
--#        scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect.
--#    content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location.
--#    datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream.
--#    xccdf-id - ID of the benchmark you want to use.
--#    xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive.
--#    profile - ID of the profile to be applied. Use default to apply the default profile.
--#    fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url.
--#    tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive.
--#
--#  The following is an example %addon org_fedora_oscap section which uses content from the
--#  scap-security-guide on the installation media: 
--%addon org_fedora_oscap
--	content-type = scap-security-guide
--	profile = xccdf_org.ssgproject.content_profile_anssi_bp28_high
--%end
--
--# Packages selection (%packages section is required)
--%packages
--
--# Require @Base
--@Base
--
--%end # End of %packages section
--
--# Reboot after the installation is complete (optional)
--# --eject	attempt to eject CD or DVD media before rebooting
--reboot --eject
--- 
-2.26.2
-

SOURCES/scap-security-guide-0.1.55-OL7_DISA_STIG_v2r2_update-PR_6607.patch

@@ -1,137 +0,0 @@
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-index 7da2e067a6..5d01170aab 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-@@ -33,6 +33,7 @@ references:
-     cis@sle12: 5.2.4
-     cis@sle15: 5.2.6
-     stigid@rhel7: RHEL-07-040710
-+    stigid@ol7: OL07-00-040710
-     srg: SRG-OS-000480-GPOS-00227
-     disa: CCI-000366
-     nist: CM-6(b)
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-index 87c3cb7f5a..5683676bfc 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-@@ -23,7 +23,6 @@ identifiers:
-     cce@sle12: CCE-83017-4
- 
- references:
--    stigid@ol7: OL07-00-040710
-     cui: 3.1.13
-     disa: CCI-000366
-     nist: CM-6(a),AC-17(a),AC-17(2)
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-index 50c7d689af..42cb32e30e 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: ol7,rhel7,rhel8,wrlinux1019,wrlinux8
-+prodtype: ol7,ol8,rhel7,rhel8,wrlinux1019,wrlinux8
- 
- title: 'Use Only FIPS 140-2 Validated Ciphers'
- 
-@@ -51,7 +51,6 @@ identifiers:
-     cce@rhel8: CCE-81032-5
- 
- references:
--    stigid@ol7: OL07-00-040110
-     cis: 5.2.10
-     cjis: 5.5.6
-     cui: 3.1.13,3.13.11,3.13.8
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml
-index 0751064179..73de17af35 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: rhel7
-+prodtype: ol7,rhel7
- 
- title: 'Use Only FIPS 140-2 Validated Ciphers'
- 
-@@ -32,6 +32,7 @@ references:
-     disa: CCI-000068,CCI-000366,CCI-000803,CCI-000877,CCI-002890,CCI-003123
-     srg: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174
-     stigid@rhel7: RHEL-07-040110
-+    stigid@ol7: OL07-00-040110
- 
- ocil_clause: 'FIPS ciphers are not configured or the enabled ciphers are not FIPS-approved'
- 
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-index c490756daf..13997f9418 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: ol7,rhel7,rhel8,sle12,wrlinux1019
-+prodtype: ol7,ol8,rhel7,rhel8,sle12,wrlinux1019
- 
- title: 'Use Only FIPS 140-2 Validated MACs'
- 
-@@ -46,7 +46,6 @@ identifiers:
-     cce@sle12: CCE-83036-4
- 
- references:
--    stigid@ol7: OL07-00-040400
-     cis: 5.2.12
-     cui: 3.1.13,3.13.11,3.13.8
-     disa: CCI-000068,CCI-000803,CCI-000877,CCI-001453,CCI-003123
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-index 88d2d77e14..bd597f0860 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: rhel7
-+prodtype: ol7,rhel7
- 
- title: 'Use Only FIPS 140-2 Validated MACs'
- 
-@@ -25,6 +25,7 @@ references:
-     disa: CCI-000068,CCI-000803,CCI-000877,CCI-001453,CCI-003123
-     srg: SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000394-GPOS-00174
-     stigid@rhel7: RHEL-07-040400
-+    stigid@ol7: OL07-00-040400
- 
- ocil_clause: 'MACs option is commented out or not using FIPS-approved hash algorithms'
- 
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-index 7267d2443a..b0fe065d86 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-@@ -26,6 +26,7 @@ identifiers:
- references:
-     srg: SRG-OS-000480-GPOS-00227
-     stig@rhel7: RHEL-07-040711
-+    stig@ol7: OL07-00-040711
-     disa: CCI-000366
-     nist: CM-6(b)
- 
-diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
-index 820a942220..dfcbbafd17 100644
---- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
-+++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
-@@ -36,4 +36,4 @@ ocil_clause: 'the group ownership is incorrect'
- ocil: |-
-     To verify the assigned home directory of all interactive users is group-
-     owned by that users primary GID, run the following command:
--    <pre>$ sudo ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)</pre>
-+    <pre># ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd)</pre>
-diff --git a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml
-index 7d5778d4f6..37cb36cda3 100644
---- a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml
-+++ b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml
-@@ -30,4 +30,4 @@ ocil_clause: 'the user ownership is incorrect'
- 
- ocil: |-
-     To verify the home directory ownership, run the following command:
--    <pre>$ sudo ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)</pre>
-+    <pre># ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd)</pre>
-

SOURCES/scap-security-guide-0.1.55-add_notes_and_rule_for_R35-PR_6548.patch

@@ -1,34 +0,0 @@
-From cb299dd0ce870d55cb530bc5e5ad9a9f52734bf4 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 19 Jan 2021 09:42:26 +0100
-Subject: [PATCH] Add metadata to ANSSI R35
-
-Current implementation cannot diferentiate between system and
-standard user umask, they are both set to the same value.
----
- controls/anssi.yml | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index dec9d68c99..621996e985 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -572,10 +572,18 @@ controls:
-       only be read by the user and his group, and be editable only by his owner).
-       The umask for users must be set to 0077 (any file created by a user is
-       readable and editable only by him).
-+    notes: >-
-+      There is no simple way to check and remediate different umask values for
-+      system and standard users reliably.
-+      The different values are set in a conditional clause in a shell script
-+      (e.g. /etc/profile or /etc/bashrc).
-+      The current implementation checks and fixes both umask to the same value.
-+    automated: partially
-     rules:
-     - var_accounts_user_umask=077
-     - accounts_umask_etc_login_defs
-     - accounts_umask_etc_profile
-+    - accounts_umask_etc_bashrc
- 
-   - id: R36
-     title: Rights to access sensitive content files

SOURCES/scap-security-guide-0.1.55-add_rule_sysctl_kernel_modules_disabled-PR_6533.patch

@@ -1,94 +0,0 @@
-From d5673795ba2f87ae1649c84591ee13d7876af0b2 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Wed, 13 Jan 2021 14:01:03 +0100
-Subject: [PATCH 1/3] add rule
-
----
- .../sysctl_kernel_modules_disabled/rule.yml   | 34 +++++++++++++++++++
- 1 file changed, 34 insertions(+)
- create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-
-diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-new file mode 100644
-index 0000000000..1811c43815
---- /dev/null
-+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-@@ -0,0 +1,34 @@
-+documentation_complete: true
-+
-+prodtype: fedora,ol8,rhel7,rhel8
-+
-+title: 'Disable loading and unloading of kernel modules'
-+
-+description: '{{{ describe_sysctl_option_value(sysctl="kernel.modules_disabled", value="1") }}}'
-+
-+rationale: |-
-+    Malicious kernel modules can have a significant impact on system security and
-+    availability. Disabling loading of kernel modules prevents this threat. Note
-+    that once this option has been set, it cannot be reverted without doing a
-+    system reboot. Make sure that all needed kernel modules are loaded before
-+    setting this option.
-+
-+severity: medium
-+
-+identifiers:
-+    cce@rhel7: CCE-83392-1
-+    cce@rhel8: CCE-83397-0
-+
-+references:
-+    anssi: BP28(R24)
-+
-+{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.modules_disabled", value="1") }}}
-+
-+platform: machine
-+
-+template:
-+    name: sysctl
-+    vars:
-+        sysctlvar: kernel.modules_disabled
-+        sysctlval: '1'
-+        datatype: int
-
-From 5e4f6a4a0b70c07488595080cfd98fdbfb02e352 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Wed, 13 Jan 2021 14:01:15 +0100
-Subject: [PATCH 2/3] add rule to anssi profile
-
----
- controls/anssi.yml | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index 9e2b899b6d..f435459af3 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -483,7 +483,8 @@ controls:
-       sysctl kernel.modules_disabledconf:
-       Prohibition of loading modules (except those already loaded to this point)
-       kernel.modules_disabled = 1
--    # rules: TBD
-+    rules:
-+    - sysctl_kernel_modules_disabled
- 
-   - id: R25
-     level: enhanced
-
-From a4a91fbb7f23854e4f80819a023c1adc4e7110c5 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Thu, 14 Jan 2021 09:30:01 +0100
-Subject: [PATCH 3/3] remove cces from pool
-
----
- shared/references/cce-redhat-avail.txt | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
-index 4dbec8255c..137d975a3d 100644
---- a/shared/references/cce-redhat-avail.txt
-+++ b/shared/references/cce-redhat-avail.txt
-@@ -1,5 +1,3 @@
--CCE-83392-1
--CCE-83397-0
- CCE-83398-8
- CCE-83399-6
- CCE-83404-4

SOURCES/scap-security-guide-0.1.55-add_rules_for_R18-PR_6539.patch

@@ -1,117 +0,0 @@
-From 2df02e3988525eee8360db1e829655a761adb461 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 19 Oct 2020 17:25:05 +0200
-Subject: [PATCH 1/2] var pam unix remember, add selector
-
-Add selector "2" to var_password_pam_unix_remember.
----
- .../accounts/accounts-pam/var_password_pam_unix_remember.var     | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/linux_os/guide/system/accounts/accounts-pam/var_password_pam_unix_remember.var b/linux_os/guide/system/accounts/accounts-pam/var_password_pam_unix_remember.var
-index f533a36963..6e7abb3b78 100644
---- a/linux_os/guide/system/accounts/accounts-pam/var_password_pam_unix_remember.var
-+++ b/linux_os/guide/system/accounts/accounts-pam/var_password_pam_unix_remember.var
-@@ -18,6 +18,7 @@ options:
-     "0": "0"
-     10: 10
-     24: 24
-+    2: 2
-     4: 4
-     5: 5
-     default: 5
-
-From 5503605d2f9e56b07686a9f1f2f3f8418e61b8cb Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 19 Oct 2020 17:29:47 +0200
-Subject: [PATCH 2/2] Select rules for password strenght management
-
-Rule selection is based on ANSSI DAT-NT-001
----
- controls/anssi.yml                            | 45 ++++++++++++++++++-
- .../var_password_pam_minlen.var               |  2 +
- ...ar_accounts_password_minlen_login_defs.var |  2 +
- 3 files changed, 48 insertions(+), 1 deletion(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index 26bc7f4694..3ccd0f8cb3 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -281,7 +281,50 @@ controls:
-   - id: R18
-     level: minimal
-     title: Administrator password robustness
--    # rules: TBD
-+    notes: >-
-+      The rules selected below establish a general password strength baseline of 100 bits,
-+      inspired by DAT-NT-001 and the "Password Strenght Calculator"
-+      (https://www.ssi.gouv.fr/administration/precautions-elementaires/calculer-la-force-dun-mot-de-passe/).
-+
-+      The baseline should be reviewed and tailored to the system's use case and needs.
-+    automated: partially
-+    rules:
-+    # Renew passwords every 90 days
-+    - var_accounts_maximum_age_login_defs=90
-+    - accounts_maximum_age_login_defs
-+
-+    # Ensure passwords with minimum of 18 characters
-+    - var_password_pam_minlen=18
-+    - accounts_password_pam_minlen
-+    # Enforce password lenght for new accounts
-+    - var_accounts_password_minlen_login_defs=18
-+    - accounts_password_minlen_login_defs
-+    # Require at Least 1 Special Character in Password
-+    - var_password_pam_ocredit=1
-+    - accounts_password_pam_ocredit
-+    # Require at Least 1 Numeric Character in Password
-+    - var_password_pam_dcredit=1
-+    - accounts_password_pam_dcredit
-+    # Require at Least 1 Uppercase Character in Password
-+    - var_password_pam_ucredit=1
-+    - accounts_password_pam_ucredit
-+    # Require at Least 1 Lowercase Character in Password
-+    - var_password_pam_lcredit=1
-+    - accounts_password_pam_lcredit
-+
-+    # Lock out users after 3 failed authentication attempts within 15 min
-+    - var_accounts_passwords_pam_faillock_fail_interval=900
-+    - accounts_passwords_pam_faillock_interval
-+    - var_accounts_passwords_pam_faillock_deny=3
-+    - accounts_passwords_pam_faillock_deny
-+    - accounts_passwords_pam_faillock_deny_root
-+    # Automatically unlock users after 15 min to prevent DoS
-+    - var_accounts_passwords_pam_faillock_unlock_time=900
-+    - accounts_passwords_pam_faillock_unlock_time
-+
-+    # Do not reuse last two passwords
-+    - var_password_pam_unix_remember=2
-+    - accounts_password_pam_unix_remember
- 
-   - id: R19
-     level: intermediary
-diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_minlen.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_minlen.var
-index f506a090bb..873d907ab9 100644
---- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_minlen.var
-+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_minlen.var
-@@ -15,6 +15,8 @@ options:
-     12: 12
-     14: 14
-     15: 15
-+    18: 18
-+    20: 20
-     6: 6
-     7: 7
-     8: 8
-diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_password_minlen_login_defs.var b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_password_minlen_login_defs.var
-index f41ff432ec..662c53b076 100644
---- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_password_minlen_login_defs.var
-+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_password_minlen_login_defs.var
-@@ -13,6 +13,8 @@ options:
-     12: 12
-     14: 14
-     15: 15
-+    18: 18
-+    20: 20
-     6: 6
-     8: 8
-     default: 15

SOURCES/scap-security-guide-0.1.55-add_rules_for_R37-PR_6540.patch

@@ -1,47 +0,0 @@
-From 76aede9cea67f4ea37eaa05ad74bf80273638de2 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 28 Oct 2020 18:52:13 +0100
-Subject: [PATCH] Select rules for ANSSI R37
-
-These rules are better fit for R37 than R38.
-R37 is about binaries designed to be used with setuid or setgid bits.
-R38 is about reducing number of binaries with setuid root.
----
- controls/anssi.yml | 17 ++++++++++++-----
- 1 file changed, 12 insertions(+), 5 deletions(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index 26bc7f4694..4648b98dff 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -590,8 +590,17 @@ controls:
- 
-   - id: R37
-     level: minimal
--    title: Executables with setuid and/or setgid bits
--    # rules: TBD
-+    title: Executables with setuid and setgid bits
-+    notes: >-
-+      Only programs specifically designed to be used with setuid or setgid bits can have these privilege bits set.
-+      This requirement considers apropriate for setuid and setgid bits the binaries that are installed from
-+      recognized and authorized repositories (covered in R15).
-+      The remediation resets the sticky bit to intended value by vendor/developer, any finding after remediation
-+      should be reviewed.
-+    automated: yes
-+    rules:
-+    - file_permissions_unauthorized_suid
-+    - file_permissions_unauthorized_sgid
- 
-   - id: R38
-     level: enhanced
-@@ -600,9 +609,7 @@ controls:
-       Setuid executables should be as small as possible. When it is expected
-       that only the administrators of the machine execute them, the setuid bit
-       must be removed and prefer them commands like su or sudo, which can be monitored
--    rules:
--    - file_permissions_unauthorized_suid
--    - file_permissions_unauthorized_sgid
-+    # rules: TBD
- 
-   - id: R39
-     level: intermediary

SOURCES/scap-security-guide-0.1.55-add_selector_for_R29-PR_6553.patch

@@ -1,37 +0,0 @@
-From 4d67a36c0a07ef8e07b8760b0e883bd42c0177ec Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Thu, 21 Jan 2021 11:04:05 +0100
-Subject: [PATCH] Add variable selector and notes for R29
-
----
- controls/anssi.yml | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index dec9d68c99..3303d70295 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -521,10 +521,22 @@ controls:
-     description: >-
-       Remote user sessions (shell access, graphical clients) must be closed
-       after a certain period of inactivity.
-+    notes: >-
-+      There is no specific capability to check remote user inactivity, but some shells allow the
-+      session inactivity time out to be configured via TMOUT variable.
-+      In OpenSSH < 8.2 the inactivity of the user is implied from the network inactivity.
-+      The server is configured to disconnect sessions if no data has been received within the idle timeout,
-+      regardless of liveness status (ClientAliveCountMax is 0 and ClientAliveInterval is > 0).
-+      In OpenSSH >= 8.2 there is no way to disconnect sessions based on client liveness.
-+      The semantics of "ClientAliveCountMax 0" has changed from "disconnect on first timeout" to
-+      "don't disconnect network inactive sessions". The server either probes for the client liveness
-+      or keeps inactive sessions connected.
-+    automated: yes
-     rules:
-     - accounts_tmout
-+    - var_accounts_tmout=10_min
-     - sshd_set_idle_timeout
--    - sshd_idle_timeout_value=5_minutes
-+    - sshd_idle_timeout_value=10_minutes
-     - sshd_set_keepalive
- 
-   - id: R30

SOURCES/scap-security-guide-0.1.55-add_sshd_x11_proxy_localhost-PR_6534.patch

@@ -1,106 +0,0 @@
-From 389d25be2b69e4e5c828d9b0b72573e0962cabb4 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Wed, 13 Jan 2021 17:07:48 +0100
-Subject: [PATCH 1/4] add rule
-
----
- .../sshd_x11_use_localhost/rule.yml           | 43 +++++++++++++++++++
- shared/references/cce-redhat-avail.txt        |  3 --
- 2 files changed, 43 insertions(+), 3 deletions(-)
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-new file mode 100644
-index 0000000000..67131e509c
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-@@ -0,0 +1,43 @@
-+documentation_complete: true
-+
-+prodtype: fedora,ol7,rhel7
-+
-+title: 'Prevent remote hosts from connecting to the proxy display'
-+
-+description: |-
-+    The SSH daemon should prevent remote hosts from connecting to the proxy
-+    display. Make sure that the option <tt>X11UseLocalhost</tt> is set to
-+    <tt>yes</tt> within the SSH server configuration file.
-+
-+
-+rationale: |-
-+    When X11 forwarding is enabled, there may be additional exposure to the
-+    server and client displays if the sshd proxy display is configured to listen
-+    on the wildcard address. By default, sshd binds the forwarding server to the
-+    loopback address and sets the hostname part of the <tt>DISPLAY</tt>
-+    environment variable to localhost. This prevents remote hosts from
-+    connecting to the proxy display.  
-+
-+severity: medium
-+
-+identifiers:
-+    cce@rhel7: CCE-83404-4
-+
-+references:
-+    srg: SRG-OS-000480-GPOS-00227
-+    stig@rhel7: RHEL-07-040711
-+    disa: CCI-000366
-+    nist: CM-6(b)
-+
-+ocil_clause: "the display proxy is listening on wildcard address"
-+
-+ocil: |-
-+    {{{ ocil_sshd_option(default="yes", option="X11UseLocalhost", value="yes") }}}
-+
-+template:
-+    name: sshd_lineinfile
-+    vars:
-+        missing_parameter_pass: 'false'
-+        parameter: X11UseLocalhost
-+        rule_id: sshd_x11_use_localhost
-+        value: 'yes'
-From a40b9e68305afb52c2c674848b71cbcaee25fe32 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Wed, 13 Jan 2021 17:08:08 +0100
-Subject: [PATCH 2/4] add rule to the stig profile
-
----
- rhel7/profiles/stig.profile | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
-index 88b50d5ef4..817e0982e5 100644
---- a/rhel7/profiles/stig.profile
-+++ b/rhel7/profiles/stig.profile
-@@ -286,6 +286,7 @@ selections:
-     - package_vsftpd_removed
-     - package_tftp-server_removed
-     - sshd_enable_x11_forwarding
-+    - sshd_x11_use_localhost
-     - tftpd_uses_secure_mode
-     - package_xorg-x11-server-common_removed
-     - xwindows_runlevel_target
-
-From be2f96b80fbfb74708381e15a2a6e76c3952bbb5 Mon Sep 17 00:00:00 2001
-From: vojtapolasek <krecoun@gmail.com>
-Date: Fri, 15 Jan 2021 07:46:09 +0100
-Subject: [PATCH 4/4] Update
- linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-
-Co-authored-by: Gabriel Becker <ggasparb@redhat.com>
----
- .../services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml     | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-index 67131e509c..7267d2443a 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
-@@ -37,7 +37,7 @@ ocil: |-
- template:
-     name: sshd_lineinfile
-     vars:
--        missing_parameter_pass: 'false'
-+        missing_parameter_pass: 'true'
-         parameter: X11UseLocalhost
-         rule_id: sshd_x11_use_localhost
-         value: 'yes'

SOURCES/scap-security-guide-0.1.55-add_sudoers_explicit_command_args-PR_6525.diff

@@ -1,196 +0,0 @@
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index 851993512..515a4a172 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -850,7 +850,8 @@ controls:
-   - id: R63
-     level: intermediary
-     title: Explicit arguments in sudo specifications
--    # rules: TBD
-+    rules:
-+    - sudoers_explicit_command_args
- 
-   - id: R64
-     level: intermediary
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/oval/shared.xml
-new file mode 100644
-index 000000000..94a0cb421
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/oval/shared.xml
-@@ -0,0 +1,25 @@
-+<def-group>
-+     <definition class="compliance" id="{{{ rule_id }}}" version="1">
-+     {{{ oval_metadata("Check that sudoers doesn't contain commands without arguments specified") }}}
-+     <criteria operator="AND">
-+	     <criterion comment="Make sure that no commands are without arguments" test_ref="test_{{{ rule_id }}}" />
-+     </criteria>
-+  </definition>
-+
-+  <ind:textfilecontent54_test check="all" check_existence="none_exist"
-+  comment="Make sure that no command in user spec is without any argument"
-+	  id="test_{{{ rule_id }}}" version="1">
-+  <ind:object object_ref="object_{{{ rule_id }}}" />
-+  </ind:textfilecontent54_test>
-+
-+  <ind:textfilecontent54_object id="object_{{{ rule_id }}}" version="1">
-+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
-+    <!-- The regex idea: <user list> <host list> = (<the whole command with at least an arg>,)* <command with no arg> <end of the line or next command spec we don't care about>
-+         where a command is <runas spec>?<anything except ,>+,
-+           - ',' is a command delimiter, while
-+         The last capturing group holds the offending command without args.
-+    -->
-+    <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind:pattern>
-+    <ind:instance datatype="int">1</ind:instance>
-+  </ind:textfilecontent54_object>
-+</def-group>
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/rule.yml b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/rule.yml
-new file mode 100644
-index 000000000..a0590c8b0
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/rule.yml
-@@ -0,0 +1,46 @@
-+documentation_complete: true
-+
-+title: "Explicit arguments in sudo specifications"
-+
-+description: |-
-+    All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user.
-+    If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.
-+
-+rationale: |-
-+    Any argument can modify quite significantly the behavior of a program, whether regarding the
-+    realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To
-+    avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the
-+    level of its specification.
-+
-+    For example, on some systems, the kernel messages are only accessible by root.
-+    If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted
-+    in order to prevent the user from flushing the buffer through the -c option:
-+    <pre>
-+    user ALL = dmesg ""
-+    </pre>
-+
-+severity: medium
-+
-+identifiers:
-+  cce@rhel7: CCE-83631-2
-+  cce@rhel8: CCE-83632-0
-+
-+references:
-+    anssi: BP28(R63)
-+
-+ocil_clause: '/etc/sudoers file contains user specifications that allow execution of commands with any arguments'
-+
-+ocil: |-
-+    To determine if arguments that commands can be executed with are restricted, run the following command:
-+    <pre>$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))' /etc/sudoers /etc/sudoers.d/</pre>
-+    The command should return no output.
-+
-+platform: sudo
-+
-+warnings:
-+  - general:
-+      This rule doesn't come with a remediation, as absence of arguments in the user spec doesn't mean that the command is intended to be executed with no arguments.
-+
-+  - general:
-+      The rule can produce false findings when an argument contains a comma - sudoers syntax allows comma escaping using backslash, but the check doesn't support that.
-+      For example, <code>root ALL=(ALL) echo 1\,2</code> allows root to execute <code>echo 1,2</code>, but the check would interpret it as two commands <code>echo 1\</code> and <code>2</code>.
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/commented.pass.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/commented.pass.sh
-new file mode 100644
-index 000000000..b0d05b2a5
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/commented.pass.sh
-@@ -0,0 +1,5 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+
-+echo '#jen,!fred		ALL, !SERVERS = !/bin/sh' > /etc/sudoers
-+echo '# somebody ALL=/bin/ls, (!bob,alice) !/bin/cat, /bin/dog' > /etc/sudoers.d/foo
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-1.fail.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-1.fail.sh
-new file mode 100644
-index 000000000..c6f885f9f
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-1.fail.sh
-@@ -0,0 +1,5 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+# remediation = none
-+
-+echo 'somebody ALL=/bin/ls, (!bob,alice) /bin/cat arg, /bin/dog' > /etc/sudoers
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-2.fail.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-2.fail.sh
-new file mode 100644
-index 000000000..fce851f55
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/complex-2.fail.sh
-@@ -0,0 +1,5 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+# remediation = none
-+
-+echo 'nobody ALL=/bin/ls, (!bob,alice) /bin/dog, /bin/cat arg' > /etc/sudoers
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/false_positive.fail.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/false_positive.fail.sh
-new file mode 100644
-index 000000000..baf66468d
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/false_positive.fail.sh
-@@ -0,0 +1,9 @@
-+# platform = multi_platform_all
-+# remediation = none
-+# packages = sudo
-+
-+# The val1\,val2 is the first argument of the /bin/dog command that contains a comma.
-+# Our check tends to interpret the comma as commad delimiter, so the dog arg is val1\
-+# and val2 is another command in the user spec.
-+echo 'nobody ALL=/bin/ls "", (!bob,alice) /bin/dog val1\,val2, /bin/cat ""' > /etc/sudoers
-+
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.fail.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.fail.sh
-new file mode 100644
-index 000000000..9a04a205a
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.fail.sh
-@@ -0,0 +1,5 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+# remediation = none
-+
-+echo 'jen,!fred		ALL,SERVERS = /bin/sh ' > /etc/sudoers
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.pass.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.pass.sh
-new file mode 100644
-index 000000000..4a3a7c94b
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/simple.pass.sh
-@@ -0,0 +1,6 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+
-+echo 'nobody ALL=/bin/ls "", (!bob,alice) /bin/dog arg, /bin/cat ""' > /etc/sudoers
-+echo 'jen,!fred		ALL,!SERVERS = /bin/sh arg' >> /etc/sudoers
-+echo 'nobody ALL=/bin/ls arg arg, (bob,!alice) /bin/dog arg, /bin/cat arg' > /etc/sudoers.d/foo
-diff --git a/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/sudoers_d.fail.sh b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/sudoers_d.fail.sh
-new file mode 100644
-index 000000000..9643a3337
---- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudoers_explicit_command_args/tests/sudoers_d.fail.sh
-@@ -0,0 +1,9 @@
-+# platform = multi_platform_all
-+# packages = sudo
-+# remediation = none
-+
-+echo 'nobody ALL=/bin/ls, (!bob,alice) /bin/dog arg, /bin/cat ""' > /etc/sudoers
-+echo 'jen,!fred		ALL,!SERVERS = /bin/sh arg' >> /etc/sudoers
-+echo 'nobody ALL=/bin/ls, (bob,!alice) /bin/dog arg, /bin/cat arg' > /etc/sudoers.d/foo
-+
-+echo 'user ALL = ALL' > /etc/sudoers.d/bar
-diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
-index 4dbec8255..94a116b59 100644
---- a/shared/references/cce-redhat-avail.txt
-+++ b/shared/references/cce-redhat-avail.txt
-@@ -140,8 +140,6 @@ CCE-83626-2
- CCE-83627-0
- CCE-83628-8
- CCE-83629-6
--CCE-83631-2
--CCE-83632-0
- CCE-83633-8
- CCE-83634-6
- CCE-83635-3

SOURCES/scap-security-guide-0.1.55-adjust_ks_partion_sizes-PR_6600.patch

@@ -1,213 +0,0 @@
-From afa3b348ed0af551967870f48334afbabecb89ab Mon Sep 17 00:00:00 2001
-From: Milan Lysonek <mlysonek@redhat.com>
-Date: Thu, 4 Feb 2021 09:43:51 +0100
-Subject: [PATCH] Extend /var partition to 3GB in rhel8 kickstarts
-
----
- rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg     | 4 ++--
- rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg         | 4 ++--
- rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg | 4 ++--
- rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg      | 4 ++--
- rhel8/kickstart/ssg-rhel8-cis-ks.cfg                     | 4 ++--
- rhel8/kickstart/ssg-rhel8-cui-ks.cfg                     | 4 ++--
- rhel8/kickstart/ssg-rhel8-ospp-ks.cfg                    | 4 ++--
- rhel8/kickstart/ssg-rhel8-pci-dss-ks.cfg                 | 4 ++--
- rhel8/kickstart/ssg-rhel8-stig-ks.cfg                    | 4 ++--
- 9 files changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-index 52af3ef47e..4e249f61e2 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-@@ -110,7 +110,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=4216 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
- # Ensure /usr Located On Separate Partition
- logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
- # Ensure /opt Located On Separate Partition
-@@ -124,7 +124,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-index 702f23d4dc..a1511b157a 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-@@ -110,7 +110,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=4216 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
- # Ensure /usr Located On Separate Partition
- logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
- # Ensure /opt Located On Separate Partition
-@@ -124,7 +124,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-index b875692944..981d291847 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-@@ -110,7 +110,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=4216 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
- # Ensure /usr Located On Separate Partition
- logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
- # Ensure /opt Located On Separate Partition
-@@ -124,7 +124,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-index 4a114aebb6..7fc4945518 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-@@ -110,7 +110,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=4216 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
- # Ensure /usr Located On Separate Partition
- logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
- # Ensure /opt Located On Separate Partition
-@@ -124,7 +124,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-cis-ks.cfg b/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
-index bf3804b3fa..ee3a20bcc2 100644
---- a/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
-@@ -109,7 +109,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
- # Ensure /home Located On Separate Partition
- logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # Ensure /tmp Located On Separate Partition
-@@ -117,7 +117,7 @@ logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptio
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048
-+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-cui-ks.cfg b/rhel8/kickstart/ssg-rhel8-cui-ks.cfg
-index 6e0f83ebb7..8e4b92584f 100644
---- a/rhel8/kickstart/ssg-rhel8-cui-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-cui-ks.cfg
-@@ -107,7 +107,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow
-+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow
- # Ensure /home Located On Separate Partition
- logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # Ensure /tmp Located On Separate Partition
-@@ -115,7 +115,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-ospp-ks.cfg b/rhel8/kickstart/ssg-rhel8-ospp-ks.cfg
-index 119e98364f..ec490c38ee 100644
---- a/rhel8/kickstart/ssg-rhel8-ospp-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-ospp-ks.cfg
-@@ -107,7 +107,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow
-+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow
- # Ensure /home Located On Separate Partition
- logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # Ensure /tmp Located On Separate Partition
-@@ -115,7 +115,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-pci-dss-ks.cfg b/rhel8/kickstart/ssg-rhel8-pci-dss-ks.cfg
-index 21a50f52fd..386cbcc169 100644
---- a/rhel8/kickstart/ssg-rhel8-pci-dss-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-pci-dss-ks.cfg
-@@ -103,13 +103,13 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=12288 --grow
-+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
- # CCE-26557-9: Ensure /home Located On Separate Partition
- logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # CCE-26435-8: Ensure /tmp Located On Separate Partition
- logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
- # CCE-26639-5: Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # CCE-26215-4: Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # CCE-26436-6: Ensure /var/log/audit Located On Separate Partition
-diff --git a/rhel8/kickstart/ssg-rhel8-stig-ks.cfg b/rhel8/kickstart/ssg-rhel8-stig-ks.cfg
-index a3e5e5fec1..28f7ff0927 100644
---- a/rhel8/kickstart/ssg-rhel8-stig-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-stig-ks.cfg
-@@ -107,7 +107,7 @@ part pv.01 --grow --size=1
- volgroup VolGroup --pesize=4096 pv.01
- 
- # Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow
-+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow
- # Ensure /home Located On Separate Partition
- logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
- # Ensure /tmp Located On Separate Partition
-@@ -115,7 +115,7 @@ logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="n
- # Ensure /var/tmp Located On Separate Partition
- logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev"
-+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
- # Ensure /var/log Located On Separate Partition
- logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
- # Ensure /var/log/audit Located On Separate Partition

SOURCES/scap-security-guide-0.1.55-better_align_anssi_ks-PR_6589.patch

@@ -1,426 +0,0 @@
-From fad3761eff3a3857bb4201ac90642dfc37217a2a Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 09:41:26 +0100
-Subject: [PATCH 1/4] Remove extra configurations from ANSSI minimal ks
-
-- No need to restrict IPv6
-- Root login is not restricted
-- Simplify boot command
-- Simplify paritioning
-- No requirement to enforce use of SELinux
----
- .../ssg-rhel7-anssi_nt28_minimal-ks.cfg       | 46 ++--------------
- .../ssg-rhel8-anssi_bp28_minimal-ks.cfg       | 53 +------------------
- 2 files changed, 5 insertions(+), 94 deletions(-)
-
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_minimal-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_minimal-ks.cfg
-index 4160ac094c..9bc4eae44f 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_minimal-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_minimal-ks.cfg
-@@ -54,7 +54,7 @@ keyboard us
- #       "--bootproto=static" must be used. For example:
- # network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
- #
--network --onboot yes --device eth0 --bootproto dhcp --noipv6
-+network --onboot yes --device eth0 --bootproto dhcp
- 
- # Set the system's root password (required)
- # Plaintext password is: server
-@@ -62,26 +62,12 @@ network --onboot yes --device eth0 --bootproto dhcp --noipv6
- # encrypted password form for different plaintext password
- rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
- 
--# The selected profile will restrict root login
--# Add a user that can login and escalate privileges
--# Plaintext password is: admin123
--user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
--
--# Configure firewall settings for the system (optional)
--# --enabled	reject incoming connections that are not in response to outbound requests
--# --ssh		allow sshd service through the firewall
--firewall --enabled --ssh
--
- # Set up the authentication options for the system (required)
- # --enableshadow	enable shadowed passwords by default
- # --passalgo		hash / crypt algorithm for new passwords
- # See the manual page for authconfig for a complete list of possible options.
- authconfig --enableshadow --passalgo=sha512
- 
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +75,7 @@ timezone --utc America/New_York
- # Plaintext password is: password
- # Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
- # encrypted password form for different plaintext password
--bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr
- 
- # Initialize (format) all disks (optional)
- zerombr
-@@ -103,33 +89,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
--part pv.01 --grow --size=1
--
--# Create a Logical Volume Management (LVM) group (optional)
--volgroup VolGroup --pesize=4096 pv.01
--
--# Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=4216 --grow
--# Ensure /usr Located On Separate Partition
--logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
--# Ensure /opt Located On Separate Partition
--logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /srv Located On Separate Partition
--logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /home Located On Separate Partition
--logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
--# Ensure /tmp Located On Separate Partition
--logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
--# Ensure /var/tmp Located On Separate Partition
--logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048 --fsoptions="nodev"
--# Ensure /var/log Located On Separate Partition
--logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev"
--# Ensure /var/log/audit Located On Separate Partition
--logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 --fsoptions="nodev"
--logvol swap --name=lv_swap --vgname=VolGroup --size=2016
-+autopart
- 
- # Despite the ID referencing NT-28, the profile is aligned to BP-028
- %addon org_fedora_oscap
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-index 7fc4945518..1d62b55d55 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_minimal-ks.cfg
-@@ -6,9 +6,6 @@
- # https://pykickstart.readthedocs.io/en/latest/
- # http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
- 
--# Install a fresh new system (optional)
--install
--
- # Specify installation method to use for installation
- # To use a different one comment out the 'url' one below, update
- # the selected choice with proper options & un-comment it
-@@ -61,26 +58,6 @@ network --onboot yes --bootproto dhcp
- # to see how to create encrypted password form for different plaintext password
- rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220
- 
--# The selected profile will restrict root login
--# Add a user that can login and escalate privileges
--# Plaintext password is: admin123
--user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
--
--# Configure firewall settings for the system (optional)
--# --enabled	reject incoming connections that are not in response to outbound requests
--# --ssh		allow sshd service through the firewall
--firewall --enabled --ssh
--
--# Set up the authentication options for the system (required)
--# --enableshadow	enable shadowed passwords by default
--# --passalgo		hash / crypt algorithm for new passwords
--# See the manual page for authconfig for a complete list of possible options.
--authconfig --enableshadow --passalgo=sha512
--
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +66,7 @@ timezone --utc America/New_York
- # Refer to e.g.
- #   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
- # to see how to create encrypted password form for different plaintext password
--bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr
- 
- # Initialize (format) all disks (optional)
- zerombr
-@@ -103,33 +80,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
--part pv.01 --grow --size=1
--
--# Create a Logical Volume Management (LVM) group (optional)
--volgroup VolGroup --pesize=4096 pv.01
--
--# Create particular logical volumes (optional)
--logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
--# Ensure /usr Located On Separate Partition
--logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
--# Ensure /opt Located On Separate Partition
--logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /srv Located On Separate Partition
--logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
--# Ensure /home Located On Separate Partition
--logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
--# Ensure /tmp Located On Separate Partition
--logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var/tmp Located On Separate Partition
--logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var Located On Separate Partition
--logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
--# Ensure /var/log Located On Separate Partition
--logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
--# Ensure /var/log/audit Located On Separate Partition
--logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec"
--logvol swap --name=swap --vgname=VolGroup --size=2016
-+autopart
- 
- # The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol)
- # content - security policies - on the installed system.This add-on has been enabled by default
-
-From 3884ae59b59d69c928acb1d3d52a3f68834aa709 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 09:53:20 +0100
-Subject: [PATCH 2/4] Align ANSSI kickstarts with intermediary level
-
-- Simplify boot command
-- No requirement to enforce use of SELinux
----
- .../ssg-rhel7-anssi_nt28_intermediary-ks.cfg    |  6 +-----
- .../ssg-rhel8-anssi_bp28_intermediary-ks.cfg    | 17 ++---------------
- 2 files changed, 3 insertions(+), 20 deletions(-)
-
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-index ab654410b5..20c4c59a78 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-@@ -78,10 +78,6 @@ firewall --enabled --ssh
- # See the manual page for authconfig for a complete list of possible options.
- authconfig --enableshadow --passalgo=sha512
- 
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +85,7 @@ timezone --utc America/New_York
- # Plaintext password is: password
- # Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
- # encrypted password form for different plaintext password
--bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
- 
- # Initialize (format) all disks (optional)
- zerombr
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-index 981d291847..3a241b06f4 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-@@ -6,9 +6,6 @@
- # https://pykickstart.readthedocs.io/en/latest/
- # http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
- 
--# Install a fresh new system (optional)
--install
--
- # Specify installation method to use for installation
- # To use a different one comment out the 'url' one below, update
- # the selected choice with proper options & un-comment it
-@@ -52,7 +49,7 @@ keyboard us
- #       "--bootproto=static" must be used. For example:
- # network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
- #
--network --onboot yes --bootproto dhcp
-+network --onboot yes --bootproto dhcp --noipv6
- 
- # Set the system's root password (required)
- # Plaintext password is: server
-@@ -71,16 +68,6 @@ user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUaf
- # --ssh		allow sshd service through the firewall
- firewall --enabled --ssh
- 
--# Set up the authentication options for the system (required)
--# --enableshadow	enable shadowed passwords by default
--# --passalgo		hash / crypt algorithm for new passwords
--# See the manual page for authconfig for a complete list of possible options.
--authconfig --enableshadow --passalgo=sha512
--
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +76,7 @@ timezone --utc America/New_York
- # Refer to e.g.
- #   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
- # to see how to create encrypted password form for different plaintext password
--bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr
- 
- # Initialize (format) all disks (optional)
- zerombr
-
-From 745ec9b02bb45ca89d2705e79b36b17060508765 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 14:03:09 +0100
-Subject: [PATCH 3/4] Align ANSSI kickstarts with enhanced level
-
-- Keep restricting IPv6
-- Audit enabled during boot
-- No requirement to enforce use of SELinux
----
- .../ssg-rhel7-anssi_nt28_enhanced-ks.cfg        |  6 +-----
- .../ssg-rhel8-anssi_bp28_enhanced-ks.cfg        | 17 ++---------------
- 2 files changed, 3 insertions(+), 20 deletions(-)
-
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-index 2e75873a28..1d35bedb91 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-@@ -78,10 +78,6 @@ firewall --enabled --ssh
- # See the manual page for authconfig for a complete list of possible options.
- authconfig --enableshadow --passalgo=sha512
- 
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +85,7 @@ timezone --utc America/New_York
- # Plaintext password is: password
- # Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
- # encrypted password form for different plaintext password
--bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr --append="audit=1 audit_backlog_limig=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
- 
- # Initialize (format) all disks (optional)
- zerombr
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-index 4e249f61e2..728946ecb7 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-@@ -6,9 +6,6 @@
- # https://pykickstart.readthedocs.io/en/latest/
- # http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
- 
--# Install a fresh new system (optional)
--install
--
- # Specify installation method to use for installation
- # To use a different one comment out the 'url' one below, update
- # the selected choice with proper options & un-comment it
-@@ -52,7 +49,7 @@ keyboard us
- #       "--bootproto=static" must be used. For example:
- # network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
- #
--network --onboot yes --bootproto dhcp
-+network --onboot yes --bootproto dhcp --noipv6
- 
- # Set the system's root password (required)
- # Plaintext password is: server
-@@ -71,16 +68,6 @@ user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUaf
- # --ssh		allow sshd service through the firewall
- firewall --enabled --ssh
- 
--# Set up the authentication options for the system (required)
--# --enableshadow	enable shadowed passwords by default
--# --passalgo		hash / crypt algorithm for new passwords
--# See the manual page for authconfig for a complete list of possible options.
--authconfig --enableshadow --passalgo=sha512
--
--# State of SELinux on the installed system (optional)
--# Defaults to enforcing
--selinux --enforcing
--
- # Set the system time zone (required)
- timezone --utc America/New_York
- 
-@@ -89,7 +76,7 @@ timezone --utc America/New_York
- # Refer to e.g.
- #   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
- # to see how to create encrypted password form for different plaintext password
--bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
- 
- # Initialize (format) all disks (optional)
- zerombr
-
-From 6804cdfbdea9992daf48fe545d8005be9f37bc56 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 14:08:15 +0100
-Subject: [PATCH 4/4] Align ANSSI Kickstarts with high level
-
----
- rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg |  2 +-
- rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg | 13 ++-----------
- 2 files changed, 3 insertions(+), 12 deletions(-)
-
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-index 745dcbd058..73225c2fab 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-@@ -89,7 +89,7 @@ timezone --utc America/New_York
- # Plaintext password is: password
- # Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
- # encrypted password form for different plaintext password
--bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
- 
- # Initialize (format) all disks (optional)
- zerombr
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-index a1511b157a..cd0eff2625 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-@@ -6,9 +6,6 @@
- # https://pykickstart.readthedocs.io/en/latest/
- # http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
- 
--# Install a fresh new system (optional)
--install
--
- # Specify installation method to use for installation
- # To use a different one comment out the 'url' one below, update
- # the selected choice with proper options & un-comment it
-@@ -52,7 +49,7 @@ keyboard us
- #       "--bootproto=static" must be used. For example:
- # network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
- #
--network --onboot yes --bootproto dhcp
-+network --onboot yes --bootproto dhcp --noipv6
- 
- # Set the system's root password (required)
- # Plaintext password is: server
-@@ -71,12 +68,6 @@ user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUaf
- # --ssh		allow sshd service through the firewall
- firewall --enabled --ssh
- 
--# Set up the authentication options for the system (required)
--# --enableshadow	enable shadowed passwords by default
--# --passalgo		hash / crypt algorithm for new passwords
--# See the manual page for authconfig for a complete list of possible options.
--authconfig --enableshadow --passalgo=sha512
--
- # State of SELinux on the installed system (optional)
- # Defaults to enforcing
- selinux --enforcing
-@@ -89,7 +80,7 @@ timezone --utc America/New_York
- # Refer to e.g.
- #   https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
- # to see how to create encrypted password form for different plaintext password
--bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
-+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
- 
- # Initialize (format) all disks (optional)
- zerombr

SOURCES/scap-security-guide-0.1.55-drop_fix_sysctl_kernel_modules_disabled-PR_6586.patch

@@ -1,57 +0,0 @@
-From 01b1ade0e5713bf3f11f78cc0ca7e43f74eb8a46 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 01:02:48 +0100
-Subject: [PATCH 1/2] Drop remediation for sysctl_kernel_modules_disabled
-
-Remediating this during kickstart install time renders the machine
-unbootable.
----
- .../restrictions/sysctl_kernel_modules_disabled/rule.yml       | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-index 1811c43815..34e8290f74 100644
---- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-@@ -32,3 +32,6 @@ template:
-         sysctlvar: kernel.modules_disabled
-         sysctlval: '1'
-         datatype: int
-+    backends:
-+        # Automated remediation of this rule disrupts installs via kickstart
-+        bash: 'off'
-
-From 77eeafd1af1445a185651c77b143bce0004badda Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Feb 2021 09:23:17 +0100
-Subject: [PATCH 2/2] Add warning why rule has no remediation
-
-Rule sysctl_kernel_modules_disabled disrupts the install and boot
-process if remediated during installation.
----
- .../restrictions/sysctl_kernel_modules_disabled/rule.yml   | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-index 34e8290f74..438cd2759e 100644
---- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
-@@ -26,6 +26,11 @@ references:
- 
- platform: machine
- 
-+warnings:
-+  - general:
-+      This rule doesn't come with Bash remediation.
-+      Remediating this rule during the installation process disrupts the install and boot process.
-+
- template:
-     name: sysctl
-     vars:
-@@ -33,5 +38,5 @@ template:
-         sysctlval: '1'
-         datatype: int
-     backends:
--        # Automated remediation of this rule disrupts installs via kickstart
-+        # Automated remediation of this rule during installations disrupts the first boot
-         bash: 'off'

SOURCES/scap-security-guide-0.1.55-drop_kernel_module_vfat_disabled-PR_6613.patch

@@ -1,62 +0,0 @@
-From eea787e1453b19aa949903c39189479538fbbab9 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Fri, 12 Feb 2021 10:36:10 +0100
-Subject: [PATCH] remove mrules disabling vfat file systems from cis profiles
-
----
- rhcos4/profiles/moderate.profile | 1 -
- rhel7/profiles/cis.profile       | 3 +--
- rhel8/profiles/cis.profile       | 4 ++--
- sle15/profiles/cis.profile       | 1 -
- 4 files changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/rhcos4/profiles/moderate.profile b/rhcos4/profiles/moderate.profile
-index 4e715cae9a..966e092c97 100644
---- a/rhcos4/profiles/moderate.profile
-+++ b/rhcos4/profiles/moderate.profile
-@@ -627,4 +627,3 @@ selections:
-     - kernel_module_squashfs_disabled
-     - kernel_module_udf_disabled
-     - kernel_module_usb-storage_disabled
--    - kernel_module_vfat_disabled
-diff --git a/rhel7/profiles/cis.profile b/rhel7/profiles/cis.profile
-index 22d5117546..093d2b5759 100644
---- a/rhel7/profiles/cis.profile
-+++ b/rhel7/profiles/cis.profile
-@@ -46,8 +46,7 @@ selections:
-     #### 1.1.1.7 Ensure mounting of udf filesystems is disabled (Scored)
-     - kernel_module_udf_disabled
- 
--    #### 1.1.1.8 Ensure mounting of FAT filesystems is disabled (Scored)
--    - kernel_module_vfat_disabled
-+    #### 1.1.1.8 Ensure mounting of FAT filesystems is disabled (Manual)
- 
-     ### 1.1.2 Ensure separate partition exists for /tmp (Scored)
-     - partition_for_tmp
-diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
-index 9ceeb74f9a..e96d2fbb9d 100644
---- a/rhel8/profiles/cis.profile
-+++ b/rhel8/profiles/cis.profile
-@@ -31,8 +31,8 @@ selections:
-     #### 1.1.1.1 Ensure mounting cramfs filesystems is disabled (Scored)
-     - kernel_module_cramfs_disabled
- 
--    #### 1.1.1.2 Ensure mounting of vFAT flesystems is limited (Not Scored)
--    - kernel_module_vfat_disabled
-+    #### 1.1.1.2 Ensure mounting of vFAT filesystems is limited (Not Scored)
-+
- 
-     #### 1.1.1.3 Ensure mounting of squashfs filesystems is disabled (Scored)
-     - kernel_module_squashfs_disabled
-diff --git a/sle15/profiles/cis.profile b/sle15/profiles/cis.profile
-index 9a0efedbdd..fa9ff3b775 100644
---- a/sle15/profiles/cis.profile
-+++ b/sle15/profiles/cis.profile
-@@ -25,7 +25,6 @@ selections:
-     - kernel_module_udf_disabled
- 
-     #### 1.1.1.4 Ensure mounting of vFAT flesystems is limited (Not Scored)
--    - kernel_module_vfat_disabled
- 
-     ### 1.1.2 Ensure /tmp is configured (Scored)
-     - partition_for_tmp

SOURCES/scap-security-guide-0.1.55-fix_cce_rhel7_mac-PR_6564.patch

@@ -1,24 +0,0 @@
-From 67f33ad17c234106bb3243af9f63ae478daa11ec Mon Sep 17 00:00:00 2001
-From: Gabriel Becker <ggasparb@redhat.com>
-Date: Mon, 25 Jan 2021 18:28:26 +0100
-Subject: [PATCH] Reassign a new unique CCE identifier to approved macs STIG
- rule.
-
----
- .../ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml | 2 +-
- shared/references/cce-redhat-avail.txt                          | 1 -
- 2 files changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-index dc9f7dca7c..88d2d77e14 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-@@ -19,7 +19,7 @@ rationale: |-
- severity: medium
- 
- identifiers:
--    cce@rhel7: CCE-83398-8
-+    cce@rhel7: CCE-83636-1
- 
- references:
-     disa: CCI-000068,CCI-000803,CCI-000877,CCI-001453,CCI-003123

SOURCES/scap-security-guide-0.1.55-remove_auditd_data_retention_space_left_from_RHEL8_STIG-PR_6615.patch

@@ -1,39 +0,0 @@
-From 9c6bdd92d2980aff87d1de0085250078ac131eda Mon Sep 17 00:00:00 2001
-From: Gabriel Becker <ggasparb@redhat.com>
-Date: Tue, 16 Feb 2021 15:49:46 +0100
-Subject: [PATCH] Remove auditd_data_retention_space_left from RHEL8 STIG
- profile.
-
-This rule is not aligned with STIG because it checks for space left in
-megabytes, whereas STIG demands space left in percentage.
----
- rhel8/profiles/stig.profile                     | 3 ++-
- tests/data/profile_stability/rhel8/stig.profile | 1 -
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
-index 0aa6f28986..dccfb548b7 100644
---- a/rhel8/profiles/stig.profile
-+++ b/rhel8/profiles/stig.profile
-@@ -219,7 +219,8 @@ selections:
-     - package_rsyslog_installed
-     - package_rsyslog-gnutls_installed
-     - rsyslog_remote_loghost
--    - auditd_data_retention_space_left
-+    # this rule expects configuration in MB instead percentage as how STIG demands
-+    # - auditd_data_retention_space_left
-     - auditd_data_retention_space_left_action
-     # remediation fails because default configuration file contains pool instead of server keyword
-     - chronyd_or_ntpd_set_maxpoll
-diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
-index 55b645b67b..41782dcf3d 100644
---- a/tests/data/profile_stability/rhel8/stig.profile
-+++ b/tests/data/profile_stability/rhel8/stig.profile
-@@ -63,7 +63,6 @@ selections:
- - auditd_data_disk_full_action
- - auditd_data_retention_action_mail_acct
- - auditd_data_retention_max_log_file_action
--- auditd_data_retention_space_left
- - auditd_data_retention_space_left_action
- - auditd_local_events
- - auditd_log_format

SOURCES/scap-security-guide-0.1.55-remove_pam_rule_from_rhel8_stig-PR_6528.patch

@@ -1,43 +0,0 @@
-From 0f10e6fe07e068f3fac8cb9563141530f3d8b9e8 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 12 Jan 2021 16:23:07 +0100
-Subject: [PATCH 1/2] remove rule from rhel8 stig
-
----
- rhel8/profiles/stig.profile | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
-index 882c481066..cda0239433 100644
---- a/rhel8/profiles/stig.profile
-+++ b/rhel8/profiles/stig.profile
-@@ -45,7 +45,6 @@ selections:
-     - package_audispd-plugins_installed
-     - package_libcap-ng-utils_installed
-     - auditd_audispd_syslog_plugin_activated
--    - accounts_passwords_pam_faillock_enforce_local
-     - accounts_password_pam_enforce_local
-     - accounts_password_pam_enforce_root
- 
-
-From b558c9030d2f16e59571e1730a3b0350d257d298 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 12 Jan 2021 16:23:25 +0100
-Subject: [PATCH 2/2] modify profile stability test
-
----
- tests/data/profile_stability/rhel8/stig.profile | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
-index a4ad24aec2..6676ca497c 100644
---- a/tests/data/profile_stability/rhel8/stig.profile
-+++ b/tests/data/profile_stability/rhel8/stig.profile
-@@ -41,7 +41,6 @@ selections:
- - accounts_password_set_max_life_existing
- - accounts_password_set_min_life_existing
- - accounts_passwords_pam_faillock_deny
--- accounts_passwords_pam_faillock_enforce_local
- - accounts_passwords_pam_faillock_interval
- - accounts_passwords_pam_faillock_unlock_time
- - accounts_umask_etc_bashrc

