From shawn at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============7503705452173914459==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Any RPM builders? request for help legitimizing EPEL RPM Date: Mon, 30 Sep 2013 22:34:53 -0400 Message-ID: <524A34CD.9050200@redhat.com> --===============7503705452173914459== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable This afternoon sgrubb sent over where one could RTFM on the Fedora EPEL = build system (thanks, Steve!). I was able to perform scratch builds in = koji (the Fedora build system) tonight: http://koji.fedoraproject.org/koji/taskinfo?taskID=3D6008567 While the SSG RPM builds, several errors are thrown during rpmlint = validation. The RHEL6/transforms/xccdf2table-* files need to issue = proper HTML headers, e.g. "" I'll be locked into meetings over the next two days, and I believe Dave = & Jeff will be too. If anyone is feeling ambitious, patches to start = resolving these errors would be INCREDIBLY helpful to move the project = towards having a legitimate RPM in EPEL! > [shawn(a)localhost scap-security-guide]$ make clean ; \ > make all ; \ > rpmlint = > rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-12.el6.noarch.rpm > ....... > ....... > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-nistrefs.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/eap5-oval.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-cces.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/eap5-xccdf.xml > scap-security-guide.noarch: E: wrong-script-end-of-line-encoding = > /usr/share/xml/scap/ssg/content/eap5-xccdf.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/eap5-cpe-dictionary.xml > scap-security-guide.noarch: E: wrong-script-end-of-line-encoding = > /usr/share/xml/scap/ssg/content/eap5-cpe-dictionary.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-oval.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-srgmap.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-nistrefs-common.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-srgmap-flat.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/guide/rhel6-guide.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/ssg-rhel6-oval.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/eap5-ocil.xml > scap-security-guide.noarch: E: wrong-script-end-of-line-encoding = > /usr/share/xml/scap/ssg/content/eap5-ocil.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/guide/JBossEAP5_Guide.html > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/policytables/table-rhel6-srgmap-flat.xhtml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml > scap-security-guide.noarch: E: script-without-shebang = > /usr/share/xml/scap/ssg/content/eap5-cpe-oval.xml --===============7503705452173914459==-- From shawn.d.wells at gmail.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============8265227223999209569==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] [bugfix] Updated RPM spec file Date: Mon, 30 Sep 2013 22:43:07 -0400 Message-ID: <20131001024307.GA608@mail.corp.redhat.com> --===============8265227223999209569== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable --===============8265227223999209569== Content-Type: text/plain MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-bugfix-Updated-RPM-spec-file.patch" PkZyb20gMzIxYWJmMmNjZWIzMGNjNDZjMThjODZmYThjMjE1M2RiYzc5ZWU5ZiBNb24gU2VwIDE3 IDAwOjAwOjAwIDIwMDEKRnJvbTogU2hhd24gV2VsbHMgPHNoYXduQHJlZGhhdC5jb20+CkRhdGU6 IE1vbiwgMzAgU2VwIDIwMTMgMDc6MzA6MDQgLTA0MDAKU3ViamVjdDogW1BBVENIXSBbYnVnZml4 XSBVcGRhdGVkIFJQTSBzcGVjIGZpbGUKCi0gVXBkYXRlZCBkZXNjcmlwdGlvbgotIFVwZGF0ZWQg IlB1YmxpYyBEb21haW4iIGxpY2Vuc2UKLSBVcGRhdGVkIEdyb3VwIChyZWYgYGxlc3MgL3Vzci9z aGFyZS9kb2MvcnBtLSovR1JPVVBTYCAgZm9yIGZ1bGwgbGlzdGluZywgaWRlYXMgd2VsY29tZSEp Ci0tLQogc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjIHwgICAgOSArKysrKystLS0KIDEgZmlsZXMg Y2hhbmdlZCwgNiBpbnNlcnRpb25zKCspLCAzIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL3Nj YXAtc2VjdXJpdHktZ3VpZGUuc3BlYyBiL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYwppbmRleCA1 ZmM4ODhjLi4yZGMyZDljIDEwMDY0NAotLS0gYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKKysr IGIvc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCkBAIC0xLDEwICsxLDEwIEBACiBOYW1lOiAgICAg ICAgICAgc2NhcC1zZWN1cml0eS1ndWlkZQogVmVyc2lvbjogICAgICAgICV7dmVyc2lvbn0KIFJl bGVhc2U6ICAgICAgICAle3JlbGVhc2V9Ci1TdW1tYXJ5OiAgICAgICAgU2VjdXJpdHkgZ3VpZGFu Y2UgYW5kIGJhc2VsaW5lcyBpbiBTQ0FQIGZvcm1hdHMuCitTdW1tYXJ5OiAgICAgICAgU2VjdXJp dHkgZ3VpZGFuY2UgYW5kIGJhc2VsaW5lcyBpbiBTQ0FQIGZvcm1hdHMKIAotR3JvdXA6ICAgICAg ICAgIFRlc3RpbmcKLUxpY2Vuc2U6ICAgICAgICBQdWJsaWMgZG9tYWluIGFuZCBHUEwKK0dyb3Vw OiAgICAgICAgICBTeXN0ZW0gRW52aXJvbm1lbnQvQmFzZQorTGljZW5zZTogICAgICAgIFB1Ymxp YyBEb21haW4KIFVSTDogICAgICAgICAgICBodHRwczovL2ZlZG9yYWhvc3RlZC5vcmcvc2NhcC1z ZWN1cml0eS1ndWlkZS8KIAogU291cmNlMDogICAgICAgICV7bmFtZX0tJXt2ZXJzaW9ufS50YXIu Z3oKQEAgLTU2LDYgKzU2LDkgQEAgcm0gLXJmICRSUE1fQlVJTERfUk9PVAogCiAKICVjaGFuZ2Vs b2cKKyogU2F0IFNlcCAyOCAyMDEzIFNoYXduIFdlbGxzIDxzaGF3bkByZWRoYXQuY29tPiAwLjEt MTMKKy0gdGVzdAorCiAqIFdlZCBKdW4gMjYgMjAxMyBTaGF3biBXZWxscyA8c2hhd25AcmVkaGF0 LmNvbT4gMC4xLTEyCiAtIAogCi0tIAoxLjcuMQoK --===============8265227223999209569==-- From rui-p-bernardino at ptinovacao.pt Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============7180852342968093328==" MIME-Version: 1.0 From: Rui Pedro Bernardino To: scap-security-guide at lists.fedorahosted.org Subject: template_sysctl Date: Tue, 01 Oct 2013 12:33:12 +0100 Message-ID: --===============7180852342968093328== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I'm getting false results on 'sysctl_net_ipv6_conf_default_accept_ra' on sy= stems that don't have ipv6 module at all. I think this also applies to any = undefined sys variables. Suggested change: RHEL6/input/checks/templates/template_sysctl - + Does this make sense? regards -- Rui Pedro Bernardino CTE2/Tecnologias e Desenvolvimento PT Inova=C3=A7=C3=A3o --===============7180852342968093328== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTEiPjxtZXRhIG5hbWU9R2VuZXJhdG9yIGNv bnRlbnQ9Ik1pY3Jvc29mdCBXb3JkIDEyIChmaWx0ZXJlZCBtZWRpdW0pIj48c3R5bGU+PCEtLQov KiBGb250IERlZmluaXRpb25zICovCkBmb250LWZhY2UKCXtmb250LWZhbWlseToiQ2FtYnJpYSBN YXRoIjsKCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQpAZm9udC1mYWNlCgl7Zm9udC1m YW1pbHk6Q2FsaWJyaTsKCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30KQGZvbnQtZmFj ZQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOwoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7 fQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLwpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsCgl7bWFyZ2luOjBjbTsKCW1hcmdpbi1ib3R0b206LjAwMDFwdDsKCWZvbnQtc2l6 ZToxMS4wcHQ7Cglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO30KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluawoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsKCWNvbG9yOmJsdWU7Cgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv bGxvd2VkCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5OwoJY29sb3I6cHVycGxlOwoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9CnNwYW4uRW1haWxTdHlsZTE3Cgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtY29tcG9zZTsKCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7Cgljb2xv cjp3aW5kb3d0ZXh0O30KLk1zb0NocERlZmF1bHQKCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTt9CkBwYWdlIFdvcmRTZWN0aW9uMQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0OwoJbWFyZ2luOjcy LjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9CmRpdi5Xb3JkU2VjdGlvbjEKCXtwYWdlOldvcmRT ZWN0aW9uMTt9Ci0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+CjxvOnNoYXBlZGVm YXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+CjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPgo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+CjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPgo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5k aWZdLS0+PC9oZWFkPjxib2R5IGxhbmc9RU4tVVMgbGluaz1ibHVlIHZsaW5rPXB1cnBsZT48ZGl2 IGNsYXNzPVdvcmRTZWN0aW9uMT48cCBjbGFzcz1Nc29Ob3JtYWw+SGksPG86cD48L286cD48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1h bD5JJiM4MjE3O20gZ2V0dGluZyBmYWxzZSByZXN1bHRzIG9uICYjODIxNjtzeXNjdGxfbmV0X2lw djZfY29uZl9kZWZhdWx0X2FjY2VwdF9yYSYjODIxNzsgb24gc3lzdGVtcyB0aGF0IGRvbiYjODIx Nzt0IGhhdmUgaXB2NiBtb2R1bGUgYXQgYWxsLiBJIHRoaW5rIHRoaXMgYWxzbyBhcHBsaWVzIHRv IGFueSB1bmRlZmluZWQgc3lzIHZhcmlhYmxlcy4gU3VnZ2VzdGVkIGNoYW5nZTo8bzpwPjwvbzpw PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PHAgY2xhc3M9TXNv Tm9ybWFsPlJIRUw2L2lucHV0L2NoZWNrcy90ZW1wbGF0ZXMvdGVtcGxhdGVfc3lzY3RsPG86cD48 L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPi2gICZsdDt1bml4OnN5c2N0bF90ZXN0IGNoZWNr PSZxdW90O2FsbCZxdW90OyBjaGVja19leGlzdGVuY2U9JnF1b3Q7PGI+YWxsX2V4aXN0PC9iPiZx dW90OyBjb21tZW50PSZxdW90O2tlcm5lbCBydW50aW1lIHBhcmFtZXRlciBTWVNDVExWQVIgc2V0 IHRvIFNZU0NUTFZBTCZxdW90OyBpZD0mcXVvdDt0ZXN0X3J1bnRpbWVfc3lzY3RsX1NZU0NUTElE JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDsgPG86cD48L286cD48L3A+PHAgY2xhc3M9 TXNvTm9ybWFsPisgJmx0O3VuaXg6c3lzY3RsX3Rlc3QgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNo ZWNrX2V4aXN0ZW5jZT0mcXVvdDs8Yj5hbnlfZXhpc3Q8L2I+JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7 a2VybmVsIHJ1bnRpbWUgcGFyYW1ldGVyIFNZU0NUTFZBUiBzZXQgdG8gU1lTQ1RMVkFMJnF1b3Q7 IGlkPSZxdW90O3Rlc3RfcnVudGltZV9zeXNjdGxfU1lTQ1RMSUQmcXVvdDsgdmVyc2lvbj0mcXVv dDsxJnF1b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNw OzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+RG9lcyB0aGlzIG1ha2Ugc2Vuc2U/PG86cD48 L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNz PU1zb05vcm1hbD5yZWdhcmRzPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBsYW5nPVBUIHN0eWxlPSdm b250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzJz4tLTxvOnA+PC9vOnA+PC9zcGFu PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gbGFuZz1QVCBzdHlsZT0nZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTpDb25zb2xhcyc+UnVpIFBlZHJvIEJlcm5hcmRpbm88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIGxhbmc9UFQgc3R5bGU9J2ZvbnQt c2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXMnPkNURTIvVGVjbm9sb2dpYXMgZSBEZXNl bnZvbHZpbWVudG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFu IHN0eWxlPSdmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzJz5QVCBJbm92Yefj bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286 cD48L3A+PC9kaXY+PC9ib2R5PjwvaHRtbD4= --===============7180852342968093328==-- From bressers at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============7175702333643800622==" MIME-Version: 1.0 From: Josh Bressers To: scap-security-guide at lists.fedorahosted.org Subject: Re: Any RPM builders? request for help legitimizing EPEL RPM Date: Tue, 01 Oct 2013 08:29:45 -0400 Message-ID: <954180894.1013994.1380630585094.JavaMail.root@redhat.com> In-Reply-To: 524A34CD.9050200@redhat.com --===============7175702333643800622== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > This afternoon sgrubb sent over where one could RTFM on the Fedora EPEL > build system (thanks, Steve!). I was able to perform scratch builds in > koji (the Fedora build system) tonight: > = > http://koji.fedoraproject.org/koji/taskinfo?taskID=3D6008567 > = > While the SSG RPM builds, several errors are thrown during rpmlint > validation. The RHEL6/transforms/xccdf2table-* files need to issue > proper HTML headers, e.g. "" > = > I'll be locked into meetings over the next two days, and I believe Dave > & Jeff will be too. If anyone is feeling ambitious, patches to start > resolving these errors would be INCREDIBLY helpful to move the project > towards having a legitimate RPM in EPEL! > = > = It might make sense to submit your package for EPEL and Fedora, not just EPEL. That should help prevent having to do this again once Fedora content is ready. I'd be happy to review the request once you submit it (presuming nobody else wants to do it). -- = Josh Bressers / Red Hat Product Security Team --===============7175702333643800622==-- From coopercd at ornl.gov Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============0912687755285378490==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] *** SUBJECT HERE *** Date: Tue, 01 Oct 2013 10:06:38 -0400 Message-ID: <1380636399-6941-1-git-send-email-coopercd@ornl.gov> --===============0912687755285378490== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable *** BLURB HERE *** Caleb Cooper (1): Added OVAL content for the file_ownership_binary_dirs rule as the file file_ownership_binary_dirs.xml and added the oval id to the corresponding XCCDF content in files.xml RHEL6/input/checks/file_ownership_binary_dirs.xml | 163 +++++++++++++++++= ++++ 1 files changed, 163 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml --===============0912687755285378490==-- From coopercd at ornl.gov Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============2005508228870175831==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Added OVAL content for the file_ownership_binary_dirs rule as the file file_ownership_binary_dirs.xml and added the oval id to the corresponding XCCDF content in files.xml Date: Tue, 01 Oct 2013 10:06:39 -0400 Message-ID: <1380636399-6941-2-git-send-email-coopercd@ornl.gov> In-Reply-To: 1380636399-6941-1-git-send-email-coopercd@ornl.gov --===============2005508228870175831== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Signed-off-by: Caleb Cooper --- RHEL6/input/checks/file_ownership_binary_dirs.xml | 163 +++++++++++++++++= ++++ 1 files changed, 163 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/inpu= t/checks/file_ownership_binary_dirs.xml new file mode 100644 index 0000000..b787191 --- /dev/null +++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml @@ -0,0 +1,163 @@ + + + + Verify that System Executables Have Root Ownership + + Red Hat Enterprise Linux 6 + + Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/loca= l/bin, /usr/local/sbin and objects therein, are owned by root + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /bin + + state_owner_not_root + + + + + /bin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /sbin + + state_owner_not_root + + + + + /sbin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /usr/bin + + state_owner_not_root + + + + + /usr/bin + ^.*$ + state_owner_not_root + = + + + + + + + + + + + + /usr/sbin + + state_owner_not_root + + + + + /usr/sbin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /usr/local/bin + + state_owner_not_root + + + + + /usr/local/bin + ^.*$ + state_owner_not_root + + = + + + + + + + + + + + /usr/local/sbin + + state_owner_not_root + + + + + /usr/local/sbin + ^.*$ + state_owner_not_root + + + + + 0 + + -- = 1.7.1 --===============2005508228870175831==-- From shawn at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============3311863769580830051==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Added OVAL content for the file_ownership_binary_dirs rule as the file file_ownership_binary_dirs.xml and added the oval id to the corresponding XCCDF content in files.xml Date: Tue, 01 Oct 2013 11:24:19 -0400 Message-ID: <524AE923.5010309@redhat.com> In-Reply-To: 1380636399-6941-2-git-send-email-coopercd@ornl.gov --===============3311863769580830051== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable You're encountering the same issue I did... perhaps I'm the LCD here... ;) Check out results for /usr/local/bin below. I ran the following to = ensure everything is root before testing: > [shawn(a)SSG-RHEL6 checks]$ sudo bash > [root(a)SSG-RHEL6 checks]# DIRS=3D"/bin /usr/bin /usr/local/bin /sbin = > /usr/sbin /usr/local/sbin" > [root(a)SSG-RHEL6 checks]# for dirPath in $DIRS; do > > find $dirPath \! -user root -exec chown root '{}' \; > > done > [root(a)SSG-RHEL6 checks]# exit > exit > [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml > Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsU1mqUp.xml > Writing results to : /tmp/file_ownership_binary_dirsU1mqUp.xml-results > Definition oval:scap-security-guide.testing:def:261: true > Evaluation done. > On 10/1/13 10:06 AM, Caleb Cooper wrote: > Signed-off-by: Caleb Cooper > --- > RHEL6/input/checks/file_ownership_binary_dirs.xml | 163 ++++++++++++++= +++++++ > 1 files changed, 163 insertions(+), 0 deletions(-) > create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml > > diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/in= put/checks/file_ownership_binary_dirs.xml > new file mode 100644 > index 0000000..b787191 > --- /dev/null > +++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml > @@ -0,0 +1,163 @@ > + > + > + > + Verify that System Executables Have Root Ownership > + > + Red Hat Enterprise Linux 6 > + > + Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/lo= cal/bin, /usr/local/sbin and objects therein, are owned by root > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + > + Minor note: lib/bin in comment > + > + /bin > + > + state_owner_not_root > + > + > + > + > + /bin > + ^.*$ > + state_owner_not_root > + > + .... testing for non-root under /bin...... [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /bin/awk [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirs6eQhsR.xml Writing results to : /tmp/file_ownership_binary_dirs6eQhsR.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. > + > + > + > + > + > + > + > + > + > + > + /sbin > + > + state_owner_not_root > + > + > + > + > + /sbin > + ^.*$ > + state_owner_not_root > + ..... testing for non-root under /sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo rm /usr/local/bin/filetest [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /sbin/addpart [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsu4wrQh.xml Writing results to : /tmp/file_ownership_binary_dirsu4wrQh.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. > + > + > + > + > + > + > + > + > + > + > + > + /usr/bin > + > + state_owner_not_root > + > + > + > + > + /usr/bin > + ^.*$ > + state_owner_not_root > + ..... testing for non-root under /usr/bin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /bin/awk [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/bin/a2p [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirs2wHH6V.xml Writing results to : /tmp/file_ownership_binary_dirs2wHH6V.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. > + > + > + > + > + > + > + > + > + > + > + > + /usr/sbin > + > + state_owner_not_root > + > + > + > + > + /usr/sbin > + ^.*$ > + state_owner_not_root > + ..... testing for non-root under /usr/sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /sbin/addpart [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/sbin/accept [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsddwRzZ.xml Writing results to : /tmp/file_ownership_binary_dirsddwRzZ.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. > + > + > + > + > + > + > + > + > + > + > + > + /usr/local/bin > + > + state_owner_not_root > + ..... testing for non-root under /usr/local/bin ..... [shawn(a)SSG-RHEL6 checks]$ sudo touch /usr/local/bin/filetest ; sudo = chown shawn:shawn /usr/local/bin/filetest [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /usr/bin/a2p [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsno1sSt.xml Writing results to : /tmp/file_ownership_binary_dirsno1sSt.xml-results Definition oval:scap-security-guide.testing:def:261: true Evaluation done. [shawn(a)SSG-RHEL6 checks]$ ll /usr/local/bin/filetest -rw-r--r--. 1 shawn shawn 0 Oct 1 00:09 /usr/local/bin/filetest > + > + > + > + /usr/local/bin > + ^.*$ > + state_owner_not_root > + > + > + > + > + > + > + > + > + > + > + > + > + /usr/local/sbin > + > + state_owner_not_root > + > + > + > + > + /usr/local/sbin > + ^.*$ > + state_owner_not_root > + ..... testing for non-root under /usr/local/sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /usr/sbin/accept [shawn(a)SSG-RHEL6 checks]$ sudo touch /usr/local/sbin/test ; sudo chown = shawn:shawn /usr/local/sbin/test [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirszY6fXL.xml Writing results to : /tmp/file_ownership_binary_dirszY6fXL.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. > + > + > + > + 0 > + > + --===============3311863769580830051== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij48YnI+CiAgICAgIFlvdSdyZSBlbmNvdW50ZXJpbmcgdGhlIHNhbWUgaXNzdWUgSSBkaWQuLi4g cGVyaGFwcyBJJ20gdGhlIExDRAogICAgICBoZXJlLi4uIDspPGJyPgogICAgICA8YnI+CiAgICAg IENoZWNrIG91dCByZXN1bHRzIGZvciAvdXNyL2xvY2FsL2JpbiBiZWxvdy4gSSByYW4gdGhlIGZv bGxvd2luZyB0bwogICAgICBlbnN1cmUgZXZlcnl0aGluZyBpcyByb290IGJlZm9yZSB0ZXN0aW5n Ojxicj4KICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3NoYXduQFNTRy1SSEVMNiBjaGVj a3NdJCBzdWRvIGJhc2g8YnI+CiAgICAgICAgW3Jvb3RAU1NHLVJIRUw2IGNoZWNrc10jIERJUlM9 Ii9iaW4gL3Vzci9iaW4gL3Vzci9sb2NhbC9iaW4KICAgICAgICAvc2JpbiAvdXNyL3NiaW4gL3Vz ci9sb2NhbC9zYmluIjxicj4KICAgICAgICBbcm9vdEBTU0ctUkhFTDYgY2hlY2tzXSMgZm9yIGRp clBhdGggaW4gJERJUlM7IGRvPGJyPgogICAgICAgICZndDvCoMKgwqDCoMKgwqDCoMKgwqDCoCBm aW5kICRkaXJQYXRoIFwhIC11c2VyIHJvb3QgLWV4ZWMgY2hvd24gcm9vdCAne30nCiAgICAgICAg XDs8YnI+CiAgICAgICAgJmd0O8KgwqAgZG9uZTxicj4KICAgICAgICBbcm9vdEBTU0ctUkhFTDYg Y2hlY2tzXSMgZXhpdDxicj4KICAgICAgICBleGl0PGJyPgogICAgICAgIFtzaGF3bkBTU0ctUkhF TDYgY2hlY2tzXSQgLi90ZXN0Y2hlY2sucHkKICAgICAgICBmaWxlX293bmVyc2hpcF9iaW5hcnlf ZGlycy54bWwgPGJyPgogICAgICAgIEV2YWx1YXRpbmcgd2l0aCBPVkFMIHRlbXBmaWxlIDoKICAg ICAgICAvdG1wL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzVTFtcVVwLnhtbDxicj4KICAgICAg ICBXcml0aW5nIHJlc3VsdHMgdG8gOgogICAgICAgIC90bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5 X2RpcnNVMW1xVXAueG1sLXJlc3VsdHM8YnI+CiAgICAgICAgRGVmaW5pdGlvbiBvdmFsOnNjYXAt c2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MjYxOiB0cnVlPGJyPgogICAgICAgIEV2YWx1YXRp b24gZG9uZS48YnI+CiAgICAgICAgPGJyPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4K ICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgT24gMTAvMS8xMyAxMDowNiBB TSwgQ2FsZWIgQ29vcGVyIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKICAg ICAgY2l0ZT0ibWlkOjEzODA2MzYzOTktNjk0MS0yLWdpdC1zZW5kLWVtYWlsLWNvb3BlcmNkQG9y bmwuZ292IgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFwPSIiPgpTaWduZWQtb2Zm LWJ5OiBDYWxlYiBDb29wZXIgPGEgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0i bWFpbHRvOmNvb3BlcmNkQG9ybmwuZ292Ij4mbHQ7Y29vcGVyY2RAb3JubC5nb3YmZ3Q7PC9hPgot LS0KIFJIRUw2L2lucHV0L2NoZWNrcy9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwgfCAg MTYzICsrKysrKysrKysrKysrKysrKysrKwogMSBmaWxlcyBjaGFuZ2VkLCAxNjMgaW5zZXJ0aW9u cygrKSwgMCBkZWxldGlvbnMoLSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBSSEVMNi9pbnB1dC9jaGVj a3MvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMueG1sCgpkaWZmIC0tZ2l0IGEvUkhFTDYvaW5w dXQvY2hlY2tzL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzLnhtbCBiL1JIRUw2L2lucHV0L2No ZWNrcy9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMC4uYjc4NzE5MQotLS0gL2Rldi9udWxsCisrKyBiL1JIRUw2L2lucHV0L2No ZWNrcy9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwKQEAgLTAsMCArMSwxNjMgQEAKKyZs dDtkZWYtZ3JvdXAmZ3Q7CisgICZsdDtkZWZpbml0aW9uIGNsYXNzPSJjb21wbGlhbmNlIiBpZD0i ZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMiIHZlcnNpb249IjEiJmd0OworICAgICZsdDttZXRh ZGF0YSZndDsKKyAgICAgICZsdDt0aXRsZSZndDtWZXJpZnkgdGhhdCBTeXN0ZW0gRXhlY3V0YWJs ZXMgSGF2ZSBSb290IE93bmVyc2hpcCZsdDsvdGl0bGUmZ3Q7CisgICAgICAmbHQ7YWZmZWN0ZWQg ZmFtaWx5PSJ1bml4IiZndDsKKyAgICAgICAgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQgRW50ZXJw cmlzZSBMaW51eCA2Jmx0Oy9wbGF0Zm9ybSZndDsKKyAgICAgICZsdDsvYWZmZWN0ZWQmZ3Q7Cisg ICAgICAmbHQ7ZGVzY3JpcHRpb24mZ3Q7Q2hlY2tzIHRoYXQgL2JpbiwgL3NiaW4sIC91c3IvYmlu LCAvdXNyL3NiaW4sIC91c3IvbG9jYWwvYmluLCAvdXNyL2xvY2FsL3NiaW4gYW5kIG9iamVjdHMg dGhlcmVpbiwgYXJlIG93bmVkIGJ5IHJvb3QmbHQ7L2Rlc2NyaXB0aW9uJmd0OworICAgICAgJmx0 O3JlZmVyZW5jZSBzb3VyY2U9InN3ZWxscyIgcmVmX2lkPSIyMDEzMDkxNCIgcmVmX3VybD0idGVz dF9hdHRlc3RhdGlvbiIgLyZndDsKKyAgICAmbHQ7L21ldGFkYXRhJmd0OworICAgICZsdDtjcml0 ZXJpYSBvcGVyYXRvcj0iQU5EIiZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9InRl