21 changed files with 124 additions and 47348 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,3 @@
 SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
-SOURCES/scap-security-guide-0.1.63.tar.bz2
+SOURCES/scap-security-guide-0.1.73-1.el7_9-rhel7.tar.bz2
+SOURCES/scap-security-guide-0.1.74.tar.bz2
--- a/.scap-security-guide.metadata
+++ b/.scap-security-guide.metadata
@ -1,2 +1,3 @@
 b22b45d29ad5a97020516230a6ef3140a91d050a SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2
-b77c67caa4f8818e95fa6a4c74adf3173ed8e3d2 SOURCES/scap-security-guide-0.1.63.tar.bz2
+17274daaa588330aa4df9a4d8df5ef448e40a696 SOURCES/scap-security-guide-0.1.73-1.el7_9-rhel7.tar.bz2
+31288700eb6b3cd31d181592238babd8752d5074 SOURCES/scap-security-guide-0.1.74.tar.bz2
--- a/SOURCES/0001-Add-AlmaLinux-8-support.patch
+++ b/SOURCES/0001-Add-AlmaLinux-8-support.patch
--- a/SOURCES/disable-not-in-good-shape-profiles.patch
+++ b/SOURCES/disable-not-in-good-shape-profiles.patch
@ -1,45 +0,0 @@
-diff --git a/products/rhel8/CMakeLists.txt b/products/rhel8/CMakeLists.txt
-index 5258591c7f..cc4b9c5720 100644
--- a/products/rhel8/CMakeLists.txt
-+++ b/products/rhel8/CMakeLists.txt
-@@ -11,7 +11,6 @@ ssg_build_product(${PRODUCT})
- ssg_build_html_ref_tables("${PRODUCT}" "table-${PRODUCT}-{ref_id}refs" "anssi;cis;cui;nist;pcidss")
- 
- ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-ospp" "${PRODUCT}" "ospp" "nist")
-ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-standard" "${PRODUCT}" "standard" "nist")
- ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-stig" "${PRODUCT}" "stig" "nist")
- 
- ssg_build_html_profile_table("table-${PRODUCT}-anssirefs-bp28_minimal" "${PRODUCT}" "anssi_bp28_minimal" "anssi")
-diff --git a/products/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile
-index 035d2705b..c6475f33e 100644
--- a/products/rhel8/profiles/cjis.profile
-+++ b/products/rhel8/profiles/cjis.profile
-@@ -1,4 +1,4 @@
-documentation_complete: true
-+documentation_complete: false
- 
- metadata:
-     version: 5.4
-diff --git a/products/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile
-index c84579592..164ec98c4 100644
--- a/products/rhel8/profiles/rht-ccp.profile
-+++ b/products/rhel8/profiles/rht-ccp.profile
-@@ -1,4 +1,4 @@
-documentation_complete: true
-+documentation_complete: false
- 
- title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)'
- 
-diff --git a/products/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile
-index a63ae2cf3..da669bb84 100644
--- a/products/rhel8/profiles/standard.profile
-+++ b/products/rhel8/profiles/standard.profile
-@@ -1,4 +1,4 @@
-documentation_complete: true
-+documentation_complete: false
- 
- title: 'Standard System Security Profile for Red Hat Enterprise Linux 8'
- 
-- 
-2.26.2
-
--- a/SOURCES/scap-security-guide-0.1.64-add_platform_for_partition_existence-PR_9204.patch
+++ b/SOURCES/scap-security-guide-0.1.64-add_platform_for_partition_existence-PR_9204.patch
@ -1,227 +0,0 @@
-From b4291642f301c18b33ad9b722f0f26490bb55047 Mon Sep 17 00:00:00 2001
-From: Matej Tyc <matyc@redhat.com>
-Date: Thu, 21 Jul 2022 16:42:41 +0200
-Subject: [PATCH 1/3] Add platforms for partition existence
-
---
- shared/applicability/general.yml              | 14 +++++++++++++
- .../checks/oval/installed_env_mounts_tmp.xml  | 10 +++++++++
- .../oval/installed_env_mounts_var_tmp.xml     | 10 +++++++++
- shared/macros/10-ansible.jinja                |  5 +++++
- shared/macros/10-bash.jinja                   |  5 +++++
- shared/macros/10-oval.jinja                   | 21 +++++++++++++++++++
- 6 files changed, 65 insertions(+)
- create mode 100644 shared/checks/oval/installed_env_mounts_tmp.xml
- create mode 100644 shared/checks/oval/installed_env_mounts_var_tmp.xml
-
-diff --git a/shared/applicability/general.yml b/shared/applicability/general.yml
-index 2d23d753148..e2f5d04ce00 100644
--- a/shared/applicability/general.yml
-+++ b/shared/applicability/general.yml
-@@ -77,6 +77,20 @@ cpes:
-       bash_conditional: {{{ bash_pkg_conditional("pam") }}}
-       ansible_conditional: {{{ ansible_pkg_conditional("pam") }}}
- 
-+  - partition-var-tmp:
-+      name: "cpe:/a:partition-var-tmp"
-+      title: "There is a /var/tmp partition"
-+      check_id: installed_env_mounts_var_tmp
-+      bash_conditional: {{{ bash_partition_conditional("/var/tmp") }}}
-+      ansible_conditional: {{{ ansible_partition_conditional("/var/tmp") }}}
-+
-+  - partition-tmp:
-+      name: "cpe:/a:partition-tmp"
-+      title: "There is a /tmp partition"
-+      check_id: installed_env_mounts_tmp
-+      bash_conditional: {{{ bash_partition_conditional("/tmp") }}}
-+      ansible_conditional: {{{ ansible_partition_conditional("/tmp") }}}
-+
-   - polkit:
-       name: "cpe:/a:polkit"
-       title: "Package polkit is installed"
-diff --git a/shared/checks/oval/installed_env_mounts_tmp.xml b/shared/checks/oval/installed_env_mounts_tmp.xml
-new file mode 100644
-index 00000000000..c1bcd6b2431
--- /dev/null
-+++ b/shared/checks/oval/installed_env_mounts_tmp.xml
-@@ -0,0 +1,10 @@
-+<def-group>
-+  <definition class="inventory" id="installed_env_mounts_tmp" version="1">
-+    {{{ oval_metadata("", title="Partition /tmp exists", affected_platforms=[full_name]) }}}
-+    <criteria>
-+       {{{ partition_exists_criterion("/tmp") }}}
-+    </criteria>
-+  </definition>
-+
-+  {{{ partition_exists_tos("/tmp") }}}
-+</def-group>
-diff --git a/shared/checks/oval/installed_env_mounts_var_tmp.xml b/shared/checks/oval/installed_env_mounts_var_tmp.xml
-new file mode 100644
-index 00000000000..a72f49c8a8f
--- /dev/null
-+++ b/shared/checks/oval/installed_env_mounts_var_tmp.xml
-@@ -0,0 +1,10 @@
-+<def-group>
-+  <definition class="inventory" id="installed_env_mounts_var_tmp" version="1">
-+    {{{ oval_metadata("", title="Partition /var/tmp exists", affected_platforms=[full_name]) }}}
-+    <criteria>
-+       {{{ partition_exists_criterion("/var/tmp") }}}
-+    </criteria>
-+  </definition>
-+
-+  {{{ partition_exists_tos("/var/tmp") }}}
-+</def-group>
-diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
-index 2d24f730d3f..478f0072bc7 100644
--- a/shared/macros/10-ansible.jinja
-+++ b/shared/macros/10-ansible.jinja
-@@ -1439,3 +1439,8 @@ Part of the grub2_bootloader_argument_absent template.
-   when:
-     - result_pam_file_present.stat.exists
- {{%- endmacro -%}}
-+
-+
-+{{%- macro ansible_partition_conditional(path) -%}}
-+"ansible_facts.ansible_mounts | json_query(\"[?mount=='{{{ path }}}'].mount\") | length == 1"
-+{{%- endmacro -%}}
-diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
-index 94c3c6f9570..6a7fb165fd2 100644
--- a/shared/macros/10-bash.jinja
-+++ b/shared/macros/10-bash.jinja
-@@ -2085,3 +2085,8 @@ else
-     echo "{{{ pam_file }}} was not found" >&2
- fi
- {{%- endmacro -%}}
-+
-+
-+{{%- macro bash_partition_conditional(path) -%}}
-+'findmnt --mountpoint "{{{ path }}}" > /dev/null'
-+{{%- endmacro -%}}
-diff --git a/shared/macros/10-oval.jinja b/shared/macros/10-oval.jinja
-index c8d7bbeffb7..1ec93b6ef7d 100644
--- a/shared/macros/10-oval.jinja
-+++ b/shared/macros/10-oval.jinja
-@@ -926,3 +926,24 @@ Generates the :code:`<affected>` tag for OVAL check using correct product platfo
- {{%- else %}}
-   {{%- set user_list="nobody" %}}
- {{%- endif %}}
-+
-+
-+{{%- macro partition_exists_criterion(path) %}}
-+{{%- set escaped_path = path | replace("/", "_") %}}
-+      <criterion comment="The path {{{ path }}} is a partition's mount point" test_ref="test_partition_{{{ escaped_path  }}}_exists" />
-+{{%- endmacro %}}
-+
-+{{%- macro partition_exists_tos(path) %}}
-+{{%- set escaped_path = path | replace("/", "_") %}}
-+  <linux:partition_test check="all" check_existence="all_exist"
-+      comment="Partition {{{ path }}} exists"
-+      id="test_partition_{{{ escaped_path }}}_exists"
-+  version="1">
-+    <linux:object object_ref="object_partition_{{{ escaped_path }}}_exists" />
-+    {{#- <linux:partition_state state_ref="" /> #}}
-+  </linux:partition_test>
-+
-+  <linux:partition_object id="object_partition_{{{ escaped_path }}}_exists" version="1">
-+    <linux:mount_point>{{{ path }}}</linux:mount_point>
-+  </linux:partition_object>
-+{{%- endmacro %}}
-
-From 704da46c44f50c93acbfe172212f1687763013b0 Mon Sep 17 00:00:00 2001
-From: Matej Tyc <matyc@redhat.com>
-Date: Thu, 21 Jul 2022 16:43:21 +0200
-Subject: [PATCH 2/3] Use partition exist platforms on a real rule
-
---
- .../partitions/mount_option_var_tmp_nodev/rule.yml           | 3 ++-
- .../mount_option_var_tmp_nodev/tests/notapplicable.pass.sh   | 5 +++++
- 2 files changed, 7 insertions(+), 1 deletion(-)
- create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/tests/notapplicable.pass.sh
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml
-index 8ee8c8b12e0..741d0973283 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml
-@@ -38,7 +38,8 @@ references:
-     stigid@ol8: OL08-00-040132
-     stigid@rhel8: RHEL-08-040132
- 
-platform: machine
-+platforms:
-+  - machine and partition-var-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/tests/notapplicable.pass.sh b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/tests/notapplicable.pass.sh
-new file mode 100644
-index 00000000000..241c0103d82
--- /dev/null
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/tests/notapplicable.pass.sh
-@@ -0,0 +1,5 @@
-+#!/bin/bash
-+
-+. $SHARED/partition.sh
-+
-+clean_up_partition /var/tmp  # Remove the partition from the system, and unmount it
-
-From 7b3c9eb40d362ffcfda542cc2b267bce13e25d5a Mon Sep 17 00:00:00 2001
-From: Matej Tyc <matyc@redhat.com>
-Date: Wed, 10 Aug 2022 11:32:38 +0200
-Subject: [PATCH 3/3] Improve code style
-
- Improve description of OVAL macro
- Use the escape_id filter to produce IDs
---
- shared/checks/oval/installed_env_mounts_tmp.xml     | 2 +-
- shared/checks/oval/installed_env_mounts_var_tmp.xml | 2 +-
- shared/macros/10-oval.jinja                         | 7 +++----
- 3 files changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/shared/checks/oval/installed_env_mounts_tmp.xml b/shared/checks/oval/installed_env_mounts_tmp.xml
-index c1bcd6b2431..edd8ad050f5 100644
--- a/shared/checks/oval/installed_env_mounts_tmp.xml
-+++ b/shared/checks/oval/installed_env_mounts_tmp.xml
-@@ -6,5 +6,5 @@
-     </criteria>
-   </definition>
- 
-  {{{ partition_exists_tos("/tmp") }}}
-+  {{{ partition_exists_test_object("/tmp") }}}
- </def-group>
-diff --git a/shared/checks/oval/installed_env_mounts_var_tmp.xml b/shared/checks/oval/installed_env_mounts_var_tmp.xml
-index a72f49c8a8f..cf9aafbdb04 100644
--- a/shared/checks/oval/installed_env_mounts_var_tmp.xml
-+++ b/shared/checks/oval/installed_env_mounts_var_tmp.xml
-@@ -6,5 +6,5 @@
-     </criteria>
-   </definition>
- 
-  {{{ partition_exists_tos("/var/tmp") }}}
-+  {{{ partition_exists_test_object("/var/tmp") }}}
- </def-group>
-diff --git a/shared/macros/10-oval.jinja b/shared/macros/10-oval.jinja
-index 1ec93b6ef7d..f302091f7df 100644
--- a/shared/macros/10-oval.jinja
-+++ b/shared/macros/10-oval.jinja
-@@ -929,18 +929,17 @@ Generates the :code:`<affected>` tag for OVAL check using correct product platfo
- 
- 
- {{%- macro partition_exists_criterion(path) %}}
-{{%- set escaped_path = path | replace("/", "_") %}}
-+{{%- set escaped_path = path | escape_id %}}
-       <criterion comment="The path {{{ path }}} is a partition's mount point" test_ref="test_partition_{{{ escaped_path  }}}_exists" />
- {{%- endmacro %}}
- 
-{{%- macro partition_exists_tos(path) %}}
-{{%- set escaped_path = path | replace("/", "_") %}}
-+{{%- macro partition_exists_test_object(path) %}}
-+{{%- set escaped_path = path | escape_id %}}
-   <linux:partition_test check="all" check_existence="all_exist"
-       comment="Partition {{{ path }}} exists"
-       id="test_partition_{{{ escaped_path }}}_exists"
-   version="1">
-     <linux:object object_ref="object_partition_{{{ escaped_path }}}_exists" />
-    {{#- <linux:partition_state state_ref="" /> #}}
-   </linux:partition_test>
- 
-   <linux:partition_object id="object_partition_{{{ escaped_path }}}_exists" version="1">
--- a/SOURCES/scap-security-guide-0.1.64-apply_partition_platform_to_rules-PR_9324.patch
+++ b/SOURCES/scap-security-guide-0.1.64-apply_partition_platform_to_rules-PR_9324.patch
@ -1,92 +0,0 @@
-From 51d7ee352dd2e90cb711d949cc59fb36c7fbe5da Mon Sep 17 00:00:00 2001
-From: Matej Tyc <matyc@redhat.com>
-Date: Wed, 10 Aug 2022 13:35:50 +0200
-Subject: [PATCH] Add the platform applicability to relevant rules
-
---
- .../permissions/partitions/mount_option_tmp_nodev/rule.yml      | 2 +-
- .../permissions/partitions/mount_option_tmp_noexec/rule.yml     | 2 +-
- .../permissions/partitions/mount_option_tmp_nosuid/rule.yml     | 2 +-
- .../permissions/partitions/mount_option_var_tmp_bind/rule.yml   | 2 +-
- .../permissions/partitions/mount_option_var_tmp_noexec/rule.yml | 2 +-
- .../permissions/partitions/mount_option_var_tmp_nosuid/rule.yml | 2 +-
- 6 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml
-index 45a73e0286a..79a19a8d30b 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml
-@@ -45,7 +45,7 @@ references:
-     stigid@ol8: OL08-00-040123
-     stigid@rhel8: RHEL-08-040123
- 
-platform: machine
-+platform: machine and partition-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml
-index 7356183bab3..d3f6d6175e5 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml
-@@ -44,7 +44,7 @@ references:
-     stigid@ol8: OL08-00-040125
-     stigid@rhel8: RHEL-08-040125
- 
-platform: machine
-+platform: machine and partition-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml
-index d153b86934f..10790dc95a7 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml
-@@ -45,7 +45,7 @@ references:
-     stigid@ol8: OL08-00-040124
-     stigid@rhel8: RHEL-08-040124
- 
-platform: machine
-+platform: machine and partition-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml
-index 133e7727ca7..05992df4b49 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml
-@@ -31,7 +31,7 @@ references:
-     nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7
-     nist-csf: PR.IP-1,PR.PT-3
- 
-platform: machine
-+platform: machine and partition-var-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml
-index 39fd458ec6b..dc00b2f2376 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml
-@@ -38,7 +38,7 @@ references:
-     stigid@ol8: OL08-00-040134
-     stigid@rhel8: RHEL-08-040134
- 
-platform: machine
-+platform: machine and partition-var-tmp
- 
- template:
-     name: mount_option
-diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml
-index 349f3348955..f0c26b6d9c5 100644
--- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml
-+++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml
-@@ -38,7 +38,7 @@ references:
-     stigid@ol8: OL08-00-040133
-     stigid@rhel8: RHEL-08-040133
- 
-platform: machine
-+platform: machine and partition-var-tmp
- 
- template:
-     name: mount_option
--- a/SOURCES/scap-security-guide-0.1.64-fix_ansible_partition_conditional-PR_9339.patch
+++ b/SOURCES/scap-security-guide-0.1.64-fix_ansible_partition_conditional-PR_9339.patch
@ -1,48 +0,0 @@
-From 779ffcf0a51a1ad5a13e5b8ee29ce044d93eca55 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 15 Aug 2022 13:14:58 +0200
-Subject: [PATCH 1/2] Access the mounts via ansible_mounts
-
-It seems that the data about ansible_mounts should be accessed without
-the 'ansible_facts' prefix.