SOURCES/scap-security-guide-0.1.55-sles12_stigs-PR_6524.patch

@@ -1,843 +0,0 @@
-From c5f46d9166d0629740deb3cc5c45d3925345df09 Mon Sep 17 00:00:00 2001
-From: Guang Yee <guang.yee@suse.com>
-Date: Mon, 11 Jan 2021 12:55:43 -0800
-Subject: [PATCH] Enable checks and remediations for the following SLES-12
- STIGs:
-
- - SLES-12-010030 'banner_etc_issue'
- - SLES-12-010120 'accounts_max_concurrent_login_sessions'
- - SLES-12-010450 'encrypt_partitions'
- - SLES-12-010460 'dir_perms_world_writable_sticky_bits'
- - SLES-12-010500 'package_aide_installed'
- - SLES-12-010550 'ensure_gpgcheck_globally_activated'
- - SLES-12-010580 'kernel_module_usb-storage_disabled'
- - SLES-12-010599 'package_MFEhiplsm_installed'
- - SLES-12-010690 'no_files_unowned_by_user'
- - SLES-12-030000 'package_telnet-server_removed'
- - SLES-12-030010 'ftp_present_banner'
- - SLES-12-030050 'sshd_enable_warning_banner'
- - SLES-12-030110 'sshd_set_loglevel_verbose'
- - SLES-12-030130 'sshd_print_last_log'
- - SLES-12-030210 'file_permissions_sshd_pub_key'
- - SLES-12-030220 'file_permissions_sshd_private_key'
- - SLES-12-030230 'sshd_enable_strictmodes'
- - SLES-12-030240 'sshd_use_priv_separation'
- - SLES-12-030250 'sshd_disable_compression'
- - SLES-12-030340 'auditd_audispd_encrypt_sent_records'
- - SLES-12-030360 'sysctl_net_ipv4_conf_all_accept_source_route'
- - SLES-12-030361 'sysctl_net_ipv6_conf_all_accept_source_route'
- - SLES-12-030370 'sysctl_net_ipv4_conf_default_accept_source_route'
- - SLES-12-030420 'sysctl_net_ipv4_conf_default_send_redirects'
----
- .../ftp_present_banner/rule.yml               |  1 +
- .../package_telnet-server_removed/rule.yml    |  1 +
- .../rule.yml                                  |  1 +
- .../file_permissions_sshd_pub_key/rule.yml    |  1 +
- .../ansible/shared.yml                        |  2 +-
- .../sshd_disable_compression/rule.yml         |  1 +
- .../sshd_enable_strictmodes/rule.yml          |  1 +
- .../sshd_enable_warning_banner/rule.yml       |  1 +
- .../ssh_server/sshd_print_last_log/rule.yml   |  1 +
- .../sshd_set_loglevel_verbose/rule.yml        |  1 +
- .../sshd_use_priv_separation/rule.yml         |  1 +
- .../banner_etc_issue/ansible/shared.yml       |  2 +-
- .../banner_etc_issue/rule.yml                 |  4 ++-
- .../ansible/shared.yml                        |  2 +-
- .../rule.yml                                  |  2 ++
- .../ansible/shared.yml                        |  2 +-
- .../rule.yml                                  |  4 ++-
- .../rule.yml                                  |  4 ++-
- .../rule.yml                                  |  4 ++-
- .../rule.yml                                  |  4 ++-
- .../rule.yml                                  |  4 ++-
- .../bash/shared.sh                            |  2 +-
- .../rule.yml                                  |  2 ++
- .../files/no_files_unowned_by_user/rule.yml   |  4 ++-
- .../rule.yml                                  |  4 ++-
- .../encrypt_partitions/rule.yml               |  8 +++++-
- .../package_MFEhiplsm_installed/rule.yml      |  2 ++
- .../aide/package_aide_installed/rule.yml      |  3 +++
- .../ansible/sle12.yml                         | 13 ++++++++++
- .../rule.yml                                  |  8 +++++-
- shared/applicability/general.yml              |  4 +++
- .../oval/installed_env_has_zypper_package.xml | 25 +++++++++++++++++++
- .../kernel_module_disabled/ansible.template   | 12 +++++++--
- .../kernel_module_disabled/bash.template      |  9 ++++++-
- .../kernel_module_disabled/oval.template      |  5 ++++
- sle12/product.yml                             |  1 +
- sle12/profiles/stig.profile                   | 25 +++++++++++++++++++
- 37 files changed, 153 insertions(+), 18 deletions(-)
- create mode 100644 linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/sle12.yml
- create mode 100644 shared/checks/oval/installed_env_has_zypper_package.xml
-
-diff --git a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml
-index 35ba09b0d0..3590a085b6 100644
---- a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml
-+++ b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml
-@@ -19,6 +19,7 @@ severity: medium
- 
- identifiers:
-     cce@rhel7: CCE-80248-8
-+    cce@sle12: CCE-83059-6
- 
- references:
-     stigid@sle12: SLES-12-030010
-diff --git a/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml b/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml
-index 317eecdc3d..619b3f0b7d 100644
---- a/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml
-+++ b/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml
-@@ -27,6 +27,7 @@ severity: high
- identifiers:
-     cce@rhel7: CCE-27165-0
-     cce@rhel8: CCE-82182-7
-+    cce@sle12: CCE-83084-4
- 
- references:
-     stigid@ol7: OL07-00-021710
-diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
-index 2e52219ece..d460411667 100644
---- a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
-+++ b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
-@@ -18,6 +18,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-27485-2
-     cce@rhel8: CCE-82424-3
-+    cce@sle12: CCE-83058-8
- 
- references:
-     stigid@ol7: OL07-00-040420
-diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
-index e59ddc0770..b9e07d71af 100644
---- a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
-+++ b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
-@@ -13,6 +13,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-27311-0
-     cce@rhel8: CCE-82428-4
-+    cce@sle12: CCE-83057-0 
- 
- references:
-     stigid@ol7: OL07-00-040410
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml
-index e07e436d60..f8d422c6c4 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml
-@@ -1,4 +1,4 @@
--# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
- # reboot = false
- # strategy = restrict
- # complexity = low
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml
-index fe7e67c1c2..f8eec6a074 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml
-@@ -21,6 +21,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80224-9
-     cce@rhel8: CCE-80895-6
-+    cce@sle12: CCE-83062-0
- 
- references:
-     stigid@ol7: OL07-00-040470
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml
-index 22b98c71a2..601f6a0ca2 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml
-@@ -18,6 +18,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80222-3
-     cce@rhel8: CCE-80904-6
-+    cce@sle12: CCE-83060-4  
- 
- references:
-     stigid@ol7: OL07-00-040450
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
-index 2199d61ca9..c93ef6340f 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
-@@ -20,6 +20,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-27314-4
-     cce@rhel8: CCE-80905-3
-+    cce@sle12: CCE-83066-1
- 
- references:
-     stigid@ol7: OL07-00-040170
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml
-index a0b8ed38ae..0ce5da30b2 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml
-@@ -17,6 +17,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80225-6
-     cce@rhel8: CCE-82281-7
-+    cce@sle12: CCE-83083-6
- 
- references:
-     stigid@ol7: OL07-00-040360
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_verbose/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_verbose/rule.yml
-index 28ce48de8e..2180398855 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_verbose/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_verbose/rule.yml
-@@ -22,6 +22,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-82419-3
-     cce@rhel8: CCE-82420-1
-+    cce@sle12: CCE-83077-8
- 
- references:
-     srg: SRG-OS-000032-GPOS-00013
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_priv_separation/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_priv_separation/rule.yml
-index 14d1acfd22..d65ddb6cd1 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_priv_separation/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_priv_separation/rule.yml
-@@ -18,6 +18,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80223-1
-     cce@rhel8: CCE-80908-7
-+    cce@sle12: CCE-83061-2 
- 
- references:
-     stigid@ol7: OL07-00-040460
-diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
-index f3a0c85ea5..ff6b6eab42 100644
---- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
-+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
-@@ -1,4 +1,4 @@
--# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
- # reboot = false
- # strategy = unknown
- # complexity = low
-diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml
-index a86ede70f8..637d8ee528 100644
---- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml
-+++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12
- 
- title: 'Modify the System Login Banner'
- 
-@@ -52,6 +52,7 @@ identifiers:
-     cce@rhel7: CCE-27303-7
-     cce@rhel8: CCE-80763-6
-     cce@rhcos4: CCE-82555-4
-+    cce@sle12: CCE-83054-7
- 
- references:
-     stigid@ol7: OL07-00-010050
-@@ -64,6 +65,7 @@ references:
-     srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007
-     vmmsrg: SRG-OS-000023-VMM-000060,SRG-OS-000024-VMM-000070
-     stigid@rhel7: RHEL-07-010050
-+    stigid@sle12: SLES-12-010030
-     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.5,SR 1.7,SR 1.8,SR 1.9'
-     isa-62443-2009: 4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9
-     cobit5: DSS05.04,DSS05.10,DSS06.10
-diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml
-index 9d50a9d20c..536ac29569 100644
---- a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml
-+++ b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml
-@@ -1,4 +1,4 @@
--# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel
-+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
- # reboot = false
- # strategy = restrict
- # complexity = low
-diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml
-index e598f4e8cb..32412aa482 100644
---- a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml
-+++ b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml
-@@ -20,6 +20,7 @@ severity: low
- identifiers:
-     cce@rhel7: CCE-82041-5
-     cce@rhel8: CCE-80955-8
-+    cce@sle12: CCE-83065-3
- 
- references:
-     stigid@ol7: OL07-00-040000
-@@ -30,6 +31,7 @@ references:
-     srg: SRG-OS-000027-GPOS-00008
-     vmmsrg: SRG-OS-000027-VMM-000080
-     stigid@rhel7: RHEL-07-040000
-+    stigid@sle12: SLES-12-010120
-     isa-62443-2013: 'SR 3.1,SR 3.8'
-     isa-62443-2009: 4.3.3.4
-     cobit5: DSS01.05,DSS05.02
-diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/ansible/shared.yml
-index 23bcdf8641..007b23ba24 100644
---- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/ansible/shared.yml
-+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/ansible/shared.yml
-@@ -1,4 +1,4 @@
--# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,Red Hat Virtualization 4
-+# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,Red Hat Virtualization 4,multi_platform_sle
- # reboot = false
- # complexity = low
- # disruption = low
-diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml
-index 4c27eb11fd..1943a00fb2 100644
---- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml
-+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12
- 
- title: 'Encrypt Audit Records Sent With audispd Plugin'
- 
-@@ -26,6 +26,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80540-8
-     cce@rhel8: CCE-80926-9
-+    cce@sle12: CCE-83063-8 
- 
- references:
-     stigid@ol7: OL07-00-030310
-@@ -33,6 +34,7 @@ references:
-     nist: AU-9(3),CM-6(a)
-     srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
-     stigid@rhel7: RHEL-07-030310
-+    stigid@sle12: SLES-12-030340 
-     ospp: FAU_GEN.1.1.c
- 
- ocil_clause: 'audispd is not encrypting audit records when sent over the network'
-diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml
-index a3f78cb910..8767a5226f 100644
---- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml
-+++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
-+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12
- 
- title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces'
- 
-@@ -22,6 +22,7 @@ identifiers:
-     cce@rhel7: CCE-80179-5
-     cce@rhel8: CCE-81013-5
-     cce@rhcos4: CCE-82480-5
-+    cce@sle12: CCE-83078-6 
- 
- references:
-     stigid@ol7: OL07-00-040830
-@@ -33,6 +34,7 @@ references:
-     nist-csf: DE.AE-1,ID.AM-3,PR.AC-5,PR.DS-5,PR.PT-4
-     srg: SRG-OS-000480-GPOS-00227
-     stigid@rhel7: RHEL-07-040830
-+    stigid@sle12: SLES-12-030361  
-     isa-62443-2013: 'SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 7.1,SR 7.6'
-     isa-62443-2009: 4.2.3.4,4.3.3.4,4.4.3.3
-     cobit5: APO01.06,APO13.01,DSS01.05,DSS03.01,DSS05.02,DSS05.04,DSS05.07,DSS06.02
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
-index 0cd3dbc143..7bc4e3b9b7 100644
---- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12
- 
- title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces'
- 
-@@ -22,6 +22,7 @@ identifiers:
-     cce@rhel7: CCE-27434-0
-     cce@rhel8: CCE-81011-9
-     cce@rhcos4: CCE-82478-9
-+    cce@sle12: CCE-83064-6 
- 
- references:
-     stigid@ol7: OL07-00-040610
-@@ -33,6 +34,7 @@ references:
-     nist-csf: DE.AE-1,DE.CM-1,ID.AM-3,PR.AC-5,PR.DS-4,PR.DS-5,PR.IP-1,PR.PT-3,PR.PT-4
-     srg: SRG-OS-000480-GPOS-00227
-     stigid@rhel7: RHEL-07-040610
-+    stigid@sle12: SLES-12-030360
-     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 6.2,SR 7.1,SR 7.2,SR 7.6'
-     isa-62443-2009: 4.2.3.4,4.3.3.4,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.4.3.3
-     cobit5: APO01.06,APO13.01,BAI04.04,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS01.05,DSS03.01,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.02,DSS06.06
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
-index c48ec8de3d..f7ee2e9818 100644
---- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12
- 
- title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default'
- 
-@@ -22,6 +22,7 @@ identifiers:
-     cce@rhel7: CCE-80162-1
-     cce@rhel8: CCE-80920-2
-     cce@rhcos4: CCE-82479-7
-+    cce@sle12: CCE-83079-4  
- 
- references:
-     stigid@ol7: OL07-00-040620
-@@ -34,6 +35,7 @@ references:
-     nist-csf: DE.AE-1,DE.CM-1,ID.AM-3,PR.AC-5,PR.DS-4,PR.DS-5,PR.IP-1,PR.PT-3,PR.PT-4
-     srg: SRG-OS-000480-GPOS-00227
-     stigid@rhel7: RHEL-07-040620
-+    stigid@sle12: SLES-12-030370 
-     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 6.2,SR 7.1,SR 7.2,SR 7.6'
-     isa-62443-2009: 4.2.3.4,4.3.3.4,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.4.3.3
-     cobit5: APO01.06,APO13.01,BAI04.04,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS01.05,DSS03.01,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.02,DSS06.06
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml
-index ddf6b07758..861c3485f3 100644
---- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12
- 
- title: 'Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default'
- 
-@@ -19,6 +19,7 @@ identifiers:
-     cce@rhel7: CCE-80999-6
-     cce@rhel8: CCE-80921-0
-     cce@rhcos4: CCE-82485-4
-+    cce@sle12: CCE-83086-9 
- 
- references:
-     stigid@ol7: OL07-00-040650
-@@ -31,6 +32,7 @@ references:
-     nist-csf: DE.AE-1,DE.CM-1,ID.AM-3,PR.AC-5,PR.DS-4,PR.DS-5,PR.IP-1,PR.PT-3,PR.PT-4
-     srg: SRG-OS-000480-GPOS-00227
-     stigid@rhel7: RHEL-07-040650
-+    stigid@sle12: SLES-12-030420 
-     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 6.2,SR 7.1,SR 7.2,SR 7.6'
-     isa-62443-2009: 4.2.3.4,4.3.3.4,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.4.3.3
-     cobit5: APO01.06,APO13.01,BAI04.04,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS01.05,DSS03.01,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.02,DSS06.06
-diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh
-index 0a829df187..e49942d1cc 100644
---- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh
-+++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh
-@@ -1,4 +1,4 @@
--# platform = Red Hat Virtualization 4,multi_platform_rhel
-+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_sle
- df --local -P | awk '{if (NR!=1) print $6}' \
- | xargs -I '{}' find '{}' -xdev -type d \
- \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null \
-diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml
-index d04df8df86..5bb3cf3713 100644
---- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml
-+++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml
-@@ -34,6 +34,7 @@ identifiers:
-     cce@rhel7: CCE-80130-8
-     cce@rhel8: CCE-80783-4
-     cce@rhcos4: CCE-82753-5
-+    cce@sle12: CCE-83047-1
- 
- references:
-     cis@rhe8: 1.1.21
-@@ -46,6 +47,7 @@ references:
-     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
-     cis-csc: 12,13,14,15,16,18,3,5
-     cis@sle15: 1.1.22
-+    stigid@sle12: SLES-12-010460 
- 
- ocil_clause: 'any world-writable directories are missing the sticky bit'
- 
-diff --git a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
-index e664cf9215..faab0b8822 100644
---- a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
-+++ b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019
- 
- title: 'Ensure All Files Are Owned by a User'
- 
-@@ -24,6 +24,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-80134-0
-     cce@rhel8: CCE-83499-4
-+    cce@sle12: CCE-83072-9
- 
- references:
-     stigid@ol7: OL07-00-020320
-@@ -40,6 +41,7 @@ references:
-     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
-     cis-csc: 11,12,13,14,15,16,18,3,5,9
-     cis@sle15: 6.1.11
-+    stigid@sle12: SLES-12-010690
- 
- ocil_clause: 'files exist that are not owned by a valid user'
- 
-diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml
-index c78b570efb..24e77cc74e 100644
---- a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml
-+++ b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019
-+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019
- 
- title: 'Disable Modprobe Loading of USB Storage Driver'
- 
-@@ -22,6 +22,7 @@ identifiers:
-     cce@rhel7: CCE-27277-3
-     cce@rhel8: CCE-80835-2
-     cce@rhcos4: CCE-82719-6
-+    cce@sle12: CCE-83069-5
- 
- references:
-     stigid@ol7: OL07-00-020100
-@@ -39,6 +40,7 @@ references:
-     cis-csc: 1,12,15,16,5
-     cis@rhel8: 1.1.23
-     cis@sle15: 1.1.3
-+    stigid@sle12: SLES-12-010580
- 
- {{{ complete_ocil_entry_module_disable(module="usb-storage") }}}
- 
-diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
-index 80d1856778..fe370a4323 100644
---- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
-+++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: ol7,ol8,rhel7,rhel8,rhv4,rhcos4
-+prodtype: ol7,ol8,rhel7,rhel8,rhv4,rhcos4,sle12
- 
- title: 'Encrypt Partitions'
- 
-@@ -14,6 +14,7 @@ description: |-
-     option is selected the system will prompt for a passphrase to use in
-     decrypting the partition. The passphrase will subsequently need to be entered manually
-     every time the system boots.
-+    {{% if product != "sle12" %}}
-     <br /><br />
-     For automated/unattended installations, it is possible to use Kickstart by adding
-     the <tt>--encrypted</tt> and <tt>--passphrase=</tt> options to the definition of each partition to be
-@@ -26,11 +27,14 @@ description: |-
-     <br /><br />
-     By default, the <tt>Anaconda</tt> installer uses <tt>aes-xts-plain64</tt> cipher
-     with a minimum <tt>512</tt> bit key size which should be compatible with FIPS enabled.
-+    {{% endif %}}
-     <br /><br />
-     Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on
-     the {{{ full_name }}} Documentation web site:<br />
-     {{% if product in ["ol7", "ol8"] %}}
-         {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54670/html/ol7-encrypt-sec.html") }}}.
-+    {{% elif product == "sle12" %}}
-+        {{{ weblink(link="https://www.suse.com/documentation/sled-12/book_security/data/sec_security_cryptofs_y2.html") }}}
-     {{% else %}}
-         {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html") }}}.
-     {{% endif %}}
-@@ -45,6 +49,7 @@ severity: high
- identifiers:
-     cce@rhel7: CCE-27128-8
-     cce@rhel8: CCE-80789-1
-+    cce@sle12: CCE-83046-3
- 
- references:
-     cui: 3.13.16
-@@ -58,6 +63,7 @@ references:
-     isa-62443-2013: 'SR 3.4,SR 4.1,SR 5.2'
-     cobit5: APO01.06,BAI02.01,BAI06.01,DSS04.07,DSS05.03,DSS05.04,DSS05.07,DSS06.02,DSS06.06
-     cis-csc: 13,14
-+    stigid@sle12: SLES-12-010450
- 
- ocil_clause: 'partitions do not have a type of crypto_LUKS'
- 
-diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml
-index f96cfc925b..c0bf1ee908 100644
---- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml
-+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml
-@@ -18,6 +18,7 @@ severity: medium
- 
- identifiers:
-     cce@rhel7: CCE-80368-4
-+    cce@sle12: CCE-83071-1
- 
- references:
-     disa: CCI-000366,CCI-001263
-@@ -31,6 +32,7 @@ references:
-     iso27001-2013: 'A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.3,A.12.5.1,A.12.6.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.7,A.14.2.8,A.15.2.1,A.16.1.1,A.16.1.2,A.16.1.3,A.16.1.4,A.16.1.5,A.16.1.6,A.16.1.7,A.18.1.4,A.18.2.2,A.18.2.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5,Clause 16.1.2,Clause 7.4'
-     cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9
-     stigid@rhel7: RHEL-07-020019
-+    stigid@sle12: SLES-12-010599 
- 
- ocil_clause: 'the HBSS HIPS module is not installed'
- 
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
-index 699992b48c..23e939bbec 100644
---- a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml
-@@ -14,6 +14,7 @@ severity: medium
- identifiers:
-     cce@rhel7: CCE-27096-7
-     cce@rhel8: CCE-80844-4
-+    cce@sle12: CCE-83048-9
- 
- references:
-     cis@rhel8: 1.4.1
-@@ -30,6 +31,8 @@ references:
-     srg: SRG-OS-000363-GPOS-00150
-     cis@sle15: 1.4.1
-     ism: 1034,1288,1341,1417
-+    stigid@sle12: SLES-12-010500
-+    disa@sle12: CCI-002699
- 
- ocil_clause: 'the package is not installed'
- 
-diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/sle12.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/sle12.yml
-new file mode 100644
-index 0000000000..6fca48166a
---- /dev/null
-+++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/sle12.yml
-@@ -0,0 +1,13 @@
-+# platform = multi_platform_sle
-+# reboot = false
-+# strategy = unknown
-+# complexity = low
-+# disruption = medium
-+- name: Ensure GPG check is globally activated (zypper)
-+  ini_file:
-+    dest: /etc/zypp/zypp.conf
-+    section: main
-+    option: gpgcheck
-+    value: 1
-+    no_extra_spaces: yes
-+    create: False
-diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml
-index 24cef5499c..1f86aff1e9 100644
---- a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml
-+++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml
-@@ -1,6 +1,6 @@
- documentation_complete: true
- 
--prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15
-+prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15
- 
- title: 'Ensure gpgcheck Enabled In Main {{{ pkg_manager }}} Configuration'
- 
-@@ -33,6 +33,7 @@ severity: high
- identifiers:
-     cce@rhel7: CCE-26989-4
-     cce@rhel8: CCE-80790-9
-+    cce@sle12: CCE-83068-7
- 
- references:
-     stigid@ol7: OL07-00-020050
-@@ -54,6 +55,7 @@ references:
-     iso27001-2013: A.11.2.4,A.12.1.2,A.12.2.1,A.12.5.1,A.12.6.2,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4
-     cis-csc: 11,2,3,9
-     anssi: BP28(R15)
-+    stigid@sle12: SLES-12-010550
- 
- ocil_clause: 'GPG checking is not enabled'
- 
-@@ -66,4 +68,8 @@ ocil: |-
-     <tt>gpgcheck</tt> line or a setting of <tt>0</tt> indicates that it is
-     disabled.
- 
-+{{% if product == 'sle12' %}}
-+platform: zypper
-+{{% else %}}
- platform: yum
-+{{% endif %}}
-diff --git a/shared/applicability/general.yml b/shared/applicability/general.yml
-index a6581fd713..7382b7dd30 100644
---- a/shared/applicability/general.yml
-+++ b/shared/applicability/general.yml
-@@ -74,3 +74,7 @@ cpes:
-       title: "Package yum is installed"
-       check_id: installed_env_has_yum_package
- 
-+  - zypper:
-+      name: "cpe:/a:zypper"
-+      title: "Package zypper is installed"
-+      check_id: installed_env_has_zypper_package
-diff --git a/shared/checks/oval/installed_env_has_zypper_package.xml b/shared/checks/oval/installed_env_has_zypper_package.xml
-new file mode 100644
-index 0000000000..cf14e6af3c
---- /dev/null
-+++ b/shared/checks/oval/installed_env_has_zypper_package.xml
-@@ -0,0 +1,25 @@
-+<def-group>
-+  <definition class="inventory"
-+  id="installed_env_has_zypper_package" version="1">
-+    <metadata>
-+      <title>Package zypper is installed</title>
-+      <affected family="unix">
-+        <platform>multi_platform_sle</platform>
-+      </affected>
-+      <description>Checks if package zypper is installed.</description>
-+      <reference ref_id="cpe:/a:zypper" source="CPE" />
-+    </metadata>
-+    <criteria>
-+      <criterion comment="Package zypper is installed" test_ref="test_env_has_zypper_installed" />
-+    </criteria>
-+  </definition>
-+
-+  <linux:rpminfo_test check="all" check_existence="at_least_one_exists"
-+  id="test_env_has_zypper_installed" version="1"
-+  comment="system has package zypper installed">
-+    <linux:object object_ref="obj_env_has_zypper_installed" />
-+  </linux:rpminfo_test>
-+  <linux:rpminfo_object id="obj_env_has_zypper_installed" version="1">
-+    <linux:name>zypper</linux:name>
-+  </linux:rpminfo_object>
-+</def-group>
-diff --git a/shared/templates/kernel_module_disabled/ansible.template b/shared/templates/kernel_module_disabled/ansible.template
-index 47deee6e54..c4a83ad325 100644
---- a/shared/templates/kernel_module_disabled/ansible.template
-+++ b/shared/templates/kernel_module_disabled/ansible.template
-@@ -1,12 +1,20 @@
--# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
-+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
- # reboot = true
- # strategy = disable
- # complexity = low
- # disruption = medium
-+{{% if product == "sle12" %}}
-+- name: Ensure kernel module '{{{ KERNMODULE }}}' is disabled
-+  lineinfile:
-+    create: yes
-+    dest: "/etc/modprobe.d/50-blacklist.conf"
-+    regexp: '^blacklist {{{ KERNMODULE }}}$'
-+    line: "blacklist {{{ KERNMODULE }}}"
-+{{% else %}}
- - name: Ensure kernel module '{{{ KERNMODULE }}}' is disabled
-   lineinfile:
-     create: yes
-     dest: "/etc/modprobe.d/{{{ KERNMODULE }}}.conf"
-     regexp: '{{{ KERNMODULE }}}'
-     line: "install {{{ KERNMODULE }}} /bin/true"
--
-+{{% endif %}}
-diff --git a/shared/templates/kernel_module_disabled/bash.template b/shared/templates/kernel_module_disabled/bash.template
-index 42c0830b5f..f70a9925cd 100644
---- a/shared/templates/kernel_module_disabled/bash.template
-+++ b/shared/templates/kernel_module_disabled/bash.template
-@@ -1,11 +1,18 @@
--# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle
- # reboot = true
- # strategy = disable
- # complexity = low
- # disruption = medium
-+{{% if product == "sle12" %}}
-+if ! LC_ALL=C grep -q -m 1 "^blacklist {{{ KERNMODULE }}}$" /etc/modprobe.d/50-blacklist.conf ; then
-+        echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/50-blacklist.conf
-+        echo "blacklist {{{ KERNMODULE }}}" >> /etc/modprobe.d/50-blacklist.conf
-+fi
-+{{% else %}}
- if LC_ALL=C grep -q -m 1 "^install {{{ KERNMODULE }}}" /etc/modprobe.d/{{{ KERNMODULE }}}.conf ; then
- 	sed -i 's/^install {{{ KERNMODULE }}}.*/install {{{ KERNMODULE }}} /bin/true/g' /etc/modprobe.d/{{{ KERNMODULE }}}.conf
- else
- 	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/{{{ KERNMODULE }}}.conf
- 	echo "install {{{ KERNMODULE }}} /bin/true" >> /etc/modprobe.d/{{{ KERNMODULE }}}.conf
- fi
-+{{% endif %}}
-diff --git a/shared/templates/kernel_module_disabled/oval.template b/shared/templates/kernel_module_disabled/oval.template
-index e5a7aaa8b4..737ae3c796 100644
---- a/shared/templates/kernel_module_disabled/oval.template
-+++ b/shared/templates/kernel_module_disabled/oval.template
-@@ -54,9 +54,14 @@
- 
-   <ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_disabled"
-   version="1" comment="kernel module {{{ KERNMODULE }}} disabled">
-+    {{% if product == "sle12" %}}
-+    <ind:filepath>/etc/modprobe.d/50-blacklist.conf</ind:filepath>
-+    <ind:pattern operation="pattern match">^blacklist\s+{{{ KERNMODULE }}}$</ind:pattern>
-+    {{% else %}}
-     <ind:path>/etc/modprobe.d</ind:path>
-     <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
-     <ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
-+    {{% endif %}}
-     <ind:instance datatype="int">1</ind:instance>
-   </ind:textfilecontent54_object>
- 
-diff --git a/sle12/product.yml b/sle12/product.yml
-index e465a6d687..d83ad88c21 100644
---- a/sle12/product.yml
-+++ b/sle12/product.yml
-@@ -9,6 +9,7 @@ profiles_root: "./profiles"
- init_system: "systemd"
- 
- pkg_manager: "zypper"
-+pkg_manager_config_file: "/etc/zypp/zypp.conf"
- oval_feed_url: "https://support.novell.com/security/oval/suse.linux.enterprise.12.xml"
- 
- cpes_root: "../shared/applicability"
-diff --git a/sle12/profiles/stig.profile b/sle12/profiles/stig.profile
-index 6cf3339569..15c4f70336 100644
---- a/sle12/profiles/stig.profile
-+++ b/sle12/profiles/stig.profile
-@@ -12,34 +12,59 @@ selections:
-     - account_temp_expire_date
-     - accounts_have_homedir_login_defs
-     - accounts_logon_fail_delay
-+    - accounts_max_concurrent_login_sessions
-     - accounts_maximum_age_login_defs
-+    - accounts_minimum_age_login_defs
-     - accounts_no_uid_except_zero
-     - accounts_password_set_max_life_existing
-     - accounts_password_set_min_life_existing
-     - accounts_umask_etc_login_defs
-+    - auditd_audispd_encrypt_sent_records
-     - auditd_data_disk_full_action
-     - auditd_data_retention_action_mail_acct
-     - auditd_data_retention_space_left
-+    - banner_etc_issue
-     - banner_etc_motd
-+    - dir_perms_world_writable_sticky_bits
-     - disable_ctrlaltdel_reboot
-+    - encrypt_partitions
-+    - ensure_gpgcheck_globally_activated
-+    - file_permissions_sshd_private_key
-+    - file_permissions_sshd_pub_key
-+    - ftp_present_banner
-     - gnome_gdm_disable_automatic_login
-     - grub2_password
-     - grub2_uefi_password
-     - installed_OS_is_vendor_supported
-+    - kernel_module_usb-storage_disabled
-     - no_empty_passwords
-+    - no_files_unowned_by_user
-     - no_host_based_files
-     - no_user_host_based_files
-+    - package_MFEhiplsm_installed
-+    - package_aide_installed
-     - package_audit-audispd-plugins_installed
-     - package_audit_installed
-+    - package_telnet-server_removed
-     - postfix_client_configure_mail_alias
-     - security_patches_up_to_date
-     - service_auditd_enabled
-     - set_password_hashing_algorithm_logindefs
-+    - sshd_disable_compression
-     - sshd_disable_empty_passwords
-     - sshd_disable_user_known_hosts
-     - sshd_do_not_permit_user_env
-+    - sshd_enable_strictmodes
-+    - sshd_enable_warning_banner
-     - sshd_enable_x11_forwarding
-+    - sshd_print_last_log
-     - sshd_set_idle_timeout
-     - sshd_set_keepalive
-+    - sshd_set_loglevel_verbose
-+    - sshd_use_priv_separation
-     - sudo_remove_no_authenticate
-     - sudo_remove_nopasswd
-+    - sysctl_net_ipv4_conf_all_accept_source_route
-+    - sysctl_net_ipv4_conf_default_accept_source_route
-+    - sysctl_net_ipv4_conf_default_send_redirects
-+    - sysctl_net_ipv6_conf_all_accept_source_route

SOURCES/scap-security-guide-0.1.55-sshd_approved_ciphers_ordered-PR_6541.patch

@@ -1,259 +0,0 @@
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-index abcebf60c7..50c7d689af 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml
-@@ -61,7 +61,6 @@ references:
-     nist-csf: PR.AC-1,PR.AC-3,PR.AC-4,PR.AC-6,PR.AC-7,PR.IP-1,PR.PT-1,PR.PT-3,PR.PT-4
-     srg: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174
-     vmmsrg: SRG-OS-000033-VMM-000140,SRG-OS-000120-VMM-000600,SRG-OS-000478-VMM-001980,SRG-OS-000396-VMM-001590
--    stigid@rhel7: RHEL-07-040110
-     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 2.8,SR 2.9,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 7.1,SR 7.6'
-     isa-62443-2009: 4.3.3.2.2,4.3.3.3.9,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4
-     cobit5: APO11.04,APO13.01,BAI03.05,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.04,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.06,DSS06.10,MEA02.01
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml
-new file mode 100644
-index 0000000000..4796a2eab1
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml
-@@ -0,0 +1,13 @@
-+# platform = Red Hat Enterprise Linux 7,Oracle Linux 7
-+# reboot = false
-+# strategy = restrict
-+# complexity = low
-+# disruption = low
-+
-+- name: "Configure sshd to use approved ciphers"
-+  lineinfile:
-+    path: /etc/ssh/sshd_config
-+    line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
-+    state: present
-+    regexp: '^[\s]*[Cc]iphers[\s]+(aes256-ctr(?=[\w,-@]+|$),?)?(aes192-ctr(?=[\w,-@]+|$),?)?(aes128-ctr(?=[\w,-@]+|$),?)?[\s]*(?:#.*)?$'
-+    create: True
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh
-new file mode 100644
-index 0000000000..8f751ed516
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh
-@@ -0,0 +1,7 @@
-+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Oracle Linux 7
-+
-+if grep -q -P '^\s*[Cc]iphers\s+' /etc/ssh/sshd_config; then
-+  sed -i 's/^\s*[Cc]iphers.*/Ciphers aes256-ctr,aes192-ctr,aes128-ctr/' /etc/ssh/sshd_config
-+else
-+  echo "Ciphers aes256-ctr,aes192-ctr,aes128-ctr" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml
-new file mode 100644
-index 0000000000..53ff0a2a9e
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml
-@@ -0,0 +1,38 @@
-+<def-group>
-+  <definition class="compliance" id="sshd_use_approved_ciphers_ordered_stig" version="1">
-+    {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.") }}}
-+    <criteria operator="AND">
-+      <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
-+      <criteria comment="SSH is configured correctly or is not installed"
-+      operator="OR">
-+        <criteria comment="sshd is not installed" operator="AND">
-+          <extend_definition comment="sshd is not required or requirement is unset"
-+          definition_ref="sshd_not_required_or_unset" />
-+          <extend_definition comment="rpm package openssh-server removed"
-+          definition_ref="package_openssh-server_removed" />
-+        </criteria>
-+        <criteria comment="sshd is installed and configured" operator="AND">
-+          <extend_definition comment="sshd is required or requirement is unset"
-+          definition_ref="sshd_required_or_unset" />
-+          <extend_definition comment="rpm package openssh-server installed"
-+          definition_ref="package_openssh-server_installed" />
-+          <criterion comment="Check the Cipers list in /etc/ssh/sshd_config"
-+          test_ref="test_sshd_use_approved_ciphers_ordered_stig" />
-+        </criteria>
-+      </criteria>
-+    </criteria>
-+  </definition>
-+
-+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
-+  comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file"
-+  id="test_sshd_use_approved_ciphers_ordered_stig" version="1">
-+    <ind:object object_ref="obj_sshd_use_approved_ciphers_ordered_stig" />
-+  </ind:textfilecontent54_test>
-+
-+  <ind:textfilecontent54_object id="obj_sshd_use_approved_ciphers_ordered_stig" version="1">
-+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
-+    <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$</ind:pattern>
-+    <ind:instance datatype="int">1</ind:instance>
-+  </ind:textfilecontent54_object>
-+
-+</def-group>
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml
-new file mode 100644
-index 0000000000..0751064179
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/rule.yml
-@@ -0,0 +1,64 @@
-+documentation_complete: true
-+
-+prodtype: rhel7
-+
-+title: 'Use Only FIPS 140-2 Validated Ciphers'
-+
-+description: |-
-+    Limit the ciphers to those algorithms which are FIPS-approved.
-+    The following line in <tt>/etc/ssh/sshd_config</tt>
-+    demonstrates use of FIPS-approved ciphers:
-+    <pre>Ciphers aes256-ctr,aes192-ctr,aes128-ctr</pre>
-+    This rule ensures that there are configured ciphers mentioned
-+    above (or their subset), keeping the given order of algorithms.
-+
-+rationale: |-
-+    Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore
-+    cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
-+    <br />
-+    Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to
-+    cryptographic modules.
-+    <br />
-+    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
-+    utilize authentication that meets industry and government requirements. For government systems, this allows
-+    Security Levels 1, 2, 3, or 4 for use on {{{ full_name }}}.
-+
-+severity: medium
-+
-+identifiers:
-+    cce@rhel7: CCE-83398-8
-+
-+references:
-+    disa: CCI-000068,CCI-000366,CCI-000803,CCI-000877,CCI-002890,CCI-003123
-+    srg: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174
-+    stigid@rhel7: RHEL-07-040110
-+
-+ocil_clause: 'FIPS ciphers are not configured or the enabled ciphers are not FIPS-approved'
-+
-+ocil: |-
-+    Only FIPS ciphers should be used. To verify that only FIPS-approved
-+    ciphers are in use, run the following command:
-+    <pre>$ sudo grep Ciphers /etc/ssh/sshd_config</pre>
-+    The output should contain only following ciphers (or a subset) in the exact order:
-+    <pre>aes256-ctr,aes192-ctr,aes128-ctr</pre>
-+
-+warnings:
-+    - general: |-
-+        The system needs to be rebooted for these changes to take effect.
-+    - regulatory: |-
-+        System Crypto Modules must be provided by a vendor that undergoes
-+        FIPS-140 certifications.
-+        FIPS-140 is applicable to all Federal agencies that use
-+        cryptographic-based security systems to protect sensitive information
-+        in computer and telecommunication systems (including voice systems) as
-+        defined in Section 5131 of the Information Technology Management Reform
-+        Act of 1996, Public Law 104-106. This standard shall be used in
-+        designing and implementing cryptographic modules that Federal
-+        departments and agencies operate or are operated for them under
-+        contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
-+        To meet this, the system has to have cryptographic software provided by
-+        a vendor that has undergone this certification. This means providing
-+        documentation, test results, design information, and independent third
-+        party review by an accredited lab. While open source software is
-+        capable of meeting this, it does not meet FIPS-140 unless the vendor
-+        submits to this process.
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/comment.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/comment.fail.sh
-new file mode 100644
-index 0000000000..daff7d7c53
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/comment.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/# ciphers aes256-ctr,aes192-ctr,aes128-ctr/" /etc/ssh/sshd_config
-+else
-+	echo "# ciphers aes256-ctr,aes192-ctr,aes128-ctr" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_reduced_list.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_reduced_list.pass.sh
-new file mode 100644
-index 0000000000..b9d22262af
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_reduced_list.pass.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/Ciphers aes192-ctr,aes128-ctr/" /etc/ssh/sshd_config
-+else
-+	echo "Ciphers aes192-ctr,aes128-ctr" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_scrambled.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_scrambled.fail.sh
-new file mode 100644
-index 0000000000..b99d3832cd
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_scrambled.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr/" /etc/ssh/sshd_config
-+else
-+	echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh
-new file mode 100644
-index 0000000000..6dfd54631c
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/ciphers aes256-ctr,aes192-ctr,aes128-ctr/" /etc/ssh/sshd_config
-+else
-+	echo 'ciphers aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/line_not_there.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/line_not_there.fail.sh
-new file mode 100644
-index 0000000000..7b38914a1a
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/line_not_there.fail.sh
-@@ -0,0 +1,3 @@
-+#!/bin/bash
-+
-+sed -i "/^Ciphers.*/d" /etc/ssh/sshd_config
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/no_parameters.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/no_parameters.fail.sh
-new file mode 100644
-index 0000000000..6fdb47093d
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/no_parameters.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/Ciphers /" /etc/ssh/sshd_config
-+else
-+	echo 'Ciphers ' >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value.fail.sh
-new file mode 100644
-index 0000000000..24fdf0f30d
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^Ciphers" /etc/ssh/sshd_config; then
-+	sed -i "s/^Ciphers.*/ Ciphers aes128-ctr,aes192-ctr,weak-cipher,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator\.liu\.se/" /etc/ssh/sshd_config
-+else
-+	echo " Ciphers aes128-ctr,aes192-ctr,weak-cipher,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator\.liu\.se" >> /etc/ssh/sshd_config
-+fi
-diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
-index 6c06a8ede6..adf86894e1 100644
---- a/rhel7/profiles/stig.profile
-+++ b/rhel7/profiles/stig.profile
-@@ -239,8 +239,7 @@ selections:
-     - install_antivirus
-     - accounts_max_concurrent_login_sessions
-     - configure_firewalld_ports
--    - sshd_approved_ciphers=stig
--    - sshd_use_approved_ciphers
-+    - sshd_use_approved_ciphers_ordered_stig
-     - accounts_tmout
-     - sshd_enable_warning_banner
-     - sssd_ldap_start_tls

SOURCES/scap-security-guide-0.1.55-sshd_use_approved_macs_stig-PR_6546.patch

@@ -1,386 +0,0 @@
-From 5f8f98024f8955a0327b67f873923757a51d082c Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 19 Jan 2021 12:32:07 +0100
-Subject: [PATCH 1/7] add rule and remediations
-
----
- .../ansible/shared.yml                        | 13 +++++
- .../bash/shared.sh                            |  7 +++
- .../oval/shared.xml                           | 38 +++++++++++++
- .../rule.yml                                  | 57 +++++++++++++++++++
- shared/references/cce-redhat-avail.txt        |  1 -
- 5 files changed, 115 insertions(+), 1 deletion(-)
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
-new file mode 100644
-index 0000000000..cefba7db05
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml
-@@ -0,0 +1,13 @@
-+# platform = Red Hat Enterprise Linux 7,Oracle Linux 7
-+# reboot = false
-+# strategy = restrict
-+# complexity = low
-+# disruption = low
-+
-+- name: "Configure sshd to use approved MACs"
-+  lineinfile:
-+    path: /etc/ssh/sshd_config
-+    line: 'MACs hmac-sha2-512,hmac-sha2-256'
-+    state: present
-+    regexp: '^[\s]*MACs[\s]+(hmac-sha2-512(?=[\w,-@]+|$),?)?(hmac-sha2-256(?=[\w,-@]+|$),?)?[\s]*(?:#.*)?$'
-+    create: True
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
-new file mode 100644
-index 0000000000..c76190fb96
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
-@@ -0,0 +1,7 @@
-+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Oracle Linux 7
-+
-+if grep -q -P '^[[:space:]]*MACs[[:space:]]+' /etc/ssh/sshd_config; then
-+  sed -i 's/^\s*MACs.*/MACs hmac-sha2-512,hmac-sha2-256/' /etc/ssh/sshd_config
-+else
-+  echo "MACs hmac-sha2-512,hmac-sha2-256" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-new file mode 100644
-index 0000000000..d7fbd9f0ed
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-@@ -0,0 +1,38 @@
-+<def-group>
-+  <definition class="compliance" id="sshd_use_approved_macs_ordered_stig" version="1">
-+    {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.") }}}
-+    <criteria operator="AND">
-+      <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
-+      <criteria comment="SSH is configured correctly or is not installed"
-+      operator="OR">
-+        <criteria comment="sshd is not installed" operator="AND">
-+          <extend_definition comment="sshd is not required or requirement is unset"
-+          definition_ref="sshd_not_required_or_unset" />
-+          <extend_definition comment="rpm package openssh-server removed"
-+          definition_ref="package_openssh-server_removed" />
-+        </criteria>
-+        <criteria comment="sshd is installed and configured" operator="AND">
-+          <extend_definition comment="sshd is required or requirement is unset"
-+          definition_ref="sshd_required_or_unset" />
-+          <extend_definition comment="rpm package openssh-server installed"
-+          definition_ref="package_openssh-server_installed" />
-+          <criterion comment="Check MACs in /etc/ssh/sshd_config"
-+          test_ref="test_sshd_use_approved_macs_ordered_stig" />
-+        </criteria>
-+      </criteria>
-+    </criteria>
-+  </definition>
-+
-+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
-+  comment="tests the value of MACs setting in the /etc/ssh/sshd_config file"
-+  id="test_sshd_use_approved_macs_ordered_stig" version="1">
-+    <ind:object object_ref="obj_sshd_use_approved_macs_ordered_stig" />
-+  </ind:textfilecontent54_test>
-+
-+  <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig" version="1">
-+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
-+    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w,-@]+)(hmac-sha2-512(?=[\w,-@]+|$),?)?(hmac-sha2-256(?=[\w,-@]+|$),?)?[\s]*(?:#.*)?$</ind:pattern>
-+    <ind:instance datatype="int">1</ind:instance>
-+  </ind:textfilecontent54_object>
-+
-+</def-group>
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-new file mode 100644
-index 0000000000..dc9f7dca7c
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
-@@ -0,0 +1,57 @@
-+documentation_complete: true
-+
-+prodtype: rhel7
-+
-+title: 'Use Only FIPS 140-2 Validated MACs'
-+
-+description: |-
-+    Limit the MACs to those hash algorithms which are FIPS-approved.
-+    The following line in <tt>/etc/ssh/sshd_config</tt>
-+    demonstrates use of FIPS-approved MACs:
-+    <pre>MACs hmac-sha2-512,hmac-sha2-256</pre>
-+    This rule ensures that there are configured MACs mentioned
-+    above (or their subset), keeping the given order of algorithms.
-+
-+rationale: |-
-+    DoD Information Systems are required to use FIPS-approved cryptographic hash
-+    functions. The only SSHv2 hash algorithms meeting this requirement is SHA2.
-+
-+severity: medium
-+
-+identifiers:
-+    cce@rhel7: CCE-83398-8
-+
-+references:
-+    disa: CCI-000068,CCI-000803,CCI-000877,CCI-001453,CCI-003123
-+    srg: SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000394-GPOS-00174
-+    stigid@rhel7: RHEL-07-040400
-+
-+ocil_clause: 'MACs option is commented out or not using FIPS-approved hash algorithms'
-+
-+ocil: |-
-+    Only FIPS-approved MACs should be used. To verify that only FIPS-approved
-+    MACs are in use, run the following command:
-+    <pre>$ sudo grep -i macs /etc/ssh/sshd_config</pre>
-+    The output should contain only following MACs (or a subset) in the exact order:
-+    <pre>hmac-sha2-512,hmac-sha2-256</pre>
-+
-+warnings:
-+    - general: |-
-+        The system needs to be rebooted for these changes to take effect.
-+    - regulatory: |-
-+        System Crypto Modules must be provided by a vendor that undergoes
-+        FIPS-140 certifications.
-+        FIPS-140 is applicable to all Federal agencies that use
-+        cryptographic-based security systems to protect sensitive information
-+        in computer and telecommunication systems (including voice systems) as
-+        defined in Section 5131 of the Information Technology Management Reform
-+        Act of 1996, Public Law 104-106. This standard shall be used in
-+        designing and implementing cryptographic modules that Federal
-+        departments and agencies operate or are operated for them under
-+        contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
-+        To meet this, the system has to have cryptographic software provided by
-+        a vendor that has undergone this certification. This means providing
-+        documentation, test results, design information, and independent third
-+        party review by an accredited lab. While open source software is
-+        capable of meeting this, it does not meet FIPS-140 unless the vendor
-+        submits to this process.
-From 18ea3b8671e15c06a5c1c864d9d1d67f4262189e Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 19 Jan 2021 12:32:25 +0100
-Subject: [PATCH 2/7] add tests
-
----
- .../tests/comment.fail.sh                                  | 7 +++++++
- .../tests/correct_reduced_list.pass.sh                     | 7 +++++++
- .../tests/correct_scrambled.fail.sh                        | 7 +++++++
- .../tests/correct_value.pass.sh                            | 7 +++++++
- .../tests/line_not_there.fail.sh                           | 3 +++
- .../tests/no_parameters.fail.sh                            | 7 +++++++
- .../tests/wrong_value.fail.sh                              | 7 +++++++
- 7 files changed, 45 insertions(+)
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/comment.fail.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list.pass.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_scrambled.fail.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value.pass.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/line_not_there.fail.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/no_parameters.fail.sh
- create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value.fail.sh
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/comment.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/comment.fail.sh
-new file mode 100644
-index 0000000000..26bf18234c
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/comment.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/# MACs hmac-sha2-512,hmac-sha2-256/" /etc/ssh/sshd_config
-+else
-+	echo "# ciphers MACs hmac-sha2-512,hmac-sha2-256" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list.pass.sh
-new file mode 100644
-index 0000000000..0d922cdee9
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list.pass.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/MACs hmac-sha2-512/" /etc/ssh/sshd_config
-+else
-+	echo "MACs hmac-sha2-512" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_scrambled.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_scrambled.fail.sh
-new file mode 100644
-index 0000000000..ce3f459352
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_scrambled.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/MACs hmac-sha2-256,hmac-sha2-512/" /etc/ssh/sshd_config
-+else
-+	echo "MACs hmac-sha2-256,hmac-sha2-512" >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value.pass.sh
-new file mode 100644
-index 0000000000..19da7102a7
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value.pass.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/MACs hmac-sha2-512,hmac-sha2-256/" /etc/ssh/sshd_config
-+else
-+	echo 'MACs hmac-sha2-512,hmac-sha2-256' >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/line_not_there.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/line_not_there.fail.sh
-new file mode 100644
-index 0000000000..fd1f19347a
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/line_not_there.fail.sh
-@@ -0,0 +1,3 @@
-+#!/bin/bash
-+
-+sed -i "/^MACs.*/d" /etc/ssh/sshd_config
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/no_parameters.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/no_parameters.fail.sh
-new file mode 100644
-index 0000000000..44c07c6de0
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/no_parameters.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/MACs /" /etc/ssh/sshd_config
-+else
-+	echo 'MACs ' >> /etc/ssh/sshd_config
-+fi
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value.fail.sh
-new file mode 100644
-index 0000000000..cf56cd228f
---- /dev/null
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value.fail.sh
-@@ -0,0 +1,7 @@
-+#!/bin/bash
-+
-+if grep -q "^MACs" /etc/ssh/sshd_config; then
-+	sed -i "s/^MACs.*/MACs hmac-sha2-512,hmac-sha2-256,blahblah/" /etc/ssh/sshd_config
-+else
-+	echo "MACs hmac-sha2-512,hmac-sha2-256,blahblah" >> /etc/ssh/sshd_config
-+fi
-
-From a334b4b434adf92c94b8bd6bb888751782e70ad3 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 19 Jan 2021 12:32:58 +0100
-Subject: [PATCH 3/7] modify rhel7 stig profile
-
----
- rhel7/profiles/stig.profile | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
-index 6c06a8ede6..17c781d3eb 100644
---- a/rhel7/profiles/stig.profile
-+++ b/rhel7/profiles/stig.profile
-@@ -28,7 +28,6 @@ selections:
-     - inactivity_timeout_value=15_minutes
-     - var_screensaver_lock_delay=5_seconds
-     - sshd_idle_timeout_value=10_minutes
--    - sshd_approved_macs=stig
-     - var_accounts_fail_delay=4
-     - var_selinux_state=enforcing
-     - var_selinux_policy_name=targeted
-@@ -259,7 +258,7 @@ selections:
-     - sshd_print_last_log
-     - sshd_disable_root_login
-     - sshd_allow_only_protocol2
--    - sshd_use_approved_macs
-+    - sshd_use_approved_macs_ordered_stig
-     - file_permissions_sshd_pub_key
-     - file_permissions_sshd_private_key
-     - sshd_disable_gssapi_auth
-
-From df71fc735efa8754a73fab5d355d422c6e0ffa53 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Tue, 19 Jan 2021 12:33:10 +0100
-Subject: [PATCH 4/7] remove rhel7 stigid from sshd_use_approved_macs
-
----
- .../services/ssh/ssh_server/sshd_use_approved_macs/rule.yml      | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-index 394c733f51..d47eb443f5 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml
-@@ -54,7 +54,6 @@ references:
-     nist-csf: PR.AC-1,PR.AC-3,PR.DS-5,PR.PT-4
-     srg: SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000394-GPOS-00174
-     vmmsrg: SRG-OS-000033-VMM-000140,SRG-OS-000120-VMM-000600,SRG-OS-000478-VMM-001980,SRG-OS-000480-VMM-002000,SRG-OS-000396-VMM-001590
--    stigid@rhel7: RHEL-07-040400
-     stigid@sle12: SLES-12-030180
-     isa-62443-2013: 'SR 1.1,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.6,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 7.1,SR 7.6'
-     isa-62443-2009: 4.3.3.5.1,4.3.3.6.6
-
-From 9c24aaaba67f0123a82335672fd25aacd913caa4 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Thu, 21 Jan 2021 11:43:16 +0100
-Subject: [PATCH 5/7] simplify regex
-
----
- .../sshd_use_approved_macs_ordered_stig/oval/shared.xml         | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-index d7fbd9f0ed..5973488661 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-@@ -31,7 +31,7 @@
- 
-   <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig" version="1">
-     <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
--    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w,-@]+)(hmac-sha2-512(?=[\w,-@]+|$),?)?(hmac-sha2-256(?=[\w,-@]+|$),?)?[\s]*(?:#.*)?$</ind:pattern>
-+    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w,-@]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$</ind:pattern>
-     <ind:instance datatype="int">1</ind:instance>
-   </ind:textfilecontent54_object>
- 
-
-From e3973f4c2988308a2d1a18e67a730a059f791336 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Thu, 21 Jan 2021 11:55:19 +0100
-Subject: [PATCH 6/7] make bash remediation more readable
-
----
- .../sshd_use_approved_macs_ordered_stig/bash/shared.sh          | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
-index c76190fb96..f8f6f39bee 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh
-@@ -1,6 +1,6 @@
- # platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Oracle Linux 7
- 
--if grep -q -P '^[[:space:]]*MACs[[:space:]]+' /etc/ssh/sshd_config; then
-+if grep -q -P '^\s*MACs\s+' /etc/ssh/sshd_config; then
-   sed -i 's/^\s*MACs.*/MACs hmac-sha2-512,hmac-sha2-256/' /etc/ssh/sshd_config
- else
-   echo "MACs hmac-sha2-512,hmac-sha2-256" >> /etc/ssh/sshd_config
-
-From e5c379ac8cbd7bd42b116d3a5473a78406a662fd Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Thu, 21 Jan 2021 13:05:18 +0100
-Subject: [PATCH 7/7] one more small fix to oval regex
-
----
- .../sshd_use_approved_macs_ordered_stig/oval/shared.xml         | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-index 5973488661..b5443b07c4 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml
-@@ -31,7 +31,7 @@
- 
-   <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig" version="1">
-     <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
--    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w,-@]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$</ind:pattern>
-+    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$</ind:pattern>
-     <ind:instance datatype="int">1</ind:instance>
-   </ind:textfilecontent54_object>
- 

SOURCES/scap-security-guide-0.1.55-supress_lint_errors-PR_6542.patch

@@ -1,30 +0,0 @@
-From e5399b7bf17d5bdb995851b3d2a27f3ab2e6066a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 18 Jan 2021 15:21:51 +0100
-Subject: [PATCH] Supress Ansible lint error 503
-
-It says that Tasks that run when changed should likely be handlers.
-However, we don't use handlers, and developer guide says that handlers
-aren't supported. I assume handlers would cause problems for SCAP
-scanners. Unless we start to support handlers this error isn't fixable
-for us therefore we can suppress it globally.
-
-Addressing problems in scap-security-guide-lint-check Jenkins job:
-30/48 Test #260: ansible-playbook-ansible-lint-check-rhel8 .........***Failed  630.77 sec
-all/sudo_add_umask.yml:30: [E503] Tasks that run when changed should likely be handlers
-anssi_bp28_enhanced/sudo_add_umask.yml:30: [E503] Tasks that run when changed should likely be handlers
-anssi_bp28_high/sudo_add_umask.yml:30: [E503] Tasks that run when changed should likely be handlers
-anssi_bp28_intermediary/sudo_add_umask.yml:30: [E503] Tasks that run when changed should likely be handlers
----
- tests/ansible-lint_config.yml | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tests/ansible-lint_config.yml b/tests/ansible-lint_config.yml
-index d5107476a9..e4b4443f8c 100644
---- a/tests/ansible-lint_config.yml
-+++ b/tests/ansible-lint_config.yml
-@@ -3,3 +3,4 @@ skip_list:
-   - '301' # Commands should not change things if nothing needs doing
-   - '303' # Using command rather than module
-   - '403' # Package installs should not use latest
-+  - '503' # Tasks that run when changed should likely be handlers

SOURCES/scap-security-guide-0.1.55-update_RHEL_07_040710-PR_6537.patch

@@ -1,73 +0,0 @@
-From 35eb6ba272c4ca0b7bae1c10af182e59e3e52c6a Mon Sep 17 00:00:00 2001
-From: Gabriel Becker <ggasparb@redhat.com>
-Date: Fri, 15 Jan 2021 16:28:07 +0100
-Subject: [PATCH] RHEL-07-040710 now configures X11Forwarding to disable.
-
----
- .../sshd_disable_x11_forwarding/rule.yml      | 19 ++++++++++---------
- .../sshd_enable_x11_forwarding/rule.yml       |  1 -
- rhel7/profiles/stig.profile                   |  2 +-
- 3 files changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-index 1779129f87..7da2e067a6 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
-@@ -19,22 +19,23 @@ rationale: |-
-     other users on the X11 server. Note that even if X11 forwarding is disabled,
-     users can always install their own forwarders.
- 
--severity: low
-+severity: medium
- 
--ocil_clause: "that the X11Forwarding option exists and is enabled"
--
--ocil: |-
--    {{{ ocil_sshd_option(default="no", option="X11Forwarding", value="no") }}}
-+{{{ complete_ocil_entry_sshd_option(default="yes", option="X11Forwarding", value="no") }}}
- 
- identifiers:
-     cce@rhel7: CCE-83359-0
-     cce@rhel8: CCE-83360-8
- 
- references:
--  cis@rhel7: 5.2.4
--  cis@rhel8: 5.2.6
--  cis@sle12: 5.2.4
--  cis@sle15: 5.2.6
-+    cis@rhel7: 5.2.4
-+    cis@rhel8: 5.2.6
-+    cis@sle12: 5.2.4
-+    cis@sle15: 5.2.6
-+    stigid@rhel7: RHEL-07-040710
-+    srg: SRG-OS-000480-GPOS-00227
-+    disa: CCI-000366
-+    nist: CM-6(b)
- 
- template:
-     name: sshd_lineinfile
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-index 803e581a0f..87c3cb7f5a 100644
---- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
-@@ -29,7 +29,6 @@ references:
-     nist: CM-6(a),AC-17(a),AC-17(2)
-     nist-csf: DE.AE-1,PR.DS-7,PR.IP-1
-     srg: SRG-OS-000480-GPOS-00227
--    stigid@rhel7: RHEL-07-040710
-     stigid@sle12: SLES-12-030260
-     isa-62443-2013: 'SR 7.6'
-     isa-62443-2009: 4.3.4.3.2,4.3.4.3.3,4.4.3.3
-diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
-index 817e0982e5..6c06a8ede6 100644
---- a/rhel7/profiles/stig.profile
-+++ b/rhel7/profiles/stig.profile
-@@ -285,7 +285,7 @@ selections:
-     - postfix_prevent_unrestricted_relay
-     - package_vsftpd_removed
-     - package_tftp-server_removed
--    - sshd_enable_x11_forwarding
-+    - sshd_disable_x11_forwarding
-     - sshd_x11_use_localhost
-     - tftpd_uses_secure_mode
-     - package_xorg-x11-server-common_removed