c3Rfb3duZXJzaGlwX2Jpbl9kaXIiIC8mZ3Q7CisgICAgICAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVm PSJ0ZXN0X293bmVyc2hpcF9zYmluX2RpciIgLyZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVz dF9yZWY9InRlc3Rfb3duZXJzaGlwX3Vzcl9iaW5fZGlyIiAvJmd0OworICAgICAgJmx0O2NyaXRl cmlvbiB0ZXN0X3JlZj0idGVzdF9vd25lcnNoaXBfdXNyX3NiaW5fZGlyIiAvJmd0OworICAgICAg Jmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0idGVzdF9vd25lcnNoaXBfdXNyX2xvY2FsX2Jpbl9kaXIi IC8mZ3Q7CisgICAgICAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSJ0ZXN0X293bmVyc2hpcF91c3Jf bG9jYWxfYmluX2RpciIgLyZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9InRlc3Rf b3duZXJzaGlwX2Jpbl9maWxlcyIgLyZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9 InRlc3Rfb3duZXJzaGlwX3NiaW5fZmlsZXMiIC8mZ3Q7CisgICAgICAmbHQ7Y3JpdGVyaW9uIHRl c3RfcmVmPSJ0ZXN0X293bmVyc2hpcF91c3JfYmluX2ZpbGVzIiAvJmd0OworICAgICAgJmx0O2Ny aXRlcmlvbiB0ZXN0X3JlZj0idGVzdF9vd25lcnNoaXBfdXNyX3NiaW5fZmlsZXMiIC8mZ3Q7Cisg ICAgICAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSJ0ZXN0X293bmVyc2hpcF91c3JfbG9jYWxfc2Jp bl9maWxlcyIgLyZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9InRlc3Rfb3duZXJz aGlwX3Vzcl9sb2NhbF9zYmluX2ZpbGVzIiAvJmd0OworICAgICZsdDsvY3JpdGVyaWEmZ3Q7Cisg ICZsdDsvZGVmaW5pdGlvbiZndDsKKworICAmbHQ7dW5peDpmaWxlX3Rlc3QgIGNoZWNrPSJhbGwi IGNoZWNrX2V4aXN0ZW5jZT0ibm9uZV9leGlzdCIgY29tbWVudD0iL2JpbiBkaXJlY3RvcmllcyB1 aWQgcm9vdCIgaWQ9InRlc3Rfb3duZXJzaGlwX2Jpbl9kaXIiIHZlcnNpb249IjEiJmd0OworICAg ICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSJmaWxlX293bmVyc2hpcF9vYmplY3RfYmluX2Rp ciIgLyZndDsKKyAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDsKKworICAmbHQ7dW5peDpmaWxlX3Rl c3QgIGNoZWNrPSJhbGwiIGNoZWNrX2V4aXN0ZW5jZT0ibm9uZV9leGlzdCIgY29tbWVudD0iL2Jp biBmaWxlcyB1aWQgcm9vdCIgaWQ9InRlc3Rfb3duZXJzaGlwX2Jpbl9maWxlcyIgdmVyc2lvbj0i MSImZ3Q7CisgICAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9maWxlX293bmVy c2hpcF9iaW5fZmlsZXMiIC8mZ3Q7CisgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7CisKKyAgJmx0 O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0iL2xpYiBkaXJlY3RvcmllcyIgaWQ9ImZpbGVfb3du ZXJzaGlwX29iamVjdF9iaW5fZGlyIiB2ZXJzaW9uPSIxIiZndDs8L3ByZT4KICAgIDwvYmxvY2tx dW90ZT4KICAgIDxicj4KICAgIE1pbm9yIG5vdGU6IGxpYi9iaW4gaW4gY29tbWVudDxicj4KICAg IDxicj4KICAgIDxicj4KICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoxMzgwNjM2Mzk5 LTY5NDEtMi1naXQtc2VuZC1lbWFpbC1jb29wZXJjZEBvcm5sLmdvdiIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj4KKyAgICAmbHQ7dW5peDpiZWhhdmlvcnMgcmVjdXJzZT0i ZGlyZWN0b3JpZXMiIHJlY3Vyc2VfZGlyZWN0aW9uPSJkb3duIiBtYXhfZGVwdGg9Ii0xIiByZWN1 cnNlX2ZpbGVfc3lzdGVtPSJhbGwiIC8mZ3Q7CisgICAgJmx0O3VuaXg6cGF0aCBvcGVyYXRpb249 ImVxdWFscyImZ3Q7L2JpbiZsdDsvdW5peDpwYXRoJmd0OworICAgICZsdDt1bml4OmZpbGVuYW1l IHhzaTpuaWw9InRydWUiIC8mZ3Q7CisgICAgJmx0O2ZpbHRlciBhY3Rpb249ImluY2x1ZGUiJmd0 O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7CisgICZsdDsvdW5peDpmaWxlX29i amVjdCZndDsKKworICAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSIvYmluIGZpbGVzIiBp ZD0ib2JqZWN0X2ZpbGVfb3duZXJzaGlwX2Jpbl9maWxlcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAg Jmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9ImRpcmVjdG9yaWVzIiByZWN1cnNlX2RpcmVjdGlv bj0iZG93biIgbWF4X2RlcHRoPSItMSIgcmVjdXJzZV9maWxlX3N5c3RlbT0iYWxsIiAvJmd0Owor ICAgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSJlcXVhbHMiJmd0Oy9iaW4mbHQ7L3VuaXg6cGF0 aCZndDsKKyAgICAmbHQ7dW5peDpmaWxlbmFtZSBvcGVyYXRpb249InBhdHRlcm4gbWF0Y2giJmd0 O14uKiQmbHQ7L3VuaXg6ZmlsZW5hbWUmZ3Q7CisgICAmbHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVk ZSImZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDsKKyAgJmx0Oy91bml4OmZp bGVfb2JqZWN0Jmd0OworPC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+ CiAgICA8YnI+CiAgICAuLi4uIHRlc3RpbmcgZm9yIG5vbi1yb290IHVuZGVyIC9iaW4uLi4uLi48 YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gY2hvd24gc2hhd246c2hhd24g L2Jpbi9hd2sgPGJyPgogICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rlc3RjaGVjay5w eQogICAgZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMueG1sIDxicj4KICAgIEV2YWx1YXRpbmcg d2l0aCBPVkFMIHRlbXBmaWxlIDoKICAgIC90bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnM2 ZVFoc1IueG1sPGJyPgogICAgV3JpdGluZyByZXN1bHRzIHRvIDoKICAgIC90bXAvZmlsZV9vd25l cnNoaXBfYmluYXJ5X2RpcnM2ZVFoc1IueG1sLXJlc3VsdHM8YnI+CiAgICBEZWZpbml0aW9uIG92 YWw6c2NhcC1zZWN1cml0eS1ndWlkZS50ZXN0aW5nOmRlZjoyNjE6IGZhbHNlPGJyPgogICAgRXZh bHVhdGlvbiBkb25lLjxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAg IDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoxMzgwNjM2Mzk5LTY5NDEtMi1naXQtc2VuZC1l bWFpbC1jb29wZXJjZEBvcm5sLmdvdiIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3Jh cD0iIj4KKyAgJmx0O3VuaXg6ZmlsZV90ZXN0ICBjaGVjaz0iYWxsIiBjaGVja19leGlzdGVuY2U9 Im5vbmVfZXhpc3QiIGNvbW1lbnQ9Ii9zYmluIGRpcmVjdG9yaWVzIHVpZCByb290IiBpZD0idGVz dF9vd25lcnNoaXBfc2Jpbl9kaXIiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4Om9iamVj dCBvYmplY3RfcmVmPSJvYmplY3RfZmlsZV9vd25lcnNoaXBfc2Jpbl9kaXIiIC8mZ3Q7CisgICZs dDsvdW5peDpmaWxlX3Rlc3QmZ3Q7CisKKyAgJmx0O3VuaXg6ZmlsZV90ZXN0ICBjaGVjaz0iYWxs IiBjaGVja19leGlzdGVuY2U9Im5vbmVfZXhpc3QiIGNvbW1lbnQ9Ii9zYmluIGZpbGVzIHVpZCBy b290IiBpZD0idGVzdF9vd25lcnNoaXBfc2Jpbl9maWxlcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAg Jmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9maWxlX293bmVyc2hpcF9zYmluX2Zp bGVzIiAvJmd0OworICAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OworCisgICZsdDt1bml4OmZpbGVf b2JqZWN0IGNvbW1lbnQ9Ii9zYmluIGRpcmVjdG9yaWVzIiBpZD0ib2JqZWN0X2ZpbGVfb3duZXJz aGlwX3NiaW5fZGlyIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7dW5peDpiZWhhdmlvcnMgcmVj dXJzZT0iZGlyZWN0b3JpZXMiIHJlY3Vyc2VfZGlyZWN0aW9uPSJkb3duIiBtYXhfZGVwdGg9Ii0x IiByZWN1cnNlX2ZpbGVfc3lzdGVtPSJhbGwiIC8mZ3Q7CisgICAgJmx0O3VuaXg6cGF0aCBvcGVy YXRpb249ImVxdWFscyImZ3Q7L3NiaW4mbHQ7L3VuaXg6cGF0aCZndDsKKyAgICAmbHQ7dW5peDpm aWxlbmFtZSB4c2k6bmlsPSJ0cnVlIiAvJmd0OworICAgICZsdDtmaWx0ZXIgYWN0aW9uPSJpbmNs dWRlIiZndDtzdGF0ZV9vd25lcl9ub3Rfcm9vdCZsdDsvZmlsdGVyJmd0OworICAmbHQ7L3VuaXg6 ZmlsZV9vYmplY3QmZ3Q7CisKKyAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0iL3NiaW4g ZmlsZXMiIGlkPSJvYmplY3RfZmlsZV9vd25lcnNoaXBfc2Jpbl9maWxlcyIgdmVyc2lvbj0iMSIm Z3Q7CisgICAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9ImRpcmVjdG9yaWVzIiByZWN1cnNl X2RpcmVjdGlvbj0iZG93biIgbWF4X2RlcHRoPSItMSIgcmVjdXJzZV9maWxlX3N5c3RlbT0iYWxs IiAvJmd0OworICAgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSJlcXVhbHMiJmd0Oy9zYmluJmx0 Oy91bml4OnBhdGgmZ3Q7CisgICAgJmx0O3VuaXg6ZmlsZW5hbWUgb3BlcmF0aW9uPSJwYXR0ZXJu IG1hdGNoIiZndDteLiokJmx0Oy91bml4OmZpbGVuYW1lJmd0OworICAgICZsdDtmaWx0ZXIgYWN0 aW9uPSJpbmNsdWRlIiZndDtzdGF0ZV9vd25lcl9ub3Rfcm9vdCZsdDsvZmlsdGVyJmd0OworICAm bHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+ CiAgICA8YnI+CiAgICAuLi4uLiB0ZXN0aW5nIGZvciBub24tcm9vdCB1bmRlciAvc2JpbiAuLi4u Ljxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBybSAvdXNyL2xvY2FsL2Jp bi9maWxldGVzdCA8YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gY2hvd24g c2hhd246c2hhd24gL3NiaW4vYWRkcGFydCA8YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNr c10kIC4vdGVzdGNoZWNrLnB5CiAgICBmaWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwgPGJy PgogICAgRXZhbHVhdGluZyB3aXRoIE9WQUwgdGVtcGZpbGUgOgogICAgL3RtcC9maWxlX293bmVy c2hpcF9iaW5hcnlfZGlyc3U0d3JRaC54bWw8YnI+CiAgICBXcml0aW5nIHJlc3VsdHMgdG8gOgog ICAgL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyc3U0d3JRaC54bWwtcmVzdWx0czxicj4K ICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjI2MTog ZmFsc2U8YnI+CiAgICBFdmFsdWF0aW9uIGRvbmUuPGJyPgogICAgPGJyPgogICAgPGJyPgogICAg PGJsb2NrcXVvdGUKICAgICAgY2l0ZT0ibWlkOjEzODA2MzYzOTktNjk0MS0yLWdpdC1zZW5kLWVt YWlsLWNvb3BlcmNkQG9ybmwuZ292IgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFw PSIiPgorCisgICZsdDt1bml4OmZpbGVfdGVzdCAgY2hlY2s9ImFsbCIgY2hlY2tfZXhpc3RlbmNl PSJub25lX2V4aXN0IiBjb21tZW50PSIvdXNyL2JpbiBkaXJlY3RvcmllcyB1aWQgcm9vdCIgaWQ9 InRlc3Rfb3duZXJzaGlwX3Vzcl9iaW5fZGlyIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7dW5p eDpvYmplY3Qgb2JqZWN0X3JlZj0ib2JqZWN0X2ZpbGVfb3duZXJzaGlwX3Vzcl9iaW5fZGlyIiAv Jmd0OworICAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OworCisgICZsdDt1bml4OmZpbGVfdGVzdCAg Y2hlY2s9ImFsbCIgY2hlY2tfZXhpc3RlbmNlPSJub25lX2V4aXN0IiBjb21tZW50PSIvdXNyL2Jp biBmaWxlcyB1aWQgcm9vdCIgaWQ9InRlc3Rfb3duZXJzaGlwX3Vzcl9iaW5fZmlsZXMiIHZlcnNp b249IjEiJmd0OworICAgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSJvYmplY3RfZmlsZV9v d25lcnNoaXBfdXNyX2Jpbl9maWxlcyIgLyZndDsKKyAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDsK KworICAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSIvdXNyL2JpbiBkaXJlY3RvcmllcyIg aWQ9Im9iamVjdF9maWxlX293bmVyc2hpcF91c3JfYmluX2RpciIgdmVyc2lvbj0iMSImZ3Q7Cisg ICAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9ImRpcmVjdG9yaWVzIiByZWN1cnNlX2RpcmVj dGlvbj0iZG93biIgbWF4X2RlcHRoPSItMSIgcmVjdXJzZV9maWxlX3N5c3RlbT0iYWxsIiAvJmd0 OworICAgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSJlcXVhbHMiJmd0Oy91c3IvYmluJmx0Oy91 bml4OnBhdGgmZ3Q7CisgICAgJmx0O3VuaXg6ZmlsZW5hbWUgeHNpOm5pbD0idHJ1ZSIgLyZndDsK KwkmbHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVkZSImZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7 L2ZpbHRlciZndDsKKyAgJmx0Oy91bml4OmZpbGVfb2JqZWN0Jmd0OworCisgICZsdDt1bml4OmZp bGVfb2JqZWN0IGNvbW1lbnQ9Ii91c3IvYmluIGZpbGVzIiBpZD0ib2JqZWN0X2ZpbGVfb3duZXJz aGlwX3Vzcl9iaW5fZmlsZXMiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4OmJlaGF2aW9y cyByZWN1cnNlPSJkaXJlY3RvcmllcyIgcmVjdXJzZV9kaXJlY3Rpb249ImRvd24iIG1heF9kZXB0 aD0iLTEiIHJlY3Vyc2VfZmlsZV9zeXN0ZW09ImFsbCIgLyZndDsKKyAgICAmbHQ7dW5peDpwYXRo IG9wZXJhdGlvbj0iZXF1YWxzIiZndDsvdXNyL2JpbiZsdDsvdW5peDpwYXRoJmd0OworICAgICZs dDt1bml4OmZpbGVuYW1lIG9wZXJhdGlvbj0icGF0dGVybiBtYXRjaCImZ3Q7Xi4qJCZsdDsvdW5p eDpmaWxlbmFtZSZndDsKKyAgICAmbHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVkZSImZ3Q7c3RhdGVf b3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDsKKyAgJmx0Oy91bml4OmZpbGVfb2JqZWN0Jmd0 OyAgPC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICAuLi4uLiB0 ZXN0aW5nIGZvciBub24tcm9vdCB1bmRlciAvdXNyL2JpbiAuLi4uLjxicj4KICAgIFtzaGF3bkBT U0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBjaG93biByb290OnJvb3QgL2Jpbi9hd2sgPGJyPgogICAg W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHNoYXduOnNoYXduIC91c3IvYmlu L2EycCA8YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIC4vdGVzdGNoZWNrLnB5CiAg ICBmaWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwgPGJyPgogICAgRXZhbHVhdGluZyB3aXRo IE9WQUwgdGVtcGZpbGUgOgogICAgL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyczJ3SEg2 Vi54bWw8YnI+CiAgICBXcml0aW5nIHJlc3VsdHMgdG8gOgogICAgL3RtcC9maWxlX293bmVyc2hp cF9iaW5hcnlfZGlyczJ3SEg2Vi54bWwtcmVzdWx0czxicj4KICAgIERlZmluaXRpb24gb3ZhbDpz Y2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjI2MTogZmFsc2U8YnI+CiAgICBFdmFsdWF0 aW9uIGRvbmUuPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJsb2NrcXVvdGUK ICAgICAgY2l0ZT0ibWlkOjEzODA2MzYzOTktNjk0MS0yLWdpdC1zZW5kLWVtYWlsLWNvb3BlcmNk QG9ybmwuZ292IgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFwPSIiPgorCisgICZs dDt1bml4OmZpbGVfdGVzdCAgY2hlY2s9ImFsbCIgY2hlY2tfZXhpc3RlbmNlPSJub25lX2V4aXN0 IiBjb21tZW50PSIvdXNyL3NiaW4gZGlyZWN0b3JpZXMgdWlkIHJvb3QiIGlkPSJ0ZXN0X293bmVy c2hpcF91c3Jfc2Jpbl9kaXIiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4Om9iamVjdCBv YmplY3RfcmVmPSJvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNyX3NiaW5fZGlyIiAvJmd0OworICAm bHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OworCisgICZsdDt1bml4OmZpbGVfdGVzdCAgY2hlY2s9ImFs bCIgY2hlY2tfZXhpc3RlbmNlPSJub25lX2V4aXN0IiBjb21tZW50PSIvdXNyL3NiaW4gZmlsZXMg dWlkIHJvb3QiIGlkPSJ0ZXN0X293bmVyc2hpcF91c3Jfc2Jpbl9maWxlcyIgdmVyc2lvbj0iMSIm Z3Q7CisgICAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9maWxlX293bmVyc2hp cF91c3Jfc2Jpbl9maWxlcyIgLyZndDsKKyAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDsKKworICAm bHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSIvdXNyL3NiaW4gZGlyZWN0b3JpZXMiIGlkPSJv YmplY3RfZmlsZV9vd25lcnNoaXBfdXNyX3NiaW5fZGlyIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAm bHQ7dW5peDpiZWhhdmlvcnMgcmVjdXJzZT0iZGlyZWN0b3JpZXMiIHJlY3Vyc2VfZGlyZWN0aW9u PSJkb3duIiBtYXhfZGVwdGg9Ii0xIiByZWN1cnNlX2ZpbGVfc3lzdGVtPSJhbGwiIC8mZ3Q7Cisg ICAgJmx0O3VuaXg6cGF0aCBvcGVyYXRpb249ImVxdWFscyImZ3Q7L3Vzci9zYmluJmx0Oy91bml4 OnBhdGgmZ3Q7CisgICAgJmx0O3VuaXg6ZmlsZW5hbWUgeHNpOm5pbD0idHJ1ZSIgLyZndDsKKwkm bHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVkZSImZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2Zp bHRlciZndDsKKyAgJmx0Oy91bml4OmZpbGVfb2JqZWN0Jmd0OworCisgICZsdDt1bml4OmZpbGVf b2JqZWN0IGNvbW1lbnQ9Ii91c3Ivc2JpbiBmaWxlcyIgaWQ9Im9iamVjdF9maWxlX293bmVyc2hp cF91c3Jfc2Jpbl9maWxlcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O3VuaXg6YmVoYXZpb3Jz IHJlY3Vyc2U9ImRpcmVjdG9yaWVzIiByZWN1cnNlX2RpcmVjdGlvbj0iZG93biIgbWF4X2RlcHRo PSItMSIgcmVjdXJzZV9maWxlX3N5c3RlbT0iYWxsIiAvJmd0OworICAgICZsdDt1bml4OnBhdGgg b3BlcmF0aW9uPSJlcXVhbHMiJmd0Oy91c3Ivc2JpbiZsdDsvdW5peDpwYXRoJmd0OworICAgICZs dDt1bml4OmZpbGVuYW1lIG9wZXJhdGlvbj0icGF0dGVybiBtYXRjaCImZ3Q7Xi4qJCZsdDsvdW5p eDpmaWxlbmFtZSZndDsKKyAgICAmbHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVkZSImZ3Q7c3RhdGVf b3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDsKKyAgJmx0Oy91bml4OmZpbGVfb2JqZWN0Jmd0 OzwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgPGJyPgogICAgPGJyPgogICAg Li4uLi4gdGVzdGluZyBmb3Igbm9uLXJvb3QgdW5kZXIgL3Vzci9zYmluIC4uLi4uPGJyPgogICAg W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHJvb3Q6cm9vdCAvc2Jpbi9hZGRw YXJ0IDxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBjaG93biBzaGF3bjpz aGF3biAvdXNyL3NiaW4vYWNjZXB0IDxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQg Li90ZXN0Y2hlY2sucHkKICAgIGZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzLnhtbCA8YnI+CiAg ICBFdmFsdWF0aW5nIHdpdGggT1ZBTCB0ZW1wZmlsZSA6CiAgICAvdG1wL2ZpbGVfb3duZXJzaGlw X2JpbmFyeV9kaXJzZGR3UnpaLnhtbDxicj4KICAgIFdyaXRpbmcgcmVzdWx0cyB0byA6CiAgICAv dG1wL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzZGR3UnpaLnhtbC1yZXN1bHRzPGJyPgogICAg RGVmaW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MjYxOiBmYWxz ZTxicj4KICAgIEV2YWx1YXRpb24gZG9uZS48YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8YnI+ CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MTM4MDYzNjM5OS02OTQxLTItZ2l0LXNl bmQtZW1haWwtY29vcGVyY2RAb3JubC5nb3YiCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8cHJl IHdyYXA9IiI+CisKKyAgJmx0O3VuaXg6ZmlsZV90ZXN0ICBjaGVjaz0iYWxsIiBjaGVja19leGlz dGVuY2U9Im5vbmVfZXhpc3QiIGNvbW1lbnQ9Ii91c3IvbG9jYWwvYmluIGRpcmVjdG9yaWVzIHVp ZCByb290IiBpZD0idGVzdF9vd25lcnNoaXBfdXNyX2xvY2FsX2Jpbl9kaXIiIHZlcnNpb249IjEi Jmd0OworICAgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSJvYmplY3RfZmlsZV9vd25lcnNo aXBfdXNyX2xvY2FsX2Jpbl9kaXIiIC8mZ3Q7CisgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7CisK KyAgJmx0O3VuaXg6ZmlsZV90ZXN0ICBjaGVjaz0iYWxsIiBjaGVja19leGlzdGVuY2U9Im5vbmVf ZXhpc3QiIGNvbW1lbnQ9Ii91c3IvbG9jYWwvYmluIGZpbGVzIHVpZCByb290IiBpZD0idGVzdF9v d25lcnNoaXBfdXNyX2xvY2FsX2Jpbl9maWxlcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O3Vu aXg6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9maWxlX293bmVyc2hpcF91c3JfbG9jYWxfYmlu X2ZpbGVzIiAvJmd0OworICAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OworCisgICZsdDt1bml4OmZp bGVfb2JqZWN0IGNvbW1lbnQ9Ii91c3IvbG9jYWwvYmluIGRpcmVjdG9yaWVzIiBpZD0ib2JqZWN0 X2ZpbGVfb3duZXJzaGlwX3Vzcl9sb2NhbF9iaW5fZGlyIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAm bHQ7dW5peDpiZWhhdmlvcnMgcmVjdXJzZT0iZGlyZWN0b3JpZXMiIHJlY3Vyc2VfZGlyZWN0aW9u PSJkb3duIiBtYXhfZGVwdGg9Ii0xIiByZWN1cnNlX2ZpbGVfc3lzdGVtPSJhbGwiIC8mZ3Q7Cisg ICAgJmx0O3VuaXg6cGF0aCBvcGVyYXRpb249ImVxdWFscyImZ3Q7L3Vzci9sb2NhbC9iaW4mbHQ7 L3VuaXg6cGF0aCZndDsKKyAgICAmbHQ7dW5peDpmaWxlbmFtZSB4c2k6bmlsPSJ0cnVlIiAvJmd0 OworICAgJmx0O2ZpbHRlciBhY3Rpb249ImluY2x1ZGUiJmd0O3N0YXRlX293bmVyX25vdF9yb290 Jmx0Oy9maWx0ZXImZ3Q7CisgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8L3ByZT4KICAgIDwv YmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxmb250IGNvbG9yPSIjZmYwMDAwIj48YnI+CiAgICAg IC4uLi4uIHRlc3RpbmcgZm9yIG5vbi1yb290IHVuZGVyIC91c3IvbG9jYWwvYmluIC4uLi4uPGJy PgogICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gdG91Y2ggL3Vzci9sb2NhbC9i aW4vZmlsZXRlc3QgOwogICAgICBzdWRvIGNob3duIHNoYXduOnNoYXduIC91c3IvbG9jYWwvYmlu L2ZpbGV0ZXN0PGJyPgogICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gY2hvd24g cm9vdDpyb290IC91c3IvYmluL2EycCA8YnI+CiAgICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tz XSQgLi90ZXN0Y2hlY2sucHkKICAgICAgZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMueG1sIDxi cj4KICAgICAgRXZhbHVhdGluZyB3aXRoIE9WQUwgdGVtcGZpbGUgOgogICAgICAvdG1wL2ZpbGVf b3duZXJzaGlwX2JpbmFyeV9kaXJzbm8xc1N0LnhtbDxicj4KICAgICAgV3JpdGluZyByZXN1bHRz IHRvIDoKICAgICAgL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyc25vMXNTdC54bWwtcmVz dWx0czxicj4KICAgICAgRGVmaW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGlu ZzpkZWY6MjYxOiB0cnVlPGJyPgogICAgICBFdmFsdWF0aW9uIGRvbmUuPGJyPgogICAgICBbc2hh d25AU1NHLVJIRUw2IGNoZWNrc10kIGxsIC91c3IvbG9jYWwvYmluL2ZpbGV0ZXN0IDxicj4KICAg ICAgLXJ3LXItLXItLS4gMSBzaGF3biBzaGF3biAwIE9jdMKgIDEgMDA6MDkgL3Vzci9sb2NhbC9i aW4vZmlsZXRlc3Q8L2ZvbnQ+PGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJs b2NrcXVvdGUKICAgICAgY2l0ZT0ibWlkOjEzODA2MzYzOTktNjk0MS0yLWdpdC1zZW5kLWVtYWls LWNvb3BlcmNkQG9ybmwuZ292IgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFwPSIi PgorCisgICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9Ii91c3IvbG9jYWwvYmluIGZpbGVz IiBpZD0ib2JqZWN0X2ZpbGVfb3duZXJzaGlwX3Vzcl9sb2NhbF9iaW5fZmlsZXMiIHZlcnNpb249 IjEiJmd0OworICAgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSJkaXJlY3RvcmllcyIgcmVj dXJzZV9kaXJlY3Rpb249ImRvd24iIG1heF9kZXB0aD0iLTEiIHJlY3Vyc2VfZmlsZV9zeXN0ZW09 ImFsbCIgLyZndDsKKyAgICAmbHQ7dW5peDpwYXRoIG9wZXJhdGlvbj0iZXF1YWxzIiZndDsvdXNy L2xvY2FsL2JpbiZsdDsvdW5peDpwYXRoJmd0OworICAgICZsdDt1bml4OmZpbGVuYW1lIG9wZXJh dGlvbj0icGF0dGVybiBtYXRjaCImZ3Q7Xi4qJCZsdDsvdW5peDpmaWxlbmFtZSZndDsKKyAgICAm bHQ7ZmlsdGVyIGFjdGlvbj0iaW5jbHVkZSImZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2Zp bHRlciZndDsKKyAgJmx0Oy91bml4OmZpbGVfb2JqZWN0Jmd0OworICAKKyAgJmx0O3VuaXg6Zmls ZV90ZXN0ICBjaGVjaz0iYWxsIiBjaGVja19leGlzdGVuY2U9Im5vbmVfZXhpc3QiIGNvbW1lbnQ9 Ii91c3IvbG9jYWwvc2JpbiBkaXJlY3RvcmllcyB1aWQgcm9vdCIgaWQ9InRlc3Rfb3duZXJzaGlw X3Vzcl9sb2NhbF9zYmluX2RpciIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O3VuaXg6b2JqZWN0 IG9iamVjdF9yZWY9Im9iamVjdF9maWxlX293bmVyc2hpcF91c3JfbG9jYWxfc2Jpbl9kaXIiIC8m Z3Q7CisgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7CisKKyAgJmx0O3VuaXg6ZmlsZV90ZXN0ICBj aGVjaz0iYWxsIiBjaGVja19leGlzdGVuY2U9Im5vbmVfZXhpc3QiIGNvbW1lbnQ9Ii91c3IvbG9j YWwvc2JpbiBmaWxlcyB1aWQgcm9vdCIgaWQ9InRlc3Rfb3duZXJzaGlwX3Vzcl9sb2NhbF9zYmlu X2ZpbGVzIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0i b2JqZWN0X2ZpbGVfb3duZXJzaGlwX3Vzcl9sb2NhbF9zYmluX2ZpbGVzIiAvJmd0OworICAmbHQ7 L3VuaXg6ZmlsZV90ZXN0Jmd0OworCisgICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9Ii91 c3IvbG9jYWwvc2JpbiBkaXJlY3RvcmllcyIgaWQ9Im9iamVjdF9maWxlX293bmVyc2hpcF91c3Jf bG9jYWxfc2Jpbl9kaXIiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4OmJlaGF2aW9ycyBy ZWN1cnNlPSJkaXJlY3RvcmllcyIgcmVjdXJzZV9kaXJlY3Rpb249ImRvd24iIG1heF9kZXB0aD0i LTEiIHJlY3Vyc2VfZmlsZV9zeXN0ZW09ImFsbCIgLyZndDsKKyAgICAmbHQ7dW5peDpwYXRoIG9w ZXJhdGlvbj0iZXF1YWxzIiZndDsvdXNyL2xvY2FsL3NiaW4mbHQ7L3VuaXg6cGF0aCZndDsKKyAg ICAmbHQ7dW5peDpmaWxlbmFtZSB4c2k6bmlsPSJ0cnVlIiAvJmd0OworICAgJmx0O2ZpbHRlciBh Y3Rpb249ImluY2x1ZGUiJmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7Cisg ICZsdDsvdW5peDpmaWxlX29iamVjdCZndDsKKworICAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21t ZW50PSIvdXNyL2xvY2FsL3NiaW4gZmlsZXMiIGlkPSJvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNy X2xvY2FsX3NiaW5fZmlsZXMiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4OmJlaGF2aW9y cyByZWN1cnNlPSJkaXJlY3RvcmllcyIgcmVjdXJzZV9kaXJlY3Rpb249ImRvd24iIG1heF9kZXB0 aD0iLTEiIHJlY3Vyc2VfZmlsZV9zeXN0ZW09ImFsbCIgLyZndDsKKyAgICAmbHQ7dW5peDpwYXRo IG9wZXJhdGlvbj0iZXF1YWxzIiZndDsvdXNyL2xvY2FsL3NiaW4mbHQ7L3VuaXg6cGF0aCZndDsK KyAgICAmbHQ7dW5peDpmaWxlbmFtZSBvcGVyYXRpb249InBhdHRlcm4gbWF0Y2giJmd0O14uKiQm bHQ7L3VuaXg6ZmlsZW5hbWUmZ3Q7CisgICAgJmx0O2ZpbHRlciBhY3Rpb249ImluY2x1ZGUiJmd0 O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7CisgICZsdDsvdW5peDpmaWxlX29i amVjdCZndDs8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxicj4KICAgIC4u Li4uIHRlc3RpbmcgZm9yIG5vbi1yb290IHVuZGVyIC91c3IvbG9jYWwvc2JpbiAuLi4uLjxicj4K ICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBjaG93biByb290OnJvb3QgL3Vzci9z YmluL2FjY2VwdDxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyB0b3VjaCAv dXNyL2xvY2FsL3NiaW4vdGVzdCA7IHN1ZG8KICAgIGNob3duIHNoYXduOnNoYXduIC91c3IvbG9j YWwvc2Jpbi90ZXN0PGJyPgogICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rlc3RjaGVj ay5weQogICAgZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMueG1sIDxicj4KICAgIEV2YWx1YXRp bmcgd2l0aCBPVkFMIHRlbXBmaWxlIDoKICAgIC90bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2Rp cnN6WTZmWEwueG1sPGJyPgogICAgV3JpdGluZyByZXN1bHRzIHRvIDoKICAgIC90bXAvZmlsZV9v d25lcnNoaXBfYmluYXJ5X2RpcnN6WTZmWEwueG1sLXJlc3VsdHM8YnI+CiAgICBEZWZpbml0aW9u IG92YWw6c2NhcC1zZWN1cml0eS1ndWlkZS50ZXN0aW5nOmRlZjoyNjE6IGZhbHNlPGJyPgogICAg RXZhbHVhdGlvbiBkb25lLjxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxibG9j a3F1b3RlCiAgICAgIGNpdGU9Im1pZDoxMzgwNjM2Mzk5LTY5NDEtMi1naXQtc2VuZC1lbWFpbC1j b29wZXJjZEBvcm5sLmdvdiIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj4K KworICAmbHQ7dW5peDpmaWxlX3N0YXRlIGlkPSJzdGF0ZV9vd25lcl9ub3Rfcm9vdCIgdmVyc2lv bj0iMSIgb3BlcmF0b3I9Ik9SIiZndDsKKyZsdDshLS0gICAgJmx0O3VuaXg6Z3JvdXBfaWQgZGF0 YXR5cGU9ImludCIgb3BlcmF0aW9uPSJub3QgZXF1YWwiJmd0OzAmbHQ7L3VuaXg6Z3JvdXBfaWQm Z3Q7IC0tJmd0OworICAgICZsdDt1bml4OnVzZXJfaWQgZGF0YXR5cGU9ImludCIgb3BlcmF0aW9u PSJub3QgZXF1YWwiJmd0OzAmbHQ7L3VuaXg6dXNlcl9pZCZndDsKKyAgJmx0Oy91bml4OmZpbGVf c3RhdGUmZ3Q7CismbHQ7L2RlZi1ncm91cCZndDsKPC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+CiAg ICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============3311863769580830051==-- From coopercd at ornl.gov Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============6777788168753011246==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Fixed typos in RHEL6/input/checks/file_ownership_binary_dirs.xml Date: Tue, 01 Oct 2013 13:09:13 -0400 Message-ID: <1380647354-17803-1-git-send-email-coopercd@ornl.gov> --===============6777788168753011246== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable *** BLURB HERE *** Caleb Cooper (1): Fixed two typos in RHEL6/input/checks/file_ownership_binary_dirs.xml. The first was inside a comment and said the check was for /lib when really it was for /bin. The second was a criterion which had an extra letter so it ended up not performing one of the checks and missed files which were owned by a user other than root. RHEL6/input/checks/file_ownership_binary_dirs.xml | 162 +++++++++++++++++= ++++ 1 files changed, 162 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml --===============6777788168753011246==-- From coopercd at ornl.gov Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============9158980640880241986==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Fixed two typos in RHEL6/input/checks/file_ownership_binary_dirs.xml. The first was inside a comment and said the check was for /lib when really it was for /bin. The second was a criterion which had an extra letter so it ended up not performing one of the checks and missed files which were owned by a user other than root. Date: Tue, 01 Oct 2013 13:09:14 -0400 Message-ID: <1380647354-17803-2-git-send-email-coopercd@ornl.gov> In-Reply-To: 1380647354-17803-1-git-send-email-coopercd@ornl.gov --===============9158980640880241986== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Signed-off-by: Caleb Cooper --- RHEL6/input/checks/file_ownership_binary_dirs.xml | 162 +++++++++++++++++= ++++ 1 files changed, 162 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/inpu= t/checks/file_ownership_binary_dirs.xml new file mode 100644 index 0000000..602c720 --- /dev/null +++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml @@ -0,0 +1,162 @@ + + + + Verify that System Executables Have Root Ownership + + Red Hat Enterprise Linux 6 + + Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/loca= l/bin, /usr/local/sbin and objects therein, are owned by root + + + + + + + + + + + + + + + + + + + + + + + + + + + + /bin + + state_owner_not_root + + + + + /bin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /sbin + + state_owner_not_root + + + + + /sbin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /usr/bin + + state_owner_not_root + + + + + /usr/bin + ^.