---
- shared/macros/10-ansible.jinja | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
-index 478f0072bc7..e8bff0973f5 100644
--- a/shared/macros/10-ansible.jinja
-+++ b/shared/macros/10-ansible.jinja
-@@ -1442,5 +1442,5 @@ Part of the grub2_bootloader_argument_absent template.
- 
- 
- {{%- macro ansible_partition_conditional(path) -%}}
-"ansible_facts.ansible_mounts | json_query(\"[?mount=='{{{ path }}}'].mount\") | length == 1"
-+"ansible_mounts | json_query(\"[?mount=='{{{ path }}}'].mount\") | length == 1"
- {{%- endmacro -%}}
-
-From 4963d70d565919d0db6c0bc35f3fd4274d474310 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 15 Aug 2022 13:16:24 +0200
-Subject: [PATCH 2/2] Avoid use of json_query and additional dependency
-
-The json_query filter requires package jmespath to be installed.
-
-This also avoids mismatchs in python version between ansible and
-python3-jmespath. Some distros (RHEL8) don't have jmespath module
-available for the same python version ansible is using.
---
- shared/macros/10-ansible.jinja | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
-index e8bff0973f5..beb2bc11403 100644
--- a/shared/macros/10-ansible.jinja
-+++ b/shared/macros/10-ansible.jinja
-@@ -1442,5 +1442,5 @@ Part of the grub2_bootloader_argument_absent template.
- 
- 
- {{%- macro ansible_partition_conditional(path) -%}}
-"ansible_mounts | json_query(\"[?mount=='{{{ path }}}'].mount\") | length == 1"
-+'"{{{ path }}}" in ansible_mounts | map(attribute="mount") | list'
- {{%- endmacro -%}}
--- a/SOURCES/scap-security-guide-0.1.64-fix_enable_fips_mode_s390x-PR_9355.patch
+++ b/SOURCES/scap-security-guide-0.1.64-fix_enable_fips_mode_s390x-PR_9355.patch
@ -1,33 +0,0 @@
-From 61ff9fd6f455ee49608cab2c851a3819c180c30a Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 16 Aug 2022 18:53:02 +0200
-Subject: [PATCH] Don't fail rule if /etc/grubenv missing on s390x
-
-There is no need to check  /etc/grubenv for fips=1 on s390x systems, it
-uses zIPL.
---
- .../integrity/fips/enable_fips_mode/oval/shared.xml      | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
-index 65056a654c6..7af675de0d3 100644
--- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
-+++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
-@@ -7,9 +7,16 @@
-       <extend_definition comment="Dracut FIPS module is enabled" definition_ref="enable_dracut_fips_module" />
-       <extend_definition comment="system cryptography policy is configured" definition_ref="configure_crypto_policy" />
-       <criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="test_system_crypto_policy_value" />
-      {{% if product in ["ol8","rhel8"] %}}
-+      {{% if product in ["ol8"] %}}
-       <criterion comment="check if the kernel boot parameter is configured for FIPS mode"
-       test_ref="test_grubenv_fips_mode" />
-+      {{% elif product in ["rhel8"] %}}
-+      <criteria operator="OR">
-+        <extend_definition comment="Generic test for s390x architecture"
-+        definition_ref="system_info_architecture_s390_64" />
-+        <criterion comment="check if the kernel boot parameter is configured for FIPS mode"
-+        test_ref="test_grubenv_fips_mode" />
-+      </criteria>
-       {{% endif %}}
-     </criteria>
-   </definition>
--- a/SOURCES/scap-security-guide-0.1.64-fix_sudoers_defaults-PR_9299.patch
+++ b/SOURCES/scap-security-guide-0.1.64-fix_sudoers_defaults-PR_9299.patch
@ -1,107 +0,0 @@
-From 9243f7615c2656003e4a64c88076d0d660f58580 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Fri, 5 Aug 2022 12:45:24 +0200
-Subject: [PATCH] Fix rule sudo_custom_logfile
-
- Allow only white space after the Default keyword to avoid
-  matching words that only start with Default.
- If the variable value contains slashes they need to be escaped
-  because the sed command uses slashes as a separator, otherwise
-  the sed doesn't replace the wrong line during a remediation.
-
-Also adds 2 test scenarios.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2083109
---
- .../guide/system/software/sudo/sudo_custom_logfile/rule.yml  | 2 +-
- .../sudo/sudo_custom_logfile/tests/broken_defaults.fail.sh   | 4 ++++
- .../sudo/sudo_custom_logfile/tests/wrong_logfile.fail.sh     | 4 ++++
- shared/templates/sudo_defaults_option/ansible.template       | 2 +-
- shared/templates/sudo_defaults_option/bash.template          | 5 +++--
- shared/templates/sudo_defaults_option/oval.template          | 2 +-
- 6 files changed, 14 insertions(+), 5 deletions(-)
- create mode 100644 linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/broken_defaults.fail.sh
- create mode 100644 linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/wrong_logfile.fail.sh
-
-diff --git a/linux_os/guide/system/software/sudo/sudo_custom_logfile/rule.yml b/linux_os/guide/system/software/sudo/sudo_custom_logfile/rule.yml
-index 739f5f14936..94fbaaa33ed 100644
--- a/linux_os/guide/system/software/sudo/sudo_custom_logfile/rule.yml
-+++ b/linux_os/guide/system/software/sudo/sudo_custom_logfile/rule.yml
-@@ -29,7 +29,7 @@ ocil_clause: 'logfile is not enabled in sudo'
- 
- ocil: |-
-     To determine if <tt>logfile</tt> has been configured for sudo, run the following command:
-    <pre>$ sudo grep -ri "^[\s]*Defaults.*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/</pre>
-+    <pre>$ sudo grep -ri "^[\s]*Defaults\s*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/</pre>
-     The command should return a matching output.
- 
- template:
-diff --git a/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/broken_defaults.fail.sh b/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/broken_defaults.fail.sh
-new file mode 100644
-index 00000000000..13ff4559edb
--- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/broken_defaults.fail.sh
-@@ -0,0 +1,4 @@
-+#!/bin/bash
-+# platform = multi_platform_all
-+
-+echo "Defaultsabc logfile=/var/log/sudo.log" >> /etc/sudoers
-diff --git a/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/wrong_logfile.fail.sh b/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/wrong_logfile.fail.sh
-new file mode 100644
-index 00000000000..ec24854f0f9
--- /dev/null
-+++ b/linux_os/guide/system/software/sudo/sudo_custom_logfile/tests/wrong_logfile.fail.sh
-@@ -0,0 +1,4 @@
-+#!/bin/bash
-+# platform = multi_platform_all
-+
-+echo "Defaults logfile=/var/log/othersudologfile.log" >> /etc/sudoers
-diff --git a/shared/templates/sudo_defaults_option/ansible.template b/shared/templates/sudo_defaults_option/ansible.template
-index 094fa430b64..c9e344ec772 100644
--- a/shared/templates/sudo_defaults_option/ansible.template
-+++ b/shared/templates/sudo_defaults_option/ansible.template
-@@ -8,7 +8,7 @@
- - name: Ensure {{{ OPTION }}} is enabled with the appropriate value in /etc/sudoers
-   lineinfile:
-     path: /etc/sudoers
-    regexp: '^[\s]*Defaults\s(.*)\b{{{ OPTION }}}=[-]?\w+\b(.*)$'
-+    regexp: '^[\s]*Defaults\s(.*)\b{{{ OPTION }}}=[-]?.+\b(.*)$'
-     line: 'Defaults \1{{{ OPTION }}}={{ {{{ VARIABLE_NAME }}} }}\2'
-     validate: /usr/sbin/visudo -cf %s
-     backrefs: yes
-diff --git a/shared/templates/sudo_defaults_option/bash.template b/shared/templates/sudo_defaults_option/bash.template
-index e3563d42db6..e7d962a668d 100644
--- a/shared/templates/sudo_defaults_option/bash.template
-+++ b/shared/templates/sudo_defaults_option/bash.template
-@@ -9,7 +9,7 @@
- {{% endif %}}
- if /usr/sbin/visudo -qcf /etc/sudoers; then
-     cp /etc/sudoers /etc/sudoers.bak
-    if ! grep -P '^[\s]*Defaults.*\b{{{ OPTION_REGEX }}}\b.*$' /etc/sudoers; then
-+    if ! grep -P '^[\s]*Defaults[\s]*\b{{{ OPTION_REGEX }}}\b.*$' /etc/sudoers; then
-         # sudoers file doesn't define Option {{{ OPTION }}}
-         echo "Defaults {{{ OPTION_VALUE }}}" >> /etc/sudoers
-     {{%- if not VARIABLE_NAME %}}
-@@ -21,7 +21,8 @@ if /usr/sbin/visudo -qcf /etc/sudoers; then
-             {{% if '/' in OPTION %}}
-             {{{ raise("OPTION (" + OPTION + ") uses sed path separator (/) in " + rule_id) }}}
-             {{% endif %}}
-            sed -Ei "s/(^[\s]*Defaults.*\b{{{ OPTION }}}=)[-]?\w+(\b.*$)/\1{{{ '${' ~ VARIABLE_NAME ~ '}' }}}\2/" /etc/sudoers
-+            escaped_variable={{{ "${" ~ VARIABLE_NAME ~ "//$'/'/$'\/'}" }}}
-+            sed -Ei "s/(^[\s]*Defaults.*\b{{{ OPTION }}}=)[-]?.+(\b.*$)/\1$escaped_variable\2/" /etc/sudoers
-         fi
-     fi
-     {{% endif %}}
-diff --git a/shared/templates/sudo_defaults_option/oval.template b/shared/templates/sudo_defaults_option/oval.template
-index c0d81c95093..a9636a7204a 100644
--- a/shared/templates/sudo_defaults_option/oval.template
-+++ b/shared/templates/sudo_defaults_option/oval.template
-@@ -13,7 +13,7 @@
-   </ind:textfilecontent54_test>
-   <ind:textfilecontent54_object id="object_{{{ OPTION }}}_sudoers" version="1">
-     <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*Defaults.*\b{{{ OPTION_REGEX }}}.*$</ind:pattern>
-+    <ind:pattern operation="pattern match">^[\s]*Defaults[\s]*\b{{{ OPTION_REGEX }}}.*$</ind:pattern>
-     <ind:instance datatype="int" operation="greater than or equal" >1</ind:instance>
-   </ind:textfilecontent54_object>
- 
--- a/SOURCES/scap-security-guide-0.1.64-improve_handling_of_rsyslog_includes-PR_9326.patch
+++ b/SOURCES/scap-security-guide-0.1.64-improve_handling_of_rsyslog_includes-PR_9326.patch
@ -1,967 +0,0 @@
-From 2d22616a6223e26662c1dc81e0389349defd716a Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Wed, 13 Apr 2022 20:06:18 +0800
-Subject: [PATCH 01/15] rsyslog: Fix array creation when path has wildcard
-
-This patch fixes the issue that the array is expanded to wildcard path instead of its elements.