SOURCES/scap-security-guide-0.1.55-update_anssi_profile_title-PR_6592.patch

@@ -1,688 +0,0 @@
-From e3dd773f905114c1d16ac3283611218a685f1722 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Feb 2021 09:17:15 +0100
-Subject: [PATCH 1/5] Remove extends key from ANSSI intermediary profile
-
-This is not necessary as the ANSSI controls file handles this.
----
- rhel8/profiles/anssi_bp28_intermediary.profile | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/rhel8/profiles/anssi_bp28_intermediary.profile b/rhel8/profiles/anssi_bp28_intermediary.profile
-index 64a9b542a0..4d0029af1d 100644
---- a/rhel8/profiles/anssi_bp28_intermediary.profile
-+++ b/rhel8/profiles/anssi_bp28_intermediary.profile
-@@ -7,7 +7,6 @@ description:
-     Agence nationale de la sécurité des systèmes d''information. Based on
-     https://www.ssi.gouv.fr/.
- 
--extends: anssi_bp28_minimal
- 
- selections:
-   - anssi:all:intermediary
-
-From 48845dbde69e69a043fc90622f21dc73d6a72018 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Feb 2021 09:21:47 +0100
-Subject: [PATCH 2/5] Update title and descriptions of ANSSI profiles
-
----
- controls/anssi.yml                             |  2 +-
- rhel7/profiles/anssi_nt28_enhanced.profile     | 12 +++++++++---
- rhel7/profiles/anssi_nt28_high.profile         | 12 +++++++++---
- rhel7/profiles/anssi_nt28_intermediary.profile | 14 ++++++++++----
- rhel7/profiles/anssi_nt28_minimal.profile      | 14 ++++++++++----
- rhel8/profiles/anssi_bp28_enhanced.profile     | 12 ++++++++----
- rhel8/profiles/anssi_bp28_high.profile         | 14 +++++++++-----
- rhel8/profiles/anssi_bp28_intermediary.profile | 11 +++++++----
- rhel8/profiles/anssi_bp28_minimal.profile      | 12 ++++++++----
- 9 files changed, 71 insertions(+), 32 deletions(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index 2173d23f9d..54c05245b7 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -1,5 +1,5 @@
- policy: 'ANSSI-BP-028'
--title: 'ANSSI-BP-028'
-+title: 'Configuration Recommendations of a GNU/Linux System'
- id: anssi
- version: '1.2'
- source: https://www.ssi.gouv.fr/uploads/2019/03/linux_configuration-en-v1.2.pdf
-diff --git a/rhel7/profiles/anssi_nt28_enhanced.profile b/rhel7/profiles/anssi_nt28_enhanced.profile
-index 5893d12dbd..49fa8593fe 100644
---- a/rhel7/profiles/anssi_nt28_enhanced.profile
-+++ b/rhel7/profiles/anssi_nt28_enhanced.profile
-@@ -1,9 +1,15 @@
- documentation_complete: true
- 
--title: 'DRAFT - ANSSI DAT-BP28 (enhanced)'
-+title: 'ANSSI BP-028 (enhanced)'
- 
--description: 'Draft profile for ANSSI compliance at the enhanced level. ANSSI stands for Agence nationale de la sécurité des
--    systèmes d''information. Based on https://www.ssi.gouv.fr/.'
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the enhanced hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-     - anssi:all:enhanced
-diff --git a/rhel7/profiles/anssi_nt28_high.profile b/rhel7/profiles/anssi_nt28_high.profile
-index 52ae1dd6d2..2853f20607 100644
---- a/rhel7/profiles/anssi_nt28_high.profile
-+++ b/rhel7/profiles/anssi_nt28_high.profile
-@@ -1,9 +1,15 @@
- documentation_complete: true
- 
--title: 'DRAFT - ANSSI DAT-BP28 (high)'
-+title: 'DRAFT - ANSSI BP-028 (high)'
- 
--description: 'Draft profile for ANSSI compliance at the high level. ANSSI stands for Agence nationale de la sécurité des systèmes
--    d''information. Based on https://www.ssi.gouv.fr/.'
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the high hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-     - anssi:all:high
-diff --git a/rhel7/profiles/anssi_nt28_intermediary.profile b/rhel7/profiles/anssi_nt28_intermediary.profile
-index e18225247b..55f985a7a9 100644
---- a/rhel7/profiles/anssi_nt28_intermediary.profile
-+++ b/rhel7/profiles/anssi_nt28_intermediary.profile
-@@ -1,10 +1,16 @@
- # Don't forget to enable build of tables in rhel7CMakeLists.txt when setting to true
- documentation_complete: true
- 
--title: 'DRAFT - ANSSI DAT-BP28 (intermediary)'
-+title: 'ANSSI BP-028 (intermediary)'
- 
--description: 'Draft profile for ANSSI compliance at the intermediary level. ANSSI stands for Agence nationale de la sécurité
--    des systèmes d''information. Based on https://www.ssi.gouv.fr/.'
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the intermediary hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
--  - anssi:all:intermediary
-+    - anssi:all:intermediary
-diff --git a/rhel7/profiles/anssi_nt28_minimal.profile b/rhel7/profiles/anssi_nt28_minimal.profile
-index 214f37d14b..7786a26b45 100644
---- a/rhel7/profiles/anssi_nt28_minimal.profile
-+++ b/rhel7/profiles/anssi_nt28_minimal.profile
-@@ -1,9 +1,15 @@
- documentation_complete: true
- 
--title: 'DRAFT - ANSSI DAT-BP28 (minimal)'
-+title: 'ANSSI BP-028 (minimal)'
- 
--description: 'Draft profile for ANSSI compliance at the minimal level. ANSSI stands for Agence nationale de la sécurité des
--    systèmes d''information. Based on https://www.ssi.gouv.fr/.'
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the minimal hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
--  - anssi:all:minimal
-+    - anssi:all:minimal
-diff --git a/rhel8/profiles/anssi_bp28_enhanced.profile b/rhel8/profiles/anssi_bp28_enhanced.profile
-index 4c39852b65..49fa8593fe 100644
---- a/rhel8/profiles/anssi_bp28_enhanced.profile
-+++ b/rhel8/profiles/anssi_bp28_enhanced.profile
-@@ -2,10 +2,14 @@ documentation_complete: true
- 
- title: 'ANSSI BP-028 (enhanced)'
- 
--description: 
--    ANSSI BP-028 compliance at the enhanced level. ANSSI stands for
--    Agence nationale de la sécurité des systèmes d'information. Based on
--    https://www.ssi.gouv.fr/.
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the enhanced hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-     - anssi:all:enhanced
-diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
-index 6b0489e0f1..2853f20607 100644
---- a/rhel8/profiles/anssi_bp28_high.profile
-+++ b/rhel8/profiles/anssi_bp28_high.profile
-@@ -1,11 +1,15 @@
- documentation_complete: false
- 
--title: 'ANSSI BP-028 (high)'
-+title: 'DRAFT - ANSSI BP-028 (high)'
- 
--description: 
--    ANSSI BP-028 compliance at the high level. ANSSI stands for
--    Agence nationale de la sécurité des systèmes d'information. Based on
--    https://www.ssi.gouv.fr/.
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the high hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-     - anssi:all:high
-diff --git a/rhel8/profiles/anssi_bp28_intermediary.profile b/rhel8/profiles/anssi_bp28_intermediary.profile
-index 4d0029af1d..50ab1ba0b8 100644
---- a/rhel8/profiles/anssi_bp28_intermediary.profile
-+++ b/rhel8/profiles/anssi_bp28_intermediary.profile
-@@ -2,11 +2,14 @@ documentation_complete: true
- 
- title: 'ANSSI BP-028 (intermediary)'
- 
--description: 
--    ANSSI BP-028 compliance at the intermediary level. ANSSI stands for
--    Agence nationale de la sécurité des systèmes d''information. Based on
--    https://www.ssi.gouv.fr/.
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the intermediary hardening level.
- 
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-   - anssi:all:intermediary
-diff --git a/rhel8/profiles/anssi_bp28_minimal.profile b/rhel8/profiles/anssi_bp28_minimal.profile
-index d8f076c3e7..d477d34787 100644
---- a/rhel8/profiles/anssi_bp28_minimal.profile
-+++ b/rhel8/profiles/anssi_bp28_minimal.profile
-@@ -2,10 +2,14 @@ documentation_complete: true
- 
- title: 'ANSSI BP-028 (minimal)'
- 
--description: 
--    ANSSI BP-028 compliance at the minimal level. ANSSI stands for
--    Agence nationale de la sécurité des systèmes d'information. Based on
--    https://www.ssi.gouv.fr/.
-+description: |-
-+    This profile contains configurations that align to ANSSI BP-28 at the minimal hardening level.
-+
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+
-+    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-   - anssi:all:minimal
-
-From 5ea9fe70c78df6c4278aec71b9ab000a9884cea7 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Feb 2021 12:23:14 +0100
-Subject: [PATCH 3/5] Add missing hyphen in ANSSI profiles descriptions
-
----
- rhel7/profiles/anssi_nt28_enhanced.profile     | 8 ++++----
- rhel7/profiles/anssi_nt28_high.profile         | 8 ++++----
- rhel7/profiles/anssi_nt28_intermediary.profile | 8 ++++----
- rhel7/profiles/anssi_nt28_minimal.profile      | 8 ++++----
- rhel8/profiles/anssi_bp28_enhanced.profile     | 8 ++++----
- rhel8/profiles/anssi_bp28_high.profile         | 8 ++++----
- rhel8/profiles/anssi_bp28_intermediary.profile | 8 ++++----
- rhel8/profiles/anssi_bp28_minimal.profile      | 8 ++++----
- 8 files changed, 32 insertions(+), 32 deletions(-)
-
-diff --git a/rhel7/profiles/anssi_nt28_enhanced.profile b/rhel7/profiles/anssi_nt28_enhanced.profile
-index 49fa8593fe..411f0c03aa 100644
---- a/rhel7/profiles/anssi_nt28_enhanced.profile
-+++ b/rhel7/profiles/anssi_nt28_enhanced.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (enhanced)'
-+title: 'ANSSI-BP-028 (enhanced)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the enhanced hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the enhanced hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel7/profiles/anssi_nt28_high.profile b/rhel7/profiles/anssi_nt28_high.profile
-index 2853f20607..d9147b2dd0 100644
---- a/rhel7/profiles/anssi_nt28_high.profile
-+++ b/rhel7/profiles/anssi_nt28_high.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'DRAFT - ANSSI BP-028 (high)'
-+title: 'DRAFT - ANSSI-BP-028 (high)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the high hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the high hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel7/profiles/anssi_nt28_intermediary.profile b/rhel7/profiles/anssi_nt28_intermediary.profile
-index 55f985a7a9..6e39a978e5 100644
---- a/rhel7/profiles/anssi_nt28_intermediary.profile
-+++ b/rhel7/profiles/anssi_nt28_intermediary.profile
-@@ -1,15 +1,15 @@
- # Don't forget to enable build of tables in rhel7CMakeLists.txt when setting to true
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (intermediary)'
-+title: 'ANSSI-BP-028 (intermediary)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the intermediary hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the intermediary hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel7/profiles/anssi_nt28_minimal.profile b/rhel7/profiles/anssi_nt28_minimal.profile
-index 7786a26b45..f0a77bccd7 100644
---- a/rhel7/profiles/anssi_nt28_minimal.profile
-+++ b/rhel7/profiles/anssi_nt28_minimal.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (minimal)'
-+title: 'ANSSI-BP-028 (minimal)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the minimal hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the minimal hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel8/profiles/anssi_bp28_enhanced.profile b/rhel8/profiles/anssi_bp28_enhanced.profile
-index 49fa8593fe..411f0c03aa 100644
---- a/rhel8/profiles/anssi_bp28_enhanced.profile
-+++ b/rhel8/profiles/anssi_bp28_enhanced.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (enhanced)'
-+title: 'ANSSI-BP-028 (enhanced)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the enhanced hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the enhanced hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
-index 2853f20607..d9147b2dd0 100644
---- a/rhel8/profiles/anssi_bp28_high.profile
-+++ b/rhel8/profiles/anssi_bp28_high.profile
-@@ -1,14 +1,14 @@
- documentation_complete: false
- 
--title: 'DRAFT - ANSSI BP-028 (high)'
-+title: 'DRAFT - ANSSI-BP-028 (high)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the high hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the high hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel8/profiles/anssi_bp28_intermediary.profile b/rhel8/profiles/anssi_bp28_intermediary.profile
-index 50ab1ba0b8..6dcd2b8ef2 100644
---- a/rhel8/profiles/anssi_bp28_intermediary.profile
-+++ b/rhel8/profiles/anssi_bp28_intermediary.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (intermediary)'
-+title: 'ANSSI-BP-028 (intermediary)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the intermediary hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the intermediary hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-diff --git a/rhel8/profiles/anssi_bp28_minimal.profile b/rhel8/profiles/anssi_bp28_minimal.profile
-index d477d34787..54e8cbd5a6 100644
---- a/rhel8/profiles/anssi_bp28_minimal.profile
-+++ b/rhel8/profiles/anssi_bp28_minimal.profile
-@@ -1,14 +1,14 @@
- documentation_complete: true
- 
--title: 'ANSSI BP-028 (minimal)'
-+title: 'ANSSI-BP-028 (minimal)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI BP-28 at the minimal hardening level.
-+    This profile contains configurations that align to ANSSI-BP-28 at the minimal hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
--    ANSSI BP-028 is a configuration recommendation for GNU/Linux systems.
-+    ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
--    A copy of the ANSSI BP-028 can be found at the ANSSI website:
-+    A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-     https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
- 
- selections:
-
-From c111061d6f1b9c134cc4cff1b712c44f271bcf42 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Fri, 5 Feb 2021 11:11:57 +0100
-Subject: [PATCH 4/5] Fix ANSSI document number for consistency
-
----
- rhel7/profiles/anssi_nt28_enhanced.profile     | 2 +-
- rhel7/profiles/anssi_nt28_high.profile         | 2 +-
- rhel7/profiles/anssi_nt28_intermediary.profile | 2 +-
- rhel7/profiles/anssi_nt28_minimal.profile      | 2 +-
- rhel8/profiles/anssi_bp28_enhanced.profile     | 2 +-
- rhel8/profiles/anssi_bp28_high.profile         | 2 +-
- rhel8/profiles/anssi_bp28_intermediary.profile | 2 +-
- rhel8/profiles/anssi_bp28_minimal.profile      | 2 +-
- 8 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/rhel7/profiles/anssi_nt28_enhanced.profile b/rhel7/profiles/anssi_nt28_enhanced.profile
-index 411f0c03aa..846ace9002 100644
---- a/rhel7/profiles/anssi_nt28_enhanced.profile
-+++ b/rhel7/profiles/anssi_nt28_enhanced.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (enhanced)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the enhanced hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel7/profiles/anssi_nt28_high.profile b/rhel7/profiles/anssi_nt28_high.profile
-index d9147b2dd0..e4db830291 100644
---- a/rhel7/profiles/anssi_nt28_high.profile
-+++ b/rhel7/profiles/anssi_nt28_high.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'DRAFT - ANSSI-BP-028 (high)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the high hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the high hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel7/profiles/anssi_nt28_intermediary.profile b/rhel7/profiles/anssi_nt28_intermediary.profile
-index 6e39a978e5..4454976862 100644
---- a/rhel7/profiles/anssi_nt28_intermediary.profile
-+++ b/rhel7/profiles/anssi_nt28_intermediary.profile
-@@ -4,7 +4,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (intermediary)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the intermediary hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel7/profiles/anssi_nt28_minimal.profile b/rhel7/profiles/anssi_nt28_minimal.profile
-index f0a77bccd7..cc2cbd8359 100644
---- a/rhel7/profiles/anssi_nt28_minimal.profile
-+++ b/rhel7/profiles/anssi_nt28_minimal.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (minimal)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the minimal hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel8/profiles/anssi_bp28_enhanced.profile b/rhel8/profiles/anssi_bp28_enhanced.profile
-index 411f0c03aa..846ace9002 100644
---- a/rhel8/profiles/anssi_bp28_enhanced.profile
-+++ b/rhel8/profiles/anssi_bp28_enhanced.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (enhanced)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the enhanced hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
-index d9147b2dd0..e4db830291 100644
---- a/rhel8/profiles/anssi_bp28_high.profile
-+++ b/rhel8/profiles/anssi_bp28_high.profile
-@@ -3,7 +3,7 @@ documentation_complete: false
- title: 'DRAFT - ANSSI-BP-028 (high)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the high hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the high hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel8/profiles/anssi_bp28_intermediary.profile b/rhel8/profiles/anssi_bp28_intermediary.profile
-index 6dcd2b8ef2..a9e0442257 100644
---- a/rhel8/profiles/anssi_bp28_intermediary.profile
-+++ b/rhel8/profiles/anssi_bp28_intermediary.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (intermediary)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the intermediary hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-diff --git a/rhel8/profiles/anssi_bp28_minimal.profile b/rhel8/profiles/anssi_bp28_minimal.profile
-index 54e8cbd5a6..090b571bb6 100644
---- a/rhel8/profiles/anssi_bp28_minimal.profile
-+++ b/rhel8/profiles/anssi_bp28_minimal.profile
-@@ -3,7 +3,7 @@ documentation_complete: true
- title: 'ANSSI-BP-028 (minimal)'
- 
- description: |-
--    This profile contains configurations that align to ANSSI-BP-28 at the minimal hardening level.
-+    This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level.
- 
-     ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
-
-From c4b11df5dabe389129f3cbc8a5bd9444fce09850 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Fri, 5 Feb 2021 16:05:07 +0100
-Subject: [PATCH 5/5] Fix single quote in ANSSI name
-
-Previously the description was enclosed in single quotes, requiring a
-single quote to be escaped.
-Now the description is not enclosed in single quotes and there is no
-need to escape it.
----
- rhel7/profiles/anssi_nt28_enhanced.profile     | 2 +-
- rhel7/profiles/anssi_nt28_high.profile         | 2 +-
- rhel7/profiles/anssi_nt28_intermediary.profile | 2 +-
- rhel7/profiles/anssi_nt28_minimal.profile      | 2 +-
- rhel8/profiles/anssi_bp28_enhanced.profile     | 2 +-
- rhel8/profiles/anssi_bp28_high.profile         | 2 +-
- rhel8/profiles/anssi_bp28_intermediary.profile | 2 +-
- rhel8/profiles/anssi_bp28_minimal.profile      | 2 +-
- 8 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/rhel7/profiles/anssi_nt28_enhanced.profile b/rhel7/profiles/anssi_nt28_enhanced.profile
-index 846ace9002..bbc11353f3 100644
---- a/rhel7/profiles/anssi_nt28_enhanced.profile
-+++ b/rhel7/profiles/anssi_nt28_enhanced.profile
-@@ -5,7 +5,7 @@ title: 'ANSSI-BP-028 (enhanced)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel7/profiles/anssi_nt28_high.profile b/rhel7/profiles/anssi_nt28_high.profile
-index e4db830291..22efad9c09 100644
---- a/rhel7/profiles/anssi_nt28_high.profile
-+++ b/rhel7/profiles/anssi_nt28_high.profile
-@@ -5,7 +5,7 @@ title: 'DRAFT - ANSSI-BP-028 (high)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the high hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel7/profiles/anssi_nt28_intermediary.profile b/rhel7/profiles/anssi_nt28_intermediary.profile
-index 4454976862..0c43ab8d73 100644
---- a/rhel7/profiles/anssi_nt28_intermediary.profile
-+++ b/rhel7/profiles/anssi_nt28_intermediary.profile
-@@ -6,7 +6,7 @@ title: 'ANSSI-BP-028 (intermediary)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel7/profiles/anssi_nt28_minimal.profile b/rhel7/profiles/anssi_nt28_minimal.profile
-index cc2cbd8359..480333747c 100644
---- a/rhel7/profiles/anssi_nt28_minimal.profile
-+++ b/rhel7/profiles/anssi_nt28_minimal.profile
-@@ -5,7 +5,7 @@ title: 'ANSSI-BP-028 (minimal)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel8/profiles/anssi_bp28_enhanced.profile b/rhel8/profiles/anssi_bp28_enhanced.profile
-index 846ace9002..bbc11353f3 100644
---- a/rhel8/profiles/anssi_bp28_enhanced.profile
-+++ b/rhel8/profiles/anssi_bp28_enhanced.profile
-@@ -5,7 +5,7 @@ title: 'ANSSI-BP-028 (enhanced)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
-index e4db830291..22efad9c09 100644
---- a/rhel8/profiles/anssi_bp28_high.profile
-+++ b/rhel8/profiles/anssi_bp28_high.profile
-@@ -5,7 +5,7 @@ title: 'DRAFT - ANSSI-BP-028 (high)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the high hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel8/profiles/anssi_bp28_intermediary.profile b/rhel8/profiles/anssi_bp28_intermediary.profile
-index a9e0442257..a592031673 100644
---- a/rhel8/profiles/anssi_bp28_intermediary.profile
-+++ b/rhel8/profiles/anssi_bp28_intermediary.profile
-@@ -5,7 +5,7 @@ title: 'ANSSI-BP-028 (intermediary)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:
-diff --git a/rhel8/profiles/anssi_bp28_minimal.profile b/rhel8/profiles/anssi_bp28_minimal.profile
-index 090b571bb6..cef8394114 100644
---- a/rhel8/profiles/anssi_bp28_minimal.profile
-+++ b/rhel8/profiles/anssi_bp28_minimal.profile
-@@ -5,7 +5,7 @@ title: 'ANSSI-BP-028 (minimal)'
- description: |-
-     This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level.
- 
--    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d''information.
-+    ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
-     ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
- 
-     A copy of the ANSSI-BP-028 can be found at the ANSSI website:

SOURCES/scap-security-guide-0.1.55-update_metadata_for_minimal_intermediary-PR_6549.patch

@@ -1,89 +0,0 @@
-From ce6a307518c55b333897f5c130f5372dee9eeae8 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 18 Jan 2021 11:18:43 +0100
-Subject: [PATCH] Update metadata for a few miminal and intermediary
- requirements
-
----
- controls/anssi.yml | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/controls/anssi.yml b/controls/anssi.yml
-index dec9d68c99..9288ac1663 100644
---- a/controls/anssi.yml
-+++ b/controls/anssi.yml
-@@ -506,7 +506,10 @@ controls:
-   - id: R27
-     title: Disabling service accounts
-     level: intermediary
--    # rules: TBD
-+    notes: >-
-+      It is difficult to generally identify the system's service accounts.
-+      Assisting rules could list users which are not disabled for manual review.
-+    automated: no
- 
-   - id: R28
-     level: enhanced
-@@ -530,7 +533,10 @@ controls:
-   - id: R30
-     level: minimal
-     title: Applications using PAM
--    # rules: TBD
-+    notes: >-
-+      Manual review is necessary to decide if the list of applications using PAM is minimal.
-+      Asssising rules could be created to list all applications using PAM for manual review.
-+    automated: no
- 
-   - id: R31
-     title: Securing PAM Authentication Network Services
-@@ -580,6 +586,7 @@ controls:
-   - id: R36
-     title: Rights to access sensitive content files
-     level: intermediary
-+    automated: yes
-     rules:
-     - file_owner_etc_shadow
-     - file_permissions_etc_shadow
-@@ -637,7 +644,10 @@ controls:
-   - id: R42
-     level: minimal
-     title: In memory services and daemons
--    # rules: TBD
-+    notes: >-
-+      Manual review is necessary to decide if the list of resident daemons is minimal.
-+      Asssising rules could be created to list sevices listening on the network for manual review.
-+    automated: no
- 
-   - id: R43
-     title: Hardening and configuring the syslog
-@@ -709,6 +719,7 @@ controls:
-   - id: R48
-     level: intermediary
-     title: Configuring the local messaging service
-+    automated: yes
-     rules:
-     - postfix_network_listening_disabled
- 
-@@ -825,6 +836,7 @@ controls:
-     level: intermediary
-     title: Privileges of target sudo users
-     description: The targeted users of a rule should be, as much as possible, non privileged users.
-+    automated: yes
-     rules:
-     - sudoers_no_root_target
- 
-@@ -840,12 +852,14 @@ controls:
-     level: intermediary
-     title: Good use of negation in a sudoers file
-     description: The sudoers configuration rules should not involve negation.
-+    automated: yes
-     rules:
-     - sudoers_no_command_negation
- 
-   - id: R63
-     level: intermediary
-     title: Explicit arguments in sudo specifications
-+    automated: yes
-     rules:
-     - sudoers_explicit_command_args
- 

SOURCES/scap-security-guide-0.1.55-update_nodev_nonroot_mount_option-PR_6606.patch

@@ -1,352 +0,0 @@
-From cbede36c7a4e35cb882c35892cff72f9f190cbf9 Mon Sep 17 00:00:00 2001
-From: Milan Lysonek <mlysonek@redhat.com>
-Date: Mon, 8 Feb 2021 15:57:43 +0100
-Subject: [PATCH 1/5] Add nodev,nosuid,noexec options to /boot in ANSSI
- kickstart
-
----
- rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg     | 2 +-
- rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg         | 2 +-
- rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg | 2 +-
- rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg     | 2 +-
- rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg         | 2 +-
- rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg | 2 +-
- 6 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-index 1d35bedb91..c381512476 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg
-@@ -99,7 +99,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-index 73225c2fab..a672b38b83 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg
-@@ -103,7 +103,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-index 20c4c59a78..88a7cee8ab 100644
---- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-+++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg
-@@ -99,7 +99,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-index 728946ecb7..6f66a3774b 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg
-@@ -90,7 +90,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-index cd0eff2625..b5c09253a5 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
-@@ -94,7 +94,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-index 3a241b06f4..fb785e0c11 100644
---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-+++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg
-@@ -90,7 +90,7 @@ zerombr
- clearpart --linux --initlabel
- 
- # Create primary system partitions (required for installs)
--part /boot --fstype=xfs --size=512
-+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
- part pv.01 --grow --size=1
- 
- # Create a Logical Volume Management (LVM) group (optional)
-
-From 15be64cc2d6c21b0351bb8d3d1b55b1924be99ca Mon Sep 17 00:00:00 2001
-From: Milan Lysonek <mlysonek@redhat.com>
-Date: Tue, 9 Feb 2021 12:45:34 +0100
-Subject: [PATCH 2/5] Add mount_option_nodev_nonroot_local_partitions bash
- remediation
-
----
- .../bash/shared.sh                             | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh
-new file mode 100644
-index 0000000000..7e2b3bd76b
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh
-@@ -0,0 +1,18 @@
-+# platform = multi_platform_all
-+. /usr/share/scap-security-guide/remediation_functions
-+
-+include_mount_options_functions
-+
-+MOUNT_OPTION="nodev"
-+# Create array of local non-root partitions
-+readarray -t partitions_records < <(findmnt --mtab --raw --evaluate | grep "^/\w" | grep "\s/dev/\w")
-+
-+for partition_record in "${partitions_records[@]}"; do
-+    # Get all important information for fstab
-+    mount_point="$(echo ${partition_record} | cut -d " " -f1)"
-+    device="$(echo ${partition_record} | cut -d " " -f2)"
-+    device_type="$(echo ${partition_record} | cut -d " " -f3)"
-+    # device and device_type will be used only in case when the device doesn't have fstab record
-+    ensure_mount_option_in_fstab "$mount_point" "$MOUNT_OPTION" "$device" "$device_type"
-+    ensure_partition_is_mounted "$mount_point"
-+done
-
-From 36958b72896a69cb580f00a986673c8ae99cb011 Mon Sep 17 00:00:00 2001
-From: Milan Lysonek <mlysonek@redhat.com>
-Date: Tue, 9 Feb 2021 12:45:54 +0100
-Subject: [PATCH 3/5] Add mount_option_nodev_nonroot_local_partitions test
- scenarios
-
----
- .../tests/correct.pass.sh                     | 23 +++++++++++++++++
- .../local_mounted_during_runtime.fail.sh      | 19 ++++++++++++++
- .../tests/missing_multiple_nodev.fail.sh      | 23 +++++++++++++++++
- .../tests/missing_one_nodev.fail.sh           | 23 +++++++++++++++++
- .../tests/remote_without_nodev.pass.sh        | 25 +++++++++++++++++++
- 5 files changed, 113 insertions(+)
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh
-new file mode 100644
-index 0000000000..8bfac4b80f
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh
-@@ -0,0 +1,23 @@
-+#!/bin/bash
-+
-+. $SHARED/partition.sh
-+
-+# Add nodev option to all records in fstab to ensure that test will
-+# run on environment where everything is set correctly for rule check.
-+cp /etc/fstab /etc/fstab.backup
-+sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup
-+awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab
-+# Remount all partitions. (--all option can't be used because it doesn't
-+# mount e.g. /boot partition
-+declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") )
-+for partition in ${partitions[@]}; do
-+    mount -o remount "$partition"
-+done
-+
-+PARTITION="/dev/new_partition1"; create_partition
-+make_fstab_given_partition_line "/tmp/partition1" ext2 nodev
-+mount_partition "/tmp/partition1"
-+
-+PARTITION="/dev/new_partition2"; create_partition
-+make_fstab_given_partition_line "/tmp/partition2" ext2 nodev
-+mount_partition "/tmp/partition2"
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh
-new file mode 100644
-index 0000000000..84cadd6f73
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh
-@@ -0,0 +1,19 @@
-+#!/bin/bash
-+
-+. $SHARED/partition.sh
-+
-+# Add nodev option to all records in fstab to ensure that test will
-+# run on environment where everything is set correctly for rule check.
-+cp /etc/fstab /etc/fstab.backup
-+sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup
-+awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab
-+# Remount all partitions. (--all option can't be used because it doesn't
-+# mount e.g. /boot partition
-+declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") )
-+for partition in ${partitions[@]}; do
-+    mount -o remount "$partition"
-+done
-+
-+PARTITION="/dev/new_partition1"; create_partition
-+mkdir /tmp/test_dir
-+mount $PARTITION /tmp/test_dir
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh
-new file mode 100644
-index 0000000000..7a09093f46
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh
-@@ -0,0 +1,23 @@
-+#!/bin/bash
-+
-+. $SHARED/partition.sh
-+
-+# Add nodev option to all records in fstab to ensure that test will
-+# run on environment where everything is set correctly for rule check.
-+cp /etc/fstab /etc/fstab.backup
-+sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup
-+awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab
-+# Remount all partitions. (--all option can't be used because it doesn't
-+# mount e.g. /boot partition
-+declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") )
-+for partition in ${partitions[@]}; do
-+    mount -o remount "$partition"
-+done
-+
-+PARTITION="/dev/new_partition1"; create_partition
-+make_fstab_given_partition_line "/tmp/partition1" ext2
-+mount_partition "/tmp/partition1"
-+
-+PARTITION="/dev/new_partition2"; create_partition
-+make_fstab_given_partition_line "/tmp/partition2" ext2
-+mount_partition "/tmp/partition2"
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh
-new file mode 100644
-index 0000000000..c20a98bdcc
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh
-@@ -0,0 +1,23 @@
-+#!/bin/bash
-+
-+. $SHARED/partition.sh
-+
-+# Add nodev option to all records in fstab to ensure that test will
-+# run on environment where everything is set correctly for rule check.
-+cp /etc/fstab /etc/fstab.backup
-+sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup
-+awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab
-+# Remount all partitions. (--all option can't be used because it doesn't
-+# mount e.g. /boot partition
-+declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") )
-+for partition in ${partitions[@]}; do
-+    mount -o remount "$partition"
-+done
-+
-+PARTITION="/dev/new_partition1"; create_partition
-+make_fstab_given_partition_line "/tmp/partition1" ext2 nodev
-+mount_partition "/tmp/partition1"
-+
-+PARTITION="/dev/new_partition2"; create_partition
-+make_fstab_given_partition_line "/tmp/partition2" ext2
-+mount_partition "/tmp/partition2"
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh
-new file mode 100644
-index 0000000000..a95410526f
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh
-@@ -0,0 +1,25 @@
-+#!/bin/bash
-+# packages = nfs-utils
-+
-+. $SHARED/partition.sh
-+
-+# Add nodev option to all records in fstab to ensure that test will
-+# run on environment where everything is set correctly for rule check.
-+cp /etc/fstab /etc/fstab.backup
-+sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup
-+awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab
-+# Remount all partitions. (--all option can't be used because it doesn't
-+# mount e.g. /boot partition
-+declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") )
-+for partition in ${partitions[@]}; do
-+    mount -o remount "$partition"
-+done
-+
-+mkdir /tmp/testdir
-+mkdir /tmp/testmount
-+chown 2 /tmp/testdir
-+chmod 777 /tmp/testdir
-+
-+echo '/tmp/testdir localhost(rw)' > /etc/exports
-+systemctl restart nfs-server
-+mount.nfs localhost:/tmp/testdir /tmp/testmount
-
-From b7bec83d7a3ad186413777f70fe2b5d20e01e56b Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Feb 2021 18:32:26 +0100
-Subject: [PATCH 4/5] Add Ansible for
- mount_option_nodev_nonroot_local_partitions
-
-The remediation metadata were inspired by the template mount_options
----
- .../ansible/shared.yml                         | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-new file mode 100644
-index 0000000000..8530604308
---- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-@@ -0,0 +1,18 @@
-+# platform = multi_platform_all
-+# reboot = false
-+# strategy = configure
-+# complexity = low
-+# disruption = high
-+
-+- name: Ensure non-root local partitions are mounted with nodev option
-+  mount:
-+    path: "{{ item.mount }}"
-+    src: "{{ item.device}}"
-+    opts: "{{ item.options }},nodev"
-+    state: "mounted"
-+    fstype: "{{ item.fstype }}"
-+  when:
-+    - "item.mount is match('/\\w')"
-+    - "item.options is not search('nodev')"
-+  with_items:
-+    - "{{ ansible_facts.mounts }}"
-
-From dab22894ca0798dde27c77704a7fd34d62d77f8f Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Feb 2021 20:29:32 +0100
-Subject: [PATCH 5/5] Add space before and after variable
-
----
- .../ansible/shared.yml                                          | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-index 8530604308..2aa9a53e4d 100644
---- a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml
-@@ -7,7 +7,7 @@
- - name: Ensure non-root local partitions are mounted with nodev option
-   mount:
-     path: "{{ item.mount }}"
--    src: "{{ item.device}}"
-+    src: "{{ item.device }}"
-     opts: "{{ item.options }},nodev"
-     state: "mounted"
-     fstype: "{{ item.fstype }}"

SOURCES/scap-security-guide-0.1.58-RHEL_08_010001-PR_7344.patch

@@ -0,0 +1,240 @@
+From bb5c2983be3b11c3cd1070cf1d3daca27cb700ee Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Thu, 19 Aug 2021 08:02:55 -0500
+Subject: [PATCH] Add a new rules RHEL-08-010001 and RHEL-07-020019
+
+---
+ .../agent_mfetpd_running/oval/shared.xml      | 16 ++++++
+ .../agent_mfetpd_running/rule.yml             | 39 ++++++++++++++
+ .../group.yml                                 |  7 +++
+ .../package_mcafeetp_installed/rule.yml       | 51 +++++++++++++++++++
+ products/rhel7/profiles/stig.profile          |  2 +
+ products/rhel8/profiles/stig.profile          |  4 ++
+ shared/references/cce-redhat-avail.txt        |  4 --
+ .../data/profile_stability/rhel8/stig.profile |  2 +
+ .../profile_stability/rhel8/stig_gui.profile  |  2 +
+ 9 files changed, 123 insertions(+), 4 deletions(-)
+ create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
+ create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
+ create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+ create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
+new file mode 100644
+index 00000000000..9900d8bd724
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml
+@@ -0,0 +1,16 @@
++<def-group>
++    <definition class="compliance" id="{{{ rule_id }}}" version="1">
++        {{{ oval_metadata("Ensure that McAfee Endpoint Security for Linux (ENSL) is running.") }}}
++        <criteria>
++            <criterion comment="McAfee ENSL is running" test_ref="test_{{{ rule_id }}}"/>
++        </criteria>
++    </definition>
++    <unix:process58_test check="all" id="test_{{{ rule_id }}}" comment="is mfetpd running" version="1">
++        <unix:object object_ref="obj_{{{ rule_id }}}"/>
++    </unix:process58_test>
++
++    <unix:process58_object id="obj_{{{ rule_id }}}" version="1">
++        <unix:command_line operation="pattern match">^mfetpd.*$</unix:command_line>
++        <unix:pid datatype="int" operation="greater than">0</unix:pid>
++    </unix:process58_object>
++</def-group>
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
+new file mode 100644
+index 00000000000..32c934467da
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml
+@@ -0,0 +1,39 @@
++documentation_complete: true
++
++prodtype: rhel7,rhel8
++
++title: 'Ensure McAfee Endpoint Security for Linux (ENSL) is running'
++
++description: |-
++    Install McAfee Endpoint Security for Linux antivirus software
++    which is provided for DoD systems and uses signatures to search for the
++    presence of viruses on the filesystem.
++
++rationale: |-
++    Virus scanning software can be used to detect if a system has been compromised by
++    computer viruses, as well as to limit their spread to other systems.
++
++severity: high
++
++identifiers:
++    cce@rhel7: CCE-86262-3
++    cce@rhel8: CCE-86261-5
++
++references:
++    disa: CCI-001233
++    nist: SI-2(2)
++    srg: SRG-OS-000191-GPOS-00080
++    stigid@rhel7: RHEL-07-020019
++    stigid@rhel8: RHEL-08-010001
++
++ocil_clause: 'virus scanning software is not running'
++
++ocil: |-
++    To verify that McAfee Endpoint Security for Linux is
++    running, run the following command:
++    <pre>$ sudo ps -ef | grep -i mfetpd</pre>
++
++warnings:
++    - general: |-
++        Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
++        automated remediation is not available for this configuration check.
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+new file mode 100644
+index 00000000000..f2e4e89851a
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+@@ -0,0 +1,7 @@
++documentation_complete: true
++
++title: 'McAfee Endpoint Security for Linux (ENSL)'
++
++description: |-
++    McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
++    used to monitor, detect, and defend computer networks and systems.
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+new file mode 100644
+index 00000000000..16587792eff
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+@@ -0,0 +1,51 @@
++documentation_complete: true
++
++prodtype: rhel7,rhel8
++
++title: 'Install McAfee Endpoint Security for Linux (ENSL)'
++
++description: |-
++    Install McAfee Endpoint Security for Linux antivirus software
++    which is provided for DoD systems and uses signatures to search for the
++    presence of viruses on the filesystem.
++
++    {{{ describe_package_install(package="mcafeetp") }}}
++
++rationale: |-
++    Virus scanning software can be used to detect if a system has been compromised by
++    computer viruses, as well as to limit their spread to other systems.
++
++severity: high
++
++identifiers:
++    cce@rhel7: CCE-86257-3
++    cce@rhel8: CCE-86260-7
++
++references:
++    disa: CCI-001233
++    nist: SI-2(2)
++    srg: SRG-OS-000191-GPOS-00080
++    stigid@rhel7: RHEL-07-020019
++    stigid@rhel8: RHEL-08-010001
++
++ocil_clause: 'the package is not installed'
++
++ocil: '{{{ ocil_package(package="mcafeetp") }}}'
++
++warnings:
++    - general: |-
++        Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
++        automated remediation is not available for this configuration check.
++
++platform: machine
++
++template:
++    name: package_installed
++    vars:
++        pkgname: mcafeetp
++    backends:
++        bash: "off"
++        ansible: "off"
++        anaconda: "off"
++        puppet: "off"
++        blueprint: "off"
+diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
+index f5761c891f2..9ca13600057 100644
+--- a/products/rhel7/profiles/stig.profile
++++ b/products/rhel7/profiles/stig.profile
+@@ -316,3 +316,5 @@ selections:
+     - file_permissions_var_log_audit
+     - sysctl_net_ipv4_conf_all_rp_filter
+     - sysctl_net_ipv4_conf_default_rp_filter
++    - package_mcafeetp_installed
++    - agent_mfetpd_running
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 9dc9360e899..36f384621ae 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -84,6 +84,10 @@ selections:
+     # RHEL-08-010000
+     - installed_OS_is_vendor_supported
+ 
++    # RHEL-08-010001
++    - package_mcafeetp_installed
++    - agent_mfetpd_running
++
+     # RHEL-08-010010
+     - security_patches_up_to_date
+ 
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 3b24e19da06..08013e6de22 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -372,12 +372,8 @@ CCE-86253-2
+ CCE-86254-0
+ CCE-86255-7
+ CCE-86256-5
+-CCE-86257-3
+ CCE-86258-1
+ CCE-86259-9
+-CCE-86260-7
+-CCE-86261-5
+-CCE-86262-3
+ CCE-86263-1
+ CCE-86264-9
+ CCE-86265-6
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index e9ba0f0adbf..f3e6c4fa1a1 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -65,6 +65,7 @@ selections:
+ - accounts_user_interactive_home_directory_defined
+ - accounts_user_interactive_home_directory_exists
+ - aide_check_audit_tools
++- agent_mfetpd_running
+ - aide_scan_notification
+ - aide_verify_acls
+ - aide_verify_ext_attributes
+@@ -280,6 +281,7 @@ selections:
+ - package_gssproxy_removed
+ - package_iprutils_removed
+ - package_krb5-workstation_removed
++- package_mcafeetp_installed
+ - package_opensc_installed
+ - package_openssh-server_installed
+ - package_policycoreutils_installed
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index c8540f9392e..b5b60349a83 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -76,6 +76,7 @@ selections:
+ - accounts_user_interactive_home_directory_defined
+ - accounts_user_interactive_home_directory_exists
+ - aide_check_audit_tools
++- agent_mfetpd_running
+ - aide_scan_notification
+ - aide_verify_acls
+ - aide_verify_ext_attributes
+@@ -291,6 +292,7 @@ selections:
+ - package_gssproxy_removed
+ - package_iprutils_removed
+ - package_krb5-workstation_removed
++- package_mcafeetp_installed
+ - package_opensc_installed
+ - package_openssh-server_installed
+ - package_policycoreutils_installed

SOURCES/scap-security-guide-0.1.58-RHEL_08_010360-PR_7209.patch

@@ -0,0 +1,118 @@
+From 386f9787ceac9b0fc732bcd5fd5f7174254922b3 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Thu, 15 Jul 2021 14:33:44 -0500
+Subject: [PATCH]  Update 'Configure Notification of Post-AIDE Scan Details'
+
+Added
+- Ansible fix for this rule
+- Configurable email for sending notification email for AIDE alerts
+---
+ .../aide_scan_notification/ansible/shared.yml | 28 +++++++++++++++++++
+ .../aide_scan_notification/bash/shared.sh     | 18 ++++++++----
+ .../aide/aide_scan_notification/rule.yml      |  2 ++
+ .../var_aide_scan_notification_email.var      | 16 +++++++++++
+ 4 files changed, 58 insertions(+), 6 deletions(-)
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
+
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
+new file mode 100644
+index 00000000000..5c11fc1719e
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml
+@@ -0,0 +1,28 @@
++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol,multi_platform_sle
++# reboot = false
++# strategy = restrict
++# complexity = low
++# disruption = low
++{{% if product in ["sle12", "sle15"] %}}
++    {{% set aide_path = "/usr/bin/aide" %}}
++{{% else %}}
++    {{% set aide_path = "/usr/sbin/aide" %}}
++{{% endif %}}
++
++- (xccdf-var var_aide_scan_notification_email)
++
++- name: "Ensure AIDE is installed"
++  package:
++    name: "{{ item }}"
++    state: present
++  with_items:
++    - aide
++
++- name: "{{{ rule_title }}}"
++  cron:
++    name: "run AIDE check"
++    minute: 05
++    hour: 04
++    weekday: 0
++    user: root
++    job: '{{{aide_path}}}  --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" {{ var_aide_scan_notification_email }}'
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
+index 2f129e568b2..3cb8b72a0bd 100644
+--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh
+@@ -1,6 +1,16 @@
+ # platform = multi_platform_all
+ 
++. /usr/share/scap-security-guide/remediation_functions
++
+ {{{ bash_package_install("aide") }}}
++{{{ bash_instantiate_variables("var_aide_scan_notification_email") }}}
++{{% if product in ["sle12", "sle15"] %}}
++    {{% set aide_path = "/usr/bin/aide" %}}
++{{% else %}}
++    {{% set aide_path = "/usr/sbin/aide" %}}
++{{% endif %}}
++
++
+ 
+ CRONTAB=/etc/crontab
+ CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
+@@ -14,11 +24,7 @@ if [ -f /var/spool/cron/root ]; then
+ 	VARSPOOL=/var/spool/cron/root
+ fi
+ 
+-if ! grep -qR '^.*\/usr\/sbin\/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*root@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
+-{{% if product in ["sle12", "sle15"] %}}
+-	echo '0 5 * * * root /usr/bin/aide  --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost' >> $CRONTAB
+-{{% else %}}
+-	echo '0 5 * * * root /usr/sbin/aide  --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost' >> $CRONTAB
+-{{% endif %}}
++if ! grep -qR '^.*{{{aide_path}}}\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
++	echo "0 5 * * * root {{{ aide_path }}}  --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" >> $CRONTAB
+ fi
+ 
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
+index 51dae72ee6d..cb35c5c642d 100644
+--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml
+@@ -57,3 +57,5 @@ ocil: |-
+     <pre>$ grep aide /etc/crontab</pre>
+     The output should return something similar to the following:
+     <pre>05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost</pre>
++    The email address that the notifications are sent to can be changed by overriding
++    <pre><sub idref="var_aide_scan_notification_email" /></pre>.
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var b/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
+new file mode 100644
+index 00000000000..75b9f5d2650
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/var_aide_scan_notification_email.var
+@@ -0,0 +1,16 @@
++documentation_complete: true
++
++title: Integrity Scan Notification Email Address
++
++description: |-
++    Specify the email address for designated personnel if baseline
++    configurations are changed in an unauthorized manner.
++
++type: string
++
++operator: equals
++
++interactive: true
++
++options:
++    default: root@localhost

SOURCES/scap-security-guide-0.1.58-RHEL_08_010420-PR_7227.patch

@@ -0,0 +1,151 @@
+From 278f3b476291d69e45da4dcdfca5a308646224f2 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 19 Jul 2021 09:49:57 -0500
+Subject: [PATCH 1/2] Add more checks for bios_enable_execution_restrictions to
+ ensure we don't miss anything
+
+---
+ .../oval/shared.xml                            | 18 ++++++++++++++++++
+ .../rule.yml                                   |  3 ++-
+ products/rhel8/profiles/stig.profile           |  1 +
+ .../data/profile_stability/rhel8/stig.profile  |  1 +
+ .../profile_stability/rhel8/stig_gui.profile   |  1 +
+ 5 files changed, 23 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+
+diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+new file mode 100644
+index 00000000000..622a183f99f
+--- /dev/null
++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+@@ -0,0 +1,18 @@
++<def-group>
++    <definition class="compliance" id="bios_enable_execution_restrictions" version="2">
++        {{{ oval_metadata("The NX (no-execution) bit flag should be set on the system.") }}}
++        <criteria>
++            <criterion comment="NX bit is set" test_ref="test_NX_cpu_support" />
++        </criteria>
++    </definition>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support for NX bit" id="test_NX_cpu_support" version="1">
++        <ind:object object_ref="obj_NX_cpu_support" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_NX_cpu_support" version="1">
++        <ind:filepath>/proc/cpuinfo</ind:filepath>
++        <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++</def-group>
+diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+index 4ca003520ac..b037e374f5b 100644
+--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+@@ -14,7 +14,7 @@ rationale: |-
+     Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
+     allow users to turn the feature on or off at will.
+ 
+-severity: unknown
++severity: medium
+ 
+ identifiers:
+     cce@rhel7: CCE-27099-1
+@@ -31,5 +31,6 @@ references:
+     iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
+     nist: SC-39,CM-6(a)
+     nist-csf: PR.IP-1
++    stig@rhel8: RHEL-08-010420
+ 
+ platform: machine
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 5a0a520ee0a..6372d13cfc9 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -260,6 +260,7 @@ selections:
+     - package_opensc_installed
+ 
+     # RHEL-08-010420
++    - bios_enable_execution_restrictions
+ 
+     # RHEL-08-010421
+     - grub2_page_poison_argument
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 4be3cf93c25..32f1a24a7a4 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -74,6 +74,7 @@ selections:
+ - auditd_log_format
+ - auditd_name_format
+ - banner_etc_issue
++- bios_enable_execution_restrictions
+ - chronyd_client_only
+ - chronyd_no_chronyc_network
+ - chronyd_or_ntpd_set_maxpoll
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 20b8a54861e..d6a27c67dc0 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -85,6 +85,7 @@ selections:
+ - auditd_log_format
+ - auditd_name_format
+ - banner_etc_issue
++- bios_enable_execution_restrictions
+ - chronyd_client_only
+ - chronyd_no_chronyc_network
+ - chronyd_or_ntpd_set_maxpoll
+
+From dac8111b4d89a31cbaa5648f876bd58575a93e86 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 19 Jul 2021 09:51:34 -0500
+Subject: [PATCH 2/2] Add oval check for bios_enable_execution_restrictions
+
+---
+ .../oval/shared.xml                           | 24 ++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+index 622a183f99f..7cc448f8cce 100644
+--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/oval/shared.xml
+@@ -1,8 +1,10 @@
+ <def-group>
+     <definition class="compliance" id="bios_enable_execution_restrictions" version="2">
+         {{{ oval_metadata("The NX (no-execution) bit flag should be set on the system.") }}}
+-        <criteria>
++        <criteria operator="AND">
+             <criterion comment="NX bit is set" test_ref="test_NX_cpu_support" />
++            <criterion comment="No log messages about NX being disabled" test_ref="test_messages_nx_active" />
++            <criterion comment="NX is not disabled in the kernel command line" test_ref="test_noexec_cmd_line" />
+         </criteria>
+     </definition>
+ 
+@@ -10,9 +12,29 @@
+         <ind:object object_ref="obj_NX_cpu_support" />
+     </ind:textfilecontent54_test>
+ 
++    <ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_messages_nx_active" version="1" comment="No log messages about NX being disabled">
++        <ind:object object_ref="obj_messages_nx_active" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_noexec_cmd_line" version="1" comment="NX is not disabled in the kernel command line">
++        <ind:object object_ref="obj_noexec_cmd_line" />
++    </ind:textfilecontent54_test>
++
+     <ind:textfilecontent54_object id="obj_NX_cpu_support" version="1">
+         <ind:filepath>/proc/cpuinfo</ind:filepath>
+         <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
+         <ind:instance datatype="int">1</ind:instance>
+     </ind:textfilecontent54_object>
++
++    <ind:textfilecontent54_object id="obj_messages_nx_active" version="1">
++        <ind:filepath>/var/log/messages</ind:filepath>
++        <ind:pattern operation="pattern match">^.+protection: disabled.+</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++
++    <ind:textfilecontent54_object id="obj_noexec_cmd_line" version="1">
++        <ind:filepath>/proc/cmdline</ind:filepath>
++        <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
+ </def-group>

SOURCES/scap-security-guide-0.1.58-RHEL_08_010630-PR_7250.patch

@@ -0,0 +1,47 @@
+From 4ac2a6db67e03e616b26d39fb0620d4656bac65b Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 14 Jul 2021 13:19:42 -0500
+Subject: [PATCH] Add RHEL-08-010590 STIG to existing rule
+
+---
+ products/rhel8/profiles/stig.profile                          | 1 +
+ tests/data/profile_stability/rhel8/stig.profile               | 1 +
+ tests/data/profile_stability/rhel8/stig_gui.profile           | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 2508008d511..fef1965fb1d 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -341,6 +341,7 @@ selections:
+     - mount_option_nodev_nonroot_local_partitions
+ 
+     # RHEL-08-010590
++    - mount_option_home_noexec
+ 
+     # RHEL-08-010600
+     - mount_option_nodev_removable_partitions
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 765487c6f16..843d8eb7d0a 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -156,6 +156,7 @@ selections:
+ - mount_option_dev_shm_nodev
+ - mount_option_dev_shm_noexec
+ - mount_option_dev_shm_nosuid
++- mount_option_home_noexec
+ - mount_option_home_nosuid
+ - mount_option_nodev_nonroot_local_partitions
+ - mount_option_nodev_remote_filesystems
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 9fd80aac727..6dd0f08b142 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -167,6 +167,7 @@ selections:
+ - mount_option_dev_shm_nodev
+ - mount_option_dev_shm_noexec
+ - mount_option_dev_shm_nosuid
++- mount_option_home_noexec
+ - mount_option_home_nosuid
+ - mount_option_nodev_nonroot_local_partitions
+ - mount_option_nodev_remote_filesystems

SOURCES/scap-security-guide-0.1.58-RHEL_08_020090-PR_7313.patch

@@ -0,0 +1,153 @@
+From 6eeef4054d707b8b255e9fa600c4c7babffbf5f7 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 2 Aug 2021 08:37:04 -0500
+Subject: [PATCH] Add rule for RHEL-08-020090
+
+---
+ .../sssd/sssd_enable_certmap/rule.yml         | 58 +++++++++++++++++++
+ .../sssd_enable_certmap/tests/default.fail.sh |  4 ++
+ .../tests/with_section.pass.sh                |  7 +++
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 7 files changed, 72 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+ create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
+ create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
+
+diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+new file mode 100644
+index 0000000000..0614a2f4a0
+--- /dev/null
++++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+@@ -0,0 +1,58 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Enable Certmap in SSSD'
++
++description: |-
++   SSSD should be configured to verify the certificate of the user or group. To set this up
++    ensure that section like <tt>certmap/testing.test/rule_name</tt> is setup in
++   <tt>/etc/sssd/sssd.conf</tt>. For example
++   <pre>
++   [certmap/testing.test/rule_name]
++   matchrule =&lt;SAN&gt;.*EDIPI@mil
++   maprule = (userCertificate;binary={cert!bin})
++   domains = testing.test
++   </pre>
++
++rationale: |-
++   Without mapping the certificate used to authenticate to the user account, the ability to
++   determine the identity of the individual user or group will not be available for forensic
++   analysis.
++
++severity: medium
++
++identifiers:
++   cce@rhel8: CCE-86060-1
++
++references:
++   disa: CCI-000187
++   nist: IA-5 (2) (c)
++   stigid@rhel8: RHEL-08-020090
++
++warnings:
++    - general: |-
++        Automatic remediation of this control is not available, since all of the settings in
++        in the certmap need to be customized.
++
++ocil_clause: 'Certmap is not configured in SSSD'
++
++ocil: |-
++    To verify Certmap is enabled in SSSD, run the following command:
++    <pre>$ cat sudo cat /etc/sssd/sssd.conf</pre>
++    If configured properly, output should contain section like the following
++    <pre>
++    [certmap/testing.test/rule_name]
++    matchrule =&lt;SAN&gt;.*EDIPI@mil
++    maprule = (userCertificate;binary={cert!bin})
++    domains = testing.test
++    </pre>
++
++template:
++    name: lineinfile
++    vars:
++      path: '/etc/sssd/sssd.conf'
++      text: '^\[certmap\/.+\/.+\]$'
++    backends:
++        ansible: "off"
++        bash: "off"
+diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
+new file mode 100644
+index 0000000000..1e31c0da19
+--- /dev/null
++++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++
++touch /etc/sssd/sssd.conf
++sed -i "s/\[certmap.*//g" /etc/sssd/sssd.conf
+diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
+new file mode 100644
+index 0000000000..911e095f5d
+--- /dev/null
++++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++cat >> /etc/sssd/sssd.conf<< EOF
++[certmap/testing.test/rule_name]
++matchrule =<SAN>.*EDIPI@mil
++maprule = (userCertificate;binary={cert!bin})
++domains = testing.test
++EOF
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index f17a7b88b1..ec0a3b1753 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -503,6 +503,7 @@ selections:
+     # RHEL-08-020080
+ 
+     # RHEL-08-020090
++    - sssd_enable_certmap
+ 
+     # RHEL-08-020100
+     - accounts_password_pam_retry
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 73d025484e..e80557f033 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -186,7 +186,6 @@ CCE-86056-9
+ CCE-86057-7
+ CCE-86058-5
+ CCE-86059-3
+-CCE-86060-1
+ CCE-86061-9
+ CCE-86062-7
+ CCE-86063-5
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 236e595604..bffa509b69 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -275,6 +275,7 @@ selections:
+ - sshd_set_keepalive_0
+ - sshd_use_strong_rng
+ - sshd_x11_use_localhost
++- sssd_enable_certmap
+ - sssd_enable_smartcards
+ - sssd_offline_cred_expiration
+ - sudo_remove_no_authenticate
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 9973b5adef..c84ac75c7b 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -286,6 +286,7 @@ selections:
+ - sshd_set_keepalive_0
+ - sshd_use_strong_rng
+ - sshd_x11_use_localhost
++- sssd_enable_certmap
+ - sssd_enable_smartcards
+ - sssd_offline_cred_expiration
+ - sudo_remove_no_authenticate

SOURCES/scap-security-guide-0.1.58-RHEL_08_020300-PR_7289.patch

@@ -0,0 +1,194 @@
+From 2af7d6d8f86f80dbac088d115a50162cfc28c542 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Tue, 27 Jul 2021 07:49:50 -0500
+Subject: [PATCH] Add rule for RHEL-08-020300
+
+---
+ .../accounts_password_pam_dictcheck/rule.yml  | 45 +++++++++++++++++++
+ .../tests/disabled.fail.sh                    |  3 ++
+ .../tests/enable.pass.sh                      |  3 ++
+ .../tests/not_defined.fail.sh                 |  3 ++
+ .../var_password_pam_dictcheck.var            | 16 +++++++
+ products/rhel8/profiles/stig.profile          |  2 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  2 +
+ .../profile_stability/rhel8/stig_gui.profile  |  2 +
+ 9 files changed, 76 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+ create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
+ create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
+ create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
+ create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
+
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+new file mode 100644
+index 0000000000..2990150c0a
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+@@ -0,0 +1,45 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
++
++description: |-
++    The pam_pwquality module's <tt>dictcheck</tt> check if passwords contains dictionary words. When
++    <tt>dictcheck</tt> is set to <tt>1</tt> passwords will be checked for dictionary words.
++
++rationale: |-
++    Use of a complex password helps to increase the time and resources required to compromise the password.
++    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
++    guessing and brute-force attacks.
++    <br /><br />
++    Password complexity is one factor of several that determines how long it takes to crack a password. The more
++    complex the password, the greater the number of possible combinations that need to be tested before the
++    password is compromised.
++    <br /><br />
++    Passwords with dictionary words may be more vulnerable to password-guessing attacks.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-86233-4
++
++references:
++    disa: CCI-000366
++    nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
++    stigid@rhel8: RHEL-08-020300
++
++ocil_clause: 'dictcheck is not found or not equal to the required value'
++
++ocil: |-
++    To check if dictionary words are disallowed run the following command:
++    <pre>$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf</pre>
++    The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
++    <pre>dictcheck=1</pre>
++
++
++template:
++    name: accounts_password
++    vars:
++        variable: dictcheck
++        operation: equals
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
+new file mode 100644
+index 0000000000..cb84c6d968
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
+@@ -0,0 +1,3 @@
++#!/bin/bash
++
++echo "dictcheck=0" > /etc/security/pwquality.conf
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
+new file mode 100644
+index 0000000000..ceb9f7ec44
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
+@@ -0,0 +1,3 @@
++#!/bin/bash
++
++echo "dictcheck=1" > /etc/security/pwquality.conf
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
+new file mode 100644
+index 0000000000..57e54b6623
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
+@@ -0,0 +1,3 @@
++#!/bin/bash
++
++sed -i s/dictcheck.+//g /etc/security/pwquality.conf
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
+new file mode 100644
+index 0000000000..26452c3a8e
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
+@@ -0,0 +1,16 @@
++documentation_complete: true
++
++title: dictcheck
++
++description: |-
++    Prevent the use of dictionary words for passwords.
++
++type: number
++
++operator: equals
++
++interactive: false
++
++options:
++    1: 1
++    default: 1
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index bf410c2087..f17a7b88b1 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -45,6 +45,7 @@ selections:
+     - var_password_pam_minlen=15
+     - var_password_pam_ocredit=1
+     - var_password_pam_dcredit=1
++    - var_password_pam_dictcheck=1
+     - var_password_pam_ucredit=1
+     - var_password_pam_lcredit=1
+     - var_password_pam_retry=3
+@@ -567,6 +568,7 @@ selections:
+     - sssd_offline_cred_expiration
+ 
+     # RHEL-08-020300
++    - accounts_password_pam_dictcheck
+ 
+     # RHEL-08-020310
+     - accounts_logon_fail_delay
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 0b794d5c2a..dae4495b2d 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -362,7 +362,6 @@ CCE-86229-2
+ CCE-86230-0
+ CCE-86231-8
+ CCE-86232-6
+-CCE-86233-4
+ CCE-86234-2
+ CCE-86235-9
+ CCE-86236-7
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index ddfa13e731..236e595604 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -35,6 +35,7 @@ selections:
+ - accounts_password_all_shadowed_sha512
+ - accounts_password_minlen_login_defs
+ - accounts_password_pam_dcredit
++- accounts_password_pam_dictcheck
+ - accounts_password_pam_difok
+ - accounts_password_pam_lcredit
+ - accounts_password_pam_maxclassrepeat
+@@ -332,6 +333,7 @@ selections:
+ - var_password_pam_minlen=15
+ - var_password_pam_ocredit=1
+ - var_password_pam_dcredit=1
++- var_password_pam_dictcheck=1
+ - var_password_pam_ucredit=1
+ - var_password_pam_lcredit=1
+ - var_password_pam_retry=3
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 017ab8c0e3..9973b5adef 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -46,6 +46,7 @@ selections:
+ - accounts_password_all_shadowed_sha512
+ - accounts_password_minlen_login_defs
+ - accounts_password_pam_dcredit
++- accounts_password_pam_dictcheck
+ - accounts_password_pam_difok
+ - accounts_password_pam_lcredit
+ - accounts_password_pam_maxclassrepeat
+@@ -342,6 +343,7 @@ selections:
+ - var_password_pam_minlen=15
+ - var_password_pam_ocredit=1
+ - var_password_pam_dcredit=1
++- var_password_pam_dictcheck=1
+ - var_password_pam_ucredit=1
+ - var_password_pam_lcredit=1
+ - var_password_pam_retry=3

SOURCES/scap-security-guide-0.1.58-RHEL_08_020320-PR_7303.patch

@@ -0,0 +1,220 @@
+From d6f7334d642fb311d32d7a171c460cd05e6625b8 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Fri, 6 Aug 2021 10:48:46 -0500
+Subject: [PATCH] Add rule for RHEL-08-020320
+
+---
+ .../ansible/shared.yml                           |  0
+ .../bash/shared.sh                               |  2 +-
+ .../oval/shared.xml                              |  2 +-
+ .../accounts_authorized_local_users/rule.yml     | 12 +++++++++---
+ .../tests/bad_user.fail.sh                       |  2 ++
+ .../tests/default.pass.sh                        | 16 ++++++++++++++++
+ ...var_accounts_authorized_local_users_regex.var |  1 +
+ products/rhel8/profiles/stig.profile             |  3 ++-
+ shared/references/cce-redhat-avail.txt           |  1 -
+ tests/data/profile_stability/rhel8/stig.profile  |  2 ++
+ .../profile_stability/rhel8/stig_gui.profile     |  2 ++
+ 11 files changed, 36 insertions(+), 7 deletions(-)
+ rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/ansible/shared.yml (100%)
+ rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/bash/shared.sh (95%)
+ rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/oval/shared.xml (98%)
+ rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/accounts_authorized_local_users/rule.yml (88%)
+ create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
+ create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
+ rename linux_os/guide/system/{software/sap_host => accounts/accounts-restrictions}/var_accounts_authorized_local_users_regex.var (81%)
+
+diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/ansible/shared.yml
+similarity index 100%
+rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/ansible/shared.yml
+rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/ansible/shared.yml
+diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
+similarity index 95%
+rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh
+rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
+index c342acf36d1..fedb02d84ce 100644
+--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/bash/shared.sh
++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/bash/shared.sh
+@@ -10,7 +10,7 @@ default_os_user="root"
+ for username in $( sed 's/:.*//' /etc/passwd ) ; do
+ 	if [[ ! "$username" =~ ($default_os_user|$var_accounts_authorized_local_users_regex) ]];
+         then
+-		userdel $username ; 
++		userdel $username ;
+ 	fi
+ done
+ 
+diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
+similarity index 98%
+rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml
+rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
+index 4e42081d0dc..c56799ded20 100644
+--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/oval/shared.xml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/oval/shared.xml
+@@ -32,6 +32,6 @@
+     var_ref="var_accounts_authorized_local_users_regex"></ind:subexpression>
+   </ind:textfilecontent54_state>
+ 
+-  <external_variable id="var_accounts_authorized_local_users_regex" version="1" datatype="string" 
++  <external_variable id="var_accounts_authorized_local_users_regex" version="1" datatype="string"
+   comment="accounts authorized local users on operating system"/>
+ </def-group>
+diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
+similarity index 88%
+rename from linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml
+rename to linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
+index ddbda30afe6..e2311f6a5c3 100644
+--- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
+@@ -1,6 +1,6 @@
+ documentation_complete: true
+ 
+-prodtype: ol7,sle12,sle15
++prodtype: ol7,sle12,sle15,fedora,rhel8
+ 
+ title: 'Only Authorized Local User Accounts Exist on Operating System'
+ 
+@@ -26,11 +26,10 @@ rationale: |-
+ severity: medium
+ 
+ identifiers:
++    cce@rhel8: CCE-85987-6
+     cce@sle12: CCE-83195-8
+     cce@sle15: CCE-85561-9
+ 
+-severity: medium
+-
+ references:
+     disa: CCI-000366
+     nist@sle12: CM-6(b),CM-6.1(iv)
+@@ -41,6 +40,13 @@ references:
+ 
+ ocil_clause: 'there are unauthorized local user accounts on the system'
+ 
++{{% if 'rhel' in product %}}
++warnings:
++    - general: |-
++        Automatic remediation of this control is not available. Due the unique
++        requirements of each system.
++{{% endif %}}
++
+ ocil: |-
+     To verify that there are no unauthorized local user accounts, run the following command:
+     <pre>$ less /etc/passwd </pre>
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
+new file mode 100644
+index 00000000000..6dabaff6bc6
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/bad_user.fail.sh
+@@ -0,0 +1,2 @@
++#! /bin/bash
++adduser testuser
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
+new file mode 100644
+index 00000000000..d942f81d04f
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh
+@@ -0,0 +1,16 @@
++#! /bin/bash
++# platform = multi_platform_rhel
++
++var_accounts_authorized_local_users_regex="^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$"
++
++# never delete the root user
++default_os_user="root"
++
++# delete users that is in /etc/passwd but neither in default_os_user
++# nor in var_accounts_authorized_local_users_regex
++for username in $( sed 's/:.*//' /etc/passwd ) ; do
++	if [[ ! "$username" =~ ($default_os_user|$var_accounts_authorized_local_users_regex) ]];
++        then
++		echo $username ;
++	fi
++done
+diff --git a/linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
+similarity index 81%
+rename from linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var
+rename to linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
+index 81626307321..2f456764617 100644
+--- a/linux_os/guide/system/software/sap_host/var_accounts_authorized_local_users_regex.var
++++ b/linux_os/guide/system/accounts/accounts-restrictions/var_accounts_authorized_local_users_regex.var
+@@ -22,5 +22,6 @@ operator: pattern match
+ interactive: true
+ 
+ options:
++    rhel8: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$"
+     ol7forsap: "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$"
+     saponol7 : "^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$"
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index f66b2a24a75..ec2929e8dc4 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -54,6 +54,7 @@ selections:
+     - sshd_approved_macs=stig
+     - sshd_approved_ciphers=stig
+     - sshd_idle_timeout_value=10_minutes
++    - var_accounts_authorized_local_users_regex=rhel8
+     - var_accounts_passwords_pam_faillock_deny=3
+     - var_accounts_passwords_pam_faillock_fail_interval=900
+     - var_accounts_passwords_pam_faillock_unlock_time=never
+@@ -576,7 +577,7 @@ selections:
+     - accounts_logon_fail_delay
+ 
+     # RHEL-08-020320
+-    # - accounts_authorized_local_users
++    - accounts_authorized_local_users
+ 
+     # RHEL-08-020330
+     - sshd_disable_empty_passwords
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 1d54e8ec15f..3047c2d9b92 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -115,7 +115,6 @@ CCE-85983-5
+ CCE-85984-3
+ CCE-85985-0
+ CCE-85986-8
+-CCE-85987-6
+ CCE-85988-4
+ CCE-85989-2
+ CCE-85990-0
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index fcae79f6d88..9496f1e1d1d 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -27,6 +27,7 @@ selections:
+ - account_emergency_expire_date
+ - account_temp_expire_date
+ - account_unique_id
++- accounts_authorized_local_users
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay
+ - accounts_max_concurrent_login_sessions
+@@ -358,6 +359,7 @@ selections:
+ - var_auditd_disk_error_action=halt
+ - var_auditd_max_log_file_action=syslog
+ - var_auditd_disk_full_action=halt
++- var_accounts_authorized_local_users_regex=rhel8
+ - var_system_crypto_policy=fips
+ - var_sudo_timestamp_timeout=always_prompt
+ title: DISA STIG for Red Hat Enterprise Linux 8
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 2bbd1881f51..9e0c648a5f8 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -38,6 +38,7 @@ selections:
+ - account_emergency_expire_date
+ - account_temp_expire_date
+ - account_unique_id
++- accounts_authorized_local_users
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay
+ - accounts_max_concurrent_login_sessions
+@@ -368,6 +369,7 @@ selections:
+ - var_auditd_disk_error_action=halt
+ - var_auditd_max_log_file_action=syslog
+ - var_auditd_disk_full_action=halt
++- var_accounts_authorized_local_users_regex=rhel8
+ - var_system_crypto_policy=fips
+ - var_sudo_timestamp_timeout=always_prompt
+ title: DISA STIG with GUI for Red Hat Enterprise Linux 8