*$ + state_owner_not_root + = + + + + + + + + + + + + /usr/sbin + + state_owner_not_root + + + + + /usr/sbin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /usr/local/bin + + state_owner_not_root + + + + + /usr/local/bin + ^.*$ + state_owner_not_root + + = + + + + + + + + + + + /usr/local/sbin + + state_owner_not_root + + + + + /usr/local/sbin + ^.*$ + state_owner_not_root + + + + + 0 + + -- = 1.7.1 --===============9158980640880241986==-- From coopercd at ornl.gov Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============8241939758435290387==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: RE: [PATCH] Added OVAL content for the file_ownership_binary_dirs rule as the file file_ownership_binary_dirs.xml and added the oval id to the corresponding XCCDF content in files.xml Date: Tue, 01 Oct 2013 13:19:10 -0400 Message-ID: In-Reply-To: 524AE923.5010309@redhat.com --===============8241939758435290387== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable It looks like I made a typo in one of the criteria that caused this issue. = I fixed that and resubmitted. From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-sec= urity-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: Tuesday, October 01, 2013 11:24 AM To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: [PATCH] Added OVAL content for the file_ownership_binary_dirs = rule as the file file_ownership_binary_dirs.xml and added the oval id to th= e corresponding XCCDF content in files.xml You're encountering the same issue I did... perhaps I'm the LCD here... ;) Check out results for /usr/local/bin below. I ran the following to ensure e= verything is root before testing: [shawn(a)SSG-RHEL6 checks]$ sudo bash [root(a)SSG-RHEL6 checks]# DIRS=3D"/bin /usr/bin /usr/local/bin /sbin /usr/= sbin /usr/local/sbin" [root(a)SSG-RHEL6 checks]# for dirPath in $DIRS; do > find $dirPath \! -user root -exec chown root '{}' \; > done [root(a)SSG-RHEL6 checks]# exit exit [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsU1mqUp.xml Writing results to : /tmp/file_ownership_binary_dirsU1mqUp.xml-results Definition oval:scap-security-guide.testing:def:261: true Evaluation done. On 10/1/13 10:06 AM, Caleb Cooper wrote: Signed-off-by: Caleb Cooper --- RHEL6/input/checks/file_ownership_binary_dirs.xml | 163 +++++++++++++++++= ++++ 1 files changed, 163 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/inpu= t/checks/file_ownership_binary_dirs.xml new file mode 100644 index 0000000..b787191 --- /dev/null +++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml @@ -0,0 +1,163 @@ + + + + Verify that System Executables Have Root Ownership + + Red Hat Enterprise Linux 6 + + Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/loca= l/bin, /usr/local/sbin and objects therein, are owned by root + + + + + + + + + + + + + + + + + + + + + + + + + + + Minor note: lib/bin in comment + + /bin + + state_owner_not_root + + + + + /bin + ^.*$ + state_owner_not_root + + .... testing for non-root under /bin...... [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /bin/awk [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirs6eQhsR.xml Writing results to : /tmp/file_ownership_binary_dirs6eQhsR.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. + + + + + + + + + + + /sbin + + state_owner_not_root + + + + + /sbin + ^.*$ + state_owner_not_root + ..... testing for non-root under /sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo rm /usr/local/bin/filetest [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /sbin/addpart [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsu4wrQh.xml Writing results to : /tmp/file_ownership_binary_dirsu4wrQh.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. + + + + + + + + + + + + /usr/bin + + state_owner_not_root + + + + + /usr/bin + ^.*$ + state_owner_not_root + ..... testing for non-root under /usr/bin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /bin/awk [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/bin/a2p [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirs2wHH6V.xml Writing results to : /tmp/file_ownership_binary_dirs2wHH6V.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. + + + + + + + + + + + + /usr/sbin + + state_owner_not_root + + + + + /usr/sbin + ^.*$ + state_owner_not_root + ..... testing for non-root under /usr/sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /sbin/addpart [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/sbin/accept [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsddwRzZ.xml Writing results to : /tmp/file_ownership_binary_dirsddwRzZ.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. + + + + + + + + + + + + /usr/local/bin + + state_owner_not_root + ..... testing for non-root under /usr/local/bin ..... [shawn(a)SSG-RHEL6 checks]$ sudo touch /usr/local/bin/filetest ; sudo chown= shawn:shawn /usr/local/bin/filetest [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /usr/bin/a2p [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsno1sSt.xml Writing results to : /tmp/file_ownership_binary_dirsno1sSt.xml-results Definition oval:scap-security-guide.testing:def:261: true Evaluation done. [shawn(a)SSG-RHEL6 checks]$ ll /usr/local/bin/filetest -rw-r--r--. 1 shawn shawn 0 Oct 1 00:09 /usr/local/bin/filetest + + + + /usr/local/bin + ^.*$ + state_owner_not_root + + + + + + + + + + + + + /usr/local/sbin + + state_owner_not_root + + + + + /usr/local/sbin + ^.*$ + state_owner_not_root + ..... testing for non-root under /usr/local/sbin ..... [shawn(a)SSG-RHEL6 checks]$ sudo chown root:root /usr/sbin/accept [shawn(a)SSG-RHEL6 checks]$ sudo touch /usr/local/sbin/test ; sudo chown sh= awn:shawn /usr/local/sbin/test [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirszY6fXL.xml Writing results to : /tmp/file_ownership_binary_dirszY6fXL.xml-results Definition oval:scap-security-guide.testing:def:261: false Evaluation done. + + + + 0 + + --===============8241939758435290387== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250ZW50 PSJNaWNyb3NvZnQgV29yZCAxNCAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0NCi8qIEZv bnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglw YW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsInNlcmlmIjsNCglj b2xvcjpibGFjazt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwcmUNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRl ZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6YmxhY2s7fQ0K c3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3Jt YXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJI VE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6IkNvbnNvbGFzIiwic2VyaWYiOw0KCWNv bG9yOmJsYWNrO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFG NDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBp bjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1s PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpl eHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVs YXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+PC9oZWFkPjxib2R5IGJnY29sb3I9d2hpdGUgbGFuZz1F Ti1VUyBsaW5rPWJsdWUgdmxpbms9cHVycGxlPjxkaXYgY2xhc3M9V29yZFNlY3Rpb24xPjxwIGNs YXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToi Q2FsaWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPkl0IGxvb2tzIGxpa2UgSSBtYWRl IGEgdHlwbyBpbiBvbmUgb2YgdGhlIGNyaXRlcmlhIHRoYXQgY2F1c2VkIHRoaXMgaXNzdWUuIEkg Zml4ZWQgdGhhdCBhbmQgcmVzdWJtaXR0ZWQuPG86cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNz PU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2Fs aWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjtjb2xvcjojMUY0OTdEJz48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+PGRpdj48ZGl2IHN0eWxlPSdib3JkZXI6bm9uZTtib3JkZXItdG9w OnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbic+PHAgY2xhc3M9 TXNvTm9ybWFsPjxiPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiJU YWhvbWEiLCJzYW5zLXNlcmlmIjtjb2xvcjp3aW5kb3d0ZXh0Jz5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2Vy aWYiO2NvbG9yOndpbmRvd3RleHQnPiBzY2FwLXNlY3VyaXR5LWd1aWRlLWJvdW5jZXNAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZyBbbWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGUtYm91bmNlc0BsaXN0 cy5mZWRvcmFob3N0ZWQub3JnXSA8Yj5PbiBCZWhhbGYgT2YgPC9iPlNoYXduIFdlbGxzPGJyPjxi PlNlbnQ6PC9iPiBUdWVzZGF5LCBPY3RvYmVyIDAxLCAyMDEzIDExOjI0IEFNPGJyPjxiPlRvOjwv Yj4gc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPGJyPjxiPlN1Ympl Y3Q6PC9iPiBSZTogW1BBVENIXSBBZGRlZCBPVkFMIGNvbnRlbnQgZm9yIHRoZSBmaWxlX293bmVy c2hpcF9iaW5hcnlfZGlycyBydWxlIGFzIHRoZSBmaWxlIGZpbGVfb3duZXJzaGlwX2JpbmFyeV9k aXJzLnhtbCBhbmQgYWRkZWQgdGhlIG92YWwgaWQgdG8gdGhlIGNvcnJlc3BvbmRpbmcgWENDREYg Y29udGVudCBpbiBmaWxlcy54bWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PHAg Y2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxkaXY+PHAgY2xhc3M9TXNvTm9y bWFsPjxicj5Zb3UncmUgZW5jb3VudGVyaW5nIHRoZSBzYW1lIGlzc3VlIEkgZGlkLi4uIHBlcmhh cHMgSSdtIHRoZSBMQ0QgaGVyZS4uLiA7KTxicj48YnI+Q2hlY2sgb3V0IHJlc3VsdHMgZm9yIC91 c3IvbG9jYWwvYmluIGJlbG93LiBJIHJhbiB0aGUgZm9sbG93aW5nIHRvIGVuc3VyZSBldmVyeXRo aW5nIGlzIHJvb3QgYmVmb3JlIHRlc3Rpbmc6PGJyPjxicj48bzpwPjwvbzpwPjwvcD48cCBjbGFz cz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206MTIuMHB0Jz5bc2hhd25AU1NHLVJIRUw2 IGNoZWNrc10kIHN1ZG8gYmFzaDxicj5bcm9vdEBTU0ctUkhFTDYgY2hlY2tzXSMgRElSUz0mcXVv dDsvYmluIC91c3IvYmluIC91c3IvbG9jYWwvYmluIC9zYmluIC91c3Ivc2JpbiAvdXNyL2xvY2Fs L3NiaW4mcXVvdDs8YnI+W3Jvb3RAU1NHLVJIRUw2IGNoZWNrc10jIGZvciBkaXJQYXRoIGluICRE SVJTOyBkbzxicj4mZ3Q7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IGZpbmQgJGRpclBhdGggXCEgLXVzZXIgcm9vdCAtZXhlYyBjaG93 biByb290ICd7fScgXDs8YnI+Jmd0OyZuYnNwOyZuYnNwOyBkb25lPGJyPltyb290QFNTRy1SSEVM NiBjaGVja3NdIyBleGl0PGJyPmV4aXQ8YnI+W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rl c3RjaGVjay5weSBmaWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwgPGJyPkV2YWx1YXRpbmcg d2l0aCBPVkFMIHRlbXBmaWxlIDogL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyc1UxbXFV cC54bWw8YnI+V3JpdGluZyByZXN1bHRzIHRvIDogL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlf ZGlyc1UxbXFVcC54bWwtcmVzdWx0czxicj5EZWZpbml0aW9uIG92YWw6c2NhcC1zZWN1cml0eS1n dWlkZS50ZXN0aW5nOmRlZjoyNjE6IHRydWU8YnI+RXZhbHVhdGlvbiBkb25lLjxvOnA+PC9vOnA+ PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48YnI+PGJyPjxicj48YnI+T24gMTAvMS8xMyAxMDowNiBB TSwgQ2FsZWIgQ29vcGVyIHdyb3RlOjxvOnA+PC9vOnA+PC9wPjwvZGl2PjxibG9ja3F1b3RlIHN0 eWxlPSdtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQnPjxwcmU+PG86cD4mbmJz cDs8L286cD48L3ByZT48cHJlPlNpZ25lZC1vZmYtYnk6IENhbGViIENvb3BlciA8YSBocmVmPSJt YWlsdG86Y29vcGVyY2RAb3JubC5nb3YiPiZsdDtjb29wZXJjZEBvcm5sLmdvdiZndDs8L2E+PG86 cD48L286cD48L3ByZT48cHJlPi0tLTxvOnA+PC9vOnA+PC9wcmU+PHByZT4gUkhFTDYvaW5wdXQv Y2hlY2tzL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzLnhtbCB8wqAgMTYzICsrKysrKysrKysr KysrKysrKysrKzxvOnA+PC9vOnA+PC9wcmU+PHByZT4gMSBmaWxlcyBjaGFuZ2VkLCAxNjMgaW5z ZXJ0aW9ucygrKSwgMCBkZWxldGlvbnMoLSk8bzpwPjwvbzpwPjwvcHJlPjxwcmU+IGNyZWF0ZSBt b2RlIDEwMDY0NCBSSEVMNi9pbnB1dC9jaGVja3MvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnMu eG1sPG86cD48L286cD48L3ByZT48cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+PHByZT5kaWZm IC0tZ2l0IGEvUkhFTDYvaW5wdXQvY2hlY2tzL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzLnht bCBiL1JIRUw2L2lucHV0L2NoZWNrcy9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWw8bzpw PjwvbzpwPjwvcHJlPjxwcmU+bmV3IGZpbGUgbW9kZSAxMDA2NDQ8bzpwPjwvbzpwPjwvcHJlPjxw cmU+aW5kZXggMDAwMDAwMC4uYjc4NzE5MTxvOnA+PC9vOnA+PC9wcmU+PHByZT4tLS0gL2Rldi9u dWxsPG86cD48L286cD48L3ByZT48cHJlPisrKyBiL1JIRUw2L2lucHV0L2NoZWNrcy9maWxlX293 bmVyc2hpcF9iaW5hcnlfZGlycy54bWw8bzpwPjwvbzpwPjwvcHJlPjxwcmU+QEAgLTAsMCArMSwx NjMgQEA8bzpwPjwvbzpwPjwvcHJlPjxwcmU+KyZsdDtkZWYtZ3JvdXAmZ3Q7PG86cD48L286cD48 L3ByZT48cHJlPivCoCAmbHQ7ZGVmaW5pdGlvbiBjbGFzcz0mcXVvdDtjb21wbGlhbmNlJnF1b3Q7 IGlkPSZxdW90O2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzJnF1b3Q7IHZlcnNpb249JnF1b3Q7 MSZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7bWV0YWRhdGEmZ3Q7 PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDt0aXRsZSZndDtWZXJpZnkgdGhh dCBTeXN0ZW0gRXhlY3V0YWJsZXMgSGF2ZSBSb290IE93bmVyc2hpcCZsdDsvdGl0bGUmZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDthZmZlY3RlZCBmYW1pbHk9JnF1b3Q7 dW5peCZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoMKgwqDCoMKgICZsdDtw bGF0Zm9ybSZndDtSZWQgSGF0IEVudGVycHJpc2UgTGludXggNiZsdDsvcGxhdGZvcm0mZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPivCoCDCoMKgwqDCoCZsdDsvYWZmZWN0ZWQmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDtkZXNjcmlwdGlvbiZndDtDaGVja3MgdGhhdCAv YmluLCAvc2JpbiwgL3Vzci9iaW4sIC91c3Ivc2JpbiwgL3Vzci9sb2NhbC9iaW4sIC91c3IvbG9j YWwvc2JpbiBhbmQgb2JqZWN0cyB0aGVyZWluLCBhcmUgb3duZWQgYnkgcm9vdCZsdDsvZGVzY3Jp cHRpb24mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDtyZWZlcmVuY2Ug c291cmNlPSZxdW90O3N3ZWxscyZxdW90OyByZWZfaWQ9JnF1b3Q7MjAxMzA5MTQmcXVvdDsgcmVm X3VybD0mcXVvdDt0ZXN0X2F0dGVzdGF0aW9uJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48 cHJlPivCoMKgwqAgJmx0Oy9tZXRhZGF0YSZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDC oCAmbHQ7Y3JpdGVyaWEgb3BlcmF0b3I9JnF1b3Q7QU5EJnF1b3Q7Jmd0OzxvOnA+PC9vOnA+PC9w cmU+PHByZT4rwqDCoMKgwqDCoCAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSZxdW90O3Rlc3Rfb3du ZXJzaGlwX2Jpbl9kaXImcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoMKg wqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X293bmVyc2hpcF9zYmluX2RpciZx dW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgwqDCoCAmbHQ7Y3JpdGVyaW9u IHRlc3RfcmVmPSZxdW90O3Rlc3Rfb3duZXJzaGlwX3Vzcl9iaW5fZGlyJnF1b3Q7IC8mZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1 b3Q7dGVzdF9vd25lcnNoaXBfdXNyX3NiaW5fZGlyJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3By ZT48cHJlPivCoMKgwqDCoMKgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1b3Q7dGVzdF9vd25l cnNoaXBfdXNyX2xvY2FsX2Jpbl9kaXImcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+ K8KgwqDCoMKgwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X293bmVyc2hpcF91 c3JfbG9jYWxfYmluX2RpciZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKg wqDCoCAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSZxdW90O3Rlc3Rfb3duZXJzaGlwX2Jpbl9maWxl cyZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgwqDCoCAmbHQ7Y3JpdGVy aW9uIHRlc3RfcmVmPSZxdW90O3Rlc3Rfb3duZXJzaGlwX3NiaW5fZmlsZXMmcXVvdDsgLyZndDs8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoMKgwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0m cXVvdDt0ZXN0X293bmVyc2hpcF91c3JfYmluX2ZpbGVzJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48 L3ByZT48cHJlPivCoMKgwqDCoMKgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1b3Q7dGVzdF9v d25lcnNoaXBfdXNyX3NiaW5fZmlsZXMmcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+ K8KgwqDCoMKgwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X293bmVyc2hpcF91 c3JfbG9jYWxfc2Jpbl9maWxlcyZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDC oMKgwqDCoCAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSZxdW90O3Rlc3Rfb3duZXJzaGlwX3Vzcl9s b2NhbF9zYmluX2ZpbGVzJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAg Jmx0Oy9jcml0ZXJpYSZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDsvZGVmaW5pdGlv biZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0 O3VuaXg6ZmlsZV90ZXN0wqAgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0m cXVvdDtub25lX2V4aXN0JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7L2JpbiBkaXJlY3RvcmllcyB1aWQg cm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293bmVyc2hpcF9iaW5fZGlyJnF1b3Q7IHZlcnNpb249 JnF1b3Q7MSZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpv YmplY3Qgb2JqZWN0X3JlZj0mcXVvdDtmaWxlX293bmVyc2hpcF9vYmplY3RfYmluX2RpciZxdW90 OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDs8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0O3VuaXg6 ZmlsZV90ZXN0wqAgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDtu b25lX2V4aXN0JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7L2JpbiBmaWxlcyB1aWQgcm9vdCZxdW90OyBp ZD0mcXVvdDt0ZXN0X293bmVyc2hpcF9iaW5fZmlsZXMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1 b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4Om9iamVjdCBvYmpl Y3RfcmVmPSZxdW90O29iamVjdF9maWxlX293bmVyc2hpcF9iaW5fZmlsZXMmcXVvdDsgLyZndDs8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfb2Jq ZWN0IGNvbW1lbnQ9JnF1b3Q7L2xpYiBkaXJlY3RvcmllcyZxdW90OyBpZD0mcXVvdDtmaWxlX293 bmVyc2hpcF9vYmplY3RfYmluX2RpciZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86 cD48L286cD48L3ByZT48L2Jsb2NrcXVvdGU+PHAgY2xhc3M9TXNvTm9ybWFsPjxicj5NaW5vciBu b3RlOiBsaWIvYmluIGluIGNvbW1lbnQ8YnI+PGJyPjxicj48YnI+PG86cD48L286cD48L3A+PHBy ZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpiZWhhdmlvcnMg cmVjdXJzZT0mcXVvdDtkaXJlY3RvcmllcyZxdW90OyByZWN1cnNlX2RpcmVjdGlvbj0mcXVvdDtk b3duJnF1b3Q7IG1heF9kZXB0aD0mcXVvdDstMSZxdW90OyByZWN1cnNlX2ZpbGVfc3lzdGVtPSZx dW90O2FsbCZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4 OnBhdGggb3BlcmF0aW9uPSZxdW90O2VxdWFscyZxdW90OyZndDsvYmluJmx0Oy91bml4OnBhdGgm Z3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6ZmlsZW5hbWUgeHNpOm5p bD0mcXVvdDt0cnVlJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0 O2ZpbHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9vd25lcl9ub3Rfcm9v dCZsdDsvZmlsdGVyJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVf b2JqZWN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rPG86cD48L286cD48L3ByZT48cHJlPivC oCAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSZxdW90Oy9iaW4gZmlsZXMmcXVvdDsgaWQ9 JnF1b3Q7b2JqZWN0X2ZpbGVfb3duZXJzaGlwX2Jpbl9maWxlcyZxdW90OyB2ZXJzaW9uPSZxdW90 OzEmcXVvdDsmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6YmVoYXZp b3JzIHJlY3Vyc2U9JnF1b3Q7ZGlyZWN0b3JpZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1 b3Q7ZG93biZxdW90OyBtYXhfZGVwdGg9JnF1b3Q7LTEmcXVvdDsgcmVjdXJzZV9maWxlX3N5c3Rl bT0mcXVvdDthbGwmcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7 dW5peDpwYXRoIG9wZXJhdGlvbj0mcXVvdDtlcXVhbHMmcXVvdDsmZ3Q7L2JpbiZsdDsvdW5peDpw YXRoJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OmZpbGVuYW1lIG9w ZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14uKiQmbHQ7L3VuaXg6ZmlsZW5h bWUmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90 O2luY2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDs8bzpw PjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8bzpwPjwvbzpw PjwvcHJlPjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHAgY2xhc3M9TXNvTm9ybWFsPjxicj48YnI+ PGJyPi4uLi4gdGVzdGluZyBmb3Igbm9uLXJvb3QgdW5kZXIgL2Jpbi4uLi4uLjxicj5bc2hhd25A U1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gY2hvd24gc2hhd246c2hhd24gL2Jpbi9hd2sgPGJyPltz aGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgLi90ZXN0Y2hlY2sucHkgZmlsZV9vd25lcnNoaXBfYmlu YXJ5X2RpcnMueG1sIDxicj5FdmFsdWF0aW5nIHdpdGggT1ZBTCB0ZW1wZmlsZSA6IC90bXAvZmls ZV9vd25lcnNoaXBfYmluYXJ5X2RpcnM2ZVFoc1IueG1sPGJyPldyaXRpbmcgcmVzdWx0cyB0byA6 IC90bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnM2ZVFoc1IueG1sLXJlc3VsdHM8YnI+RGVm aW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MjYxOiBmYWxzZTxi cj5FdmFsdWF0aW9uIGRvbmUuPGJyPjxicj48YnI+PGJyPjxicj48YnI+PG86cD48L286cD48L3A+ PHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfdGVzdMKg IGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlzdGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZx dW90OyBjb21tZW50PSZxdW90Oy9zYmluIGRpcmVjdG9yaWVzIHVpZCByb290JnF1b3Q7IGlkPSZx dW90O3Rlc3Rfb3duZXJzaGlwX3NiaW5fZGlyJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZn dDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0X3Jl Zj0mcXVvdDtvYmplY3RfZmlsZV9vd25lcnNoaXBfc2Jpbl9kaXImcXVvdDsgLyZndDs8bzpwPjwv bzpwPjwvcHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7PG86cD48L286cD48L3By ZT48cHJlPis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfdGVzdMKgIGNo ZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlzdGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90 OyBjb21tZW50PSZxdW90Oy9zYmluIGZpbGVzIHVpZCByb290JnF1b3Q7IGlkPSZxdW90O3Rlc3Rf b3duZXJzaGlwX3NiaW5fZmlsZXMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzxvOnA+ PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZxdW90 O29iamVjdF9maWxlX293bmVyc2hpcF9zYmluX2ZpbGVzJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48 L3ByZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHBy ZT4rPG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50 PSZxdW90Oy9zYmluIGRpcmVjdG9yaWVzJnF1b3Q7IGlkPSZxdW90O29iamVjdF9maWxlX293bmVy c2hpcF9zYmluX2RpciZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286cD48 L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9JnF1b3Q7ZGlyZWN0 b3JpZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1b3Q7ZG93biZxdW90OyBtYXhfZGVwdGg9 JnF1b3Q7LTEmcXVvdDsgcmVjdXJzZV9maWxlX3N5c3RlbT0mcXVvdDthbGwmcXVvdDsgLyZndDs8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpwYXRoIG9wZXJhdGlvbj0mcXVv dDtlcXVhbHMmcXVvdDsmZ3Q7L3NiaW4mbHQ7L3VuaXg6cGF0aCZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpmaWxlbmFtZSB4c2k6bmlsPSZxdW90O3RydWUmcXVvdDsg LyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVv dDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfb2Jq ZWN0IGNvbW1lbnQ9JnF1b3Q7L3NiaW4gZmlsZXMmcXVvdDsgaWQ9JnF1b3Q7b2JqZWN0X2ZpbGVf b3duZXJzaGlwX3NiaW5fZmlsZXMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzxvOnA+ PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSZxdW90 O2RpcmVjdG9yaWVzJnF1b3Q7IHJlY3Vyc2VfZGlyZWN0aW9uPSZxdW90O2Rvd24mcXVvdDsgbWF4 X2RlcHRoPSZxdW90Oy0xJnF1b3Q7IHJlY3Vyc2VfZmlsZV9zeXN0ZW09JnF1b3Q7YWxsJnF1b3Q7 IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6cGF0aCBvcGVyYXRp b249JnF1b3Q7ZXF1YWxzJnF1b3Q7Jmd0Oy9zYmluJmx0Oy91bml4OnBhdGgmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6ZmlsZW5hbWUgb3BlcmF0aW9uPSZxdW90O3Bh dHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7Xi4qJCZsdDsvdW5peDpmaWxlbmFtZSZndDs8bzpwPjwvbzpw PjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7 Jmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7PG86cD48L286cD48L3ByZT48 cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PG86cD48L286cD48L3ByZT48cCBjbGFz cz1Nc29Ob3JtYWw+PGJyPjxicj4uLi4uLiB0ZXN0aW5nIGZvciBub24tcm9vdCB1bmRlciAvc2Jp biAuLi4uLjxicj5bc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gcm0gL3Vzci9sb2NhbC9i aW4vZmlsZXRlc3QgPGJyPltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBjaG93biBzaGF3 bjpzaGF3biAvc2Jpbi9hZGRwYXJ0IDxicj5bc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIC4vdGVz dGNoZWNrLnB5IGZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzLnhtbCA8YnI+RXZhbHVhdGluZyB3 aXRoIE9WQUwgdGVtcGZpbGUgOiAvdG1wL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9kaXJzdTR3clFo LnhtbDxicj5Xcml0aW5nIHJlc3VsdHMgdG8gOiAvdG1wL2ZpbGVfb3duZXJzaGlwX2JpbmFyeV9k aXJzdTR3clFoLnhtbC1yZXN1bHRzPGJyPkRlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1 aWRlLnRlc3Rpbmc6ZGVmOjI2MTogZmFsc2U8YnI+RXZhbHVhdGlvbiBkb25lLjxicj48YnI+PGJy Pjxicj48bzpwPjwvbzpwPjwvcD48cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+PHByZT4rPG86 cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7dW5peDpmaWxlX3Rlc3TCoCBjaGVjaz0mcXVvdDth bGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgY29tbWVudD0m cXVvdDsvdXNyL2JpbiBkaXJlY3RvcmllcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293 bmVyc2hpcF91c3JfYmluX2RpciZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48 L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7 b2JqZWN0X2ZpbGVfb3duZXJzaGlwX3Vzcl9iaW5fZGlyJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48 L3ByZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHBy ZT4rPG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7dW5peDpmaWxlX3Rlc3TCoCBjaGVjaz0m cXVvdDthbGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgY29t bWVudD0mcXVvdDsvdXNyL2JpbiBmaWxlcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293 