-A simple test case as follows:
-
-    /etc/rsyslog.conf
-    include(file="/etc/rsyslog.d/*.conf" mode="optional")
-
-    /etc/rsyslog.d/custom1.conf
-    local1.*    /tmp/local1.out
-
-    /etc/rsyslog.d/custom2.conf
-    local2.*    /tmp/local2.out
---
- .../rsyslog_files_permissions/bash/shared.sh                  | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index b794ea8db31..02b0c36d899 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -5,8 +5,8 @@
- RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
- # * And also the log file paths listed after rsyslog's $IncludeConfig directive
- #   (store the result into array for the case there's shell glob used as value of IncludeConfig)
-readarray -t RSYSLOG_INCLUDE_CONFIG < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
-readarray -t RSYSLOG_INCLUDE < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
-+readarray -t RSYSLOG_INCLUDE_CONFIG < <(printf '%s\n' $(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2))
-+readarray -t RSYSLOG_INCLUDE < <(printf '%s\n' $(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf))
- 
- # Declare an array to hold the final list of different log file paths
- declare -a LOG_FILE_PATHS
-
-From 37a57668e98ba613d850e4c4ec4363dc7687d06d Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Thu, 14 Apr 2022 15:58:04 +0800
-Subject: [PATCH 02/15] A better fix.
-
-  * Should also fixed the CI failure.
---
- .../rsyslog_files_permissions/bash/shared.sh                | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index 02b0c36d899..1aebb8f9da5 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -5,8 +5,10 @@
- RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
- # * And also the log file paths listed after rsyslog's $IncludeConfig directive
- #   (store the result into array for the case there's shell glob used as value of IncludeConfig)
-readarray -t RSYSLOG_INCLUDE_CONFIG < <(printf '%s\n' $(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2))
-readarray -t RSYSLOG_INCLUDE < <(printf '%s\n' $(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf))
-+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
-+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
-+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
-+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
- 
- # Declare an array to hold the final list of different log file paths
- declare -a LOG_FILE_PATHS
-
-From 5135fb64fb773400234c740a3feeac206ac7f42a Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Fri, 15 Apr 2022 10:47:37 +0800
-Subject: [PATCH 03/15] Add test for wildcard paths used in rsyslog
-
---
- .../include_config_syntax_perms_0600.pass.sh  | 56 ++++++++++++++++++
- .../include_config_syntax_perms_0601.fail.sh  | 57 +++++++++++++++++++
- 2 files changed, 113 insertions(+)
- create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
- create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-new file mode 100755
-index 00000000000..7cb09128d78
--- /dev/null
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-@@ -0,0 +1,56 @@
-+#!/bin/bash
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-+
-+# Check rsyslog.conf with log file permissions 0600 from rules and
-+# log file permissions 0600 from $IncludeConfig passes.
-+
-+source $SHARED/rsyslog_log_utils.sh
-+
-+PERMS=0600
-+
-+# setup test data
-+create_rsyslog_test_logs 3
-+
-+# setup test log files and permissions
-+chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-+chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-+chmod $PERMS ${RSYSLOG_TEST_LOGS[2]}
-+
-+# create test configuration file
-+conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-+mkdir ${conf_subdir}
-+test_subdir_conf=${conf_subdir}/test_subdir.conf
-+test_conf=${RSYSLOG_TEST_DIR}/test.conf
-+cat << EOF > ${test_subdir_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[2]}
-+EOF
-+
-+cat << EOF > ${test_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
-+EOF
-+
-+# create rsyslog.conf configuration file
-+cat << EOF > $RSYSLOG_CONF
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[0]}
-+
-+#### MODULES ####
-+
-+include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
-+include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-+
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-+
-+EOF
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-new file mode 100755
-index 00000000000..942eaf086a1
--- /dev/null
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-@@ -0,0 +1,57 @@
-+#!/bin/bash
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
-+
-+# Check rsyslog.conf with log file permissions 0600 from rules and
-+# log file permissions 0601 from $IncludeConfig fails.
-+
-+source $SHARED/rsyslog_log_utils.sh
-+
-+PERMS_PASS=0600
-+PERMS_FAIL=0601
-+
-+# setup test data
-+create_rsyslog_test_logs 3
-+
-+# setup test log files and permissions
-+chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-+
-+# create test configuration file
-+conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-+mkdir ${conf_subdir}
-+test_subdir_conf=${conf_subdir}/test_subdir.conf
-+test_conf=${RSYSLOG_TEST_DIR}/test.conf
-+cat << EOF > ${test_subdir_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[2]}
-+EOF
-+
-+cat << EOF > ${test_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
-+EOF
-+
-+# create rsyslog.conf configuration file
-+cat << EOF > $RSYSLOG_CONF
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[0]}
-+
-+#### MODULES ####
-+
-+include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
-+include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-+
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-+
-+EOF
-
-From 052558d8d5be3b8ce49067ab8c05ed9ea92bab0b Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Thu, 19 May 2022 01:22:19 +0800
-Subject: [PATCH 04/15] The way using 'find' can be retired.
-
---
- .../rsyslog_files_permissions/bash/shared.sh  | 20 +++++--------------
- 1 file changed, 5 insertions(+), 15 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index 1aebb8f9da5..cece5930ee8 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -13,22 +13,12 @@ readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf
- # Declare an array to hold the final list of different log file paths
- declare -a LOG_FILE_PATHS
- 
-RSYSLOG_CONFIGS=()
-RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
-+declare -a RSYSLOG_CONFIGS
-+RSYSLOG_CONFIGS+=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
- 
-# Get full list of files to be checked
-# RSYSLOG_CONFIGS may contain globs such as 
-# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
-# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
-RSYSLOG_FILES=()
-for ENTRY in "${RSYSLOG_CONFIGS[@]}"
-do
-     mapfile -t FINDOUT < <(find "$(dirname "${ENTRY}")" -maxdepth 1 -name "$(basename "${ENTRY}")")
-     RSYSLOG_FILES+=("${FINDOUT[@]}")
-done
-
-# Check file and fix if needed.
-for LOG_FILE in "${RSYSLOG_FILES[@]}"
-+# Browse each file selected above as containing paths of log files
-+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
-+for LOG_FILE in "${RSYSLOG_CONFIGS[@]}"
- do
- 	# From each of these files extract just particular log file path(s), thus:
- 	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
-
-From 4f1d08642a74c0be7cd02815784a2c81b7b558ee Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Fri, 20 May 2022 01:30:37 +0800
-Subject: [PATCH 05/15] Cover the include pattern '/etc/rsyslog.d/'
-
---
- .../rsyslog_files_permissions/bash/shared.sh  | 20 ++++++++++++++++++-
- 1 file changed, 19 insertions(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index cece5930ee8..50d36d7426f 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -13,12 +13,30 @@ readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf
- # Declare an array to hold the final list of different log file paths
- declare -a LOG_FILE_PATHS
- 
-+# Array to hold all rsyslog config entries
- declare -a RSYSLOG_CONFIGS
- RSYSLOG_CONFIGS+=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
- 
-+# Array to hold all rsyslog config files
-+declare -a RSYSLOG_CONFIG_FILES
-+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
-+do
-+	# If directory, need to include files recursively
-+	if [ -d "${ENTRY}" ]
-+	then
-+		readarray -t FINDOUT < <(find "${ENTRY}" -type f -name '*.conf')
-+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
-+	elif [ -f "${ENTRY}" ]
-+	then
-+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
-+	else
-+		echo "Invalid include object: ${ENTRY}"
-+	fi
-+done
-+
- # Browse each file selected above as containing paths of log files
- # ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
-for LOG_FILE in "${RSYSLOG_CONFIGS[@]}"
-+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
- do
- 	# From each of these files extract just particular log file path(s), thus:
- 	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
-
-From d77551b64c4d67226627d0819dc30fff9433ac2b Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Fri, 20 May 2022 01:46:33 +0800
-Subject: [PATCH 06/15] Update test files.
-
---
- .../tests/include_config_syntax_perms_0600.pass.sh              | 2 ++
- .../tests/include_config_syntax_perms_0601.fail.sh              | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-index 7cb09128d78..2ddd9fcb697 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-@@ -49,8 +49,10 @@ cat << EOF > $RSYSLOG_CONF
- 
- include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
- include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-+include(file="${RSYSLOG_TEST_DIR}" mode="optional")
- 
- \$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
- \$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}
- 
- EOF
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-index 942eaf086a1..73ff3332c6d 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-@@ -50,8 +50,10 @@ cat << EOF > $RSYSLOG_CONF
- 
- include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
- include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-+include(file="${RSYSLOG_TEST_DIR}" mode="optional")
- 
- \$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
- \$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-+\$IncludeConfig ${RSYSLOG_TEST_DIR}
- 
- EOF
-
-From 9a97bfa1ca4c918a39a68131e5fbc46fa7b00961 Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Fri, 20 May 2022 10:03:32 +0800
-Subject: [PATCH 07/15] Rsyslog says we should include all files
-
---
- .../rsyslog_files_permissions/bash/shared.sh     |  2 +-
- .../include_config_syntax_perms_0600.pass.sh     | 16 +++++++++++++++-
- .../include_config_syntax_perms_0601.fail.sh     | 16 +++++++++++++++-
- 3 files changed, 31 insertions(+), 3 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index 50d36d7426f..cd5014105e9 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -24,7 +24,7 @@ do
- 	# If directory, need to include files recursively
- 	if [ -d "${ENTRY}" ]
- 	then
-		readarray -t FINDOUT < <(find "${ENTRY}" -type f -name '*.conf')
-+		readarray -t FINDOUT < <(find "${ENTRY}" -type f)
- 		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
- 	elif [ -f "${ENTRY}" ]
- 	then
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-index 2ddd9fcb697..755865ca522 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-@@ -9,20 +9,24 @@ source $SHARED/rsyslog_log_utils.sh
- PERMS=0600
- 
- # setup test data
-create_rsyslog_test_logs 3
-+create_rsyslog_test_logs 4
- 
- # setup test log files and permissions
- chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
- chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
- chmod $PERMS ${RSYSLOG_TEST_LOGS[2]}
-+chmod $PERMS ${RSYSLOG_TEST_LOGS[3]}
- 
- # create test configuration file
- conf_subdir=${RSYSLOG_TEST_DIR}/subdir
- mkdir ${conf_subdir}
- test_subdir_conf=${conf_subdir}/test_subdir.conf
- test_conf=${RSYSLOG_TEST_DIR}/test.conf
-+test_bak=${RSYSLOG_TEST_DIR}/test.bak
-+
- cat << EOF > ${test_subdir_conf}
- # rsyslog configuration file
-+# test_subdir_conf
- 
- #### RULES ####
- 
-@@ -31,12 +35,22 @@ EOF
- 
- cat << EOF > ${test_conf}
- # rsyslog configuration file
-+# test_conf
- 
- #### RULES ####
- 
- *.*     ${RSYSLOG_TEST_LOGS[1]}
- EOF
- 
-+cat << EOF > ${test_bak}
-+# rsyslog configuration file
-+# test_bak
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[3]}
-+EOF
-+
- # create rsyslog.conf configuration file
- cat << EOF > $RSYSLOG_CONF
- # rsyslog configuration file
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-index 73ff3332c6d..063b1a0cbe5 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-@@ -10,20 +10,24 @@ PERMS_PASS=0600
- PERMS_FAIL=0601
- 
- # setup test data
-create_rsyslog_test_logs 3
-+create_rsyslog_test_logs 4
- 
- # setup test log files and permissions
- chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
- chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
- chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[3]}
- 
- # create test configuration file
- conf_subdir=${RSYSLOG_TEST_DIR}/subdir
- mkdir ${conf_subdir}
- test_subdir_conf=${conf_subdir}/test_subdir.conf
- test_conf=${RSYSLOG_TEST_DIR}/test.conf
-+test_bak=${RSYSLOG_TEST_DIR}/test.bak
-+
- cat << EOF > ${test_subdir_conf}
- # rsyslog configuration file
-+# test_subdir_conf
- 
- #### RULES ####
- 
-@@ -32,12 +36,22 @@ EOF
- 
- cat << EOF > ${test_conf}
- # rsyslog configuration file
-+# test_conf
- 
- #### RULES ####
- 
- *.*     ${RSYSLOG_TEST_LOGS[1]}
- EOF
- 
-+cat << EOF > ${test_bak}
-+# rsyslog configuration file
-+# test_bak
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[3]}
-+EOF
-+
- # create rsyslog.conf configuration file
- cat << EOF > $RSYSLOG_CONF
- # rsyslog configuration file
-
-From fcfc7c126ed76488085ef35cd0fd497c272aa364 Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Sat, 21 May 2022 16:02:26 +0800
-Subject: [PATCH 08/15] Match glob() function of rsyslog
-
---
- .../rsyslog_files_permissions/bash/shared.sh  |  5 ++-
- .../include_config_syntax_perms_0600.pass.sh  | 39 ++++++++++++-------
- .../include_config_syntax_perms_0601.fail.sh  | 39 ++++++++++++-------
- 3 files changed, 55 insertions(+), 28 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index cd5014105e9..38105bf086b 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -21,10 +21,11 @@ RSYSLOG_CONFIGS+=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYS
- declare -a RSYSLOG_CONFIG_FILES
- for ENTRY in "${RSYSLOG_CONFIGS[@]}"
- do
-	# If directory, need to include files recursively
-+	# If directory, rsyslog will search for config files in recursively.
-+	# However, files in hidden sub-directories or hidden files will be ignored.