SOURCES/scap-security-guide-0.1.58-RHEL_08_030610-PR_7256.patch

@@ -0,0 +1,211 @@
+From 8455c8556a6d828b15ebc62cf511e484dd626a36 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Fri, 16 Jul 2021 13:16:12 -0500
+Subject: [PATCH] Add rules for RHEL-08-030610
+
+Added two rules, one for each of the paths mentioned in the STIG.
+---
+ .../rule.yml                                  | 35 ++++++++++++++++++
+ .../tests/correct_permissions.pass.sh         |  6 ++++
+ .../tests/incorrect_permissions.fail.sh       |  6 ++++
+ .../rule.yml                                  | 36 +++++++++++++++++++
+ .../tests/correct_permissions.pass.sh         |  6 ++++
+ .../tests/incorrect_permissions.fail.sh       |  6 ++++
+ products/rhel8/profiles/stig.profile          |  2 ++
+ shared/references/cce-redhat-avail.txt        |  2 --
+ .../data/profile_stability/rhel8/stig.profile |  2 ++
+ .../profile_stability/rhel8/stig_gui.profile  |  2 ++
+ 10 files changed, 101 insertions(+), 2 deletions(-)
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
+ create mode 100644 linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
+
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
+new file mode 100644
+index 0000000000..1cde3ded5f
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml
+@@ -0,0 +1,35 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Verify Permissions on /etc/audit/auditd.conf'
++
++description: |-
++    {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0640") }}}
++
++
++rationale: |-
++    Without the capability to restrict the roles and individuals that can select which events
++    are audited, unauthorized personnel may be able to prevent the auditing of critical
++    events. Misconfigured audits may degrade the system's performance by overwhelming
++    the audit log. Misconfigured audits may also make it more difficult to establish,
++    correlate, and investigate the events relating to an incident or identify
++    those responsible for one.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85871-2
++
++references:
++    disa: CCI-000171
++    nist: AU-12(b)
++    srg: SRG-OS-000063-GPOS-00032
++    stigid@rhel8: RHEL-08-030610
++
++template:
++    name: file_permissions
++    vars:
++      filepath: /etc/audit/auditd.conf
++      allow_stricter_permissions: "true"
++      filemode: '0640'
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
+new file mode 100644
+index 0000000000..8c9b782920
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/correct_permissions.pass.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++
++export TESTFILE=/etc/audit/auditd.conf
++mkdir -p /etc/audit/
++touch $TESTFILE
++chmod 0640 $TESTFILE
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
+new file mode 100644
+index 0000000000..a460e0dddd
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/tests/incorrect_permissions.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++
++export TESTFILLE=/etc/audit/auditd.conf
++mkdir -p /etc/audit/
++touch $TESTFILLE
++chmod 0644 $TESTFILLE
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
+new file mode 100644
+index 0000000000..34e1f30367
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml
+@@ -0,0 +1,36 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Verify Permissions on /etc/audit/rules.d/*.rules'
++
++description: |-
++    {{{ describe_file_permissions(file="/etc/audit/rules.d/*.rules", perms="0640") }}}
++
++
++rationale: |-
++    Without the capability to restrict the roles and individuals that can select which events
++    are audited, unauthorized personnel may be able to prevent the auditing of critical
++    events. Misconfigured audits may degrade the system's performance by overwhelming
++    the audit log. Misconfigured audits may also make it more difficult to establish,
++    correlate, and investigate the events relating to an incident or identify
++    those responsible for one.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85875-3
++
++references:
++    disa: CCI-000171
++    nist: AU-12(b)
++    srg: SRG-OS-000063-GPOS-00032
++    stigid@rhel8: RHEL-08-030610
++
++template:
++    name: file_permissions
++    vars:
++      filepath: /etc/audit/rules.d/
++      file_regex: ^.*rules$
++      allow_stricter_permissions: "true"
++      filemode: '0640'
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
+new file mode 100644
+index 0000000000..b0a20248c3
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/correct_permissions.pass.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++
++export TESTFILE=/etc/audit/rules.d/test_rule.rules
++mkdir -p /etc/audit/rules.d/
++touch $TESTFILE
++chmod 0640 $TESTFILE
+diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
+new file mode 100644
+index 0000000000..c7fd3a95e9
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/tests/incorrect_permissions.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++
++export TESTFILLE=/etc/audit/rules.d/test_rule.rules
++mkdir -p /etc/audit/rules.d/
++touch $TESTFILLE
++chmod 0644 $TESTFILLE
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 26d0aa9922..5a0a520ee0 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -801,6 +801,8 @@ selections:
+     - configure_usbguard_auditbackend
+ 
+     # RHEL-08-030610
++    - file_permissions_etc_audit_auditd
++    - file_permissions_etc_audit_rulesd
+ 
+     # RHEL-08-030620
+ 
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index ae3375fd4d..24e8149168 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -11,11 +11,9 @@ CCE-85867-0
+ CCE-85868-8
+ CCE-85869-6
+ CCE-85870-4
+-CCE-85871-2
+ CCE-85872-0
+ CCE-85873-8
+ CCE-85874-6
+-CCE-85875-3
+ CCE-85876-1
+ CCE-85877-9
+ CCE-85878-7
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index a1de1f5561..4be3cf93c2 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -123,6 +123,8 @@ selections:
+ - file_ownership_var_log_audit
+ - file_permission_user_init_files
+ - file_permissions_binary_dirs
++- file_permissions_etc_audit_auditd
++- file_permissions_etc_audit_rulesd
+ - file_permissions_home_directories
+ - file_permissions_library_dirs
+ - file_permissions_sshd_private_key
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index b7d2be3af3..20b8a54861 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -134,6 +134,8 @@ selections:
+ - file_ownership_var_log_audit
+ - file_permission_user_init_files
+ - file_permissions_binary_dirs
++- file_permissions_etc_audit_auditd
++- file_permissions_etc_audit_rulesd
+ - file_permissions_home_directories
+ - file_permissions_library_dirs
+ - file_permissions_sshd_private_key

SOURCES/scap-security-guide-0.1.58-RHEL_08_030650-PR_7283.patch

@@ -0,0 +1,327 @@
+From 065b6e540a2aa437ddf5239c97ed4e1fddf43b50 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 26 Jul 2021 09:00:49 -0500
+Subject: [PATCH] Update rule aide_check_audit_tools for RHEL-08-030650
+
+---
+ .../aide_check_audit_tools/ansible/shared.yml | 27 ++++++++++++------
+ .../aide_check_audit_tools/bash/shared.sh     | 25 +++++++++++++++++
+ .../aide_check_audit_tools/oval/shared.xml    | 20 +++++++++++++
+ .../aide/aide_check_audit_tools/rule.yml      | 28 ++++++++++++-------
+ .../tests/correct.pass.sh                     | 15 ++++++++++
+ .../tests/correct_with_selinux.pass.sh        | 12 ++++++++
+ .../tests/not_config.fail.sh                  | 14 ++++++++++
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 11 files changed, 126 insertions(+), 19 deletions(-)
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
+ create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
+
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
+index 73afaeff869..edef272183d 100644
+--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
+@@ -1,18 +1,29 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,multi_platform_rhel
+ # reboot = false
+ # strategy = restrict
+ # complexity = low
+ # disruption = low
+ 
+-- name: Install aide package
+-  zypper:
+-    name: aide
+-    state: latest
++{{% if 'rhel' not in product %}}
++{{% set aide_string = 'p+i+n+u+g+s+b+acl+selinux+xattrs+sha512' %}}
++{{% else %}}
++{{% set aide_string = 'p+i+n+u+g+s+b+acl+xattrs+sha512' %}}
++{{% endif %}}
++
++
++
++- name: Ensure aide is installed
++  package:
++    name: "{{ item }}"
++    state: present
++  with_items:
++    - aide
++
+ 
+ - name: Set audit_tools fact
+   set_fact:
+     audit_tools:
+-      - /usr/sbin/audispd
++      {{% if 'rhel' not in product %}}- /usr/sbin/audispd{{% endif %}}
+       - /usr/sbin/auditctl
+       - /usr/sbin/auditd
+       - /usr/sbin/augenrules
+@@ -24,11 +35,11 @@
+   lineinfile:
+     path: /etc/aide.conf
+     regexp: ^{{ item }}\s
+-    line: "{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512"
++    line: "{{ item }} {{{ aide_string }}}"
+   with_items: "{{ audit_tools }}"
+ 
+ - name: Configure AIDE to properly protect audit tools
+   lineinfile:
+     path: /etc/aide.conf
+-    line: "{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512"
++    line: "{{ item }} {{{ aide_string }}}"
+   with_items: "{{ audit_tools }}"
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
+new file mode 100644
+index 00000000000..0875eeec648
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
+@@ -0,0 +1,25 @@
++# platform = multi_platform_rhel
++# reboot = false
++# strategy = restrict
++# complexity = low
++# disruption = low
++. /usr/share/scap-security-guide/remediation_functions
++
++{{{ bash_package_install("aide") }}}
++
++{{% set configString = "p+i+n+u+g+s+b+acl+xattrs+sha512" %}}
++{{% set configFile = "/etc/aide.conf" %}}
++{{% for file in (
++      "/usr/sbin/auditctl",
++      "/usr/sbin/auditd",
++      "/usr/sbin/ausearch",
++      "/usr/sbin/aureport",
++      "/usr/sbin/autrace",
++      "/usr/sbin/augenrules" ) %}}
++
++if grep -i '^.*{{{file}}}.*$' {{{ configFile }}}; then
++sed -i "s#.*{{{file}}}.*#{{{file}}} {{{ configString }}}#" {{{ configFile }}}
++else
++echo "{{{ file }}} {{{ configString }}}" >> {{{ configFile }}}
++fi
++{{% endfor %}}
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
+index 32e6325a3ab..22c6276a1f5 100644
+--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
+@@ -8,13 +8,19 @@
+       <criterion comment="ausearch is checked in /etc/aide.conf" test_ref="test_aide_verify_ausearch" />
+       <criterion comment="aureport is checked in /etc/aide.conf" test_ref="test_aide_verify_aureport" />
+       <criterion comment="autrace is checked in /etc/aide.conf" test_ref="test_aide_verify_autrace" />
++      {{% if 'rhel' not in product %}}
+       <criterion comment="audispd is checked in /etc/aide.conf" test_ref="test_aide_verify_audispd" />
++      {{% endif %}}
+       <criterion comment="augenrules is checked in /etc/aide.conf" test_ref="test_aide_verify_augenrules" />
+     </criteria>
+   </definition>
+ 
+   <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
++    {{% if 'rhel' not in product %}}
+     <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
++    {{% else %}}
++    <ind:subexpression operation="pattern match">p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512</ind:subexpression>
++    {{% endif %}}
+   </ind:textfilecontent54_state>
+ 
+   <ind:textfilecontent54_test id="test_aide_verify_auditctl"
+@@ -95,6 +101,20 @@
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+ 
++  <ind:textfilecontent54_test id="test_aide_verify_rsyslogd"
++  comment="rsyslogd is checked in /etc/aide.conf" check="all"
++  check_existence="all_exist" version="1">
++    <ind:object object_ref="object_aide_verify_rsyslogd" />
++    <ind:state state_ref="state_aide_check_attributes" />
++  </ind:textfilecontent54_test>
++  <ind:textfilecontent54_object id="object_aide_verify_rsyslogd"
++  version="1">
++    <ind:filepath>/etc/aide.conf</ind:filepath>
++    <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
++    <ind:instance datatype="int" operation="equals">1</ind:instance>
++  </ind:textfilecontent54_object>
++
++
+   <ind:textfilecontent54_test id="test_aide_verify_augenrules"
+   comment="augenrules is checked in /etc/aide.conf" check="all"
+   check_existence="all_exist" version="1">
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
+index 126ee756cc0..17a95bf4b31 100644
+--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml
+@@ -1,11 +1,11 @@
+ documentation_complete: true
+ 
+-prodtype: sle12,sle15,ubuntu2004
++prodtype: sle12,sle15,ubuntu2004,rhel8,fedora
+ 
+ title: 'Configure AIDE to Verify the Audit Tools'
+ 
+ description: |-
+-    The SUSE operating system file integrity tool must be configured to protect the integrity of the audit tools.
++    The operating system file integrity tool must be configured to protect the integrity of the audit tools.
+ 
+ rationale: |-
+     Protecting the integrity of the tools used for auditing purposes is a
+@@ -31,32 +31,40 @@ rationale: |-
+ severity: medium
+ 
+ identifiers:
++    cce@rhel8: CCE-85964-5
+     cce@sle12: CCE-83204-8
+     cce@sle15: CCE-85610-4
+ 
+ references:
+     disa: CCI-001496
+-    nist@sle12: AU-9(3),AU-9(3).1
++    nist: AU-9(3),AU-9(3).1
+     srg: SRG-OS-000278-GPOS-00108
++    stigid@rhel8: RHEL-08-030650
+     stigid@sle12: SLES-12-010540
+     stigid@sle15: SLES-15-030630
+     stigid@ubuntu2004: UBTU-20-010205
+ 
+ ocil_clause: 'integrity checks of the audit tools are missing or incomplete'
+ 
++{{% if 'rhel' not in product %}}
++{{% set aide_string = 'p+i+n+u+g+s+b+acl+selinux+xattrs+sha512' %}}
++{{% else %}}
++{{% set aide_string = 'p+i+n+u+g+s+b+acl+xattrs+sha512' %}}
++{{% endif %}}
++
+ ocil: |-
+     Check that AIDE is properly configured to protect the integrity of the
+     audit tools by running the following command:
+ 
+     <pre># sudo cat /etc/aide.conf | grep /usr/sbin/au
+ 
+-    /usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
+-    /usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</pre>
++    /usr/sbin/auditctl {{{ aide_string }}}
++    /usr/sbin/auditd {{{ aide_string }}}
++    /usr/sbin/ausearch {{{ aide_string }}}
++    /usr/sbin/aureport {{{ aide_string }}}
++    /usr/sbin/autrace {{{ aide_string }}}
++    {{% if 'rhel' not in product %}}/usr/sbin/audispd {{{ aide_string }}}{{% endif %}}
++    /usr/sbin/augenrules {{{ aide_string }}}</pre>
+ 
+     If AIDE is configured properly to protect the integrity of the audit tools,
+     all lines listed above will be returned from the command.
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
+new file mode 100644
+index 00000000000..756b88d8a23
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
+@@ -0,0 +1,15 @@
++#!/bin/bash
++# platform = multi_platform_rhel,multi_platform_fedora
++
++
++yum -y install aide
++aide --init
++
++
++declare -a bins
++bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
++
++for theFile in "${bins[@]}"
++do
++    echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> /etc/aide.conf
++done
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
+new file mode 100644
+index 00000000000..f3a2a126d3d
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
+@@ -0,0 +1,12 @@
++#!/bin/bash
++# platform = multi_platform_rhel,multi_platform_fedora
++
++yum -y install aide
++
++declare -a bins
++bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
++
++for theFile in "${bins[@]}"
++do
++    echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> /etc/aide.conf
++done
+diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
+new file mode 100644
+index 00000000000..4315cef2073
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = multi_platform_rhel,multi_platform_fedora
++
++
++yum -y install aide
++aide --init
++
++declare -a bins
++bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
++
++for theFile in "${bins[@]}"
++do
++    echo sed -i "s#^.*${theFile}.*##g" /etc/aide.conf
++done
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 7270a8f91f2..6b3232a9e00 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -822,6 +822,7 @@ selections:
+     # RHEL-08-030640
+ 
+     # RHEL-08-030650
++    - aide_check_audit_tools
+ 
+     # RHEL-08-030660
+     - auditd_audispd_configure_sufficiently_large_partition
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 665f903ead4..ff557cc2323 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -97,7 +97,6 @@ CCE-85960-3
+ CCE-85961-1
+ CCE-85962-9
+ CCE-85963-7
+-CCE-85964-5
+ CCE-85965-2
+ CCE-85966-0
+ CCE-85967-8
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 7d59cfff625..692a1690b19 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -60,6 +60,7 @@ selections:
+ - accounts_user_home_paths_only
+ - accounts_user_interactive_home_directory_defined
+ - accounts_user_interactive_home_directory_exists
++- aide_check_audit_tools
+ - aide_scan_notification
+ - aide_verify_acls
+ - aide_verify_ext_attributes
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 2c2daad6f6d..cf119c02a17 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -71,6 +71,7 @@ selections:
+ - accounts_user_home_paths_only
+ - accounts_user_interactive_home_directory_defined
+ - accounts_user_interactive_home_directory_exists
++- aide_check_audit_tools
+ - aide_scan_notification
+ - aide_verify_acls
+ - aide_verify_ext_attributes

SOURCES/scap-security-guide-0.1.58-RHEL_08_030700-PR_7264.patch

@@ -0,0 +1,241 @@
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
+new file mode 100644
+index 0000000000..4f88ed361d
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
+@@ -0,0 +1,8 @@
++# platform = multi_platform_fedora,multi_platform_rhel
++
++{{{ ansible_set_config_file(file="/etc/audit/auditd.conf",
++                  parameter="overflow_action",
++                  value="syslog",
++                  separator="=",
++                  separator_regex="=",
++                  prefix_regex="^\s*") }}}
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh
+new file mode 100644
+index 0000000000..539b9b6582
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh
+@@ -0,0 +1,12 @@
++# platform = multi_platform_fedora,multi_platform_rhel
++# reboot = true
++# strategy = restrict
++# complexity = low
++# disruption = low
++
++{{{set_config_file(path="/etc/audit/auditd.conf",
++                  parameter="overflow_action",
++                  value="syslog",
++                  separator="=",
++                  separator_regex="=",
++                  prefix_regex="^\s*")}}}
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml
+new file mode 100644
+index 0000000000..fd45280e4e
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/oval/shared.xml
+@@ -0,0 +1,6 @@
++{{{ oval_check_config_file(
++    path="/etc/audit/auditd.conf",
++    prefix_regex="^(?:.*\\n)*\s*",
++    parameter="overflow_action",
++    value="syslog|single|halt",
++    separator_regex="\s*=\s*") }}}
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
+new file mode 100644
+index 0000000000..d41ca00076
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml
+@@ -0,0 +1,36 @@
++documentation_complete: true
++
++title: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full
++
++description: |-
++    The audit system should have an action setup in the event the internal event queue becomes full.
++    To setup an overflow action edit <tt>/etc/audit/auditd.conf</tt>. Set <tt>overflow_action</tt>
++    to one of the following values: <tt>syslog</tt>, <tt>single</tt>, <tt>halt</tt>.
++
++
++rationale: |-
++    The audit system should have an action setup in the event the internal event queue becomes full
++    so that no data is lost.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85889-4
++
++references:
++    disa: CCI-001851
++    nist: AU-4(1)
++    srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
++    stigid@rhel8: RHEL-08-030700
++
++ocil_clause: 'auditd overflow action is not setup correctly'
++
++ocil: |-
++    Verify the audit system is configured to take an appropriate action when the internal event queue is full:
++    <pre>$ sudo grep -i overflow_action /etc/audit/auditd.conf</pre>
++
++    The output should contain be like <tt>overflow_action = syslog</tt>
++
++    If the value of the "overflow_action" option is not set to <tt>syslog</tt>, 
++    <tt>single</tt>, <tt>halt</tt> or the line is commented out, ask the System Administrator
++    to indicate how the audit logs are off-loaded to a different system or media. 
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh
+new file mode 100644
+index 0000000000..ec7525b195
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/commented_out.fail.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++echo "# overflow_action = syslog" >> /etc/audit/auditd.conf
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh
+new file mode 100644
+index 0000000000..e4d173ab37
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/empty.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++if [[ -f $config_file ]]; then
++    echo '' > $config_file
++fi
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh
+new file mode 100644
+index 0000000000..f26cd7cddf
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/file_not_present.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++
++config_file=/etc/audit/auditd.conf
++
++if [[ -f $config_file ]]; then
++    rm -f $config_file
++fi
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh
+new file mode 100644
+index 0000000000..0ec591b25b
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/halt.pass.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++echo "overflow_action = halt" >> /etc/audit/auditd.conf
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh
+new file mode 100644
+index 0000000000..236ad543fe
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/ignore.fail.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++echo "overflow_action = ignore" >> /etc/audit/auditd.conf
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh
+new file mode 100644
+index 0000000000..74efdcafee
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/not_present.fail.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++config_file=/etc/audit/auditd.conf
++sed -i "s/^.*overflow_action.*$//" $config_file
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh
+new file mode 100644
+index 0000000000..de11126320
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/setup.sh
+@@ -0,0 +1,9 @@
++#!/bin/bash
++# Use this script to ensure the audit directory structure and audit conf file
++# exist in the test env.
++config_file=/etc/audit/auditd.conf
++
++# Ensure directory structure exists (useful for container based testing)
++test -d /etc/audit/ || mkdir -p /etc/audit/
++
++test -f $config_file || touch $config_file
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh
+new file mode 100644
+index 0000000000..f9fa7a935c
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/single.pass.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++echo "overflow_action = single" >> /etc/audit/auditd.conf
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh
+new file mode 100644
+index 0000000000..1c625fb752
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/tests/syslog.pass.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# Ensure test system has proper directories/files for test scenario
++bash -x setup.sh
++
++echo "overflow_action = syslog" >> /etc/audit/auditd.conf
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 6372d13cfc..5cac78e00d 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -826,6 +826,7 @@ selections:
+     - rsyslog_remote_loghost
+ 
+     # RHEL-08-030700
++    - auditd_overflow_action
+ 
+     # RHEL-08-030710
+ 
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 24e8149168..b3d9596e1f 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -27,7 +27,6 @@ CCE-85885-2
+ CCE-85886-0
+ CCE-85887-8
+ CCE-85888-6
+-CCE-85889-4
+ CCE-85890-2
+ CCE-85891-0
+ CCE-85892-8
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 32f1a24a7a..c9d23ed1dc 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -73,6 +73,7 @@ selections:
+ - auditd_local_events
+ - auditd_log_format
+ - auditd_name_format
++- auditd_overflow_action
+ - banner_etc_issue
+ - bios_enable_execution_restrictions
+ - chronyd_client_only
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index d6a27c67dc..7303145141 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -84,6 +84,7 @@ selections:
+ - auditd_local_events
+ - auditd_log_format
+ - auditd_name_format
++- auditd_overflow_action
+ - banner_etc_issue
+ - bios_enable_execution_restrictions
+ - chronyd_client_only

SOURCES/scap-security-guide-0.1.58-RHEL_08_030710-PR_7268.patch

@@ -0,0 +1,480 @@
+From 2f38b61e9b6b26dab05443a9bf03642971cbeeef Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Fri, 23 Jul 2021 16:32:15 -0500
+Subject: [PATCH] Add new rule for RHEL-08-030710
+
+---
+ .../ansible/shared.yml                        |  5 +++
+ .../bash/shared.sh                            |  6 +++
+ .../oval/shared.xml                           | 44 +++++++++++++++++++
+ .../rule.yml                                  | 38 ++++++++++++++++
+ .../tests/default_no_pass.fail.sh             |  7 +++
+ .../tests/rsyslog.pass.sh                     |  4 ++
+ .../tests/rsyslog_wrong_value.fail.sh         |  4 ++
+ .../tests/rsyslogd.pass.sh                    |  4 ++
+ .../tests/rsyslogd_wrong_value.fail.sh        |  4 ++
+ .../tests/setup.sh                            |  9 ++++
+ .../ansible/shared.yml                        |  5 +++
+ .../bash/shared.sh                            |  5 +++
+ .../oval/shared.xml                           | 44 +++++++++++++++++++
+ .../rule.yml                                  | 38 ++++++++++++++++
+ .../tests/default_no_pass.fail.sh             |  7 +++
+ .../tests/rsyslog.pass.sh                     |  4 ++
+ .../tests/rsyslog_wrong_value.fail.sh         |  4 ++
+ .../tests/rsyslogd.pass.sh                    |  4 ++
+ .../tests/rsyslogd_wrong_value.fail.sh        |  4 ++
+ .../tests/setup.sh                            |  9 ++++
+ products/rhel8/profiles/stig.profile          |  2 +
+ shared/references/cce-redhat-avail.txt        |  2 -
+ .../data/profile_stability/rhel8/stig.profile |  2 +
+ .../profile_stability/rhel8/stig_gui.profile  |  2 +
+ 24 files changed, 255 insertions(+), 2 deletions(-)
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
+
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+new file mode 100644
+index 0000000000..2d6c5227a8
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+@@ -0,0 +1,5 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++
++{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
++             parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
++}}}
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
+new file mode 100644
+index 0000000000..36853d1786
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++
++{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
++             parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
++}}}
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
+new file mode 100644
+index 0000000000..d21f8af1e4
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
+@@ -0,0 +1,44 @@
++
++<def-group>
++    <definition class="compliance" id="{{{ rule_id }}}" version="1">
++        {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
++        <criteria operator="AND">
++            <criteria operator="OR">
++                 <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
++                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
++                <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"
++                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
++            </criteria>
++        </criteria>
++    </definition>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" version="1">
++
++        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog"
++                                    comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
++                                    version="1">
++        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
++        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" version="1">
++        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir"
++                                    comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d"
++                                    version="1">
++        <ind:path>/etc/rsyslog.d</ind:path>
++        <ind:filename operation="pattern match">^.*conf$</ind:filename>
++        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++</def-group>
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
+new file mode 100644
+index 0000000000..1bcc33927b
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
+@@ -0,0 +1,38 @@
++documentation_complete: true
++
++title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
++
++description: |-
++  Rsyslogd is a system utility providing support for message logging. Support
++  for both internet and UNIX domain sockets enables this utility to support both local
++  and remote logging.  Couple this utility with <tt>gnutls</tt> (which is a secure communications
++  library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
++  encrypt and off-load auditing.
++
++  When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
++
++rationale: |-
++    The audit records generated by Rsyslog contain valuable information regarding system
++    configuration, user authentication, and other such information. Audit records should be
++    protected from unauthorized access.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-86098-1
++
++references:
++    disa: CCI-001851
++    nist: AU-4(1)
++    srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
++    stigid@rhel8: RHEL-08-030710
++
++ocil_clause: 'rsyslogd ActionSendStreamDriverMode not set to 1'
++
++ocil: |-
++    Verify the operating system encrypts audit records off-loaded onto a different system
++    or media from the system being audited with the following commands:
++
++    <pre>$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
++    The output should be
++    <pre>/etc/rsyslog.conf:$ActionSendStreamDriverMode 1</pre>
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
+new file mode 100644
+index 0000000000..3ee5384371
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++bash -x setup.sh
++
++if [[ -f encrypt.conf ]]; then
++  sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.d/encrypt.conf
++fi
++  sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
+new file mode 100644
+index 0000000000..34105aaa85
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
+new file mode 100644
+index 0000000000..db87b2956c
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
+new file mode 100644
+index 0000000000..25e7cdf783
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
+new file mode 100644
+index 0000000000..d37882acf3
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
+new file mode 100644
+index 0000000000..9686f16bcc
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
+@@ -0,0 +1,9 @@
++#!/bin/bash
++# Use this script to ensure the rsyslog directory structure and rsyslog conf file
++# exist in the test env.
++config_file=/etc/rsyslog.conf
++
++# Ensure directory structure exists (useful for container based testing)
++test -f $config_file || touch $config_file
++
++test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+new file mode 100644
+index 0000000000..2ddbfb871f
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+@@ -0,0 +1,5 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++
++{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
++                    parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
++}}}
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
+new file mode 100644
+index 0000000000..3955346cd3
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
++                    parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
++}}}
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
+new file mode 100644
+index 0000000000..71d39c179d
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
+@@ -0,0 +1,44 @@
++
++<def-group>
++    <definition class="compliance" id="{{{ rule_id }}}" version="1">
++        {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
++        <criteria operator="AND">
++            <criteria operator="OR">
++                 <criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
++                            test_ref="test_{{{rule_id}}}_default_netstream_rsyslog" />
++                <criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d"
++                            test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_dir" />
++            </criteria>
++        </criteria>
++    </definition>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_default_netstream_rsyslog" version="1">
++
++        <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog"
++                                    comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
++                                    version="1">
++        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
++        <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_default_netstream_rsyslog_dir" version="1">
++        <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog_dir" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog_dir"
++                                    comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d"
++                                    version="1">
++        <ind:path>/etc/rsyslog.d</ind:path>
++        <ind:filename operation="pattern match">^.*conf$</ind:filename>
++        <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++</def-group>
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
+new file mode 100644
+index 0000000000..eff85d3fae
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
+@@ -0,0 +1,38 @@
++documentation_complete: true
++
++title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
++
++description: |-
++  Rsyslogd is a system utility providing support for message logging. Support
++  for both internet and UNIX domain sockets enables this utility to support both local
++  and remote logging.  Couple this utility with <tt>gnutls</tt> (which is a secure communications
++  library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
++  encrypt and off-load auditing.
++
++  When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
++
++rationale: |-
++    The audit records generated by Rsyslog contain valuable information regarding system
++    configuration, user authentication, and other such information. Audit records should be
++    protected from unauthorized access.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85992-6
++
++references:
++    disa: CCI-001851
++    nist: AU-4(1)
++    srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
++    stigid@rhel8: RHEL-08-030710
++
++ocil_clause: 'rsyslogd DefaultNetstreamDriver not set to gtls'
++
++ocil: |-
++    Verify the operating system encrypts audit records off-loaded onto a different system
++    or media from the system being audited with the following commands:
++
++    <pre>$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
++    The output should be
++    <pre>/etc/rsyslog.conf:$DefaultNetstreamDriver gtls</pre>
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
+new file mode 100644
+index 0000000000..6ab43bfc0d
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++bash -x setup.sh
++
++if [[ -f encrypt.conf ]]; then
++  sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.d/encrypt.conf
++fi
++  sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
+new file mode 100644
+index 0000000000..40f1bfe087
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
+new file mode 100644
+index 0000000000..30a1d5b43a
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
+new file mode 100644
+index 0000000000..44715bca66
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
+new file mode 100644
+index 0000000000..30a1d5b43a
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
+new file mode 100644
+index 0000000000..9686f16bcc
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
+@@ -0,0 +1,9 @@
++#!/bin/bash
++# Use this script to ensure the rsyslog directory structure and rsyslog conf file
++# exist in the test env.
++config_file=/etc/rsyslog.conf
++
++# Ensure directory structure exists (useful for container based testing)
++test -f $config_file || touch $config_file
++
++test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 6372d13cfc..1cc53cf1e1 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -828,6 +828,8 @@ selections:
+     - auditd_overflow_action
+ 
+     # RHEL-08-030710
++    - rsyslog_encrypt_offload_defaultnetstreamdriver
++    - rsyslog_encrypt_offload_actionsendstreamdrivermode
+ 
+     # RHEL-08-030720
+ 
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 24e8149168..fdf69f6baa 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -129,7 +129,6 @@ CCE-85988-4
+ CCE-85989-2
+ CCE-85990-0
+ CCE-85991-8
+-CCE-85992-6
+ CCE-85993-4
+ CCE-85994-2
+ CCE-85995-9
+@@ -235,7 +234,6 @@ CCE-86094-0
+ CCE-86095-7
+ CCE-86096-5
+ CCE-86097-3
+-CCE-86098-1
+ CCE-86099-9
+ CCE-86100-5
+ CCE-86101-3
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 32f1a24a7a..c0ef381696 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -228,6 +228,8 @@ selections:
+ - require_singleuser_auth
+ - root_permissions_syslibrary_files
+ - rsyslog_cron_logging
++- rsyslog_encrypt_offload_actionsendstreamdrivermode
++- rsyslog_encrypt_offload_defaultnetstreamdriver
+ - rsyslog_remote_access_monitoring
+ - rsyslog_remote_loghost
+ - security_patches_up_to_date
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index d6a27c67dc..5adeea4a35 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -239,6 +239,8 @@ selections:
+ - require_singleuser_auth
+ - root_permissions_syslibrary_files
+ - rsyslog_cron_logging
++- rsyslog_encrypt_offload_actionsendstreamdrivermode
++- rsyslog_encrypt_offload_defaultnetstreamdriver
+ - rsyslog_remote_access_monitoring
+ - rsyslog_remote_loghost
+ - security_patches_up_to_date

SOURCES/scap-security-guide-0.1.58-RHEL_08_030720-PR_7288.patch

@@ -0,0 +1,389 @@
+From fbaa0ae639fbb001e4c9e92d9e35f9dd9309d605 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 9 Aug 2021 10:56:36 -0500
+Subject: [PATCH 1/2] Allow set_config_file bash macro and lineinfile to set a
+ custom sed path separator
+
+So that if the text has '/' in it  the sed path separator can be changed.
+---
+ .../developer/06_contributing_with_content.md |  3 +++
+ shared/macros-bash.jinja                      | 23 ++++++++++---------
+ shared/templates/lineinfile/bash.template     |  6 ++++-
+ 3 files changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/docs/manual/developer/06_contributing_with_content.md b/docs/manual/developer/06_contributing_with_content.md
+index 245db1550de..c0d62bef5ca 100644
+--- a/docs/manual/developer/06_contributing_with_content.md
++++ b/docs/manual/developer/06_contributing_with_content.md
+@@ -1572,6 +1572,9 @@ the following to `rule.yml`:
+     -   **oval_extend_definitions** - optional, list of additional OVAL
+         definitions that have to pass along the generated check.
+ 
++        **sed_path_separator** - optional, default is `/`, sets the sed path separator. Set this
++        to a character like `#` if `/` is in use in your text.
++
+ -   Languages: Ansible, Bash, OVAL
+ 
+ 
+diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
+index d654a0e0e89..7af8038a783 100644
+--- a/shared/macros-bash.jinja
++++ b/shared/macros-bash.jinja
+@@ -444,11 +444,12 @@ printf '%s\n' "{{{ message | replace('"', '\\"') }}}" >&2
+ # separator_regex: regular expression that describes the separator and surrounding whitespace
+ # prefix_regex: regular expression describing allowed leading characters at each line
+ #}}
+-{{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*") -%}}
+-    {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
++
++{{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", sed_path_separator="/") -%}}
+     {{%- set new_line = parameter+separator+value -%}}
++    {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
+ if [ -e "{{{ path }}}" ] ; then
+-    {{{ lineinfile_absent(path, line_regex, insensitive) | indent(4) }}}
++    {{{ lineinfile_absent(path, line_regex, insensitive, sed_path_separator=sed_path_separator) | indent(4) }}}
+ else
+     {{%- if create %}}
+     touch "{{{ path }}}"
+@@ -456,19 +457,19 @@ else
+     {{{ die("Path '" + path + "' wasn't found on this system. Refusing to continue.", action="return") | indent(4) }}}
+     {{%- endif %}}
+ fi
+-{{{ lineinfile_present(path, new_line, insert_after, insert_before, insensitive) }}}
++{{{ lineinfile_present(path, new_line, insert_after, insert_before, insensitive, sed_path_separator=sed_path_separator) }}}
+ {{%- endmacro -%}}
+ 
+-{{%- macro lineinfile_absent(path, regex, insensitive=true) -%}}
++{{%- macro lineinfile_absent(path, regex, insensitive=true, sed_path_separator="/") -%}}
+     {{%- if insensitive -%}}
+         {{%- set modifier="Id" -%}}
+     {{%- else -%}}
+         {{%- set modifier="d" -%}}
+     {{%- endif -%}}
+-    {{% if '/' in regex %}}
+-    {{{ raise("regex (" + regex + ") uses sed path separator (/) in " + rule_id) }}}
++    {{% if sed_path_separator in regex %}}
++    {{{ raise("regex (" + regex + ") uses sed path separator (" + sed_path_separator + ") in " + rule_id) }}}
+     {{% endif %}}
+-LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
++LC_ALL=C sed -i "{{{ sed_path_separator }}}{{{ regex }}}{{{ sed_path_separator }}}{{{ modifier }}}" "{{{ path }}}"
+ {{%- endmacro -%}}
+ 
+ {{%- macro lineinfile_absent_in_directory(dirname, regex, insensitive=true) -%}}
+@@ -480,7 +481,7 @@ LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
+ LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ dirname }}}"/*
+ {{%- endmacro -%}}
+ 
+-{{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true) -%}}
++{{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true, sed_path_separator="/") -%}}
+     {{%- if insensitive -%}}
+         {{%- set grep_args="-q -m 1 -i" -%}}
+     {{%- else -%}}
+@@ -496,7 +497,7 @@ printf '%s\n' "{{{ line }}}" > "{{{ path }}}"
+ cat "{{{ path }}}.bak" >> "{{{ path }}}"
+     {{%- elif insert_after %}}
+ # Insert after the line matching the regex '{{{ insert_after }}}'
+-line_number="$(LC_ALL=C grep -n "{{{ insert_after }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's/:.*//g')"
++line_number="$(LC_ALL=C grep -n "{{{ insert_after }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's{{{sed_path_separator}}}:.*{{{sed_path_separator}}}{{{sed_path_separator}}}g')"
+ if [ -z "$line_number" ]; then
+     # There was no match of '{{{ insert_after }}}', insert at
+     # the end of the file.
+@@ -508,7 +509,7 @@ else
+ fi
+     {{%- elif insert_before %}}
+ # Insert before the line matching the regex '{{{ insert_before }}}'.
+-line_number="$(LC_ALL=C grep -n "{{{ insert_before }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's/:.*//g')"
++line_number="$(LC_ALL=C grep -n "{{{ insert_before }}}" "{{{ path }}}.bak" | LC_ALL=C sed 's{{{sed_path_separator}}}:.*{{{sed_path_separator}}}{{{sed_path_separator}}}g')"
+ if [ -z "$line_number" ]; then
+     # There was no match of '{{{ insert_before }}}', insert at
+     # the end of the file.
+diff --git a/shared/templates/lineinfile/bash.template b/shared/templates/lineinfile/bash.template
+index 0e43e88842a..6d1ca349268 100644
+--- a/shared/templates/lineinfile/bash.template
++++ b/shared/templates/lineinfile/bash.template
+@@ -4,4 +4,8 @@
+ # complexity = low
+ # disruption = low
+ 
+-{{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*") -}}}
++{{% if SED_PATH_SEPARATOR %}}
++    {{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*", sed_path_separator=SED_PATH_SEPARATOR) -}}}
++{{% else %}}
++    {{{ set_config_file(PATH, TEXT, value="", create='yes', insert_after="", insert_before="", separator="", separator_regex="", prefix_regex="^\s*") -}}}
++{{% endif %}}
+
+From 4b3182bd5d5308fed16f58da9656aa76a4275569 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 9 Aug 2021 13:56:32 -0500
+Subject: [PATCH 2/2] Add new rule for RHEL-08-030720
+
+---
+ .../ansible/shared.yml                        |  9 ++++
+ .../bash/shared.sh                            | 11 +++++
+ .../oval/shared.xml                           | 43 +++++++++++++++++++
+ .../rule.yml                                  | 40 +++++++++++++++++
+ .../tests/default_no_pass.fail.sh             |  7 +++
+ .../tests/rsyslog.pass.sh                     |  4 ++
+ .../tests/rsyslog_wrong_value.fail.sh         |  4 ++
+ .../tests/rsyslogd.pass.sh                    |  4 ++
+ .../tests/rsyslogd_wrong_value.fail.sh        |  4 ++
+ .../tests/setup.sh                            |  9 ++++
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 14 files changed, 138 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
+
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
+new file mode 100644
+index 00000000000..637f90003b2
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
+@@ -0,0 +1,9 @@
++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
++# reboot = false
++# strategy = configure
++# complexity = low
++# disruption = low
++
++{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf", 
++                                "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s', 
++                                value="x509/name", create='yes') }}}
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
+new file mode 100644
+index 00000000000..71d312f332f
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh
+@@ -0,0 +1,11 @@
++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel
++# reboot = false
++# strategy = configure
++# complexity = low
++# disruption = low
++
++if ! grep -s "\$ActionSendStreamDriverAuthMode\s*x509/name" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
++	mkdir -p /etc/rsyslog.d
++    sed -i '/^.*\$ActionSendStreamDriverAuthMode.*/d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
++    echo "\$ActionSendStreamDriverAuthMode x509/name" > /etc/rsyslog.d/stream_driver_auth.conf
++fi
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
+new file mode 100644
+index 00000000000..8e1ec48a974
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
+@@ -0,0 +1,43 @@
++<def-group>
++    <definition class="compliance" id="{{{ rule_id }}}" version="1">
++        {{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
++        <criteria operator="AND">
++            <criteria operator="OR">
++                 <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
++                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
++                <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
++                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
++            </criteria>
++        </criteria>
++    </definition>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" version="1">
++
++        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode"
++                                    comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
++                                    version="1">
++        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
++        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++
++    <ind:textfilecontent54_test check="all" check_existence="all_exist"
++                                comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
++                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" version="1">
++        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
++    </ind:textfilecontent54_test>
++
++    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir"
++                                    comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d"
++                                    version="1">
++        <ind:path>/etc/rsyslog.d</ind:path>
++        <ind:filename operation="pattern match">^.*conf$</ind:filename>
++        <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
++        <ind:instance datatype="int">1</ind:instance>
++    </ind:textfilecontent54_object>
++</def-group>
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
+new file mode 100644
+index 00000000000..beaf8ce96da
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml
+@@ -0,0 +1,40 @@
++documentation_complete: true
++
++title: Ensure Rsyslog Authenticates Off-Loaded Audit Records
++
++description: |-
++    Rsyslogd is a system utility providing support for message logging. Support
++    for both internet and UNIX domain sockets enables this utility to support both local
++    and remote logging.  Couple this utility with <tt>gnutls</tt> (which is a secure communications
++    library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
++    encrypt and off-load auditing.
++
++    When using <tt>rsyslogd</tt> to off-load logs the remote system must be authenticated.
++
++rationale: |-
++    The audit records generated by Rsyslog contain valuable information regarding system
++    configuration, user authentication, and other such information. Audit records should be
++    protected from unauthorized access.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-86339-9
++
++references:
++    disa: CCI-001851
++    nist: AU-4(1)
++    srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
++    stigid@rhel8: RHEL-08-030720
++
++
++ocil_clause: '$ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name'
++
++ocil: |-
++    Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command:
++
++    <pre>$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
++    The output should be
++    <pre>$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name</pre>
++
++
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
+new file mode 100644
+index 00000000000..54d70f6b85f
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/default_no_pass.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++bash -x setup.sh
++
++if [[ -f encrypt.conf ]]; then
++  sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
++fi
++  sed -i "/^\$ActionSendStreamDriverMod.*/d" /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
+new file mode 100644
+index 00000000000..fe3db6f9c41
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
+new file mode 100644
+index 00000000000..bad06fba0e9
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverAuthMode 0" >> /etc/rsyslog.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
+new file mode 100644
+index 00000000000..ab511daecc7
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd.pass.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverAuthMode x509/name" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
+new file mode 100644
+index 00000000000..02bf64747a7
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslogd_wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++bash -x setup.sh
++
++echo "\$ActionSendStreamDriverAuthMode x509/certvalid" >> /etc/rsyslog.d/encrypt.conf
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
+new file mode 100644
+index 00000000000..9686f16bcc9
+--- /dev/null
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/setup.sh
+@@ -0,0 +1,9 @@
++#!/bin/bash
++# Use this script to ensure the rsyslog directory structure and rsyslog conf file
++# exist in the test env.
++config_file=/etc/rsyslog.conf
++
++# Ensure directory structure exists (useful for container based testing)
++test -f $config_file || touch $config_file
++
++test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index ec0a3b17537..382247057cd 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -854,6 +854,7 @@ selections:
+     - rsyslog_encrypt_offload_actionsendstreamdrivermode
+ 
+     # RHEL-08-030720
++    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+ 
+     # RHEL-08-030730
+     # this rule expects configuration in MB instead percentage as how STIG demands
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 61384c108a0..03211442aba 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -460,7 +460,6 @@ CCE-86335-7
+ CCE-86336-5
+ CCE-86337-3
+ CCE-86338-1
+-CCE-86339-9
+ CCE-86340-7
+ CCE-86341-5
+ CCE-86342-3
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index bffa509b698..481e7b28228 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -238,6 +238,7 @@ selections:
+ - require_singleuser_auth
+ - root_permissions_syslibrary_files
+ - rsyslog_cron_logging
++- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+ - rsyslog_encrypt_offload_actionsendstreamdrivermode
+ - rsyslog_encrypt_offload_defaultnetstreamdriver
+ - rsyslog_remote_access_monitoring
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index c84ac75c7bf..7fb3d892a30 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -249,6 +249,7 @@ selections:
+ - require_singleuser_auth
+ - root_permissions_syslibrary_files
+ - rsyslog_cron_logging
++- rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+ - rsyslog_encrypt_offload_actionsendstreamdrivermode
+ - rsyslog_encrypt_offload_defaultnetstreamdriver
+ - rsyslog_remote_access_monitoring

SOURCES/scap-security-guide-0.1.58-RHEL_08_030730-PR_7323.patch

@@ -0,0 +1,357 @@
+From 2f4ddb4297f2a14e2bde3b32f76347e2bbe2cb2d Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Thu, 19 Aug 2021 09:47:42 -0500
+Subject: [PATCH] Add new rule for RHEL-07-030330 and RHEL-08-030730
+
+This new rule is copy of auditd_data_retention_space_left, but
+setup to allow for percentages.
+---
+ .../auditd_data_retention_space_left/rule.yml |  2 -
+ .../ansible/shared.yml                        | 15 ++++++
+ .../bash/shared.sh                            |  7 +++
+ .../oval/shared.xml                           | 32 +++++++++++++
+ .../rule.yml                                  | 47 +++++++++++++++++++
+ .../tests/no_percent_sign.fail.sh             |  6 +++
+ .../space_left_greater_than_minimum.pass.sh   |  6 +++
+ .../tests/space_left_minimum_value.pass.sh    |  6 +++
+ .../tests/space_left_not_enough.fail.sh       |  6 +++
+ .../tests/space_left_not_there.fail.sh        |  6 +++
+ .../var_auditd_space_left_percentage.var      | 15 ++++++
+ products/rhel7/profiles/stig.profile          |  3 +-
+ products/rhel8/profiles/stig.profile          |  7 +--
+ shared/references/cce-redhat-avail.txt        |  2 -
+ .../data/profile_stability/rhel8/stig.profile |  3 +-
+ .../profile_stability/rhel8/stig_gui.profile  |  3 +-
+ 16 files changed, 156 insertions(+), 10 deletions(-)
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
+
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
+index 7fd0470df8..a652d15d0d 100644
+--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
+@@ -39,8 +39,6 @@ references:
+     pcidss: Req-10.7
+     srg: SRG-OS-000343-GPOS-00134
+     stigid@ol7: OL07-00-030330
+-    stigid@rhel7: RHEL-07-030330
+-    stigid@rhel8: RHEL-08-030730
+     stigid@sle12: SLES-12-020030
+     stigid@sle15: SLES-15-030700
+     stigid@ubuntu2004: UBTU-20-010217
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
+new file mode 100644
+index 0000000000..ea52773bd3
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/ansible/shared.yml
+@@ -0,0 +1,15 @@
++# platform = multi_platform_all
++# reboot = false
++# strategy = restrict
++# complexity = low
++# disruption = low
++{{{ ansible_instantiate_variables("var_auditd_space_left_percentage") }}}
++
++- name: Configure auditd space_left on Low Disk Space
++  lineinfile:
++    dest: /etc/audit/auditd.conf
++    line: "space_left = {{ var_auditd_space_left_percentage }}%"
++    regexp: '^\s*space_left\s*=\s*.*$'
++    state: present
++    create: yes
++  #notify: reload auditd
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
+new file mode 100644
+index 0000000000..6cc3e9ecbe
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/bash/shared.sh
+@@ -0,0 +1,7 @@
++# platform = multi_platform_all
++. /usr/share/scap-security-guide/remediation_functions
++{{{ bash_instantiate_variables("var_auditd_space_left_percentage") }}}
++
++grep -q "^space_left[[:space:]]*=.*$" /etc/audit/auditd.conf && \
++  sed -i "s/^space_left[[:space:]]*=.*$/space_left = $var_auditd_space_left_percentage%/g" /etc/audit/auditd.conf || \
++  echo "space_left = $var_auditd_space_left_percentage%" >> /etc/audit/auditd.conf
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
+new file mode 100644
+index 0000000000..2fcd222d29
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/oval/shared.xml
+@@ -0,0 +1,32 @@
++<def-group>
++  <definition class="compliance" id="{{{ rule_id }}}" version="2">
++    {{{ oval_metadata("space_left setting in /etc/audit/auditd.conf is set to at least a certain value") }}}
++
++    <criteria>
++        <criterion comment="space_left setting in auditd.conf" test_ref="test_auditd_data_retention_space_left_percentage" />
++    </criteria>
++
++  </definition>
++
++  <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_space_left_percentage" version="1">
++    <ind:object object_ref="object_auditd_data_retention_space_left_percentage" />
++    <ind:state state_ref="state_auditd_data_retention_space_left_percentage" />
++  </ind:textfilecontent54_test>
++
++  <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_percentage" version="2">
++    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
++    <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
++    <!-- Require at least one space before and after the equal sign -->
++    <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind:pattern>
++    <ind:instance datatype="int">1</ind:instance>
++  </ind:textfilecontent54_object>
++
++
++  <ind:textfilecontent54_state id="state_auditd_data_retention_space_left_percentage" version="1">
++    <ind:subexpression operation="greater than or equal" var_ref="var_auditd_space_left_percentage" datatype="int" />
++  </ind:textfilecontent54_state>
++
++  <external_variable comment="audit space_left setting" datatype="int" id="var_auditd_space_left_percentage" version="1" />
++
++
++</def-group>
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
+new file mode 100644
+index 0000000000..ea9d9fcc6b
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml
+@@ -0,0 +1,47 @@
++documentation_complete: true
++
++prodtype:  fedora,rhel7,rhel8,rhel9
++
++title: 'Configure auditd space_left on Low Disk Space'
++
++description: |-
++    The <tt>auditd</tt> service can be configured to take an action
++    when disk space is running low but prior to running out of space completely.
++    Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
++    substituting <i>PERCENTAGE</i> appropriately:
++    <pre>space_left = <i>PERCENTAGE</i>%</pre>
++    Set this value to at least 25 to cause the system to
++    notify the user of an issue.
++
++rationale: |-
++    Notifying administrators of an impending disk space problem may allow them to
++    take corrective action prior to any disruption.
++
++severity: medium
++
++identifiers:
++    cce@rhel7: CCE-86056-9
++    cce@rhel8: CCE-86055-1
++
++references:
++    cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8
++    cobit5: APO11.04,APO12.06,APO13.01,BAI03.05,BAI04.04,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,MEA02.01
++    disa: CCI-001855
++    isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
++    isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 6.1,SR 7.1,SR 7.2'
++    iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.16.1.4,A.16.1.5,A.16.1.7,A.17.2.1
++    nist: AU-5(b),AU-5(2),AU-5(1),AU-5(4),CM-6(a)
++    nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4
++    pcidss: Req-10.7
++    srg: SRG-OS-000343-GPOS-00134
++    stigid@rhel7: RHEL-07-030330
++    stigid@rhel8: RHEL-08-030730
++    vmmsrg: SRG-OS-000343-VMM-001240
++
++ocil_clause: 'the system is not configured with a specific percentage to notify administrators of an issue'
++
++ocil: |-
++    Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
++    determine if the system is configured correctly:
++    <pre>space_left <i>PERCENTAGE</i>%</pre>
++
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
+new file mode 100644
+index 0000000000..2e90ce1d7b
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/no_percent_sign.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# variables = var_auditd_space_left_percentage=25
++
++. $SHARED/auditd_utils.sh
++prepare_auditd_test_enviroment
++set_parameters_value /etc/audit/auditd.conf "space_left" "25"
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
+new file mode 100644
+index 0000000000..135d6e4258
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_greater_than_minimum.pass.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# variables = var_auditd_space_left_percentage=25
++
++. $SHARED/auditd_utils.sh
++prepare_auditd_test_enviroment
++set_parameters_value /etc/audit/auditd.conf "space_left" "35%"
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
+new file mode 100644
+index 0000000000..10d652e80e
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_minimum_value.pass.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# variables = var_auditd_space_left_percentage=25
++
++. $SHARED/auditd_utils.sh
++prepare_auditd_test_enviroment
++set_parameters_value /etc/audit/auditd.conf "space_left" "25%"
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
+new file mode 100644
+index 0000000000..0bf7694b15
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_enough.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# variables = var_auditd_space_left_percentage=25
++
++. $SHARED/auditd_utils.sh
++prepare_auditd_test_enviroment
++set_parameters_value /etc/audit/auditd.conf "space_left" "15%"
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
+new file mode 100644
+index 0000000000..34ac5595c6
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/tests/space_left_not_there.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# variables = var_auditd_space_left_percentage=25
++
++. $SHARED/auditd_utils.sh
++prepare_auditd_test_enviroment
++delete_parameter /etc/audit/auditd.conf "space_left"
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var b/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
+new file mode 100644
+index 0000000000..427a1d4bfa
+--- /dev/null
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_space_left_percentage.var
+@@ -0,0 +1,15 @@
++documentation_complete: true
++
++title: 'The percentage remaining in disk space before prompting space_left_action'
++
++description: 'The setting for space_left as a percentage in /etc/audit/auditd.conf'
++
++type: number
++
++interactive: true
++
++options:
++    25pc: 25
++    50pc: 50
++    75pc: 75
++    default: 25
+diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
+index 9ca1360005..67e22982cd 100644
+--- a/products/rhel7/profiles/stig.profile
++++ b/products/rhel7/profiles/stig.profile
+@@ -50,6 +50,7 @@ selections:
+     - var_removable_partition=dev_cdrom
+     - var_auditd_action_mail_acct=root
+     - var_auditd_space_left_action=email
++    - var_auditd_space_left_percentage=25pc
+     - var_accounts_user_umask=077
+     - var_password_pam_retry=3
+     - var_accounts_max_concurrent_login_sessions=10
+@@ -178,8 +179,8 @@ selections:
+     - auditd_audispd_configure_remote_server
+     - auditd_audispd_encrypt_sent_records
+     - auditd_audispd_disk_full_action
+-    - auditd_data_retention_space_left
+     - auditd_data_retention_space_left_action
++    - auditd_data_retention_space_left_percentage
+     - auditd_data_retention_action_mail_acct
+     - audit_rules_suid_privilege_function
+     - audit_rules_dac_modification_chown
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 36f384621a..10dbc1501b 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -65,7 +65,7 @@ selections:
+     - var_auditd_action_mail_acct=root
+     - var_time_service_set_maxpoll=18_hours
+     - var_accounts_maximum_age_login_defs=60
+-    - var_auditd_space_left=250MB
++    - var_auditd_space_left_percentage=25pc
+     - var_auditd_space_left_action=email
+     - var_auditd_disk_error_action=halt
+     - var_auditd_max_log_file_action=syslog
+@@ -922,8 +922,9 @@ selections:
+     - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+ 
+     # RHEL-08-030730
+-    # this rule expects configuration in MB instead percentage as how STIG demands
+-    # - auditd_data_retention_space_left
++    - auditd_data_retention_space_left_percentage
++
++    # RHEL-08-030731
+     - auditd_data_retention_space_left_action
+ 
+     # RHEL-08-030740
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 6c33c2e85f..fcb8125ca4 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -170,8 +170,6 @@ CCE-86051-0
+ CCE-86052-8
+ CCE-86053-6
+ CCE-86054-4
+-CCE-86055-1
+-CCE-86056-9
+ CCE-86057-7
+ CCE-86058-5
+ CCE-86059-3
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index f3e6c4fa1a..09a5bc3174 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -140,6 +140,7 @@ selections:
+ - auditd_data_retention_action_mail_acct
+ - auditd_data_retention_max_log_file_action
+ - auditd_data_retention_space_left_action
++- auditd_data_retention_space_left_percentage
+ - auditd_local_events
+ - auditd_log_format
+ - auditd_name_format
+@@ -422,7 +423,7 @@ selections:
+ - var_auditd_action_mail_acct=root
+ - var_time_service_set_maxpoll=18_hours
+ - var_accounts_maximum_age_login_defs=60
+-- var_auditd_space_left=250MB
++- var_auditd_space_left_percentage=25pc
+ - var_auditd_space_left_action=email
+ - var_auditd_disk_error_action=halt
+ - var_auditd_max_log_file_action=syslog
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index b5b60349a8..5b631a3fe0 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -151,6 +151,7 @@ selections:
+ - auditd_data_retention_action_mail_acct
+ - auditd_data_retention_max_log_file_action
+ - auditd_data_retention_space_left_action
++- auditd_data_retention_space_left_percentage
+ - auditd_local_events
+ - auditd_log_format
+ - auditd_name_format
+@@ -432,7 +433,7 @@ selections:
+ - var_auditd_action_mail_acct=root
+ - var_time_service_set_maxpoll=18_hours
+ - var_accounts_maximum_age_login_defs=60
+-- var_auditd_space_left=250MB
++- var_auditd_space_left_percentage=25pc
+ - var_auditd_space_left_action=email
+ - var_auditd_disk_error_action=halt
+ - var_auditd_max_log_file_action=syslog

SOURCES/scap-security-guide-0.1.58-RHEL_08_040286-PR_7354.patch

@@ -0,0 +1,66 @@
+From 994b50e9a47e222c2a27fde231cbf3e2f6f77aed Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Fri, 6 Aug 2021 15:26:28 -0500
+Subject: [PATCH] Select sysctl_net_core_bpf_jit_harden for RHEL-08-040286
+
+---
+ .../restrictions/sysctl_net_core_bpf_jit_harden/rule.yml       | 3 +++
+ products/rhel8/profiles/stig.profile                           | 3 +++
+ tests/data/profile_stability/rhel8/stig.profile                | 1 +
+ tests/data/profile_stability/rhel8/stig_gui.profile            | 1 +
+ 4 files changed, 8 insertions(+)
+
+diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
+index 9a1096cc72..31b7183b87 100644
+--- a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml
+@@ -19,8 +19,11 @@ identifiers:
+     cce@rhel9: CCE-83966-2
+ 
+ references:
++    disa: CCI-000366
++    nist: CM-6b
+     ospp: FMT_SMF_EXT.1
+     srg: SRG-OS-000480-GPOS-00227
++    stigid@rhel8: RHEL-08-040286
+ 
+ {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.core.bpf_jit_harden", value="2") }}}
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 0a1fdd15ca..a358f61dba 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1149,6 +1149,9 @@ selections:
+     # RHEL-08-040285
+     - sysctl_net_ipv4_conf_all_rp_filter
+ 
++    # RHEL-08-040286
++    - sysctl_net_core_bpf_jit_harden
++
+     # RHEL-08-040290
+     # /etc/postfix/main.cf does not exist on default installation resulting in error during remediation
+     # there needs to be a new platform check to identify when postfix is installed or not
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index d7e2f71376..7d54a7505f 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -359,6 +359,7 @@ selections:
+ - sysctl_kernel_randomize_va_space
+ - sysctl_kernel_unprivileged_bpf_disabled
+ - sysctl_kernel_yama_ptrace_scope
++- sysctl_net_core_bpf_jit_harden
+ - sysctl_net_ipv4_conf_all_accept_redirects
+ - sysctl_net_ipv4_conf_all_accept_source_route
+ - sysctl_net_ipv4_conf_all_rp_filter
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 7c95e31545..97291230e7 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -370,6 +370,7 @@ selections:
+ - sysctl_kernel_randomize_va_space
+ - sysctl_kernel_unprivileged_bpf_disabled
+ - sysctl_kernel_yama_ptrace_scope
++- sysctl_net_core_bpf_jit_harden
+ - sysctl_net_ipv4_conf_all_accept_redirects
+ - sysctl_net_ipv4_conf_all_accept_source_route
+ - sysctl_net_ipv4_conf_all_rp_filter

SOURCES/scap-security-guide-0.1.58-add_RHEL_08_020240-PR_7330.patch

@@ -0,0 +1,121 @@
+From 3d24d93e200f53f3845fffbc8764b8e48517c7b2 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Wed, 4 Aug 2021 16:57:50 +0200
+Subject: [PATCH] Assign RHEL-08-020240 to account_unique_id and add test
+ scenarios.
+
+---
+ .../accounts-restrictions/account_unique_id/oval/shared.xml  | 2 +-
+ .../accounts-restrictions/account_unique_id/rule.yml         | 4 +++-
+ .../account_unique_id/tests/correct_value.pass.sh            | 2 ++
+ .../account_unique_id/tests/wrong_value.fail.sh              | 5 +++++
+ products/rhel8/profiles/stig.profile                         | 1 +
+ shared/references/cce-redhat-avail.txt                       | 1 -
+ tests/data/profile_stability/rhel8/stig.profile              | 1 +
+ tests/data/profile_stability/rhel8/stig_gui.profile          | 1 +
+ 8 files changed, 14 insertions(+), 3 deletions(-)
+ create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
+ create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
+
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
+index be45c518115..491ad4587ee 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
+@@ -7,7 +7,7 @@
+ 
+   </definition>
+ 
+-  <!-- collect informatino about all users -->
++  <!-- collect information about all users -->
+   <unix:password_object id="obj_all_uids" version="1">
+     <unix:username operation="pattern match">.*</unix:username>
+   </unix:password_object>
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
+index 731632f7f5a..e55901dbdc5 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
+@@ -12,6 +12,7 @@ severity: medium
+ 
+ identifiers:
+     cce@rhel7: CCE-85857-1
++    cce@rhel8: CCE-89903-9
+     cce@sle12: CCE-83196-6
+     cce@sle15: CCE-83277-4
+ 
+@@ -19,7 +20,8 @@ references:
+     cis@rhel7: 6.2.7
+     disa: CCI-000764,CCI-000804
+     nist@sle12: IA-2,IA-2.1,IA-8,IA-8.1
+-    srg: SRG-OS-000104-GPOS-00051,SRG-OS-000121-GPOS-00062
++    srg: SRG-OS-000104-GPOS-00051,SRG-OS-000121-GPOS-00062,SRG-OS-000042-GPOS-00020
++    stigid@rhel8: RHEL-08-020240
+     stigid@sle12: SLES-12-010640
+     stigid@sle15: SLES-15-010230
+ 
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
+new file mode 100644
+index 00000000000..645c46eb847
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
+@@ -0,0 +1,2 @@
++#!/bin/bash
++# remediation = none
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
+new file mode 100644
+index 00000000000..cc7f2215041
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# remediation = none
++
++echo "test_user:x:30090:30090:Test User:/home/test_user:/usr/bin/bash" >> /etc/passwd
++echo "test_user_2:x:30090:30090:Test User 2:/home/test_user_2:/usr/bin/bash" >> /etc/passwd
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index ec0a3b17537..bdddfef846f 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -552,6 +552,7 @@ selections:
+     - accounts_password_minlen_login_defs
+ 
+     # RHEL-08-020240
++    - account_unique_id
+ 
+     # RHEL-08-020250
+     - sssd_enable_smartcards
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 61384c108a0..1d54e8ec15f 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -3969,7 +3969,6 @@ CCE-89899-9
+ CCE-89900-5
+ CCE-89901-3
+ CCE-89902-1
+-CCE-89903-9
+ CCE-89904-7
+ CCE-89905-4
+ CCE-89906-2
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index bffa509b698..71dd6330a16 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -26,6 +26,7 @@ selections:
+ - account_disable_post_pw_expiration
+ - account_emergency_expire_date
+ - account_temp_expire_date
++- account_unique_id
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay
+ - accounts_max_concurrent_login_sessions
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index c84ac75c7bf..3e788b27bac 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -37,6 +37,7 @@ selections:
+ - account_disable_post_pw_expiration
+ - account_emergency_expire_date
+ - account_temp_expire_date
++- account_unique_id
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay
+ - accounts_max_concurrent_login_sessions

SOURCES/scap-security-guide-0.1.58-add_missing_unit_test_playbook-PR_7431.patch

@@ -0,0 +1,80 @@
+From 86dad83f4e6c5b823882ec736d27410570f5b69a Mon Sep 17 00:00:00 2001
+From: Watson Sato <wsato@redhat.com>
+Date: Fri, 20 Aug 2021 16:03:33 +0200
+Subject: [PATCH] Add missing unit test playbook
+
+The playbook is used on
+test-function-check_playbook_file_removed_and_added
+---
+ .../file_block_removed_and_not_added.yml      | 62 +++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+ create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
+
+diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
+new file mode 100644
+index 0000000000..8391d1bc99
+--- /dev/null
++++ b/tests/ansible_file_removed_and_added/file_block_removed_and_not_added.yml
+@@ -0,0 +1,62 @@
++---
++
++- hosts: all
++  vars:
++    var_system_crypto_policy: !!str FUTURE
++    var_sudo_logfile: !!str /var/log/sudo.log
++
++  tasks:
++    - name: Modify the System Login Banner - add correct banner
++      lineinfile:
++        dest: /etc/issue
++        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
++          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
++          "\n") | regex_replace("\\", "") | wordwrap() }}'
++        create: true
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Test for existence /etc/issue
++      stat:
++        path: /etc/issue
++      register: file_exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - name: Ensure permission 0644 on /etc/issue
++      file:
++        path: /etc/issue
++        mode: '0644'
++      when: file_exists.stat is defined and file_exists.stat.exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - block:
++        - name: Remove Rsh Trust Files
++          file:
++            path: '/root/shosts.equiv'
++            state: absent
++      tags:
++        - high_severity
++        - low_complexity
++        - low_disruption
++        - no_reboot_needed
++        - no_rsh_trust_files
++        - restrict_strategy
++