bmVyc2hpcF91c3JfYmluX2ZpbGVzJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8bzpw PjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVv dDtvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNyX2Jpbl9maWxlcyZxdW90OyAvJmd0OzxvOnA+PC9v OnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29t bWVudD0mcXVvdDsvdXNyL2JpbiBkaXJlY3RvcmllcyZxdW90OyBpZD0mcXVvdDtvYmplY3RfZmls ZV9vd25lcnNoaXBfdXNyX2Jpbl9kaXImcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxv OnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSZx dW90O2RpcmVjdG9yaWVzJnF1b3Q7IHJlY3Vyc2VfZGlyZWN0aW9uPSZxdW90O2Rvd24mcXVvdDsg bWF4X2RlcHRoPSZxdW90Oy0xJnF1b3Q7IHJlY3Vyc2VfZmlsZV9zeXN0ZW09JnF1b3Q7YWxsJnF1 b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6cGF0aCBvcGVy YXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7Jmd0Oy91c3IvYmluJmx0Oy91bml4OnBhdGgmZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6ZmlsZW5hbWUgeHNpOm5pbD0mcXVv dDt0cnVlJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqDCoMKgwqAgJmx0 O2ZpbHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9vd25lcl9ub3Rfcm9v dCZsdDsvZmlsdGVyJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVf b2JqZWN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rPG86cD48L286cD48L3ByZT48cHJlPivC oCAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSZxdW90Oy91c3IvYmluIGZpbGVzJnF1b3Q7 IGlkPSZxdW90O29iamVjdF9maWxlX293bmVyc2hpcF91c3JfYmluX2ZpbGVzJnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5p eDpiZWhhdmlvcnMgcmVjdXJzZT0mcXVvdDtkaXJlY3RvcmllcyZxdW90OyByZWN1cnNlX2RpcmVj dGlvbj0mcXVvdDtkb3duJnF1b3Q7IG1heF9kZXB0aD0mcXVvdDstMSZxdW90OyByZWN1cnNlX2Zp bGVfc3lzdGVtPSZxdW90O2FsbCZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDC oMKgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSZxdW90O2VxdWFscyZxdW90OyZndDsvdXNyL2Jp biZsdDsvdW5peDpwYXRoJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4 OmZpbGVuYW1lIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14uKiQmbHQ7 L3VuaXg6ZmlsZW5hbWUmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O2ZpbHRl ciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9vd25lcl9ub3Rfcm9vdCZsdDsv ZmlsdGVyJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVfb2JqZWN0 Jmd0O8KgIDxvOnA+PC9vOnA+PC9wcmU+PHAgY2xhc3M9TXNvTm9ybWFsPjxicj48YnI+Li4uLi4g dGVzdGluZyBmb3Igbm9uLXJvb3QgdW5kZXIgL3Vzci9iaW4gLi4uLi48YnI+W3NoYXduQFNTRy1S SEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHJvb3Q6cm9vdCAvYmluL2F3ayA8YnI+W3NoYXduQFNT Ry1SSEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHNoYXduOnNoYXduIC91c3IvYmluL2EycCA8YnI+ W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rlc3RjaGVjay5weSBmaWxlX293bmVyc2hpcF9i aW5hcnlfZGlycy54bWwgPGJyPkV2YWx1YXRpbmcgd2l0aCBPVkFMIHRlbXBmaWxlIDogL3RtcC9m aWxlX293bmVyc2hpcF9iaW5hcnlfZGlyczJ3SEg2Vi54bWw8YnI+V3JpdGluZyByZXN1bHRzIHRv IDogL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyczJ3SEg2Vi54bWwtcmVzdWx0czxicj5E ZWZpbml0aW9uIG92YWw6c2NhcC1zZWN1cml0eS1ndWlkZS50ZXN0aW5nOmRlZjoyNjE6IGZhbHNl PGJyPkV2YWx1YXRpb24gZG9uZS48YnI+PGJyPjxicj48YnI+PGJyPjxvOnA+PC9vOnA+PC9wPjxw cmU+PG86cD4mbmJzcDs8L286cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8Kg ICZsdDt1bml4OmZpbGVfdGVzdMKgIGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlzdGVu Y2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90OyBjb21tZW50PSZxdW90Oy91c3Ivc2JpbiBkaXJlY3Rv cmllcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293bmVyc2hpcF91c3Jfc2Jpbl9kaXIm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDC oMKgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZxdW90O29iamVjdF9maWxlX293bmVyc2hp cF91c3Jfc2Jpbl9kaXImcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDsv dW5peDpmaWxlX3Rlc3QmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgICZsdDt1bml4OmZpbGVfdGVzdMKgIGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVj a19leGlzdGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90OyBjb21tZW50PSZxdW90Oy91c3Ivc2Jp biBmaWxlcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293bmVyc2hpcF91c3Jfc2Jpbl9m aWxlcyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286cD48L3ByZT48cHJl PivCoMKgwqAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2ZpbGVfb3du ZXJzaGlwX3Vzcl9zYmluX2ZpbGVzJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivC oCAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rPG86cD48L286 cD48L3ByZT48cHJlPivCoCAmbHQ7dW5peDpmaWxlX29iamVjdCBjb21tZW50PSZxdW90Oy91c3Iv c2JpbiBkaXJlY3RvcmllcyZxdW90OyBpZD0mcXVvdDtvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNy X3NiaW5fZGlyJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpiZWhhdmlvcnMgcmVjdXJzZT0mcXVvdDtkaXJlY3Rvcmll cyZxdW90OyByZWN1cnNlX2RpcmVjdGlvbj0mcXVvdDtkb3duJnF1b3Q7IG1heF9kZXB0aD0mcXVv dDstMSZxdW90OyByZWN1cnNlX2ZpbGVfc3lzdGVtPSZxdW90O2FsbCZxdW90OyAvJmd0OzxvOnA+ PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSZxdW90O2Vx dWFscyZxdW90OyZndDsvdXNyL3NiaW4mbHQ7L3VuaXg6cGF0aCZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpmaWxlbmFtZSB4c2k6bmlsPSZxdW90O3RydWUmcXVvdDsg LyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoMKgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlv bj0mcXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXIm Z3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PG86 cD48L286cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZp bGVfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L3Vzci9zYmluIGZpbGVzJnF1b3Q7IGlkPSZxdW90O29i amVjdF9maWxlX293bmVyc2hpcF91c3Jfc2Jpbl9maWxlcyZxdW90OyB2ZXJzaW9uPSZxdW90OzEm cXVvdDsmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6YmVoYXZpb3Jz IHJlY3Vyc2U9JnF1b3Q7ZGlyZWN0b3JpZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1b3Q7 ZG93biZxdW90OyBtYXhfZGVwdGg9JnF1b3Q7LTEmcXVvdDsgcmVjdXJzZV9maWxlX3N5c3RlbT0m cXVvdDthbGwmcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5p eDpwYXRoIG9wZXJhdGlvbj0mcXVvdDtlcXVhbHMmcXVvdDsmZ3Q7L3Vzci9zYmluJmx0Oy91bml4 OnBhdGgmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6ZmlsZW5hbWUg b3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7Xi4qJCZsdDsvdW5peDpmaWxl bmFtZSZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0m cXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7 PG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PG86cD48 L286cD48L3ByZT48cCBjbGFzcz1Nc29Ob3JtYWw+PGJyPjxicj48YnI+Li4uLi4gdGVzdGluZyBm b3Igbm9uLXJvb3QgdW5kZXIgL3Vzci9zYmluIC4uLi4uPGJyPltzaGF3bkBTU0ctUkhFTDYgY2hl Y2tzXSQgc3VkbyBjaG93biByb290OnJvb3QgL3NiaW4vYWRkcGFydCA8YnI+W3NoYXduQFNTRy1S SEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHNoYXduOnNoYXduIC91c3Ivc2Jpbi9hY2NlcHQgPGJy PltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgLi90ZXN0Y2hlY2sucHkgZmlsZV9vd25lcnNoaXBf YmluYXJ5X2RpcnMueG1sIDxicj5FdmFsdWF0aW5nIHdpdGggT1ZBTCB0ZW1wZmlsZSA6IC90bXAv ZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnNkZHdSeloueG1sPGJyPldyaXRpbmcgcmVzdWx0cyB0 byA6IC90bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnNkZHdSeloueG1sLXJlc3VsdHM8YnI+ RGVmaW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MjYxOiBmYWxz ZTxicj5FdmFsdWF0aW9uIGRvbmUuPGJyPjxicj48YnI+PGJyPjxicj48bzpwPjwvbzpwPjwvcD48 cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+PHByZT4rPG86cD48L286cD48L3ByZT48cHJlPivC oCAmbHQ7dW5peDpmaWxlX3Rlc3TCoCBjaGVjaz0mcXVvdDthbGwmcXVvdDsgY2hlY2tfZXhpc3Rl bmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgY29tbWVudD0mcXVvdDsvdXNyL2xvY2FsL2JpbiBk aXJlY3RvcmllcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0X293bmVyc2hpcF91c3JfbG9j YWxfYmluX2RpciZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286cD48L3By ZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2Zp bGVfb3duZXJzaGlwX3Vzcl9sb2NhbF9iaW5fZGlyJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3By ZT48cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4r PG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7dW5peDpmaWxlX3Rlc3TCoCBjaGVjaz0mcXVv dDthbGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgY29tbWVu dD0mcXVvdDsvdXNyL2xvY2FsL2JpbiBmaWxlcyB1aWQgcm9vdCZxdW90OyBpZD0mcXVvdDt0ZXN0 X293bmVyc2hpcF91c3JfbG9jYWxfYmluX2ZpbGVzJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90 OyZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0 X3JlZj0mcXVvdDtvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNyX2xvY2FsX2Jpbl9maWxlcyZxdW90 OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZpbGVfdGVzdCZndDs8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0O3VuaXg6 ZmlsZV9vYmplY3QgY29tbWVudD0mcXVvdDsvdXNyL2xvY2FsL2JpbiBkaXJlY3RvcmllcyZxdW90 OyBpZD0mcXVvdDtvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNyX2xvY2FsX2Jpbl9kaXImcXVvdDsg dmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZs dDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSZxdW90O2RpcmVjdG9yaWVzJnF1b3Q7IHJlY3Vyc2Vf ZGlyZWN0aW9uPSZxdW90O2Rvd24mcXVvdDsgbWF4X2RlcHRoPSZxdW90Oy0xJnF1b3Q7IHJlY3Vy c2VfZmlsZV9zeXN0ZW09JnF1b3Q7YWxsJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJl PivCoMKgwqAgJmx0O3VuaXg6cGF0aCBvcGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7Jmd0Oy91 c3IvbG9jYWwvYmluJmx0Oy91bml4OnBhdGgmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKg wqAgJmx0O3VuaXg6ZmlsZW5hbWUgeHNpOm5pbD0mcXVvdDt0cnVlJnF1b3Q7IC8mZ3Q7PG86cD48 L286cD48L3ByZT48cHJlPivCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVv dDsmZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8bzpwPjwvbzpwPjwvcHJlPjxwIGNs YXNzPU1zb05vcm1hbD48YnI+PHNwYW4gc3R5bGU9J2NvbG9yOnJlZCc+PGJyPi4uLi4uIHRlc3Rp bmcgZm9yIG5vbi1yb290IHVuZGVyIC91c3IvbG9jYWwvYmluIC4uLi4uPGJyPltzaGF3bkBTU0ct UkhFTDYgY2hlY2tzXSQgc3VkbyB0b3VjaCAvdXNyL2xvY2FsL2Jpbi9maWxldGVzdCA7IHN1ZG8g Y2hvd24gc2hhd246c2hhd24gL3Vzci9sb2NhbC9iaW4vZmlsZXRlc3Q8YnI+W3NoYXduQFNTRy1S SEVMNiBjaGVja3NdJCBzdWRvIGNob3duIHJvb3Q6cm9vdCAvdXNyL2Jpbi9hMnAgPGJyPltzaGF3 bkBTU0ctUkhFTDYgY2hlY2tzXSQgLi90ZXN0Y2hlY2sucHkgZmlsZV9vd25lcnNoaXBfYmluYXJ5 X2RpcnMueG1sIDxicj5FdmFsdWF0aW5nIHdpdGggT1ZBTCB0ZW1wZmlsZSA6IC90bXAvZmlsZV9v d25lcnNoaXBfYmluYXJ5X2RpcnNubzFzU3QueG1sPGJyPldyaXRpbmcgcmVzdWx0cyB0byA6IC90 bXAvZmlsZV9vd25lcnNoaXBfYmluYXJ5X2RpcnNubzFzU3QueG1sLXJlc3VsdHM8YnI+RGVmaW5p dGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MjYxOiB0cnVlPGJyPkV2 YWx1YXRpb24gZG9uZS48YnI+W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBsbCAvdXNyL2xvY2Fs L2Jpbi9maWxldGVzdCA8YnI+LXJ3LXItLXItLS4gMSBzaGF3biBzaGF3biAwIE9jdCZuYnNwOyAx IDAwOjA5IC91c3IvbG9jYWwvYmluL2ZpbGV0ZXN0PC9zcGFuPjxicj48YnI+PGJyPjxicj48YnI+ PG86cD48L286cD48L3A+PHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPjxwcmU+KzxvOnA+PC9v OnA+PC9wcmU+PHByZT4rwqAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0mcXVvdDsvdXNy L2xvY2FsL2JpbiBmaWxlcyZxdW90OyBpZD0mcXVvdDtvYmplY3RfZmlsZV9vd25lcnNoaXBfdXNy X2xvY2FsX2Jpbl9maWxlcyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPisgwqDCoMKgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9JnF1b3Q7ZGly ZWN0b3JpZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1b3Q7ZG93biZxdW90OyBtYXhfZGVw dGg9JnF1b3Q7LTEmcXVvdDsgcmVjdXJzZV9maWxlX3N5c3RlbT0mcXVvdDthbGwmcXVvdDsgLyZn dDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpwYXRoIG9wZXJhdGlvbj0m cXVvdDtlcXVhbHMmcXVvdDsmZ3Q7L3Vzci9sb2NhbC9iaW4mbHQ7L3VuaXg6cGF0aCZndDs8bzpw PjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpmaWxlbmFtZSBvcGVyYXRpb249JnF1 b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteLiokJmx0Oy91bml4OmZpbGVuYW1lJmd0OzxvOnA+ PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUm cXVvdDsmZ3Q7c3RhdGVfb3duZXJfbm90X3Jvb3QmbHQ7L2ZpbHRlciZndDs8bzpwPjwvbzpwPjwv cHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8bzpwPjwvbzpwPjwvcHJlPjxw cmU+K8KgIDxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0O3VuaXg6ZmlsZV90ZXN0wqAgY2hl Y2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDtub25lX2V4aXN0JnF1b3Q7 IGNvbW1lbnQ9JnF1b3Q7L3Vzci9sb2NhbC9zYmluIGRpcmVjdG9yaWVzIHVpZCByb290JnF1b3Q7 IGlkPSZxdW90O3Rlc3Rfb3duZXJzaGlwX3Vzcl9sb2NhbF9zYmluX2RpciZxdW90OyB2ZXJzaW9u PSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6 b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2ZpbGVfb3duZXJzaGlwX3Vzcl9sb2NhbF9z YmluX2RpciZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqAgJmx0Oy91bml4OmZp bGVfdGVzdCZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+KzxvOnA+PC9vOnA+PC9wcmU+PHByZT4r wqAgJmx0O3VuaXg6ZmlsZV90ZXN0wqAgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0 ZW5jZT0mcXVvdDtub25lX2V4aXN0JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7L3Vzci9sb2NhbC9zYmlu IGZpbGVzIHVpZCByb290JnF1b3Q7IGlkPSZxdW90O3Rlc3Rfb3duZXJzaGlwX3Vzcl9sb2NhbF9z YmluX2ZpbGVzJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfZmls ZV9vd25lcnNoaXBfdXNyX2xvY2FsX3NiaW5fZmlsZXMmcXVvdDsgLyZndDs8bzpwPjwvbzpwPjwv cHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7PG86cD48L286cD48L3ByZT48cHJl Pis8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9 JnF1b3Q7L3Vzci9sb2NhbC9zYmluIGRpcmVjdG9yaWVzJnF1b3Q7IGlkPSZxdW90O29iamVjdF9m aWxlX293bmVyc2hpcF91c3JfbG9jYWxfc2Jpbl9kaXImcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1 b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OmJlaGF2aW9ycyBy ZWN1cnNlPSZxdW90O2RpcmVjdG9yaWVzJnF1b3Q7IHJlY3Vyc2VfZGlyZWN0aW9uPSZxdW90O2Rv d24mcXVvdDsgbWF4X2RlcHRoPSZxdW90Oy0xJnF1b3Q7IHJlY3Vyc2VfZmlsZV9zeXN0ZW09JnF1 b3Q7YWxsJnF1b3Q7IC8mZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6 cGF0aCBvcGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7Jmd0Oy91c3IvbG9jYWwvc2JpbiZsdDsv dW5peDpwYXRoJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rwqDCoMKgICZsdDt1bml4OmZpbGVu YW1lIHhzaTpuaWw9JnF1b3Q7dHJ1ZSZxdW90OyAvJmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4r wqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX293bmVy X25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7PG86cD48L286cD48L3ByZT48cHJlPivCoCAmbHQ7L3Vu aXg6ZmlsZV9vYmplY3QmZ3Q7PG86cD48L286cD48L3ByZT48cHJlPis8bzpwPjwvbzpwPjwvcHJl PjxwcmU+K8KgICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L3Vzci9sb2NhbC9z YmluIGZpbGVzJnF1b3Q7IGlkPSZxdW90O29iamVjdF9maWxlX293bmVyc2hpcF91c3JfbG9jYWxf c2Jpbl9maWxlcyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PG86cD48L286cD48L3By ZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9JnF1b3Q7ZGlyZWN0b3Jp ZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1b3Q7ZG93biZxdW90OyBtYXhfZGVwdGg9JnF1 b3Q7LTEmcXVvdDsgcmVjdXJzZV9maWxlX3N5c3RlbT0mcXVvdDthbGwmcXVvdDsgLyZndDs8bzpw PjwvbzpwPjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDpwYXRoIG9wZXJhdGlvbj0mcXVvdDtl cXVhbHMmcXVvdDsmZ3Q7L3Vzci9sb2NhbC9zYmluJmx0Oy91bml4OnBhdGgmZ3Q7PG86cD48L286 cD48L3ByZT48cHJlPivCoMKgwqAgJmx0O3VuaXg6ZmlsZW5hbWUgb3BlcmF0aW9uPSZxdW90O3Bh dHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7Xi4qJCZsdDsvdW5peDpmaWxlbmFtZSZndDs8bzpwPjwvbzpw PjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7 Jmd0O3N0YXRlX293bmVyX25vdF9yb290Jmx0Oy9maWx0ZXImZ3Q7PG86cD48L286cD48L3ByZT48 cHJlPivCoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PG86cD48L286cD48L3ByZT48cCBjbGFz cz1Nc29Ob3JtYWw+PGJyPjxicj4uLi4uLiB0ZXN0aW5nIGZvciBub24tcm9vdCB1bmRlciAvdXNy L2xvY2FsL3NiaW4gLi4uLi48YnI+W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIGNob3du IHJvb3Q6cm9vdCAvdXNyL3NiaW4vYWNjZXB0PGJyPltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQg c3VkbyB0b3VjaCAvdXNyL2xvY2FsL3NiaW4vdGVzdCA7IHN1ZG8gY2hvd24gc2hhd246c2hhd24g L3Vzci9sb2NhbC9zYmluL3Rlc3Q8YnI+W3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rlc3Rj aGVjay5weSBmaWxlX293bmVyc2hpcF9iaW5hcnlfZGlycy54bWwgPGJyPkV2YWx1YXRpbmcgd2l0 aCBPVkFMIHRlbXBmaWxlIDogL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGlyc3pZNmZYTC54 bWw8YnI+V3JpdGluZyByZXN1bHRzIHRvIDogL3RtcC9maWxlX293bmVyc2hpcF9iaW5hcnlfZGly c3pZNmZYTC54bWwtcmVzdWx0czxicj5EZWZpbml0aW9uIG92YWw6c2NhcC1zZWN1cml0eS1ndWlk ZS50ZXN0aW5nOmRlZjoyNjE6IGZhbHNlPGJyPkV2YWx1YXRpb24gZG9uZS48YnI+PGJyPjxicj48 YnI+PGJyPjxvOnA+PC9vOnA+PC9wPjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT48cHJlPis8 bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDt1bml4OmZpbGVfc3RhdGUgaWQ9JnF1b3Q7c3Rh dGVfb3duZXJfbm90X3Jvb3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7IG9wZXJhdG9yPSZx dW90O09SJnF1b3Q7Jmd0OzxvOnA+PC9vOnA+PC9wcmU+PHByZT4rJmx0OyEtLcKgwqDCoCAmbHQ7 dW5peDpncm91cF9pZCBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsgb3BlcmF0aW9uPSZxdW90O25v dCBlcXVhbCZxdW90OyZndDswJmx0Oy91bml4Omdyb3VwX2lkJmd0OyAtLSZndDs8bzpwPjwvbzpw PjwvcHJlPjxwcmU+K8KgwqDCoCAmbHQ7dW5peDp1c2VyX2lkIGRhdGF0eXBlPSZxdW90O2ludCZx dW90OyBvcGVyYXRpb249JnF1b3Q7bm90IGVxdWFsJnF1b3Q7Jmd0OzAmbHQ7L3VuaXg6dXNlcl9p ZCZndDs8bzpwPjwvbzpwPjwvcHJlPjxwcmU+K8KgICZsdDsvdW5peDpmaWxlX3N0YXRlJmd0Ozxv OnA+PC9vOnA+PC9wcmU+PHByZT4rJmx0Oy9kZWYtZ3JvdXAmZ3Q7PG86cD48L286cD48L3ByZT48 cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PC9kaXY+PC9ib2R5PjwvaHRt bD4= --===============8241939758435290387==-- From jlieskov at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============0364330518937370036==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: Any RPM builders? request for help legitimizing EPEL RPM Date: Wed, 02 Oct 2013 05:50:16 -0400 Message-ID: <127262186.205462.1380707416987.JavaMail.root@redhat.com> In-Reply-To: 954180894.1013994.1380630585094.JavaMail.root@redhat.com --===============0364330518937370036== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hey Josh, Shawn, SSG contributors, ----- Original Message ----- > From: "Josh Bressers" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Tuesday, October 1, 2013 2:29:45 PM > Subject: Re: Any RPM builders? request for help legitimizing EPEL RPM > = > ----- Original Message ----- > > This afternoon sgrubb sent over where one could RTFM on the Fedora EPEL > > build system (thanks, Steve!). I was able to perform scratch builds in > > koji (the Fedora build system) tonight: > > = > > http://koji.fedoraproject.org/koji/taskinfo?taskID=3D6008567 > > = > > While the SSG RPM builds, several errors are thrown during rpmlint > > validation. The RHEL6/transforms/xccdf2table-* files need to issue > > proper HTML headers, e.g. "" > > = > > I'll be locked into meetings over the next two days, and I believe Dave > > & Jeff will be too. If anyone is feeling ambitious, patches to start > > resolving these errors would be INCREDIBLY helpful to move the project > > towards having a legitimate RPM in EPEL! @Shawn && fixing RHEL6 rpmlint issues - wasn't around on Monday, and yester= day was question of get in touch with mails. Will have a look and RHEL-6 *.spec issues, and submit a patch proposal. > > = > > = > = > It might make sense to submit your package for EPEL and Fedora, not just > EPEL. That should help prevent having to do this again once Fedora content > is ready. > = > I'd be happy to review the request once you submit it (presuming nobody > else wants to do it). @more common plane regarding the future Fedora SCAP content direction - we have had a meeting with Brno Security Technologies guys yesterday, and since to ask the right question being an half-way answer, inlining the points we concluded at below and awaiting your feedback: The milestones have been set up as follows: ------------------------------------------- #1 to have Fedora SSG SCAP rpm functionality available (DONE), #2 submit Fedora rpm package for review (PENDING), [for the beginning particular skeleton rules to be supported by OCIL recommendations], #3 increase the amount of rules and remediation scripts implemented (ITERATIVE PROCESS), #4 make a blog post regarding building SSG SCAP content for Fedora. To dive more deeply into particular areas / points: --------------------------------------------------- # regarding having RHEL6/JBossEAP5 SSG content available in Fedora package (this reasonable requirement [sample scenario: being able to scan RHEL6 VM system on my Fedora host] was actually raised right from the beginning, and i wanted to include the content later in the release cycle, but since you opened this topic, will react on this). Motivation: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = So the expectation is to have SSG content to have same package name (scap-security-guide) in both (Red Hat Enterprise Linux 6 && Fedora products), so RHEL6 users accustomed to use SSG functionality for = scanning their systems wouldn't need to get familiar / accustomed to new things. Proposal: =3D=3D=3D=3D=3D=3D=3D=3D=3D So instead of packaging current RHEL6 / JBossEAP5 rpm content as scap-security-guide rpm package into Fedora, we would rather prefer to modify existing Fedora rpm's spec file it to include the RHEL6 / JB= ossEAP5 content (possibly in form of subpackages) too. The subpackages could be divided based on product (one for RHEL6, the another for JBossEAP5), or they could be separated based on profiles (AKA one particular package for each of the following ones: "common", "desktop", "server", "stig-rhel6-server", [possibly "CS2", "usgcb-rhel6-server" ones too]) - feedback on preferred subpack= ages separation form appreciated. # regarding quick launch of Fedora SCAP SSG content: Vision #A: ---------- Keep adding OVAL rules and remediation scripts in progressive way putting emphasis on fact, each newly added rule to be complete in the moment of submit ('complete' in the sense there would be underlying OVAL rule and remediation script for it where possible already available). But since this is time consuming process (main bottleneck has been identi= fied to be the need to test the rules and remediation scripts on various syste= ms to confirm they to return reasonable results for the different systems / = configurations), we would prefer the Vision #B approach first / from the beginning. Vision #B: ---------- Instead of trying to have all currently submitted XML rules they to have their counterparts in the form of OVAL rules and SCAP remediation scripts to be available in the moment of XML rule submit (AKA the XML rule to be 'complete'), we might want to submit only XML rules text content (and pro= vide manual in the form of OCIL recommendations) for them first. This would allow us to have form of more complete Fedora SCAP SSG guide sooner (no need to in a time consuming way to test the rules and correspo= nding SCAP remediation scripts). Also, this way Fedora system administrators wo= uld have a security guide available at hand sooner, and in the case they woul= d want to apply the system remediations / hardenings / recommendations, listed i= n that guide, they could do it manually for now based on the provided OCIL recom= mendations / guidance. Iteratively, in subsequent Fedora SCAP SSG RPM package versions, we would= provide OVAL rules and SCAP remediation scripts for already documented XML defini= tions (here is space for Fedora community to start providing implementations [f= or not existing] or fixes [for already existing] code). = Again, feedback on the alternate visions above (or new proposals), welcome. # regarding involvement of other Linux distributions into the SSG SCAP effo= rt (the listing below should not be read as an exhaustive Linux / BSD distribu= tion list, rather than like an example of other distributions, which are doing same / = similar things, and representatives of which could be contacted to start contributi= ng to upstream SSG project rules applicable to their distribution [since more = heads know more things :), and at the end the effort could result only into the f= inal product being more perfect]): Sven Vermeulen of Gentoo: http://wiki.gentoo.org/wiki/User:SwifT seems to= be participating on Gentoo's SCAP content: http://dev.gentoo.org/~swift/docs/security_benchmarks/ http://dev.gentoo.org/~swift/docs/security_benchmarks/gentoo.html http://www.gentoo.org/doc/en/security/security-handbook.xml therefore we could probably get in touch with him / them, Gentoo to start= participating = on this effort / hosting their security content on the upstream SSG proje= ct too. To mention other distributions for possible cooperation: https://help.ubuntu.com/10.04/serverguide/security.html http://www.debian.org/doc/manuals/securing-debian-howto/ http://doc.opensuse.org/documentation/html/openSUSE/opensuse-security/ For the three above unsure of status of upstream SSG project effort. BSD ones: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/securing-free= bsd.html https://www.netbsd.org/docs/ = ..