- 	if [ -d "${ENTRY}" ]
- 	then
-		readarray -t FINDOUT < <(find "${ENTRY}" -type f)
-+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
- 		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
- 	elif [ -f "${ENTRY}" ]
- 	then
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-index 755865ca522..a5a2f67fadc 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
-@@ -9,48 +9,61 @@ source $SHARED/rsyslog_log_utils.sh
- PERMS=0600
- 
- # setup test data
-create_rsyslog_test_logs 4
-+create_rsyslog_test_logs 5
- 
- # setup test log files and permissions
- chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
- chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
- chmod $PERMS ${RSYSLOG_TEST_LOGS[2]}
- chmod $PERMS ${RSYSLOG_TEST_LOGS[3]}
-+chmod $PERMS ${RSYSLOG_TEST_LOGS[4]}
- 
-# create test configuration file
-+# create test configuration files
- conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-+conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir
- mkdir ${conf_subdir}
-test_subdir_conf=${conf_subdir}/test_subdir.conf
-test_conf=${RSYSLOG_TEST_DIR}/test.conf
-test_bak=${RSYSLOG_TEST_DIR}/test.bak
-+mkdir ${conf_hiddir}
- 
-cat << EOF > ${test_subdir_conf}
-+test_conf_in_subdir=${conf_subdir}/in_subdir.conf
-+test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak
-+
-+test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf
-+test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf
-+
-+cat << EOF > ${test_conf_in_subdir}
- # rsyslog configuration file
-# test_subdir_conf
- 
- #### RULES ####
- 
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
- EOF
- 
-cat << EOF > ${test_conf}
-+cat << EOF > ${test_conf_name_bak}
- # rsyslog configuration file
-# test_conf
- 
- #### RULES ####
- 
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-+*.*     ${RSYSLOG_TEST_LOGS[2]}
- EOF
- 
-cat << EOF > ${test_bak}
-+cat << EOF > ${test_conf_in_hiddir}
- # rsyslog configuration file
-# test_bak
-+# not used
- 
- #### RULES ####
- 
- *.*     ${RSYSLOG_TEST_LOGS[3]}
- EOF
- 
-+cat << EOF > ${test_conf_dot_name}
-+# rsyslog configuration file
-+# not used
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[4]}
-+EOF
-+
- # create rsyslog.conf configuration file
- cat << EOF > $RSYSLOG_CONF
- # rsyslog configuration file
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-index 063b1a0cbe5..a9d0adfb727 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-@@ -10,48 +10,61 @@ PERMS_PASS=0600
- PERMS_FAIL=0601
- 
- # setup test data
-create_rsyslog_test_logs 4
-+create_rsyslog_test_logs 5
- 
- # setup test log files and permissions
- chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
- chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
- chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
- chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[3]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[4]}
- 
-# create test configuration file
-+# create test configuration files
- conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-+conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir
- mkdir ${conf_subdir}
-test_subdir_conf=${conf_subdir}/test_subdir.conf
-test_conf=${RSYSLOG_TEST_DIR}/test.conf
-test_bak=${RSYSLOG_TEST_DIR}/test.bak
-+mkdir ${conf_hiddir}
- 
-cat << EOF > ${test_subdir_conf}
-+test_conf_in_subdir=${conf_subdir}/in_subdir.conf
-+test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak
-+
-+test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf
-+test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf
-+
-+cat << EOF > ${test_conf_in_subdir}
- # rsyslog configuration file
-# test_subdir_conf
- 
- #### RULES ####
- 
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
- EOF
- 
-cat << EOF > ${test_conf}
-+cat << EOF > ${test_conf_name_bak}
- # rsyslog configuration file
-# test_conf
- 
- #### RULES ####
- 
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-+*.*     ${RSYSLOG_TEST_LOGS[2]}
- EOF
- 
-cat << EOF > ${test_bak}
-+cat << EOF > ${test_conf_in_hiddir}
- # rsyslog configuration file
-# test_bak
-+# not used
- 
- #### RULES ####
- 
- *.*     ${RSYSLOG_TEST_LOGS[3]}
- EOF
- 
-+cat << EOF > ${test_conf_dot_name}
-+# rsyslog configuration file
-+# not used
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[4]}
-+EOF
-+
- # create rsyslog.conf configuration file
- cat << EOF > $RSYSLOG_CONF
- # rsyslog configuration file
-
-From 313094b7d5c13ba38a2d02fad544cd4665c5a17d Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Sun, 22 May 2022 21:10:16 +0800
-Subject: [PATCH 09/15] Fixed incorrect parsing of rules in old code
-
---
- .../rsyslog_files_permissions/bash/shared.sh                    | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index 38105bf086b..e1129e34c81 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -54,7 +54,7 @@ do
- 	then
- 		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
- 		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
-		FILTERED_PATHS=$(sed -e 's/[^\/]*[[:space:]]*\([^:;[:space:]]*\)/\1/g' <<< "${LINES_WITH_PATHS}")
-+		FILTERED_PATHS=$(awk '{if(NF>=2&&($2~/^\//||$2~/^-\//)){sub(/^-\//,"/",$2);print $2}}' <<< "${LINES_WITH_PATHS}")
- 		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
- 		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
- 		# Since above sed command might return more than one item (delimited by newline), split the particular
-
-From 86f655ac79d879c1f47bda7a06cc15a64e65e5fb Mon Sep 17 00:00:00 2001
-From: Flos Lonicerae <lonicerae@gmail.com>
-Date: Tue, 24 May 2022 00:42:17 +0800
-Subject: [PATCH 10/15] Added platform.
-
---
- .../tests/include_config_syntax_perms_0601.fail.sh              | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-index a9d0adfb727..fe4db0a3c91 100755
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
-@@ -1,5 +1,5 @@
- #!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
-+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
- 
- # Check rsyslog.conf with log file permissions 0600 from rules and
- # log file permissions 0601 from $IncludeConfig fails.
-
-From e71901895f29af9a34fe81938be1332691b6f64a Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Aug 2022 13:56:39 +0200
-Subject: [PATCH 11/15] Reset the arrays before using them
-
-When bash remediations for a profile are generated, it can happen that a
-variable with same name is used for multiple remediations.
-So let's reset the array before using it.
---
- .../rsyslog_files_permissions/bash/shared.sh          | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-index e1129e34c81..d1856ffbe7b 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
-@@ -14,11 +14,14 @@ readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf
- declare -a LOG_FILE_PATHS
- 
- # Array to hold all rsyslog config entries
-declare -a RSYSLOG_CONFIGS
-RSYSLOG_CONFIGS+=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
-+RSYSLOG_CONFIGS=()
-+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
- 
-# Array to hold all rsyslog config files
-declare -a RSYSLOG_CONFIG_FILES
-+# Get full list of files to be checked
-+# RSYSLOG_CONFIGS may contain globs such as 
-+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
-+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
-+RSYSLOG_CONFIG_FILES=()
- for ENTRY in "${RSYSLOG_CONFIGS[@]}"
- do
- 	# If directory, rsyslog will search for config files in recursively.
-
-From 525dce106bf8d054c83e8d79acbb92cc16224e4c Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Aug 2022 14:55:37 +0200
-Subject: [PATCH 12/15] Don't parse hidden config files for Includes
-
-Let's follow rsyslog behavior and not capture process hidden config
-files for includes.
---
- .../rsyslog_files_permissions/oval/shared.xml |  9 ++++
- ...00_IncludeConfig_perms_0601_hidden.pass.sh | 53 +++++++++++++++++++
- 2 files changed, 62 insertions(+)
- create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
-index a04e6fd8900..d13177216c3 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
-@@ -17,8 +17,17 @@
-     <ind:filepath>/etc/rsyslog.conf</ind:filepath>
-     <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
-     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
-+    <filter action="exclude">state_permissions_ignore_hidden_paths</filter>
-   </ind:textfilecontent54_object>
- 
-+  <ind:textfilecontent54_state id="state_permissions_ignore_hidden_paths" comment="ignore hidden conf files" version="1">
-+    <!-- Among the paths matched in object_rfp_rsyslog_include_config_value there can be paths from
-+         include() or $IncludeConfig that point to hidden dirs or files.
-+         Rsyslog ignores these conf files, so we should ignore them too.
-+    -->
-+    <ind:subexpression operation="pattern match">^.*\/\..*$</ind:subexpression>
-+  </ind:textfilecontent54_state>
-+
-   <!-- Turn that glob value into Perl's regex so it can be used as filepath pattern below -->
-   <local_variable id="var_rfp_include_config_regex" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
-     <unique>
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
-new file mode 100644
-index 00000000000..9b0185c6b2f
--- /dev/null
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
-@@ -0,0 +1,53 @@
-+#!/bin/bash
-+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-+
-+# Check rsyslog.conf with log file permisssions 0600 from rules and
-+# log file permissions 0601 from include() fails.
-+
-+source $SHARED/rsyslog_log_utils.sh
-+
-+PERMS_PASS=0600
-+PERMS_FAIL=0601
-+
-+# setup test data
-+create_rsyslog_test_logs 3
-+
-+# setup test log files and permissions
-+chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-+chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-+
-+# create test configuration file
-+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-+cat << EOF > ${test_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
-+EOF
-+
-+# create hidden test2 configuration file
-+test_conf2=${RSYSLOG_TEST_DIR}/.test2.conf
-+cat << EOF > ${test_conf2}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[2]}
-+EOF
-+
-+# create rsyslog.conf configuration file
-+cat << EOF > $RSYSLOG_CONF
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[0]}
-+
-+#### MODULES ####
-+
-+include(file="${test_conf}")
-+
-+\$IncludeConfig ${test_conf2}
-+EOF
-
-From d872c4a2cfcd3331b7aae954aacf3d0d481d1582 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Aug 2022 15:49:11 +0200
-Subject: [PATCH 13/15] Add test for for missing rsyslog included files
-
-The rsyslog conf file may include other config files.
-If the included missing files are missing rsyslog will generate an
-error, but will still continue working.
-https://www.rsyslog.com/doc/master/rainerscript/include.html#include-a-required-file
-
-There is not a good way of ensuring that all files defined in a list of paths exist.
---
- ...0_IncludeConfig_perms_0601_missing.pass.sh | 45 +++++++++++++++++++
- 1 file changed, 45 insertions(+)
- create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
-new file mode 100644
-index 00000000000..b929f2a94ab
--- /dev/null
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
-@@ -0,0 +1,45 @@
-+#!/bin/bash
-+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-+
-+# Check rsyslog.conf with log file permisssions 0600 from rules and
-+# log file permissions 0601 from include() fails.
-+
-+source $SHARED/rsyslog_log_utils.sh
-+
-+PERMS_PASS=0600
-+PERMS_FAIL=0601
-+
-+# setup test data
-+create_rsyslog_test_logs 3
-+
-+# setup test log files and permissions
-+chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-+chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-+chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-+
-+# create test configuration file
-+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-+cat << EOF > ${test_conf}
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[1]}
-+EOF
-+
-+# Skip creation test2 configuration file
-+
-+# create rsyslog.conf configuration file
-+cat << EOF > $RSYSLOG_CONF
-+# rsyslog configuration file
-+
-+#### RULES ####
-+
-+*.*     ${RSYSLOG_TEST_LOGS[0]}
-+
-+#### MODULES ####
-+
-+include(file="${test_conf}")
-+
-+\$IncludeConfig ${test_conf2}
-+EOF
-
-From cf9eaf6e55405248731cb08268bcba6a58a93486 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Aug 2022 21:47:18 +0200
-Subject: [PATCH 14/15] Align Ansible remediation with Bash
-
-The remediation now expands the glob expressions and doesn't collect
-hidden files or directories to check for their permissions.
---
- .../rsyslog_files_permissions/ansible/shared.yml  | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-index 635b72f7352..c558bf46c71 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-@@ -19,19 +19,26 @@
-   shell: |
-     set -o pipefail
-     grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
-  register: include_config_output
-+  register: rsyslog_old_inc
-   changed_when: False
- 
- - name: "Get include files directives"
-   shell: |
-     set -o pipefail
-     grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut  -d"\"" -f 2 || true
-  register: include_files_output
-+  register: rsyslog_new_inc
-   changed_when: False
- 
-+- name: "Expand glob expressions"
-+  shell: |
-+    set -o pipefail
-+    eval printf '%s\\n' {{ item }}
-+  register: include_config_output
-+  loop: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}"
-+
- - name: "List all config files"
-  shell: find "$(dirname "{{ item }}" )" -maxdepth 1 -name "$(basename "{{ item }}")"
-  loop: "{{ include_config_output.stdout_lines + include_files_output.stdout_lines }}"
-+  shell: find {{ item }} -not -path "*/.*" -type f
-+  loop: "{{ include_config_output.results|map(attribute='stdout_lines')|list|flatten }}"
-   register: rsyslog_config_files
-   changed_when: False
- 
-
-From 37e98ed3a86a0e56543132752c62982ff01cd3d9 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 10 Aug 2022 21:56:05 +0200
-Subject: [PATCH 15/15] Ignore invalid or non existing include objects
-
-Let's not fail the task when the find doesn't find the include object.
-When the include is a glob expression that doesn't evaluate to any file
-the glob itself is used in find command.
-
-The Bash remediation prints a message for each include that is not a
-file is not a directory or doesn't exist.