SOURCES/scap-security-guide-0.1.58-add_rhel_minor_check-PR_7251.patch

@@ -0,0 +1,179 @@
+From b814fc94d0fb360ef53a6b735e9520df5b484589 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 14 Jul 2021 12:52:13 -0500
+Subject: [PATCH 1/3] Add Jinja-based RHEL 8 minor check
+
+---
+ shared/checks/oval/installed_OS_is_rhel8.xml | 29 ++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/shared/checks/oval/installed_OS_is_rhel8.xml b/shared/checks/oval/installed_OS_is_rhel8.xml
+index a9699411ce7..fdd3c870d43 100644
+--- a/shared/checks/oval/installed_OS_is_rhel8.xml
++++ b/shared/checks/oval/installed_OS_is_rhel8.xml
+@@ -44,6 +44,35 @@
+     <linux:name>redhat-release</linux:name>
+   </linux:rpminfo_object>
+ 
++  {{% for minorversion in range(0, 9) %}}
++  <definition class="inventory" id="installed_OS_is_rhel8_{{{ minorversion }}}" version="1">
++    <metadata>
++      <title>Red Hat Enterprise Linux 8.{{{ minorversion }}}</title>
++      <affected family="unix">
++        <platform>Red Hat Enterprise Linux 8.{{{ minorversion }}}</platform>
++      </affected>
++      <reference ref_id="cpe:/o:redhat:enterprise_linux:8.{{{ minorversion }}}" source="CPE" />
++      <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{  minorversion}}}</description>
++    </metadata>
++  </definition>
++
++  <criteria>
++    <criterion comment="RHEL.{{{ minorversion }}} 8 is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
++  </criteria>
++
++  <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.{{{ minorversion }}}"
++   id="test_rhel8_{{{ minorversion }}}" version="1">
++    <linux:object object_ref="obj_rhel8_{{{ minorversion }}}" />
++    <linux:state state_ref="state_rhel8_{{{ minorversion }}}" />
++  </linux:rpminfo_test>
++  <linux:rpminfo_state id="state_rhel8_{{{ minorversion }}}" version="1">
++    <linux:version operation="pattern match">^8.{{{ minorversion }}}*$</linux:version>
++  </linux:rpminfo_state>
++  <linux:rpminfo_object id="obj_rhel8_{{{ minorversion }}}" version="1">
++    <linux:name>redhat-release</linux:name>
++  </linux:rpminfo_object>
++  {{% endfor %}}
++
+   <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="test_rhevh_rhel8_version" version="1">
+     <ind:object object_ref="obj_rhevh_rhel8_version" />
+     <ind:state state_ref="state_rhevh_rhel8_version" />
+
+From d37d303654be74758c19615ef027b3bafa2d7217 Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Wed, 14 Jul 2021 15:30:02 -0400
+Subject: [PATCH 2/3] Adding cpe's to product.yml
+
+---
+ products/rhel8/product.yml | 45 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/products/rhel8/product.yml b/products/rhel8/product.yml
+index 3278207fcb4..14336bfddf1 100644
+--- a/products/rhel8/product.yml
++++ b/products/rhel8/product.yml
+@@ -27,6 +27,51 @@ cpes:
+       title: "Red Hat Enterprise Linux 8"
+       check_id: installed_OS_is_rhel8
+ 
++  - rhel8.0:
++      name: "cpe:/o:redhat:enterprise_linux:8.0"
++      title: "Red Hat Enterprise Linux 8.0"
++      check_id: installed_OS_is_rhel8_0
++
++  - rhel8.1:
++      name: "cpe:/o:redhat:enterprise_linux:8.1"
++      title: "Red Hat Enterprise Linux 8.1"
++      check_id: installed_OS_is_rhel8_1
++
++  - rhel8.2:
++      name: "cpe:/o:redhat:enterprise_linux:8.2"
++      title: "Red Hat Enterprise Linux 8.2"
++      check_id: installed_OS_is_rhel8_2
++
++  - rhel8.3:
++      name: "cpe:/o:redhat:enterprise_linux:8.3"
++      title: "Red Hat Enterprise Linux 8.3"
++      check_id: installed_OS_is_rhel8_3
++
++  - rhel8.4:
++      name: "cpe:/o:redhat:enterprise_linux:8.4"
++      title: "Red Hat Enterprise Linux 8.4"
++      check_id: installed_OS_is_rhel8_4
++
++  - rhel8.5:
++      name: "cpe:/o:redhat:enterprise_linux:8.5"
++      title: "Red Hat Enterprise Linux 8.5"
++      check_id: installed_OS_is_rhel8_5
++
++  - rhel8.6:
++      name: "cpe:/o:redhat:enterprise_linux:8.6"
++      title: "Red Hat Enterprise Linux 8.6"
++      check_id: installed_OS_is_rhel8_6
++
++  - rhel8.7:
++      name: "cpe:/o:redhat:enterprise_linux:8.7"
++      title: "Red Hat Enterprise Linux 8.7"
++      check_id: installed_OS_is_rhel8_7
++
++  - rhel8.8:
++      name: "cpe:/o:redhat:enterprise_linux:8.8"
++      title: "Red Hat Enterprise Linux 8.8"
++      check_id: installed_OS_is_rhel8_8
++
+ # Mapping of CPE platform to package
+ platform_package_overrides:
+   login_defs: "shadow-utils"
+
+From c4e4fd7b0449ba4655020fc0dc99ae3c4523b8cc Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Mon, 19 Jul 2021 08:12:34 -0500
+Subject: [PATCH 3/3] Add checks to go up to RHEL 8.10
+
+This also makes the checks work.
+---
+ products/rhel8/product.yml                   | 10 ++++++++++
+ shared/checks/oval/installed_OS_is_rhel8.xml | 10 +++++-----
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/products/rhel8/product.yml b/products/rhel8/product.yml
+index 14336bfddf1..78c987b2457 100644
+--- a/products/rhel8/product.yml
++++ b/products/rhel8/product.yml
+@@ -72,6 +72,16 @@ cpes:
+       title: "Red Hat Enterprise Linux 8.8"
+       check_id: installed_OS_is_rhel8_8
+ 
++  - rhel8.9:
++      name: "cpe:/o:redhat:enterprise_linux:8.9"
++      title: "Red Hat Enterprise Linux 8.9"
++      check_id: installed_OS_is_rhel8_9
++
++  - rhel8.10:
++      name: "cpe:/o:redhat:enterprise_linux:8.10"
++      title: "Red Hat Enterprise Linux 8.10"
++      check_id: installed_OS_is_rhel8_10
++
+ # Mapping of CPE platform to package
+ platform_package_overrides:
+   login_defs: "shadow-utils"
+diff --git a/shared/checks/oval/installed_OS_is_rhel8.xml b/shared/checks/oval/installed_OS_is_rhel8.xml
+index fdd3c870d43..feab963b941 100644
+--- a/shared/checks/oval/installed_OS_is_rhel8.xml
++++ b/shared/checks/oval/installed_OS_is_rhel8.xml
+@@ -44,7 +44,7 @@
+     <linux:name>redhat-release</linux:name>
+   </linux:rpminfo_object>
+ 
+-  {{% for minorversion in range(0, 9) %}}
++  {{% for minorversion in range(0, 11) %}}
+   <definition class="inventory" id="installed_OS_is_rhel8_{{{ minorversion }}}" version="1">
+     <metadata>
+       <title>Red Hat Enterprise Linux 8.{{{ minorversion }}}</title>
+@@ -52,13 +52,13 @@
+         <platform>Red Hat Enterprise Linux 8.{{{ minorversion }}}</platform>
+       </affected>
+       <reference ref_id="cpe:/o:redhat:enterprise_linux:8.{{{ minorversion }}}" source="CPE" />
+-      <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{  minorversion}}}</description>
++      <description>The operating system installed on the system is Red Hat Enterprise Linux 8.{{{ minorversion }}}</description>
+     </metadata>
++    <criteria>
++      <criterion comment="RHEL 8.{{{ minorversion }}} is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
++    </criteria>
+   </definition>
+ 
+-  <criteria>
+-    <criterion comment="RHEL.{{{ minorversion }}} 8 is installed" test_ref="test_rhel8_{{{ minorversion }}}" />
+-  </criteria>
+ 
+   <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.{{{ minorversion }}}"
+    id="test_rhel8_{{{ minorversion }}}" version="1">

SOURCES/scap-security-guide-0.1.58-ansible_missing_metadata-PR_7357.patch

@@ -0,0 +1,50 @@
+From 5d4726bb609f463956c03909891f8fbd1975d222 Mon Sep 17 00:00:00 2001
+From: Milan Lysonek <mlysonek@redhat.com>
+Date: Mon, 9 Aug 2021 14:00:19 +0200
+Subject: [PATCH] Add missing ansible remediation metadata
+
+---
+ .../auditd_overflow_action/ansible/shared.yml                 | 4 ++++
+ .../ansible/shared.yml                                        | 4 ++++
+ .../ansible/shared.yml                                        | 4 ++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
+index 166054a95a..e1569b2254 100644
+--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml
+@@ -1,4 +1,8 @@
+ # platform = multi_platform_fedora,multi_platform_rhel
++# reboot = false
++# strategy = restrict
++# complexity = low
++# disruption = low
+ 
+ {{{ ansible_set_config_file(file="/etc/audit/auditd.conf",
+                   parameter="overflow_action",
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+index 2d6c5227a8..bbd27a0061 100644
+--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+@@ -1,4 +1,8 @@
+ # platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++# reboot = false
++# strategy = configure
++# complexity = low
++# disruption = low
+ 
+ {{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
+              parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
+diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+index 2ddbfb871f..b215daaef4 100644
+--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+@@ -1,4 +1,8 @@
+ # platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++# reboot = false
++# strategy = configure
++# complexity = low
++# disruption = low
+ 
+ {{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
+                     parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")

SOURCES/scap-security-guide-0.1.58-audit_privileged_rhel_cis-PR_7353.patch

@@ -0,0 +1,92 @@
+From 01397cbe2a62303ef001ab5e5821ffafd6929e41 Mon Sep 17 00:00:00 2001
+From: Alex Haydock <alex@alexhaydock.co.uk>
+Date: Fri, 6 Aug 2021 16:46:22 +0100
+Subject: [PATCH] Update CCEs and identifiers on rules that make up RHEL 8 CIS
+ 4.1.15
+
+---
+ .../audit_rules_privileged_commands_insmod/rule.yml            | 2 ++
+ .../audit_rules_privileged_commands_modprobe/rule.yml          | 2 ++
+ .../audit_rules_privileged_commands_rmmod/rule.yml             | 2 ++
+ shared/references/cce-redhat-avail.txt                         | 3 ---
+ 4 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
+index 5c3a99447c..a4ecb0d1e0 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
+@@ -28,10 +28,12 @@ severity: medium
+ 
+ identifiers:
+     cce@rhel7: CCE-85851-4
++    cce@rhel8: CCE-85919-9
+     cce@sle15: CCE-85744-1
+ 
+ references:
+     cis@rhel7: 4.1.16
++    cis@rhel8: 4.1.15
+     cis@ubuntu2004: 4.1.16
+     disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
+     nist: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
+index 5e03dde851..f70c537064 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
+@@ -32,10 +32,12 @@ severity: medium
+ 
+ identifiers:
+     cce@rhel7: CCE-85853-0
++    cce@rhel8: CCE-85973-6
+     cce@sle15: CCE-85731-8
+ 
+ references:
+     cis@rhel7: 4.1.16
++    cis@rhel8: 4.1.15
+     cis@ubuntu2004: 4.1.16
+     disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
+     nist: AU-12(a),AU-12.1(ii),AU-3,AU-3.1,AU-12(c),AU-12.1(iv),MA-4(1)(a)
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
+index 1535041672..113c8fc4bc 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
+@@ -28,10 +28,12 @@ severity: medium
+ 
+ identifiers:
+     cce@rhel7: CCE-85852-2
++    cce@rhel8: CCE-86017-1
+     cce@sle15: CCE-85732-6
+ 
+ references:
+     cis@rhel7: 4.1.16
++    cis@rhel8: 4.1.15
+     cis@ubuntu2004: 4.1.16
+     disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
+     nist@sle15: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 001262c6ee..aaa631515b 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -49,7 +49,6 @@ CCE-85915-7
+ CCE-85916-5
+ CCE-85917-3
+ CCE-85918-1
+-CCE-85919-9
+ CCE-85920-7
+ CCE-85921-5
+ CCE-85922-3
+@@ -100,7 +99,6 @@ CCE-85968-6
+ CCE-85969-4
+ CCE-85970-2
+ CCE-85972-8
+-CCE-85973-6
+ CCE-85974-4
+ CCE-85975-1
+ CCE-85976-9
+@@ -143,7 +141,6 @@ CCE-86013-0
+ CCE-86014-8
+ CCE-86015-5
+ CCE-86016-3
+-CCE-86017-1
+ CCE-86018-9
+ CCE-86019-7
+ CCE-86020-5

SOURCES/scap-security-guide-0.1.58-bios_enable_execution_restrictions_srg-PR_7284.patch

@@ -0,0 +1,21 @@
+From df11870dd23bc5ada56acd89610c6498cbc5bc35 Mon Sep 17 00:00:00 2001
+From: Milan Lysonek <mlysonek@redhat.com>
+Date: Mon, 26 Jul 2021 11:49:30 +0200
+Subject: [PATCH] Add bios_enable_execution_restrictions SRG reference
+
+---
+ .../enable_nx/bios_enable_execution_restrictions/rule.yml        | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+index b037e374f5..99f2c739c9 100644
+--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+@@ -31,6 +31,7 @@ references:
+     iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
+     nist: SC-39,CM-6(a)
+     nist-csf: PR.IP-1
++    srg: SRG-OS-000433-GPOS-00192
+     stig@rhel8: RHEL-08-010420
+ 
+ platform: machine

SOURCES/scap-security-guide-0.1.58-cis_rhel7_updates-PR_7384.patch

@@ -0,0 +1,139 @@
+From 44976b5fda0f34e78a0a0764add645212bd4e26d Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 11:08:56 +0200
+Subject: [PATCH 1/4] remove automated: yes for 1.1.6, rule is missing
+
+---
+ controls/cis_rhel7.yml | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
+index 6a333693fb..7298158ad3 100644
+--- a/controls/cis_rhel7.yml
++++ b/controls/cis_rhel7.yml
+@@ -95,8 +95,7 @@ controls:
+     levels:
+     - l1_server
+     - l1_workstation
+-    automated: yes
+-#     rules:
++    automated: no # rule missing
+ 
+   - id: 1.1.7
+     title: Ensure noexec option set on /dev/shm partition (Automated)
+
+From 4dcbe4b2d4a9c14527edd06e90809630877d97aa Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 11:21:20 +0200
+Subject: [PATCH 2/4] add rule for 3.5.1.5 - firewalld default zone
+
+---
+ controls/cis_rhel7.yml                                        | 4 +++-
+ .../ruleset_modifications/set_firewalld_default_zone/rule.yml | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
+index 7298158ad3..0f3cec2a83 100644
+--- a/controls/cis_rhel7.yml
++++ b/controls/cis_rhel7.yml
+@@ -1022,7 +1022,9 @@ controls:
+     levels:
+     - l1_server
+     - l1_workstation
+-    automated: no # no exact rule is present
++    automated: yes
++    rules:
++    - set_firewalld_default_zone
+ 
+   - id: 3.5.1.6
+     title: Ensure network interfaces are assigned to appropriate zone (Manual)
+diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
+index 48de06c5bc..f4d78fb7a1 100644
+--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
++++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
+@@ -27,6 +27,7 @@ identifiers:
+ 
+ references:
+     cis-csc: 11,14,3,9
++    cis@rhel7: 3.5.1.5
+     cis@rhel8: 3.4.2.4
+     cis@sle15: 3.5.1.5
+     cjis: 5.10.1
+
+From a13a796ee8c33ae98e93072bfc7ee15182bdfb5c Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 11:45:52 +0200
+Subject: [PATCH 3/4] partially cover 5.5.1.4
+
+---
+ controls/cis_rhel7.yml                                       | 5 ++++-
+ .../account_disable_post_pw_expiration/rule.yml              | 2 +-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
+index 0f3cec2a83..78ac34817f 100644
+--- a/controls/cis_rhel7.yml
++++ b/controls/cis_rhel7.yml
+@@ -1966,7 +1966,10 @@ controls:
+     levels:
+     - l1_server
+     - l1_workstation
+-    automated: no # rule missing
++    automated: partially # we do not check /et/shadow
++    rules:
++    - account_disable_post_pw_expiration
++    - var_account_disable_post_pw_expiration=30
+ 
+   - id: 5.5.1.5
+     title: Ensure all users last password change date is in the past (Automated)
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
+index 310e234d43..a3d81cf73f 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
+@@ -34,7 +34,7 @@ identifiers:
+ 
+ references:
+     cis-csc: 1,12,13,14,15,16,18,3,5,7,8
+-    cis@rhel7: 5.4.1.4
++    cis@rhel7: 5.5.1.4
+     cis@rhel8: 5.5.1.4
+     cis@ubuntu2004: 5.4.1.4
+     cjis: 5.6.2.1.1
+
+From 31ecc1b5806e7bc14199904b0a4e4d7b027ef7c4 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 11:52:09 +0200
+Subject: [PATCH 4/4] automate 6.2.5
+
+---
+ controls/cis_rhel7.yml                                        | 4 +++-
+ .../account_expiration/account_unique_name/rule.yml           | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
+index 78ac34817f..672b96cbeb 100644
+--- a/controls/cis_rhel7.yml
++++ b/controls/cis_rhel7.yml
+@@ -2205,7 +2205,9 @@ controls:
+     levels:
+     - l1_server
+     - l1_workstation
+-    automated: no # rule missing
++    automated: yes
++    rules:
++    - account_unique_name
+ 
+   - id: 6.2.6
+     title: Ensure no duplicate group names exist (Automated)
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+index 484b3c4f90..5f6377f194 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+@@ -20,6 +20,7 @@ identifiers:
+     cce@rhel9: CCE-83628-8
+ 
+ references:
++    cis@rhel7: 6.2.5
+     cis@rhel8: 6.2.17
+     cjis: 5.5.2
+     disa: CCI-000770,CCI-000804

SOURCES/scap-security-guide-0.1.58-disable_ctrlaltdel_reboot_fix_test_scenario-PR_7444.patch

@@ -0,0 +1,20 @@
+From 9bb002a6870f255a8e4934fab0d1b44893f818bc Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Mon, 23 Aug 2021 12:29:13 +0200
+Subject: [PATCH] disable_ctrlaltdel_reboot: disable service before masking
+ during test scenario setup.
+
+---
+ .../disable_ctrlaltdel_reboot/tests/masked.pass.sh               | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
+index cc333ea2e9e..b56b59b2fd2 100644
+--- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
++++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh
+@@ -1,4 +1,5 @@
+ #!/bin/bash
+ # platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora
+ 
++systemctl disable --now ctrl-alt-del.target
+ systemctl mask --now ctrl-alt-del.target

SOURCES/scap-security-guide-0.1.58-ensure_test_helper_scripts_executable-PR_7302.patch

@@ -0,0 +1,28 @@
+From 030557e3c4b48f568f6fef7de36de4dca6c66838 Mon Sep 17 00:00:00 2001
+From: Watson Sato <wsato@redhat.com>
+Date: Thu, 29 Jul 2021 19:02:11 +0200
+Subject: [PATCH] Ensure test scenarios and scripts are excutable
+
+After Jinja processing the test scenarios and test helper scripts they
+lose their original permissions. This ensures they are readable and
+executable.
+
+The helper scripts are called by test scenarios and they need to be
+executable.
+---
+ tests/ssg_test_suite/common.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/ssg_test_suite/common.py b/tests/ssg_test_suite/common.py
+index 3dbeaf304a..130e5c960c 100644
+--- a/tests/ssg_test_suite/common.py
++++ b/tests/ssg_test_suite/common.py
+@@ -245,6 +245,8 @@ def _make_file_root_owned(tarinfo):
+     if tarinfo:
+         tarinfo.uid = 0
+         tarinfo.gid = 0
++        # set permission to 775
++        tarinfo.mode = 509
+     return tarinfo
+ 
+ 

SOURCES/scap-security-guide-0.1.58-fix_STIG_references-PR_7371.patch

@@ -0,0 +1,114 @@
+From 859684c560e948a439029b0d180fe23659d85141 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Tue, 10 Aug 2021 12:04:16 +0200
+Subject: [PATCH] Remove inexistent and/or duplicated STIG references.
+
+---
+ .../package_xorg-x11-server-common_removed/rule.yml             | 1 -
+ .../accounts_password_pam_unix_remember/rule.yml                | 1 -
+ .../audit_rules_sysadmin_actions/rule.yml                       | 1 -
+ .../file_ownership_var_log_audit/rule.yml                       | 1 -
+ .../auditd_data_retention_space_left_action/rule.yml            | 2 +-
+ .../harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml     | 1 -
+ .../rule.yml                                                    | 2 +-
+ .../crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml | 1 -
+ 8 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
+index de8f0f6fd8..6e739d21a2 100644
+--- a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
++++ b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
+@@ -42,7 +42,6 @@ references:
+     nist-csf: PR.AC-3,PR.PT-4
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@rhel7: RHEL-07-040730
+-    stigid@rhel8: RHEL-08-040320
+ 
+ ocil_clause: 'the X Windows package group or xorg-x11-server-common has not be removed'
+ 
+diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
+index 9138681688..a2b66fc4d6 100644
+--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
+@@ -50,7 +50,6 @@ references:
+     srg: SRG-OS-000077-GPOS-00045
+     stigid@ol7: OL07-00-010270
+     stigid@rhel7: RHEL-07-010270
+-    stigid@rhel8: RHEL-08-020220
+     stigid@sle15: SLES-15-020250
+     stigid@ubuntu2004: UBTU-20-010070
+     vmmsrg: SRG-OS-000077-VMM-000440
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
+index 12bca676d8..b4291e168c 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
+@@ -50,7 +50,6 @@ references:
+     srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,CCI-002884,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221
+     stigid@ol7: OL07-00-030700
+     stigid@rhel7: RHEL-07-030700
+-    stigid@rhel8: RHEL-08-030172
+     stigid@sle15: SLES-15-030140
+     vmmsrg: SRG-OS-000462-VMM-001840,SRG-OS-000471-VMM-001910
+ 
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
+index 956beef52b..96bc0fa0b8 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
+@@ -35,7 +35,6 @@ references:
+     srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
+     stigid@ol7: OL07-00-910055
+     stigid@rhel7: RHEL-07-910055
+-    stigid@rhel8: RHEL-08-030080
+ 
+ ocil: |-
+     {{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
+diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
+index 6e30f1c4ac..7569a6776b 100644
+--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml
+@@ -53,7 +53,7 @@ references:
+     srg: SRG-OS-000343-GPOS-00134
+     stigid@ol7: OL07-00-030340
+     stigid@rhel7: RHEL-07-030340
+-    stigid@rhel8: RHEL-08-030730
++    stigid@rhel8: RHEL-08-030731
+     stigid@ubuntu2004: UBTU-20-010217
+     vmmsrg: SRG-OS-000343-VMM-001240
+ 
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
+index 0aa310d924..682ca436b8 100644
+--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml
+@@ -30,7 +30,6 @@ references:
+     disa: CCI-001453
+     nist: AC-17(2)
+     srg: SRG-OS-000250-GPOS-00093
+-    stigid@rhel8: RHEL-08-010291
+ 
+ ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'
+ 
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
+index b56f2421f2..e904bc848c 100644
+--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml
+@@ -30,7 +30,7 @@ references:
+     disa: CCI-001453
+     nist: AC-17(2)
+     srg: SRG-OS-000250-GPOS-00093
+-    stigid@rhel8: RHEL-08-010290
++    stigid@rhel8: RHEL-08-010291
+ 
+ ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly'
+ 
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
+index 1aeb987db2..d21f68ac17 100644
+--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
+@@ -28,7 +28,6 @@ references:
+     disa: CCI-001453
+     nist: AC-17(2)
+     srg: SRG-OS-000250-GPOS-00093
+-    stigid@rhel8: RHEL-08-010290
+ 
+ ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'
+ 

SOURCES/scap-security-guide-0.1.58-fix_ansible_banner_remediation-PR_7228.patch

@@ -0,0 +1,53 @@
+From a9660f01ecd85240df9460f141387dd2874eba82 Mon Sep 17 00:00:00 2001
+From: Marcus Burghardt <marcus@mbsec.com.br>
+Date: Fri, 9 Jul 2021 16:15:28 +0200
+Subject: [PATCH] Bug 1857179 - Improved ansible fix for banner files. Replace
+ files only when necessary.
+
+---
+ .../banner_etc_issue/ansible/shared.yml              | 12 +++---------
+ .../banner_etc_motd/ansible/shared.yml               | 12 +++---------
+ 2 files changed, 6 insertions(+), 18 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
+index ff6b6eab42b..4f6d64fd7ac 100644
+--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
++++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
+@@ -5,13 +5,7 @@
+ # disruption = medium
+ {{{ ansible_instantiate_variables("login_banner_text") }}}
+ 
+-- name: "{{{ rule_title }}} - remove incorrect banner"
+-  file:
+-    state: absent
+-    path: /etc/issue
+-
+-- name: "{{{ rule_title }}} - add correct banner"
+-  lineinfile:
++- name: "{{{ rule_title }}} - ensure correct banner"
++  copy:
+     dest: /etc/issue
+-    line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+-    create: yes
++    content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
+index 15eb3cc1cbd..2c645889336 100644
+--- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
++++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml
+@@ -5,13 +5,7 @@
+ # disruption = medium
+ {{{ ansible_instantiate_variables("login_banner_text") }}}
+ 
+-- name: "{{{ rule_title }}} - remove incorrect banner"
+-  file:
+-    state: absent
+-    path: /etc/motd
+-
+-- name: "{{{ rule_title }}} - add correct banner"
+-  lineinfile:
++- name: "{{{ rule_title }}} - ensure correct banner"
++  copy:
+     dest: /etc/motd
+-    line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+-    create: yes
++    content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'

SOURCES/scap-security-guide-0.1.58-fix_audit_file_permissions-PR_7440.patch

@@ -0,0 +1,58 @@
+From 1dcdad51a48c17dd5dbb7eb9bbb8cef23cf00e29 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Mon, 23 Aug 2021 10:26:39 +0200
+Subject: [PATCH] Fix remaining audit rule files permissions.
+
+---
+ .../audit_rules_immutable/ansible/shared.yml                 | 1 +
+ .../audit_rules_immutable/bash/shared.sh                     | 1 +
+ shared/templates/audit_file_contents/ansible.template        | 5 +++++
+ shared/templates/audit_file_contents/bash.template           | 2 ++
+ 4 files changed, 9 insertions(+)
+
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
+index 1cafb744cc3..736d4c333e4 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
+@@ -22,6 +22,7 @@
+     path: "{{ item }}"
+     create: True
+     line: "-e 2"
++    mode: o-rwx
+   loop:
+     - "/etc/audit/audit.rules"
+     - "/etc/audit/rules.d/immutable.rules"
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
+index 29cd4a5de6f..36e0691493f 100644
+--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
+@@ -20,4 +20,5 @@ do
+ 	echo '# Set the audit.rules configuration immutable per security requirements' >> $AUDIT_FILE
+ 	echo '# Reboot is required to change audit rules once this setting is applied' >> $AUDIT_FILE
+ 	echo '-e 2' >> $AUDIT_FILE
++	chmod o-rwx $AUDIT_FILE
+ done
+diff --git a/shared/templates/audit_file_contents/ansible.template b/shared/templates/audit_file_contents/ansible.template
+index c2852745451..a262386cfbf 100644
+--- a/shared/templates/audit_file_contents/ansible.template
++++ b/shared/templates/audit_file_contents/ansible.template
+@@ -9,3 +9,8 @@
+         contents=CONTENTS,
+     )
+ }}}
++
++- name: Remove any permissions from other group
++  file:
++    path: {{{ FILEPATH }}}
++    mode: o-rwx
+diff --git a/shared/templates/audit_file_contents/bash.template b/shared/templates/audit_file_contents/bash.template
+index f264be6f14d..d6277167892 100644
+--- a/shared/templates/audit_file_contents/bash.template
++++ b/shared/templates/audit_file_contents/bash.template
+@@ -11,4 +11,6 @@
+     )
+ }}}
+ 
++chmod o-rwx {{{ FILEPATH }}}
++
+ augenrules --load

SOURCES/scap-security-guide-0.1.58-fix_cis_value_selector-PR_7452.patch

@@ -0,0 +1,39 @@
+From bd790153e02c1d1725f59f5d88c65c77eb1421e9 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Tue, 24 Aug 2021 12:48:46 +0200
+Subject: [PATCH] Add a new selector for var_system_crypto_policy and use it
+ RHEL8 CIS.
+
+This new selector is used to select explicit DEFAULT value in RHEL8 CIS
+L1 profiles. The "default" selector cannot be selected and it causes
+errors if used.
+---
+ controls/cis_rhel8.yml                                          | 2 +-
+ .../software/integrity/crypto/var_system_crypto_policy.var      | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml
+index 29d972427cf..c0d3f5f40de 100644
+--- a/controls/cis_rhel8.yml
++++ b/controls/cis_rhel8.yml
+@@ -553,7 +553,7 @@ controls:
+     automated: yes
+     rules:
+       - configure_crypto_policy
+-      - var_system_crypto_policy=default
++      - var_system_crypto_policy=default_policy
+ 
+   # This rule works in conjunction with the configure_crypto_policy above.
+   # If a system is remediated to CIS Level 1, just the rule above will apply
+diff --git a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
+index ce301154a39..8b89848d122 100644
+--- a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
++++ b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
+@@ -13,6 +13,7 @@ interactive: false
+ 
+ options:
+     default: DEFAULT
++    default_policy: DEFAULT
+     default_nosha1: "DEFAULT:NO-SHA1"
+     fips: FIPS
+     fips_ospp: "FIPS:OSPP"

SOURCES/scap-security-guide-0.1.58-fix_handling_of_variables_in_levels-PR_7226.patch

@@ -0,0 +1,702 @@
+From 7901659fa169db8ac5ffd7c610a798c785a3556b Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Fri, 9 Jul 2021 14:41:03 +0200
+Subject: [PATCH 01/12] ensure that higher policy levels can override variables
+ of lower levels
+
+---
+ ssg/controls.py | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 297d80e46c5..165cdf0511a 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -202,9 +202,16 @@ def get_all_controls_of_level(self, policy_id, level_id):
+ 
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+-        for c in all_policy_controls:
+-            if len(level_ids.intersection(c.levels)) > 0:
+-                eligible_controls.append(c)
++        defined_variables = []
++        # we will go level by level, from top to bottom
++        # this is done to enable overriding of variables by higher levels
++        for lv in level_ids:
++            for c in all_policy_controls:
++                if lv in c.levels:
++                    # if the control has a variable, check if it is not already defined
++                    if c.variables.keys().isdisjoint(defined_variables):
++                        eligible_controls.append(c)
++                        defined_variables += [*c.variables.keys()]
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From 66e612a9668009cc553fcf1abbf2c9477155c0c2 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 5 Aug 2021 14:02:25 +0200
+Subject: [PATCH 02/12] use ordered sets emulated by ordereddict
+
+because of compatibility with python2
+---
+ ssg/controls.py | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 165cdf0511a..611a647e125 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -2,6 +2,7 @@
+ import logging
+ import os
+ from glob import glob
++from collections import OrderedDict
+ 
+ import ssg.build_yaml
+ import ssg.yaml
+@@ -152,16 +153,18 @@ def get_level(self, level_id):
+             raise ValueError(msg)
+ 
+     def get_level_with_ancestors(self, level_id):
+-        levels = set()
++        # use OrderedDict for Python2 compatibility instead of ordered set
++        levels = OrderedDict()
+         level = self.get_level(level_id)
+-        levels.add(level)
++        levels[level] = ""
+         if level.inherits_from:
+             for lv in level.inherits_from:
+-                levels.update(self.get_level_with_ancestors(lv))
++                eligible_levels = [l for l in self.get_level_with_ancestors(lv).keys() if l not in levels.keys()]
++                for l in eligible_levels:
++                    levels[l] = ""
+         return levels
+ 
+ 
+-
+ class ControlsManager():
+     def __init__(self, controls_dir, env_yaml=None):
+         self.controls_dir = os.path.abspath(controls_dir)
+@@ -198,20 +201,24 @@ def _get_policy(self, policy_id):
+     def get_all_controls_of_level(self, policy_id, level_id):
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
+-        level_ids = set([lv.id for lv in levels])
++        # we use OrderedDict here with empty values instead of ordered set
++        # cause we want to be compatible with python 2
++        level_ids = OrderedDict()
++        for lv in levels.keys():
++            level_ids[lv.id] = ""
+ 
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+         defined_variables = []
+         # we will go level by level, from top to bottom
+         # this is done to enable overriding of variables by higher levels
+-        for lv in level_ids:
++        for lv in level_ids.keys():
+             for c in all_policy_controls:
+                 if lv in c.levels:
+                     # if the control has a variable, check if it is not already defined
+                     if c.variables.keys().isdisjoint(defined_variables):
+                         eligible_controls.append(c)
+-                        defined_variables += [*c.variables.keys()]
++                        defined_variables += list(c.variables.keys())
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From 95a23a31293a0a63361ddf1831866cd5ae1ab61e Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 5 Aug 2021 16:30:10 +0200
+Subject: [PATCH 03/12] rework handling of variables when returning all
+ controls of a level
+
+currently only the top most level variables are kept in the controls
+if there is a control with lower level which has the same variable defined, it is deep copied and the variable definition is removed only from the resulting control
+the original control stays in tact
+---
+ ssg/controls.py | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 611a647e125..4ebb8bda3d7 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -1,8 +1,8 @@
+ import collections
+ import logging
+ import os
++import copy
+ from glob import glob
+-from collections import OrderedDict
+ 
+ import ssg.build_yaml
+ import ssg.yaml
+@@ -154,7 +154,7 @@ def get_level(self, level_id):
+ 
+     def get_level_with_ancestors(self, level_id):
+         # use OrderedDict for Python2 compatibility instead of ordered set
+-        levels = OrderedDict()
++        levels = collections.OrderedDict()
+         level = self.get_level(level_id)
+         levels[level] = ""
+         if level.inherits_from:
+@@ -201,24 +201,39 @@ def _get_policy(self, policy_id):
+     def get_all_controls_of_level(self, policy_id, level_id):
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
++        print ("getting levels of " + level_id)
++        print ([ l.id for l in levels.keys()])
+         # we use OrderedDict here with empty values instead of ordered set
+         # cause we want to be compatible with python 2
+-        level_ids = OrderedDict()
++        level_ids = collections.OrderedDict()
+         for lv in levels.keys():
+             level_ids[lv.id] = ""
+-
++        print (level_ids.keys())
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+         defined_variables = []
+         # we will go level by level, from top to bottom
+         # this is done to enable overriding of variables by higher levels
+         for lv in level_ids.keys():
++            print ("going through level " +lv)
+             for c in all_policy_controls:
++                print (c.levels)
+                 if lv in c.levels:
+                     # if the control has a variable, check if it is not already defined
+-                    if c.variables.keys().isdisjoint(defined_variables):
++                    variables = list(c.variables.keys())
++                    if len(variables) == 0:
+                         eligible_controls.append(c)
+-                        defined_variables += list(c.variables.keys())
++                    for var in variables:
++                        if var in defined_variables:
++                            # if it is, create new instance of the control and remove the variable
++                            # we are going from the top level to the bottom
++                            # so we don't want to overwrite variables
++                            new_c = copy.deepcopy(c)
++                            del new_c.variables[var]
++                            eligible_controls.append(new_c)
++                        else:
++                            defined_variables.append(var)
++                            eligible_controls.append(c)
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From a2dd7e9386c757a523b57646bdc5a9ffa99f68c5 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 5 Aug 2021 16:31:25 +0200
+Subject: [PATCH 04/12] add tests for defining of variables
+
+---
+ tests/unit/ssg-module/data/controls_dir/abcd-levels.yml | 6 ++++++
+ tests/unit/ssg-module/test_controls.py                  | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+index aded77c12a6..b98a7cd4e19 100644
+--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
++++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+@@ -19,10 +19,14 @@ controls:
+   - id: S2
+     levels:
+     - low
++    rules:
++      - var_password_pam_minlen=1
+ 
+   - id: S3
+     levels:
+     - medium
++    rules:
++      - var_password_pam_minlen=2
+ 
+   - id: S4
+     title: Configure authentication
+@@ -36,3 +40,5 @@ controls:
+         title: Enforce password quality standards
+         levels:
+         - high
++        rules:
++          - var_password_pam_minlen=3
+diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
+index ff9b04f26c9..06fcb0c375d 100644
+--- a/tests/unit/ssg-module/test_controls.py
++++ b/tests/unit/ssg-module/test_controls.py
+@@ -87,6 +87,11 @@ def test_controls_levels():
+     assert len(low_controls) == 4
+     assert len(medium_controls) == 5
+ 
++    # test overriding of variables in levels
++    assert c_2.variables["var_password_pam_minlen"] == "1"
++    assert c_3.variables["var_password_pam_minlen"] == "2"
++    assert c_4b.variables["var_password_pam_minlen"] == "3"
++
+ 
+ def test_controls_load_product():
+     ssg_root = \
+
+From 82b90a9720dadab7d6060f0ccbcd902b1c097904 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Fri, 6 Aug 2021 09:30:47 +0200
+Subject: [PATCH 05/12] make overriding of variables optional
+
+---
+ ssg/controls.py | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 4ebb8bda3d7..90639fbe4c7 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -198,42 +198,42 @@ def _get_policy(self, policy_id):
+             raise ValueError(msg)
+         return policy
+ 
+-    def get_all_controls_of_level(self, policy_id, level_id):
++    def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
++        # if override_vars is enabled, then variables from higher levels will
++        # override variables efined in controls of lower levels
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
+-        print ("getting levels of " + level_id)
+-        print ([ l.id for l in levels.keys()])
+         # we use OrderedDict here with empty values instead of ordered set
+         # cause we want to be compatible with python 2
+         level_ids = collections.OrderedDict()
+         for lv in levels.keys():
+             level_ids[lv.id] = ""
+-        print (level_ids.keys())
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+         defined_variables = []
+         # we will go level by level, from top to bottom
+         # this is done to enable overriding of variables by higher levels
+         for lv in level_ids.keys():
+-            print ("going through level " +lv)
+             for c in all_policy_controls:
+-                print (c.levels)
+                 if lv in c.levels:
+-                    # if the control has a variable, check if it is not already defined
+-                    variables = list(c.variables.keys())
+-                    if len(variables) == 0:
++                    if override_vars == False:
+                         eligible_controls.append(c)
+-                    for var in variables:
+-                        if var in defined_variables:
+-                            # if it is, create new instance of the control and remove the variable
+-                            # we are going from the top level to the bottom
+-                            # so we don't want to overwrite variables
+-                            new_c = copy.deepcopy(c)
+-                            del new_c.variables[var]
+-                            eligible_controls.append(new_c)
+-                        else:
+-                            defined_variables.append(var)
++                    else:
++                        # if the control has a variable, check if it is not already defined
++                        variables = list(c.variables.keys())
++                        if len(variables) == 0:
+                             eligible_controls.append(c)
++                        for var in variables:
++                            if var in defined_variables:
++                                # if it is, create new instance of the control and remove the variable
++                                # we are going from the top level to the bottom
++                                # so we don't want to overwrite variables
++                                new_c = copy.deepcopy(c)
++                                del new_c.variables[var]
++                                eligible_controls.append(new_c)
++                            else:
++                                defined_variables.append(var)
++                                eligible_controls.append(c)
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From 47df80d086e96deb4eab88d5f813bffb380006a8 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Wed, 11 Aug 2021 12:38:42 +0200
+Subject: [PATCH 06/12] fix a typo
+
+---
+ ssg/controls.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 90639fbe4c7..10a304bf8c2 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -200,7 +200,7 @@ def _get_policy(self, policy_id):
+ 
+     def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
+         # if override_vars is enabled, then variables from higher levels will
+-        # override variables efined in controls of lower levels
++        # override variables defined in controls of lower levels
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
+         # we use OrderedDict here with empty values instead of ordered set
+
+From 8e59037ed07aad33a55e8297ee5bce0f51c0dee6 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Wed, 11 Aug 2021 17:02:11 +0200
+Subject: [PATCH 07/12] update tests to check that overriding of variables
+ works
+
+---
+ .../ssg-module/data/controls_dir/abcd-levels.yml |  4 +---
+ tests/unit/ssg-module/test_controls.py           | 16 ++++++++++++++--
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+index b98a7cd4e19..99efafd832e 100644
+--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
++++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+@@ -25,8 +25,6 @@ controls:
+   - id: S3
+     levels:
+     - medium
+-    rules:
+-      - var_password_pam_minlen=2
+ 
+   - id: S4
+     title: Configure authentication
+@@ -41,4 +39,4 @@ controls:
+         levels:
+         - high
+         rules:
+-          - var_password_pam_minlen=3
++          - var_password_pam_minlen=2
+diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
+index 06fcb0c375d..124b344d141 100644
+--- a/tests/unit/ssg-module/test_controls.py
++++ b/tests/unit/ssg-module/test_controls.py
+@@ -89,8 +89,20 @@ def test_controls_levels():
+ 
+     # test overriding of variables in levels
+     assert c_2.variables["var_password_pam_minlen"] == "1"
+-    assert c_3.variables["var_password_pam_minlen"] == "2"
+-    assert c_4b.variables["var_password_pam_minlen"] == "3"
++    assert "var_password_pam_minlen" not in c_3.variables.keys()
++    assert c_4b.variables["var_password_pam_minlen"] == "2"
++
++    for c in low_controls:
++        if "var_password_pam_minlen" in c.variables.keys():
++            assert c.variables["var_password_pam_minlen"] == "1"
++
++    for c in medium_controls:
++        if "var_password_pam_minlen" in c.variables.keys():
++            assert c.variables["var_password_pam_minlen"] == "1"
++
++    for c in high_controls:
++        if "var_password_pam_minlen" in c.variables.keys():
++            assert c.variables["var_password_pam_minlen"] == "2"
+ 
+ 
+ def test_controls_load_product():
+
+From dae4fc52a627eac6595bb73e3ffb1a0c50e78fdd Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Wed, 11 Aug 2021 17:02:32 +0200
+Subject: [PATCH 08/12] make overriding of variables hardcoded when requesting
+ controls of a certain level
+
+---
+ ssg/controls.py | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 10a304bf8c2..7923f0cb379 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -198,9 +198,7 @@ def _get_policy(self, policy_id):
+             raise ValueError(msg)
+         return policy
+ 
+-    def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
+-        # if override_vars is enabled, then variables from higher levels will
+-        # override variables defined in controls of lower levels
++    def get_all_controls_of_level(self, policy_id, level_id):
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
+         # we use OrderedDict here with empty values instead of ordered set
+@@ -216,24 +214,22 @@ def get_all_controls_of_level(self, policy_id, level_id, override_vars=True):
+         for lv in level_ids.keys():
+             for c in all_policy_controls:
+                 if lv in c.levels:
+-                    if override_vars == False:
++                    # if the control has a variable, check if it is not already defined
++                    variables = list(c.variables.keys())
++                    if len(variables) == 0:
+                         eligible_controls.append(c)
+-                    else:
+-                        # if the control has a variable, check if it is not already defined
+-                        variables = list(c.variables.keys())
+-                        if len(variables) == 0:
++                        continue
++                    for var in variables:
++                        if var in defined_variables:
++                            # if it is, create new instance of the control and remove the variable
++                            # we are going from the top level to the bottom
++                            # so we don't want to overwrite variables
++                            new_c = copy.deepcopy(c)
++                            del new_c.variables[var]
++                            eligible_controls.append(new_c)
++                        else:
++                            defined_variables.append(var)
+                             eligible_controls.append(c)
+-                        for var in variables:
+-                            if var in defined_variables:
+-                                # if it is, create new instance of the control and remove the variable
+-                                # we are going from the top level to the bottom
+-                                # so we don't want to overwrite variables
+-                                new_c = copy.deepcopy(c)
+-                                del new_c.variables[var]
+-                                eligible_controls.append(new_c)
+-                            else:
+-                                defined_variables.append(var)
+-                                eligible_controls.append(c)
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From c051e11c70b7e23ce3d4a8e0670da4fae72833c6 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 15:30:39 +0200
+Subject: [PATCH 09/12] get rid of one ordereddict
+
+---
+ ssg/controls.py | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 7923f0cb379..891b13c891c 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -201,19 +201,14 @@ def _get_policy(self, policy_id):
+     def get_all_controls_of_level(self, policy_id, level_id):
+         policy = self._get_policy(policy_id)
+         levels = policy.get_level_with_ancestors(level_id)
+-        # we use OrderedDict here with empty values instead of ordered set
+-        # cause we want to be compatible with python 2
+-        level_ids = collections.OrderedDict()
+-        for lv in levels.keys():
+-            level_ids[lv.id] = ""
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+         defined_variables = []
+         # we will go level by level, from top to bottom
+         # this is done to enable overriding of variables by higher levels
+-        for lv in level_ids.keys():
++        for lv in levels.keys():
+             for c in all_policy_controls:
+-                if lv in c.levels:
++                if lv.id in c.levels:
+                     # if the control has a variable, check if it is not already defined
+                     variables = list(c.variables.keys())
+                     if len(variables) == 0:
+
+From 4dd5cb1326932cf020785a8c2472998eb2e7775e Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 16:44:57 +0200
+Subject: [PATCH 10/12] fix overriding of variables
+
+when there were multiple variables overridden, it caused problems by creating multiple copies of controls
+---
+ ssg/controls.py | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 891b13c891c..8b69676313c 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -214,17 +214,19 @@ def get_all_controls_of_level(self, policy_id, level_id):
+                     if len(variables) == 0:
+                         eligible_controls.append(c)
+                         continue
++                    variables_to_remove = [] # contains list of variables which are already defined and should be removed from the control
+                     for var in variables:
+                         if var in defined_variables:
+-                            # if it is, create new instance of the control and remove the variable
+-                            # we are going from the top level to the bottom
+-                            # so we don't want to overwrite variables
+-                            new_c = copy.deepcopy(c)
+-                            del new_c.variables[var]
+-                            eligible_controls.append(new_c)
++                            variables_to_remove.append(var)
+                         else:
+                             defined_variables.append(var)
+-                            eligible_controls.append(c)
++                    if len(variables_to_remove) == 0:
++                        eligible_controls.append(c)
++                    else:
++                        new_c = copy.deepcopy(c)
++                        for var in variables_to_remove:
++                            del new_c.variables[var]
++                        eligible_controls.append(new_c)
+         return eligible_controls
+ 
+     def get_all_controls(self, policy_id):
+
+From fbebba524cab090bc4c2f92b75257a7cc881ef5e Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 16:45:38 +0200
+Subject: [PATCH 11/12] extended tests to test for multiple overridden
+ variables
+
+---
+ .../data/controls_dir/abcd-levels.yml         |  2 ++
+ tests/unit/ssg-module/test_controls.py        | 19 +++++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+index 99efafd832e..2e60ec43532 100644
+--- a/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
++++ b/tests/unit/ssg-module/data/controls_dir/abcd-levels.yml
+@@ -21,6 +21,7 @@ controls:
+     - low
+     rules:
+       - var_password_pam_minlen=1
++      - var_some_variable=1
+ 
+   - id: S3
+     levels:
+@@ -40,3 +41,4 @@ controls:
+         - high
+         rules:
+           - var_password_pam_minlen=2
++          - var_some_variable=3
+diff --git a/tests/unit/ssg-module/test_controls.py b/tests/unit/ssg-module/test_controls.py
+index 124b344d141..1465661b04a 100644
+--- a/tests/unit/ssg-module/test_controls.py
++++ b/tests/unit/ssg-module/test_controls.py
+@@ -104,6 +104,25 @@ def test_controls_levels():
+         if "var_password_pam_minlen" in c.variables.keys():
+             assert c.variables["var_password_pam_minlen"] == "2"
+ 
++    # now test if controls of lower level has the variable definition correctly removed
++    # because it is overriden by higher level controls
++    s2_high = [c for c in high_controls if c.id == "S2"]
++    assert len(s2_high) == 1
++    assert "var_some_variable" not in s2_high[0].variables.keys()
++    assert "var_password_pam_minlen" not in s2_high[0].variables.keys()
++    s4b_high = [c for c in high_controls if c.id == "S4.b"]
++    assert len(s4b_high) == 1
++    assert s4b_high[0].variables["var_some_variable"] == "3"
++    assert s4b_high[0].variables["var_password_pam_minlen"] == "2"
++
++    # check that in low level the variable is correctly placed there in S2
++    s2_low = [c for c in low_controls if c.id == "S2"]
++    assert len(s2_low) == 1
++    assert s2_low[0].variables["var_some_variable"] == "1"
++    assert s2_low[0].variables["var_password_pam_minlen"] == "1"
++
++
++
+ 
+ def test_controls_load_product():
+     ssg_root = \
+
+From 369de6b8374084d9d607979b712285912dbb65aa Mon Sep 17 00:00:00 2001
+From: Matej Tyc <matyc@redhat.com>
+Date: Mon, 16 Aug 2021 10:39:22 +0200
+Subject: [PATCH 12/12] Style improvements
+
+- Renamed get_level_with_ancestors to get_level_with_ancestors_sequence,
+  and made it return a list - a dictionary result is quite confusing.
+- Removed some optimization in the variable deletion loops.
+- Extracted functionality to a _get_control_without_variables static
+  method.
+- Defined variable removal steps using set operations.
+---
+ ssg/controls.py | 54 +++++++++++++++++++++++++------------------------
+ 1 file changed, 28 insertions(+), 26 deletions(-)
+
+diff --git a/ssg/controls.py b/ssg/controls.py
+index 8b69676313c..ca3187d5b16 100644
+--- a/ssg/controls.py
++++ b/ssg/controls.py
+@@ -152,17 +152,17 @@ def get_level(self, level_id):
+             )
+             raise ValueError(msg)
+ 
+-    def get_level_with_ancestors(self, level_id):
++    def get_level_with_ancestors_sequence(self, level_id):
+         # use OrderedDict for Python2 compatibility instead of ordered set
+         levels = collections.OrderedDict()
+         level = self.get_level(level_id)
+         levels[level] = ""
+         if level.inherits_from:
+             for lv in level.inherits_from:
+-                eligible_levels = [l for l in self.get_level_with_ancestors(lv).keys() if l not in levels.keys()]
++                eligible_levels = [l for l in self.get_level_with_ancestors_sequence(lv) if l not in levels.keys()]
+                 for l in eligible_levels:
+                     levels[l] = ""
+-        return levels
++        return list(levels.keys())
+ 
+ 
+ class ControlsManager():
+@@ -200,35 +200,37 @@ def _get_policy(self, policy_id):
+ 
+     def get_all_controls_of_level(self, policy_id, level_id):
+         policy = self._get_policy(policy_id)
+-        levels = policy.get_level_with_ancestors(level_id)
++        levels = policy.get_level_with_ancestors_sequence(level_id)
+         all_policy_controls = self.get_all_controls(policy_id)
+         eligible_controls = []
+-        defined_variables = []
++        already_defined_variables = set()
+         # we will go level by level, from top to bottom
+         # this is done to enable overriding of variables by higher levels
+-        for lv in levels.keys():
+-            for c in all_policy_controls:
+-                if lv.id in c.levels:
+-                    # if the control has a variable, check if it is not already defined
+-                    variables = list(c.variables.keys())
+-                    if len(variables) == 0:
+-                        eligible_controls.append(c)
+-                        continue
+-                    variables_to_remove = [] # contains list of variables which are already defined and should be removed from the control
+-                    for var in variables:
+-                        if var in defined_variables:
+-                            variables_to_remove.append(var)
+-                        else:
+-                            defined_variables.append(var)
+-                    if len(variables_to_remove) == 0:
+-                        eligible_controls.append(c)
+-                    else:
+-                        new_c = copy.deepcopy(c)
+-                        for var in variables_to_remove:
+-                            del new_c.variables[var]
+-                        eligible_controls.append(new_c)
++        for lv in levels:
++            for control in all_policy_controls:
++                if lv.id not in control.levels:
++                    continue
++
++                variables = set(control.variables.keys())
++
++                variables_to_remove = variables.intersection(already_defined_variables)
++                already_defined_variables.update(variables)
++
++                new_c = self._get_control_without_variables(variables_to_remove, control)
++                eligible_controls.append(new_c)
++
+         return eligible_controls
+ 
++    @staticmethod
++    def _get_control_without_variables(variables_to_remove, control):
++        if not variables_to_remove:
++            return control
++
++        new_c = copy.deepcopy(control)
++        for var in variables_to_remove:
++            del new_c.variables[var]
++        return new_c
++
+     def get_all_controls(self, policy_id):
+         policy = self._get_policy(policy_id)
+         return policy.controls_by_id.values()

SOURCES/scap-security-guide-0.1.58-fix_missing_srgs-PR_7362.patch

@@ -0,0 +1,43 @@
+From 90cbb9fc2662cd2b7652d1f012ece74e8cf41c5d Mon Sep 17 00:00:00 2001
+From: Milan Lysonek <mlysonek@redhat.com>
+Date: Mon, 9 Aug 2021 15:22:59 +0200
+Subject: [PATCH 1/2] Add SRG for sssd_enable_certmap
+
+---
+ linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+index 0614a2f4a0..67c02f4fb7 100644
+--- a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
++++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
+@@ -28,6 +28,7 @@ identifiers:
+ references:
+    disa: CCI-000187
+    nist: IA-5 (2) (c)
++   srg: SRG-OS-000068-GPOS-00036
+    stigid@rhel8: RHEL-08-020090
+ 
+ warnings:
+
+From b15299568849111d142c27f99dff7052afd96c07 Mon Sep 17 00:00:00 2001
+From: Milan Lysonek <mlysonek@redhat.com>
+Date: Mon, 9 Aug 2021 15:23:16 +0200
+Subject: [PATCH 2/2] Add SRG for accounts_password_pam_dictcheck
+
+---
+ .../accounts_password_pam_dictcheck/rule.yml                     | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+index 2990150c0a..5956718a70 100644
+--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+@@ -27,6 +27,7 @@ identifiers:
+ references:
+     disa: CCI-000366
+     nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
++    srg: SRG-OS-000480-GPOS-00225
+     stigid@rhel8: RHEL-08-020300
+ 
+ ocil_clause: 'dictcheck is not found or not equal to the required value'

SOURCES/scap-security-guide-0.1.58-fix_rhel7_doc_link-PR_7443.patch

@@ -0,0 +1,22 @@
+From 3866ba4f0ce678b68de0ff5f1dc7edbea6a904bb Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Mon, 23 Aug 2021 12:10:01 +0200
+Subject: [PATCH] Fix RHEL7 documentation link.
+
+---
+ .../screen_locking/smart_card_login/smartcard_auth/rule.yml     | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+index 62a343cf39..8153b31177 100644
+--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+@@ -8,7 +8,7 @@ description: |-
+     To enable smart card authentication, consult the documentation at:
+     <ul>
+     {{% if product == "rhel7" %}}
+-    <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards.html#authconfig-smartcards") }}}</b></li>
++    <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards#authconfig-smartcards") }}}</b></li>
+     {{% elif product == "ol7" %}}
+     <li><b>{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s4-auth") }}}</b></li>
+     {{% endif %}}

SOURCES/scap-security-guide-0.1.58-fix_rhel7_links-PR_7409.patch

@@ -0,0 +1,160 @@
+From ac416fb6b73135b6fdeae850740ca4e10ad9fa1e Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Wed, 18 Aug 2021 15:16:59 +0200
+Subject: [PATCH] Fix RHEL7 documentation links.
+
+---
+ linux_os/guide/services/ldap/openldap_client/group.yml        | 2 +-
+ linux_os/guide/services/ldap/openldap_server/group.yml        | 2 +-
+ .../ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml     | 2 +-
+ .../ntp/chronyd_or_ntpd_specify_remote_server/rule.yml        | 2 +-
+ linux_os/guide/services/ntp/group.yml                         | 2 +-
+ .../services/ntp/service_chronyd_or_ntpd_enabled/rule.yml     | 2 +-
+ linux_os/guide/services/sssd/group.yml                        | 2 +-
+ .../screen_locking/smart_card_login/smartcard_auth/rule.yml   | 4 +---
+ linux_os/guide/system/auditing/group.yml                      | 2 +-
+ .../software/disk_partitioning/encrypt_partitions/rule.yml    | 2 +-
+ .../guide/system/software/gnome/gnome_login_screen/group.yml  | 2 +-
+ 11 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/linux_os/guide/services/ldap/openldap_client/group.yml b/linux_os/guide/services/ldap/openldap_client/group.yml
+index bf17a053cd5..a64f105395f 100644
+--- a/linux_os/guide/services/ldap/openldap_client/group.yml
++++ b/linux_os/guide/services/ldap/openldap_client/group.yml
+@@ -13,7 +13,7 @@ description: |-
+     files, which is useful when trying to use SSL cleanly across several protocols.
+     Installation and configuration of OpenLDAP on {{{ full_name }}} is available at
+     {{% if product == "rhel7" %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}.
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/openldap") }}}.
+     {{% elif product == "ol7" %}}
+         {{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s9-auth") }}}.
+     {{% endif %}}
+diff --git a/linux_os/guide/services/ldap/openldap_server/group.yml b/linux_os/guide/services/ldap/openldap_server/group.yml
+index c180820e9fc..d571867a7f8 100644
+--- a/linux_os/guide/services/ldap/openldap_server/group.yml
++++ b/linux_os/guide/services/ldap/openldap_server/group.yml
+@@ -7,5 +7,5 @@ description: |-
+     for an OpenLDAP server.
+     {{% if product == "rhel7" %}}
+     Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 7 is available at:
+-    {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}.
++    {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/openldap") }}}.
+     {{% endif %}}
+diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
+index 8f939356ab1..7dc188589ee 100644
+--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
++++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
+@@ -14,7 +14,7 @@ description: |-
+     {{% elif product == "ol8" %}}
+         {{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
+     {{% else %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
+     {{% endif %}}
+     for more detailed comparison of the features of both of the choices, and for
+     further guidance how to choose between the two NTP daemons.
+diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
+index 503aecc0de2..27df8595efa 100644
+--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
++++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml
+@@ -14,7 +14,7 @@ description: |-
+      {{% elif product == "ol8" %}}
+          {{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
+     {{% else %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
+     {{% endif %}}
+     for more detailed comparison of the features of both of the choices, and for
+     further guidance how to choose between the two NTP daemons.
+diff --git a/linux_os/guide/services/ntp/group.yml b/linux_os/guide/services/ntp/group.yml
+index 181b10dfd65..b944ee03116 100644
+--- a/linux_os/guide/services/ntp/group.yml
++++ b/linux_os/guide/services/ntp/group.yml
+@@ -54,7 +54,7 @@ description: |-
+     {{% elif product == "ol8" %}}
+         {{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
+     {{% elif product == "rhel7" %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
+     {{% elif "ubuntu" in product  %}}
+         {{{ weblink(link="https://help.ubuntu.com/lts/serverguide/NTP.html") }}}
+     {{% elif "debian" in product %}}
+diff --git a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
+index 065cf301b95..00739816f5e 100644
+--- a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
++++ b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml
+@@ -17,7 +17,7 @@ description: |-
+     {{% elif product == "ol8" %}}
+         {{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/ol-nettime.html") }}}
+     {{% else %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}}
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite") }}}
+     {{% endif %}}
+     for guidance which NTP daemon to choose depending on the environment used.
+ 
+diff --git a/linux_os/guide/services/sssd/group.yml b/linux_os/guide/services/sssd/group.yml
+index 5b0caf7d64b..3f4eced7ca7 100644
+--- a/linux_os/guide/services/sssd/group.yml
++++ b/linux_os/guide/services/sssd/group.yml
+@@ -11,7 +11,7 @@ description: |-
+     <br /><br />
+     For more information, see
+     {{%- if product == "rhel7" -%}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/SSSD.html") }}}
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/sssd") }}}
+     {{%- elif product == "rhel8" -%}}
+         {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/installing-an-ipa-client-basic-scenario_installing-identity-management#sssd-deployment-operations_install-client-basic") }}}
+     {{%- elif product == "ol7" -%}}
+diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+index fc7f149bf40..62a343cf396 100644
+--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
+@@ -8,9 +8,7 @@ description: |-
+     To enable smart card authentication, consult the documentation at:
+     <ul>
+     {{% if product == "rhel7" %}}
+-    <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li>
+-    {{% elif product == "rhel8" %}}
+-    <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li>
++    <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/smartcards.html#authconfig-smartcards") }}}</b></li>
+     {{% elif product == "ol7" %}}
+     <li><b>{{{ weblink(link="https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s4-auth") }}}</b></li>
+     {{% endif %}}
+diff --git a/linux_os/guide/system/auditing/group.yml b/linux_os/guide/system/auditing/group.yml
+index 82f87e81c47..5fce88db032 100644
+--- a/linux_os/guide/system/auditing/group.yml
++++ b/linux_os/guide/system/auditing/group.yml
+@@ -38,7 +38,7 @@ description: |-
+     Examining some example audit records demonstrates how the Linux audit system
+     satisfies common requirements.
+     The following example from Fedora Documentation available at
+-    <tt>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages") }}}</tt>
++    <tt>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages") }}}</tt>
+     shows the substantial amount of information captured in a
+     two typical "raw" audit messages, followed by a breakdown of the most important
+     fields. In this example the message is SELinux-related and reports an AVC
+diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
+index add0a41fa94..cd07fb4c0ca 100644
+--- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
++++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
+@@ -38,7 +38,7 @@ description: |-
+     {{% elif product in ["sle12", "sle15"] %}}
+         {{{ weblink(link="https://www.suse.com/documentation/sled-12/book_security/data/sec_security_cryptofs_y2.html") }}}
+     {{% elif product == "rhel7" %}}
+-        {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html") }}}.
++        {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-encryption") }}}.
+     {{% else %}}
+         {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening") }}}.
+     {{% endif %}}
+diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
+index 8e8b32f1d79..299b96c0592 100644
+--- a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
++++ b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml
+@@ -14,5 +14,5 @@ description: |-
+     the man page <tt>dconf(1)</tt>.
+     {{% else %}}
+     For more information about enforcing preferences in the GNOME3 environment using the DConf
+-    configuration system, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Desktop_Migration_and_Administration_Guide/index.html") }}}/></b> and the man page <tt>dconf(1)</tt>.
++    configuration system, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide") }}}/></b> and the man page <tt>dconf(1)</tt>.
+     {{% endif %}}