(many more here).. This could be parallel goal / effort with the two aforementioned ones (benefit =3D profit on wider inter-distribution cooperation wrt to building security guidance documents). Feedback welcome again. Hopefully i have covered all the main points / conclusions from the yesterd= ay's discussion. If not / will come with something yet i forgot to mention, will= reply to this thread. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: Sorry for such a long post again, but too much ideas / proposals to s= hare (hopefully i didn't hijack the original topic too far). > = > -- > Josh Bressers / Red Hat Product Security Team > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============0364330518937370036==-- From jlieskov at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============0625061873796926207==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH 1/2] [Fedora] New rpm versioning scheme - set proper name of the build directory Date: Wed, 02 Oct 2013 10:45:02 -0400 Message-ID: <2125838213.363216.1380725102663.JavaMail.root@redhat.com> In-Reply-To: 381889015.357421.1380724622333.JavaMail.root@redhat.com --===============0625061873796926207== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Upstream commit c5229573e4b4aaf090d7bf8cfd25a40793ce0c12 introduced a change in the way how Fedora tarball is created (before it was created according to the scheme pkg_name-pkg_version.tar.gz, now it's created in pkg_name-pkg_version-fedora_ssg_release.tar.gz form). Without the attached patch it was not possible to properly generate Fedora RPM package (since %setup macro without build directory name [option -n] assumes the build directory to have a form of pkg_name-pkg_version: http://www.rpm.org/max-rpm/s1-rpm-inside-macros.html Thus fix the deficiency by setting proper name of the build directory. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============0625061873796926207== Content-Type: text/x-patch MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-Fedora-New-rpm-versioning-scheme-set-proper-name-of-.patch" RnJvbSA4MjYwNzk3MzRhMTM2NTAyY2NlNTM3OGE4OWYwMjYwNDlkMzM3YTdkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4K RGF0ZTogV2VkLCAyIE9jdCAyMDEzIDE0OjQzOjExICswMjAwClN1YmplY3Q6IFtQQVRDSCAxLzJd IFtGZWRvcmFdIE5ldyBycG0gdmVyc2lvbmluZyBzY2hlbWUgLSBzZXQgcHJvcGVyIG5hbWUgb2YK IHRoZSBidWlsZCBkaXJlY3RvcnkKCgpTaWduZWQtb2ZmLWJ5OiBKYW4gTGllc2tvdnNreSA8amxp ZXNrb3ZAcmVkaGF0LmNvbT4KLS0tCiBGZWRvcmEvc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjIHwg NyArKysrKy0tCiAxIGZpbGUgY2hhbmdlZCwgNSBpbnNlcnRpb25zKCspLCAyIGRlbGV0aW9ucygt KQoKZGlmZiAtLWdpdCBhL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgYi9GZWRvcmEv c2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCmluZGV4IGU5MWQ5NTUuLmEzMjM3NDkgMTAwNjQ0Ci0t LSBhL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKKysrIGIvRmVkb3JhL3NjYXAtc2Vj dXJpdHktZ3VpZGUuc3BlYwpAQCAtNSw3ICs1LDcgQEAKICMgZmlsZSBvbmUgbGV2ZWwgdXAgLSBp biB0aGUgbWFpbiBzY2FwLXNlY3VyaXR5LWd1aWRlIGRpcmVjdG9yeSAoaW5zdGVhZCBvZgogIyB0 aGlzIG9uZSkuCiAKLSVnbG9iYWwJZmVkb3Jhc3NncmVsZWFzZQkxCislZ2xvYmFsCWZlZG9yYXNz Z3JlbGVhc2UJMi5yYzEKIAogTmFtZToJCXNjYXAtc2VjdXJpdHktZ3VpZGUKIFZlcnNpb246CTAu MQpAQCAtMjcsNyArMjcsNyBAQCBjYXRhbG9nIG9mIHByYWN0aWNhbCBoYXJkZW5pbmcgYWR2aWNl IGFuZCBsaW5rcyBpdCB0byBnb3Zlcm5tZW50IHJlcXVpcmVtZW50cwogd2hlcmUgYXBwbGljYWJs ZS4gVGhlIHByb2plY3QgYnJpZGdlcyB0aGUgZ2FwIGJldHdlZW4gZ2VuZXJhbGl6ZWQgcG9saWN5 CiByZXF1aXJlbWVudHMgYW5kIHNwZWNpZmljIGltcGxlbWVudGF0aW9uIGd1aWRhbmNlLgogJXBy ZXAKLSVzZXR1cCAtcQorJXNldHVwIC1xIC1uICV7bmFtZX0tJXt2ZXJzaW9ufS0le2ZlZG9yYXNz Z3JlbGVhc2V9CiAKIAogJWJ1aWxkCkBAIC01MSw1ICs1MSw4IEBAIHJtIC1yZiAkUlBNX0JVSUxE X1JPT1QKIC91c3Ivc2hhcmUveG1sL3NjYXAvc3NnL2ZlZG9yYS8xOS8qCiAKICVjaGFuZ2Vsb2cK KyogV2VkIE9jdCAwMiAyMDEzIEphbiBpYW5ra28gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0 LmNvbT4gMC4xLTIucmMxCistIFNldCBwcm9wZXIgbmFtZSBvZiB0aGUgYnVpbGQgZGlyZWN0b3J5 IGluIHRoZSBzcGVjJ3MgJXNldHVwIG1hY3JvLgorCiAqIFR1ZSBTZXAgMTcgMjAxMyBKYW4gaWFu a2tvIExpZXNrb3Zza3kgPGpsaWVza292QHJlZGhhdC5jb20+IDAuMS0xCiAtIEluaXRpYWwgRmVk b3JhIFNTRyBSUE0uCi0tIAoxLjcuMTEuNwoK --===============0625061873796926207==-- From jlieskov at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============6800093187468604162==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH 2/2] Fedora spec - replace hard-wired paths with macros. Preserve attributes when copying files. Date: Wed, 02 Oct 2013 10:50:03 -0400 Message-ID: <2042932658.365574.1380725403339.JavaMail.root@redhat.com> In-Reply-To: 1426817463.363731.1380725162690.JavaMail.root@redhat.com --===============6800093187468604162== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable According to: http://fedoraproject.org/wiki/Common_Rpmlint_issues hard-coded paths should be avoided in *.spec file: https://fedoraproject.org/wiki/Packaging:RPMMacros?rd=3DPackaging/RPMMacr= os Also, while copying files file attributes should be preserved: https://fedoraproject.org/wiki/Packaging:Guidelines#Timestamps Therefore fix both issues in Fedora's spec file. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============6800093187468604162== Content-Type: text/x-patch MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0002-Fedora-spec-replace-hard-wired-paths-with-macros.-Pr.patch" RnJvbSAyMWRmMGRjOWI4YjNiMWQzMDM5ODVhMDBiOTRmMmJhZWRmMzA2ZDJiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4K RGF0ZTogV2VkLCAyIE9jdCAyMDEzIDE2OjAzOjAyICswMjAwClN1YmplY3Q6IFtQQVRDSCAyLzJd IEZlZG9yYSBzcGVjIC0gcmVwbGFjZSBoYXJkLXdpcmVkIHBhdGhzIHdpdGggbWFjcm9zLgogUHJl c2VydmUgYXR0cmlidXRlcyB3aGVuIGNvcHlpbmcgZmlsZXMuCgoKU2lnbmVkLW9mZi1ieTogSmFu IExpZXNrb3Zza3kgPGpsaWVza292QHJlZGhhdC5jb20+Ci0tLQogRmVkb3JhL3NjYXAtc2VjdXJp dHktZ3VpZGUuc3BlYyB8IDggKysrKy0tLS0KIDEgZmlsZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMo KyksIDQgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3Vp ZGUuc3BlYyBiL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKaW5kZXggYTMyMzc0OS4u NGVmMzcxMyAxMDA2NDQKLS0tIGEvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYworKysg Yi9GZWRvcmEvc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCkBAIC0zNiwxMSArMzYsMTAgQEAgY2Qg RmVkb3JhICYmIG1ha2UgZGlzdAogCiAlaW5zdGFsbAogcm0gLXJmICRSUE1fQlVJTERfUk9PVAot bWtkaXIgLXAgJFJQTV9CVUlMRF9ST09UL3Vzci9zaGFyZS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5 Citta2RpciAtcCAkUlBNX0JVSUxEX1JPT1Qle19kYXRhZGlyfS94bWwvc2NhcC9zc2cvZmVkb3Jh LzE5CiAKICMgQWRkIGluIGNvcmUgY29udGVudCAoU0NBUCwgZ3VpZGUpCi1jcCAtciBGZWRvcmEv ZGlzdC8qICRSUE1fQlVJTERfUk9PVC91c3Ivc2hhcmUveG1sL3NjYXAvc3NnL2ZlZG9yYS8xOQot CitjcCAtYSBGZWRvcmEvZGlzdC8qICRSUE1fQlVJTERfUk9PVCV7X2RhdGFkaXJ9L3htbC9zY2Fw L3NzZy9mZWRvcmEvMTkKIAogJWNsZWFuCiBybSAtcmYgJFJQTV9CVUlMRF9ST09UCkBAIC00OCwx MSArNDcsMTIgQEAgcm0gLXJmICRSUE1fQlVJTERfUk9PVAogCiAlZmlsZXMKICVkZWZhdHRyKC0s cm9vdCxyb290LC0pCi0vdXNyL3NoYXJlL3htbC9zY2FwL3NzZy9mZWRvcmEvMTkvKgorJXtfZGF0 YWRpcn0veG1sL3NjYXAvc3NnL2ZlZG9yYS8xOS8qCiAKICVjaGFuZ2Vsb2cKICogV2VkIE9jdCAw MiAyMDEzIEphbiBpYW5ra28gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4gMC4xLTIu cmMxCiAtIFNldCBwcm9wZXIgbmFtZSBvZiB0aGUgYnVpbGQgZGlyZWN0b3J5IGluIHRoZSBzcGVj J3MgJXNldHVwIG1hY3JvLgorLSBSZXBsYWNlIGhhcmQtd2lyZWQgcGF0aHMgd2l0aCBtYWNyb3Mu IFByZXNlcnZlIGF0dHJpYnV0ZXMgd2hlbiBjb3B5aW5nIGZpbGVzLgogCiAqIFR1ZSBTZXAgMTcg MjAxMyBKYW4gaWFua2tvIExpZXNrb3Zza3kgPGpsaWVza292QHJlZGhhdC5jb20+IDAuMS0xCiAt IEluaXRpYWwgRmVkb3JhIFNTRyBSUE0uCi0tIAoxLjcuMTEuNwoK --===============6800093187468604162==-- From jlieskov at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============6817774739808677894==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [bugfix] Updated RPM spec file Date: Wed, 02 Oct 2013 12:57:13 -0400 Message-ID: <1897185981.444612.1380733033296.JavaMail.root@redhat.com> In-Reply-To: 20131001024307.GA608@mail.corp.redhat.com --===============6817774739808677894== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello Shawn, as promised, attached is slightly enhanced patch for RHEL6's spec file it to quieten more rpmlint warnings: * spaces 've been replaced with tabs globally, * removed dot from Summary, * updated license && group, * replaced hard-coded paths with rpm macros, * adjusted defattr rpmlint not to complain about invalid shebangs. For now kept defattr there (since other RHEL6 specs do too), but according to Fedora PackagingGuidelines (section File Permissions): https://fedoraproject.org/wiki/Packaging:Guidelines?rd=3DPackaging/Guid= elines it was necessary only in versions of rpm package prior to 4.4. Since in RHEL6 there's rpm-4.8.0 currently, that macro might not be even needed already. = * adjusted scap-security-guide manual page definition rpmlint not to complain about missing %lang. The rpmlint output has been reduced to two warnings / errors: - one about the invalid source - as previously mentioned, this is not something i can fix. Someone with proper privileges needs to upload the tarball to pre-agreed https:// location first, then that location needs to be listed after Source0: section of the spec file to calm down this warning, - the other one about the 'too much recursion / deep loop' could be quieten by moving the Version and Release information from the main Makefile into the RHEL6's scap-security-guide.spec file (and for purpose of their use in the main Makefile being extracted back from the spec file like Fedora case is doing). But since this impacts main Makefile and the way how RHEL6 versioning would behave, i am gonna to wait with the change till someone else approves / confirms, fixing this particular rpmlint warning has higher priority than Version / Release being in the main Makefile. * didn't update the changelog entry yet (for case this wouldn't be the final version). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team = ----- Original Message ----- > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Tuesday, October 1, 2013 4:43:07 AM > Subject: [PATCH] [bugfix] Updated RPM spec file > = > = > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============6817774739808677894== Content-Type: text/x-patch MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-bugfix-Update-RHEL6-RPM-spec-file.patch" RnJvbSA5MmY4NzE2YjM4NjcyODUwNzMwNzdjOTQ5OWRiZDcyMjM5MGM4ZmM5IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4K RGF0ZTogV2VkLCAyIE9jdCAyMDEzIDE4OjIzOjQzICswMjAwClN1YmplY3Q6IFtQQVRDSF0gW2J1 Z2ZpeF0gVXBkYXRlIFJIRUw2IFJQTSBzcGVjIGZpbGUKCgpTaWduZWQtb2ZmLWJ5OiBKYW4gTGll c2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4KLS0tCiBzY2FwLXNlY3VyaXR5LWd1aWRlLnNw ZWMgfCA0MiArKysrKysrKysrKysrKysrKysrKystLS0tLS0tLS0tLS0tLS0tLS0tLS0KIDEgZmls ZSBjaGFuZ2VkLCAyMSBpbnNlcnRpb25zKCspLCAyMSBkZWxldGlvbnMoLSkKIG1vZGUgY2hhbmdl IDEwMDc1NSA9PiAxMDA2NDQgSkJvc3NFQVA1L2VhcDUtY3BlLWRpY3Rpb25hcnkueG1sCgpkaWZm IC0tZ2l0IGEvSkJvc3NFQVA1L2VhcDUtY3BlLWRpY3Rpb25hcnkueG1sIGIvSkJvc3NFQVA1L2Vh cDUtY3BlLWRpY3Rpb25hcnkueG1sCm9sZCBtb2RlIDEwMDc1NQpuZXcgbW9kZSAxMDA2NDQKZGlm ZiAtLWdpdCBhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyBiL3NjYXAtc2VjdXJpdHktZ3VpZGUu c3BlYwppbmRleCA1ZmM4ODhjLi5hZWE3ODg2IDEwMDY0NAotLS0gYS9zY2FwLXNlY3VyaXR5LWd1 aWRlLnNwZWMKKysrIGIvc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCkBAIC0xLDE5ICsxLDE5IEBA Ci1OYW1lOiAgICAgICAgICAgc2NhcC1zZWN1cml0eS1ndWlkZQotVmVyc2lvbjogICAgICAgICV7 dmVyc2lvbn0KLVJlbGVhc2U6ICAgICAgICAle3JlbGVhc2V9Ci1TdW1tYXJ5OiAgICAgICAgU2Vj dXJpdHkgZ3VpZGFuY2UgYW5kIGJhc2VsaW5lcyBpbiBTQ0FQIGZvcm1hdHMuCitOYW1lOgkJc2Nh cC1zZWN1cml0eS1ndWlkZQorVmVyc2lvbjoJJXt2ZXJzaW9ufQorUmVsZWFzZToJJXtyZWxlYXNl fQorU3VtbWFyeToJU2VjdXJpdHkgZ3VpZGFuY2UgYW5kIGJhc2VsaW5lcyBpbiBTQ0FQIGZvcm1h dHMKIAotR3JvdXA6ICAgICAgICAgIFRlc3RpbmcKLUxpY2Vuc2U6ICAgICAgICBQdWJsaWMgZG9t YWluIGFuZCBHUEwKLVVSTDogICAgICAgICAgICBodHRwczovL2ZlZG9yYWhvc3RlZC5vcmcvc2Nh cC1zZWN1cml0eS1ndWlkZS8KK0dyb3VwOgkJU3lzdGVtIEVudmlyb25tZW50L0Jhc2UKK0xpY2Vu c2U6CVB1YmxpYyBEb21haW4KK1VSTDoJCWh0dHBzOi8vZmVkb3JhaG9zdGVkLm9yZy9zY2FwLXNl Y3VyaXR5LWd1aWRlLwogCi1Tb3VyY2UwOiAgICAgICAgJXtuYW1lfS0le3ZlcnNpb259LnRhci5n egotQnVpbGRSb290OiAgICAgICUobWt0ZW1wIC11ZCAle190bXBwYXRofS8le25hbWV9LSV7dmVy c2lvbn0tJXtyZWxlYXNlfS1YWFhYWFgpCitTb3VyY2UwOgkle25hbWV9LSV7dmVyc2lvbn0udGFy Lmd6CitCdWlsZFJvb3Q6CSUobWt0ZW1wIC11ZCAle190bXBwYXRofS8le25hbWV9LSV7dmVyc2lv bn0tJXtyZWxlYXNlfS1YWFhYWFgpCiAKIEJ1aWxkQXJjaDoJJXthcmNofQogCi1CdWlsZFJlcXVp cmVzOiAgY29yZXV0aWxzLCBsaWJ4c2x0LCBleHBhdCwgcHl0aG9uLCBvcGVuc2NhcC11dGlscyA+ PSAwLjkuMSwgcHl0aG9uLWx4bWwKLVJlcXVpcmVzOiAgICAgICBmaWxlc3lzdGVtLCBvcGVuc2Nh cC11dGlscyA+PSAwLjkuMQorQnVpbGRSZXF1aXJlczoJY29yZXV0aWxzLCBsaWJ4c2x0LCBleHBh dCwgcHl0aG9uLCBvcGVuc2NhcC11dGlscyA+PSAwLjkuMSwgcHl0aG9uLWx4bWwKK1JlcXVpcmVz OglmaWxlc3lzdGVtLCBvcGVuc2NhcC11dGlscyA+PSAwLjkuMQogCiAlZGVzY3JpcHRpb24KIFRo ZSBzY2FwLXNlY3VyaXR5LWd1aWRlIHByb2plY3QgcHJvdmlkZXMgc2VjdXJpdHkgY29uZmlndXJh dGlvbiBndWlkYW5jZSBpbgpAQCAtMzIsMjcgKzMyLDI3IEBAIGNkIFJIRUw2ICYmIG1ha2UgZGlz dAogJWluc3RhbGwKIHJtIC1yZiAkUlBNX0JVSUxEX1JPT1QKICNtYWtlIGluc3RhbGwgREVTVERJ Uj0kUlBNX0JVSUxEX1JPT1QKLW1rZGlyIC1wICRSUE1fQlVJTERfUk9PVC91c3Ivc2hhcmUveG1s L3NjYXAvc3NnLwotbWtkaXIgLXAgJFJQTV9CVUlMRF9ST09UL3Vzci9zaGFyZS9tYW4vZW4vbWFu OC8KK21rZGlyIC1wICRSUE1fQlVJTERfUk9PVCV7X2RhdGFkaXJ9L3htbC9zY2FwL3NzZy8KK21r ZGlyIC1wICRSUE1fQlVJTERfUk9PVCV7X21hbmRpcn0vZW4vbWFuOC8KIAogIyBBZGQgaW4gY29y ZSBjb250ZW50IChTQ0FQLCBndWlkZSwgdGFibGVzKQotY3AgLXIgUkhFTDYvZGlzdC8qICRSUE1f QlVJTERfUk9PVC91c3Ivc2hhcmUveG1sL3NjYXAvc3NnLwotY3AgSkJvc3NFQVA1L2VhcDUtKiAk UlBNX0JVSUxEX1JPT1QvdXNyL3NoYXJlL3htbC9zY2FwL3NzZy9jb250ZW50LwotY3AgSkJvc3NF QVA1L2RvY3MvSkJvc3NFQVA1X0d1aWRlLmh0bWwgJFJQTV9CVUlMRF9ST09UL3Vzci9zaGFyZS94 bWwvc2NhcC9zc2cvZ3VpZGUvCitjcCAtciBSSEVMNi9kaXN0LyogJFJQTV9CVUlMRF9ST09UJXtf ZGF0YWRpcn0veG1sL3NjYXAvc3NnLworY3AgSkJvc3NFQVA1L2VhcDUtKiAkUlBNX0JVSUxEX1JP T1Qle19kYXRhZGlyfS94bWwvc2NhcC9zc2cvY29udGVudC8KK2NwIEpCb3NzRUFQNS9kb2NzL0pC b3NzRUFQNV9HdWlkZS5odG1sICRSUE1fQlVJTERfUk9PVCV7X2RhdGFkaXJ9L3htbC9zY2FwL3Nz Zy9ndWlkZS8KIAogIyBBZGQgaW4gbWFucGFnZQotZ3ppcCAtYyBSSEVMNi9pbnB1dC9hdXhpbGlh cnkvc2NhcC1zZWN1cml0eS1ndWlkZS44ID4gJFJQTV9CVUlMRF9ST09UL3Vzci9zaGFyZS9tYW4v ZW4vbWFuOC9zY2FwLXNlY3VyaXR5LWd1aWRlLjguZ3oKK2d6aXAgLWMgUkhFTDYvaW5wdXQvYXV4 aWxpYXJ5L3NjYXAtc2VjdXJpdHktZ3VpZGUuOCA+ICRSUE1fQlVJTERfUk9PVCV7X21hbmRpcn0v ZW4vbWFuOC9zY2FwLXNlY3VyaXR5LWd1aWRlLjguZ3oKIG1ha2V3aGF0aXMKLWNoY29uIC11IHN5 c3RlbV91ICRSUE1fQlVJTERfUk9PVC91c3Ivc2hhcmUvbWFuL2VuL21hbjgvc2NhcC1zZWN1cml0 eS1ndWlkZS44Lmd6CitjaGNvbiAtdSBzeXN0ZW1fdSAkUlBNX0JVSUxEX1JPT1Qle19tYW5kaXJ9 L2VuL21hbjgvc2NhcC1zZWN1cml0eS1ndWlkZS44Lmd6CiAKICVjbGVhbgogcm0gLXJmICRSUE1f QlVJTERfUk9PVAogCiAKICVmaWxlcwotJWRlZmF0dHIoMDY0NCxyb290LHJvb3QsMDc1NSkKLSVh dHRyKDA3NTUscm9vdCxyb290KSAvdXNyL3NoYXJlL3htbC9zY2FwL3NzZwotJWF0dHIoMDY0NCxy b290LHJvb3QpIC91c3Ivc2hhcmUvbWFuL2VuL21hbjgvc2NhcC1zZWN1cml0eS1ndWlkZS44Lmd6 CislZGVmYXR0cigtLHJvb3Qscm9vdCwtKQorJXtfZGF0YWRpcn0veG1sL3NjYXAvc3NnCislbGFu ZyhlbikgJXtfbWFuZGlyfS9lbi9tYW44L3NjYXAtc2VjdXJpdHktZ3VpZGUuOC5negogCiAKICVj aGFuZ2Vsb2cKLS0gCjEuNy4xMS43Cgo= --===============6817774739808677894==-- From shawn at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============7228799595609259052==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 1/2] [Fedora] New rpm versioning scheme - set proper name of the build directory Date: Wed, 02 Oct 2013 13:57:52 -0400 Message-ID: <524C5EA0.7000602@redhat.com> In-Reply-To: 2125838213.363216.1380725102663.JavaMail.root@redhat.com --===============7228799595609259052== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 10:45 AM, Jan Lieskovsky wrote: > Upstream commit c5229573e4b4aaf090d7bf8cfd25a40793ce0c12 > introduced a change in the way how Fedora tarball is created > (before it was created according to the scheme pkg_name-pkg_version.tar.g= z, > now it's created in pkg_name-pkg_version-fedora_ssg_release.tar.gz > form). > > Without the attached patch it was not possible to properly > generate Fedora RPM package (since %setup macro without > build directory name [option -n] assumes the build directory > to have a form of pkg_name-pkg_version: > http://www.rpm.org/max-rpm/s1-rpm-inside-macros.html > > Thus fix the deficiency by setting proper name of the build directory. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0001-Fedora-New-rpm-versioning-scheme-set-proper-name-of-.patch > > > From 826079734a136502cce5378a89f026049d337a7d Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Wed, 2 Oct 2013 14:43:11 +0200 > Subject: [PATCH 1/2] [Fedora] New rpm versioning scheme - set proper name= of > the build directory > > > Signed-off-by: Jan Lieskovsky > --- > Fedora/scap-security-guide.spec | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide= .spec > index e91d955..a323749 100644 > --- a/Fedora/scap-security-guide.spec > +++ b/Fedora/scap-security-guide.spec > @@ -5,7 +5,7 @@ > # file one level up - in the main scap-security-guide directory (instea= d of > # this one). > = > -%global fedorassgrelease 1 > +%global fedorassgrelease 2.rc1 > = > Name: scap-security-guide > Version: 0.1 > @@ -27,7 +27,7 @@ catalog of practical hardening advice and links it to g= overnment requirements > where applicable. The project bridges the gap between generalized policy > requirements and specific implementation guidance. > %prep > -%setup -q > +%setup -q -n %{name}-%{version}-%{fedorassgrelease} > = > = > %build > @@ -51,5 +51,8 @@ rm -rf $RPM_BUILD_ROOT > /usr/share/xml/scap/ssg/fedora/19/* > = > %changelog > +* Wed Oct 02 2013 Jan iankko Lieskovsky 0.1-2.rc1 > +- Set proper name of the build directory in the spec's %setup macro. > + > * Tue Sep 17 2013 Jan iankko Lieskovsky 0.1-1 > - Initial Fedora SSG RPM. > -- 1.7.11.7 Ack --===============7228799595609259052== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8yLzEzIDEwOjQ1IEFNLCBKYW4gTGllc2tvdnNreQogICAgICB3cm90ZTo8YnI+CiAg ICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoyMTI1ODM4MjEzLjM2MzIx Ni4xMzgwNzI1MTAyNjYzLkphdmFNYWlsLnJvb3RAcmVkaGF0LmNvbSIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGlj YWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBm b250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAgICAgICAgPHByZSB3 cmFwPSIiPlVwc3RyZWFtIGNvbW1pdCBjNTIyOTU3M2U0YjRhYWYwOTBkN2JmOGNmZDI1YTQwNzkz Y2UwYzEyCmludHJvZHVjZWQgYSBjaGFuZ2UgaW4gdGhlIHdheSBob3cgRmVkb3JhIHRhcmJhbGwg aXMgY3JlYXRlZAooYmVmb3JlIGl0IHdhcyBjcmVhdGVkIGFjY29yZGluZyB0byB0aGUgc2NoZW1l IHBrZ19uYW1lLXBrZ192ZXJzaW9uLnRhci5neiwKbm93IGl0J3MgY3JlYXRlZCBpbiBwa2dfbmFt ZS1wa2dfdmVyc2lvbi1mZWRvcmFfc3NnX3JlbGVhc2UudGFyLmd6CmZvcm0pLgoKV2l0aG91dCB0 aGUgYXR0YWNoZWQgcGF0Y2ggaXQgd2FzIG5vdCBwb3NzaWJsZSB0byBwcm9wZXJseQpnZW5lcmF0 ZSBGZWRvcmEgUlBNIHBhY2thZ2UgKHNpbmNlICVzZXR1cCBtYWNybyB3aXRob3V0CmJ1aWxkIGRp cmVjdG9yeSBuYW1lIFtvcHRpb24gLW5dIGFzc3VtZXMgdGhlIGJ1aWxkIGRpcmVjdG9yeQp0byBo YXZlIGEgZm9ybSBvZiBwa2dfbmFtZS1wa2dfdmVyc2lvbjoKICA8YSBtb3otZG8tbm90LXNlbmQ9 InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly93d3cucnBt Lm9yZy9tYXgtcnBtL3MxLXJwbS1pbnNpZGUtbWFjcm9zLmh0bWwiPmh0dHA6Ly93d3cucnBtLm9y Zy9tYXgtcnBtL3MxLXJwbS1pbnNpZGUtbWFjcm9zLmh0bWw8L2E+CgpUaHVzIGZpeCB0aGUgZGVm aWNpZW5jeSBieSBzZXR0aW5nIHByb3BlciBuYW1lIG9mIHRoZSBidWlsZCBkaXJlY3RvcnkuCgpU aGFuayB5b3UgJmFtcDsmYW1wOyBSZWdhcmRzLCBKYW4uCi0tCkphbiBpYW5ra28gTGllc2tvdnNr eSAvIFJlZCBIYXQgU2VjdXJpdHkgVGVjaG5vbG9naWVzIFRlYW0KPC9wcmU+CiAgICAgIDwvZGl2 PgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIi PjxsZWdlbmQKICAgICAgICAgIGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlck5hbWUiPjAwMDEt RmVkb3JhLU5ldy1ycG0tdmVyc2lvbmluZy1zY2hlbWUtc2V0LXByb3Blci1uYW1lLW9mLS5wYXRj aDwvbGVnZW5kPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPGRpdiBjbGFzcz0ibW96LXRl eHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIKICAgICAgICBzdHls ZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgbGFu Zz0ieC13ZXN0ZXJuIj4KICAgICAgICA8cHJlIHdyYXA9IiI+RnJvbSA4MjYwNzk3MzRhMTM2NTAy Y2NlNTM3OGE4OWYwMjYwNDlkMzM3YTdkIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBK YW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxp bmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29tIj4mbHQ7amxpZXNr b3ZAcmVkaGF0LmNvbSZndDs8L2E+CkRhdGU6IFdlZCwgMiBPY3QgMjAxMyAxNDo0MzoxMSArMDIw MApTdWJqZWN0OiBbUEFUQ0ggMS8yXSBbRmVkb3JhXSBOZXcgcnBtIHZlcnNpb25pbmcgc2NoZW1l IC0gc2V0IHByb3BlciBuYW1lIG9mCiB0aGUgYnVpbGQgZGlyZWN0b3J5CgoKU2lnbmVkLW9mZi1i eTogSmFuIExpZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4 dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2ps aWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPgotLS0KIEZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRl LnNwZWMgfCA3ICsrKysrLS0KIDEgZmlsZSBjaGFuZ2VkLCA1IGluc2VydGlvbnMoKyksIDIgZGVs ZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyBi L0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKaW5kZXggZTkxZDk1NS4uYTMyMzc0OSAx MDA2NDQKLS0tIGEvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYworKysgYi9GZWRvcmEv c2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCkBAIC01LDcgKzUsNyBAQAogIyBmaWxlIG9uZSBsZXZl bCB1cCAtIGluIHRoZSBtYWluIHNjYXAtc2VjdXJpdHktZ3VpZGUgZGlyZWN0b3J5IChpbnN0ZWFk IG9mCiAjIHRoaXMgb25lKS4KIAotJWdsb2JhbAlmZWRvcmFzc2dyZWxlYXNlCTEKKyVnbG9iYWwJ ZmVkb3Jhc3NncmVsZWFzZQkyLnJjMQogCiBOYW1lOgkJc2NhcC1zZWN1cml0eS1ndWlkZQogVmVy c2lvbjoJMC4xCkBAIC0yNyw3ICsyNyw3IEBAIGNhdGFsb2cgb2YgcHJhY3RpY2FsIGhhcmRlbmlu ZyBhZHZpY2UgYW5kIGxpbmtzIGl0IHRvIGdvdmVybm1lbnQgcmVxdWlyZW1lbnRzCiB3aGVyZSBh cHBsaWNhYmxlLiBUaGUgcHJvamVjdCBicmlkZ2VzIHRoZSBnYXAgYmV0d2VlbiBnZW5lcmFsaXpl ZCBwb2xpY3kKIHJlcXVpcmVtZW50cyBhbmQgc3BlY2lmaWMgaW1wbGVtZW50YXRpb24gZ3VpZGFu Y2UuCiAlcHJlcAotJXNldHVwIC1xCislc2V0dXAgLXEgLW4gJXtuYW1lfS0le3ZlcnNpb259LSV7 ZmVkb3Jhc3NncmVsZWFzZX0KIAogCiAlYnVpbGQKQEAgLTUxLDUgKzUxLDggQEAgcm0gLXJmICRS UE1fQlVJTERfUk9PVAogL3Vzci9zaGFyZS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5LyoKIAogJWNo YW5nZWxvZworKiBXZWQgT2N0IDAyIDIwMTMgSmFuIGlhbmtrbyBMaWVza292c2t5IDxhIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFp bHRvOmpsaWVza292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4g MC4xLTIucmMxCistIFNldCBwcm9wZXIgbmFtZSBvZiB0aGUgYnVpbGQgZGlyZWN0b3J5IGluIHRo ZSBzcGVjJ3MgJXNldHVwIG1hY3JvLgorCiAqIFR1ZSBTZXAgMTcgMjAxMyBKYW4gaWFua2tvIExp ZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJm YzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2psaWVza292QHJl ZGhhdC5jb20mZ3Q7PC9hPiAwLjEtMQogLSBJbml0aWFsIEZlZG9yYSBTU0cgUlBNLgo8ZGl2IGNs YXNzPSJtb3otdHh0LXNpZyI+LS0gCjEuNy4xMS43Cgo8L2Rpdj48L3ByZT4KICAgICAgPC9kaXY+ CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBBY2s8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+ Cg== --===============7228799595609259052==-- From shawn at redhat.com Thu Aug 20 11:35:23 2015 Content-Type: multipart/mixed; boundary="===============7531916002194641958==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 2/2] Fedora spec - replace hard-wired paths with macros. Preserve attributes when copying files. Date: Wed, 02 Oct 2013 13:59:07 -0400 Message-ID: <524C5EEB.4090609@redhat.com> In-Reply-To: 2042932658.365574.1380725403339.JavaMail.root@redhat.com --===============7531916002194641958== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 10:50 AM, Jan Lieskovsky wrote: > According to: > http://fedoraproject.org/wiki/Common_Rpmlint_issues > > hard-coded paths should be avoided in *.spec file: > https://fedoraproject.org/wiki/Packaging:RPMMacros?rd=3DPackaging/RPMM= acros > > Also, while copying files file attributes should be preserved: > https://fedoraproject.org/wiki/Packaging:Guidelines#Timestamps > > Therefore fix both issues in Fedora's spec file. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0002-Fedora-spec-replace-hard-wired-paths-with-macros.