---
- .../rsyslog_files_permissions/ansible/shared.yml                 | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-index c558bf46c71..3a9380cf13b 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
-@@ -40,6 +40,7 @@
-   shell: find {{ item }} -not -path "*/.*" -type f
-   loop: "{{ include_config_output.results|map(attribute='stdout_lines')|list|flatten }}"
-   register: rsyslog_config_files
-+  failed_when: False
-   changed_when: False
- 
- - name: "Extract log files"
--- a/SOURCES/scap-security-guide-0.1.64-ospp_autselect_minimal-PR_9298.patch
+++ b/SOURCES/scap-security-guide-0.1.64-ospp_autselect_minimal-PR_9298.patch
@ -1,90 +0,0 @@
-From 4ef59d44355179b6450ac493d4417a8b29d8ccf1 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Fri, 5 Aug 2022 11:45:15 +0200
-Subject: [PATCH 1/4] fix ospp references
-
---
- linux_os/guide/system/accounts/enable_authselect/rule.yml | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/linux_os/guide/system/accounts/enable_authselect/rule.yml b/linux_os/guide/system/accounts/enable_authselect/rule.yml
-index c151d3c4aa1..f9b46c51ddd 100644
--- a/linux_os/guide/system/accounts/enable_authselect/rule.yml
-+++ b/linux_os/guide/system/accounts/enable_authselect/rule.yml
-@@ -34,6 +34,7 @@ references:
-     disa: CCI-000213
-     hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)  # taken from require_singleuser_auth
-     nist: AC-3
-+    ospp: FIA_UAU.1,FIA_AFL.1
-     srg: SRG-OS-000480-GPOS-00227
- 
- ocil: |-
-
-From 05a0414b565097c155d0c4a1696d8c4f2da91298 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Fri, 5 Aug 2022 11:45:42 +0200
-Subject: [PATCH 2/4] change authselect profile to minimal in rhel9 ospp
-
---
- products/rhel9/profiles/ospp.profile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
-index b47630c62b0..dcc41970043 100644
--- a/products/rhel9/profiles/ospp.profile
-+++ b/products/rhel9/profiles/ospp.profile
-@@ -115,7 +115,7 @@ selections:
-     - coredump_disable_storage
-     - coredump_disable_backtraces
-     - service_systemd-coredump_disabled
-    - var_authselect_profile=sssd
-+    - var_authselect_profile=minimal
-     - enable_authselect
-     - use_pam_wheel_for_su
- 
-
-From 350135aa0c49a8a383103f88034acbb3925bb556 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Fri, 5 Aug 2022 11:45:54 +0200
-Subject: [PATCH 3/4] change authselect profile to minimal in rhel8 ospp
-
---
- products/rhel8/profiles/ospp.profile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile
-index 39ad1797c7a..ebec8a3a6f9 100644
--- a/products/rhel8/profiles/ospp.profile
-+++ b/products/rhel8/profiles/ospp.profile
-@@ -220,7 +220,7 @@ selections:
-     - var_accounts_max_concurrent_login_sessions=10
-     - accounts_max_concurrent_login_sessions
-     - securetty_root_login_console_only
-    - var_authselect_profile=sssd
-+    - var_authselect_profile=minimal
-     - enable_authselect
-     - var_password_pam_unix_remember=5
-     - accounts_password_pam_unix_remember
-
-From 9d6014242b3fcda06b38ac35d73d5d4df75313a3 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Fri, 5 Aug 2022 13:55:05 +0200
-Subject: [PATCH 4/4] update profile stability test
-
---
- tests/data/profile_stability/rhel8/ospp.profile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
-index 5d73a8c6fef..21e93e310d5 100644
--- a/tests/data/profile_stability/rhel8/ospp.profile
-+++ b/tests/data/profile_stability/rhel8/ospp.profile
-@@ -242,7 +242,7 @@ selections:
- - var_slub_debug_options=P
- - var_auditd_flush=incremental_async
- - var_accounts_max_concurrent_login_sessions=10
-- var_authselect_profile=sssd
-+- var_authselect_profile=minimal
- - var_password_pam_unix_remember=5
- - var_selinux_state=enforcing
- - var_selinux_policy_name=targeted
--- a/SOURCES/scap-security-guide-0.1.64-ospp_grub_disable_recovery-PR_9321.patch
+++ b/SOURCES/scap-security-guide-0.1.64-ospp_grub_disable_recovery-PR_9321.patch
@ -1,50 +0,0 @@
-From b36ecf8942ce8dea0c4a2b06b4607259deaf3613 Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Wed, 10 Aug 2022 09:59:57 +0200
-Subject: [PATCH] switch rule grub2_disable_interactive_boot for
- grub2_disable_recovery in rhel8 ospp
-
---
- .../system/bootloader-grub2/grub2_disable_recovery/rule.yml     | 1 +
- products/rhel8/profiles/ospp.profile                            | 2 +-
- tests/data/profile_stability/rhel8/ospp.profile                 | 2 +-
- 4 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/linux_os/guide/system/bootloader-grub2/grub2_disable_recovery/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_disable_recovery/rule.yml
-index 4f8d4ddcfde..fb126cbe7d8 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_disable_recovery/rule.yml
-+++ b/linux_os/guide/system/bootloader-grub2/grub2_disable_recovery/rule.yml
-@@ -17,6 +17,7 @@ rationale: |-
- severity: medium
- 
- identifiers:
-+    cce@rhel8: CCE-86006-4
-     cce@rhel9: CCE-85986-8
- 
- references:
-diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile
-index ebec8a3a6f9..6e3b30f64bb 100644
--- a/products/rhel8/profiles/ospp.profile
-+++ b/products/rhel8/profiles/ospp.profile
-@@ -304,7 +304,7 @@ selections:
-     ## Disable Unauthenticated Login (such as Guest Accounts)
-     ## FIA_UAU.1
-     - require_singleuser_auth
-    - grub2_disable_interactive_boot
-+    - grub2_disable_recovery
-     - grub2_uefi_password
-     - no_empty_passwords
- 
-diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
-index 21e93e310d5..267b66a4f89 100644
--- a/tests/data/profile_stability/rhel8/ospp.profile
-+++ b/tests/data/profile_stability/rhel8/ospp.profile
-@@ -89,7 +89,7 @@ selections:
- - ensure_redhat_gpgkey_installed
- - grub2_audit_argument
- - grub2_audit_backlog_limit_argument
-- grub2_disable_interactive_boot
-+- grub2_disable_recovery
- - grub2_kernel_trust_cpu_rng
- - grub2_page_poison_argument
- - grub2_pti_argument
--- a/SOURCES/scap-security-guide-0.1.64-stig_aide-PR_9282.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_aide-PR_9282.patch
@ -1,97 +0,0 @@
-From 95b79ffa7e9247bd65a92311b92e37b0d83e4432 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Aug 2022 15:01:42 +0200
-Subject: [PATCH] Add rsyslogd to the list of tools check by aide
-
-RHEL products will also check for integrity of /usr/sbin/rsyslogd.
---
- .../aide/aide_check_audit_tools/ansible/shared.yml             | 1 +
- .../aide/aide_check_audit_tools/bash/shared.sh                 | 3 +--
- .../aide/aide_check_audit_tools/oval/shared.xml                | 2 +-
- .../aide/aide_check_audit_tools/tests/correct.pass.sh          | 2 +-
- .../aide_check_audit_tools/tests/correct_with_selinux.pass.sh  | 2 +-
- .../aide/aide_check_audit_tools/tests/not_config.fail.sh       | 2 +-
- 6 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
-index 9d1b7b675c9..5905ea8d0e6 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml
-@@ -22,6 +22,7 @@
-       - /usr/sbin/aureport
-       - /usr/sbin/ausearch
-       - /usr/sbin/autrace
-+      {{% if product == 'ol8' or 'rhel' in product %}}- /usr/sbin/rsyslogd{{% endif %}}
- 
- - name: Ensure existing AIDE configuration for audit tools are correct
-   lineinfile:
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
-index d0a1ba2522f..a81e25c3950 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh
-@@ -18,12 +18,11 @@
- {{% set auditfiles = auditfiles + ["/usr/sbin/audispd"] %}}
- {{% endif %}}
- 
-{{% if product == 'ol8' %}}
-+{{% if product == 'ol8' or 'rhel' in product %}}
- {{% set auditfiles = auditfiles + ["/usr/sbin/rsyslogd"] %}}
- {{% endif %}}
- 
- {{% for file in auditfiles %}}
-
- if grep -i '^.*{{{file}}}.*$' {{{ aide_conf_path }}}; then
- sed -i "s#.*{{{file}}}.*#{{{file}}} {{{ aide_string() }}}#" {{{ aide_conf_path }}}
- else
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
-index 6ce56c1137a..ca9bf4f94d0 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml
-@@ -11,7 +11,7 @@
-       {{% if 'rhel' not in product and product != 'ol8' %}}
-       <criterion comment="audispd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_audispd" />
-       {{% endif %}}
-      {{% if product == 'ol8' %}}
-+      {{% if product == 'ol8' or 'rhel' in product %}}
-       <criterion comment="rsyslogd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_rsyslogd" />
-       {{% endif %}}
-       <criterion comment="augenrules is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_augenrules" />
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
-index 756b88d8a23..071dde13295 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh
-@@ -7,7 +7,7 @@ aide --init
- 
- 
- declare -a bins
-bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
-+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace' '/usr/sbin/rsyslogd')
- 
- for theFile in "${bins[@]}"
- do
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
-index f3a2a126d3d..cb9bbfa7350 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh
-@@ -4,7 +4,7 @@
- yum -y install aide
- 
- declare -a bins
-bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
-+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace' '/usr/sbin/rsyslogd')
- 
- for theFile in "${bins[@]}"
- do
-diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
-index 4315cef2073..a22aecb0000 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
-+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh
-@@ -6,7 +6,7 @@ yum -y install aide
- aide --init
- 
- declare -a bins
-bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace')
-+bins=('/usr/sbin/auditctl' '/usr/sbin/auditd' '/usr/sbin/augenrules' '/usr/sbin/aureport' '/usr/sbin/ausearch' '/usr/sbin/autrace' '/usr/sbin/rsyslogd')
- 
- for theFile in "${bins[@]}"
- do
--- a/SOURCES/scap-security-guide-0.1.64-stig_bump_version-PR_9276.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_bump_version-PR_9276.patch
--- a/SOURCES/scap-security-guide-0.1.64-stig_ipv4_forwarding-PR_9277.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_ipv4_forwarding-PR_9277.patch
@ -1,187 +0,0 @@
-From 82012a2c80e0f0bed75586b7d93570db2121962e Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 1 Aug 2022 17:50:37 +0200
-Subject: [PATCH 1/2] Add rule for sysctl net.ipv4.conf.all.forwarding
-
-This is rule is similar to sysctl_net_ipv6_conf_all_forwarding and
-sysctl_net_ipv4_forward.
---
- .../rule.yml                                  | 44 +++++++++++++++++++
- ...ctl_net_ipv4_conf_all_forwarding_value.var | 17 +++++++
- shared/references/cce-redhat-avail.txt        |  1 -
- 3 files changed, 61 insertions(+), 1 deletion(-)
- create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml
- create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var
-
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml
-new file mode 100644
-index 00000000000..7b0066f7c29
--- /dev/null
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml
-@@ -0,0 +1,44 @@
-+documentation_complete: true
-+
-+prodtype: rhel8
-+
-+title: 'Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces'
-+
-+description: '{{{ describe_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}}'
-+
-+rationale: |-
-+    IP forwarding permits the kernel to forward packets from one network
-+    interface to another. The ability to forward packets between two networks is
-+    only appropriate for systems acting as routers.
-+
-+severity: medium
-+
-+identifiers:
-+    cce@rhel8: CCE-86220-1
-+
-+references:
-+    disa: CCI-000366
-+    nist: CM-6(b)
-+    srg: SRG-OS-000480-GPOS-00227
-+    stigid@rhel8: RHEL-08-040259
-+
-+ocil_clause: 'IP forwarding value is "1" and the system is not router'
-+
-+ocil: |-
-+    {{{ ocil_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}}
-+    The ability to forward packets is only appropriate for routers.
-+
-+fixtext: |-
-+    Configure {{{ full_name }}} to not allow packet forwarding unless the system is a router with the following commands:
-+    {{{ fixtext_sysctl(sysctl="net.ipv4.conf.all.forwarding", value="0") | indent(4) }}}
-+
-+srg_requirement: '{{{ full_name }}} must not perform packet forwarding unless the system is a router.'
-+
-+platform: machine
-+
-+template:
-+    name: sysctl
-+    vars:
-+        sysctlvar: net.ipv4.conf.all.forwarding
-+        datatype: int
-+
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var
-new file mode 100644
-index 00000000000..2aedd6e6432
--- /dev/null
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var
-@@ -0,0 +1,17 @@
-+documentation_complete: true
-+
-+title: net.ipv4.conf.all.forwarding
-+
-+description: 'Toggle IPv4 Forwarding'
-+
-+type: number
-+
-+operator: equals
-+
-+interactive: false
-+
-+options:
-+    default: "0"
-+    disabled: "0"
-+    enabled: 1
-+
-diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
-index 914233f06bf..3e14b73dd71 100644
--- a/shared/references/cce-redhat-avail.txt
-+++ b/shared/references/cce-redhat-avail.txt
-@@ -168,7 +168,6 @@ CCE-86216-9
- CCE-86217-7
- CCE-86218-5
- CCE-86219-3
-CCE-86220-1
- CCE-86221-9
- CCE-86222-7
- CCE-86223-5
-
-From 0e2be2dfb7c185ac15e69e110c2e7a76f6896df7 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Mon, 1 Aug 2022 17:53:32 +0200
-Subject: [PATCH 2/2] Better align with RHEL-08-040259
-
-The item is about net.ipv4.conf.all.forwarding
-The update to V1R7 made brought this misalignment to light.
---
- .../sysctl_net_ipv4_ip_forward/rule.yml                       | 1 -
- products/rhel8/profiles/stig.profile                          | 2 +-
- tests/data/profile_stability/rhel8/stig.profile               | 4 ++--
- tests/data/profile_stability/rhel8/stig_gui.profile           | 2 +-
- 4 files changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml
-index 5c449db7f3a..7acfc0b05b6 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml
-@@ -45,7 +45,6 @@ references:
-     stigid@ol7: OL07-00-040740
-     stigid@ol8: OL08-00-040260
-     stigid@rhel7: RHEL-07-040740
-    stigid@rhel8: RHEL-08-040259
-     stigid@sle12: SLES-12-030430
-     stigid@sle15: SLES-15-040380
- 
-diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
-index 4b480bd2c11..6b44436a2b1 100644
--- a/products/rhel8/profiles/stig.profile
-+++ b/products/rhel8/profiles/stig.profile
-@@ -1127,7 +1127,7 @@ selections:
-     - sysctl_net_ipv6_conf_default_accept_source_route
- 
-     # RHEL-08-040259
-    - sysctl_net_ipv4_ip_forward
-+    - sysctl_net_ipv4_conf_all_forwarding
- 
-     # RHEL-08-040260
-     - sysctl_net_ipv6_conf_all_forwarding
-diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
-index 4bee72830d0..47f53a9d023 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
-+++ b/tests/data/profile_stability/rhel8/stig.profile
-@@ -1,7 +1,7 @@
- title: DISA STIG for Red Hat Enterprise Linux 8
- description: 'This profile contains configuration checks that align to the
- 
-    DISA STIG for Red Hat Enterprise Linux 8 V1R7
-+    DISA STIG for Red Hat Enterprise Linux 8 V1R7.