SOURCES/scap-security-guide-0.1.58-fix_stig_overlay_python2-PR_7317.patch

@@ -0,0 +1,27 @@
+From a032960b4fb8e50386fa02739b6b107b233b64ca Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Mon, 2 Aug 2021 18:39:58 +0200
+Subject: [PATCH] Fix a python2 issue with STIG overlay generation.
+
+---
+ utils/create-stig-overlay.py | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/utils/create-stig-overlay.py b/utils/create-stig-overlay.py
+index 02deb0b5b2..5d4bb835ca 100755
+--- a/utils/create-stig-overlay.py
++++ b/utils/create-stig-overlay.py
+@@ -107,7 +107,12 @@ def new_stig_overlay(xccdftree, ssgtree, outfile, quiet):
+     lines = new_stig_overlay.findall("overlay")
+     new_stig_overlay[:] = sorted(lines, key=getkey)
+ 
+-    dom = xml.dom.minidom.parseString(ET.tostring(new_stig_overlay, encoding="UTF-8", xml_declaration=True))
++    try:
++        et_str = ET.tostring(new_stig_overlay, encoding="UTF-8", xml_declaration=True)
++    except TypeError:
++        et_str = ET.tostring(new_stig_overlay, encoding="UTF-8")
++
++    dom = xml.dom.minidom.parseString(et_str)
+     pretty_xml_as_string = dom.toprettyxml(indent='  ', encoding="UTF-8")
+ 
+     overlay_directory = os.path.dirname(outfile)

SOURCES/scap-security-guide-0.1.58-ism_ks-PR_7392.patch

@@ -0,0 +1,256 @@
+From 86e1556555fde19d3b6bfa7e280c8d9faf6243d3 Mon Sep 17 00:00:00 2001
+From: Matej Tyc <matyc@redhat.com>
+Date: Mon, 16 Aug 2021 13:08:10 +0200
+Subject: [PATCH] Add ISM Official kickstarts
+
+---
+ .../rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg    | 116 ++++++++++++++++++
+ .../rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg    | 116 ++++++++++++++++++
+ 2 files changed, 232 insertions(+)
+ create mode 100644 products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
+ create mode 100644 products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
+
+diff --git a/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
+new file mode 100644
+index 0000000000..d84d98b12d
+--- /dev/null
++++ b/products/rhel8/kickstart/ssg-rhel8-ism_o-ks.cfg
+@@ -0,0 +1,116 @@
++# SCAP Security Guide ISM Official profile kickstart for Red Hat Enterprise Linux 8 Server
++# Version: 0.0.1
++# Date: 2021-08-16
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# sssd profile sets sha512 to hash passwords
++# passwords are shadowed by default
++# See the manual page for authselect-profile for a complete list of possible options.
++authselect select sssd
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet"
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++# 
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++autopart
++
++# Harden installation with Essential Eight profile
++# For more details and configuration options see
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_ism_o
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+diff --git a/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg b/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
+new file mode 100644
+index 0000000000..517919539a
+--- /dev/null
++++ b/products/rhel9/kickstart/ssg-rhel9-ism_o-ks.cfg
+@@ -0,0 +1,116 @@
++# SCAP Security Guide ISM Official profile kickstart for Red Hat Enterprise Linux 9 Server
++# Version: 0.0.1
++# Date: 2021-08-16
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# sssd profile sets sha512 to hash passwords
++# passwords are shadowed by default
++# See the manual page for authselect-profile for a complete list of possible options.
++authselect select sssd
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet"
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++# 
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++autopart
++
++# Harden installation with Essential Eight profile
++# For more details and configuration options see
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
++%addon com_redhat_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_ism_o
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject

SOURCES/scap-security-guide-0.1.58-ism_usb_hid-PR_7493.patch

@@ -0,0 +1,36 @@
+From 7189a9f4aa319b823e241ca11a798762bd62515f Mon Sep 17 00:00:00 2001
+From: Matej Tyc <matyc@redhat.com>
+Date: Tue, 31 Aug 2021 13:58:00 +0200
+Subject: [PATCH] Allow HID USB in the ISM profile
+
+The usbguard is too strict without this rule,
+and its default setting blocks keyboard and mouse.
+---
+ products/rhel8/profiles/ism_o.profile | 1 +
+ products/rhel9/profiles/ism_o.profile | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/products/rhel8/profiles/ism_o.profile b/products/rhel8/profiles/ism_o.profile
+index 95cdfc4ede..2e78dc8776 100644
+--- a/products/rhel8/profiles/ism_o.profile
++++ b/products/rhel8/profiles/ism_o.profile
+@@ -52,6 +52,7 @@ selections:
+   ## Identifiers 1418
+   - package_usbguard_installed
+   - service_usbguard_enabled
++  - usbguard_allow_hid_and_hub
+ 
+   ## Authentication hardening
+   ## Identifiers 1546 / 0974 / 1173 / 1504 / 1505 / 1401 / 1559 / 1560
+diff --git a/products/rhel9/profiles/ism_o.profile b/products/rhel9/profiles/ism_o.profile
+index 6fc919da12..b395b0e9cb 100644
+--- a/products/rhel9/profiles/ism_o.profile
++++ b/products/rhel9/profiles/ism_o.profile
+@@ -52,6 +52,7 @@ selections:
+   ## Identifiers 1418
+   - package_usbguard_installed
+   - service_usbguard_enabled
++  - usbguard_allow_hid_and_hub
+ 
+   ## Authentication hardening
+   ## Identifiers 1546 / 0974 / 1173 / 1504 / 1505 / 1401 / 1559 / 1560

SOURCES/scap-security-guide-0.1.58-mark_rule_as_machine_only-PR_7442.patch

@@ -0,0 +1,33 @@
+From 0d04f65d53b83690769f7baee48ec64e785b0e00 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Mon, 23 Aug 2021 11:33:28 +0200
+Subject: [PATCH] Mark agent_mfetpd_running as machine only.
+
+---
+ .../mcafee_endpoint_security_software/group.yml                 | 2 ++
+ .../package_mcafeetp_installed/rule.yml                         | 2 --
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+index f2e4e89851..b915311533 100644
+--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml
+@@ -5,3 +5,5 @@ title: 'McAfee Endpoint Security for Linux (ENSL)'
+ description: |-
+     McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
+     used to monitor, detect, and defend computer networks and systems.
++
++platform: machine
+diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+index 16587792ef..4c7dc8d7a2 100644
+--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml
+@@ -37,8 +37,6 @@ warnings:
+         Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
+         automated remediation is not available for this configuration check.
+ 
+-platform: machine
+-
+ template:
+     name: package_installed
+     vars:

SOURCES/scap-security-guide-0.1.58-remove_RHEL_08_040162-PR_7369.patch

@@ -0,0 +1,63 @@
+From 8fa9ca61649a36dd1f3d5e5c72c0162a4dbfe694 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Tue, 10 Aug 2021 09:45:56 +0200
+Subject: [PATCH] Remove RHEL-08-040162 from STIG profile.
+
+This item has been removed in version RHEL8 DISA STIG V1R3.
+---
+ .../services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml    | 1 -
+ products/rhel8/profiles/stig.profile                           | 3 ---
+ tests/data/profile_stability/rhel8/stig.profile                | 1 -
+ tests/data/profile_stability/rhel8/stig_gui.profile            | 1 -
+ 4 files changed, 6 deletions(-)
+
+diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
+index 1852313216a..f43f92c2f15 100644
+--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
++++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml
+@@ -32,7 +32,6 @@ references:
+     disa: CCI-000068
+     ospp: FCS_SSHS_EXT.1
+     srg: SRG-OS-000423-GPOS-00187,SRG-OS-000033-GPOS-00014
+-    stigid@rhel8: RHEL-08-040162
+ 
+ ocil_clause: 'it is commented out or is not set'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index a358f61dba5..9d4d1965141 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1071,9 +1071,6 @@ selections:
+     # RHEL-08-040161
+     - sshd_rekey_limit
+ 
+-    # RHEL-08-040162
+-    - ssh_client_rekey_limit
+-
+     # RHEL-08-040170
+     - disable_ctrlaltdel_reboot
+ 
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 7d54a7505fb..fca5842cf22 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -323,7 +323,6 @@ selections:
+ - service_usbguard_enabled
+ - set_password_hashing_algorithm_logindefs
+ - set_password_hashing_algorithm_systemauth
+-- ssh_client_rekey_limit
+ - sshd_disable_compression
+ - sshd_disable_empty_passwords
+ - sshd_disable_gssapi_auth
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 97291230e7c..35fa9ddea2b 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -334,7 +334,6 @@ selections:
+ - service_usbguard_enabled
+ - set_password_hashing_algorithm_logindefs
+ - set_password_hashing_algorithm_systemauth
+-- ssh_client_rekey_limit
+ - sshd_disable_compression
+ - sshd_disable_empty_passwords
+ - sshd_disable_gssapi_auth

SOURCES/scap-security-guide-0.1.58-rhel7_cis_kickstarts-PR_7382.patch

@@ -0,0 +1,490 @@
+From ee2da171d5a76202b2aef8231c5af6f97ef156ef Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 10:36:30 +0200
+Subject: [PATCH 1/2] add rhel7 kickstarts for cis
+
+---
+ products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg |   4 +-
+ .../kickstart/ssg-rhel7-cis_server_l1-ks.cfg  | 136 ++++++++++++++++
+ .../ssg-rhel7-cis_workstation_l1-ks.cfg       | 137 ++++++++++++++++
+ .../ssg-rhel7-cis_workstation_l2-ks.cfg       | 147 ++++++++++++++++++
+ 4 files changed, 422 insertions(+), 2 deletions(-)
+ create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
+ create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
+ create mode 100644 products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
+
+diff --git a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+index 6ead435b978..00edb9d536c 100644
+--- a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
++++ b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+@@ -1,6 +1,6 @@
+-# SCAP Security Guide CIS profile kickstart for Red Hat Enterprise Linux 7 Server
++# SCAP Security Guide CIS profile (Leve 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
+ # Version: 0.0.1
+-# Date: 2020-03-30
++# Date: 2021-08-12
+ #
+ # Based on:
+ # https://pykickstart.readthedocs.io/en/latest/
+diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
+new file mode 100644
+index 00000000000..333105c4f9e
+--- /dev/null
++++ b/products/rhel7/kickstart/ssg-rhel7-cis_server_l1-ks.cfg
+@@ -0,0 +1,136 @@
++# SCAP Security Guide CIS profile (Level 1 - Server) kickstart for Red Hat Enterprise Linux 7 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
++
++# Install a fresh new system (optional)
++install
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# --enableshadow	enable shadowed passwords by default
++# --passalgo		hash / crypt algorithm for new passwords
++# See the manual page for authconfig for a complete list of possible options.
++authconfig --enableshadow --passalgo=sha512
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see command %addon org_fedora_oscap in
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_server_l1
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
+new file mode 100644
+index 00000000000..7ca9fe8558b
+--- /dev/null
++++ b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l1-ks.cfg
+@@ -0,0 +1,137 @@
++# SCAP Security Guide CIS profile (Level 1 - Workstation) kickstart for Red Hat Enterprise Linux 7 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
++
++# Install a fresh new system (optional)
++install
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# --enableshadow	enable shadowed passwords by default
++# --passalgo		hash / crypt algorithm for new passwords
++# See the manual page for authconfig for a complete list of possible options.
++authconfig --enableshadow --passalgo=sha512
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see command %addon org_fedora_oscap in
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_workstation_l1
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+diff --git a/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
+new file mode 100644
+index 00000000000..b9bff5f390e
+--- /dev/null
++++ b/products/rhel7/kickstart/ssg-rhel7-cis_workstation_l2-ks.cfg
+@@ -0,0 +1,147 @@
++# SCAP Security Guide CIS profile (Level 2 - Workstation) kickstart for Red Hat Enterprise Linux 7 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
++
++# Install a fresh new system (optional)
++install
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# --enableshadow	enable shadowed passwords by default
++# --passalgo		hash / crypt algorithm for new passwords
++# See the manual page for authconfig for a complete list of possible options.
++authconfig --enableshadow --passalgo=sha512
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow
++# Ensure /home Located On Separate Partition
++logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++# Ensure /var/tmp Located On Separate Partition
++logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
++# Ensure /var Located On Separate Partition
++logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048
++# Ensure /var/log Located On Separate Partition
++logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024
++# Ensure /var/log/audit Located On Separate Partition
++logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see command %addon org_fedora_oscap in
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_workstation_l2
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+
+From 92e84a2c1b302291aa8ffbc08ae3e4ffabd5dfe7 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Wed, 18 Aug 2021 14:24:34 +0200
+Subject: [PATCH 2/2] Fix typo in the CIS kickstart
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Co-authored-by: Jan Černý <jcerny@redhat.com>
+---
+ products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+index 00edb9d536c..7062e2974ad 100644
+--- a/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
++++ b/products/rhel7/kickstart/ssg-rhel7-cis-ks.cfg
+@@ -1,4 +1,4 @@
+-# SCAP Security Guide CIS profile (Leve 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
++# SCAP Security Guide CIS profile (Level 2 - Server) kickstart for Red Hat Enterprise Linux 7 Server
+ # Version: 0.0.1
+ # Date: 2021-08-12
+ #

SOURCES/scap-security-guide-0.1.58-rhel8_cis_identifier_update_1-PR_7356.patch

@@ -0,0 +1,302 @@
+From 5f8264ed7c5580fdd013810a713ab9b3b296bf4a Mon Sep 17 00:00:00 2001
+From: Alex Haydock <alex@alexhaydock.co.uk>
+Date: Mon, 9 Aug 2021 11:46:22 +0100
+Subject: [PATCH] Update RHEL 8 CIS references to match benchmark 1.0.1
+
+---
+ .../file_groupowner_backup_etc_group/rule.yml                   | 2 +-
+ .../file_groupowner_backup_etc_gshadow/rule.yml                 | 2 +-
+ .../file_groupowner_backup_etc_passwd/rule.yml                  | 2 +-
+ .../file_groupowner_backup_etc_shadow/rule.yml                  | 2 +-
+ .../file_groupowner_etc_group/rule.yml                          | 2 +-
+ .../file_groupowner_etc_gshadow/rule.yml                        | 2 +-
+ .../file_groupowner_etc_shadow/rule.yml                         | 2 +-
+ .../file_owner_backup_etc_group/rule.yml                        | 2 +-
+ .../file_owner_backup_etc_gshadow/rule.yml                      | 2 +-
+ .../file_owner_backup_etc_passwd/rule.yml                       | 2 +-
+ .../file_owner_backup_etc_shadow/rule.yml                       | 2 +-
+ .../file_owner_etc_group/rule.yml                               | 2 +-
+ .../file_owner_etc_gshadow/rule.yml                             | 2 +-
+ .../file_owner_etc_shadow/rule.yml                              | 2 +-
+ .../file_permissions_backup_etc_group/rule.yml                  | 2 +-
+ .../file_permissions_backup_etc_gshadow/rule.yml                | 2 +-
+ .../file_permissions_backup_etc_passwd/rule.yml                 | 2 +-
+ .../file_permissions_backup_etc_shadow/rule.yml                 | 2 +-
+ .../file_permissions_etc_group/rule.yml                         | 2 +-
+ .../file_permissions_etc_gshadow/rule.yml                       | 2 +-
+ .../file_permissions_etc_shadow/rule.yml                        | 2 +-
+ 21 files changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
+index c4a7f19b94..fdbdbb08ad 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.9
+-    cis@rhel8: 6.1.8
++    cis@rhel8: 6.1.9
+     cis@ubuntu2004: 6.1.8
+ 
+ ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/group-", group="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
+index 5348e80954..f1f7c7a4d6 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
+@@ -23,7 +23,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.6
+-    cis@rhel8: 6.1.9
++    cis@rhel8: 6.1.7
+     cis@ubuntu2004: 6.1.3
+ 
+ ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/gshadow-", group=target_group) }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
+index 170f6412cf..26ff82fb51 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.3
+-    cis@rhel8: 6.1.6
++    cis@rhel8: 6.1.3
+     cis@ubuntu2004: 6.1.6
+ 
+ ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/passwd-", group="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
+index ce50f98e3f..07a3d919e2 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
+@@ -24,7 +24,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.5
+-    cis@rhel8: 6.1.7
++    cis@rhel8: 6.1.5
+     cis@ubuntu2004: 6.1.7
+ 
+ ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/shadow-", group=target_group) }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
+index 050dd198c3..7c3c3ac1d2 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_group/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ references:
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.8
+-    cis@rhel8: 6.1.4
++    cis@rhel8: 6.1.8
+     cis@ubuntu2004: 6.1.5
+     cjis: 5.5.2.2
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
+index 4d4e3ff788..ca65dbc5af 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_gshadow/rule.yml
+@@ -24,7 +24,7 @@ identifiers:
+ references:
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.7
+-    cis@rhel8: 6.1.5
++    cis@rhel8: 6.1.6
+     cis@ubuntu2004: 6.1.9
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+     isa-62443-2009: 4.3.3.7.3
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
+index 2af088f528..d59a34ef04 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_etc_shadow/rule.yml
+@@ -24,7 +24,7 @@ identifiers:
+ references:
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.4
+-    cis@rhel8: 6.1.3
++    cis@rhel8: 6.1.4
+     cis@ubuntu2004: 6.1.4
+     cjis: 5.5.2.2
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
+index 9021403357..2f2f475abf 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_group/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.9
+-    cis@rhel8: 6.1.8
++    cis@rhel8: 6.1.9
+     cis@ubuntu2004: 6.1.8
+ 
+ ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/group-", owner="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
+index 3f25afef5f..afbcd11696 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_gshadow/rule.yml
+@@ -17,7 +17,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.6
+-    cis@rhel8: 6.1.9
++    cis@rhel8: 6.1.7
+     cis@ubuntu2004: 6.1.3
+ 
+ ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/gshadow-", owner="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
+index d16f370572..8a3af3ae70 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_passwd/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.3
+-    cis@rhel8: 6.1.6
++    cis@rhel8: 6.1.3
+     cis@ubuntu2004: 6.1.6
+ 
+ ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/passwd-", owner="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
+index 7ef757c006..508bc355c3 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_backup_etc_shadow/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.5
+-    cis@rhel8: 6.1.7
++    cis@rhel8: 6.1.5
+     cis@ubuntu2004: 6.1.7
+ 
+ ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/shadow-", owner="root") }}}'
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
+index 90fd7b08eb..8e2cb53c67 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_group/rule.yml
+@@ -18,7 +18,7 @@ identifiers:
+ references:
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.8
+-    cis@rhel8: 6.1.4
++    cis@rhel8: 6.1.8
+     cis@sle15: 6.1.6
+     cis@ubuntu2004: 6.1.5
+     cjis: 5.5.2.2
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
+index cb16d61e88..fb91cee6d7 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_gshadow/rule.yml
+@@ -19,7 +19,7 @@ references:
+     anssi: BP28(R36)
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.7
+-    cis@rhel8: 6.1.5
++    cis@rhel8: 6.1.6
+     cis@ubuntu2004: 6.1.9
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+     isa-62443-2009: 4.3.3.7.3
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
+index 7c56014953..1099e5e7cc 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_owner_etc_shadow/rule.yml
+@@ -22,7 +22,7 @@ references:
+     anssi: BP28(R36)
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.4
+-    cis@rhel8: 6.1.3
++    cis@rhel8: 6.1.4
+     cis@ubuntu2004: 6.1.4
+     cjis: 5.5.2.2
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
+index 11f3818332..5d165a606e 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_group/rule.yml
+@@ -19,7 +19,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.9
+-    cis@rhel8: 6.1.8
++    cis@rhel8: 6.1.9
+     cis@sle15: 6.1.9
+     cis@ubuntu2004: 6.1.8
+ 
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
+index 05208fee37..9fd8981485 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_gshadow/rule.yml
+@@ -26,7 +26,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.6
+-    cis@rhel8: 6.1.9
++    cis@rhel8: 6.1.7
+     cis@sle15: 6.1.3
+     cis@ubuntu2004: 6.1.3
+ 
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
+index 6de0c5f703..67191c872d 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_passwd/rule.yml
+@@ -19,7 +19,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.3
+-    cis@rhel8: 6.1.6
++    cis@rhel8: 6.1.3
+     cis@sle15: 6.1.7
+     cis@ubuntu2004: 6.1.6
+ 
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
+index c9a4fce34c..685427c0a0 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_backup_etc_shadow/rule.yml
+@@ -27,7 +27,7 @@ identifiers:
+ 
+ references:
+     cis@rhel7: 6.1.5
+-    cis@rhel8: 6.1.7
++    cis@rhel8: 6.1.5
+     cis@sle15: 6.1.8
+     cis@ubuntu2004: 6.1.7
+ 
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
+index 1333bcb57b..fbf650b26d 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_group/rule.yml
+@@ -20,7 +20,7 @@ references:
+     anssi: BP28(R36)
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.8
+-    cis@rhel8: 6.1.4
++    cis@rhel8: 6.1.8
+     cis@sle15: 6.1.6
+     cis@ubuntu2004: 6.1.5
+     cjis: 5.5.2.2
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
+index c9b3495381..02404617c1 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_gshadow/rule.yml
+@@ -28,7 +28,7 @@ references:
+     anssi: BP28(R36)
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.7
+-    cis@rhel8: 6.1.5
++    cis@rhel8: 6.1.6
+     cis@sle15: 6.1.2
+     cis@ubuntu2004: 6.1.9
+     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
+diff --git a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
+index acbc478ce9..ff4db782f0 100644
+--- a/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_important_account_files/file_permissions_etc_shadow/rule.yml
+@@ -31,7 +31,7 @@ references:
+     anssi: BP28(R36)
+     cis-csc: 12,13,14,15,16,18,3,5
+     cis@rhel7: 6.1.4
+-    cis@rhel8: 6.1.3
++    cis@rhel8: 6.1.4
+     cis@sle15: 6.1.5
+     cis@ubuntu2004: 6.1.4
+     cjis: 5.5.2.2

SOURCES/scap-security-guide-0.1.58-rhel8_cis_kickstarts-PR_7383.patch

@@ -0,0 +1,455 @@
+From b3dc8273ded33d8357239482cf07186b14e3cdd2 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 12 Aug 2021 10:54:59 +0200
+Subject: [PATCH] add kickstarts for rhel8 CIS profiles
+
+---
+ products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg |   4 +-
+ .../kickstart/ssg-rhel8-cis_server_l1-ks.cfg  | 133 ++++++++++++++++
+ .../ssg-rhel8-cis_workstation_l1-ks.cfg       | 133 ++++++++++++++++
+ .../ssg-rhel8-cis_workstation_l2-ks.cfg       | 143 ++++++++++++++++++
+ 4 files changed, 411 insertions(+), 2 deletions(-)
+ create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
+ create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
+ create mode 100644 products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
+
+diff --git a/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
+index c3f31429036..d1bbb09c422 100644
+--- a/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
++++ b/products/rhel8/kickstart/ssg-rhel8-cis-ks.cfg
+@@ -1,6 +1,6 @@
+-# SCAP Security Guide CIS profile kickstart for Red Hat Enterprise Linux 8 Server
++# SCAP Security Guide CIS profile (Level 2 - Server) kickstart for Red Hat Enterprise Linux 8 Server
+ # Version: 0.0.1
+-# Date: 2020-03-30
++# Date: 2021-08-12
+ #
+ # Based on:
+ # https://pykickstart.readthedocs.io/en/latest/
+diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
+new file mode 100644
+index 00000000000..b73d5c12d21
+--- /dev/null
++++ b/products/rhel8/kickstart/ssg-rhel8-cis_server_l1-ks.cfg
+@@ -0,0 +1,133 @@
++# SCAP Security Guide CIS profile (Level 1 - Server) kickstart for Red Hat Enterprise Linux 8 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# sssd profile sets sha512 to hash passwords
++# passwords are shadowed by default
++# See the manual page for authselect-profile for a complete list of possible options.
++authselect select sssd
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_server_l1
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
+new file mode 100644
+index 00000000000..33bd9dd2560
+--- /dev/null
++++ b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l1-ks.cfg
+@@ -0,0 +1,133 @@
++# SCAP Security Guide CIS profile (Level 1 - Workstation) kickstart for Red Hat Enterprise Linux 8 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# sssd profile sets sha512 to hash passwords
++# passwords are shadowed by default
++# See the manual page for authselect-profile for a complete list of possible options.
++authselect select sssd
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_workstation_l1
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject
+diff --git a/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
+new file mode 100644
+index 00000000000..79ca7fbc201
+--- /dev/null
++++ b/products/rhel8/kickstart/ssg-rhel8-cis_workstation_l2-ks.cfg
+@@ -0,0 +1,143 @@
++# SCAP Security Guide CIS profile (Level 2 - Workstation) kickstart for Red Hat Enterprise Linux 8 Server
++# Version: 0.0.1
++# Date: 2021-08-12
++#
++# Based on:
++# https://pykickstart.readthedocs.io/en/latest/
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
++
++# Specify installation method to use for installation
++# To use a different one comment out the 'url' one below, update
++# the selected choice with proper options & un-comment it
++#
++# Install from an installation tree on a remote server via FTP or HTTP:
++# --url		the URL to install from
++#
++# Example:
++#
++# url --url=http://192.168.122.1/image
++#
++# Modify concrete URL in the above example appropriately to reflect the actual
++# environment machine is to be installed in
++#
++# Other possible / supported installation methods:
++# * install from the first CD-ROM/DVD drive on the system:
++#
++# cdrom
++#
++# * install from a directory of ISO images on a local drive:
++#
++# harddrive --partition=hdb2 --dir=/tmp/install-tree
++#
++# * install from provided NFS server:
++#
++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
++#
++
++# Set language to use during installation and the default language to use on the installed system (required)
++lang en_US.UTF-8
++
++# Set system keyboard type / layout (required)
++keyboard us
++
++# Configure network information for target system and activate network devices in the installer environment (optional)
++# --onboot	enable device at a boot time
++# --device	device to be activated and / or configured with the network command
++# --bootproto	method to obtain networking configuration for device (default dhcp)
++# --noipv6	disable IPv6 on this device
++#
++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
++#       "--bootproto=static" must be used. For example:
++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
++#
++network --onboot yes --device eth0 --bootproto dhcp --noipv6
++
++# Set the system's root password (required)
++# Plaintext password is: server
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0
++
++# The selected profile will restrict root login
++# Add a user that can login and escalate privileges
++# Plaintext password is: admin123
++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
++
++# Configure firewall settings for the system (optional)
++# --enabled	reject incoming connections that are not in response to outbound requests
++# --ssh		allow sshd service through the firewall
++firewall --enabled --ssh
++
++# Set up the authentication options for the system (required)
++# sssd profile sets sha512 to hash passwords
++# passwords are shadowed by default
++# See the manual page for authselect-profile for a complete list of possible options.
++authselect select sssd
++
++# State of SELinux on the installed system (optional)
++# Defaults to enforcing
++selinux --enforcing
++
++# Set the system time zone (required)
++timezone --utc America/New_York
++
++# Specify how the bootloader should be installed (required)
++# Plaintext password is: password
++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create
++# encrypted password form for different plaintext password
++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
++
++# Initialize (format) all disks (optional)
++zerombr
++
++# The following partition layout scheme assumes disk of size 20GB or larger
++# Modify size of partitions appropriately to reflect actual machine's hardware
++#
++# Remove Linux partitions from the system prior to creating new ones (optional)
++# --linux	erase all Linux partitions
++# --initlabel	initialize the disk label to the default based on the underlying architecture
++clearpart --linux --initlabel
++
++# Create primary system partitions (required for installs)
++part /boot --fstype=xfs --size=512
++part pv.01 --grow --size=1
++
++# Create a Logical Volume Management (LVM) group (optional)
++volgroup VolGroup --pesize=4096 pv.01
++
++# Create particular logical volumes (optional)
++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow
++# Ensure /home Located On Separate Partition
++logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
++# Ensure /tmp Located On Separate Partition
++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
++# Ensure /var/tmp Located On Separate Partition
++logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
++# Ensure /var Located On Separate Partition
++logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072
++# Ensure /var/log Located On Separate Partition
++logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024
++# Ensure /var/log/audit Located On Separate Partition
++logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512
++logvol swap --name=lv_swap --vgname=VolGroup --size=2016
++
++
++# Harden installation with CIS profile
++# For more details and configuration options see
++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
++%addon org_fedora_oscap
++        content-type = scap-security-guide
++        profile = xccdf_org.ssgproject.content_profile_cis_workstation_l2
++%end
++
++# Packages selection (%packages section is required)
++%packages
++
++# Require @Base
++@Base
++
++%end # End of %packages section
++
++# Reboot after the installation is complete (optional)
++# --eject	attempt to eject CD or DVD media before rebooting
++reboot --eject

SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_010290-PR_7151.patch

@@ -0,0 +1,687 @@
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
+index 194d7dfe2dc..b6c5e7f4b0d 100644
+--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml
+@@ -37,7 +37,7 @@ ocil: |-
+     MACs are in use, run the following command:
+     <pre>$ sudo grep -i macs /etc/ssh/sshd_config</pre>
+     The output should contain only following MACs (or a subset) in the exact order:
+-    <pre>hmac-sha2-512,hmac-sha2-256</pre>
++    <pre>MACs {{{ xccdf_value("sshd_approved_macs") }}}</pre>
+ 
+ warnings:
+     - general: |-
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml
+new file mode 100644
+index 00000000000..1c9dde77ee2
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml
+@@ -0,0 +1,16 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++# reboot = true
++# strategy = restrict
++# complexity = low
++# disruption = low
++{{{ ansible_instantiate_variables("sshd_approved_macs") }}}
++
++{{{ ansible_set_config_file(
++        msg='Configure SSH Daemon to Use FIPS 140-2 Validated MACs: openssh.config',
++        file='/etc/crypto-policies/back-ends/openssh.config',
++        parameter='MACs',
++        value="{{ sshd_approved_macs }}",
++        create='yes',
++        prefix_regex='^.*'
++    )
++}}}
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh
+new file mode 100644
+index 00000000000..b26992ce183
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh
+@@ -0,0 +1,13 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++. /usr/share/scap-security-guide/remediation_functions
++{{{ bash_instantiate_variables("sshd_approved_macs") }}}
++
++{{{ set_config_file(
++        path="/etc/crypto-policies/back-ends/openssh.config",
++        parameter="MACs",
++        value="${sshd_approved_macs}",
++        create=true,
++        insensitive=false,
++        prefix_regex="^.*"
++	)
++}}}
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml
+new file mode 100644
+index 00000000000..5239af10612
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/oval/shared.xml
+@@ -0,0 +1,35 @@
++{{%- set PATH = "/etc/crypto-policies/back-ends/openssh.config" -%}}
++<def-group>
++  <definition class="compliance" id="{{{ rule_id }}}" version="1">
++    {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.") }}}
++    <criteria operator="AND" comment="Test conditions - presence of the file plus.">
++      <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD MACs" test_ref="test_{{{ rule_id }}}" />
++    </criteria>
++  </definition>
++
++  <ind:textfilecontent54_test check="all"
++  comment="test the value of MACs setting in the {{{ PATH }}} file"
++  id="test_{{{ rule_id }}}" version="1">
++    <ind:object object_ref="obj_{{{ rule_id }}}" />
++    <ind:state state_ref="ste_{{{ rule_id }}}" />
++  </ind:textfilecontent54_test>
++
++  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
++    <ind:filepath>{{{ PATH }}}</ind:filepath>
++    <ind:pattern operation="pattern match">^MACs.*$</ind:pattern>
++    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
++  </ind:textfilecontent54_object>
++
++  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
++    <ind:text var_ref="sshd_macs_crypto" operation="equals"></ind:text>
++  </ind:textfilecontent54_state>
++
++  <local_variable id="sshd_macs_crypto" datatype="string" comment="The regex of the directive" version="1">
++    <concat>
++      <literal_component>MACs </literal_component>
++      <variable_component var_ref="sshd_approved_macs"/>
++    </concat>
++  </local_variable>
++
++  <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="sshd_approved_macs" version="1" />
++</def-group>
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
+new file mode 100644
+index 00000000000..1aeb987db2d
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml
+@@ -0,0 +1,60 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config'
++
++description: |-
++    Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
++    OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
++    set up incorrectly.
++
++    To check that Crypto Policies settings are configured correctly, ensure that
++    <tt>/etc/crypto-policies/back-ends/openssh.config</tt> contains the following
++    line and is not commented out:
++    <tt>MACs hmac-sha2-512,hmac-sha2-256</tt>
++
++rationale: |-
++    Overriding the system crypto policy makes the behavior of the OpenSSH
++    client violate expectations, and makes system configuration more
++    fragmented.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85870-4
++
++references:
++    disa: CCI-001453
++    nist: AC-17(2)
++    srg: SRG-OS-000250-GPOS-00093
++    stigid@rhel8: RHEL-08-010290
++
++ocil_clause: 'Crypto Policy for OpenSSH client is not configured correctly'
++
++ocil: |-
++    To verify if the OpenSSH client uses defined MACs in the Crypto Policy, run:
++    <pre>$ grep -i macs /etc/crypto-policies/back-ends/openssh.config</pre>
++    and verify that the line matches:
++    <pre>MACs hmac-sha2-512,hmac-sha2-256</pre>
++
++warnings:
++    - general: |-
++        The system needs to be rebooted for these changes to take effect.
++    - regulatory: |-
++        System Crypto Modules must be provided by a vendor that undergoes
++        FIPS-140 certifications.
++        FIPS-140 is applicable to all Federal agencies that use
++        cryptographic-based security systems to protect sensitive information
++        in computer and telecommunication systems (including voice systems) as
++        defined in Section 5131 of the Information Technology Management Reform
++        Act of 1996, Public Law 104-106. This standard shall be used in
++        designing and implementing cryptographic modules that Federal
++        departments and agencies operate or are operated for them under
++        contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
++        To meet this, the system has to have cryptographic software provided by
++        a vendor that has undergone this certification. This means providing
++        documentation, test results, design information, and independent third
++        party review by an accredited lab. While open source software is
++        capable of meeting this, it does not meet FIPS-140 unless the vendor
++        submits to this process.
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh
+new file mode 100644
+index 00000000000..5a4b6887cba
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh
+@@ -0,0 +1,15 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/MACs ${sshd_approved_macs}/" $configfile
++else
++    echo "MACs ${sshd_approved_macs}" > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh
+new file mode 100644
+index 00000000000..e713d254f9c
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh
+@@ -0,0 +1,15 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/#MACs ${sshd_approved_macs}/" $configfile
++else
++    echo "#MACs ${sshd_approved_macs}" > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh
+new file mode 100644
+index 00000000000..b8a63bec194
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh
+@@ -0,0 +1,18 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/MACs ${sshd_approved_macs}/" $configfile
++else
++    echo "MACs ${sshd_approved_macs}" > "$configfile"
++fi
++
++# follow up with incorrect
++echo "#MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512" >> $configfile
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh
+new file mode 100644
+index 00000000000..55ef3f58422
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh
+@@ -0,0 +1,10 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++echo "" > $configfile
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh
+new file mode 100644
+index 00000000000..9980a45681c
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/MACs /" $configfile
++else
++    echo "MACs " > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh
+new file mode 100644
+index 00000000000..d1303d60746
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh
+@@ -0,0 +1,19 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
++incorrect_sshd_approved_macs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/MACs ${incorrect_sshd_approved_macs}/" $configfile
++else
++    echo "MACs ${incorrect_sshd_approved_macs}" > "$configfile"
++fi
++
++# follow up with correct value
++echo "MACs ${sshd_approved_macs}" >> $configfile
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh
+new file mode 100644
+index 00000000000..8b21af46896
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i "s/^.*MACs.*$/MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512/" $configfile
++else
++    echo "MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512" > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh
+new file mode 100644
+index 00000000000..2138caad319
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh
+@@ -0,0 +1,11 @@
++#!/bin/bash
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/openssh.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++# If file exists, remove it
++test -f $configfile && rm -f $configfile
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml
+new file mode 100644
+index 00000000000..5ed618586ae
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml
+@@ -0,0 +1,45 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++# reboot = true
++# strategy = restrict
++# complexity = low
++# disruption = low
++{{{ ansible_instantiate_variables("sshd_approved_macs") }}}
++
++- name: "{{{ rule_title }}}: Set facts"
++  set_fact:
++    path: /etc/crypto-policies/back-ends/opensshserver.config
++    correct_value: "-oMACs={{ sshd_approved_macs }}"
++
++- name: "{{{ rule_title }}}: Stat"
++  stat:
++    path: "{{ path }}"
++    follow: yes
++  register: opensshserver_file
++
++- name: "{{{ rule_title }}}: Create"
++  lineinfile:
++    path: "{{ path }}"
++    line: "CRYPTO_POLICY='{{ correct_value }}'"
++    create: yes
++  when: not opensshserver_file.stat.exists or opensshserver_file.stat.size <= correct_value|length
++
++- name: "{{{ rule_title }}}"
++  block:
++    - name: "Existing value check"
++      lineinfile:
++        path: "{{ path }}"
++        create: false
++        regexp: "{{ correct_value }}"
++        state: absent
++      check_mode: true
++      changed_when: false
++      register: opensshserver
++
++    - name: "Update/Correct value"
++      replace:
++        path: "{{ path }}"
++        regexp: (-oMACs=\S+)
++        replace: "{{ correct_value }}"
++      when: opensshserver.found is defined and opensshserver.found != 1
++
++  when: opensshserver_file.stat.exists and opensshserver_file.stat.size > correct_value|length
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh
+new file mode 100644
+index 00000000000..790a2951bab
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh
+@@ -0,0 +1,31 @@
++# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
++. /usr/share/scap-security-guide/remediation_functions
++{{{ bash_instantiate_variables("sshd_approved_macs") }}}
++
++CONF_FILE=/etc/crypto-policies/back-ends/opensshserver.config
++correct_value="-oMACs=${sshd_approved_macs}"
++
++# Test if file exists
++test -f ${CONF_FILE} || touch ${CONF_FILE}
++
++# Ensure CRYPTO_POLICY is not commented out
++sed -i 's/#CRYPTO_POLICY=/CRYPTO_POLICY=/' ${CONF_FILE}
++
++grep -q "'${correct_value}'" ${CONF_FILE}
++
++if [[ $? -ne 0 ]]; then
++    # We need to get the existing value, using PCRE to maintain same regex
++    existing_value=$(grep -Po '(-oMACs=\S+)' ${CONF_FILE})
++
++    if [[ ! -z ${existing_value} ]]; then
++        # replace existing_value with correct_value
++        sed -i "s/${existing_value}/${correct_value}/g" ${CONF_FILE}
++    else
++        # ***NOTE*** #
++        # This probably means this file is not here or it's been modified
++        # unintentionally.
++        # ********** #
++        # echo correct_value to end
++        echo "CRYPTO_POLICY='${correct_value}'" >> ${CONF_FILE}
++    fi
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml
+new file mode 100644
+index 00000000000..18028157032
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/oval/shared.xml
+@@ -0,0 +1,35 @@
++{{%- set PATH = "/etc/crypto-policies/back-ends/opensshserver.config" -%}}
++<def-group>
++  <definition class="compliance" id="{{{ rule_id }}}" version="1">
++    {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.") }}}
++    <criteria operator="AND" comment="Test conditions - presence of the file plus.">
++      <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD MACs" test_ref="test_{{{ rule_id }}}" />
++    </criteria>
++  </definition>
++
++  <ind:textfilecontent54_test check="all"
++  comment="test the value of MACs setting in the {{{ PATH }}} file"
++  id="test_{{{ rule_id }}}" version="1">
++    <ind:object object_ref="obj_{{{ rule_id }}}" />
++    <ind:state state_ref="ste_{{{ rule_id }}}" />
++  </ind:textfilecontent54_test>
++
++  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
++    <ind:filepath>{{{ PATH }}}</ind:filepath>
++    <ind:pattern operation="pattern match">^(?!#).*(-oMACs=\S+).+$</ind:pattern>
++    <ind:instance operation="equals" datatype="int">1</ind:instance>
++  </ind:textfilecontent54_object>
++
++  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
++    <ind:subexpression var_ref="sshd_macs_crypto_opensshserver" operation="equals" />
++  </ind:textfilecontent54_state>
++
++  <local_variable id="sshd_macs_crypto_opensshserver" datatype="string" comment="The regex of the directive" version="1">
++    <concat>
++      <literal_component>-oMACs=</literal_component>
++      <variable_component var_ref="sshd_approved_macs"/>
++    </concat>
++  </local_variable>
++
++  <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="sshd_approved_macs" version="1" />
++</def-group>
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml
+new file mode 100644
+index 00000000000..0fd107a1bbe
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml
+@@ -0,0 +1,60 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config'
++
++description: |-
++    Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
++    OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
++    set up incorrectly.
++
++    To check that Crypto Policies settings are configured correctly, ensure that
++    <tt>/etc/crypto-policies/back-ends/opensshserver.config</tt> contains the following
++    text and is not commented out:
++    <tt>-oMACS=hmac-sha2-512,hmac-sha2-256</tt>
++
++rationale: |-
++    Overriding the system crypto policy makes the behavior of the OpenSSH
++    server violate expectations, and makes system configuration more
++    fragmented.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85899-3
++
++references:
++    disa: CCI-001453
++    nist: AC-17(2)
++    srg: SRG-OS-000250-GPOS-00093
++    stigid@rhel8: RHEL-08-010290
++
++ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly'
++
++ocil: |-
++    To verify if the OpenSSH server uses defined MACs in the Crypto Policy, run:
++    <pre>$ grep -Po '(-oMACs=\S+)' /etc/crypto-policies/back-ends/opensshserver.config</pre>
++    and verify that the line matches:
++    <pre>-oMACS=hmac-sha2-512,hmac-sha2-256</pre>
++
++warnings:
++    - general: |-
++        The system needs to be rebooted for these changes to take effect.
++    - regulatory: |-
++        System Crypto Modules must be provided by a vendor that undergoes
++        FIPS-140 certifications.
++        FIPS-140 is applicable to all Federal agencies that use
++        cryptographic-based security systems to protect sensitive information
++        in computer and telecommunication systems (including voice systems) as
++        defined in Section 5131 of the Information Technology Management Reform
++        Act of 1996, Public Law 104-106. This standard shall be used in
++        designing and implementing cryptographic modules that Federal
++        departments and agencies operate or are operated for them under
++        contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
++        To meet this, the system has to have cryptographic software provided by
++        a vendor that has undergone this certification. This means providing
++        documentation, test results, design information, and independent third
++        party review by an accredited lab. While open source software is
++        capable of meeting this, it does not meet FIPS-140 unless the vendor
++        submits to this process.
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh
+new file mode 100644
+index 00000000000..14da92218dc
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh
+@@ -0,0 +1,17 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++sshd_approved_macs=hmac-sha2-512,hmac-sha2-256
++configfile=/etc/crypto-policies/back-ends/opensshserver.config
++correct_value="-oMACs=${sshd_approved_macs}"
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++# Proceed when file exists
++if [[ -f $configfile ]]; then
++    sed -i -r "s/-oMACs=\S+/${correct_value}/" $configfile
++else
++    echo "${correct_value}" > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh
+new file mode 100644
+index 00000000000..3dde1479296
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/opensshserver.config
++
++echo "" > "$configfile"
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh
+new file mode 100644
+index 00000000000..a50a0fc02bf
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/opensshserver.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++if [[ -f $configfile ]]; then
++    sed -i -r "s/-oMACs=\S+/-oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com/" $configfile
++else
++    echo "-oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com" > "$configfile"
++fi
+diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh
+new file mode 100644
+index 00000000000..11e596ced87
+--- /dev/null
++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh
+@@ -0,0 +1,11 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# profiles = xccdf_org.ssgproject.content_profile_stig
++
++configfile=/etc/crypto-policies/back-ends/opensshserver.config
++
++# Ensure directory + file is there
++test -d /etc/crypto-policies/back-ends || mkdir -p /etc/crypto-policies/back-ends
++
++# If file exists, remove it
++test -f $configfile && rm -f $configfile
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 6372d13cfc9..28b47cca487 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -50,6 +50,7 @@ selections:
+     - var_password_pam_retry=3
+     - var_password_pam_minlen=15
+     - var_sshd_set_keepalive=0
++    - sshd_approved_macs=stig
+     - sshd_idle_timeout_value=10_minutes
+     - var_accounts_passwords_pam_faillock_deny=3
+     - var_accounts_passwords_pam_faillock_fail_interval=900
+@@ -174,11 +175,17 @@ selections:
+     # RHEL-08-010260
+     - file_groupowner_var_log
+ 
++    # *** SHARED *** #
+     # RHEL-08-010290 && RHEL-08-010291
+-    ### NOTE: This will get split out in future STIG releases, as well as we will break
+-    ### these rules up to be more flexible in meeting the requirements.
++    # *** SHARED *** #
+     - configure_ssh_crypto_policy
+ 
++    # RHEL-08-010290
++    - harden_sshd_macs_openssh_conf_crypto_policy
++    - harden_sshd_macs_opensshserver_conf_crypto_policy
++
++    # RHEL-08-010291
++
+     # RHEL-08-010292
+     - sshd_use_strong_rng
+ 
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 24e81491683..036d34cea1d 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -10,7 +10,6 @@ CCE-85866-2
+ CCE-85867-0
+ CCE-85868-8
+ CCE-85869-6
+-CCE-85870-4
+ CCE-85872-0
+ CCE-85873-8
+ CCE-85874-6
+@@ -36,7 +35,6 @@ CCE-85895-1
+ CCE-85896-9
+ CCE-85897-7
+ CCE-85898-5
+-CCE-85899-3
+ CCE-85900-9
+ CCE-85901-7
+ CCE-85902-5
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 32f1a24a7a4..393051a34ea 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -145,6 +145,8 @@ selections:
+ - grub2_uefi_admin_username
+ - grub2_uefi_password
+ - grub2_vsyscall_argument
++- harden_sshd_macs_openssh_conf_crypto_policy
++- harden_sshd_macs_opensshserver_conf_crypto_policy
+ - install_smartcard_packages
+ - installed_OS_is_vendor_supported
+ - kerberos_disable_no_keytab
+@@ -325,6 +327,7 @@ selections:
+ - var_password_pam_lcredit=1
+ - var_password_pam_retry=3
+ - var_sshd_set_keepalive=0
++- sshd_approved_macs=stig
+ - sshd_idle_timeout_value=10_minutes
+ - var_accounts_passwords_pam_faillock_deny=3
+ - var_accounts_passwords_pam_faillock_fail_interval=900
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index d6a27c67dc0..de82fb34518 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -156,6 +156,8 @@ selections:
+ - grub2_uefi_admin_username
+ - grub2_uefi_password
+ - grub2_vsyscall_argument
++- harden_sshd_macs_openssh_conf_crypto_policy
++- harden_sshd_macs_opensshserver_conf_crypto_policy
+ - install_smartcard_packages
+ - installed_OS_is_vendor_supported
+ - kerberos_disable_no_keytab
+@@ -335,6 +337,7 @@ selections:
+ - var_password_pam_lcredit=1
+ - var_password_pam_retry=3
+ - var_sshd_set_keepalive=0
++- sshd_approved_macs=stig
+ - sshd_idle_timeout_value=10_minutes
+ - var_accounts_passwords_pam_faillock_deny=3
+ - var_accounts_passwords_pam_faillock_fail_interval=900

SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_010350-PR_7231.patch

@@ -0,0 +1,546 @@
+From f7bb6fc32091ad9d10ec8253505086670eb135ba Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Mon, 12 Jul 2021 10:06:41 -0400
+Subject: [PATCH 1/4] Initial commit for RHEL-08-010350 STIG rule
+
+---
+ .../ansible/shared.yml                        |  2 +-
+ .../bash/shared.sh                            |  2 +-
+ .../oval/shared.xml                           | 44 +++++++++++++------
+ .../rule.yml                                  | 26 ++++++-----
+ .../tests/correct_group.pass.sh               |  2 +-
+ .../tests/incorrect_group.fail.sh             |  8 +++-
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 10 files changed, 57 insertions(+), 31 deletions(-)
+
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+index f90c8e26b15..e0bb6b0dc1a 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+@@ -1,4 +1,4 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ # reboot = false
+ # strategy = restrict
+ # complexity = high
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
+index fba25be6132..d5fb89487d5 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh
+@@ -1,4 +1,4 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ 
+ find /lib \
+ /lib64 \
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+index 00f733ddc78..e3d64a8390e 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+@@ -1,27 +1,45 @@
+ <def-group>
+-  <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
++  <definition class="compliance" id="root_permissions_syslibrary_files" version="1">
+     {{{ oval_metadata("
+-        Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
+-        are owned by root.
++        Checks that /lib, /lib64, /usr/lib, /usr/lib64, and
++        objects therein, are group-owned by root.
+       ") }}}
+-    <criteria >
+-      <criterion test_ref="test_root_permissions_for_syslibrary_files" />
++    <criteria operator="AND">
++      <criterion test_ref="test_group_ownership_lib_dir" />
++      <criterion test_ref="test_group_ownership_lib_files" />
+     </criteria>
+   </definition>
+ 
+-  <unix:file_test  check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
+-    <unix:object object_ref="root_permissions_for_system_wide_library_files" />
++  <unix:file_test  check="all" check_existence="none_exist" comment="library directories gid root" id="test_group_ownership_lib_dir" version="1">
++    <unix:object object_ref="object_group_ownership_lib_dir" />
+   </unix:file_test>
+ 
+-  <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
+-    <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
+-        are owned by root. -->
+-    <unix:path operation="pattern match">^\/lib(64)?|^\/usr\/lib(64)?</unix:path >    
++  <unix:file_test  check="all" check_existence="none_exist" comment="library files gid root" id="test_group_ownership_lib_files" version="1">
++    <unix:object object_ref="object_group_ownership_lib_files" />
++  </unix:file_test>
++
++  <unix:file_object comment="library directories" id="object_group_ownership_lib_dir" version="1">
++    <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
++    <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
++    <unix:filename xsi:nil="true" />
++    <filter action="include">state_group_ownership_libraries_not_root</filter>
++    <filter action="exclude">group_dir_perms_state_symlink</filter>
++  </unix:file_object>
++
++  <unix:file_object comment="library files" id="object_group_ownership_lib_files" version="1">
++    <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
++    <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
+     <unix:filename operation="pattern match">^.*$</unix:filename>
+-    <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
++   <filter action="include">state_group_ownership_libraries_not_root</filter>
++   <filter action="exclude">group_dir_perms_state_symlink</filter>
+   </unix:file_object>
+ 
+-  <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
++  <unix:file_state id="state_group_ownership_libraries_not_root" version="1">
+     <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+   </unix:file_state>
++
++  <unix:file_state id="group_dir_perms_state_symlink" version="1">
++    <unix:type operation="equals">symbolic link</unix:type>
++  </unix:file_state>
++
+ </def-group>
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
+index ff905dd08d..83371b8b9b 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml
+@@ -1,6 +1,6 @@
+ documentation_complete: true
+ 
+-prodtype: sle12,sle15
++prodtype: sle12,sle15,rhel8,fedora
+ 
+ title: |-
+     Verify the system-wide library files in directories
+@@ -17,18 +17,18 @@ description: |-
+     All system-wide shared library files should be protected from unauthorised
+     access. If any of these files is not owned by root, correct its owner with
+     the following command:
+-    <pre>$ sudo chgrp root <i>DIR</i></pre>
++    <pre>$ sudo chgrp root <i>FILE</i></pre>
+ 
+ rationale: |-
+-  If the operating system were to allow any user to make changes to software libraries,
+-  then those changes might be implemented without undergoing the appropriate testing and
+-  approvals that are part of a robust change management process.
++    If the operating system were to allow any user to make changes to software libraries,
++    then those changes might be implemented without undergoing the appropriate testing and
++    approvals that are part of a robust change management process.
+ 
+-  This requirement applies to operating systems with software libraries that are
+-  accessible and configurable, as in the case of interpreted languages. Software libraries
+-  also include privileged programs which execute with escalated privileges. Only qualified
+-  and authorized individuals must be allowed to obtain access to information system components
+-  for purposes of initiating changes, including upgrades and modifications.
++    This requirement applies to operating systems with software libraries that are
++    accessible and configurable, as in the case of interpreted languages. Software libraries
++    also include privileged programs which execute with escalated privileges. Only qualified
++    and authorized individuals must be allowed to obtain access to information system components
++    for purposes of initiating changes, including upgrades and modifications.
+ 
+ severity: medium
+ 
+@@ -45,7 +45,7 @@ references:
+     stigid@sle12: SLES-12-010875
+     stigid@sle15: SLES-15-010355
+ 
+-ocil_clause: 'any system wide library directory is returned'
++ocil_clause: 'system wide library files are not group owned by root'
+ 
+ ocil: |-
+     System-wide library files are stored in the following directories:
+@@ -54,6 +54,6 @@ ocil: |-
+     /usr/lib
+     /usr/lib64
+     </pre>
+-    To find if system-wide library files stored in these directories are group-owned by
++    To find if system-wide library files stored in these directories are not group-owned by
+     root run the following command for each directory <i>DIR</i>:
+     <pre>$ sudo find -L <i>DIR</i> ! -group root -type f </pre>
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+index 7a8e65b4f3a..8722c2add65 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+@@ -4,6 +4,6 @@ for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
+ do
+     if [[ -d $SYSLIBDIRS  ]]
+     then
+-        find $SYSLIBDIRS ! -group root -type f -exec chgrp root '{}' \;
++        find $SYSLIBDIRS ! -group root -exec chgrp root '{}' \;
+     fi
+ done
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+index a4b99a9da14..1079046d14e 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+@@ -1,6 +1,10 @@
+ #!/bin/bash
+-  
+-for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
++
++# There is a high probability that there will be nested subdirectories within the
++# shared system library directories, therefore we should test to make sure we
++# cover this. - cmm
++test -d /usr/lib/test_dir || mkdir -p /usr/lib/test_dir && chown nobody.nobody /usr/lib/test_dir
++for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me /usr/lib/test_dir/test_me
+ do
+    if [[ ! -f $TESTFILE ]]
+    then
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 2508008d511..9569b2ad629 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -207,6 +207,7 @@ selections:
+     - file_ownership_library_dirs
+ 
+     # RHEL-08-010350
++    - root_permissions_syslibrary_files
+ 
+     # RHEL-08-010360
+     - package_aide_installed
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index f139d2ed76f..e0eb5ac045c 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -662,7 +662,6 @@ CCE-86518-8
+ CCE-86520-4
+ CCE-86521-2
+ CCE-86522-0
+-CCE-86523-8
+ CCE-86524-6
+ CCE-86525-3
+ CCE-86526-1
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 765487c6f16..ebe7a91f45d 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -221,6 +221,7 @@ selections:
+ - postfix_client_configure_mail_alias
+ - require_emergency_target_auth
+ - require_singleuser_auth
++- root_permissions_syslibrary_files
+ - rsyslog_cron_logging
+ - rsyslog_remote_access_monitoring
+ - rsyslog_remote_loghost
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 9fd80aac727..97f940dc9ed 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -232,6 +232,7 @@ selections:
+ - postfix_client_configure_mail_alias
+ - require_emergency_target_auth
+ - require_singleuser_auth
++- root_permissions_syslibrary_files
+ - rsyslog_cron_logging
+ - rsyslog_remote_access_monitoring
+ - rsyslog_remote_loghost
+
+From f16c085894e4dc7974637d44bf226d3acf19f3d1 Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Mon, 12 Jul 2021 16:17:23 -0400
+Subject: [PATCH 2/4] Updated existing rules for syslibrary files/dirs
+
+---
+ .../ansible/shared.yml                        |  6 ++-
+ .../bash/shared.sh                            |  7 +++
+ .../dir_group_ownership_library_dirs/rule.yml |  4 ++
+ .../tests/all_dirs_ok.pass.sh                 |  3 +-
+ .../nobody_group_owned_dir_on_lib.fail.sh     |  3 +-
+ .../ansible/shared.yml                        | 23 ++++++++--
+ .../oval/shared.xml                           | 44 ++++++-------------
+ .../tests/correct_group.pass.sh               |  4 +-
+ .../tests/incorrect_group.fail.sh             |  8 +---
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 13 files changed, 59 insertions(+), 47 deletions(-)
+ create mode 100644 linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
+
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
+index 80562991ac5..f6f2ab48afd 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml
+@@ -1,4 +1,4 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ # reboot = false
+ # strategy = restrict
+ # complexity = medium
+@@ -20,4 +20,6 @@
+     state: "directory"
+     mode: "{{ item.mode }}"
+   with_items: "{{ library_dirs_not_group_owned_by_root.files }}"
+-  when: library_dirs_not_group_owned_by_root.matched > 0
++  when:
++    - library_dirs_not_group_owned_by_root.matched > 0
++    - item.gid != 0
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
+new file mode 100644
+index 00000000000..365b9833188
+--- /dev/null
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh
+@@ -0,0 +1,7 @@
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
++
++find /lib \
++/lib64 \
++/usr/lib \
++/usr/lib64 \
++\! -group root -type d -exec chgrp root '{}' \;
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
+index 4ff043270c8..cd02d95cb1c 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml
+@@ -1,5 +1,7 @@
+ documentation_complete: true
+ 
++prodtype: sle12,sle15,rhel8,fedora
++
+ title: 'Verify that Shared Library Directories Have Root Group Ownership'
+ 
+ description: |-
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
+index 2a38e9a88bc..50fdb17bd2e 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh
+@@ -1,4 +1,5 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
++
+ DIRS="/lib /lib64 /usr/lib /usr/lib64"
+ for dirPath in $DIRS; do
+ 	find "$dirPath" -type d -exec chgrp root '{}' \;
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+index f794d9e878f..277bd7d60de 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+@@ -1,4 +1,5 @@
+-# platform = multi_platform_sle
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
++
+ DIRS="/lib /lib64"
+ for dirPath in $DIRS; do
+ 	mkdir -p "$dirPath/testme" && chown root:nogroup "$dirPath/testme"
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+index e0bb6b0dc1a..ab3e85c4f7c 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml
+@@ -4,7 +4,24 @@
+ # complexity = high
+ # disruption = medium
+ 
+-- name: "Set ownership to root of system-wide library files"
+-  command: "find {{ item }} ! -group root -type f -exec chgrp root '{}' \\;"
+-  with_items: [ '/lib', '/lib64', '/usr/lib', '/usr/lib64' ]
++- name: "Read list libraries without root ownership"
++  find:
++    paths:
++      - "/usr/lib"
++      - "/usr/lib64"
++      - "/lib"
++      - "/lib64"
++    file_type: "file"
++  register: library_files_not_group_owned_by_root
++
++- name: "Set group ownership of system library files to root"
++  file:
++    path: "{{ item.path }}"
++    group: "root"
++    state: "file"
++    mode: "{{ item.mode }}"
++  with_items: "{{ library_files_not_group_owned_by_root.files }}"
++  when:
++    - library_files_not_group_owned_by_root.matched > 0
++    - item.gid != 0
+ 
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+index e3d64a8390e..926ff70d1e4 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+@@ -1,45 +1,27 @@
+ <def-group>
+-  <definition class="compliance" id="root_permissions_syslibrary_files" version="1">
++  <definition class="compliance" id="root_permissions_syslibrary_files" version="2">
+     {{{ oval_metadata("
+-        Checks that /lib, /lib64, /usr/lib, /usr/lib64, and
+-        objects therein, are group-owned by root.
++        Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
++        are owned by root.
+       ") }}}
+-    <criteria operator="AND">
+-      <criterion test_ref="test_group_ownership_lib_dir" />
+-      <criterion test_ref="test_group_ownership_lib_files" />
++    <criteria >
++      <criterion test_ref="test_root_permissions_for_syslibrary_files" />
+     </criteria>
+   </definition>
+ 
+-  <unix:file_test  check="all" check_existence="none_exist" comment="library directories gid root" id="test_group_ownership_lib_dir" version="1">
+-    <unix:object object_ref="object_group_ownership_lib_dir" />
++  <unix:file_test  check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="test_root_permissions_for_syslibrary_files" version="1">
++    <unix:object object_ref="root_permissions_for_system_wide_library_files" />
+   </unix:file_test>
+ 
+-  <unix:file_test  check="all" check_existence="none_exist" comment="library files gid root" id="test_group_ownership_lib_files" version="1">
+-    <unix:object object_ref="object_group_ownership_lib_files" />
+-  </unix:file_test>
+-
+-  <unix:file_object comment="library directories" id="object_group_ownership_lib_dir" version="1">
+-    <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
+-    <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
+-    <unix:filename xsi:nil="true" />
+-    <filter action="include">state_group_ownership_libraries_not_root</filter>
+-    <filter action="exclude">group_dir_perms_state_symlink</filter>
+-  </unix:file_object>
+-
+-  <unix:file_object comment="library files" id="object_group_ownership_lib_files" version="1">
+-    <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to group with gid 0 (root) -->
+-    <unix:path operation="pattern match">^\/lib(|64)?\/|^\/usr\/lib(|64)?\/</unix:path>
++  <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
++    <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
++        are owned by root. -->
++    <unix:path operation="pattern match">^\/lib\/|^\/lib64\/|^\/usr\/lib\/|^\/usr\/lib64\/</unix:path>
+     <unix:filename operation="pattern match">^.*$</unix:filename>
+-   <filter action="include">state_group_ownership_libraries_not_root</filter>
+-   <filter action="exclude">group_dir_perms_state_symlink</filter>
++    <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
+   </unix:file_object>
+ 
+-  <unix:file_state id="state_group_ownership_libraries_not_root" version="1">
++  <unix:file_state id="group_permissions_for_system_wide_files_are_not_root" version="1" >
+     <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
+   </unix:file_state>
+-
+-  <unix:file_state id="group_dir_perms_state_symlink" version="1">
+-    <unix:type operation="equals">symbolic link</unix:type>
+-  </unix:file_state>
+-
+ </def-group>
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+index 8722c2add65..a4ae2854db1 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh
+@@ -1,9 +1,9 @@
+-#!/bin/bash
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ 
+ for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64
+ do
+     if [[ -d $SYSLIBDIRS  ]]
+     then
+-        find $SYSLIBDIRS ! -group root -exec chgrp root '{}' \;
++        find $SYSLIBDIRS ! -group root -type f -exec chgrp root '{}' \;
+     fi
+ done
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+index 1079046d14e..c96f65b989c 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh
+@@ -1,10 +1,6 @@
+-#!/bin/bash
++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ 
+-# There is a high probability that there will be nested subdirectories within the
+-# shared system library directories, therefore we should test to make sure we
+-# cover this. - cmm
+-test -d /usr/lib/test_dir || mkdir -p /usr/lib/test_dir && chown nobody.nobody /usr/lib/test_dir
+-for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me /usr/lib/test_dir/test_me
++for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me
+ do
+    if [[ ! -f $TESTFILE ]]
+    then
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 9569b2ad629..059750f59d0 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -208,6 +208,7 @@ selections:
+ 
+     # RHEL-08-010350
+     - root_permissions_syslibrary_files
++    - dir_group_ownership_library_dirs
+ 
+     # RHEL-08-010360
+     - package_aide_installed
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index e0eb5ac045c..ae3375fd4d4 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -34,7 +34,6 @@ CCE-85890-2
+ CCE-85891-0
+ CCE-85892-8
+ CCE-85893-6
+-CCE-85894-4
+ CCE-85895-1
+ CCE-85896-9
+ CCE-85897-7
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index ebe7a91f45d..49cce4d81cc 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -99,6 +99,7 @@ selections:
+ - dconf_gnome_login_banner_text
+ - dconf_gnome_screensaver_idle_delay
+ - dconf_gnome_screensaver_lock_enabled
++- dir_group_ownership_library_dirs
+ - dir_perms_world_writable_root_owned
+ - dir_perms_world_writable_sticky_bits
+ - directory_permissions_var_log_audit
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 97f940dc9ed..943a57d3eb8 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -110,6 +110,7 @@ selections:
+ - dconf_gnome_login_banner_text
+ - dconf_gnome_screensaver_idle_delay
+ - dconf_gnome_screensaver_lock_enabled
++- dir_group_ownership_library_dirs
+ - dir_perms_world_writable_root_owned
+ - dir_perms_world_writable_sticky_bits
+ - directory_permissions_var_log_audit
+
+From 71deac482753a13a9f98d6d7382b13e9031a2ce4 Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Tue, 13 Jul 2021 13:40:25 -0400
+Subject: [PATCH 3/4] Updated test for nobody_group_owned_dir rule
+
+---
+ .../tests/nobody_group_owned_dir_on_lib.fail.sh               | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+index 277bd7d60de..043ad6b2dee 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh
+@@ -1,6 +1,6 @@
+ # platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
+ 
+-DIRS="/lib /lib64"
++DIRS="/lib /lib64 /usr/lib /usr/lib64"
+ for dirPath in $DIRS; do
+-	mkdir -p "$dirPath/testme" && chown root:nogroup "$dirPath/testme"
++	mkdir -p "$dirPath/testme" && chgrp nobody "$dirPath/testme"
+ done
+
+From 087359679e4f6794054b6772df6c84c4cd1fee94 Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Wed, 14 Jul 2021 10:04:25 -0400
+Subject: [PATCH 4/4] Added recommended $ to end of regex pattern to properly
+ match dirs
+
+---
+ .../root_permissions_syslibrary_files/oval/shared.xml           | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+index 926ff70d1e4..f5ca9380b55 100644
+--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/oval/shared.xml
+@@ -16,7 +16,7 @@
+   <unix:file_object comment="system-wide directories" id="root_permissions_for_system_wide_library_files" version="1">
+     <!-- Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
+         are owned by root. -->
+-    <unix:path operation="pattern match">^\/lib\/|^\/lib64\/|^\/usr\/lib\/|^\/usr\/lib64\/</unix:path>
++    <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
+     <unix:filename operation="pattern match">^.*$</unix:filename>
+     <filter action="include">group_permissions_for_system_wide_files_are_not_root</filter>
+   </unix:file_object>