-Pr.patch > > > From 21df0dc9b8b3b1d303985a00b94f2baedf306d2b Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Wed, 2 Oct 2013 16:03:02 +0200 > Subject: [PATCH 2/2] Fedora spec - replace hard-wired paths with macros. > Preserve attributes when copying files. > > > Signed-off-by: Jan Lieskovsky > --- > Fedora/scap-security-guide.spec | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide= .spec > index a323749..4ef3713 100644 > --- a/Fedora/scap-security-guide.spec > +++ b/Fedora/scap-security-guide.spec > @@ -36,11 +36,10 @@ cd Fedora && make dist > = > %install > rm -rf $RPM_BUILD_ROOT > -mkdir -p $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19 > +mkdir -p $RPM_BUILD_ROOT%{_datadir}/xml/scap/ssg/fedora/19 > = > # Add in core content (SCAP, guide) > -cp -r Fedora/dist/* $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19 > - > +cp -a Fedora/dist/* $RPM_BUILD_ROOT%{_datadir}/xml/scap/ssg/fedora/19 > = > %clean > rm -rf $RPM_BUILD_ROOT > @@ -48,11 +47,12 @@ rm -rf $RPM_BUILD_ROOT > = > %files > %defattr(-,root,root,-) > -/usr/share/xml/scap/ssg/fedora/19/* > +%{_datadir}/xml/scap/ssg/fedora/19/* > = > %changelog > * Wed Oct 02 2013 Jan iankko Lieskovsky 0.1-2.r= c1 > - Set proper name of the build directory in the spec's %setup macro. > +- Replace hard-wired paths with macros. Preserve attributes when copying= files. > = > * Tue Sep 17 2013 Jan iankko Lieskovsky 0.1-1 > - Initial Fedora SSG RPM. > -- 1.7.11.7 Ran `make fedora-rpm` and yum localinstall, everything (file perms, etc) = check out. Ack! --===============7531916002194641958== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8yLzEzIDEwOjUwIEFNLCBKYW4gTGllc2tvdnNreQogICAgICB3cm90ZTo8YnI+CiAg ICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoyMDQyOTMyNjU4LjM2NTU3 NC4xMzgwNzI1NDAzMzM5LkphdmFNYWlsLnJvb3RAcmVkaGF0LmNvbSIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGlj YWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBm b250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAgICAgICAgPHByZSB3 cmFwPSIiPkFjY29yZGluZyB0bzoKICA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtp L0NvbW1vbl9ScG1saW50X2lzc3VlcyI+aHR0cDovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvQ29t bW9uX1JwbWxpbnRfaXNzdWVzPC9hPgoKaGFyZC1jb2RlZCBwYXRocyBzaG91bGQgYmUgYXZvaWRl ZCBpbiAqLnNwZWMgZmlsZToKICA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3ot dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9Q YWNrYWdpbmc6UlBNTWFjcm9zP3JkPVBhY2thZ2luZy9SUE1NYWNyb3MiPmh0dHBzOi8vZmVkb3Jh cHJvamVjdC5vcmcvd2lraS9QYWNrYWdpbmc6UlBNTWFjcm9zP3JkPVBhY2thZ2luZy9SUE1NYWNy b3M8L2E+CgpBbHNvLCB3aGlsZSBjb3B5aW5nIGZpbGVzIGZpbGUgYXR0cmlidXRlcyBzaG91bGQg YmUgcHJlc2VydmVkOgogIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL1BhY2th Z2luZzpHdWlkZWxpbmVzI1RpbWVzdGFtcHMiPmh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lr aS9QYWNrYWdpbmc6R3VpZGVsaW5lcyNUaW1lc3RhbXBzPC9hPgoKVGhlcmVmb3JlIGZpeCBib3Ro IGlzc3VlcyBpbiBGZWRvcmEncyBzcGVjIGZpbGUuCgpUaGFuayB5b3UgJmFtcDsmYW1wOyBSZWdh cmRzLCBKYW4uCi0tCkphbiBpYW5ra28gTGllc2tvdnNreSAvIFJlZCBIYXQgU2VjdXJpdHkgVGVj aG5vbG9naWVzIFRlYW08L3ByZT4KICAgICAgPC9kaXY+CiAgICAgIDxicj4KICAgICAgPGZpZWxk c2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PGxlZ2VuZAogICAgICAgICAgY2xhc3M9 Im1pbWVBdHRhY2htZW50SGVhZGVyTmFtZSI+MDAwMi1GZWRvcmEtc3BlYy1yZXBsYWNlLWhhcmQt d2lyZWQtcGF0aHMtd2l0aC1tYWNyb3MuLVByLnBhdGNoPC9sZWdlbmQ+PC9maWVsZHNldD4KICAg ICAgPGJyPgogICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4dC1wbGFpbiIgd3JhcD0idHJ1ZSIgZ3Jh cGhpY2FsLXF1b3RlPSJ0cnVlIgogICAgICAgIHN0eWxlPSJmb250LWZhbWlseTogLW1vei1maXhl ZDsgZm9udC1zaXplOiAxMnB4OyIKICAgICAgICBsYW5nPSJ4LXdlc3Rlcm4iPgogICAgICAgIDxw cmUgd3JhcD0iIj5Gcm9tIDIxZGYwZGM5YjhiM2IxZDMwMzk4NWEwMGI5NGYyYmFlZGYzMDZkMmIg TW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCkZyb206IEphbiBMaWVza292c2t5IDxhIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRv OmpsaWVza292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4KRGF0 ZTogV2VkLCAyIE9jdCAyMDEzIDE2OjAzOjAyICswMjAwClN1YmplY3Q6IFtQQVRDSCAyLzJdIEZl ZG9yYSBzcGVjIC0gcmVwbGFjZSBoYXJkLXdpcmVkIHBhdGhzIHdpdGggbWFjcm9zLgogUHJlc2Vy dmUgYXR0cmlidXRlcyB3aGVuIGNvcHlpbmcgZmlsZXMuCgoKU2lnbmVkLW9mZi1ieTogSmFuIExp ZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJm YzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2psaWVza292QHJl ZGhhdC5jb20mZ3Q7PC9hPgotLS0KIEZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgfCA4 ICsrKystLS0tCiAxIGZpbGUgY2hhbmdlZCwgNCBpbnNlcnRpb25zKCspLCA0IGRlbGV0aW9ucygt KQoKZGlmZiAtLWdpdCBhL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgYi9GZWRvcmEv c2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjCmluZGV4IGEzMjM3NDkuLjRlZjM3MTMgMTAwNjQ0Ci0t LSBhL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKKysrIGIvRmVkb3JhL3NjYXAtc2Vj dXJpdHktZ3VpZGUuc3BlYwpAQCAtMzYsMTEgKzM2LDEwIEBAIGNkIEZlZG9yYSAmYW1wOyZhbXA7 IG1ha2UgZGlzdAogCiAlaW5zdGFsbAogcm0gLXJmICRSUE1fQlVJTERfUk9PVAotbWtkaXIgLXAg JFJQTV9CVUlMRF9ST09UL3Vzci9zaGFyZS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5Citta2RpciAt cCAkUlBNX0JVSUxEX1JPT1Qle19kYXRhZGlyfS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5CiAKICMg QWRkIGluIGNvcmUgY29udGVudCAoU0NBUCwgZ3VpZGUpCi1jcCAtciBGZWRvcmEvZGlzdC8qICRS UE1fQlVJTERfUk9PVC91c3Ivc2hhcmUveG1sL3NjYXAvc3NnL2ZlZG9yYS8xOQotCitjcCAtYSBG ZWRvcmEvZGlzdC8qICRSUE1fQlVJTERfUk9PVCV7X2RhdGFkaXJ9L3htbC9zY2FwL3NzZy9mZWRv cmEvMTkKIAogJWNsZWFuCiBybSAtcmYgJFJQTV9CVUlMRF9ST09UCkBAIC00OCwxMSArNDcsMTIg QEAgcm0gLXJmICRSUE1fQlVJTERfUk9PVAogCiAlZmlsZXMKICVkZWZhdHRyKC0scm9vdCxyb290 LC0pCi0vdXNyL3NoYXJlL3htbC9zY2FwL3NzZy9mZWRvcmEvMTkvKgorJXtfZGF0YWRpcn0veG1s L3NjYXAvc3NnL2ZlZG9yYS8xOS8qCiAKICVjaGFuZ2Vsb2cKICogV2VkIE9jdCAwMiAyMDEzIEph biBpYW5ra28gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3ot dHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29tIj4mbHQ7 amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+IDAuMS0yLnJjMQogLSBTZXQgcHJvcGVyIG5hbWUg b2YgdGhlIGJ1aWxkIGRpcmVjdG9yeSBpbiB0aGUgc3BlYydzICVzZXR1cCBtYWNyby4KKy0gUmVw bGFjZSBoYXJkLXdpcmVkIHBhdGhzIHdpdGggbWFjcm9zLiBQcmVzZXJ2ZSBhdHRyaWJ1dGVzIHdo ZW4gY29weWluZyBmaWxlcy4KIAogKiBUdWUgU2VwIDE3IDIwMTMgSmFuIGlhbmtrbyBMaWVza292 c2t5IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2 RSIgaHJlZj0ibWFpbHRvOmpsaWVza292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQu Y29tJmd0OzwvYT4gMC4xLTEKIC0gSW5pdGlhbCBGZWRvcmEgU1NHIFJQTS4KPGRpdiBjbGFzcz0i bW96LXR4dC1zaWciPi0tIAoxLjcuMTEuNzwvZGl2PjwvcHJlPgogICAgICA8L2Rpdj4KICAgIDwv YmxvY2txdW90ZT4KICAgIDxicj4KICAgIFJhbiBgbWFrZSBmZWRvcmEtcnBtYCBhbmQgeXVtIGxv Y2FsaW5zdGFsbCwgZXZlcnl0aGluZyAoZmlsZSBwZXJtcywKICAgIGV0YykgY2hlY2sgb3V0LiBB Y2shPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============7531916002194641958==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============8077900994205933626==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [bugfix] Updated RPM spec file Date: Wed, 02 Oct 2013 14:42:11 -0400 Message-ID: <524C6903.10603@redhat.com> In-Reply-To: 1897185981.444612.1380733033296.JavaMail.root@redhat.com --===============8077900994205933626== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 12:57 PM, Jan Lieskovsky wrote: > Hello Shawn, > > as promised, attached is slightly enhanced patch > for RHEL6's spec file it to quieten more rpmlint > warnings: > * spaces 've been replaced with tabs globally, > * removed dot from Summary, > * updated license && group, > * replaced hard-coded paths with rpm macros, > * adjusted defattr rpmlint not to complain about > invalid shebangs. For now kept defattr there > (since other RHEL6 specs do too), but according > to Fedora PackagingGuidelines (section File Permissions): > https://fedoraproject.org/wiki/Packaging:Guidelines?rd=3DPackaging/G= uidelines > > it was necessary only in versions of rpm package > prior to 4.4. Since in RHEL6 there's rpm-4.8.0 currently, > that macro might not be even needed already. > = > * adjusted scap-security-guide manual page definition rpmlint > not to complain about missing %lang. > > The rpmlint output has been reduced to two warnings / errors: > - one about the invalid source - as previously mentioned, > this is not something i can fix. Someone with proper privileges > needs to upload the tarball to pre-agreed https:// location first, > then that location needs to be listed after Source0: section of > the spec file to calm down this warning, We should be able to take care of this today. Something like = https://ssgproject.org/repos/ A few of us are using the gov shutdown as an opportunity to knock out = much needed to-do's. Watch for patches/EMails on this later today! > - the other one about the 'too much recursion / deep loop' > could be quieten by moving the Version and Release information > from the main Makefile into the RHEL6's scap-security-guide.spec > file (and for purpose of their use in the main Makefile > being extracted back from the spec file like Fedora case is doing). > > But since this impacts main Makefile and the way how RHEL6 > versioning would behave, i am gonna to wait with the change > till someone else approves / confirms, fixing this particular > rpmlint warning has higher priority than Version / Release being > in the main Makefile. The RHEL RPM versioning should be updated to align with your (very well = thought out) scheme for Fedora. Please feel free to update this! > * didn't update the changelog entry yet (for case this wouldn't be > the final version). > > Please review. Ack. Thank you for all your help on this! --===============8077900994205933626==-- From fcaviggi at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============3906403950091079961==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Test Date: Wed, 02 Oct 2013 17:43:35 -0400 Message-ID: <20131002214335.GA8120@mail.corp.redhat.com> --===============3906403950091079961== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Test smtp settings. --===============3906403950091079961==-- From leamhall at gmail.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============8094949457331209888==" MIME-Version: 1.0 From: leam hall To: scap-security-guide at lists.fedorahosted.org Subject: Re: Test Date: Wed, 02 Oct 2013 17:47:36 -0400 Message-ID: <524C9478.3060801@gmail.com> In-Reply-To: 20131002214335.GA8120@mail.corp.redhat.com --===============8094949457331209888== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable You passed, but just barely. 71%. :) Leam On 10/02/2013 05:43 PM, Frank Caviggia wrote: > Test smtp settings. > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > -- = http://31challenge.net http://31challenge.net/insight --===============8094949457331209888==-- From luke.t.kordell at lmco.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============2496398008854429546==" MIME-Version: 1.0 From: Kordell, Luke T To: scap-security-guide at lists.fedorahosted.org Subject: RE: EXTERNAL: Re: scan question Date: Thu, 03 Oct 2013 00:04:12 +0000 Message-ID: In-Reply-To: 5248DEF9.3010607@redhat.com --===============2496398008854429546== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, = I double-checked to make sure I added the correct line to the guide.xs= lt file but when I greped the ssg-rhel6=3Dxccdf.xml file it did not return = the usgcb file. I wish I could pull the latest update and patches quickly b= ut am unable to do so with my RHEL machine at the moment. = Basically what I'm trying to do is find a good starting-point for a complet= ely customized profile that calls a particular set of rules I will define. = I think I need to conduct a little more research to make-sure I fully under= stand how to use the scripts to generate OVAL content and how to create a p= rofile. I think I have the rule creation/adding part down. Can you point me= in the right direction? = As always thank you for the assistance! = Luke K = ________________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-g= uide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)re= dhat.com] Sent: Sunday, September 29, 2013 8:16 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: EXTERNAL: Re: scan question On 9/27/13 6:11 PM, Kordell, Luke T wrote: Thank you for responding! I'm actually getting a bunch of unlinked files i= n my output directory. The Make process involves several iterative XSLT transforms, which generate= the unlinked-* files. If you're looking for something usable, they can be = completely ignored. The final content is reflected in the ssg-rhel6-* files under the output/ d= irectory after you do a 'make content'. Alternatively, you could do a 'mak= e dist' which may be easier to consume: [shawn(a)SSG-RHEL6 RHEL6]$ pwd /var/www/html/scap-security-guide/RHEL6 [shawn(a)SSG-RHEL6 RHEL6]$ make dist ...... build process runs ..... [shawn(a)SSG-RHEL6 RHEL6]$ ll dist/ total 12 drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 content drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 guide drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 policytables [shawn(a)SSG-RHEL6 RHEL6]$ ll dist/content/ total 1892 -rw-rw-r--. 1 shawn shawn 600 Sep 29 22:07 ssg-rhel6-cpe-dictionary.xml -rw-rw-r--. 1 shawn shawn 3640 Sep 29 22:07 ssg-rhel6-cpe-oval.xml -rw-rw-r--. 1 shawn shawn 751809 Sep 29 22:07 ssg-rhel6-oval.xml -rw-rw-r--. 1 shawn shawn 1172552 Sep 29 22:07 ssg-rhel6-xccdf.xml Should the usgcb file be usgcb-rhel6-server-xccdf.xml? The profile will be included within ssg-rhel6-xccdf.xml. You could verify t= hat by grepping the ssg-rhel6-xccdf.xml file: $ grep " Note that the USGCB is *very* rough and does not [yet] reflect a comprehens= ive profile. But if people are willing to test it, then it makes sense to b= egin including it... lemme whip up a patch.... Shawn --===============2496398008854429546==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============3375166324918605144==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [bugfix] Updated RPM spec file Date: Wed, 02 Oct 2013 20:28:44 -0400 Message-ID: <524CBA3C.4000200@redhat.com> In-Reply-To: 524C6903.10603@redhat.com --===============3375166324918605144== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 2:42 PM, Shawn Wells wrote: > On 10/2/13 12:57 PM, Jan Lieskovsky wrote: >> Hello Shawn, >> >> as promised, attached is slightly enhanced patch >> for RHEL6's spec file it to quieten more rpmlint >> warnings: >> * spaces 've been replaced with tabs globally, >> * removed dot from Summary, >> * updated license && group, >> * replaced hard-coded paths with rpm macros, >> * adjusted defattr rpmlint not to complain about >> invalid shebangs. For now kept defattr there >> (since other RHEL6 specs do too), but according >> to Fedora PackagingGuidelines (section File Permissions): >> https://fedoraproject.org/wiki/Packaging:Guidelines?rd=3DPackaging/Guide= lines = >> >> >> it was necessary only in versions of rpm package >> prior to 4.4. Since in RHEL6 there's rpm-4.8.0 currently, >> that macro might not be even needed already. >> * adjusted scap-security-guide manual page definition rpmlint >> not to complain about missing %lang. >> >> The rpmlint output has been reduced to two warnings / errors: >> - one about the invalid source - as previously mentioned, >> this is not something i can fix. Someone with proper privileges >> needs to upload the tarball to pre-agreed https:// location first, >> then that location needs to be listed after Source0: section of >> the spec file to calm down this warning, > > We should be able to take care of this today. Something like = > https://ssgproject.org/repos/ > > A few of us are using the gov shutdown as an opportunity to knock out = > much needed to-do's. Watch for patches/EMails on this later today! > >> - the other one about the 'too much recursion / deep loop' >> could be quieten by moving the Version and Release information >> from the main Makefile into the RHEL6's scap-security-guide.spec >> file (and for purpose of their use in the main Makefile >> being extracted back from the spec file like Fedora case is doing). >> >> But since this impacts main Makefile and the way how RHEL6 >> versioning would behave, i am gonna to wait with the change >> till someone else approves / confirms, fixing this particular >> rpmlint warning has higher priority than Version / Release being >> in the main Makefile. > The RHEL RPM versioning should be updated to align with your (very = > well thought out) scheme for Fedora. Please feel free to update this! > >> * didn't update the changelog entry yet (for case this wouldn't be >> the final version). >> >> Please review. > > Ack. > > Thank you for all your help on this! Went ahead and pushed this patch, as I'm tinkering with Koji builds tonight. --===============3375166324918605144== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8yLzEzIDI6NDIgUE0sIFNoYXduIFdlbGxzIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjUyNEM2OTAzLjEwNjAzQHJlZGhhdC5jb20iIHR5cGU9 ImNpdGUiPgogICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4dC1mbG93ZWQiIHN0eWxlPSJmb250LWZh bWlseTogLW1vei1maXhlZDsKICAgICAgICBmb250LXNpemU6IDEycHg7IiBsYW5nPSJ4LXVuaWNv ZGUiPk9uIDEwLzIvMTMgMTI6NTcgUE0sIEphbgogICAgICAgIExpZXNrb3Zza3kgd3JvdGU6CiAg ICAgICAgPGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIHN0eWxlPSJjb2xvcjog IzAwMDAwMDsiPkhlbGxvIFNoYXduLAogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAg ICAgICAgwqDCoCBhcyBwcm9taXNlZCwgYXR0YWNoZWQgaXMgc2xpZ2h0bHkgZW5oYW5jZWQgcGF0 Y2gKICAgICAgICAgIDxicj4KICAgICAgICAgIGZvciBSSEVMNidzIHNwZWMgZmlsZSBpdCB0byBx dWlldGVuIG1vcmUgcnBtbGludAogICAgICAgICAgPGJyPgogICAgICAgICAgd2FybmluZ3M6CiAg ICAgICAgICA8YnI+CiAgICAgICAgICAqIHNwYWNlcyAndmUgYmVlbiByZXBsYWNlZCB3aXRoIHRh YnMgZ2xvYmFsbHksCiAgICAgICAgICA8YnI+CiAgICAgICAgICAqIHJlbW92ZWQgZG90IGZyb20g U3VtbWFyeSwKICAgICAgICAgIDxicj4KICAgICAgICAgICogdXBkYXRlZCBsaWNlbnNlICZhbXA7 JmFtcDsgZ3JvdXAsCiAgICAgICAgICA8YnI+CiAgICAgICAgICAqIHJlcGxhY2VkIGhhcmQtY29k ZWQgcGF0aHMgd2l0aCBycG0gbWFjcm9zLAogICAgICAgICAgPGJyPgogICAgICAgICAgKiBhZGp1 c3RlZCBkZWZhdHRyIHJwbWxpbnQgbm90IHRvIGNvbXBsYWluIGFib3V0CiAgICAgICAgICA8YnI+ CiAgICAgICAgICDCoMKgIGludmFsaWQgc2hlYmFuZ3MuIEZvciBub3cga2VwdCBkZWZhdHRyIHRo ZXJlCiAgICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIChzaW5jZSBvdGhlciBSSEVMNiBzcGVj cyBkbyB0b28pLCBidXQgYWNjb3JkaW5nCiAgICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIHRv IEZlZG9yYSBQYWNrYWdpbmdHdWlkZWxpbmVzIChzZWN0aW9uIEZpbGUgUGVybWlzc2lvbnMpOgog ICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoMKgwqAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVl IiBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgpocmVmPSJodHRwczovL2ZlZG9yYXByb2pl Y3Qub3JnL3dpa2kvUGFja2FnaW5nOkd1aWRlbGluZXM/cmQ9UGFja2FnaW5nL0d1aWRlbGluZXMi Pmh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9QYWNrYWdpbmc6R3VpZGVsaW5lcz9yZD1Q YWNrYWdpbmcvR3VpZGVsaW5lczwvYT4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAg ICAgICAgIMKgwqAgaXQgd2FzIG5lY2Vzc2FyeSBvbmx5IGluIHZlcnNpb25zIG9mIHJwbSBwYWNr YWdlCiAgICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIHByaW9yIHRvIDQuNC4gU2luY2UgaW4g UkhFTDYgdGhlcmUncyBycG0tNC44LjAgY3VycmVudGx5LAogICAgICAgICAgPGJyPgogICAgICAg ICAgwqDCoCB0aGF0IG1hY3JvIG1pZ2h0IG5vdCBiZSBldmVuIG5lZWRlZCBhbHJlYWR5LgogICAg ICAgICAgPGJyPgogICAgICAgICAgwqDCoCAqIGFkanVzdGVkIHNjYXAtc2VjdXJpdHktZ3VpZGUg bWFudWFsIHBhZ2UgZGVmaW5pdGlvbgogICAgICAgICAgcnBtbGludAogICAgICAgICAgPGJyPgog ICAgICAgICAgwqDCoCBub3QgdG8gY29tcGxhaW4gYWJvdXQgbWlzc2luZyAlbGFuZy4KICAgICAg ICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIFRoZSBycG1saW50IG91dHB1dCBoYXMg YmVlbiByZWR1Y2VkIHRvIHR3byB3YXJuaW5ncyAvIGVycm9yczoKICAgICAgICAgIDxicj4KICAg ICAgICAgIC0gb25lIGFib3V0IHRoZSBpbnZhbGlkIHNvdXJjZSAtIGFzIHByZXZpb3VzbHkgbWVu dGlvbmVkLAogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCB0aGlzIGlzIG5vdCBzb21ldGhp bmcgaSBjYW4gZml4LiBTb21lb25lIHdpdGggcHJvcGVyCiAgICAgICAgICBwcml2aWxlZ2VzCiAg ICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIG5lZWRzIHRvIHVwbG9hZCB0aGUgdGFyYmFsbCB0 byBwcmUtYWdyZWVkIDxhCiAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9 Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgaHJlZj0iaHR0cHM6Ly8iPmh0dHBz Oi8vPC9hPiBsb2NhdGlvbiBmaXJzdCwKICAgICAgICAgIDxicj4KICAgICAgICAgIMKgwqAgdGhl biB0aGF0IGxvY2F0aW9uIG5lZWRzIHRvIGJlIGxpc3RlZCBhZnRlciBTb3VyY2UwOgogICAgICAg ICAgc2VjdGlvbiBvZgogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCB0aGUgc3BlYyBmaWxl IHRvIGNhbG0gZG93biB0aGlzIHdhcm5pbmcsCiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgIDxicj4KICAgICAgICBXZSBzaG91bGQgYmUgYWJsZSB0byB0YWtlIGNh cmUgb2YgdGhpcyB0b2RheS4gU29tZXRoaW5nIGxpa2UgPGEKICAgICAgICAgIG1vei1kby1ub3Qt c2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgIGhyZWY9 Imh0dHBzOi8vc3NncHJvamVjdC5vcmcvcmVwb3MvIj5odHRwczovL3NzZ3Byb2plY3Qub3JnL3Jl cG9zLzwvYT4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIEEgZmV3IG9mIHVzIGFy ZSB1c2luZyB0aGUgZ292IHNodXRkb3duIGFzIGFuIG9wcG9ydHVuaXR5IHRvCiAgICAgICAga25v Y2sgb3V0IG11Y2ggbmVlZGVkIHRvLWRvJ3MuIFdhdGNoIGZvciBwYXRjaGVzL0VNYWlscyBvbiB0 aGlzCiAgICAgICAgbGF0ZXIgdG9kYXkhCiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAg ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBzdHlsZT0iY29sb3I6ICMwMDAwMDA7Ij4tIHRoZSBv dGhlciBvbmUKICAgICAgICAgIGFib3V0IHRoZSAndG9vIG11Y2ggcmVjdXJzaW9uIC8gZGVlcCBs b29wJwogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCBjb3VsZCBiZSBxdWlldGVuIGJ5IG1v dmluZyB0aGUgVmVyc2lvbiBhbmQgUmVsZWFzZQogICAgICAgICAgaW5mb3JtYXRpb24KICAgICAg ICAgIDxicj4KICAgICAgICAgIMKgwqAgZnJvbSB0aGUgbWFpbiBNYWtlZmlsZSBpbnRvIHRoZSBS SEVMNidzCiAgICAgICAgICBzY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKICAgICAgICAgIDxicj4K ICAgICAgICAgIMKgwqAgZmlsZSAoYW5kIGZvciBwdXJwb3NlIG9mIHRoZWlyIHVzZSBpbiB0aGUg bWFpbiBNYWtlZmlsZQogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCBiZWluZyBleHRyYWN0 ZWQgYmFjayBmcm9tIHRoZSBzcGVjIGZpbGUgbGlrZSBGZWRvcmEgY2FzZSBpcwogICAgICAgICAg ZG9pbmcpLgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCBCdXQg c2luY2UgdGhpcyBpbXBhY3RzIG1haW4gTWFrZWZpbGUgYW5kIHRoZSB3YXkgaG93IFJIRUw2CiAg ICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIHZlcnNpb25pbmcgd291bGQgYmVoYXZlLCBpIGFt IGdvbm5hIHRvIHdhaXQgd2l0aCB0aGUgY2hhbmdlCiAgICAgICAgICA8YnI+CiAgICAgICAgICDC oMKgIHRpbGwgc29tZW9uZSBlbHNlIGFwcHJvdmVzIC8gY29uZmlybXMsIGZpeGluZyB0aGlzCiAg ICAgICAgICBwYXJ0aWN1bGFyCiAgICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIHJwbWxpbnQg d2FybmluZyBoYXMgaGlnaGVyIHByaW9yaXR5IHRoYW4gVmVyc2lvbiAvIFJlbGVhc2UKICAgICAg ICAgIGJlaW5nCiAgICAgICAgICA8YnI+CiAgICAgICAgICDCoMKgIGluIHRoZSBtYWluIE1ha2Vm aWxlLgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICBUaGUgUkhF TCBSUE0gdmVyc2lvbmluZyBzaG91bGQgYmUgdXBkYXRlZCB0byBhbGlnbiB3aXRoIHlvdXIKICAg ICAgICAodmVyeSB3ZWxsIHRob3VnaHQgb3V0KSBzY2hlbWUgZm9yIEZlZG9yYS4gUGxlYXNlIGZl ZWwgZnJlZSB0bwogICAgICAgIHVwZGF0ZSB0aGlzIQogICAgICAgIDxicj4KICAgICAgICA8YnI+ CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgc3R5bGU9ImNvbG9yOiAjMDAwMDAwOyI+ KiBkaWRuJ3QgdXBkYXRlCiAgICAgICAgICB0aGUgY2hhbmdlbG9nIGVudHJ5IHlldCAoZm9yIGNh c2UgdGhpcyB3b3VsZG4ndCBiZQogICAgICAgICAgPGJyPgogICAgICAgICAgwqDCoCB0aGUgZmlu YWwgdmVyc2lvbikuCiAgICAgICAgICA8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBQbGVh c2UgcmV2aWV3LgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8 YnI+CiAgICAgICAgQWNrLgogICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgVGhhbmsg eW91IGZvciBhbGwgeW91ciBoZWxwIG9uIHRoaXMhIDxicj4KICAgICAgPC9kaXY+CiAgICA8L2Js b2NrcXVvdGU+CiAgICA8YnI+CiAgICBXZW50IGFoZWFkIGFuZCBwdXNoZWQgdGhpcyBwYXRjaCwg YXMgSSdtIHRpbmtlcmluZyB3aXRoIEtvamkgYnVpbGRzCiAgICB0b25pZ2h0Ljxicj4KICA8L2Jv ZHk+CjwvaHRtbD4K --===============3375166324918605144==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============0597366003247767933==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 1/2] [Fedora] New rpm versioning scheme - set proper name of the build directory Date: Wed, 02 Oct 2013 21:26:20 -0400 Message-ID: <524CC7BC.6070903@redhat.com> In-Reply-To: 524C5EA0.7000602@redhat.com --===============0597366003247767933== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 1:57 PM, Shawn Wells wrote: > On 10/2/13 10:45 AM, Jan Lieskovsky wrote: >> Upstream commit c5229573e4b4aaf090d7bf8cfd25a40793ce0c12 >> introduced a change in the way how Fedora tarball is created >> (before it was created according to the scheme pkg_name-pkg_version.tar.