- 
- 
-     In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes
-@@ -395,13 +395,13 @@ selections:
- - sysctl_net_core_bpf_jit_harden
- - sysctl_net_ipv4_conf_all_accept_redirects
- - sysctl_net_ipv4_conf_all_accept_source_route
-+- sysctl_net_ipv4_conf_all_forwarding
- - sysctl_net_ipv4_conf_all_rp_filter
- - sysctl_net_ipv4_conf_all_send_redirects
- - sysctl_net_ipv4_conf_default_accept_redirects
- - sysctl_net_ipv4_conf_default_accept_source_route
- - sysctl_net_ipv4_conf_default_send_redirects
- - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
-- sysctl_net_ipv4_ip_forward
- - sysctl_net_ipv6_conf_all_accept_ra
- - sysctl_net_ipv6_conf_all_accept_redirects
- - sysctl_net_ipv6_conf_all_accept_source_route
-diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
-index ece32d06a6f..c4e60ddcde5 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
-+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
-@@ -405,13 +405,13 @@ selections:
- - sysctl_net_core_bpf_jit_harden
- - sysctl_net_ipv4_conf_all_accept_redirects
- - sysctl_net_ipv4_conf_all_accept_source_route
-+- sysctl_net_ipv4_conf_all_forwarding
- - sysctl_net_ipv4_conf_all_rp_filter
- - sysctl_net_ipv4_conf_all_send_redirects
- - sysctl_net_ipv4_conf_default_accept_redirects
- - sysctl_net_ipv4_conf_default_accept_source_route
- - sysctl_net_ipv4_conf_default_send_redirects
- - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
-- sysctl_net_ipv4_ip_forward
- - sysctl_net_ipv6_conf_all_accept_ra
- - sysctl_net_ipv6_conf_all_accept_redirects
- - sysctl_net_ipv6_conf_all_accept_source_route
--- a/SOURCES/scap-security-guide-0.1.64-stig_readd_ssh_rules-PR_9318.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_readd_ssh_rules-PR_9318.patch
@ -1,89 +0,0 @@
-From e368a515911cd09727d8cd1c7e8b46dc7bdff4fa Mon Sep 17 00:00:00 2001
-From: Gabriel Becker <ggasparb@redhat.com>
-Date: Tue, 9 Aug 2022 17:28:33 +0200
-Subject: [PATCH] Reintroduce back the sshd timeout rules in RHEL8 STIG
- profile.
-
---
- .../ssh/ssh_server/sshd_set_idle_timeout/rule.yml  |  1 +
- .../ssh/ssh_server/sshd_set_keepalive_0/rule.yml   |  1 +
- products/rhel8/profiles/stig.profile               | 14 +++++++-------
- tests/data/profile_stability/rhel8/stig.profile    |  2 ++
- .../data/profile_stability/rhel8/stig_gui.profile  |  2 ++
- 5 files changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
-index 46ea0558a42..1e9c6172758 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
-@@ -57,6 +57,7 @@ references:
-     stigid@ol7: OL07-00-040320
-     stigid@ol8: OL08-00-010201
-     stigid@rhel7: RHEL-07-040320
-+    stigid@rhel8: RHEL-08-010201
-     stigid@sle12: SLES-12-030190
-     stigid@sle15: SLES-15-010280
-     stigid@ubuntu2004: UBTU-20-010037
-diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
-index 0f0693ddc6c..f6e98a61d9a 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
-+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
-@@ -53,6 +53,7 @@ references:
-     stigid@ol7: OL07-00-040340
-     stigid@ol8: OL08-00-010200
-     stigid@rhel7: RHEL-07-040340
-+    stigid@rhel8: RHEL-08-010200
-     stigid@sle12: SLES-12-030191
-     stigid@sle15: SLES-15-010320
-     vmmsrg: SRG-OS-000480-VMM-002000
-diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
-index 6b44436a2b1..124b7520d3a 100644
--- a/products/rhel8/profiles/stig.profile
-+++ b/products/rhel8/profiles/stig.profile
-@@ -170,13 +170,13 @@ selections:
-     # RHEL-08-010190
-     - dir_perms_world_writable_sticky_bits
- 
-    # These two items don't behave as they used to in RHEL8.6 and RHEL9
-    # anymore. They will be disabled for now until an alternative
-    # solution is found.
-    # # RHEL-08-010200
-    # - sshd_set_keepalive_0
-    # # RHEL-08-010201
-    # - sshd_set_idle_timeout
-+    # Although these rules have a different behavior in RHEL>=8.6
-+    # they still need to be selected so it follows exactly what STIG
-+    # states.
-+    # RHEL-08-010200
-+    - sshd_set_keepalive_0
-+    # RHEL-08-010201
-+    - sshd_set_idle_timeout
- 
-     # RHEL-08-010210
-     - file_permissions_var_log_messages
-diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
-index 47f53a9d023..6c75d0ae1b1 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
-+++ b/tests/data/profile_stability/rhel8/stig.profile
-@@ -369,6 +369,8 @@ selections:
- - sshd_enable_warning_banner
- - sshd_print_last_log
- - sshd_rekey_limit
-+- sshd_set_idle_timeout
-+- sshd_set_keepalive_0
- - sshd_use_strong_rng
- - sshd_x11_use_localhost
- - sssd_certificate_verification
-diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
-index c4e60ddcde5..8a7a469b940 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
-+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
-@@ -379,6 +379,8 @@ selections:
- - sshd_enable_warning_banner
- - sshd_print_last_log
- - sshd_rekey_limit
-+- sshd_set_idle_timeout
-+- sshd_set_keepalive_0
- - sshd_use_strong_rng
- - sshd_x11_use_localhost
- - sssd_certificate_verification
--- a/SOURCES/scap-security-guide-0.1.64-stig_sudoers_includes-PR_9283.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_sudoers_includes-PR_9283.patch
@ -1,113 +0,0 @@
-From 7e46b59d2227dea50ca173d799bce7fa14b57ab1 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Tue, 2 Aug 2022 15:57:52 +0200
-Subject: [PATCH 1/2] Accept sudoers files without includes as compliant
-
-Update rule sudoers_default_includedir to accept as compliant sudoers
-files that don't have any #include or #includedir directive
---
- .../oval/shared.xml                           | 24 +++++++++++++++----
- .../sudo/sudoers_default_includedir/rule.yml  |  8 ++++---
- ...cludedir.fail.sh => no_includedir.pass.sh} |  2 +-
- 3 files changed, 26 insertions(+), 8 deletions(-)
- rename linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/{no_includedir.fail.sh => no_includedir.pass.sh} (51%)
-
-diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-index 59cab0b89de..629fbe8c6d2 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-@@ -1,10 +1,16 @@
- <def-group>
-   <definition class="compliance" id="{{{ rule_id }}}" version="1">
-     {{{ oval_metadata("Check if sudo includes only the default includedir") }}}
-    <criteria operator="AND">
-      <criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
-      <criterion comment="Check /etc/sudoers for #include" test_ref="test_sudoers_without_include" />
-      <criterion comment="Check /etc/sudoers.d for includes" test_ref="test_sudoersd_without_includes" />
-+    <criteria operator="OR">
-+      <criteria operator="AND">
-+        <criterion comment="Check /etc/sudoers doesn't have any #include" test_ref="test_sudoers_without_include" />
-+        <criterion comment="Check /etc/sudoers doesn't have any #includedir" test_ref="test_sudoers_without_includedir" />
-+      </criteria>
-+      <criteria operator="AND">
-+        <criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
-+        <criterion comment="Check /etc/sudoers for #include" test_ref="test_sudoers_without_include" />
-+        <criterion comment="Check /etc/sudoers.d for includes" test_ref="test_sudoersd_without_includes" />
-+      </criteria>
-     </criteria>
-   </definition>
- 
-@@ -32,6 +38,16 @@
-     <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
-   </ind:textfilecontent54_object>
- 
-+  <ind:textfilecontent54_test check="all" check_existence="none_exist"
-+      comment="audit augenrules rmmod" id="test_sudoers_without_includedir" version="1">
-+    <ind:object object_ref="object_sudoers_without_includedir" />
-+  </ind:textfilecontent54_test>
-+  <ind:textfilecontent54_object id="object_sudoers_without_includedir" version="1">
-+    <ind:filepath>/etc/sudoers</ind:filepath>
-+    <ind:pattern operation="pattern match">^#includedir[\s]+.*$</ind:pattern>
-+    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
-+  </ind:textfilecontent54_object>
-+
-   <ind:textfilecontent54_test check="all" check_existence="none_exist"
-       comment="audit augenrules rmmod" id="test_sudoersd_without_includes" version="1">
-     <ind:object object_ref="object_sudoersd_without_includes" />
-diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
-index aa2aaee19f8..83bfb0183bd 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
-+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/rule.yml
-@@ -8,9 +8,11 @@ description: |-
-     Administrators can configure authorized <tt>sudo</tt> users via drop-in files, and it is possible to include
-     other directories and configuration files from the file currently being parsed.
-   
-    Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>.
-    The <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
-    <tt>/etc/sudoers.d</tt>, and no file in <tt>/etc/sudoers.d/</tt> should include other files or directories.
-+    Make sure that <tt>/etc/sudoers</tt> only includes drop-in configuration files from <tt>/etc/sudoers.d</tt>,
-+    or that no drop-in file is included.
-+    Either the <tt>/etc/sudoers</tt> should contain only one <tt>#includedir</tt> directive pointing to
-+    <tt>/etc/sudoers.d</tt>, and no file in <tt>/etc/sudoers.d/</tt> should include other files or directories;
-+    Or the <tt>/etc/sudoers</tt> should not contain any <tt>#include</tt> or <tt>#includedir</tt> directives.
-     Note that the '#' character doesn't denote a comment in the configuration file.
- 
- rationale: |-
-diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.pass.sh
-similarity index 51%
-rename from linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
-rename to linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.pass.sh
-index 1e0ab8aea92..fe73cb25076 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.fail.sh
-+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/tests/no_includedir.pass.sh
-@@ -1,4 +1,4 @@
- #!/bin/bash
- # platform = multi_platform_all
- 
-sed -i "/#includedir.*/d" /etc/sudoers
-+sed -i "/#include(dir)?.*/d" /etc/sudoers
-
-From 28967d81eeea19f172ad0fd43ad3f58b203e1411 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 12:01:12 +0200
-Subject: [PATCH 2/2] Improve definition's comments
-
---
- .../software/sudo/sudoers_default_includedir/oval/shared.xml  | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-index 629fbe8c6d2..82095acc6ed 100644
--- a/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-+++ b/linux_os/guide/system/software/sudo/sudoers_default_includedir/oval/shared.xml
-@@ -8,8 +8,8 @@
-       </criteria>
-       <criteria operator="AND">
-         <criterion comment="Check /etc/sudoers for #includedir" test_ref="test_sudoers_default_includedir" />
-        <criterion comment="Check /etc/sudoers for #include" test_ref="test_sudoers_without_include" />
-        <criterion comment="Check /etc/sudoers.d for includes" test_ref="test_sudoersd_without_includes" />
-+        <criterion comment="Check /etc/sudoers doesn't have any #include" test_ref="test_sudoers_without_include" />
-+        <criterion comment="Check /etc/sudoers.d doesn't have any #include or #includedir" test_ref="test_sudoersd_without_includes" />
-       </criteria>
-     </criteria>
-   </definition>
--- a/SOURCES/scap-security-guide-0.1.64-stig_sysctl_multivalue_rules-PR_9286.patch
+++ b/SOURCES/scap-security-guide-0.1.64-stig_sysctl_multivalue_rules-PR_9286.patch
@ -1,358 +0,0 @@
-From f647d546d03b9296861f18673b0ac9efaa0db3ab Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 09:57:33 +0200
-Subject: [PATCH 1/5] Make rule sysctl ipv4 rp_filter accept two values
-
-This also removes value '0' from the list of possible configurations.
-This change aligns the rule better with STIG.
---
- .../sysctl_net_ipv4_conf_all_rp_filter/rule.yml        |  4 ++++
- .../tests/value_1.pass.sh                              | 10 ++++++++++
- .../tests/value_2.pass.sh                              | 10 ++++++++++
- .../sysctl_net_ipv4_conf_all_rp_filter_value.var       |  2 +-
- 4 files changed, 25 insertions(+), 1 deletion(-)
- create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
- create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-index 496a8491f32..697f79fa872 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-@@ -59,4 +59,8 @@ template:
-     name: sysctl
-     vars:
-         sysctlvar: net.ipv4.conf.all.rp_filter
-+        sysctlval:
-+        - '1'
-+        - '2'
-+        wrong_sysctlval_for_testing: "0"
-         datatype: int
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
-new file mode 100644
-index 00000000000..516bfaf1369
--- /dev/null
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
-@@ -0,0 +1,10 @@
-+#!/bin/bash
-+
-+# Clean sysctl config directories
-+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-+
-+sed -i "/net.ipv4.conf.all.rp_filter/d" /etc/sysctl.conf
-+echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf
-+
-+# set correct runtime value to check if the filesystem configuration is evaluated properly
-+sysctl -w net.ipv4.conf.all.rp_filter="1"
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-new file mode 100644
-index 00000000000..ef1b8da0479
--- /dev/null
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-@@ -0,0 +1,10 @@
-+#!/bin/bash
-+
-+# Clean sysctl config directories
-+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-+
-+sed -i "/net.ipv4.conf.all.rp_filter/d" /etc/sysctl.conf
-+echo "net.ipv4.conf.all.rp_filter = 2" >> /etc/sysctl.conf
-+
-+# set correct runtime value to check if the filesystem configuration is evaluated properly
-+sysctl -w net.ipv4.conf.all.rp_filter="2"
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter_value.var b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter_value.var
-index e3fc78e3f05..1eae854f6b0 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter_value.var
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter_value.var
-@@ -17,5 +17,5 @@ interactive: false
- 
- options:
-     default: 1
-    disabled: "0"
-     enabled: 1
-+    loose: 2
-
-From f903b6b257659cfe79bfd17a13ae72d1a48f40d9 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 10:53:40 +0200
-Subject: [PATCH 2/5] Make rule for kptr_restrict accept two values
-
-This also removes value '0' from the list of possible configurations.