SOURCES/scap-security-guide-0.1.58-rhel8_stig_08_020270-PR_7276.patch

@@ -0,0 +1,120 @@
+From eed29b1db9dd62d014842340abb8601570fe6655 Mon Sep 17 00:00:00 2001
+From: Carlos Matos <cmatos@redhat.com>
+Date: Thu, 22 Jul 2021 14:26:49 -0400
+Subject: [PATCH] New rule for RHEL-08-020270
+
+---
+ .../account_emergency_expire_date/rule.yml    | 52 +++++++++++++++++++
+ products/rhel8/profiles/stig.profile          |  1 +
+ shared/references/cce-redhat-avail.txt        |  1 -
+ .../data/profile_stability/rhel8/stig.profile |  1 +
+ .../profile_stability/rhel8/stig_gui.profile  |  1 +
+ 5 files changed, 55 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
+
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
+new file mode 100644
+index 0000000000..a47c7f39bc
+--- /dev/null
++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
+@@ -0,0 +1,52 @@
++documentation_complete: true
++
++prodtype: fedora,rhel8
++
++title: 'Assign Expiration Date to Emergency Accounts'
++
++description: |-
++    Emergency accounts are privileged accounts established in response to
++    crisis situations where the need for rapid account activation is required.
++    In the event emergency accounts are required, configure the system to
++    terminate them after a documented time period. For every emergency account,
++    run the following command to set an expiration date on it, substituting
++    <tt><i>ACCOUNT_NAME</i></tt> and <tt><i>YYYY-MM-DD</i></tt>
++    appropriately:
++    <pre>$ sudo chage -E <i>YYYY-MM-DD ACCOUNT_NAME</i></pre>
++    <tt><i>YYYY-MM-DD</i></tt> indicates the documented expiration date for the
++    account. For U.S. Government systems, the operating system must be
++    configured to automatically terminate these types of accounts after a
++    period of 72 hours.
++
++rationale: |-
++    If emergency user accounts remain active when no longer needed or for
++    an excessive period, these accounts may be used to gain unauthorized access.
++    To mitigate this risk, automated termination of all emergency accounts
++    must be set upon account creation.
++    <br />
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-85910-8
++
++references:
++    cis-csc: 1,12,13,14,15,16,18,3,5,7,8
++    cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS06.03
++    disa: CCI-000016,CCI-001682
++    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
++    isa-62443-2013: 'SR 1.1,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 6.2'
++    iso27001-2013: A.12.4.1,A.12.4.3,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
++    nist: AC-2(2),AC-2(3),CM-6(a)
++    nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6
++    srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002
++    stigid@rhel8: RHEL-08-020270
++    vmmsrg: SRG-OS-000002-VMM-000020,SRG-OS-000123-VMM-000620
++
++ocil_clause: 'any emergency accounts have no expiration date set or do not expire within a documented time frame'
++
++ocil: |-
++    For every emergency account, run the following command
++    to obtain its account aging and expiration information:
++    <pre>$ sudo chage -l <i>ACCOUNT_NAME</i></pre>
++    Verify each of these accounts has an expiration date set as documented.
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 7270a8f91f..c4b9d02af5 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -558,6 +558,7 @@ selections:
+     - account_disable_post_pw_expiration
+ 
+     # RHEL-08-020270
++    - account_emergency_expire_date
+ 
+     # RHEL-08-020280
+     - accounts_password_pam_ocredit
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 665f903ead..f500179292 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -43,7 +43,6 @@ CCE-85906-6
+ CCE-85907-4
+ CCE-85908-2
+ CCE-85909-0
+-CCE-85910-8
+ CCE-85911-6
+ CCE-85912-4
+ CCE-85913-2
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 7d59cfff62..72e205b695 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -24,6 +24,7 @@ documentation_complete: true
+ reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
+ selections:
+ - account_disable_post_pw_expiration
++- account_emergency_expire_date
+ - account_temp_expire_date
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 2c2daad6f6..cc21621617 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -35,6 +35,7 @@ documentation_complete: true
+ reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
+ selections:
+ - account_disable_post_pw_expiration
++- account_emergency_expire_date
+ - account_temp_expire_date
+ - accounts_have_homedir_login_defs
+ - accounts_logon_fail_delay

SOURCES/scap-security-guide-0.1.58-split_file_ownership_var_log_audit-PR_7129.patch

@@ -0,0 +1,699 @@
+From ad2267a48db738fe69bed6cc009d8be7bbc61c87 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Thu, 17 Jun 2021 17:46:26 +0200
+Subject: [PATCH] Add /var/log/audit individual ownership rules.
+
+---
+ .../bash/shared.sh                            | 12 +++++
+ .../oval/shared.xml                           | 44 +++++++++++++++++++
+ .../rule.yml                                  | 39 ++++++++++++++++
+ .../tests/correct_value.pass.sh               |  5 +++
+ .../correct_value_non-root_group.pass.sh      |  8 ++++
+ .../tests/wrong_value.fail.sh                 |  6 +++
+ .../bash/shared.sh                            |  3 ++
+ .../oval/shared.xml                           | 24 ++++++++++
+ .../rule.yml                                  | 37 ++++++++++++++++
+ .../tests/correct_value.pass.sh               |  3 ++
+ .../tests/wrong_value.fail.sh                 |  4 ++
+ .../bash/shared.sh                            | 12 +++++
+ .../oval/shared.xml                           | 44 +++++++++++++++++++
+ .../rule.yml                                  | 39 ++++++++++++++++
+ .../tests/correct_value.pass.sh               |  5 +++
+ .../correct_value_non-root_group.pass.sh      |  8 ++++
+ .../tests/wrong_value.fail.sh                 |  7 +++
+ .../bash/shared.sh                            |  3 ++
+ .../oval/shared.xml                           | 24 ++++++++++
+ .../rule.yml                                  | 36 +++++++++++++++
+ .../tests/correct_value.pass.sh               |  3 ++
+ .../tests/wrong_value.fail.sh                 |  5 +++
+ products/rhel8/profiles/stig.profile          | 15 +++++--
+ .../oval/auditd_conf_log_group_not_root.xml   | 20 ++++++++-
+ shared/references/cce-redhat-avail.txt        |  4 --
+ .../data/profile_stability/rhel8/stig.profile |  5 ++-
+ .../profile_stability/rhel8/stig_gui.profile  |  5 ++-
+ 27 files changed, 409 insertions(+), 11 deletions(-)
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+ create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
+
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
+new file mode 100644
+index 00000000000..685aa0cf3f2
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/bash/shared.sh
+@@ -0,0 +1,12 @@
++# platform = multi_platform_all
++
++if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
++  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
++  if ! [ "${GROUP}" == 'root' ] ; then
++    chgrp ${GROUP} /var/log/audit
++  else
++    chgrp root /var/log/audit
++  fi
++else
++  chgrp root /var/log/audit
++fi
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
+new file mode 100644
+index 00000000000..4d6eee02a30
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/oval/shared.xml
+@@ -0,0 +1,44 @@
++<def-group>
++  <definition class="compliance" id="directory_group_ownership_var_log_audit" version="1">
++    {{{ oval_metadata("Checks that all /var/log/audit directories are group owned by the root user.") }}}
++    <criteria operator="OR">
++      <criterion test_ref="test_group_ownership_var_log_audit_directories" />
++      <criteria operator="AND" comment="log_group in auditd.conf is not root">
++        <extend_definition comment="log_group in auditd.conf is not root"
++        definition_ref="auditd_conf_log_group_not_root" />
++        <criterion test_ref="test_group_ownership_var_log_audit_directories-non_root" />
++      </criteria>
++    </criteria>
++  </definition>
++  
++  <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_group_ownership_var_log_audit_directories" version="1">
++    <unix:object object_ref="object_group_ownership_var_log_audit_directories" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit directories" id="object_group_ownership_var_log_audit_directories" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename xsi:nil="true" />
++    <filter action="include">state_group_owner_not_root_var_log_audit_directories</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_group_owner_not_root_var_log_audit_directories" version="1" operator="OR">
++    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
++  </unix:file_state>
++
++  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="test_group_ownership_var_log_audit_directories-non_root" version="1">
++    <unix:object object_ref="object_group_ownership_var_log_audit_directories-non_root" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit directories" id="object_group_ownership_var_log_audit_directories-non_root" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename xsi:nil="true" />
++    <filter action="include">state_group_owner_not_root_var_log_audit_directories-non_root</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_group_owner_not_root_var_log_audit_directories-non_root" version="1" operator="OR">
++    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
++  </unix:file_state>
++
++</def-group>
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
+new file mode 100644
+index 00000000000..3915300c106
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml
+@@ -0,0 +1,39 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'System Audit Directories Must Be Group Owned By Root'
++
++description: |-
++    All audit directories must be group owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
++    {{{ describe_file_group_owner(file="/var/log/audit", group="root") }}}
++    If <tt>log_group</tt> in <tt>/etc/audit/auditd.conf</tt> is set to a group other than the <tt>root</tt>
++    group account, change the group ownership of the audit directories to this specific group.
++
++rationale: |-
++    Unauthorized disclosure of audit records can reveal system and configuration data to
++    attackers, thus compromising its confidentiality.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-88225-8
++
++references:
++    cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
++    cjis: 5.4.1.1
++    cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
++    cui: 3.3.1
++    disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
++    isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
++    isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
++    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
++    nist: CM-6(a),AC-6(1),AU-9(4)
++    nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
++    pcidss: Req-10.5.1
++    srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
++    stigid@rhel8: RHEL-08-030110
++
++ocil: |-
++    {{{ describe_file_group_owner(file="/var/log/audit", group="root") }}}
++
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
+new file mode 100644
+index 00000000000..4e68a450c3d
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value.pass.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = root" >> /etc/audit/auditd.conf
++chgrp root /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+new file mode 100644
+index 00000000000..89995b11954
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+@@ -0,0 +1,8 @@
++#!/bin/bash
++
++groupadd group_test
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = group_test" >> /etc/audit/auditd.conf
++
++chgrp group_test /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+new file mode 100644
+index 00000000000..13d22ca8361
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = root" >> /etc/audit/auditd.conf
++groupadd group_test
++chgrp group_test /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
+new file mode 100644
+index 00000000000..de63152c410
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/bash/shared.sh
+@@ -0,0 +1,3 @@
++# platform = multi_platform_all
++
++chown root /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
+new file mode 100644
+index 00000000000..fad17abe39a
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/oval/shared.xml
+@@ -0,0 +1,24 @@
++<def-group>
++  <definition class="compliance" id="directory_ownership_var_log_audit" version="1">
++    {{{ oval_metadata("Checks that all /var/log/audit directories are owned by the root user.") }}}
++    <criteria comment="directories are root owned">
++      <criterion test_ref="test_user_ownership_var_log_audit_directories" />
++    </criteria>
++  </definition>
++  
++  <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_user_ownership_var_log_audit_directories" version="1">
++    <unix:object object_ref="object_user_ownership_var_log_audit_directories" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit directories" id="object_user_ownership_var_log_audit_directories" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename xsi:nil="true" />
++    <filter action="include">state_owner_not_root_var_log_audit_directories</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_owner_not_root_var_log_audit_directories" version="1" operator="OR">
++    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
++  </unix:file_state>
++
++</def-group>
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
+new file mode 100644
+index 00000000000..cd6c45e249b
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml
+@@ -0,0 +1,37 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'System Audit Directories Must Be Owned By Root'
++
++description: |-
++    All audit directories must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
++    {{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
++
++rationale: |-
++    Unauthorized disclosure of audit records can reveal system and configuration data to
++    attackers, thus compromising its confidentiality.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-88226-6
++
++references:
++    cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
++    cjis: 5.4.1.1
++    cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
++    cui: 3.3.1
++    disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
++    isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
++    isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
++    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
++    nist: CM-6(a),AC-6(1),AU-9(4)
++    nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
++    pcidss: Req-10.5.1
++    srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
++    stigid@rhel8: RHEL-08-030100
++
++ocil: |-
++    {{{ describe_file_owner(file="/var/log/audit", owner="root") }}}
++
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
+new file mode 100644
+index 00000000000..fa70fdc9494
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/correct_value.pass.sh
+@@ -0,0 +1,3 @@
++#!/bin/bash
++
++chown root /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
+new file mode 100644
+index 00000000000..f65a1e67241
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/tests/wrong_value.fail.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++
++useradd testuser_123
++chown testuser_123 /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
+new file mode 100644
+index 00000000000..3f53de5ba26
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/bash/shared.sh
+@@ -0,0 +1,12 @@
++# platform = multi_platform_all
++
++if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
++  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
++  if ! [ "${GROUP}" == 'root' ] ; then
++    chgrp ${GROUP} /var/log/audit/audit.log*
++  else
++    chgrp root /var/log/audit/audit.log*
++  fi
++else
++  chgrp root /var/log/audit/audit.log*
++fi
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
+new file mode 100644
+index 00000000000..af5414a6c9c
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/oval/shared.xml
+@@ -0,0 +1,44 @@
++<def-group>
++  <definition class="compliance" id="file_group_ownership_var_log_audit" version="1">
++    {{{ oval_metadata("Checks that all /var/log/audit files are group owned by the root user.") }}}
++    <criteria operator="OR">
++      <criterion comment="files are root group owned" test_ref="test_group_ownership_var_log_audit_files"/>
++      <criteria operator="AND" comment="log_group in auditd.conf is not root">
++        <extend_definition comment="log_group in auditd.conf is not root"
++        definition_ref="auditd_conf_log_group_not_root" />
++        <criterion test_ref="test_group_ownership_var_log_audit_files-non_root" />
++      </criteria>
++    </criteria>
++  </definition>
++  
++  <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files gid root" id="test_group_ownership_var_log_audit_files" version="1">
++    <unix:object object_ref="object_group_ownership_var_log_audit_files" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit files" id="object_group_ownership_var_log_audit_files" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename operation="pattern match">^.*$</unix:filename>
++    <filter action="include">state_group_owner_not_root_var_log_audit</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_group_owner_not_root_var_log_audit" version="1" operator="OR">
++    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
++  </unix:file_state>
++
++  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root " id="test_group_ownership_var_log_audit_files-non_root" version="1">
++    <unix:object object_ref="object_group_ownership_var_log_audit_files-non_root" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit files" id="object_group_ownership_var_log_audit_files-non_root" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename operation="pattern match">^.*$</unix:filename>
++    <filter action="include">state_group_owner_not_root_var_log_audit-non_root</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_group_owner_not_root_var_log_audit-non_root" version="1" operator="OR">
++    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
++  </unix:file_state>
++
++</def-group>
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
+new file mode 100644
+index 00000000000..767c8c89bf7
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml
+@@ -0,0 +1,39 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'System Audit Logs Must Be Group Owned By Root'
++
++description: |-
++    All audit logs must be group owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
++    {{{ describe_file_group_owner(file="/var/log/audit/*", group="root") }}}
++    If <tt>log_group</tt> in <tt>/etc/audit/auditd.conf</tt> is set to a group other than the <tt>root</tt>
++    group account, change the group ownership of the audit logs to this specific group.
++
++rationale: |-
++    Unauthorized disclosure of audit records can reveal system and configuration data to
++    attackers, thus compromising its confidentiality.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-88227-4
++
++references:
++    cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
++    cjis: 5.4.1.1
++    cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
++    cui: 3.3.1
++    disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
++    isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
++    isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
++    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
++    nist: CM-6(a),AC-6(1),AU-9(4)
++    nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
++    pcidss: Req-10.5.1
++    srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
++    stigid@rhel8: RHEL-08-030090
++
++ocil: |-
++    {{{ describe_file_group_owner(file="/var/log/audit/*", group="root") }}}
++
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
+new file mode 100644
+index 00000000000..e4e69bff538
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value.pass.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = root" >> /etc/audit/auditd.conf
++chgrp root /var/log/audit/audit.log*
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+new file mode 100644
+index 00000000000..89995b11954
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/correct_value_non-root_group.pass.sh
+@@ -0,0 +1,8 @@
++#!/bin/bash
++
++groupadd group_test
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = group_test" >> /etc/audit/auditd.conf
++
++chgrp group_test /var/log/audit
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+new file mode 100644
+index 00000000000..37c0f070ae1
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/tests/wrong_value.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++
++sed -i "/\s*log_group.*/d" /etc/audit/auditd.conf
++echo "log_group = root" >> /etc/audit/auditd.conf
++touch /var/log/audit/audit.log.1
++groupadd group_test
++chgrp group_test /var/log/audit/audit.log.1
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
+new file mode 100644
+index 00000000000..ee2364a4a69
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
+@@ -0,0 +1,3 @@
++# platform = multi_platform_all
++
++chown root /var/log/audit/audit.log*
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
+new file mode 100644
+index 00000000000..c20353b5926
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
+@@ -0,0 +1,24 @@
++<def-group>
++  <definition class="compliance" id="file_ownership_var_log_audit_stig" version="1">
++    {{{ oval_metadata("Checks that all /var/log/audit files are owned by the root user.") }}}
++    <criteria comment="files are root owned">
++      <criterion test_ref="test_user_ownership_var_log_audit_files" />
++    </criteria>
++  </definition>
++  
++  <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root" id="test_user_ownership_var_log_audit_files" version="1">
++    <unix:object object_ref="object_user_ownership_var_log_audit_files" />
++  </unix:file_test>
++
++  <unix:file_object comment="/var/log/audit files" id="object_user_ownership_var_log_audit_files" version="1">
++    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
++    <unix:path operation="equals">/var/log/audit</unix:path>
++    <unix:filename operation="pattern match">^.*$</unix:filename>
++    <filter action="include">state_group_user_owner_not_root_var_log_audit</filter>
++  </unix:file_object>
++
++  <unix:file_state id="state_group_user_owner_not_root_var_log_audit" version="1" operator="OR">
++    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
++  </unix:file_state>
++
++</def-group>
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
+new file mode 100644
+index 00000000000..7f895759486
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml
+@@ -0,0 +1,36 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'System Audit Logs Must Be Owned By Root'
++
++description: |-
++    All audit logs must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>.
++    {{{ describe_file_owner(file="/var/log/audit/*", owner="root") }}}
++
++rationale: |-
++    Unauthorized disclosure of audit records can reveal system and configuration data to
++    attackers, thus compromising its confidentiality.
++
++severity: medium
++
++identifiers:
++    cce@rhel8: CCE-88228-2
++
++references:
++    cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
++    cjis: 5.4.1.1
++    cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01
++    cui: 3.3.1
++    disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
++    isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
++    isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
++    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
++    nist: CM-6(a),AC-6(1),AU-9(4)
++    nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
++    pcidss: Req-10.5.1
++    srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
++    stigid@rhel8: RHEL-08-030080
++
++ocil: |-
++    {{{ describe_file_owner(file="/var/log/audit/*", owner="root") }}}
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+new file mode 100644
+index 00000000000..eed3164eb31
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+@@ -0,0 +1,3 @@
++#!/bin/bash
++
++chown root /var/log/audit/audit.log*
+diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
+new file mode 100644
+index 00000000000..32a678562cf
+--- /dev/null
++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++
++touch /var/log/audit/audit.log.1
++useradd testuser_123
++chown testuser_123 /var/log/audit/audit.log.1
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 7270a8f91f2..7d2d386604e 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -625,10 +625,17 @@ selections:
+     # RHEL-08-030070
+     - file_permissions_var_log_audit
+ 
+-    # RHEL-08-030080, RHEL-08-030090, RHEL-08-030100, RHEL-08-030110
+-    ### NOTE: These might get broken up, but currently the following
+-    ### rule accounts for these STIG ID's
+-    - file_ownership_var_log_audit
++    # RHEL-08-030080
++    - file_ownership_var_log_audit_stig
++
++    # RHEL-08-030090
++    - file_group_ownership_var_log_audit
++
++    # RHEL-08-030100
++    - directory_ownership_var_log_audit
++
++    # RHEL-08-030110
++    - directory_group_ownership_var_log_audit
+ 
+     # RHEL-08-030120
+     - directory_permissions_var_log_audit
+diff --git a/shared/checks/oval/auditd_conf_log_group_not_root.xml b/shared/checks/oval/auditd_conf_log_group_not_root.xml
+index 93e47d119ef..2871052796e 100644
+--- a/shared/checks/oval/auditd_conf_log_group_not_root.xml
++++ b/shared/checks/oval/auditd_conf_log_group_not_root.xml
+@@ -8,9 +8,11 @@
+       <description>Verify 'log_group' is not set to 'root' in
+       /etc/audit/auditd.conf.</description>
+     </metadata>
+-    <criteria>
++    <criteria operator="AND">
+       <criterion test_ref="test_auditd_conf_log_group_not_root"
+       comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf" />
++      <criterion test_ref="test_auditd_conf_log_group_is_set"
++      comment="Verify 'log_group' is set in /etc/audit/auditd.conf" />
+     </criteria>
+   </definition>
+ 
+@@ -26,4 +28,20 @@
+     <ind:instance datatype="int">1</ind:instance>
+   </ind:textfilecontent54_object>
+ 
++  <!--
++    By default, log_group is set to root, so we need to make sure something is set
++    to meet this criterion.
++     -->
++  <ind:textfilecontent54_test id="test_auditd_conf_log_group_is_set" check="all"
++  check_existence="all_exist" comment="log_group is set" version="1">
++    <ind:object object_ref="object_auditd_conf_log_group_is_set" />
++  </ind:textfilecontent54_test>
++
++  <ind:textfilecontent54_object id="object_auditd_conf_log_group_is_set"
++  comment="log_group is set" version="1">
++    <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
++    <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind:pattern>
++    <ind:instance datatype="int">1</ind:instance>
++  </ind:textfilecontent54_object>
++
+ </def-group>
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 665f903ead4..b77e9abeb0b 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -2355,10 +2355,6 @@ CCE-88221-7
+ CCE-88222-5
+ CCE-88223-3
+ CCE-88224-1
+-CCE-88225-8
+-CCE-88226-6
+-CCE-88227-4
+-CCE-88228-2
+ CCE-88229-0
+ CCE-88230-8
+ CCE-88231-6
+diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
+index 7d59cfff625..6c97a5a8ca3 100644
+--- a/tests/data/profile_stability/rhel8/stig.profile
++++ b/tests/data/profile_stability/rhel8/stig.profile
+@@ -103,6 +103,8 @@ selections:
+ - dir_group_ownership_library_dirs
+ - dir_perms_world_writable_root_owned
+ - dir_perms_world_writable_sticky_bits
++- directory_group_ownership_var_log_audit
++- directory_ownership_var_log_audit
+ - directory_permissions_var_log_audit
+ - disable_ctrlaltdel_burstaction
+ - disable_ctrlaltdel_reboot
+@@ -113,6 +115,7 @@ selections:
+ - encrypt_partitions
+ - ensure_gpgcheck_globally_activated
+ - ensure_gpgcheck_local_packages
++- file_group_ownership_var_log_audit
+ - file_groupowner_var_log
+ - file_groupowner_var_log_messages
+ - file_groupownership_home_directories
+@@ -121,7 +124,7 @@ selections:
+ - file_owner_var_log_messages
+ - file_ownership_binary_dirs
+ - file_ownership_library_dirs
+-- file_ownership_var_log_audit
++- file_ownership_var_log_audit_stig
+ - file_permission_user_init_files
+ - file_permissions_binary_dirs
+ - file_permissions_etc_audit_auditd
+diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
+index 2c2daad6f6d..d026a40a02b 100644
+--- a/tests/data/profile_stability/rhel8/stig_gui.profile
++++ b/tests/data/profile_stability/rhel8/stig_gui.profile
+@@ -114,6 +114,8 @@ selections:
+ - dir_group_ownership_library_dirs
+ - dir_perms_world_writable_root_owned
+ - dir_perms_world_writable_sticky_bits
++- directory_group_ownership_var_log_audit
++- directory_ownership_var_log_audit
+ - directory_permissions_var_log_audit
+ - disable_ctrlaltdel_burstaction
+ - disable_ctrlaltdel_reboot
+@@ -124,6 +126,7 @@ selections:
+ - encrypt_partitions
+ - ensure_gpgcheck_globally_activated
+ - ensure_gpgcheck_local_packages
++- file_group_ownership_var_log_audit
+ - file_groupowner_var_log
+ - file_groupowner_var_log_messages
+ - file_groupownership_home_directories
+@@ -132,7 +135,7 @@ selections:
+ - file_owner_var_log_messages
+ - file_ownership_binary_dirs
+ - file_ownership_library_dirs
+-- file_ownership_var_log_audit
++- file_ownership_var_log_audit_stig
+ - file_permission_user_init_files
+ - file_permissions_binary_dirs
+ - file_permissions_etc_audit_auditd

SOURCES/scap-security-guide-0.1.58-sshd_directory_config-PR_6926.patch

@@ -0,0 +1,664 @@
+From b951a896d3ef1e678e5d6b580521053e7a076ab0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
+Date: Thu, 29 Apr 2021 16:54:03 +0200
+Subject: [PATCH 1/6] Updated checks and remediations of the sshd template.
+
+Configuration of sshd moves from one config file to a config directory.
+Therefore, checks should consider all those files, and the remediation should aim
+to deliver fixes to one of those files in the config directory.
+
+Tests that interact with this behavior have been added and are applicable for Fedora and RHEL9 products.
+---
+ .../tests/commented.fail.sh                   |  7 ++
+ .../tests/conflict.fail.sh                    | 15 ++++
+ .../tests/correct_value_directory.pass.sh     | 14 ++++
+ shared/macros-bash.jinja                      |  9 +++
+ shared/macros-oval.jinja                      | 61 +++++++++++------
+ .../templates/sshd_lineinfile/bash.template   | 22 ++++++
+ .../templates/sshd_lineinfile/oval.template   | 68 +++++++++++++++++--
+ 7 files changed, 168 insertions(+), 28 deletions(-)
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
+
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
+new file mode 100644
+index 00000000000..484c2165532
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/commented.fail.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++
++if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config; then
++	sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config
++else
++	echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
++fi
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
+new file mode 100644
+index 00000000000..177a99e0b82
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/conflict.fail.sh
+@@ -0,0 +1,15 @@
++#!/bin/bash
++
++# platform = Fedora,Red Hat Enterprise Linux 9
++
++mkdir -p /etc/ssh/sshd_config.d
++touch /etc/ssh/sshd_config.d/nothing
++
++if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
++	sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
++else
++	echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
++fi
++
++echo "PubkeyAuthentication no" > /etc/ssh/sshd_config.d/good_config
++echo "PubkeyAuthentication yes" > /etc/ssh/sshd_config.d/rogue_config
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
+new file mode 100644
+index 00000000000..0aa2e775dbe
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_pubkey_auth/tests/correct_value_directory.pass.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++
++# platform = Fedora,Red Hat Enterprise Linux 9
++
++mkdir -p /etc/ssh/sshd_config.d
++touch /etc/ssh/sshd_config.d/nothing
++
++if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
++	sed -i "s/^PubkeyAuthentication.*/# PubkeyAuthentication no/" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
++else
++	echo "# PubkeyAuthentication no" >> /etc/ssh/sshd_config
++fi
++
++echo "PubkeyAuthentication no" > /etc/ssh/sshd_config.d/correct
+diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
+index 1cd2c62b5e0..b4518d83c19 100644
+--- a/shared/macros-bash.jinja
++++ b/shared/macros-bash.jinja
+@@ -471,6 +471,15 @@ fi
+ LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ path }}}"
+ {{%- endmacro -%}}
+ 
++{{%- macro lineinfile_absent_in_directory(dirname, regex, insensitive=true) -%}}
++    {{%- if insensitive -%}}
++        {{%- set modifier="Id" -%}}
++    {{%- else -%}}
++        {{%- set modifier="d" -%}}
++    {{%- endif -%}}
++LC_ALL=C sed -i "/{{{ regex }}}/{{{ modifier }}}" "{{{ dirname }}}"/*
++{{%- endmacro -%}}
++
+ {{%- macro lineinfile_present(path, line, insert_after="", insert_before="", insensitive=true) -%}}
+     {{%- if insensitive -%}}
+         {{%- set grep_args="-q -m 1 -i" -%}}
+diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
+index be2ac268206..d38db96d9e3 100644
+--- a/shared/macros-oval.jinja
++++ b/shared/macros-oval.jinja
+@@ -92,15 +92,18 @@
+     - parameter (String): The parameter to be checked in the configuration file.
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+ #}}
+-{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
++{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem=rule_id) -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- set prefix_text = "Check the" -%}}
+ {{%- if missing_parameter_pass %}}
+ {{%- set suffix_id = suffix_id_default_not_overriden -%}}
+ {{%- set prefix_text = prefix_text + " absence of" -%}}
+ {{%- endif %}}
+-      <criterion comment="{{{ prefix_text }}} {{{ parameter }}} in {{{ path }}}"
+-      test_ref="test_{{{ rule_id }}}{{{ suffix_id }}}" />
++{{%- if not comment -%}}
++{{%- set comment = prefix_text ~ " " ~ parameter ~ " in " ~ path -%}}
++{{%- endif -%}}
++<criterion comment="{{{ comment }}}"
++  test_ref="test_{{{ id_stem }}}{{{ suffix_id }}}" />
+ {{%- endmacro %}}
+ 
+ {{#
+@@ -110,7 +113,7 @@
+     - parameter (String): The parameter to be checked in the configuration file.
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+ #}}
+-{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false) -%}}
++{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem=rule_id) -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- if missing_parameter_pass %}}
+ {{%- set check_existence = "none_exist" -%}}
+@@ -120,14 +123,14 @@
+ {{%- set check_existence = "all_exist" -%}}
+ {{%- set prefix_text = "value" -%}}
+ {{%- endif %}}
+-  <ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
++<ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
+   comment="tests the {{{ prefix_text }}} of {{{ parameter }}} setting in the {{{ path }}} file"
+-  id="test_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
+-  <ind:object object_ref="obj_{{{ rule_id }}}{{{ suffix_id }}}" />
++  id="test_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
++  <ind:object object_ref="obj_{{{ id_stem }}}{{{ suffix_id }}}" />
+   {{%- if not missing_parameter_pass %}}
+-  <ind:state state_ref="state_{{{ rule_id }}}{{{ suffix_id }}}" />
++  <ind:state state_ref="state_{{{ id_stem }}}{{{ suffix_id }}}" />
+   {{%- endif %}}
+-  </ind:textfilecontent54_test>
++</ind:textfilecontent54_test>
+ {{%- endmacro %}}
+ 
+ {{#
+@@ -141,7 +144,7 @@
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+     - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
+ #}}
+-{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='') -%}}
++{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem=rule_id) -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- if multi_value -%}}
+ {{%- set group_regex = "([^#]*).*$" -%}}
+@@ -173,16 +176,16 @@
+ {{%- set regex = prefix_regex+parameter+separator_regex+group_regex -%}}
+ {{%- endif %}}
+ {{%- endif %}}
+-  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
++<ind:textfilecontent54_object id="obj_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
+ {{%- if filepath_regex %}}
+-    <ind:path>{{{ path }}}</ind:path>
+-    <ind:filename operation="pattern match">{{{ filepath_regex }}}</ind:filename>
++  <ind:path>{{{ path }}}</ind:path>
++  <ind:filename operation="pattern match">{{{ filepath_regex }}}</ind:filename>
+ {{%- else %}}
+-    <ind:filepath>{{{ path }}}</ind:filepath>
++  <ind:filepath>{{{ path }}}</ind:filepath>
+ {{%- endif %}}
+-    <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
+-    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
+-  </ind:textfilecontent54_object>
++  <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
++  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
++</ind:textfilecontent54_object>
+ {{%- endmacro %}}
+ 
+ {{#
+@@ -193,7 +196,7 @@
+     - quotes (String): If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.
+       For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
+ #}}
+-{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='') -%}}
++{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem=rule_id) -%}}
+ {{%- set regex = value -%}}
+ {{%- if quotes != "" %}}
+ {{%- if "\\1" in value > 0 %}}
+@@ -206,9 +209,25 @@
+ {{%- else %}}
+ {{%- set regex = "^"+regex+"$" -%}}
+ {{%- endif %}}
+-  <ind:textfilecontent54_state id="state_{{{ rule_id }}}" version="1">
+-    <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
+-  </ind:textfilecontent54_state>
++<ind:textfilecontent54_state id="state_{{{ id_stem }}}" version="1">
++  <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
++</ind:textfilecontent54_state>
++{{%- endmacro %}}
++
++{{%- macro oval_line_in_directory_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
++{{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") -}}}
++{{%- endmacro %}}
++
++{{%- macro oval_line_in_directory_test(path='', parameter='', missing_parameter_pass=false) -%}}
++{{{ oval_line_in_file_test(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") }}}
++{{%- endmacro %}}
++
++{{%- macro oval_line_in_directory_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false) -%}}
++{{{- oval_line_in_file_object(path=path, section=section, prefix_regex=prefix_regex, parameter=parameter, separator_regex=separator_regex, missing_parameter_pass=missing_parameter_pass, multi_value=multi_value, filepath_regex=".*", id_stem=rule_id ~ "_config_dir") -}}}
++{{%- endmacro %}}
++
++{{%- macro oval_line_in_directory_state(value='', multi_value='', quotes='') -%}}
++{{{- oval_line_in_file_state(value, multi_value, quotes, id_stem=rule_id ~ "_config_dir") -}}}
+ {{%- endmacro %}}
+ 
+ {{#
+diff --git a/shared/templates/sshd_lineinfile/bash.template b/shared/templates/sshd_lineinfile/bash.template
+index ca1b512bb3d..eac758e310b 100644
+--- a/shared/templates/sshd_lineinfile/bash.template
++++ b/shared/templates/sshd_lineinfile/bash.template
+@@ -3,4 +3,26 @@
+ # strategy = restrict
+ # complexity = low
+ # disruption = low
++{{%- if product in ("fedora", "rhel9") %}}
++{{%- set prefix_regex = "^\s*" -%}}
++{{%- set separator_regex = "\s\+" -%}}
++{{%- set line_regex = prefix_regex ~ PARAMETER ~ separator_regex %}}
++mkdir -p /etc/ssh/sshd_config.d
++touch /etc/ssh/sshd_config.d/hardening
++{{{ lineinfile_absent("/etc/ssh/sshd_config", line_regex, insensitive=true) }}}
++{{{ lineinfile_absent_in_directory("/etc/ssh/sshd_config.d", line_regex, insensitive=true) }}}
++{{{ set_config_file(
++        path="/etc/ssh/sshd_config.d/hardening",
++        parameter=PARAMETER,
++        value=VALUE,
++        create=true,
++        insert_after="",
++        insert_before="^Match",
++        insensitive=true,
++        separator=" ",
++        separator_regex=separator_regex,
++        prefix_regex=prefix_regex)
++    }}}
++{{%- else %}}
+ {{{ bash_sshd_config_set(parameter=PARAMETER, value=VALUE) }}}
++{{%- endif %}}
+diff --git a/shared/templates/sshd_lineinfile/oval.template b/shared/templates/sshd_lineinfile/oval.template
+index df63d542505..2cc38776eb2 100644
+--- a/shared/templates/sshd_lineinfile/oval.template
++++ b/shared/templates/sshd_lineinfile/oval.template
+@@ -1,7 +1,61 @@
+-{{{
+-oval_sshd_config(
+-	parameter=PARAMETER,
+-	value=VALUE,
+-	missing_parameter_pass=MISSING_PARAMETER_PASS
+-)
+-}}}
++{{%- set config_path = "/etc/ssh/sshd_config" %}}
++{{%- set config_dir = "/etc/ssh/sshd_config.d" -%}}
++{{%- set products_with_distributed_configuration = ("rhel9", "fedora") -%}}
++{{%- set description = "Ensure '" ~ PARAMETER ~ "' is configured with value '" ~ VALUE ~ "' in " ~ config_path %}}
++{{%- if product in products_with_distributed_configuration %}}
++{{%- set description = description  ~ " and in " ~ config_dir -%}}
++{{%- endif %}}
++{{%- set case_insensitivity_kwargs = dict(prefix_regex="^[ \\t]*(?i)", separator_regex = "(?-i)[ \\t]+") -%}}
++
++<def-group>
++  <definition class="compliance" id="{{{ rule_id }}}" version="1">
++   {{{ oval_metadata(description) }}}
++   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
++     <criteria comment="sshd is not installed" operator="AND">
++        <extend_definition comment="sshd is not required or requirement is unset"
++          definition_ref="sshd_not_required_or_unset" />
++        <extend_definition comment="rpm package openssh-server removed"
++          definition_ref="package_openssh-server_removed" />
++     </criteria>
++     <criteria comment="sshd is installed and configured" operator="AND">
++        <extend_definition comment="sshd is required or requirement is unset"
++          definition_ref="sshd_required_or_unset" />
++        <extend_definition comment="rpm package openssh-server installed"
++          definition_ref="package_openssh-server_installed" />
++        <criteria comment="sshd is configured correctly" operator="OR">
++          {{{- oval_line_in_file_criterion(config_path, PARAMETER) | indent(8) }}}
++          {{%- if MISSING_PARAMETER_PASS %}}
++          <criteria comment="sshd is not configured incorrectly" operator="AND">
++          {{{- oval_line_in_file_criterion(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(10)}}}
++          {{%- if product in products_with_distributed_configuration %}}
++          {{{- oval_line_in_directory_criterion(config_dir, PARAMETER, MISSING_PARAMETER_PASS) | indent(10) }}}
++          {{%- endif %}}
++          </criteria>
++          {{%- endif %}}
++          {{%- if product in products_with_distributed_configuration %}}
++          {{{- oval_line_in_directory_criterion(config_dir, PARAMETER) | indent(8) }}}
++          {{%- endif %}}
++        </criteria>
++      </criteria>
++    </criteria> 
++  </definition>
++  {{{ oval_line_in_file_test(config_path, PARAMETER) | indent (2) }}}
++  {{{ oval_line_in_file_object(config_path, parameter=PARAMETER, ** case_insensitivity_kwargs)| indent (2) }}}
++  {{{ oval_line_in_file_state(VALUE) | indent (2) }}}
++
++  {{%- if MISSING_PARAMETER_PASS %}}
++  {{{ oval_line_in_file_test(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(2) }}}
++  {{{ oval_line_in_file_object(config_path, parameter=PARAMETER, missing_parameter_pass=MISSING_PARAMETER_PASS, ** case_insensitivity_kwargs) | indent(2) }}}
++  {{%- endif %}}
++
++  {{%- if product in products_with_distributed_configuration %}}
++  {{{ oval_line_in_directory_test(config_dir, PARAMETER) | indent (2) }}}
++  {{{ oval_line_in_directory_object(config_dir, parameter=PARAMETER, ** case_insensitivity_kwargs) | indent (2) }}}
++  {{{ oval_line_in_directory_state(VALUE) | indent (2) }}}
++
++  {{%- if MISSING_PARAMETER_PASS %}}
++  {{{ oval_line_in_directory_test(config_path, PARAMETER, MISSING_PARAMETER_PASS) | indent(2) }}}
++  {{{ oval_line_in_directory_object(config_path, parameter=PARAMETER, missing_parameter_pass=MISSING_PARAMETER_PASS, ** case_insensitivity_kwargs) | indent(2) }}}
++  {{%- endif %}}
++  {{%- endif %}}
++</def-group>
+
+From b0f86c11fa0fb45b32b53833b5d3565c7eb73cfe Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
+Date: Fri, 30 Apr 2021 11:52:22 +0200
+Subject: [PATCH 2/6] Improved the lineinfile template.
+
+It now escapes the text contents if parts of them could be incorrectly interpreted as regexes.
+---
+ shared/macros-bash.jinja                  | 2 +-
+ shared/templates/lineinfile/oval.template | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja
+index b4518d83c19..d654a0e0e89 100644
+--- a/shared/macros-bash.jinja
++++ b/shared/macros-bash.jinja
+@@ -445,7 +445,7 @@ printf '%s\n' "{{{ message | replace('"', '\\"') }}}" >&2
+ # prefix_regex: regular expression describing allowed leading characters at each line
+ #}}
+ {{%- macro set_config_file(path, parameter, value, create, insert_after, insert_before, insensitive=true, separator=" ", separator_regex="\s\+", prefix_regex="^\s*") -%}}
+-    {{%- set line_regex = prefix_regex+parameter+separator_regex -%}}
++    {{%- set line_regex = prefix_regex + ((parameter | escape_regex) | replace("/", "\/")) + separator_regex -%}}
+     {{%- set new_line = parameter+separator+value -%}}
+ if [ -e "{{{ path }}}" ] ; then
+     {{{ lineinfile_absent(path, line_regex, insensitive) | indent(4) }}}
+diff --git a/shared/templates/lineinfile/oval.template b/shared/templates/lineinfile/oval.template
+index a38856d9177..644327b7d6e 100644
+--- a/shared/templates/lineinfile/oval.template
++++ b/shared/templates/lineinfile/oval.template
+@@ -1,4 +1,4 @@
+-{{%- set regex = "^[\s]*" + TEXT + "[\s]*$" -%}}
++{{%- set regex = "^[\s]*" ~ (TEXT | escape_regex) ~ "[\s]*$" -%}}
+ <def-group>
+   <definition class="compliance" id="{{{ rule_id }}}" version="1">
+     {{{ oval_metadata("Check presence of " + TEXT + " in " + PATH) }}}
+
+From 6953f74d1ab168e7ccc3f28877621edff317fef2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
+Date: Fri, 30 Apr 2021 11:54:12 +0200
+Subject: [PATCH 3/6] Introduced the sshd_use_directory_configuration rule.
+
+The rule makes sure that the sshd configuration is distributed in the
+/etc/ssh/sshd_config.d/ directory, and therefore it makes sense to scan that directory
+in another rules.
+---
+ .../bash/shared.sh                            | 15 ++++++++++
+ .../oval/shared.xml                           | 29 +++++++++++++++++++
+ .../sshd_use_directory_configuration/rule.yml | 26 +++++++++++++++++
+ .../tests/match.fail.sh                       |  4 +++
+ .../tests/simple.fail.sh                      |  3 ++
+ .../tests/simple.pass.sh                      |  4 +++
+ shared/references/cce-redhat-avail.txt        |  1 -
+ shared/templates/extra_ovals.yml              |  6 ++++
+ 8 files changed, 87 insertions(+), 1 deletion(-)
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
+ create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
+
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+new file mode 100644
+index 00000000000..2ff58ec373c
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+@@ -0,0 +1,15 @@
++# platform = multi_platform_all
++
++{{% set target_file = "/etc/ssh/sshd_config.d/sshd_config_original.conf" -%}}
++if test -f {{{ target_file}}}; then
++	{{{ die("Remediation probably already happened, '" ~ target_file ~ "' already exists, not doing anything.", action="false") }}}
++else
++	mkdir -p /etc/ssh/sshd_config.d
++	mv /etc/ssh/sshd_config {{{ target_file }}}
++cat > /etc/ssh/sshd_config << EOF
++# To modify the system-wide sshd configuration, create a  *.conf  file under
++#  /etc/ssh/sshd_config.d/  which will be automatically included below
++
++Include /etc/ssh/sshd_config.d/*.conf
++EOF
++fi
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
+new file mode 100644
+index 00000000000..0ffb429adff
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/oval/shared.xml
+@@ -0,0 +1,29 @@
++{{%- set config_path = "/etc/ssh/sshd_config" %}}
++
++<def-group>
++  <definition class="compliance" id="{{{ rule_id }}}" version="1">
++   {{{ oval_metadata("foo") }}}
++   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
++     <criteria comment="sshd is not installed" operator="AND">
++        <extend_definition comment="sshd is not required or requirement is unset"
++          definition_ref="sshd_not_required_or_unset" />
++        <extend_definition comment="rpm package openssh-server removed"
++          definition_ref="package_openssh-server_removed" />
++     </criteria>
++     <criteria comment="sshd is installed and configured" operator="AND">
++        <extend_definition comment="sshd is required or requirement is unset"
++          definition_ref="sshd_required_or_unset" />
++        <extend_definition comment="rpm package openssh-server installed"
++          definition_ref="package_openssh-server_installed" />
++        <criteria comment="sshd is configured correctly" operator="AND">
++          <extend_definition comment="sshd includes config files from its .d directory"
++            definition_ref="sshd_includes_config_files" />
++          {{{- oval_line_in_file_criterion(config_path, "match", missing_parameter_pass=true) | indent(8) }}}
++        </criteria>
++      </criteria>
++    </criteria> 
++  </definition>
++  {{{ oval_line_in_file_test(config_path, "match", missing_parameter_pass=true) | indent (2) }}}
++  {{{ oval_line_in_file_object(config_path, parameter="match", missing_parameter_pass=true, prefix_regex="^[ \\t]*(?i)", separator_regex="(?-i)\s+\S+") | indent (2) }}}
++</def-group>
++
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
+new file mode 100644
+index 00000000000..8c370036e61
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/rule.yml
+@@ -0,0 +1,26 @@
++documentation_complete: true
++
++prodtype: fedora,rhel9
++
++title: 'Distribute the SSH Server configuration to multiple files in a config directory.'
++
++description: |-
++    Make sure to have the <tt>Include /etc/ssh/sshd_config.d/*.conf</tt> line in the <tt>/etc/ssh/sshd_config</tt> file.
++    Ideally, don't have any active configuration directives in that file, and distribute the service configuration
++    to several files in the <tt>/etc/ssh/sshd_config.d</tt> directory.
++
++rationale: |-
++    This form of distributed configuration is considered as a good practice, and as other sshd rules assume that directives in files in the <tt>/etc/ssh/sshd_config.d</tt> config directory are effective, there has to be a rule that ensures this.
++    Aside from that, having multiple configuration files makes the SSH Server configuration changes easier to partition according to the reason that they were introduced, and therefore it should help to perform merges of hardening updates.
++
++severity: medium
++
++identifiers:
++    cce@rhel9: CCE-87681-3
++
++ocil_clause: "you don't include other configuration files from the main configuration file"
++
++ocil: |-
++    To determine whether the SSH server includes configuration files from the right directory, run the following command:
++    <pre>$ sudo grep -i '^Include' /etc/ssh/sshd_config</pre>
++    If a line <tt>Include /etc/ssh/sshd_config.d/*.conf</tt> is returned, then the configuration file inclusion is set correctly.
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
+new file mode 100644
+index 00000000000..fa2ee0654f2
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/match.fail.sh
+@@ -0,0 +1,4 @@
++# platform = multi_platform_all
++
++echo "Match something" >> /etc/ssh/sshd_config
++echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
+new file mode 100644
+index 00000000000..a6013ad7cfa
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.fail.sh
+@@ -0,0 +1,3 @@
++# platform = multi_platform_all
++
++echo "include /etc/ssh/sshd_config.d/.*" > /etc/ssh/sshd_config
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
+new file mode 100644
+index 00000000000..7a26f521415
+--- /dev/null
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/tests/simple.pass.sh
+@@ -0,0 +1,4 @@
++# platform = multi_platform_all
++
++# Handling of case-insensitivity of include is tricky
++echo "Include /etc/ssh/sshd_config.d/*.conf" > /etc/ssh/sshd_config
+diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
+index 73d025484e6..40a2b9b5868 100644
+--- a/shared/references/cce-redhat-avail.txt
++++ b/shared/references/cce-redhat-avail.txt
+@@ -1780,7 +1780,6 @@ CCE-87677-1
+ CCE-87678-9
+ CCE-87679-7
+ CCE-87680-5
+-CCE-87681-3
+ CCE-87682-1
+ CCE-87683-9
+ CCE-87684-7
+diff --git a/shared/templates/extra_ovals.yml b/shared/templates/extra_ovals.yml
+index 095d911ee1c..69062ebe541 100644
+--- a/shared/templates/extra_ovals.yml
++++ b/shared/templates/extra_ovals.yml
+@@ -57,3 +57,9 @@ service_syslog_disabled:
+   vars:
+     servicename: syslog
+     packagename: rsyslog
++
++sshd_includes_config_files:
++  name: lineinfile
++  vars:
++    path: /etc/ssh/sshd_config
++    text: "Include /etc/ssh/sshd_config.d/*.conf"
+
+From d7fcab7ad66e77bb7ccba507e3f024bc892c3864 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
+Date: Tue, 11 May 2021 16:06:29 +0200
+Subject: [PATCH 4/6] Improved error reporting related to macros.
+
+---
+ ssg/jinja.py | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/ssg/jinja.py b/ssg/jinja.py
+index a46246ad0fb..28edd9a6dcd 100644
+--- a/ssg/jinja.py
++++ b/ssg/jinja.py
+@@ -153,16 +153,20 @@ def load_macros(substitutions_dict=None):
+ 
+     add_python_functions(substitutions_dict)
+     try:
+-        update_substitutions_dict(JINJA_MACROS_BASE_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_HIGHLEVEL_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_ANSIBLE_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_BASH_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_OVAL_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_IGNITION_DEFINITIONS, substitutions_dict)
+-        update_substitutions_dict(JINJA_MACROS_KUBERNETES_DEFINITIONS, substitutions_dict)
++        filenames = [
++            JINJA_MACROS_BASE_DEFINITIONS,
++            JINJA_MACROS_HIGHLEVEL_DEFINITIONS,
++            JINJA_MACROS_ANSIBLE_DEFINITIONS,
++            JINJA_MACROS_BASH_DEFINITIONS,
++            JINJA_MACROS_OVAL_DEFINITIONS,
++            JINJA_MACROS_IGNITION_DEFINITIONS,
++            JINJA_MACROS_KUBERNETES_DEFINITIONS,
++        ]
++        for filename in filenames:
++            update_substitutions_dict(filename, substitutions_dict)
+     except Exception as exc:
+-        msg = ("Error extracting macro definitions: {0}"
+-               .format(str(exc)))
++        msg = ("Error extracting macro definitions from '{1}': {0}"
++               .format(str(exc), filename))
+         raise RuntimeError(msg)
+ 
+     return substitutions_dict
+
+From df45c3fa295a2dc5a23cc347657964df6453cbae Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
+Date: Tue, 11 May 2021 16:44:50 +0200
+Subject: [PATCH 5/6] Removed devault values that are variables from Jinja
+
+Support in older jinja2 packages is not in a good shape.
+---
+ shared/macros-oval.jinja | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
+index d38db96d9e3..87e0fd7d87d 100644
+--- a/shared/macros-oval.jinja
++++ b/shared/macros-oval.jinja
+@@ -92,7 +92,8 @@
+     - parameter (String): The parameter to be checked in the configuration file.
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+ #}}
+-{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem=rule_id) -%}}
++{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem='') -%}}
++{{%- set id_stem = id_stem or rule_id -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- set prefix_text = "Check the" -%}}
+ {{%- if missing_parameter_pass %}}
+@@ -113,7 +114,8 @@
+     - parameter (String): The parameter to be checked in the configuration file.
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+ #}}
+-{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem=rule_id) -%}}
++{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem='') -%}}
++{{%- set id_stem = id_stem or rule_id -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- if missing_parameter_pass %}}
+ {{%- set check_existence = "none_exist" -%}}
+@@ -144,7 +146,8 @@
+     - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
+     - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
+ #}}
+-{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem=rule_id) -%}}
++{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filepath_regex='', id_stem='') -%}}
++{{%- set id_stem = id_stem or rule_id -%}}
+ {{%- set suffix_id = "" -%}}
+ {{%- if multi_value -%}}
+ {{%- set group_regex = "([^#]*).*$" -%}}
+@@ -196,7 +199,8 @@
+     - quotes (String): If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.
+       For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
+ #}}
+-{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem=rule_id) -%}}
++{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem='') -%}}
++{{%- set id_stem = id_stem or rule_id -%}}
+ {{%- set regex = value -%}}
+ {{%- if quotes != "" %}}
+ {{%- if "\\1" in value > 0 %}}
+
+From a3ec49f75ac3059d7096985e08e10005db96330a Mon Sep 17 00:00:00 2001
+From: Matej Tyc <matyc@redhat.com>
+Date: Fri, 30 Jul 2021 17:25:25 +0200
+Subject: [PATCH 6/6] Don't remediate when it is inappropriate
+
+Don't remediate when the config file already contains the include
+directive.
+---
+ .../sshd_use_directory_configuration/bash/shared.sh        | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+index 2ff58ec373c..9317b23992d 100644
+--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_directory_configuration/bash/shared.sh
+@@ -1,12 +1,15 @@
+ # platform = multi_platform_all
+ 
+ {{% set target_file = "/etc/ssh/sshd_config.d/sshd_config_original.conf" -%}}
++{{% set base_config = "/etc/ssh/sshd_config" -%}}
+ if test -f {{{ target_file}}}; then
+ 	{{{ die("Remediation probably already happened, '" ~ target_file ~ "' already exists, not doing anything.", action="false") }}}
++elif grep -Eq '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf' {{{ base_config }}} && ! grep -Eq '^\s*Match\s' {{{ base_config }}}; then
++	{{{ die("Remediation probably already happened, '" ~ base_config ~ "' already contains the include directive.", action="false") }}}
+ else
+ 	mkdir -p /etc/ssh/sshd_config.d
+-	mv /etc/ssh/sshd_config {{{ target_file }}}
+-cat > /etc/ssh/sshd_config << EOF
++	mv {{{ base_config }}} {{{ target_file }}}
++cat > {{{ base_config }}} << EOF
+ # To modify the system-wide sshd configuration, create a  *.conf  file under
+ #  /etc/ssh/sshd_config.d/  which will be automatically included below
+ 

SOURCES/scap-security-guide-0.1.58-tests_for_playbooks_that_change_banners-PR_7376.patch