= gz, >> now it's created in pkg_name-pkg_version-fedora_ssg_release.tar.gz >> form). >> >> Without the attached patch it was not possible to properly >> generate Fedora RPM package (since %setup macro without >> build directory name [option -n] assumes the build directory >> to have a form of pkg_name-pkg_version: >> http://www.rpm.org/max-rpm/s1-rpm-inside-macros.html >> >> Thus fix the deficiency by setting proper name of the build directory. >> >> Thank you && Regards, Jan. >> -- >> Jan iankko Lieskovsky / Red Hat Security Technologies Team >> >> 0001-Fedora-New-rpm-versioning-scheme-set-proper-name-of-.patch >> >> >> From 826079734a136502cce5378a89f026049d337a7d Mon Sep 17 00:00:00 2001 >> From: Jan Lieskovsky >> Date: Wed, 2 Oct 2013 14:43:11 +0200 >> Subject: [PATCH 1/2] [Fedora] New rpm versioning scheme - set proper nam= e of >> the build directory >> >> >> Signed-off-by: Jan Lieskovsky >> --- >> Fedora/scap-security-guide.spec | 7 +++++-- >> 1 file changed, 5 insertions(+), 2 deletions(-) >> >> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guid= e.spec >> index e91d955..a323749 100644 >> --- a/Fedora/scap-security-guide.spec >> +++ b/Fedora/scap-security-guide.spec >> @@ -5,7 +5,7 @@ >> # file one level up - in the main scap-security-guide directory (inste= ad of >> # this one). >> = >> -%global fedorassgrelease 1 >> +%global fedorassgrelease 2.rc1 >> = >> Name: scap-security-guide >> Version: 0.1 >> @@ -27,7 +27,7 @@ catalog of practical hardening advice and links it to = government requirements >> where applicable. The project bridges the gap between generalized poli= cy >> requirements and specific implementation guidance. >> %prep >> -%setup -q >> +%setup -q -n %{name}-%{version}-%{fedorassgrelease} >> = >> = >> %build >> @@ -51,5 +51,8 @@ rm -rf $RPM_BUILD_ROOT >> /usr/share/xml/scap/ssg/fedora/19/* >> = >> %changelog >> +* Wed Oct 02 2013 Jan iankko Lieskovsky 0.1-2.r= c1 >> +- Set proper name of the build directory in the spec's %setup macro. >> + >> * Tue Sep 17 2013 Jan iankko Lieskovsky 0.1-1 >> - Initial Fedora SSG RPM. >> -- 1.7.11.7 > > Ack As I'm playing with mock builds, I went ahead and pushed this: $ git commit Fedora/scap-security-guide.spec [master af11d6a] [Fedora] New rpm versioning scheme - set proper name of = the build directory = https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-October/0= 04205.html 1 files changed, 5 insertions(+), 2 deletions(-) $ git push Counting objects: 7, done. Delta compression using up to 2 threads. Compressing objects: 100% (4/4), done. Writing objects: 100% (4/4), 567 bytes, done. Total 4 (delta 3), reused 0 (delta 0) To ssh://shawndwells(a)git.fedorahosted.org/git/scap-security-guide.git 42ec0c8..af11d6a master -> master --===============0597366003247767933== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8yLzEzIDE6NTcgUE0sIFNoYXduIFdlbGxzIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjUyNEM1RUEwLjcwMDA2MDJAcmVkaGF0LmNvbSIgdHlw ZT0iY2l0ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LWh0bWwiIGxhbmc9IngtdW5pY29k ZSI+CiAgICAgICAgPG1ldGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IgogICAg ICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICAgICAgICA8ZGl2IGNsYXNzPSJtb3ot Y2l0ZS1wcmVmaXgiPk9uIDEwLzIvMTMgMTA6NDUgQU0sIEphbiBMaWVza292c2t5CiAgICAgICAg ICB3cm90ZTo8YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAg IGNpdGU9Im1pZDoyMTI1ODM4MjEzLjM2MzIxNi4xMzgwNzI1MTAyNjYzLkphdmFNYWlsLnJvb3RA cmVkaGF0LmNvbSIKICAgICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgPGRpdiBjbGFzcz0i bW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIKICAgICAg ICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNpemU6IDEycHg7Igog ICAgICAgICAgICBsYW5nPSJ4LXVuaWNvZGUiPgogICAgICAgICAgICA8cHJlIHdyYXA9IiI+VXBz dHJlYW0gY29tbWl0IGM1MjI5NTczZTRiNGFhZjA5MGQ3YmY4Y2ZkMjVhNDA3OTNjZTBjMTIKaW50 cm9kdWNlZCBhIGNoYW5nZSBpbiB0aGUgd2F5IGhvdyBGZWRvcmEgdGFyYmFsbCBpcyBjcmVhdGVk CihiZWZvcmUgaXQgd2FzIGNyZWF0ZWQgYWNjb3JkaW5nIHRvIHRoZSBzY2hlbWUgcGtnX25hbWUt cGtnX3ZlcnNpb24udGFyLmd6LApub3cgaXQncyBjcmVhdGVkIGluIHBrZ19uYW1lLXBrZ192ZXJz aW9uLWZlZG9yYV9zc2dfcmVsZWFzZS50YXIuZ3oKZm9ybSkuCgpXaXRob3V0IHRoZSBhdHRhY2hl ZCBwYXRjaCBpdCB3YXMgbm90IHBvc3NpYmxlIHRvIHByb3Blcmx5CmdlbmVyYXRlIEZlZG9yYSBS UE0gcGFja2FnZSAoc2luY2UgJXNldHVwIG1hY3JvIHdpdGhvdXQKYnVpbGQgZGlyZWN0b3J5IG5h bWUgW29wdGlvbiAtbl0gYXNzdW1lcyB0aGUgYnVpbGQgZGlyZWN0b3J5CnRvIGhhdmUgYSBmb3Jt IG9mIHBrZ19uYW1lLXBrZ192ZXJzaW9uOgogIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cDovL3d3dy5ycG0ub3JnL21heC1y cG0vczEtcnBtLWluc2lkZS1tYWNyb3MuaHRtbCI+aHR0cDovL3d3dy5ycG0ub3JnL21heC1ycG0v czEtcnBtLWluc2lkZS1tYWNyb3MuaHRtbDwvYT4KClRodXMgZml4IHRoZSBkZWZpY2llbmN5IGJ5 IHNldHRpbmcgcHJvcGVyIG5hbWUgb2YgdGhlIGJ1aWxkIGRpcmVjdG9yeS4KClRoYW5rIHlvdSAm YW1wOyZhbXA7IFJlZ2FyZHMsIEphbi4KLS0KSmFuIGlhbmtrbyBMaWVza292c2t5IC8gUmVkIEhh dCBTZWN1cml0eSBUZWNobm9sb2dpZXMgVGVhbQo8L3ByZT4KICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgPGJyPgogICAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRl ciI+PGxlZ2VuZAogICAgICAgICAgICAgIGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlck5hbWUi PjAwMDEtRmVkb3JhLU5ldy1ycG0tdmVyc2lvbmluZy1zY2hlbWUtc2V0LXByb3Blci1uYW1lLW9m LS5wYXRjaDwvbGVnZW5kPjwvZmllbGRzZXQ+CiAgICAgICAgICA8YnI+CiAgICAgICAgICA8ZGl2 IGNsYXNzPSJtb3otdGV4dC1wbGFpbiIgd3JhcD0idHJ1ZSIgZ3JhcGhpY2FsLXF1b3RlPSJ0cnVl IgogICAgICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTog MTJweDsiCiAgICAgICAgICAgIGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgICAgIDxwcmUgd3Jh cD0iIj5Gcm9tIDgyNjA3OTczNGExMzY1MDJjY2U1Mzc4YTg5ZjAyNjA0OWQzMzdhN2QgTW9uIFNl cCAxNyAwMDowMDowMCAyMDAxCkZyb206IEphbiBMaWVza292c2t5IDxhIG1vei1kby1ub3Qtc2Vu ZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmpsaWVz a292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4KRGF0ZTogV2Vk LCAyIE9jdCAyMDEzIDE0OjQzOjExICswMjAwClN1YmplY3Q6IFtQQVRDSCAxLzJdIFtGZWRvcmFd IE5ldyBycG0gdmVyc2lvbmluZyBzY2hlbWUgLSBzZXQgcHJvcGVyIG5hbWUgb2YKIHRoZSBidWls ZCBkaXJlY3RvcnkKCgpTaWduZWQtb2ZmLWJ5OiBKYW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90 LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpq bGllc2tvdkByZWRoYXQuY29tIj4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+Ci0tLQog RmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyB8IDcgKysrKystLQogMSBmaWxlIGNoYW5n ZWQsIDUgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9GZWRvcmEv c2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjIGIvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3Bl YwppbmRleCBlOTFkOTU1Li5hMzIzNzQ5IDEwMDY0NAotLS0gYS9GZWRvcmEvc2NhcC1zZWN1cml0 eS1ndWlkZS5zcGVjCisrKyBiL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKQEAgLTUs NyArNSw3IEBACiAjIGZpbGUgb25lIGxldmVsIHVwIC0gaW4gdGhlIG1haW4gc2NhcC1zZWN1cml0 eS1ndWlkZSBkaXJlY3RvcnkgKGluc3RlYWQgb2YKICMgdGhpcyBvbmUpLgogCi0lZ2xvYmFsCWZl ZG9yYXNzZ3JlbGVhc2UJMQorJWdsb2JhbAlmZWRvcmFzc2dyZWxlYXNlCTIucmMxCiAKIE5hbWU6 CQlzY2FwLXNlY3VyaXR5LWd1aWRlCiBWZXJzaW9uOgkwLjEKQEAgLTI3LDcgKzI3LDcgQEAgY2F0 YWxvZyBvZiBwcmFjdGljYWwgaGFyZGVuaW5nIGFkdmljZSBhbmQgbGlua3MgaXQgdG8gZ292ZXJu bWVudCByZXF1aXJlbWVudHMKIHdoZXJlIGFwcGxpY2FibGUuIFRoZSBwcm9qZWN0IGJyaWRnZXMg dGhlIGdhcCBiZXR3ZWVuIGdlbmVyYWxpemVkIHBvbGljeQogcmVxdWlyZW1lbnRzIGFuZCBzcGVj aWZpYyBpbXBsZW1lbnRhdGlvbiBndWlkYW5jZS4KICVwcmVwCi0lc2V0dXAgLXEKKyVzZXR1cCAt cSAtbiAle25hbWV9LSV7dmVyc2lvbn0tJXtmZWRvcmFzc2dyZWxlYXNlfQogCiAKICVidWlsZApA QCAtNTEsNSArNTEsOCBAQCBybSAtcmYgJFJQTV9CVUlMRF9ST09UCiAvdXNyL3NoYXJlL3htbC9z Y2FwL3NzZy9mZWRvcmEvMTkvKgogCiAlY2hhbmdlbG9nCisqIFdlZCBPY3QgMDIgMjAxMyBKYW4g aWFua2tvIExpZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4 dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2ps aWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPiAwLjEtMi5yYzEKKy0gU2V0IHByb3BlciBuYW1lIG9m IHRoZSBidWlsZCBkaXJlY3RvcnkgaW4gdGhlIHNwZWMncyAlc2V0dXAgbWFjcm8uCisKICogVHVl IFNlcCAxNyAyMDEzIEphbiBpYW5ra28gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRy dWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkBy ZWRoYXQuY29tIj4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+IDAuMS0xCiAtIEluaXRp YWwgRmVkb3JhIFNTRyBSUE0uCjxkaXYgY2xhc3M9Im1vei10eHQtc2lnIj4tLSAKMS43LjExLjcK CjwvZGl2PjwvcHJlPgogICAgICAgICAgPC9kaXY+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgIDxicj4KICAgICAgICBBY2s8YnI+CiAgICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3RlPgog ICAgPGJyPgogICAgQXMgSSdtIHBsYXlpbmcgd2l0aCBtb2NrIGJ1aWxkcywgSSB3ZW50IGFoZWFk IGFuZCBwdXNoZWQgdGhpczo8YnI+CiAgICA8YnI+CiAgICAkIGdpdCBjb21taXQgRmVkb3JhL3Nj YXAtc2VjdXJpdHktZ3VpZGUuc3BlYyA8YnI+CiAgICBbbWFzdGVyIGFmMTFkNmFdIFtGZWRvcmFd IE5ldyBycG0gdmVyc2lvbmluZyBzY2hlbWUgLSBzZXQgcHJvcGVyCiAgICBuYW1lIG9mIHRoZSBi dWlsZCBkaXJlY3RvcnkKPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0 cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL3BpcGVybWFpbC9zY2FwLXNlY3VyaXR5LWd1aWRl LzIwMTMtT2N0b2Jlci8wMDQyMDUuaHRtbCI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3Jn L3BpcGVybWFpbC9zY2FwLXNlY3VyaXR5LWd1aWRlLzIwMTMtT2N0b2Jlci8wMDQyMDUuaHRtbDwv YT48YnI+CiAgICDCoDEgZmlsZXMgY2hhbmdlZCwgNSBpbnNlcnRpb25zKCspLCAyIGRlbGV0aW9u cygtKTxicj4KICAgIDxicj4KICAgICQgZ2l0IHB1c2g8YnI+CiAgICBDb3VudGluZyBvYmplY3Rz OiA3LCBkb25lLjxicj4KICAgIERlbHRhIGNvbXByZXNzaW9uIHVzaW5nIHVwIHRvIDIgdGhyZWFk cy48YnI+CiAgICBDb21wcmVzc2luZyBvYmplY3RzOiAxMDAlICg0LzQpLCBkb25lLjxicj4KICAg IFdyaXRpbmcgb2JqZWN0czogMTAwJSAoNC80KSwgNTY3IGJ5dGVzLCBkb25lLjxicj4KICAgIFRv dGFsIDQgKGRlbHRhIDMpLCByZXVzZWQgMCAoZGVsdGEgMCk8YnI+CiAgICBUbwogICAgPGEgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ic3NoOi8vc2hhd25kd2VsbHNAZ2l0LmZl ZG9yYWhvc3RlZC5vcmcvZ2l0L3NjYXAtc2VjdXJpdHktZ3VpZGUuZ2l0Ij5zc2g6Ly9zaGF3bmR3 ZWxsc0BnaXQuZmVkb3JhaG9zdGVkLm9yZy9naXQvc2NhcC1zZWN1cml0eS1ndWlkZS5naXQ8L2E+ PGJyPgogICAgwqDCoCA0MmVjMGM4Li5hZjExZDZhwqAgbWFzdGVyIC0mZ3Q7IG1hc3Rlcjxicj4K ICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============0597366003247767933==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============8716274582936904055==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 2/2] Fedora spec - replace hard-wired paths with macros. Preserve attributes when copying files. Date: Wed, 02 Oct 2013 21:41:29 -0400 Message-ID: <524CCB49.40501@redhat.com> In-Reply-To: 524C5EEB.4090609@redhat.com --===============8716274582936904055== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 1:59 PM, Shawn Wells wrote: > On 10/2/13 10:50 AM, Jan Lieskovsky wrote: >> According to: >> http://fedoraproject.org/wiki/Common_Rpmlint_issues >> >> hard-coded paths should be avoided in *.spec file: >> https://fedoraproject.org/wiki/Packaging:RPMMacros?rd=3DPackaging/RPM= Macros >> >> Also, while copying files file attributes should be preserved: >> https://fedoraproject.org/wiki/Packaging:Guidelines#Timestamps >> >> Therefore fix both issues in Fedora's spec file. >> >> Thank you && Regards, Jan. >> -- >> Jan iankko Lieskovsky / Red Hat Security Technologies Team >> >> 0002-Fedora-spec-replace-hard-wired-paths-with-macros.-Pr.patch >> >> >> From 21df0dc9b8b3b1d303985a00b94f2baedf306d2b Mon Sep 17 00:00:00 2001 >> From: Jan Lieskovsky >> Date: Wed, 2 Oct 2013 16:03:02 +0200 >> Subject: [PATCH 2/2] Fedora spec - replace hard-wired paths with macros. >> Preserve attributes when copying files. >> >> >> Signed-off-by: Jan Lieskovsky >> --- >> Fedora/scap-security-guide.spec | 8 ++++---- >> 1 file changed, 4 insertions(+), 4 deletions(-) >> >> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guid= e.spec >> index a323749..4ef3713 100644 >> --- a/Fedora/scap-security-guide.spec >> +++ b/Fedora/scap-security-guide.spec >> @@ -36,11 +36,10 @@ cd Fedora && make dist >> = >> %install >> rm -rf $RPM_BUILD_ROOT >> -mkdir -p $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19 >> +mkdir -p $RPM_BUILD_ROOT%{_datadir}/xml/scap/ssg/fedora/19 >> = >> # Add in core content (SCAP, guide) >> -cp -r Fedora/dist/* $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19 >> - >> +cp -a Fedora/dist/* $RPM_BUILD_ROOT%{_datadir}/xml/scap/ssg/fedora/19 >> = >> %clean >> rm -rf $RPM_BUILD_ROOT >> @@ -48,11 +47,12 @@ rm -rf $RPM_BUILD_ROOT >> = >> %files >> %defattr(-,root,root,-) >> -/usr/share/xml/scap/ssg/fedora/19/* >> +%{_datadir}/xml/scap/ssg/fedora/19/* >> = >> %changelog >> * Wed Oct 02 2013 Jan iankko Lieskovsky 0.1-2.= rc1 >> - Set proper name of the build directory in the spec's %setup macro. >> +- Replace hard-wired paths with macros. Preserve attributes when copyin= g files. >> = >> * Tue Sep 17 2013 Jan iankko Lieskovsky 0.1-1 >> - Initial Fedora SSG RPM. >> -- 1.7.11.7 > > Ran `make fedora-rpm` and yum localinstall, everything (file perms, = > etc) check out. Ack! Pushed this too: $ git apply /tmp/j2.patch [shawn(a)SSG-RHEL6 scap-security-guide]$ git commit = Fedora/scap-security-guide.spec [master 37de67c] Fedora spec - replace hard-wired paths with macros. = Preserve attributes when copying files. 1 files changed, 4 insertions(+), 4 deletions(-) [shawn(a)SSG-RHEL6 scap-security-guide]$ git push Counting objects: 7, done. Delta compression using up to 2 threads. Compressing objects: 100% (4/4), done. Writing objects: 100% (4/4), 621 bytes, done. Total 4 (delta 3), reused 0 (delta 0) To ssh://shawndwells(a)git.fedorahosted.org/git/scap-security-guide.git af11d6a..37de67c master -> master --===============8716274582936904055== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8yLzEzIDE6NTkgUE0sIFNoYXduIFdlbGxzIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjUyNEM1RUVCLjQwOTA2MDlAcmVkaGF0LmNvbSIgdHlw ZT0iY2l0ZSI+CiAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCIg aHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJl Zml4Ij5PbiAxMC8yLzEzIDEwOjUwIEFNLCBKYW4gTGllc2tvdnNreQogICAgICAgIHdyb3RlOjxi cj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3RlCiAgICAgICAgY2l0ZT0ibWlkOjIwNDI5 MzI2NTguMzY1NTc0LjEzODA3MjU0MDMzMzkuSmF2YU1haWwucm9vdEByZWRoYXQuY29tIgogICAg ICAgIHR5cGU9ImNpdGUiPgogICAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFw PSJ0cnVlIiBncmFwaGljYWwtcXVvdGU9InRydWUiCiAgICAgICAgICBzdHlsZT0iZm9udC1mYW1p bHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgICBsYW5nPSJ4LXVuaWNv ZGUiPgogICAgICAgICAgPHByZSB3cmFwPSIiPkFjY29yZGluZyB0bzoKICA8YSBtb3otZG8tbm90 LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9m ZWRvcmFwcm9qZWN0Lm9yZy93aWtpL0NvbW1vbl9ScG1saW50X2lzc3VlcyI+aHR0cDovL2ZlZG9y YXByb2plY3Qub3JnL3dpa2kvQ29tbW9uX1JwbWxpbnRfaXNzdWVzPC9hPgoKaGFyZC1jb2RlZCBw YXRocyBzaG91bGQgYmUgYXZvaWRlZCBpbiAqLnNwZWMgZmlsZToKICA8YSBtb3otZG8tbm90LXNl bmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vZmVk b3JhcHJvamVjdC5vcmcvd2lraS9QYWNrYWdpbmc6UlBNTWFjcm9zP3JkPVBhY2thZ2luZy9SUE1N YWNyb3MiPmh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9QYWNrYWdpbmc6UlBNTWFjcm9z P3JkPVBhY2thZ2luZy9SUE1NYWNyb3M8L2E+CgpBbHNvLCB3aGlsZSBjb3B5aW5nIGZpbGVzIGZp bGUgYXR0cmlidXRlcyBzaG91bGQgYmUgcHJlc2VydmVkOgogIDxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9mZWRvcmFw cm9qZWN0Lm9yZy93aWtpL1BhY2thZ2luZzpHdWlkZWxpbmVzI1RpbWVzdGFtcHMiPmh0dHBzOi8v ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9QYWNrYWdpbmc6R3VpZGVsaW5lcyNUaW1lc3RhbXBzPC9h PgoKVGhlcmVmb3JlIGZpeCBib3RoIGlzc3VlcyBpbiBGZWRvcmEncyBzcGVjIGZpbGUuCgpUaGFu ayB5b3UgJmFtcDsmYW1wOyBSZWdhcmRzLCBKYW4uCi0tCkphbiBpYW5ra28gTGllc2tvdnNreSAv IFJlZCBIYXQgU2VjdXJpdHkgVGVjaG5vbG9naWVzIFRlYW08L3ByZT4KICAgICAgICA8L2Rpdj4K ICAgICAgICA8YnI+CiAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRl ciI+PGxlZ2VuZAogICAgICAgICAgICBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXJOYW1lIj4w MDAyLUZlZG9yYS1zcGVjLXJlcGxhY2UtaGFyZC13aXJlZC1wYXRocy13aXRoLW1hY3Jvcy4tUHIu cGF0Y2g8L2xlZ2VuZD48L2ZpZWxkc2V0PgogICAgICAgIDxicj4KICAgICAgICA8ZGl2IGNsYXNz PSJtb3otdGV4dC1wbGFpbiIgd3JhcD0idHJ1ZSIgZ3JhcGhpY2FsLXF1b3RlPSJ0cnVlIgogICAg ICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNpemU6IDEycHg7Igog ICAgICAgICAgbGFuZz0ieC13ZXN0ZXJuIj4KICAgICAgICAgIDxwcmUgd3JhcD0iIj5Gcm9tIDIx ZGYwZGM5YjhiM2IxZDMwMzk4NWEwMGI5NGYyYmFlZGYzMDZkMmIgTW9uIFNlcCAxNyAwMDowMDow MCAyMDAxCkZyb206IEphbiBMaWVza292c2t5IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmpsaWVza292QHJlZGhhdC5j b20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4KRGF0ZTogV2VkLCAyIE9jdCAyMDEz IDE2OjAzOjAyICswMjAwClN1YmplY3Q6IFtQQVRDSCAyLzJdIEZlZG9yYSBzcGVjIC0gcmVwbGFj ZSBoYXJkLXdpcmVkIHBhdGhzIHdpdGggbWFjcm9zLgogUHJlc2VydmUgYXR0cmlidXRlcyB3aGVu IGNvcHlpbmcgZmlsZXMuCgoKU2lnbmVkLW9mZi1ieTogSmFuIExpZXNrb3Zza3kgPGEgbW96LWRv LW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWls dG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2psaWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPgot LS0KIEZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgfCA4ICsrKystLS0tCiAxIGZpbGUg Y2hhbmdlZCwgNCBpbnNlcnRpb25zKCspLCA0IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL0Zl ZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgYi9GZWRvcmEvc2NhcC1zZWN1cml0eS1ndWlk ZS5zcGVjCmluZGV4IGEzMjM3NDkuLjRlZjM3MTMgMTAwNjQ0Ci0tLSBhL0ZlZG9yYS9zY2FwLXNl Y3VyaXR5LWd1aWRlLnNwZWMKKysrIGIvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYwpA QCAtMzYsMTEgKzM2LDEwIEBAIGNkIEZlZG9yYSAmYW1wOyZhbXA7IG1ha2UgZGlzdAogCiAlaW5z dGFsbAogcm0gLXJmICRSUE1fQlVJTERfUk9PVAotbWtkaXIgLXAgJFJQTV9CVUlMRF9ST09UL3Vz ci9zaGFyZS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5Citta2RpciAtcCAkUlBNX0JVSUxEX1JPT1Ql e19kYXRhZGlyfS94bWwvc2NhcC9zc2cvZmVkb3JhLzE5CiAKICMgQWRkIGluIGNvcmUgY29udGVu dCAoU0NBUCwgZ3VpZGUpCi1jcCAtciBGZWRvcmEvZGlzdC8qICRSUE1fQlVJTERfUk9PVC91c3Iv c2hhcmUveG1sL3NjYXAvc3NnL2ZlZG9yYS8xOQotCitjcCAtYSBGZWRvcmEvZGlzdC8qICRSUE1f QlVJTERfUk9PVCV7X2RhdGFkaXJ9L3htbC9zY2FwL3NzZy9mZWRvcmEvMTkKIAogJWNsZWFuCiBy bSAtcmYgJFJQTV9CVUlMRF9ST09UCkBAIC00OCwxMSArNDcsMTIgQEAgcm0gLXJmICRSUE1fQlVJ TERfUk9PVAogCiAlZmlsZXMKICVkZWZhdHRyKC0scm9vdCxyb290LC0pCi0vdXNyL3NoYXJlL3ht bC9zY2FwL3NzZy9mZWRvcmEvMTkvKgorJXtfZGF0YWRpcn0veG1sL3NjYXAvc3NnL2ZlZG9yYS8x OS8qCiAKICVjaGFuZ2Vsb2cKICogV2VkIE9jdCAwMiAyMDEzIEphbiBpYW5ra28gTGllc2tvdnNr eSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUi IGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29tIj4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNv bSZndDs8L2E+IDAuMS0yLnJjMQogLSBTZXQgcHJvcGVyIG5hbWUgb2YgdGhlIGJ1aWxkIGRpcmVj dG9yeSBpbiB0aGUgc3BlYydzICVzZXR1cCBtYWNyby4KKy0gUmVwbGFjZSBoYXJkLXdpcmVkIHBh dGhzIHdpdGggbWFjcm9zLiBQcmVzZXJ2ZSBhdHRyaWJ1dGVzIHdoZW4gY29weWluZyBmaWxlcy4K IAogKiBUdWUgU2VwIDE3IDIwMTMgSmFuIGlhbmtrbyBMaWVza292c2t5IDxhIG1vei1kby1ub3Qt c2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmps aWVza292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4gMC4xLTEK IC0gSW5pdGlhbCBGZWRvcmEgU1NHIFJQTS4KPGRpdiBjbGFzcz0ibW96LXR4dC1zaWciPi0tIAox LjcuMTEuNzwvZGl2PjwvcHJlPgogICAgICAgIDwvZGl2PgogICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgIDxicj4KICAgICAgUmFuIGBtYWtlIGZlZG9yYS1ycG1gIGFuZCB5dW0gbG9jYWxpbnN0YWxs LCBldmVyeXRoaW5nIChmaWxlCiAgICAgIHBlcm1zLCBldGMpIGNoZWNrIG91dC4gQWNrITwvYmxv Y2txdW90ZT4KICAgIDxicj4KICAgIFB1c2hlZCB0aGlzIHRvbzo8YnI+CiAgICA8YnI+CiAgICAk IGdpdCBhcHBseSAvdG1wL2oyLnBhdGNoIDxicj4KICAgIDxicj4KICAgIFtzaGF3bkBTU0ctUkhF TDYgc2NhcC1zZWN1cml0eS1ndWlkZV0kIGdpdCBjb21taXQKICAgIEZlZG9yYS9zY2FwLXNlY3Vy aXR5LWd1aWRlLnNwZWMgPGJyPgogICAgW21hc3RlciAzN2RlNjdjXSBGZWRvcmEgc3BlYyAtIHJl cGxhY2UgaGFyZC13aXJlZCBwYXRocyB3aXRoCiAgICBtYWNyb3MuwqAgUHJlc2VydmUgYXR0cmli dXRlcyB3aGVuIGNvcHlpbmcgZmlsZXMuPGJyPgogICAgwqAxIGZpbGVzIGNoYW5nZWQsIDQgaW5z ZXJ0aW9ucygrKSwgNCBkZWxldGlvbnMoLSk8YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IHNjYXAt c2VjdXJpdHktZ3VpZGVdJCBnaXQgcHVzaDxicj4KICAgIENvdW50aW5nIG9iamVjdHM6IDcsIGRv bmUuPGJyPgogICAgRGVsdGEgY29tcHJlc3Npb24gdXNpbmcgdXAgdG8gMiB0aHJlYWRzLjxicj4K ICAgIENvbXByZXNzaW5nIG9iamVjdHM6IDEwMCUgKDQvNCksIGRvbmUuPGJyPgogICAgV3JpdGlu ZyBvYmplY3RzOiAxMDAlICg0LzQpLCA2MjEgYnl0ZXMsIGRvbmUuPGJyPgogICAgVG90YWwgNCAo ZGVsdGEgMyksIHJldXNlZCAwIChkZWx0YSAwKTxicj4KICAgIFRvCiAgICA8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJzc2g6Ly9zaGF3bmR3ZWxsc0BnaXQuZmVkb3JhaG9z dGVkLm9yZy9naXQvc2NhcC1zZWN1cml0eS1ndWlkZS5naXQiPnNzaDovL3NoYXduZHdlbGxzQGdp dC5mZWRvcmFob3N0ZWQub3JnL2dpdC9zY2FwLXNlY3VyaXR5LWd1aWRlLmdpdDwvYT48YnI+CiAg ICDCoMKgIGFmMTFkNmEuLjM3ZGU2N2PCoCBtYXN0ZXIgLSZndDsgbWFzdGVyPGJyPgogICAgPGJy PgogIDwvYm9keT4KPC9odG1sPgo= --===============8716274582936904055==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============3466148220879904402==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Fixed two typos in RHEL6/input/checks/file_ownership_binary_dirs.xml. The first was inside a comment and said the check was for /lib when really it was for /bin. The second was a criterion which had an extra letter so it ended up not performing one of the checks and missed files which were owned by a user other than root. Date: Wed, 02 Oct 2013 22:04:22 -0400 Message-ID: <524CD0A6.70902@redhat.com> In-Reply-To: 1380647354-17803-2-git-send-email-coopercd@ornl.gov --===============3466148220879904402== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/1/13 1:09 PM, Caleb Cooper wrote: > + > + > + > + > + > + > + > + > + > + > + /usr/bin > + > + state_owner_not_root > + > + > + > + > + /usr/bin > + ^.*$ > + state_owner_not_root > + > + > + > + > + > + > + > + > + > + > + > + > + /usr/sbin > + > + state_owner_not_root > + > + > + > + > + /usr/sbin > + ^.*$ > + state_owner_not_root > + > + Fixed! [shawn(a)SSG-RHEL6 checks]$ sudo bash [root(a)SSG-RHEL6 checks]# DIRS=3D"/bin /usr/bin /usr/local/bin /sbin = /usr/sbin /usr/local/sbin" [root(a)SSG-RHEL6 checks]# for dirPath in $DIRS; do find $dirPath \! -user = root -exec chown root '{}' \;; done ; exit [shawn(a)SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/bin/a2p [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py file_ownership_binary_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_binary_dirsln84Oi.xml Writing results to : /tmp/file_ownership_binary_dirsln84Oi.xml-results Definition oval:scap-security-guide.testing:def:100: false Evaluation done. Please push! --===============3466148220879904402==-- From shawn at redhat.com Thu Aug 20 11:35:24 2015 Content-Type: multipart/mixed; boundary="===============5331278410248376339==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: EXTERNAL: Re: scan question Date: Wed, 02 Oct 2013 22:22:31 -0400 Message-ID: <524CD4E7.2050405@redhat.com> In-Reply-To: EBDE6A904AEF60448F36706839FFB5250B8204AB@HVXDSP21.us.lmco.com --===============5331278410248376339== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/2/13 8:04 PM, Kordell, Luke T wrote: > Hi, > > I double-checked to make sure I added the correct line to the guide= .xslt file but when I greped the ssg-rhel6=3Dxccdf.xml file it did not retu= rn the usgcb file. I wish I could pull the latest update and patches quickl= y but am unable to do so with my RHEL machine at the moment. If you do a 'git pull', or simply reclone, you'll notice the new profile = in there. It should make the next RPM release too. > Basically what I'm trying to do is find a good starting-point for a compl= etely customized profile that calls a particular set of rules I will define= . I think I need to conduct a little more research to make-sure I fully und= erstand how to use the scripts to generate OVAL content and how to create a= profile. I think I have the rule creation/adding part down. Can you point = me in the right direction? > > As always thank you for the assistance! Consider exploring the XCCDF "extends" option, as used in the STIG: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/= profiles/stig-rhel6-server.xml Specifically: > || The STIG inherits *everything* from the common profile, located here: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/= profiles/common.xml Once inherited, anything in the STIG profile takes precedence, allowing = for customization of things like password lengh, audit retention, etc. If you wanted to change a refine value, such as maximum age of = passwords, simply use a refine-value tag: > || ... which would change the value from the STIG (which is 180 days), to 5 = in your custom profile Or perhaps there's a STIG rule which you disagree with, disable it via = the selected operator: > | --===============4953710254438046573==-- From shawn at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============4516590525008671758==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: EXTERNAL: Re: scan question Date: Thu, 03 Oct 2013 20:44:03 -0400 Message-ID: <524E0F53.6080406@redhat.com> In-Reply-To: EBDE6A904AEF60448F36706839FFB5250B820609@HVXDSP21.us.lmco.com --===============4516590525008671758== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/3/13 5:05 PM, Kordell, Luke T wrote: > Great! I noticed that the stig profile also refines values inherited from= the common profile. Thank you again for the help. Once I begin developing = my own profile I will share any major modifications or creations. Absolutely! Let us know if your profile would be of interest for a = larger group, perhaps we could evaluate it for inclusion. --===============4516590525008671758==-- From shawn at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============2385943408918708903==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Thu, 03 Oct 2013 21:42:53 -0400 Message-ID: <524E1D1D.1000209@redhat.com> In-Reply-To: 524DC170.6010502@redhat.com --===============2385943408918708903== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/3/13 3:11 PM, fcaviggi(a)redhat.com wrote: > All, > > As a starting point for writing remediation fixes in the SSG - so, I = > did the following: > > $ ls ~/scap-security-guide/RHEL6/input/checks/*.xml | awk '{ print = > $1 }' | sed s/\.