-This change aligns the rule better with STIG.
---
- .../sysctl_kernel_kptr_restrict/rule.yml               |  4 ++++
- .../sysctl_kernel_kptr_restrict/tests/value_1.pass.sh  | 10 ++++++++++
- .../sysctl_kernel_kptr_restrict/tests/value_2.pass.sh  | 10 ++++++++++
- .../sysctl_kernel_kptr_restrict_value.var              |  1 -
- 4 files changed, 24 insertions(+), 1 deletion(-)
- create mode 100644 linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
- create mode 100644 linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-index 1984b3c8691..5706eee0a0a 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-@@ -42,6 +42,10 @@ template:
-     name: sysctl
-     vars:
-         sysctlvar: kernel.kptr_restrict
-+        sysctlval:
-+        - '1'
-+        - '2'
-+        wrong_sysctlval_for_testing: "0"
-         datatype: int
- 
- fixtext: |-
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
-new file mode 100644
-index 00000000000..e6efae48b25
--- /dev/null
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
-@@ -0,0 +1,10 @@
-+#!/bin/bash
-+
-+# Clean sysctl config directories
-+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-+
-+sed -i "/kernel.kptr_restrict/d" /etc/sysctl.conf
-+echo "kernel.kptr_restrict = 1" >> /etc/sysctl.conf
-+
-+# set correct runtime value to check if the filesystem configuration is evaluated properly
-+sysctl -w kernel.kptr_restrict="1"
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-new file mode 100644
-index 00000000000..be3f2b743ef
--- /dev/null
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-@@ -0,0 +1,10 @@
-+#!/bin/bash
-+
-+# Clean sysctl config directories
-+rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-+
-+sed -i "/kernel.kptr_restrict/d" /etc/sysctl.conf
-+echo "kernel.kptr_restrict = 2" >> /etc/sysctl.conf
-+
-+# set correct runtime value to check if the filesystem configuration is evaluated properly
-+sysctl -w kernel.kptr_restrict="2"
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict_value.var b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict_value.var
-index 452328e3efd..268550de53d 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict_value.var
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict_value.var
-@@ -12,6 +12,5 @@ interactive: false
- 
- options:
-     default: 1
-    0: 0
-     1: 1
-     2: 2
-
-From 932d00c370c8dc1c964354dd4bc111fbc18b9303 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 11:08:34 +0200
-Subject: [PATCH 3/5] Remove variable selector that will result in error
-
-The rule only accepts values 1 or 2 as compliant, the XCCDF Variable
-cannot have the value 0, it will never result in pass.
---
- .../sysctl_kernel_unprivileged_bpf_disabled_value.var            | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled_value.var b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled_value.var
-index b8bf965a255..cbfd9bafa91 100644
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled_value.var
-+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled_value.var
-@@ -13,6 +13,5 @@ interactive: false
- 
- options:
-     default: 2
-    0: "0"
-     1: "1"
-     2: "2"
-
-From 7127380e294a7e112fc427d0a46c21f15404aaa5 Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 11:33:03 +0200
-Subject: [PATCH 4/5] Restrict sysctl multivalue compliance to rhel and ol
-
-For now, the only STIGs I see that adopted this change were RHEL's and
-OL's.
---
- .../sysctl_net_ipv4_conf_all_rp_filter/rule.yml                 | 2 ++
- .../sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh    | 1 +
- .../sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh    | 1 +
- .../sysctl_kernel_kptr_restrict/rule.yml                        | 2 ++
- .../sysctl_kernel_kptr_restrict/tests/value_1.pass.sh           | 1 +
- .../sysctl_kernel_kptr_restrict/tests/value_2.pass.sh           | 1 +
- 6 files changed, 8 insertions(+)
-
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-index 697f79fa872..f04ae37c13d 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-@@ -59,8 +59,10 @@ template:
-     name: sysctl
-     vars:
-         sysctlvar: net.ipv4.conf.all.rp_filter
-+        {{% if 'ol' in product or 'rhel' in product %}}
-         sysctlval:
-         - '1'
-         - '2'
-         wrong_sysctlval_for_testing: "0"
-+        {{% endif %}}
-         datatype: int
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
-index 516bfaf1369..583b70a3b97 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_1.pass.sh
-@@ -1,4 +1,5 @@
- #!/bin/bash
-+# platform = multi_platform_ol,multi_platform_rhel
- 
- # Clean sysctl config directories
- rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-index ef1b8da0479..ef545976dc6 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/tests/value_2.pass.sh
-@@ -1,4 +1,5 @@
- #!/bin/bash
-+# platform = multi_platform_ol,multi_platform_rhel
- 
- # Clean sysctl config directories
- rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-index 5706eee0a0a..f53e035effa 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-@@ -42,10 +42,12 @@ template:
-     name: sysctl
-     vars:
-         sysctlvar: kernel.kptr_restrict
-+        {{% if 'ol' in product or 'rhel' in product %}}
-         sysctlval:
-         - '1'
-         - '2'
-         wrong_sysctlval_for_testing: "0"
-+        {{% endif %}}
-         datatype: int
- 
- fixtext: |-
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
-index e6efae48b25..70189666c16 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_1.pass.sh
-@@ -1,4 +1,5 @@
- #!/bin/bash
-+# platform = multi_platform_ol,multi_platform_rhel
- 
- # Clean sysctl config directories
- rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-index be3f2b743ef..209395fa9a1 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/tests/value_2.pass.sh
-@@ -1,4 +1,5 @@
- #!/bin/bash
-+# platform = multi_platform_ol,multi_platform_rhel
- 
- # Clean sysctl config directories
- rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/*
-
-From a159f7d62b200c79b6ec2b47ffa643ed6219f35b Mon Sep 17 00:00:00 2001
-From: Watson Sato <wsato@redhat.com>
-Date: Wed, 3 Aug 2022 14:01:40 +0200
-Subject: [PATCH 5/5] Update OCIL check along with the rule
-
-The OCIL should should mention both compliant values.
---
- .../rule.yml                                  | 29 +++++++++++++++++--
- .../sysctl_kernel_kptr_restrict/rule.yml      | 29 ++++++++++++++++++-
- 2 files changed, 55 insertions(+), 3 deletions(-)
-
-diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-index f04ae37c13d..4d31c6c3ebd 100644
--- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml
-@@ -47,11 +47,36 @@ references:
-     stigid@rhel7: RHEL-07-040611
-     stigid@rhel8: RHEL-08-040285
- 
-{{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.all.rp_filter", value="1") }}}
-+ocil: |-
-+    The runtime status of the <code>net.ipv4.conf.all.rp_filter</code> parameter can be queried
-+    by running the following command:
-+    <pre>$ sysctl net.ipv4.conf.all.rp_filter</pre>
-+    The output of the command should indicate either:
-+    <code>net.ipv4.conf.all.rp_filter = 1</code>
-+    or:
-+    <code>net.ipv4.conf.all.rp_filter = 2</code>
-+    The output of the command should not indicate:
-+    <code>net.ipv4.conf.all.rp_filter = 0</code>
-+
-+    The preferable way how to assure the runtime compliance is to have
-+    correct persistent configuration, and rebooting the system.
-+
-+    The persistent sysctl parameter configuration is performed by specifying the appropriate
-+    assignment in any file located in the <pre>/etc/sysctl.d</pre> directory.
-+    Verify that there is not any existing incorrect configuration by executing the following command:
-+    <pre>$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d</pre>
-+    The command should not find any assignments other than:
-+    net.ipv4.conf.all.rp_filter = 1
-+    or:
-+    net.ipv4.conf.all.rp_filter = 2
-+
-+    Conflicting assignments are not allowed.
-+
-+ocil_clause: "the net.ipv4.conf.all.rp_filter is not set to 1 or 2 or is configured to be 0"
- 
- fixtext: |-
-     Configure {{{ full_name }}} to use reverse path filtering on all IPv4 interfaces.
-    {{{ fixtext_sysctl(sysctl="net.ipv4.conf.all.rp_filter", value="1") | indent(4) }}}
-+    {{{ fixtext_sysctl(sysctl="net.ipv4.conf.all.rp_filter", value=xccdf_value("sysctl_net_ipv4_conf_all_rp_filter_value")) | indent(4) }}}
- 
- srg_requirement: '{{{ full_name }}} must use reverse path filtering on all IPv4 interfaces.'
- 
-diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-index f53e035effa..367934b5672 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
-@@ -34,6 +34,33 @@ references:
- 
- {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}}
- 
-+ocil: |-
-+    The runtime status of the <code>kernel.kptr_restrict</code> kernel parameter can be queried
-+    by running the following command:
-+    <pre>$ sysctl kernel.kptr_restrict</pre>
-+    The output of the command should indicate either:
-+    <code>kernel.kptr_restrict = 1</code>
-+    or:
-+    <code>kernel.kptr_restrict = 2</code>
-+    The output of the command should not indicate:
-+    <code>kernel.kptr_restrict = 0</code>
-+
-+    The preferable way how to assure the runtime compliance is to have
-+    correct persistent configuration, and rebooting the system.
-+
-+    The persistent kernel parameter configuration is performed by specifying the appropriate
-+    assignment in any file located in the <pre>/etc/sysctl.d</pre> directory.
-+    Verify that there is not any existing incorrect configuration by executing the following command:
-+    <pre>$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d</pre>
-+    The command should not find any assignments other than:
-+    kernel.kptr_restrict = 1
-+    or:
-+    kernel.kptr_restrict = 2
-+
-+    Conflicting assignments are not allowed.
-+
-+ocil_clause: "the kernel.kptr_restrict is not set to 1 or 2 or is configured to be 0"
-+
- srg_requirement: '{{{ full_name }}} must restrict exposed kernel pointer addresses access.'
- 
- platform: machine
-@@ -52,4 +79,4 @@ template:
- 
- fixtext: |-
-     Configure {{{ full_name }}} to restrict exposed kernel pointer addresses access.
-    {{{ fixtext_sysctl("kernel.kptr_restrict", "1") | indent(4) }}}
-+    {{{ fixtext_sysctl("kernel.kptr_restrict", value=xccdf_value("sysctl_kernel_kptr_restrict_value")) | indent(4) }}}
--- a/SOURCES/scap-security-guide-0.1.64-sysctl_template_multivalue-PR_9147.patch
+++ b/SOURCES/scap-security-guide-0.1.64-sysctl_template_multivalue-PR_9147.patch
--- a/SOURCES/scap-security-guide-0.1.64-warning_about_queues_for_rsyslog_remote_loghost-PR_9305.patch
+++ b/SOURCES/scap-security-guide-0.1.64-warning_about_queues_for_rsyslog_remote_loghost-PR_9305.patch
@ -1,92 +0,0 @@
-From 245d4e04318bcac20f15e680cf1b33a35b94067a Mon Sep 17 00:00:00 2001
-From: Vojtech Polasek <vpolasek@redhat.com>
-Date: Mon, 8 Aug 2022 14:34:34 +0200
-Subject: [PATCH 1/3] add warning to the rsyslog_remote_loghost rule about
- configuring queues
-
---
- .../rsyslog_remote_loghost/rule.yml             | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-index 4ce56d2e6a5..c73d9ec95a6 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-@@ -90,3 +90,20 @@ fixtext: |-
-     *.* @@[remoteloggingserver]:[port]"
- 
- srg_requirement: 'The {{{ full_name }}} audit records must be off-loaded onto a different system or storage media from the system being audited.'