@@ -0,0 +1,524 @@
+From bf018e9f8327b231b967db8ec74fabf01802b6a8 Mon Sep 17 00:00:00 2001
+From: Watson Sato <wsato@redhat.com>
+Date: Wed, 11 Aug 2021 09:45:04 +0200
+Subject: [PATCH 1/3] Add test for ansible files removed and readded
+
+Check if any playbook removes a file and then add it back again.
+The file removal is based on the 'file' module with 'state: absent', and
+the reintroduction of the file is based on 'lineinfile', 'blockinfile'
+and 'copy' modules.
+---
+ CMakeLists.txt                               |  2 +
+ tests/CMakeLists.txt                         |  8 ++
+ tests/test_ansible_file_removed_and_added.py | 97 ++++++++++++++++++++
+ 3 files changed, 107 insertions(+)
+ create mode 100644 tests/test_ansible_file_removed_and_added.py
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 330b869d0f9..e41f2caa630 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -129,6 +129,7 @@ find_python_module(jinja2 REQUIRED)
+ find_python_module(pytest)
+ find_python_module(pytest_cov)
+ find_python_module(json2html)
++find_python_module(yamlpath)
+ 
+ # sphinx documentation requirements
+ find_python_module(sphinx)
+@@ -231,6 +232,7 @@ message(STATUS "python pytest module (optional): ${PY_PYTEST}")
+ message(STATUS "ansible-playbook module (optional): ${ANSIBLE_PLAYBOOK_EXECUTABLE}")
+ message(STATUS "ansible-lint module (optional): ${ANSIBLE_LINT_EXECUTABLE}")
+ message(STATUS "yamllint module (optional): ${YAMLLINT_EXECUTABLE}")
++message(STATUS "yamlpath module (optional): ${PY_YAMLPATH}")
+ message(STATUS "BATS framework (optional): ${BATS_EXECUTABLE}")
+ message(STATUS "python sphinx module (optional): ${PY_SPHINX}")
+ message(STATUS "python sphinxcontrib.autojinja module (optional): ${PY_SPHINXCONTRIB.AUTOJINJA}")
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 3e2d8a4ec31..739cc124035 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -121,3 +121,11 @@ add_test(
+ )
+ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
+ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
++
++if (PY_YAMLPATH)
++    add_test(
++        NAME "ansible-file-removed-and-added"
++        COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
++    )
++    set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
++endif()
+diff --git a/tests/test_ansible_file_removed_and_added.py b/tests/test_ansible_file_removed_and_added.py
+new file mode 100644
+index 00000000000..23f6f888bda
+--- /dev/null
++++ b/tests/test_ansible_file_removed_and_added.py
+@@ -0,0 +1,97 @@
++#!/usr/bin/python3
++
++import argparse
++import os
++import sys
++from types import SimpleNamespace
++from yamlpath import Processor
++from yamlpath import YAMLPath
++from yamlpath.common import Parsers
++from yamlpath.exceptions import YAMLPathException
++from yamlpath.wrappers import ConsolePrinter
++
++
++def parse_command_line_args():
++    parser = argparse.ArgumentParser(
++        description="Checks if an Ansible Playbook removes a file and then adds it again.")
++    parser.add_argument("--ansible_dir", required=True,
++                        help="Directory containing Ansible Playbooks")
++    args = parser.parse_args()
++    return args
++
++
++def check_playbook_file_removed_and_added(playbook_path):
++    playbook_ok = True
++
++    yaml_parser = Parsers.get_yaml_editor()
++
++    logging_args = SimpleNamespace(quiet=False, verbose=False, debug=False)
++    log = ConsolePrinter(logging_args)
++
++    # Find every path removed by a file Task (also matches tasks within blocks)
++    files_absent_string = "tasks.**.file[state=absent][parent()].path"
++    files_absent_yamlpath = YAMLPath(files_absent_string)
++    path_editing_tasks_yamlpath = ""
++
++    log.info("Info: Evaluating playbook '{}'".format(playbook_path))
++    (yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml_parser, log, playbook_path)
++    if not doc_loaded:
++        # There was an issue loading the file; an error message has already been
++        # printed via ConsolePrinter.
++        return False
++
++    processor = Processor(log, yaml_data)
++    try:
++        for node in processor.get_nodes(files_absent_yamlpath, mustexist=False):
++            path = str(node)
++            # 'node' is a NodeCoords.
++            if path == 'None':
++                continue
++            elif "{{" in path:
++                # Identified path is a Jinja expression, unfortunately there is no easy way to get
++                # the actual path without making this test very complicated
++                continue
++
++            # Check if this paths is used in any of the following ansible modules
++            ansible_modules = ["lineinfile", "blockinfile", "copy"]
++            path_editing_tasks_string = "tasks.**.[.=~/{modules}/][*='{path}'][parent()].name"
++            path_editing_tasks_yamlpath = YAMLPath(path_editing_tasks_string.format(
++                modules="|".join(ansible_modules),
++                path=node)
++                )
++            for task in processor.get_nodes(path_editing_tasks_yamlpath, mustexist=False):
++                log.info("Error: Task '{}' manipulates a file that is removed by another task"
++                         .format(task))
++                playbook_ok = False
++    except YAMLPathException as ex:
++        no_file_msg = ("Cannot add PathSegmentTypes.TRAVERSE subreference to lists at 'None' "
++                       "in '{}'.")
++        if str(ex) == no_file_msg.format(files_absent_string):
++            log.info("Info: Playbook {} has no 'file' tasks.".format(playbook_path))
++        elif path_editing_tasks_yamlpath and str(ex) == no_file_msg.format(
++                path_editing_tasks_yamlpath):
++            log.info("Info: Playbook {} has no '{}' tasks.".format(
++                playbook_path, " ".join(ansible_modules)))
++        else:
++            log.info("Error: {}.".format(ex))
++
++    return playbook_ok
++
++
++def main():
++    args = parse_command_line_args()
++
++    all_playbooks_ok = True
++    for dir_item in os.listdir(args.ansible_dir):
++        if dir_item.endswith(".yml"):
++            playbook_path = os.path.join(args.ansible_dir, dir_item)
++
++            if not check_playbook_file_removed_and_added(playbook_path):
++                all_playbooks_ok = False
++
++    if not all_playbooks_ok:
++        sys.exit(1)
++
++
++if __name__ == "__main__":
++    main()
+
+From e6d727762ba446cad94f1e002fa7a7fef0f1a4cb Mon Sep 17 00:00:00 2001
+From: Watson Sato <wsato@redhat.com>
+Date: Wed, 11 Aug 2021 09:48:14 +0200
+Subject: [PATCH 2/3] Unit tests the function for file removed and added
+
+Add a unit test for the core function that checks if any playbook
+removes a file and then reintroduces it back.
+---
+ tests/CMakeLists.txt                          |  6 ++
+ .../file_block_removed_and_added.yml          | 69 +++++++++++++++++++
+ .../file_not_removed_and_added.yml            | 49 +++++++++++++
+ .../file_removed_and_added.yml                | 62 +++++++++++++++++
+ .../file_removed_and_not_added.yml            | 46 +++++++++++++
+ ...t_check_playbook_file_removed_and_added.py | 39 +++++++++++
+ 6 files changed, 271 insertions(+)
+ create mode 100644 tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
+ create mode 100644 tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
+ create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_added.yml
+ create mode 100644 tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
+ create mode 100644 tests/test_check_playbook_file_removed_and_added.py
+
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 739cc124035..000a1b1385d 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -123,6 +123,12 @@ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES LABELS quick)
+ set_tests_properties("fix_rules-sort_subkeys" PROPERTIES DEPENDS "test-rule-dir-json")
+ 
+ if (PY_YAMLPATH)
++    if (PY_PYTEST)
++        add_test(
++            NAME "test-function-check_playbook_file_removed_and_added"
++            COMMAND "${PYTHON_EXECUTABLE}" -m pytest ${PYTEST_COVERAGE_OPTIONS} "${CMAKE_CURRENT_SOURCE_DIR}/test_check_playbook_file_removed_and_added.py"
++        )
++    endif()
+     add_test(
+         NAME "ansible-file-removed-and-added"
+         COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/test_ansible_file_removed_and_added.py" --ansible_dir "${CMAKE_BINARY_DIR}/ansible"
+diff --git a/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
+new file mode 100644
+index 00000000000..8863b333129
+--- /dev/null
++++ b/tests/ansible_file_removed_and_added/file_block_removed_and_added.yml
+@@ -0,0 +1,69 @@
++---
++
++- hosts: all
++  vars:
++    var_system_crypto_policy: !!str FUTURE
++    var_sudo_logfile: !!str /var/log/sudo.log
++
++  tasks:
++    - name: Modify the System Login Banner - add correct banner
++      lineinfile:
++        dest: /etc/issue
++        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
++          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
++          "\n") | regex_replace("\\", "") | wordwrap() }}'
++        create: true
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Test for existence /etc/issue
++      stat:
++        path: /etc/issue
++      register: file_exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - name: Ensure permission 0644 on /etc/issue
++      file:
++        path: /etc/issue
++        mode: '0644'
++      when: file_exists.stat is defined and file_exists.stat.exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - block:
++
++        - name: Remove Rsh Trust Files
++          file:
++            path: /root/shosts.equiv
++            state: absent
++
++        - name: Add line to /root/shosts.equiv
++          lineinfile:
++            dest: /root/shosts.equiv
++            line: 'test host'
++            create: true
++      tags:
++        - high_severity
++        - low_complexity
++        - low_disruption
++        - no_reboot_needed
++        - no_rsh_trust_files
++        - restrict_strategy
++
+diff --git a/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
+new file mode 100644
+index 00000000000..3d3e53b958f
+--- /dev/null
++++ b/tests/ansible_file_removed_and_added/file_not_removed_and_added.yml
+@@ -0,0 +1,49 @@
++---
++
++- hosts: all
++  vars:
++    var_system_crypto_policy: !!str FUTURE
++    var_sudo_logfile: !!str /var/log/sudo.log
++
++  tasks:
++    - name: Modify the System Login Banner - add correct banner
++      lineinfile:
++        dest: /etc/issue
++        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
++          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
++          "\n") | regex_replace("\\", "") | wordwrap() }}'
++        create: true
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Test for existence /etc/issue
++      stat:
++        path: /etc/issue
++      register: file_exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - name: Ensure permission 0644 on /etc/issue
++      file:
++        path: /etc/issue
++        mode: '0644'
++      when: file_exists.stat is defined and file_exists.stat.exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
+diff --git a/tests/ansible_file_removed_and_added/file_removed_and_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
+new file mode 100644
+index 00000000000..a44c39a9db2
+--- /dev/null
++++ b/tests/ansible_file_removed_and_added/file_removed_and_added.yml
+@@ -0,0 +1,62 @@
++---
++
++- hosts: all
++  vars:
++    var_system_crypto_policy: !!str FUTURE
++    var_sudo_logfile: !!str /var/log/sudo.log
++
++  tasks:
++    - name: Modify the System Login Banner - remove incorrect banner
++      file:
++        state: absent
++        path: /etc/issue
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Modify the System Login Banner - add correct banner
++      lineinfile:
++        dest: /etc/issue
++        line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
++          "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
++          "\n") | regex_replace("\\", "") | wordwrap() }}'
++        create: true
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Test for existence /etc/issue
++      stat:
++        path: /etc/issue
++      register: file_exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - name: Ensure permission 0644 on /etc/issue
++      file:
++        path: /etc/issue
++        mode: '0644'
++      when: file_exists.stat is defined and file_exists.stat.exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
+diff --git a/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
+new file mode 100644
+index 00000000000..08cda7e5063
+--- /dev/null
++++ b/tests/ansible_file_removed_and_added/file_removed_and_not_added.yml
+@@ -0,0 +1,46 @@
++---
++
++- hosts: all
++  vars:
++    var_system_crypto_policy: !!str FUTURE
++    var_sudo_logfile: !!str /var/log/sudo.log
++
++  tasks:
++    - name: Modify the System Login Banner - remove incorrect banner
++      file:
++        state: absent
++        path: /etc/issue
++      when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
++      tags:
++        - banner_etc_issue
++        - low_complexity
++        - medium_disruption
++        - medium_severity
++        - no_reboot_needed
++        - unknown_strategy
++
++    - name: Test for existence /etc/issue
++      stat:
++        path: /etc/issue
++      register: file_exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
++    - name: Ensure permission 0644 on /etc/issue
++      file:
++        path: /etc/issue
++        mode: '0644'
++      when: file_exists.stat is defined and file_exists.stat.exists
++      tags:
++        - configure_strategy
++        - file_permissions_etc_issue
++        - low_complexity
++        - low_disruption
++        - medium_severity
++        - no_reboot_needed
++
+diff --git a/tests/test_check_playbook_file_removed_and_added.py b/tests/test_check_playbook_file_removed_and_added.py
+new file mode 100644
+index 00000000000..181bb14ed46
+--- /dev/null
++++ b/tests/test_check_playbook_file_removed_and_added.py
+@@ -0,0 +1,39 @@
++import os
++import pytest
++
++from .test_ansible_file_removed_and_added import check_playbook_file_removed_and_added
++
++
++def test_file_removed_and_added():
++    playbook_path = os.path.join(os.path.dirname(__file__),
++                                 "ansible_file_removed_and_added",
++                                 "file_removed_and_added.yml")
++    assert not check_playbook_file_removed_and_added(playbook_path)
++
++
++def test_file_removed_and_not_added():
++    playbook_path = os.path.join(os.path.dirname(__file__),
++                                 "ansible_file_removed_and_added",
++                                 "file_removed_and_not_added.yml")
++    assert check_playbook_file_removed_and_added(playbook_path)
++
++
++def test_file_not_removed_and_added():
++    playbook_path = os.path.join(os.path.dirname(__file__),
++                                 "ansible_file_removed_and_added",
++                                 "file_not_removed_and_added.yml")
++    assert check_playbook_file_removed_and_added(playbook_path)
++
++
++def test_file_block_removed_and_added():
++    playbook_path = os.path.join(os.path.dirname(__file__),
++                                 "ansible_file_removed_and_added",
++                                 "file_block_removed_and_added.yml")
++    assert not check_playbook_file_removed_and_added(playbook_path)
++
++
++def test_file_block_removed_and_not_added():
++    playbook_path = os.path.join(os.path.dirname(__file__),
++                                 "ansible_file_removed_and_added",
++                                 "file_block_removed_and_not_added.yml")
++    assert check_playbook_file_removed_and_added(playbook_path)
+
+From 741ec823ac39341f8aa0649031b72d2ac36e8a64 Mon Sep 17 00:00:00 2001
+From: Watson Sato <wsato@redhat.com>
+Date: Thu, 12 Aug 2021 10:36:47 +0200
+Subject: [PATCH 3/3] Mention Ansible static yamlpath test in docs
+
+---
+ .../developer/02_building_complianceascode.md      | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/docs/manual/developer/02_building_complianceascode.md b/docs/manual/developer/02_building_complianceascode.md
+index d536df0a259..87469bf5f9b 100644
+--- a/docs/manual/developer/02_building_complianceascode.md
++++ b/docs/manual/developer/02_building_complianceascode.md
+@@ -64,6 +64,20 @@ yum install yamllint ansible-lint
+ apt-get install yamllint ansible-lint
+ ```
+ 
++### Static Ansible Playbooks tests
++
++Install `yamlpath` and `pytest` to run tests cases that analyse the Ansible
++Playbooks' yaml nodes.
++```bash
++pip3 install yamlpath
++
++# Fedora/RHEL
++yum install python3-pytest
++
++# Ubuntu/Debian
++apt-get install python-pytest
++```
++
+ ### Ninja (Faster Builds)
+ 
+ Install the `ninja` build system if you want to use it instead of

SOURCES/scap-security-guide-0.1.58-update_rhel7_stig-PR_7217.patch

@@ -0,0 +1,21 @@
+From 2452c1c69e6bda3b6130d8cf80c69c711c438fd0 Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Wed, 7 Jul 2021 18:59:10 +0200
+Subject: [PATCH] Select two more rules in RHEL7 STIG.
+
+- sysctl_net_ipv4_conf_all_rp_filter
+- sysctl_net_ipv4_conf_default_rp_filter
+---
+ products/rhel7/profiles/stig.profile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile
+index 23635ffed91..78133180ecc 100644
+--- a/products/rhel7/profiles/stig.profile
++++ b/products/rhel7/profiles/stig.profile
+@@ -314,3 +314,5 @@ selections:
+     - package_MFEhiplsm_installed
+     - file_ownership_var_log_audit
+     - file_permissions_var_log_audit
++    - sysctl_net_ipv4_conf_all_rp_filter
++    - sysctl_net_ipv4_conf_default_rp_filter

SOURCES/scap-security-guide-0.1.58-update_stig_gui_rhel7_version-PR_7340.patch

@@ -0,0 +1,34 @@
+From f151a439ce9199a0a4496c0bc55811b47bfd8b78 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Thu, 5 Aug 2021 16:45:29 +0200
+Subject: [PATCH] update version of rhel7 stig_gui profile
+
+---
+ products/rhel7/profiles/stig_gui.profile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/products/rhel7/profiles/stig_gui.profile b/products/rhel7/profiles/stig_gui.profile
+index d41d2ef4f80..6dd433d6c21 100644
+--- a/products/rhel7/profiles/stig_gui.profile
++++ b/products/rhel7/profiles/stig_gui.profile
+@@ -1,9 +1,9 @@
+ documentation_complete: true
+ 
+ metadata:
+-    version: V3R3
++    version: V3R4
+     SMEs:
+-        - carlosmmatos
++        - ggbecker
+ 
+ reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
+ 
+@@ -11,7 +11,7 @@ title: 'DISA STIG with GUI for Red Hat Enterprise Linux 7'
+ 
+ description: |-
+     This profile contains configuration checks that align to the
+-    DISA STIG with GUI for Red Hat Enterprise Linux V3R3.
++    DISA STIG with GUI for Red Hat Enterprise Linux V3R4.
+ 
+     In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this
+     configuration baseline as applicable to the operating system tier of

SOURCES/scap-security-guide-0.1.58-update_stig_mapping_table-PR_7327.patch

@@ -0,0 +1,120 @@
+From ea1bab197a17dd944e41a583c82c3cc757bb566b Mon Sep 17 00:00:00 2001
+From: Gabriel Becker <ggasparb@redhat.com>
+Date: Wed, 4 Aug 2021 12:23:05 +0200
+Subject: [PATCH] Update STIG mapping table to reflect statistics of coverage.
+
+---
+ .../shared_xccdf-apply-overlay-stig.xslt      | 59 +++++++++++++------
+ .../transforms/shared_xccdf2table-stig.xslt   | 28 +++++++++
+ 2 files changed, 68 insertions(+), 19 deletions(-)
+
+diff --git a/shared/transforms/shared_xccdf-apply-overlay-stig.xslt b/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
+index 945f709b95..b7c000608c 100644
+--- a/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
++++ b/shared/transforms/shared_xccdf-apply-overlay-stig.xslt
+@@ -28,26 +28,47 @@
+       <xsl:variable name="overlay_ref" select="@disa"/>
+       <xsl:variable name="overlay_title" select="xccdf:title/@text"/>
+ 
+-      <xsl:for-each select="$rules">
+-        <xsl:if test="@id=$overlay_rule">
+-		  <Group id="V-{$overlay_id}">
+-		    <title>SRG-OS-ID</title>
+-		    <description></description>
+-            <Rule id="{$overlay_rule}" severity="{$overlay_severity}" >
+-			<version><xsl:value-of select="$overlay_version"/></version>
+-          	<title><xsl:value-of select="$overlay_title"/></title>
+-          	<description><xsl:copy-of select="xccdf:rationale/node()" /></description>
+-          	<check system="C-{$overlay_id}_chk">
+-              <check-content>
+-					      <xsl:apply-templates select="xccdf:check[@system='http://scap.nist.gov/schema/ocil/2']"/>
+-              </check-content>
+-          	</check>
+-		  	<ident system="https://public.cyber.mil/stigs/cci"><xsl:value-of select="$overlay_ref" /></ident>
+-          	<fixtext><xsl:copy-of select="xccdf:description/node()" /></fixtext>
+-          </Rule> 
++      <xsl:choose>
++        <xsl:when test="$overlay_rule='XXXX'">
++          <Group id="V-{$overlay_id}">
++            <title>SRG-OS-ID</title>
++            <description></description>
++                <Rule id="Missing Rule" severity="{$overlay_severity}" >
++          <version><xsl:value-of select="$overlay_version"/></version>
++                <title><xsl:value-of select="$overlay_title"/></title>
++                <description></description>
++                <check system="C-{$overlay_id}_chk">
++                  <check-content>
++                  </check-content>
++                </check>
++                <ident></ident>
++                <fixtext></fixtext>
++              </Rule>
+           </Group>
+-        </xsl:if>
+-      </xsl:for-each> 
++        </xsl:when>
++        <xsl:otherwise>
++          <xsl:for-each select="$rules">
++            <xsl:if test="@id=$overlay_rule">
++          <Group id="V-{$overlay_id}">
++            <title>SRG-OS-ID</title>
++            <description></description>
++                <Rule id="{$overlay_rule}" severity="{$overlay_severity}" >
++          <version><xsl:value-of select="$overlay_version"/></version>
++                <title><xsl:value-of select="$overlay_title"/></title>
++                <description><xsl:copy-of select="xccdf:rationale/node()" /></description>
++                <check system="C-{$overlay_id}_chk">
++                  <check-content>
++                    <xsl:apply-templates select="xccdf:check[@system='http://scap.nist.gov/schema/ocil/2']"/>
++                  </check-content>
++                </check>
++            <ident system="https://public.cyber.mil/stigs/cci"><xsl:value-of select="$overlay_ref" /></ident>
++                <fixtext><xsl:copy-of select="xccdf:description/node()" /></fixtext>
++              </Rule>
++              </Group>
++            </xsl:if>
++          </xsl:for-each>
++        </xsl:otherwise>
++    </xsl:choose>
+ 
+     </xsl:for-each> 
+     </xsl:copy>
+diff --git a/shared/transforms/shared_xccdf2table-stig.xslt b/shared/transforms/shared_xccdf2table-stig.xslt
+index 3746c386c0..4c477542f4 100644
+--- a/shared/transforms/shared_xccdf2table-stig.xslt
++++ b/shared/transforms/shared_xccdf2table-stig.xslt
+@@ -20,6 +20,34 @@
+ 			</div>
+ 			<br/>
+ 			<br/>
++
++			<div>
++			<table>
++				<thead>
++				  <tr>
++					<th>Total</th>
++					<th>Missing</th>
++					<th>Implemented</th>
++					<th>Coverage</th>
++					<th>STIG ids missing rule</th>
++				  </tr>
++				</thead>
++				<tbody>
++				  <tr>
++					<td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule))"/></td>
++					<td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id='Missing Rule']))"/></td>
++					<td><xsl:value-of select="number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id!='Missing Rule']))"/></td>
++					<td><xsl:value-of select="format-number(count(/cdf:Benchmark/cdf:Group/cdf:Rule[@id!='Missing Rule']) div count(/cdf:Benchmark/cdf:Group/cdf:Rule)*100, '#.00')"/>%</td>
++					<td>
++						<xsl:for-each select="/cdf:Benchmark/cdf:Group/cdf:Rule[@id='Missing Rule']">
++							<xsl:value-of select="cdf:version/node()"/><xsl:text>&#xd;</xsl:text>
++						</xsl:for-each>
++					</td>
++				  </tr>
++				</tbody>
++				</table>
++			</div>
++
+ 			<xsl:apply-templates select="cdf:Benchmark"/>
+ 		</body>
+ 		</html>

SOURCES/scap-security-guide-0.1.58-update_stig_references-PR_7366.patch

@@ -0,0 +1,89 @@
+From 3d7b01a7fdc27f7e5a31ba508f7f84dab446aa4b Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <eduardo.barretto@canonical.com>
+Date: Wed, 16 Jun 2021 16:34:59 +0200
+Subject: [PATCH 1/5] Add accounts_password_pam_dictcheck to UBTU-20-010056
+
+---
+ products/ubuntu2004/profiles/stig.profile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/products/ubuntu2004/profiles/stig.profile b/products/ubuntu2004/profiles/stig.profile
+index 4d03bfe7ae..ac9685809c 100644
+--- a/products/ubuntu2004/profiles/stig.profile
++++ b/products/ubuntu2004/profiles/stig.profile
+@@ -113,6 +113,8 @@ selections:
+     - accounts_password_pam_ocredit
+ 
+     # UBTU-20-010056 The Ubuntu operating system must prevent the use of dictionary words for passwords.
++    - var_password_pam_dictcheck=1
++    - accounts_password_pam_dictcheck
+ 
+     # UBTU-20-010057 The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.
+     - var_password_pam_retry=3
+
+From 6c3c586a7fe27d68052428e02843c573f9cbd559 Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <eduardo.barretto@canonical.com>
+Date: Wed, 4 Aug 2021 18:11:48 +0200
+Subject: [PATCH 2/5] Add ubuntu2004 to prodtype in
+ accounts_password_pam_dictcheck
+
+---
+ .../accounts_password_pam_dictcheck/rule.yml                    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+index 2990150c0a..00da0397b0 100644
+--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+@@ -1,6 +1,6 @@
+ documentation_complete: true
+ 
+-prodtype: fedora,rhel8
++prodtype: fedora,rhel8,ubuntu2004
+ 
+ title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
+ 
+
+From b523676430765ab7fff09f790618f091d3f916e2 Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <eduardo.barretto@canonical.com>
+Date: Wed, 4 Aug 2021 18:12:59 +0200
+Subject: [PATCH 4/5] Add stigid@ubuntu2004 to accounts_password_pam_dictcheck
+
+---
+ .../accounts_password_pam_dictcheck/rule.yml                     | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+index bae2db25fe..226329d752 100644
+--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+@@ -29,6 +29,7 @@ references:
+     nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
+     srg: SRG-OS-000480-GPOS-00225
+     stigid@rhel8: RHEL-08-020300
++    stigid@ubuntu2004: UBTU-20-010056
+ 
+ ocil_clause: 'dictcheck is not found or not equal to the required value'
+ 
+
+From 39973c39ea17fb13730f1bef239783464c1b4b01 Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <eduardo.barretto@canonical.com>
+Date: Wed, 4 Aug 2021 18:13:16 +0200
+Subject: [PATCH 5/5] Add pam platform to accounts_password_pam_dictcheck
+
+---
+ .../accounts_password_pam_dictcheck/rule.yml                     | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+index 226329d752..d0d4b8c5c5 100644
+--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
+@@ -39,6 +39,7 @@ ocil: |-
+     The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
+     <pre>dictcheck=1</pre>
+ 
++platform: pam
+ 
+ template:
+     name: accounts_password

SOURCES/scap-security-guide-0.1.58-update_stig_references_for_servives_rhel8_v1r3-PR_7299.patch

@@ -0,0 +1,821 @@
+From 7899e18d486b6181f3213c3c1351f24cdce84bf8 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 10:34:47 -0500
+Subject: [PATCH 01/20] Split RHEL-08-040100 into two rules
+
+One for the firewalld package and one for the firewalld service.
+---
+ .../firewalld_activation/service_firewalld_enabled/rule.yml   | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
+index cff9581e76..42849bdd5a 100644
+--- a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
++++ b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml
+@@ -40,7 +40,7 @@ references:
+     srg: SRG-OS-000096-GPOS-00050,SRG-OS-000297-GPOS-00115,SRG-OS-000480-GPOS-00227,SRG-OS-000480-GPOS-00231,SRG-OS-000480-GPOS-00232
+     stigid@ol7: OL07-00-040520
+     stigid@rhel7: RHEL-07-040520
+-    stigid@rhel8: RHEL-08-040100
++    stigid@rhel8: RHEL-08-040101
+     stigid@sle15: SLES-15-010220
+ 
+ ocil: |-
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 965068a691..9d0145a96f 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -968,9 +968,11 @@ selections:
+     # RHEL-08-040090
+ 
+     # RHEL-08-040100
+-    - service_firewalld_enabled
+     - package_firewalld_installed
+ 
++    # RHEL-08-040101
++    - service_firewalld_enabled
++
+     # RHEL-08-040110
+     - wireless_disable_interfaces
+ 
+
+From 7396acddc284acc54d66640e7e0bc5251334bc0b Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 11:44:59 -0500
+Subject: [PATCH 02/20] Split the rule for RHEL-08-020040
+
+Split and package_tmux_installed and configure_tmux_lock_command
+---
+ .../console_screen_locking/package_tmux_installed/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
+index 550eaea8bb..120d1c49e0 100644
+--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml
+@@ -40,7 +40,7 @@ references:
+     nist-csf: PR.AC-7
+     ospp: FMT_MOF_EXT.1
+     srg: SRG-OS-000030-GPOS-00011,SRG-OS-000028-GPOS-00009
+-    stigid@rhel8: RHEL-08-020040
++    stigid@rhel8: RHEL-08-020039
+     vmmsrg: SRG-OS-000030-VMM-000110
+ 
+ ocil_clause: 'the package is not installed'
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 9d0145a96f..9f57b28f4f 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -481,8 +481,10 @@ selections:
+     # RHEL-08-020030
+     - dconf_gnome_screensaver_lock_enabled
+ 
+-    # RHEL-08-020040
++    # RHEL-08-020039
+     - package_tmux_installed
++
++    # RHEL-08-020040
+     - configure_tmux_lock_command
+ 
+     # RHEL-08-020041
+
+From 6e3a93e173fbd12640e585d579f1e1d0afd3f419 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 11:49:59 -0500
+Subject: [PATCH 03/20] Split RHEL-08-040100
+
+One for the openssh-server package and one for the openssh-server service.
+---
+ .../services/ssh/package_openssh-server_installed/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
+index 0b2a660c29..b551f08f38 100644
+--- a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
++++ b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml
+@@ -30,7 +30,7 @@ references:
+     srg: SRG-OS-000423-GPOS-00187,SRG-OS-000424-GPOS-00188,SRG-OS-000425-GPOS-00189,SRG-OS-000426-GPOS-00190
+     stigid@ol7: OL07-00-040300
+     stigid@rhel7: RHEL-07-040300
+-    stigid@rhel8: RHEL-08-040160
++    stigid@rhel8: RHEL-08-040159
+     stigid@ubuntu2004: UBTU-20-010042
+ 
+ ocil_clause: 'the package is not installed'
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 9f57b28f4f..66f70cdfd5 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1037,8 +1037,10 @@ selections:
+ 
+     # RHEL-08-040150
+ 
+-    # RHEL-08-040160
++    # RHEL-08-040159
+     - package_openssh-server_installed
++
++    # RHEL-08-040160
+     - service_sshd_enabled
+ 
+     # RHEL-08-040161
+
+From 097682c4e225b7bdefd7b38c89cadf984540da04 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 11:56:17 -0500
+Subject: [PATCH 04/20] Split RHEL-08-040140
+
+Package usbguard and service usbguard are split out into their own
+STIG ID. now.
+---
+ .../services/usbguard/package_usbguard_installed/rule.yml | 2 +-
+ .../services/usbguard/service_usbguard_enabled/rule.yml   | 2 +-
+ products/rhel8/profiles/stig.profile                      | 8 ++++++--
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
+index 333718182e..19ef8aaca6 100644
+--- a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
++++ b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml
+@@ -48,7 +48,7 @@ references:
+     disa: CCI-001958
+     ism: "1418"
+     srg: SRG-OS-000378-GPOS-00163
+-    stigid@rhel8: RHEL-08-040140
++    stigid@rhel8: RHEL-08-040139
+ 
+ ocil_clause: 'the package is not installed'
+ 
+diff --git a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
+index 86adda9ecc..4f008129ea 100644
+--- a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
++++ b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
+@@ -27,7 +27,7 @@ references:
+     nist: CM-8(3)(a),IA-3
+     ospp: FMT_SMF_EXT.1
+     srg: SRG-OS-000378-GPOS-00163
+-    stigid@rhel8: RHEL-08-040140
++    stigid@rhel8: RHEL-08-040141
+ 
+ ocil_clause: 'the service is not enabled'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 66f70cdfd5..fd090e4058 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1030,11 +1030,15 @@ selections:
+     - package_fapolicyd_installed
+     - service_fapolicyd_enabled
+ 
+-    # RHEL-08-040140
++    # RHEL-08-040139
+     - package_usbguard_installed
+-    - service_usbguard_enabled
++
++    # RHEL-08-040140
+     - usbguard_generate_policy
+ 
++    # RHEL-08-040141
++    - service_usbguard_enabled
++
+     # RHEL-08-040150
+ 
+     # RHEL-08-040159
+
+From 1b28e2bed919e7f16519b051d39f7df640498d4f Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:01:13 -0500
+Subject: [PATCH 05/20] Split RHEL-08-030180
+
+One for the auditd package and one for the auditd service.
+---
+ linux_os/guide/system/auditing/service_auditd_enabled/rule.yml | 2 +-
+ products/rhel8/profiles/stig.profile                           | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
+index e10e8c7782..c7ce75e87c 100644
+--- a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
++++ b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
+@@ -55,7 +55,7 @@ references:
+     stigid@sle12: SLES-12-020010
+     stigid@sle15: SLES-15-030050
+     nist@sle12: AU-3,AU-3(1),AU-3(1).1(ii),AU-3.1,AU-6(4),AU-6(4).1,AU-7(1),AU-7(1).1,AU-7(a),AU-14(1),AU-14(1).1,CM-6(b),CM-6.1(iv),MA-4(1)(a)
+-    stigid@rhel8: RHEL-08-010560
++    stigid@rhel8: RHEL-08-030381
+ 
+ ocil: |-
+     {{{ ocil_service_enabled(service="auditd") }}}
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index fd090e4058..682034af4d 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -683,6 +683,9 @@ selections:
+     # RHEL-08-030180
+     - package_audit_installed
+ 
++    # RHEL-08-030181
++    - service_auditd_enabled
++
+     # RHEL-08-030190
+     - audit_rules_privileged_commands_su
+ 
+
+From 0cf0bb3f6153be26abd4622221d73356be667d1f Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:04:34 -0500
+Subject: [PATCH 06/20] Split RHEL-08-010521
+
+Disabling Kerb5 and gssapi auth for sshd move split into two STIG ids.
+---
+ .../services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml   | 2 +-
+ products/rhel8/profiles/stig.profile                            | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
+index 946ba7f1d6..2134da2839 100644
+--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml
+@@ -36,7 +36,7 @@ references:
+     srg: SRG-OS-000364-GPOS-00151,SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-040430
+     stigid@rhel7: RHEL-07-040430
+-    stigid@rhel8: RHEL-08-010521
++    stigid@rhel8: RHEL-08-010522
+     vmmsrg: SRG-OS-000480-VMM-002000
+ 
+ ocil_clause: 'it is commented out or is not disabled'
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 682034af4d..f913545106 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -318,6 +318,8 @@ selections:
+ 
+     # RHEL-08-010521
+     - sshd_disable_kerb_auth
++
++    # RHEL-08-010522
+     - sshd_disable_gssapi_auth
+ 
+     # RHEL-08-010540
+
+From 994b19da2cb0f88d6eb0533d1ba4cae362351e56 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:10:06 -0500
+Subject: [PATCH 07/20] Split RHEL-08-010471
+
+One for the rng-tools package and one for the rngd service.
+---
+ .../software/system-tools/package_rng-tools_installed/rule.yml  | 2 +-
+ products/rhel8/profiles/stig.profile                            | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
+index 33d5625fee..663a270626 100644
+--- a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
++++ b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml
+@@ -21,7 +21,7 @@ identifiers:
+ references:
+     disa: CCI-000366
+     srg: SRG-OS-000480-GPOS-00227
+-    stigid@rhel8: RHEL-08-010471
++    stigid@rhel8: RHEL-08-010472
+ 
+ ocil_clause: 'the package is not installed'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index f913545106..e6ef5ee42c 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -299,6 +299,8 @@ selections:
+ 
+     # RHEL-08-010471
+     - service_rngd_enabled
++
++    # RHEL-08-010472
+     - package_rng-tools_installed
+ 
+     # RHEL-08-010480
+
+From 2d1756e3fe017645922b1622dac139a249c48a12 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:14:53 -0500
+Subject: [PATCH 08/20] Split RHEL-08-010200
+
+idle timeout and keepalive are now split
+---
+ .../services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
+index 95c840fc5f..5a44255013 100644
+--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
++++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
+@@ -53,7 +53,7 @@ references:
+     srg: SRG-OS-000126-GPOS-00066,SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109,SRG-OS-000395-GPOS-00175
+     stigid@ol7: OL07-00-040320
+     stigid@rhel7: RHEL-07-040320
+-    stigid@rhel8: RHEL-08-010200
++    stigid@rhel8: RHEL-08-010201
+     stigid@sle12: SLES-12-030190
+     stigid@sle15: SLES-15-010280
+     stigid@ubuntu2004: UBTU-20-010037
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index e6ef5ee42c..036fd00808 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -156,9 +156,11 @@ selections:
+     - dir_perms_world_writable_sticky_bits
+ 
+     # RHEL-08-010200
+-    - sshd_set_idle_timeout
+     - sshd_set_keepalive_0
+ 
++    # RHEL-08-010201
++    - sshd_set_idle_timeout
++
+     # RHEL-08-010210
+     - file_permissions_var_log_messages
+ 
+
+From 0823a6f84d32338223502dfc93b09df5225debf6 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:23:31 -0500
+Subject: [PATCH 09/20] Split RHEL-08-010141
+
+GRUB2 UEFI username and password split
+---
+ .../bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                            | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
+index a5f9349882..8a98cbdc95 100644
+--- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
++++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
+@@ -56,7 +56,7 @@ references:
+     srg: SRG-OS-000080-GPOS-00048
+     stigid@ol7: OL07-00-010490
+     stigid@rhel7: RHEL-07-010490
+-    stigid@rhel8: RHEL-08-010140
++    stigid@rhel8: RHEL-08-010141
+ 
+ ocil_clause: 'it does not'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 036fd00808..83500c35b3 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -121,6 +121,8 @@ selections:
+ 
+     # RHEL-08-010140
+     - grub2_uefi_password
++
++    # RHEL-08-010141
+     - grub2_uefi_admin_username
+ 
+     # RHEL-08-010150
+
+From a4dd46d84d9ab8a9fd4984cbc1b9432e2920d3f5 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:24:18 -0500
+Subject: [PATCH 10/20] Split RHEL-08-010150
+
+GRUB admin username and password split
+---
+ .../bootloader-grub2/non-uefi/grub2_admin_username/rule.yml   | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
+index f5cf144e0b..bb2f1bae21 100644
+--- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
++++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
+@@ -49,7 +49,7 @@ references:
+     srg: SRG-OS-000080-GPOS-00048
+     stigid@ol7: OL07-00-010480
+     stigid@rhel7: RHEL-07-010480
+-    stigid@rhel8: RHEL-08-010150
++    stigid@rhel8: RHEL-08-010149
+ 
+ ocil_clause: 'it does not'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 83500c35b3..10d6fd6ebd 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -125,9 +125,11 @@ selections:
+     # RHEL-08-010141
+     - grub2_uefi_admin_username
+ 
++    # RHEL-08-010149
++    - grub2_admin_username
++
+     # RHEL-08-010150
+     - grub2_password
+-    - grub2_admin_username
+ 
+     # RHEL-08-010151
+     - require_singleuser_auth
+
+From e1950738e3d5a35027d322589e736e8bfdba98b3 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 28 Jul 2021 12:44:27 -0500
+Subject: [PATCH 11/20] Split RHEL-08-040135
+
+Package fapolicyd and service fapolicyd have been split.
+---
+ .../guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml | 2 +-
+ products/rhel8/profiles/stig.profile                            | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
+index 6c2663de9f..4a1cd16608 100644
+--- a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
++++ b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml
+@@ -24,7 +24,7 @@ references:
+     nist: CM-6(a),SI-4(22)
+     ospp: FMT_SMF_EXT.1
+     srg: SRG-OS-000370-GPOS-00155,SRG-OS-000368-GPOS-00154
+-    stigid@rhel8: RHEL-08-040135
++    stigid@rhel8: RHEL-08-040136
+ 
+ ocil_clause: 'the service is not enabled'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 10d6fd6ebd..8272b25057 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1041,6 +1041,8 @@ selections:
+ 
+     # RHEL-08-040135
+     - package_fapolicyd_installed
++
++    # RHEL-08-040136
+     - service_fapolicyd_enabled
+ 
+     # RHEL-08-040139
+
+From e259cdaeb85f7f1f371fa11c08a615d1828fe30e Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:42:38 -0500
+Subject: [PATCH 12/20] Split RHEL-08-020330
+
+Also added a placeholder for RHEL-08-020332
+---
+ .../password_storage/no_empty_passwords/rule.yml            | 2 +-
+ products/rhel8/profiles/stig.profile                        | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
+index 19e5e95d60..75f988ffb2 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml
+@@ -53,7 +53,7 @@ references:
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-010290
+     stigid@rhel7: RHEL-07-010290
+-    stigid@rhel8:  RHEL-08-020330
++    stigid@rhel8:  RHEL-08-020331
+     stigid@sle12: SLES-12-010231
+     stigid@sle15: SLES-15-020300
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 8272b25057..793fdd1e87 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -591,9 +591,13 @@ selections:
+     # - accounts_authorized_local_users
+ 
+     # RHEL-08-020330
+-    - no_empty_passwords
+     - sshd_disable_empty_passwords
+ 
++    # RHEL-08-020331
++    - no_empty_passwords
++
++    # RHEL-08-020332
++
+     # RHEL-08-020340
+     - display_login_attempts
+ 
+
+From 5c2b73b5a4462225e876b29ead9f92da3c5f4331 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:45:28 -0500
+Subject: [PATCH 13/20] Split RHEL-08-010050
+
+---
+ .../gui_login_banner/dconf_gnome_banner_enabled/rule.yml      | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
+index c84cff33f3..b6ba3edc47 100644
+--- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml
+@@ -54,7 +54,7 @@ references:
+     srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088
+     stigid@ol7: OL07-00-010030
+     stigid@rhel7: RHEL-07-010030
+-    stigid@rhel8: RHEL-08-010050
++    stigid@rhel8: RHEL-08-010049
+     stigid@sle12: SLES-12-010040
+     stigid@sle15: SLES-15-010080
+     stigid@ubuntu2004: UBTU-20-010002
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 793fdd1e87..976c3f1892 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -95,8 +95,10 @@ selections:
+     # RHEL-08-010040
+     - sshd_enable_warning_banner
+ 
+-    # RHEL-08-010050
++    # RHEL-08-010049
+     - dconf_gnome_banner_enabled
++
++    # RHEL-08-010050
+     - dconf_gnome_login_banner_text
+ 
+     # RHEL-08-010060
+
+From d7c7cefd39de31bb484faad49766bbca22469aea Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:47:50 -0500
+Subject: [PATCH 14/20] Split RHEL-08-010130
+
+---
+ .../accounts_password_pam_unix_rounds_system_auth/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
+index d44119622a..0b694b0e0b 100644
+--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml
+@@ -32,7 +32,7 @@ references:
+   anssi: BP28(R32)
+   disa: CCI-000196
+   srg: SRG-OS-000073-GPOS-00041
+-  stigid@rhel8: RHEL-08-010130
++  stigid@rhel8: RHEL-08-010131
+ 
+ ocil_clause: 'it does not set the appropriate number of hashing rounds'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 976c3f1892..5230dcd9c5 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -118,9 +118,11 @@ selections:
+     - accounts_password_all_shadowed_sha512
+ 
+     # RHEL-08-010130
+-    - accounts_password_pam_unix_rounds_system_auth
+     - accounts_password_pam_unix_rounds_password_auth
+ 
++    # RHEL-08-010131
++    - accounts_password_pam_unix_rounds_system_auth
++
+     # RHEL-08-010140
+     - grub2_uefi_password
+ 
+
+From f78b565e1f15cff194aef78af2184088fc41782a Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:50:42 -0500
+Subject: [PATCH 15/20] Split RHEL-08-010151
+
+---
+ .../accounts-physical/require_emergency_target_auth/rule.yml  | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +---
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
+index 930d3a09fd..e2f61432ba 100644
+--- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
++++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml
+@@ -42,7 +42,7 @@ references:
+     srg: SRG-OS-000080-GPOS-00048
+     stigid@ol7: OL07-00-010481
+     stigid@rhel7: RHEL-07-010481
+-    stigid@rhel8: RHEL-08-010151
++    stigid@rhel8: RHEL-08-010152
+ 
+ ocil_clause: 'the output is different'
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 5230dcd9c5..040228b832 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -137,11 +137,9 @@ selections:
+ 
+     # RHEL-08-010151
+     - require_singleuser_auth
+-    - require_emergency_target_auth
+ 
+     # RHEL-08-010152
+-    # To be released in V1R3
+-    # - require_emergency_target_auth
++    - require_emergency_target_auth
+ 
+     # RHEL-08-010160
+     - set_password_hashing_algorithm_systemauth
+
+From a7766cf4ccfd00eaad910fb98b02694868000410 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 08:57:18 -0500
+Subject: [PATCH 16/20] Split RHEL-08-040210
+
+---
+ .../sysctl_net_ipv4_conf_default_accept_redirects/rule.yml    | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
+index e8555a4895..bee6c117f3 100644
+--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
++++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml
+@@ -43,7 +43,7 @@ references:
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-040640
+     stigid@rhel7: RHEL-07-040640
+-    stigid@rhel8: RHEL-08-040210
++    stigid@rhel8: RHEL-08-040209
+     stigid@sle12: SLES-12-030400
+     stigid@sle15: SLES-15-040340
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 040228b832..394a460c51 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1092,8 +1092,10 @@ selections:
+     # RHEL-08-040200
+     - accounts_no_uid_except_zero
+ 
+-    # RHEL-08-040210
++    # RHEL-08-040209
+     - sysctl_net_ipv4_conf_default_accept_redirects
++
++    # RHEL-08-040210
+     - sysctl_net_ipv6_conf_default_accept_redirects
+ 
+     # RHEL-08-040220
+
+From ac28c4231415be5e58bcea6f9fdd8652c6d39c45 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 09:08:27 -0500
+Subject: [PATCH 17/20] Split RHEL-08-040240
+
+---
+ .../sysctl_net_ipv4_conf_all_accept_source_route/rule.yml     | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
+index b56f2891f5..f92772eb57 100644
+--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
++++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml
+@@ -45,7 +45,7 @@ references:
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-040610
+     stigid@rhel7: RHEL-07-040610
+-    stigid@rhel8: RHEL-08-040240
++    stigid@rhel8: RHEL-08-040239
+     stigid@sle12: SLES-12-030360
+     stigid@sle15: SLES-15-040300
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 394a460c51..9cccd25963 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1104,8 +1104,10 @@ selections:
+     # RHEL-08-040230
+     - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
+ 
+-    # RHEL-08-040240
++    # RHEL-08-040239
+     - sysctl_net_ipv4_conf_all_accept_source_route
++
++    # RHEL-08-040240
+     - sysctl_net_ipv6_conf_all_accept_source_route
+ 
+     # RHEL-08-040250
+
+From 717ed63c6ad9b69b75aee69bbf1198515011499f Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 09:11:08 -0500
+Subject: [PATCH 18/20] Split RHEL-08-040250
+
+---
+ .../sysctl_net_ipv4_conf_default_accept_source_route/rule.yml | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
+index 4df2465995..b1e7f247e2 100644
+--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
++++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml
+@@ -46,7 +46,7 @@ references:
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-040620
+     stigid@rhel7: RHEL-07-040620
+-    stigid@rhel8: RHEL-08-040250
++    stigid@rhel8: RHEL-08-040249
+     stigid@sle12: SLES-12-030370
+     stigid@sle15: SLES-15-040320
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 9cccd25963..4d1869c629 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1110,8 +1110,10 @@ selections:
+     # RHEL-08-040240
+     - sysctl_net_ipv6_conf_all_accept_source_route
+ 
+-    # RHEL-08-040250
++    # RHEL-08-040249
+     - sysctl_net_ipv4_conf_default_accept_source_route
++
++    # RHEL-08-040250
+     - sysctl_net_ipv6_conf_default_accept_source_route
+ 
+     # RHEL-08-040260
+
+From 9b244bc0828e2eb6ffe389d7ef590e6b967a4c07 Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Wed, 4 Aug 2021 09:13:19 -0500
+Subject: [PATCH 19/20] Split RHEL-08-040280
+
+---
+ .../sysctl_net_ipv4_conf_all_accept_redirects/rule.yml        | 2 +-
+ products/rhel8/profiles/stig.profile                          | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
+index d5e7fe4599..726042198e 100644
+--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
++++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml
+@@ -44,7 +44,7 @@ references:
+     srg: SRG-OS-000480-GPOS-00227
+     stigid@ol7: OL07-00-040641
+     stigid@rhel7: RHEL-07-040641
+-    stigid@rhel8: RHEL-08-040280
++    stigid@rhel8: RHEL-08-040279
+     stigid@sle12: SLES-12-030390 
+     stigid@sle15: SLES-15-040330
+ 
+diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
+index 4d1869c629..0a1fdd15ca 100644
+--- a/products/rhel8/profiles/stig.profile
++++ b/products/rhel8/profiles/stig.profile
+@@ -1128,8 +1128,10 @@ selections:
+     # RHEL-08-040270
+     - sysctl_net_ipv4_conf_default_send_redirects
+ 
+-    # RHEL-08-040280
++    # RHEL-08-040279
+     - sysctl_net_ipv4_conf_all_accept_redirects
++
++    # RHEL-08-040280
+     - sysctl_net_ipv6_conf_all_accept_redirects
+ 
+     # RHEL-08-040281
+
+From 7723ff37c5abd8681b70ad686c5df45d7d0b44ed Mon Sep 17 00:00:00 2001
+From: Matthew Burket <mburket@redhat.com>
+Date: Thu, 5 Aug 2021 14:46:46 -0500
+Subject: [PATCH 20/20] Update couple of references for RHEL8 STIG
+
+---
+ .../enable_nx/bios_enable_execution_restrictions/rule.yml       | 2 +-
+ .../software/disk_partitioning/partition_for_var_tmp/rule.yml   | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+index 99f2c739c9..2176a0bb9b 100644
+--- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml
+@@ -32,6 +32,6 @@ references:
+     nist: SC-39,CM-6(a)
+     nist-csf: PR.IP-1
+     srg: SRG-OS-000433-GPOS-00192
+-    stig@rhel8: RHEL-08-010420
++    stigid@rhel8: RHEL-08-010420
+ 
+ platform: machine
+diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
+index 726975e808..d57c0f0ce9 100644
+--- a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
++++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml
+@@ -30,6 +30,7 @@ references:
+     cis@ubuntu1804: 1.1.6
+     cis@ubuntu2004: 1.1.11
+     srg: SRG-OS-000480-GPOS-00227
++    stigid@rhel8: RHEL-08-010544
+ 
+ {{{ complete_ocil_entry_separate_partition(part="/var/tmp") }}}
+ 

SPECS/scap-security-guide.spec

@@ -1,56 +1,94 @@
 # Base name of static rhel6 content tarball
 %global _static_rhel6_content %{name}-0.1.52-2.el7_9-rhel6
+# https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds
+%global _vpath_builddir build
 
 Name:		scap-security-guide
-Version:	0.1.54
+Version:	0.1.57
-Release:	5%{?dist}.alma.1
+Release:	5%{?dist}.alma
 Summary:	Security guidance and baselines in SCAP formats
+License:	BSD-3-Clause
 Group:		Applications/System
-License:	BSD
 URL:		https://github.com/ComplianceAsCode/content/
 Source0:	https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2
 # Include tarball with last released rhel6 content
 Source1:	%{_static_rhel6_content}.tar.bz2
 # Patch allows only OSPP, PCI-DSS, E8 and STIG profiles in RHEL8 datastream
-Patch0:		disable-not-in-good-shape-profiles.patch
-Patch1:		scap-security-guide-0.1.55-add_sudoers_explicit_command_args-PR_6525.diff
-Patch2:		scap-security-guide-0.1.55-add_rule_sysctl_kernel_modules_disabled-PR_6533.patch
-Patch3:		scap-security-guide-0.1.55-supress_lint_errors-PR_6542.patch
-Patch4:		scap-security-guide-0.1.55-add_notes_and_rule_for_R35-PR_6548.patch
-Patch5:		scap-security-guide-0.1.55-update_metadata_for_minimal_intermediary-PR_6549.patch
-Patch6:		scap-security-guide-0.1.55-add_rules_for_R18-PR_6539.patch
-Patch7:		scap-security-guide-0.1.55-add_rules_for_R37-PR_6540.patch
-Patch8:		scap-security-guide-0.1.55-drop_fix_sysctl_kernel_modules_disabled-PR_6586.patch
-Patch9:		scap-security-guide-0.1.55-add_selector_for_R29-PR_6553.patch
-Patch10:		scap-security-guide-0.1.55-update_anssi_profile_title-PR_6592.patch
-Patch11:		scap-security-guide-0.1.55-adjust_ks_partion_sizes-PR_6600.patch
-Patch12:		scap-security-guide-0.1.55-better_align_anssi_ks-PR_6589.patch
-Patch13:		scap-security-guide-0.1.55-update_nodev_nonroot_mount_option-PR_6606.patch
-Patch14:		scap-security-guide-0.1.55-add_sshd_x11_proxy_localhost-PR_6534.patch
-Patch15:		scap-security-guide-0.1.55-sles12_stigs-PR_6524.patch
-Patch16:		scap-security-guide-0.1.55-remove_pam_rule_from_rhel8_stig-PR_6528.patch
-Patch17:		scap-security-guide-0.1.55-sles12_stigs_2-PR_6561.patch
-Patch18:		scap-security-guide-0.1.55-update_RHEL_07_040710-PR_6537.patch
-Patch19:		scap-security-guide-0.1.55-sshd_approved_ciphers_ordered-PR_6541.patch
-Patch20:		scap-security-guide-0.1.55-sshd_use_approved_macs_stig-PR_6546.patch
-Patch21:		scap-security-guide-0.1.55-fix_cce_rhel7_mac-PR_6564.patch
-Patch22:		scap-security-guide-0.1.55-OL7_DISA_STIG_v2r1_update-PR_6538.patch
-Patch23:		scap-security-guide-0.1.55-OL7_DISA_STIG_v2r2_update-PR_6607.patch
-Patch24:		scap-security-guide-0.1.55-upstream_sles12_stigs_3-PR_6599.patch
-Patch25:		scap-security-guide-0.1.55-rhel8_stig_v1r1-PR_6579.patch
-Patch26:		scap-security-guide-0.1.55-drop_kernel_module_vfat_disabled-PR_6613.patch
-Patch27:		scap-security-guide-0.1.55-remove_auditd_data_retention_space_left_from_RHEL8_STIG-PR_6615.patch
 # Untill ANSSI High profile is shipped we drop the ks too
-Patch28:		remove-ANSSI-high-ks.patch
+
+BuildArch:	noarch
+
+# Patch allows only OSPP, PCI-DSS, E8 and STIG profiles in RHEL8 datastream
+Patch0:		disable-not-in-good-shape-profiles.patch
+Patch1:		scap-security-guide-0.1.58-fix_ansible_banner_remediation-PR_7228.patch
+Patch2:		scap-security-guide-0.1.58-tests_for_playbooks_that_change_banners-PR_7376.patch
+Patch3:		scap-security-guide-0.1.58-add_missing_unit_test_playbook-PR_7431.patch
+Patch4:		scap-security-guide-0.1.58-RHEL_08_010630-PR_7250.patch
+Patch5:		scap-security-guide-0.1.58-rhel8_stig_08_010350-PR_7231.patch
+Patch6:		scap-security-guide-0.1.58-RHEL_08_010360-PR_7209.patch
+Patch7:		scap-security-guide-0.1.58-RHEL_08_030610-PR_7256.patch
+Patch8:		scap-security-guide-0.1.58-RHEL_08_010420-PR_7227.patch
+Patch9:		scap-security-guide-0.1.58-rhel8_stig_08_010290-PR_7151.patch
+Patch10:		scap-security-guide-0.1.58-rhel8_stig_08_010291-PR_7169.patch
+Patch11:		scap-security-guide-0.1.58-split_file_ownership_var_log_audit-PR_7129.patch
+Patch12:		scap-security-guide-0.1.58-rhel8_stig_08_020270-PR_7276.patch
+Patch13:		scap-security-guide-0.1.58-add_rhel_minor_check-PR_7251.patch
+Patch14:		scap-security-guide-0.1.58-RHEL_08_030700-PR_7264.patch
+Patch15:		scap-security-guide-0.1.58-RHEL_08_030710-PR_7268.patch
+Patch16:		scap-security-guide-0.1.58-RHEL_08_020300-PR_7289.patch
+Patch17:		scap-security-guide-0.1.58-RHEL_08_020090-PR_7313.patch
+Patch18:		scap-security-guide-0.1.58-update_stig_benchmark-PR_7326.patch
+Patch19:		scap-security-guide-0.1.58-add_RHEL_08_020240-PR_7330.patch
+Patch20:		scap-security-guide-0.1.58-audit_rhel8_stig-PR_6910.patch
+Patch21:		scap-security-guide-0.1.58-bios_enable_execution_restrictions_srg-PR_7284.patch
+Patch22:		scap-security-guide-0.1.58-update_stig_references_for_servives_rhel8_v1r3-PR_7299.patch
+Patch23:		scap-security-guide-0.1.58-RHEL_08_040286-PR_7354.patch
+Patch24:		scap-security-guide-0.1.58-RHEL_08_030650-PR_7283.patch
+Patch25:		scap-security-guide-0.1.58-remove_RHEL_08_040162-PR_7369.patch
+Patch26:		scap-security-guide-0.1.58-fix_STIG_references-PR_7371.patch
+Patch27:		scap-security-guide-0.1.58-sshd_directory_config-PR_6926.patch
+Patch28:		scap-security-guide-0.1.58-RHEL_08_030720-PR_7288.patch
+Patch29:		scap-security-guide-0.1.58-RHEL_08_020320-PR_7303.patch
+Patch30:		scap-security-guide-0.1.58-fix_missing_srgs-PR_7362.patch
+Patch31:		scap-security-guide-0.1.58-update_rhel7_stig-PR_7217.patch
+Patch32:		scap-security-guide-0.1.58-RHEL_08_010001-PR_7344.patch
+Patch33:		scap-security-guide-0.1.58-RHEL_08_030730-PR_7323.patch
+Patch34:		scap-security-guide-0.1.58-update_stig_gui_rhel7_version-PR_7340.patch
+Patch35:		scap-security-guide-0.1.58-ansible_missing_metadata-PR_7357.patch
+Patch36:		scap-security-guide-0.1.58-ensure_test_helper_scripts_executable-PR_7302.patch
+Patch37:		scap-security-guide-0.1.58-update_stig_overlay-PR_7287.patch
+Patch38:		scap-security-guide-0.1.58-update_stig_mapping_table-PR_7327.patch
+Patch39:		scap-security-guide-0.1.58-update_stig_references-PR_7366.patch
+Patch40:		scap-security-guide-0.1.58-fix_stig_overlay_python2-PR_7317.patch
+Patch41:		scap-security-guide-0.1.58-group_audit_syscalls-PR_7329.patch
+Patch42:		scap-security-guide-0.1.58-rhel8_cis_identifier_update_1-PR_7356.patch
+Patch43:		scap-security-guide-0.1.58-audit_privileged_rhel_cis-PR_7353.patch
+Patch44:		scap-security-guide-0.1.58-cis_rhel7_updates-PR_7384.patch
+Patch45:		scap-security-guide-0.1.58-fix_handling_of_variables_in_levels-PR_7226.patch
+Patch46:		scap-security-guide-0.1.58-rhel_modular_cis-PR_6976.patch
+Patch47:		scap-security-guide-0.1.58-rhel7_cis_kickstarts-PR_7382.patch
+Patch48:		scap-security-guide-0.1.58-rhel8_cis_kickstarts-PR_7383.patch
+Patch49:		scap-security-guide-0.1.58-ism_ks-PR_7392.patch
+Patch50:		scap-security-guide-0.1.58-fix_rhel7_links-PR_7409.patch
+Patch51:		scap-security-guide-0.1.58-fix_audit_file_permissions-PR_7440.patch
+Patch52:		scap-security-guide-0.1.58-mark_rule_as_machine_only-PR_7442.patch
+Patch53:		scap-security-guide-0.1.58-fix_rhel7_doc_link-PR_7443.patch
+Patch54:		scap-security-guide-0.1.58-disable_ctrlaltdel_reboot_fix_test_scenario-PR_7444.patch
+Patch55:		scap-security-guide-0.1.58-fix_cis_value_selector-PR_7452.patch
+Patch56:		scap-security-guide-0.1.58-ism_usb_hid-PR_7493.patch
 
 # AlmaLinux patches
 Patch1001:		0001-Add-AlmaLinux-8-support.patch
 
-BuildArch:	noarch
+BuildRequires:	libxslt
-
+BuildRequires:	expat
+BuildRequires:	openscap-scanner >= 1.2.5
+BuildRequires:	cmake >= 2.8
 # To get python3 inside the buildroot require its path explicitly in BuildRequires
 BuildRequires: /usr/bin/python3
-BuildRequires:	libxslt, expat, openscap-scanner >= 1.2.5, python3-lxml, cmake >= 2.8, python3-jinja2, python3-PyYAML
+BuildRequires:	python%{python3_pkgversion}
+BuildRequires:	python%{python3_pkgversion}-jinja2
+BuildRequires:	python%{python3_pkgversion}-PyYAML
 Requires:	xml-common, openscap-scanner >= 1.2.5
 Obsoletes:	openscap-content < 0:0.9.13
 Provides:	openscap-content
@@ -61,11 +99,11 @@ system from the final system's security point of view. The guidance is specified
 in the Security Content Automation Protocol (SCAP) format and constitutes
 a catalog of practical hardening advice, linked to government requirements
 where applicable. The project bridges the gap between generalized policy
-requirements and specific implementation guidelines. The AlmaLinux 8
+requirements and specific implementation guidelines. The system
-system administrator can use the oscap CLI tool from openscap-scanner
+administrator can use the oscap CLI tool from openscap-scanner package, or the
-package, or the scap-workbench GUI tool from scap-workbench package to verify
+scap-workbench GUI tool from scap-workbench package to verify that the system
-that the system conforms to provided guideline. Refer to scap-security-guide(8)
+conforms to provided guideline. Refer to scap-security-guide(8) manual page for
-manual page for further information.
+further information.
 
 %package	doc
 Summary:	HTML formatted security guides generated from XCCDF benchmarks
@@ -77,43 +115,19 @@ The %{name}-doc package contains HTML formatted documents containing
 hardening guidances that have been generated from XCCDF benchmarks
 present in %{name} package.
 
+%package	rule-playbooks
+Summary:	Ansible playbooks per each rule.
+Group:		System Environment/Base
+Requires:	%{name} = %{version}-%{release}
+
+%description	rule-playbooks
+The %{name}-rule-playbooks package contains individual ansible playbooks per rule.
+
 %prep
-%setup -q -b 1
+%autosetup -p1 -b1
-%patch0 -p1
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
-%patch11 -p1
-%patch12 -p1
-%patch13 -p1
-%patch14 -p1
-%patch15 -p1
-%patch16 -p1
-%patch17 -p1
-%patch18 -p1
-%patch19 -p1
-%patch20 -p1
-%patch21 -p1
-%patch22 -p1
-%patch23 -p1
-%patch24 -p1
-%patch25 -p1
-%patch26 -p1
-%patch27 -p1
-%patch28 -p1
-
-%patch1001 -p1
-
-mkdir build
 
 %build
+mkdir -p build
 cd build
 %cmake \
 -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE \
@@ -123,12 +137,14 @@ cd build
 -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE \
 -DSSG_PRODUCT_JRE:BOOLEAN=TRUE \
 -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF \
--DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF ../
+-DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF \
-%make_build
+-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON \
+../
+%cmake_build
 
 %install
 cd build
-%make_install
+%cmake_install
 
 # Manually install pre-built rhel6 content
 # Disabled on AlmaLinux
@@ -145,15 +161,53 @@ cd build
 %doc %{_docdir}/%{name}/LICENSE
 %doc %{_docdir}/%{name}/README.md
 %doc %{_docdir}/%{name}/Contributors.md
+%if ( %{defined rhel} && (! %{defined centos}) )
+%exclude %{_datadir}/%{name}/ansible/rule_playbooks
+%endif
 
 %files doc
 %doc %{_docdir}/%{name}/guides/*.html
 %doc %{_docdir}/%{name}/tables/*.html
 
+%files rule-playbooks
+%defattr(-,root,root,-)
+%{_datadir}/%{name}/ansible/rule_playbooks
+
 %changelog
-* Mon Apr 19 2021 Andrew Lukoshko <alukoshko@almalinux.org> - 0.1.54-5.alma
+* Tue Nov 09 2021 Andrew Lukoshko <alukoshko@almalinux.org> - 0.1.57-5.alma
 - Add AlmaLinux support
 
+* Thu Sep 02 2021 Matej Tyc <matyc@redhat.com> - 0.1.57-5
+- Add USB HID rules to the ISM profile, so it is usable after the installation (RHBZ#1999423).
+
+* Tue Aug 24 2021 Gabriel Becker <ggasparb@redhat.com> - 0.1.57-4
+- Fix a value selector in RHEL8 CIS L1 profiles (RHBZ#1993197)
+
+* Mon Aug 23 2021 Gabriel Becker <ggasparb@redhat.com> - 0.1.57-3
+- Fix remaining audit rules file permissions (RHBZ#1993056)
+- Mark a STIG service rule as machine only (RHBZ#1993056)
+- Fix a remaining broken RHEL7 documentation link. (RHBZ#1966577)
+
+* Fri Aug 20 2021 Marcus Burghardt <maburgha@redhat.com> - 0.1.57-2
+- Update Ansible login banner fixes to avoid unnecessary updates (RHBZ#1857179)
+- Include tests for Ansible Playbooks that remove and reintroduce files.
+- Update RHEL8 STIG profile to V1R3 (RHBZ#1993056) 
+- Improve Audit Rules remediation to group similar syscalls (RHBZ#1876483)
+- Reestructure RHEL7 and RHEL8 CIS profiles according to the policy (RHBZ#1993197)
+- Add Kickstart files for ISM profile (RHBZ#1955373)
+- Fix broken RHEL7 documentation links (RHBZ#1966577)
+
+* Fri Jul 30 2021 Matej Tyc <matyc@redhat.com> - 0.1.57-1
+- Update to the latest upstream release (RHBZ#1966577)
+- Enable the ISM profile.
+
+* Tue Jun 8 2021 Gabriel Becker <ggasparb@redhat.com> - 0.1.56-2
+- Create subpackage to hold ansible playbooks per rule (RHBZ#1966604)
+
+* Tue Jun 01 2021 Watson Sato <wsato@redhat.com> - 0.1.56-1
+- Update to the latest upstream release (RHBZ#1966577)
+- Add ANSSI High Profile (RHBZ#1955183)
+
 * Wed Feb 17 2021 Watson Sato <wsato@redhat.com> - 0.1.54-5
 - Remove Kickstart for not shipped profile (RHBZ#1778188)