-+
-+warnings:
-+    - functionality: |-
-+        It is important to configure queues in case the client is sending log
-+        messages to a remote server. If queues are not configured, there is a
-+        danger that the system will stop functioning in case that the connection
-+        to the remote server is not available. Please consult Rsyslog
-+        documentation for more information about configuration of queues. The
-+        example configuration which should go into <tt>/etc/rsyslog.conf</tt>
-+        can look like the following lines:
-+        <pre>
-+        $ActionQueueType LinkedList
-+        $ActionQueueFileName somenameforprefix
-+        $ActionQueueMaxDiskSpace 1g
-+        $ActionQueueSaveOnShutdown on
-+        $ActionResumeRetryCount -1
-+        </pre>
-
-From 10fbd1665513284fbb82cf1af96b92774301f8e5 Mon Sep 17 00:00:00 2001
-From: vojtapolasek <krecoun@gmail.com>
-Date: Tue, 9 Aug 2022 09:41:00 +0200
-Subject: [PATCH 2/3] Apply suggestions from code review
-
-Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>
---
- .../rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml  | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-index c73d9ec95a6..706d3265a08 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-@@ -95,14 +95,14 @@ warnings:
-     - functionality: |-
-         It is important to configure queues in case the client is sending log
-         messages to a remote server. If queues are not configured, there is a
-        danger that the system will stop functioning in case that the connection
-+        the system will stop functioning when the connection
-         to the remote server is not available. Please consult Rsyslog
-         documentation for more information about configuration of queues. The
-         example configuration which should go into <tt>/etc/rsyslog.conf</tt>
-         can look like the following lines:
-         <pre>
-         $ActionQueueType LinkedList
-        $ActionQueueFileName somenameforprefix
-+        $ActionQueueFileName queuefilename
-         $ActionQueueMaxDiskSpace 1g
-         $ActionQueueSaveOnShutdown on
-         $ActionResumeRetryCount -1
-
-From e2abf4f8a1bcc0dd02ad4af6f9575797abdd332e Mon Sep 17 00:00:00 2001
-From: vojtapolasek <krecoun@gmail.com>
-Date: Tue, 9 Aug 2022 10:55:04 +0200
-Subject: [PATCH 3/3] Update
- linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-
-Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>
---
- .../rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml    | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-index 706d3265a08..cce4d5cac1d 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
-@@ -94,7 +94,7 @@ srg_requirement: 'The {{{ full_name }}} audit records must be off-loaded onto a
- warnings:
-     - functionality: |-
-         It is important to configure queues in case the client is sending log
-        messages to a remote server. If queues are not configured, there is a
-+        messages to a remote server. If queues are not configured,
-         the system will stop functioning when the connection
-         to the remote server is not available. Please consult Rsyslog
-         documentation for more information about configuration of queues. The
--- a/SPECS/scap-security-guide.spec
+++ b/SPECS/scap-security-guide.spec
@ -1,12 +1,14 @@
 # Base name of static rhel6 content tarball
 %global _static_rhel6_content %{name}-0.1.52-2.el7_9-rhel6
+# Base name of static rhel7 content tarball
+%global _static_rhel7_content %{name}-0.1.73-1.el7_9-rhel7
 # https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds
 %global _vpath_builddir build
 # global _default_patch_fuzz 2  # Normally shouldn't be needed as patches should apply cleanly

 Name:		scap-security-guide
-Version:	0.1.63
-Release:	4%{?dist}.alma
+Version:	0.1.74
+Release:	3%{?dist}
 Summary:	Security guidance and baselines in SCAP formats
 License:	BSD-3-Clause
 Group:		Applications/System
@ -14,39 +16,16 @@ URL:		https://github.com/ComplianceAsCode/content/
 Source0:	https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2
 # Include tarball with last released rhel6 content
 Source1:	%{_static_rhel6_content}.tar.bz2
-# Patch allows only OSPP, PCI-DSS, E8 and STIG profiles in RHEL8 datastream
-# Untill ANSSI High profile is shipped we drop the ks too
+# Include tarball with last released rhel7 content
+Source2:	%{_static_rhel7_content}.tar.bz2

 BuildArch:	noarch

-# Patch allows only OSPP, PCI-DSS, E8 and STIG profiles in RHEL8 datastream
-Patch0:		disable-not-in-good-shape-profiles.patch
-Patch1:		scap-security-guide-0.1.64-stig_bump_version-PR_9276.patch
-Patch2:		scap-security-guide-0.1.64-stig_ipv4_forwarding-PR_9277.patch
-Patch3:		scap-security-guide-0.1.64-stig_aide-PR_9282.patch
-Patch4:		scap-security-guide-0.1.64-stig_sudoers_includes-PR_9283.patch
-Patch5:		scap-security-guide-0.1.64-sysctl_template_multivalue-PR_9147.patch
-Patch6:		scap-security-guide-0.1.64-stig_sysctl_multivalue_rules-PR_9286.patch
-Patch7:		scap-security-guide-0.1.64-stig_readd_ssh_rules-PR_9318.patch
-Patch8:		scap-security-guide-0.1.64-ospp_autselect_minimal-PR_9298.patch
-Patch9:		scap-security-guide-0.1.64-ospp_grub_disable_recovery-PR_9321.patch
-Patch10:		scap-security-guide-0.1.64-warning_about_queues_for_rsyslog_remote_loghost-PR_9305.patch
-Patch11:		scap-security-guide-0.1.64-fix_sudoers_defaults-PR_9299.patch
-Patch12:		scap-security-guide-0.1.64-add_platform_for_partition_existence-PR_9204.patch
-Patch13:		scap-security-guide-0.1.64-apply_partition_platform_to_rules-PR_9324.patch
-Patch14:		scap-security-guide-0.1.64-improve_handling_of_rsyslog_includes-PR_9326.patch
-Patch15:		scap-security-guide-0.1.64-fix_ansible_partition_conditional-PR_9339.patch
-Patch16:		scap-security-guide-0.1.64-fix_enable_fips_mode_s390x-PR_9355.patch
-
-# AlmaLinux patches
-Patch1001:		0001-Add-AlmaLinux-8-support.patch
-
 BuildRequires:	libxslt
 BuildRequires:	expat
 BuildRequires:	openscap-scanner >= 1.2.5
 BuildRequires:	cmake >= 2.8
-# To get python3 inside the buildroot require its path explicitly in BuildRequires
-BuildRequires: /usr/bin/python3
+BuildRequires:	python3-devel
 BuildRequires:	python%{python3_pkgversion}
 BuildRequires:	python%{python3_pkgversion}-jinja2
 BuildRequires:	python%{python3_pkgversion}-PyYAML
@ -76,6 +55,7 @@ The %{name}-doc package contains HTML formatted documents containing
 hardening guidances that have been generated from XCCDF benchmarks
 present in %{name} package.

+%if ( %{defined rhel} && (! %{defined centos}) )
 %package	rule-playbooks
 Summary:	Ansible playbooks per each rule.
 Group:		System Environment/Base
@ -83,23 +63,29 @@ Requires:	%{name} = %{version}-%{release}

 %description	rule-playbooks
 The %{name}-rule-playbooks package contains individual ansible playbooks per rule.
+%endif

 %prep
-%autosetup -p1 -b1
+%setup -q -b1 -b2

 %build
 mkdir -p build
 cd build
 %cmake \
 -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE \
-DSSG_PRODUCT_RHEL7:BOOLEAN=FALSE \
-DSSG_PRODUCT_RHEL8:BOOLEAN=FALSE \
-DSSG_PRODUCT_ALMALINUX8:BOOLEAN=TRUE \
+-DSSG_PRODUCT_RHEL7:BOOLEAN=TRUE \
+-DSSG_PRODUCT_RHEL8:BOOLEAN=TRUE \
 -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE \
 -DSSG_PRODUCT_JRE:BOOLEAN=TRUE \
+%if %{defined centos}
+-DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON \
+%else
 -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF \
+%endif
 -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF \
+%if ( %{defined rhel} && (! %{defined centos}) )
 -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON \
+%endif
 ../
 %cmake_build

@ -107,11 +93,20 @@ cd build
 cd build
 %cmake_install

-# Disabled on AlmaLinux
 # Manually install pre-built rhel6 content
-# cp -r %{_builddir}/%{_static_rhel6_content}/usr %{buildroot}
-# cp -r %{_builddir}/%{_static_rhel6_content}/tables %{buildroot}%{_docdir}/%{name}
-# cp -r %{_builddir}/%{_static_rhel6_content}/guides %{buildroot}%{_docdir}/%{name}
+cp -r %{_builddir}/%{_static_rhel6_content}/usr %{buildroot}
+cp -r %{_builddir}/%{_static_rhel6_content}/tables %{buildroot}%{_docdir}/%{name}
+cp -r %{_builddir}/%{_static_rhel6_content}/guides %{buildroot}%{_docdir}/%{name}
+
+# Manually install pre-built rhel7 content
+cp -r %{_builddir}/%{_static_rhel7_content}/usr %{buildroot}
+cp -r %{_builddir}/%{_static_rhel7_content}/tables %{buildroot}%{_docdir}/%{name}
+cp -r %{_builddir}/%{_static_rhel7_content}/guides %{buildroot}%{_docdir}/%{name}
+
+# create symlinks for ssg-<product>-ds-1.2.xml to ssg-<product>-ds.xml
+# this is for backward compatibility
+ln -s ssg-rhel8-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml
+ln -s ssg-firefox-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/ssg-firefox-ds-1.2.xml

 %files
 %{_datadir}/xml/scap/ssg/content
@ -123,19 +118,106 @@ cd build
 %doc %{_docdir}/%{name}/LICENSE
 %doc %{_docdir}/%{name}/README.md
 %doc %{_docdir}/%{name}/Contributors.md
+%if ( %{defined rhel} && (! %{defined centos}) )
 %exclude %{_datadir}/%{name}/ansible/rule_playbooks
+%endif

 %files doc
 %doc %{_docdir}/%{name}/guides/*.html
 %doc %{_docdir}/%{name}/tables/*.html

+%if ( %{defined rhel} && (! %{defined centos}) )
 %files rule-playbooks
 %defattr(-,root,root,-)
 %{_datadir}/%{name}/ansible/rule_playbooks
+%endif

 %changelog
-* Thu Oct 20 2022 Eduard Abdullin <eabdullin@almalinux.org> - 0.1.63-4.alma
- AlmaLinux changes
+* Mon Aug 19 2024 Vojtech Polasek <vpolasek@redhat.com> - 0.1.74-3
+- fix build
+- keep firefox and rhel8 ds-1.2 files in the package in form of symbolic links to regular ds files
+
+* Fri Aug 16 2024 Vojtech Polasek <vpolasek@redhat.com> - 0.1.74-2
+- include RHEL 7 artifacts from the last RHEL 7 build
+
+* Fri Aug 09 2024 Matthew Burket <mburket@redhat.com> - 0.1.74-1
+- Rebase to a new upstream release 0.1.74 (RHEL-53913)
+- Improve Rsyslog rules to support RainerScript syntax (RHEL-1816)
+- Update password hashing settings for ANSSI-BP-028 (RHEL-54390)
+
+* Wed Aug 07 2024 Milan Lysonek <mlysonek@redhat.com> - 0.1.73-2
+- Switch gating to tmt plan (RHEL-43242)
+
+* Tue May 21 2024 Jan Černý <jcerny@redhat.com> - 0.1.73-1
+- Rebase scap-security-guide package to version 0.1.73 (RHEL-36733)
+- Change crypto policy used in the CUI profile to FIPS (RHEL-30346)
+- Fix file path identification in Rsyslog configuration (RHEL-17202)
+- Use a correct chrony server address in STIG profile (RHEL-1814)
+- Don't BuildRequire /usr/bin/python3 (RHEL-2244)
+
+* Fri Feb 16 2024 Marcus Burghardt <maburgha@redhat.com> - 0.1.72-2
+- Unlist profiles no longer maintained in RHEL8.
+
+* Wed Feb 14 2024 Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
+- Rebase to a new upstream release 0.1.72 (RHEL-25250)
+- Increase CIS standards coverage regarding SSH and cron (RHEL-1314)
+- Increase compatibility of accounts_tmout rule for ksh (RHEL-16896 and RHEL-1811)
+- Align Ansible and Bash remediation in sssd_certificate_verification rule (RHEL-1313)
+- Add a warning to rule service_rngd_enabled about rule applicability (RHEL-1819)
+- Add rule to terminate idle user sessions after defined time (RHEL-1801)
+- Allow spaces around equal sign in /etc/sudoers (RHEL-1904)
+- Add remediation for rule fapolicy_default_deny (RHEL-1817)
+- Fix invalid syntax in file /usr/share/scap-security-guide/ansible/rhel8-playbook-ospp.yml (RHEL-19127)
+- Refactor ensure_pam_wheel_group_empty (RHEL-1905)
+- Prevent remediation of display_login_attempts rule from creating redundant configuration entries (RHEL-1809)
+- Update PCI-DSS to v4 (RHEL-1808)
+- Fix regex in Ansible remediation of configure_ssh_crypto_policy (RHEL-1820)
+
+* Thu Aug 17 2023 Vojtech Polasek <vpolasek@redhat.com> - 0.1.69-2
+- remove problematic rule from ANSSI High profile (RHBZ#2221695)
+
+* Thu Aug 10 2023 Jan Černý <jcerny@redhat.com> - 0.1.69-1
+- Rebase to a new upstream release 0.1.69 (RHBZ#2221695)
+- Fixed CCE link URL (RHBZ#2178516)
+- align remediations with rule description for rule configuring OpenSSL cryptopolicy (RHBZ#2192893)
+- Add rule audit_rules_login_events_faillock to STIG profile (RHBZ#2167999)
+- Fixed rules related to AIDE configuration (RHBZ#2175684)
+- Allow default permissions for files stored on EFI FAT partitions (RHBZ#2184487)
+- Add appropriate STIGID to accounts_passwords_pam_faillock_interval rule (RHBZ#2209073)
+- improved and unified OVAL checks checking for interactive users (RHBZ#2157877)
+- update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155789)
+- unify OVAL checks to correctly identify interactive users (RHBZ#2178740)
+- make rule checking for Postfix unrestricted relay accept more variants of valid configuration syntax (RHBZ#2170530)
+- Fixed excess quotes in journald configuration files (RHBZ#2169857)
+- rules related to polyinstantiated directories are not applied when building images for Image Builder (RHBZ#2130182)
+- evaluation and remediation of rules related to mount points have been enhanced for Image Builder (RHBZ#2130185)
+- do not enable FIPS mode when creating hardened images for Image Builder (RHBZ#2130181)
+- Correct URL used to download CVE checks (RHBZ#2222583)
+- mention exact required configuration value in description of some PAM related rules (RHBZ#2175882)
+- make mount point related rules not applicable when no such mount points exist (RHBZ#2176008)
+- improve checks determining if FIPS mode is enabled (RHBZ#2129100)
+
+* Mon Feb 13 2023 Watson Sato <wsato@redhat.com> - 0.1.66-2
+- Unselect rule logind_session_timeout (RHBZ#2158404)
+
+* Mon Feb 06 2023 Watson Sato <wsato@redhat.com> - 0.1.66-1
+- Rebase to a new upstream release 0.1.66 (RHBZ#2158404)
+- Update RHEL8 STIG profile to V1R9 (RHBZ#2152658)
+- Fix levels of CIS rules (RHBZ#2162803)
+- Remove unused RHEL8 STIG control file (RHBZ#2156192)
+- Fix accounts_password_pam_unix_remember's check and remediations (RHBZ#2153547)
+- Fix handling of space in sudo_require_reauthentication (RHBZ#2152208)
+- Add rule for audit immutable login uids (RHBZ#2151553)
+- Fix remediation of audit watch rules (RHBZ#2119356)
+- Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2115343)
+- Fix applicability of kerberos rules (RHBZ#2099394)
+- Add support rainer scripts in rsyslog rules (RHBZ#2072444)
+
+* Tue Jan 10 2023 Watson Sato <wsato@redhat.com> - 0.1.63-5
+- Update RHEL8 STIG profile to V1R8 (RHBZ#2148446)
+- Add rule warning for sysctl IPv4 forwarding config (RHBZ#2118758)
+- Fix remediation for firewalld_sshd_port_enabled (RHBZ#2116474)
+- Fix compatibility with Ansible 2.14

 * Wed Aug 17 2022 Watson Sato <wsato@redhat.com> - 0.1.63-4
 - Fix check of enable_fips_mode on s390x (RHBZ#2070564)