[^\.]*$// > ~/checks > $ ls ~/scap-security-guide/RHEL6/input/fixes/*.sh | awk '{ print = > $1 }' | sed s/\.[^\.]*$// > ~/fixes > $ sdiff ~/fixes ~/checks | less > > There's fair a bit of work to be done for the fix remediations... > > Since I'm new to the project, I was wondering if there was any ideas = > or standards to how the SSG should distribute some of these fixes - = > for example - a wholesale replacement of the audit.rules and = > auditd.conf might be preferable than doing piecemeal sed's. It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules = /etc/audit.rules`, and that likely is the right choice during an initial = provisioning process. But then SysAdmins tailor audit rules, the system = evolves, and we need to evaluate the audit.rules file against specific = auditing guidance items after the pristine audit.rules template is = manipulated. So, if a single rule must be remediated, we can't blow away the whole = audit.rules file. Super fun sed scripts it is =3D/ > I also think the first script that needs to be run is to tar the = > current existing configurations (as a backup) before applying any fix = > just in case we do something that jacks the users modifications to the = > system. A prevailing thought has been to address backups once the remediations = are finished, as we'll have a better handle for which files will need = addressing. Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been = to create an OVAL check -- which is listed first in the profile -- which = will *always* fail. The remediation for said OVAL would be to perform = the backups. Anyone have a better idea? =3D/ > Anyway, just trying to get an idea of how to proceed set some goals = > for my contributions. These are /really/ good questions. Thanks for starting the conversation! --===============2385943408918708903== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8zLzEzIDM6MTEgUE0sIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIj5mY2F2aWdnaUByZWRoYXQuY29tPC9h PgogICAgICB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1 MjREQzE3MC42MDEwNTAyQHJlZGhhdC5jb20iIHR5cGU9ImNpdGUiPkFsbCwKICAgICAgPGJyPgog ICAgICA8YnI+CiAgICAgIEFzIGEgc3RhcnRpbmcgcG9pbnQgZm9yIHdyaXRpbmcgcmVtZWRpYXRp b24gZml4ZXMgaW4gdGhlIFNTRyAtIHNvLAogICAgICBJIGRpZCB0aGUgZm9sbG93aW5nOgogICAg ICA8YnI+CiAgICAgIDxicj4KICAgICAgwqDCoMKgICQgbHMgfjxpIGNsYXNzPSJtb3otdHh0LXNs YXNoIj48c3BhbiBjbGFzcz0ibW96LXR4dC10YWciPi88L3NwYW4+c2NhcC1zZWN1cml0eS1ndWlk ZS9SSEVMNi9pbnB1dC9jaGVja3M8c3BhbgogICAgICAgICAgY2xhc3M9Im1vei10eHQtdGFnIj4v PC9zcGFuPjwvaT4qLnhtbCB8IGF3ayAneyBwcmludCAkMSB9JyB8CiAgICAgIHNlZCBzL1wuW15c Ll0qJC8vICZndDsgfi9jaGVja3MKICAgICAgPGJyPgogICAgICDCoMKgwqAgJCBscyB+PGkgY2xh c3M9Im1vei10eHQtc2xhc2giPjxzcGFuIGNsYXNzPSJtb3otdHh0LXRhZyI+Lzwvc3Bhbj5zY2Fw LXNlY3VyaXR5LWd1aWRlL1JIRUw2L2lucHV0L2ZpeGVzPHNwYW4KICAgICAgICAgIGNsYXNzPSJt b3otdHh0LXRhZyI+Lzwvc3Bhbj48L2k+Ki5zaCB8IGF3ayAneyBwcmludCAkMSB9JyB8CiAgICAg IHNlZCBzL1wuW15cLl0qJC8vICZndDsgfi9maXhlcwogICAgICA8YnI+CiAgICAgIMKgwqDCoCAk IHNkaWZmIH4vZml4ZXMgfi9jaGVja3MgfCBsZXNzCiAgICAgIDxicj4KICAgICAgPGJyPgogICAg ICBUaGVyZSdzIGZhaXIgYSBiaXQgb2Ygd29yayB0byBiZSBkb25lIGZvciB0aGUgZml4IHJlbWVk aWF0aW9ucy4uLgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgU2luY2UgSSdtIG5ldyB0byB0 aGUgcHJvamVjdCwgSSB3YXMgd29uZGVyaW5nIGlmIHRoZXJlIHdhcyBhbnkKICAgICAgaWRlYXMg b3Igc3RhbmRhcmRzIHRvIGhvdyB0aGUgU1NHIHNob3VsZCBkaXN0cmlidXRlIHNvbWUgb2YgdGhl c2UKICAgICAgZml4ZXMgLSBmb3IgZXhhbXBsZSAtIGEgd2hvbGVzYWxlIHJlcGxhY2VtZW50IG9m IHRoZSBhdWRpdC5ydWxlcwogICAgICBhbmQgYXVkaXRkLmNvbmYgbWlnaHQgYmUgcHJlZmVyYWJs ZSB0aGFuIGRvaW5nIHBpZWNlbWVhbCBzZWQncy48L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBJ dCdkIGJlIG9tZ3ogZWFzaWVyIHRvIGBjcCAvdXNyL3NoYXJlL2RvYy9hdWRpdC0qL3N0aWcucnVs ZXMKICAgIC9ldGMvYXVkaXQucnVsZXNgLCBhbmQgdGhhdCBsaWtlbHkgaXMgdGhlIHJpZ2h0IGNo b2ljZSBkdXJpbmcgYW4KICAgIGluaXRpYWwgcHJvdmlzaW9uaW5nIHByb2Nlc3MuIEJ1dCB0aGVu IFN5c0FkbWlucyB0YWlsb3IgYXVkaXQgcnVsZXMsCiAgICB0aGUgc3lzdGVtIGV2b2x2ZXMsIGFu ZCB3ZSBuZWVkIHRvIGV2YWx1YXRlIHRoZSBhdWRpdC5ydWxlcyBmaWxlCiAgICBhZ2FpbnN0IHNw ZWNpZmljIGF1ZGl0aW5nIGd1aWRhbmNlIGl0ZW1zIGFmdGVyIHRoZSBwcmlzdGluZQogICAgYXVk aXQucnVsZXMgdGVtcGxhdGUgaXMgbWFuaXB1bGF0ZWQuIDxicj4KICAgIDxicj4KICAgIFNvLCBp ZiBhIHNpbmdsZSBydWxlIG11c3QgYmUgcmVtZWRpYXRlZCwgd2UgY2FuJ3QgYmxvdyBhd2F5IHRo ZQogICAgd2hvbGUgYXVkaXQucnVsZXMgZmlsZS4gU3VwZXIgZnVuIHNlZCBzY3JpcHRzIGl0IGlz ID0vPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjUyNERD MTcwLjYwMTA1MDJAcmVkaGF0LmNvbSIgdHlwZT0iY2l0ZSI+IEkKICAgICAgYWxzbyB0aGluayB0 aGUgZmlyc3Qgc2NyaXB0IHRoYXQgbmVlZHMgdG8gYmUgcnVuIGlzIHRvIHRhciB0aGUKICAgICAg Y3VycmVudCBleGlzdGluZyBjb25maWd1cmF0aW9ucyAoYXMgYSBiYWNrdXApIGJlZm9yZSBhcHBs eWluZyBhbnkKICAgICAgZml4IGp1c3QgaW4gY2FzZSB3ZSBkbyBzb21ldGhpbmcgdGhhdCBqYWNr cyB0aGUgdXNlcnMKICAgICAgbW9kaWZpY2F0aW9ucyB0byB0aGUgc3lzdGVtLgogICAgICA8YnI+ CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBBIHByZXZhaWxpbmcgdGhvdWdodCBoYXMg YmVlbiB0byBhZGRyZXNzIGJhY2t1cHMgb25jZSB0aGUKICAgIHJlbWVkaWF0aW9ucyBhcmUgZmlu aXNoZWQsIGFzIHdlJ2xsIGhhdmUgYSBiZXR0ZXIgaGFuZGxlIGZvciB3aGljaAogICAgZmlsZXMg d2lsbCBuZWVkIGFkZHJlc3NpbmcuIDxicj4KICAgIDxicj4KICAgIEZvcmNpbmcgdGhlIGJhY2t1 cCAodGhyb3VnaCBYQ0NERi9PVkFMKSBpcyB0cmlja3kuIE9uZSB0aG91Z2h0IGhhcwogICAgYmVl biB0byBjcmVhdGUgYW4gT1ZBTCBjaGVjayAtLSB3aGljaCBpcyBsaXN0ZWQgZmlyc3QgaW4gdGhl IHByb2ZpbGUKICAgIC0tIHdoaWNoIHdpbGwgKmFsd2F5cyogZmFpbC4gVGhlIHJlbWVkaWF0aW9u IGZvciBzYWlkIE9WQUwgd291bGQgYmUKICAgIHRvIHBlcmZvcm0gdGhlIGJhY2t1cHMuIEFueW9u ZSBoYXZlIGEgYmV0dGVyIGlkZWE/ID0vPGJyPgogICAgPGJyPgogICAgPGJsb2NrcXVvdGUgY2l0 ZT0ibWlkOjUyNERDMTcwLjYwMTA1MDJAcmVkaGF0LmNvbSIgdHlwZT0iY2l0ZSI+CiAgICAgIEFu eXdheSwganVzdCB0cnlpbmcgdG8gZ2V0IGFuIGlkZWEgb2YgaG93IHRvIHByb2NlZWQgc2V0IHNv bWUKICAgICAgZ29hbHMgZm9yIG15IGNvbnRyaWJ1dGlvbnMuCiAgICAgIDxicj4KICAgIDwvYmxv Y2txdW90ZT4KICAgIDxicj4KICAgIFRoZXNlIGFyZSA8aT5yZWFsbHk8L2k+IGdvb2QgcXVlc3Rp b25zLiBUaGFua3MgZm9yIHN0YXJ0aW5nIHRoZQogICAgY29udmVyc2F0aW9uITxicj4KICAgIDxi cj4KICA8L2JvZHk+CjwvaHRtbD4K --===============2385943408918708903==-- From shawn at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============4778873574303588141==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Remediations involving sshd_config Date: Thu, 03 Oct 2013 23:17:26 -0400 Message-ID: <524E3346.80502@redhat.com> In-Reply-To: B0F8BA03CBE85346A2A4A48A2A9365D401EA7422E4AB@INOAVREX11.ptin.corpPT.com --===============4778873574303588141== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/3/13 10:08 AM, Rui Pedro Bernardino wrote: > Hi all, > > The remediation won't work if it appends the new option to the end of fil= e AND there are 'Match' rules (from sshd_config's: "If all of the criteria = on the Match line are satisfied, the keywords on the following lines overri= de those set in the global section of the config file, until either another= Match line or the end of the file."). > > Although commented, 'Match' rules are in the default sshd_config. > > For example, for "sshd_enable_warning_banner.sh", my suggestion would be: > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > grep -q ^Banner /etc/ssh/sshd_config && \ > sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config > if ! [ $? -eq 0 ]; then > ed -s /etc/ssh/sshd_config <<'EOF' > /Match/ > ?^[A-Z]? > + > i > Banner /etc/issue > . > w > q > EOF > fi > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > This will add a new line, after the last keyword before the first 'Match'= block (including comments). I'm ashamed to say I couldn't do it with 'sed'= :( > > Does it sound reasonable? This situation *should* be taken care of. Are you experiencing something = different than the situation below? 1) Testing file with no Banner value set: > [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config > #Banner none > > [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py = > sshd_enable_warning_banner.xml > Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannerzkgnCU.xml > Writing results to : /tmp/sshd_enable_warning_bannerzkgnCU.xml-results > Definition oval:scap-security-guide.testing:def:129: false > Definition oval:scap-security-guide.testing:def:127: false > Definition oval:scap-security-guide.testing:def:126: false > Evaluation done. > > [shawn(a)SSG-RHEL6 checks]$ sudo bash = > ../fixes/bash/sshd_enable_warning_banner.sh > [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config > #Banner none > Banner /etc/issue > > [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py = > sshd_enable_warning_banner.xml > Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banner43kR1V.xml > Writing results to : /tmp/sshd_enable_warning_banner43kR1V.xml-results > Definition oval:scap-security-guide.testing:def:129: false > Definition oval:scap-security-guide.testing:def:127: false > Definition oval:scap-security-guide.testing:def:126: true > Evaluation done. 2) Testing if incorrect Banner value set > [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config > #Banner none > Banner /totally/wrong/path > > [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py = > sshd_enable_warning_banner.xml > Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banneryFifQw.xml > Writing results to : /tmp/sshd_enable_warning_banneryFifQw.xml-results > Definition oval:scap-security-guide.testing:def:129: false > Definition oval:scap-security-guide.testing:def:127: false > Definition oval:scap-security-guide.testing:def:126: false > Evaluation done. > > [shawn(a)SSG-RHEL6 checks]$ sudo bash = > ../fixes/bash/sshd_enable_warning_banner.sh > [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config > #Banner /etc/issue > Banner /etc/issue > > [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py = > sshd_enable_warning_banner.xml > Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannervMyGwb.xml > Writing results to : /tmp/sshd_enable_warning_bannervMyGwb.xml-results > Definition oval:scap-security-guide.testing:def:129: false > Definition oval:scap-security-guide.testing:def:127: false > Definition oval:scap-security-guide.testing:def:126: true > Evaluation done. --===============4778873574303588141== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8zLzEzIDEwOjA4IEFNLCBSdWkgUGVkcm8KICAgICAgQmVybmFyZGlubyB3cm90ZTo8 YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCmNpdGU9Im1pZDpCMEY4QkEwM0NCRTg1MzQ2 QTJBNEE0OEEyQTkzNjVENDAxRUE3NDIyRTRBQkBJTk9BVlJFWDExLnB0aW4uY29ycFBULmNvbSIK ICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj5IaSBhbGwsCgpUaGUgcmVtZWRp YXRpb24gd29uJ3Qgd29yayBpZiBpdCBhcHBlbmRzIHRoZSBuZXcgb3B0aW9uIHRvIHRoZSBlbmQg b2YgZmlsZSBBTkQgdGhlcmUgYXJlICdNYXRjaCcgcnVsZXMgKGZyb20gc3NoZF9jb25maWcnczog IklmIGFsbCBvZiB0aGUgY3JpdGVyaWEgb24gdGhlIE1hdGNoIGxpbmUgYXJlIHNhdGlzZmllZCwg dGhlIGtleXdvcmRzIG9uIHRoZSBmb2xsb3dpbmcgbGluZXMgb3ZlcnJpZGUgdGhvc2Ugc2V0IGlu IHRoZSBnbG9iYWwgc2VjdGlvbiBvZiB0aGUgY29uZmlnIGZpbGUsIHVudGlsIGVpdGhlciBhbm90 aGVyIE1hdGNoIGxpbmUgb3IgdGhlIGVuZCBvZiB0aGUgZmlsZS4iKS4gCgpBbHRob3VnaCBjb21t ZW50ZWQsICdNYXRjaCcgcnVsZXMgYXJlIGluIHRoZSBkZWZhdWx0IHNzaGRfY29uZmlnLgoKRm9y IGV4YW1wbGUsIGZvciAic3NoZF9lbmFibGVfd2FybmluZ19iYW5uZXIuc2giLCBteSBzdWdnZXN0 aW9uIHdvdWxkIGJlOgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09CmdyZXAgLXEg XkJhbm5lciAvZXRjL3NzaC9zc2hkX2NvbmZpZyAmYW1wOyZhbXA7IFwKICBzZWQgLWkgInMvQmFu bmVyLiovQmFubmVyIFwvZXRjXC9pc3N1ZS9nIiAvZXRjL3NzaC9zc2hkX2NvbmZpZwppZiAhIFsg JD8gLWVxIDAgXTsgdGhlbgogICAgZWQgLXMgL2V0Yy9zc2gvc3NoZF9jb25maWcgJmx0OyZsdDsn RU9GJwo8aSBjbGFzcz0ibW96LXR4dC1zbGFzaCI+PHNwYW4gY2xhc3M9Im1vei10eHQtdGFnIj4v PC9zcGFuPk1hdGNoPHNwYW4gY2xhc3M9Im1vei10eHQtdGFnIj4vPC9zcGFuPjwvaT4KP15bQS1a XT8KKwppCkJhbm5lciAvZXRjL2lzc3VlCi4KdwpxCkVPRgpmaQo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09ClRoaXMgd2lsbCBhZGQgYSBuZXcgbGluZSwgYWZ0ZXIgdGhlIGxhc3Qg a2V5d29yZCBiZWZvcmUgdGhlIGZpcnN0ICdNYXRjaCcgYmxvY2sgKGluY2x1ZGluZyBjb21tZW50 cykuIEknbSBhc2hhbWVkIHRvIHNheSBJIGNvdWxkbid0IGRvIGl0IHdpdGggJ3NlZCcgPHNwYW4g Y2xhc3M9Im1vei1zbWlsZXktczIiIHRpdGxlPSI6KCI+PHNwYW4+Oig8L3NwYW4+PC9zcGFuPgoK RG9lcyBpdCBzb3VuZCByZWFzb25hYmxlPwo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxi cj4KICAgIFRoaXMgc2l0dWF0aW9uICpzaG91bGQqIGJlIHRha2VuIGNhcmUgb2YuIEFyZSB5b3Ug ZXhwZXJpZW5jaW5nCiAgICBzb21ldGhpbmcgZGlmZmVyZW50IHRoYW4gdGhlIHNpdHVhdGlvbiBi ZWxvdz88YnI+CiAgICA8YnI+CiAgICAxKSBUZXN0aW5nIGZpbGUgd2l0aCBubyBCYW5uZXIgdmFs dWUgc2V0Ojxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPltzaGF3bkBTU0ctUkhFTDYg Y2hlY2tzXSQgc3VkbyBncmVwIEJhbm5lcgogICAgICAvZXRjL3NzaC9zc2hkX2NvbmZpZyA8YnI+ CiAgICAgICNCYW5uZXIgbm9uZTxicj4KICAgICAgPGJyPgogICAgICBbc2hhd25AU1NHLVJIRUw2 IGNoZWNrc10kIHN1ZG8gLi90ZXN0Y2hlY2sucHkKICAgICAgc3NoZF9lbmFibGVfd2FybmluZ19i YW5uZXIueG1sIDxicj4KICAgICAgRXZhbHVhdGluZyB3aXRoIE9WQUwgdGVtcGZpbGUgOgogICAg ICAvdG1wL3NzaGRfZW5hYmxlX3dhcm5pbmdfYmFubmVyemtnbkNVLnhtbDxicj4KICAgICAgV3Jp dGluZyByZXN1bHRzIHRvIDoKICAgICAgL3RtcC9zc2hkX2VuYWJsZV93YXJuaW5nX2Jhbm5lcnpr Z25DVS54bWwtcmVzdWx0czxicj4KICAgICAgRGVmaW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHkt Z3VpZGUudGVzdGluZzpkZWY6MTI5OiBmYWxzZTxicj4KICAgICAgRGVmaW5pdGlvbiBvdmFsOnNj YXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTI3OiBmYWxzZTxicj4KICAgICAgRGVmaW5p dGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTI2OiBmYWxzZTxicj4K ICAgICAgRXZhbHVhdGlvbiBkb25lLjxicj4KICAgICAgPGJyPgogICAgICBbc2hhd25AU1NHLVJI RUw2IGNoZWNrc10kIHN1ZG8gYmFzaAogICAgICAuLi9maXhlcy9iYXNoL3NzaGRfZW5hYmxlX3dh cm5pbmdfYmFubmVyLnNoIDxicj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRv IGdyZXAgQmFubmVyIC9ldGMvc3NoL3NzaGRfY29uZmlnIDxicj4KICAgICAgI0Jhbm5lciBub25l PGJyPgogICAgICBCYW5uZXIgL2V0Yy9pc3N1ZTxicj4KICAgICAgPGJyPgogICAgICBbc2hhd25A U1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gLi90ZXN0Y2hlY2sucHkKICAgICAgc3NoZF9lbmFibGVf d2FybmluZ19iYW5uZXIueG1sIDxicj4KICAgICAgRXZhbHVhdGluZyB3aXRoIE9WQUwgdGVtcGZp bGUgOgogICAgICAvdG1wL3NzaGRfZW5hYmxlX3dhcm5pbmdfYmFubmVyNDNrUjFWLnhtbDxicj4K ICAgICAgV3JpdGluZyByZXN1bHRzIHRvIDoKICAgICAgL3RtcC9zc2hkX2VuYWJsZV93YXJuaW5n X2Jhbm5lcjQza1IxVi54bWwtcmVzdWx0czxicj4KICAgICAgRGVmaW5pdGlvbiBvdmFsOnNjYXAt c2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTI5OiBmYWxzZTxicj4KICAgICAgRGVmaW5pdGlv biBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTI3OiBmYWxzZTxicj4KICAg ICAgRGVmaW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTI2OiB0 cnVlPGJyPgogICAgICBFdmFsdWF0aW9uIGRvbmUuPGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAg PGJyPgogICAgMikgVGVzdGluZyBpZiBpbmNvcnJlY3QgQmFubmVyIHZhbHVlIHNldDxicj4KICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBn cmVwIEJhbm5lcgogICAgICAvZXRjL3NzaC9zc2hkX2NvbmZpZyA8YnI+CiAgICAgICNCYW5uZXIg bm9uZTxicj4KICAgICAgQmFubmVyIC90b3RhbGx5L3dyb25nL3BhdGg8YnI+CiAgICAgIDxicj4K ICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIC4vdGVzdGNoZWNrLnB5CiAgICAg IHNzaGRfZW5hYmxlX3dhcm5pbmdfYmFubmVyLnhtbCA8YnI+CiAgICAgIEV2YWx1YXRpbmcgd2l0 aCBPVkFMIHRlbXBmaWxlIDoKICAgICAgL3RtcC9zc2hkX2VuYWJsZV93YXJuaW5nX2Jhbm5lcnlG aWZRdy54bWw8YnI+CiAgICAgIFdyaXRpbmcgcmVzdWx0cyB0byA6CiAgICAgIC90bXAvc3NoZF9l bmFibGVfd2FybmluZ19iYW5uZXJ5RmlmUXcueG1sLXJlc3VsdHM8YnI+CiAgICAgIERlZmluaXRp b24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjEyOTogZmFsc2U8YnI+CiAg ICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjEyNzog ZmFsc2U8YnI+CiAgICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rp bmc6ZGVmOjEyNjogZmFsc2U8YnI+CiAgICAgIEV2YWx1YXRpb24gZG9uZS48YnI+CiAgICAgIDxi cj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIGJhc2gKICAgICAgLi4vZml4 ZXMvYmFzaC9zc2hkX2VuYWJsZV93YXJuaW5nX2Jhbm5lci5zaCA8YnI+CiAgICAgIFtzaGF3bkBT U0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBncmVwIEJhbm5lciAvZXRjL3NzaC9zc2hkX2NvbmZpZyA8 YnI+CiAgICAgICNCYW5uZXIgL2V0Yy9pc3N1ZTxicj4KICAgICAgQmFubmVyIC9ldGMvaXNzdWU8 YnI+CiAgICAgIDxicj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBzdWRvIC4vdGVz dGNoZWNrLnB5CiAgICAgIHNzaGRfZW5hYmxlX3dhcm5pbmdfYmFubmVyLnhtbCA8YnI+CiAgICAg IEV2YWx1YXRpbmcgd2l0aCBPVkFMIHRlbXBmaWxlIDoKICAgICAgL3RtcC9zc2hkX2VuYWJsZV93 YXJuaW5nX2Jhbm5lcnZNeUd3Yi54bWw8YnI+CiAgICAgIFdyaXRpbmcgcmVzdWx0cyB0byA6CiAg ICAgIC90bXAvc3NoZF9lbmFibGVfd2FybmluZ19iYW5uZXJ2TXlHd2IueG1sLXJlc3VsdHM8YnI+ CiAgICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjEy OTogZmFsc2U8YnI+CiAgICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLnRl c3Rpbmc6ZGVmOjEyNzogZmFsc2U8YnI+CiAgICAgIERlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3Vy aXR5LWd1aWRlLnRlc3Rpbmc6ZGVmOjEyNjogdHJ1ZTxicj4KICAgICAgRXZhbHVhdGlvbiBkb25l LjwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxi cj4KICAgIDxicj4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============4778873574303588141==-- From rui-p-bernardino at ptinovacao.pt Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============3475116370083315165==" MIME-Version: 1.0 From: Rui Pedro Bernardino To: scap-security-guide at lists.fedorahosted.org Subject: RE: Remediations involving sshd_config Date: Fri, 04 Oct 2013 08:52:05 +0100 Message-ID: In-Reply-To: 524E3346.80502@redhat.com --===============3475116370083315165== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I have exactly the same results but that=E2=80=99s not the point. This is w= hat I get on a system without a =E2=80=98Banner=E2=80=99 but with a 'Match'= group: [root(a)seis64 ~]# ssh localhost root(a)localhost's password: = [root(a)seis64 ~]# sshd_enable_warning_banner.sh [root(a)seis64 ~]# /etc/init.d/sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root(a)seis64 ~]# ssh localhost root(a)localhost's password: Still no banner. = This is because the =E2=80=98Banner=E2=80=99 was appended to the end of ssh= d_config and got =E2=80=98absorved=E2=80=99 by the Match rules (that use an= ything following 'Match' until EOF or another 'Match'): [root(a)seis64 ~]# tail -5 /etc/ssh/sshd_config # Rules for sftponly group Match group sftponly X11Forwarding no AllowTcpForwarding no Banner /etc/issue This applies to all SSG's sshd_config fixes. Note not all configuration pri= mitives are acceptable on the =E2=80=9CMatch=E2=80=9D blocks, meaning start= ing sshd will fail. Bottom line, new primitives must be inserted *before* Match blocks. Regards -- Rui Pedro Bernardino CTE2/Tecnologias e Desenvolvimento PT Inova=C3=A7=C3=A3o From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-sec= urity-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: sexta-feira, 4 de Outubro de 2013 04:17 To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: Remediations involving sshd_config On 10/3/13 10:08 AM, Rui Pedro Bernardino wrote: Hi all, The remediation won't work if it appends the new option to the end of file = AND there are 'Match' rules (from sshd_config's: "If all of the criteria on= the Match line are satisfied, the keywords on the following lines override= those set in the global section of the config file, until either another M= atch line or the end of the file."). = Although commented, 'Match' rules are in the default sshd_config. For example, for "sshd_enable_warning_banner.sh", my suggestion would be: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D grep -q ^Banner /etc/ssh/sshd_config && \ sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then ed -s /etc/ssh/sshd_config <<'EOF' /Match/ ?^[A-Z]? + i Banner /etc/issue . w q EOF fi =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D This will add a new line, after the last keyword before the first 'Match' b= lock (including comments). I'm ashamed to say I couldn't do it with 'sed' :( Does it sound reasonable? This situation *should* be taken care of. Are you experiencing something di= fferent than the situation below? 1) Testing file with no Banner value set: [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config = #Banner none [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.= xml = Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannerzkgnCU.xml Writing results to : /tmp/sshd_enable_warning_bannerzkgnCU.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done. [shawn(a)SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_ban= ner.sh = [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config = #Banner none Banner /etc/issue [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.= xml = Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banner43kR1V.xml Writing results to : /tmp/sshd_enable_warning_banner43kR1V.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done. 2) Testing if incorrect Banner value set [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config = #Banner none Banner /totally/wrong/path [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.= xml = Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banneryFifQw.xml Writing results to : /tmp/sshd_enable_warning_banneryFifQw.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done. [shawn(a)SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_ban= ner.sh = [shawn(a)SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config = #Banner /etc/issue Banner /etc/issue [shawn(a)SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.= xml = Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannervMyGwb.xml Writing results to : /tmp/sshd_enable_warning_bannervMyGwb.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done. --===============3475116370083315165==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============2418921528860735122==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Fri, 04 Oct 2013 07:40:26 -0400 Message-ID: In-Reply-To: 524E1D1D.1000209@redhat.com --===============2418921528860735122== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Is Augeas an option? This seems like the perfect opportunity to solidify the Augeas lenses regarding security settings while making life easier for everyone. Trevor On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells wrote: > On 10/3/13 3:11 PM, fcaviggi(a)redhat.com wrote: > > All, > > As a starting point for writing remediation fixes in the SSG - so, I did > the following: > > $ ls ~*/scap-security-guide/RHEL6/input/checks/**.xml | awk '{ print > $1 }' | sed s/\.[^\.]*$// > ~/checks > $ ls ~*/scap-security-guide/RHEL6/input/fixes/**.sh | awk '{ print $1 > }' | sed s/\.[^\.]*$// > ~/fixes > $ sdiff ~/fixes ~/checks | less > > There's fair a bit of work to be done for the fix remediations... > > Since I'm new to the project, I was wondering if there was any ideas or > standards to how the SSG should distribute some of these fixes - for > example - a wholesale replacement of the audit.rules and auditd.conf might > be preferable than doing piecemeal sed's. > > > It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules > /etc/audit.rules`, and that likely is the right choice during an initial > provisioning process. But then SysAdmins tailor audit rules, the system > evolves, and we need to evaluate the audit.rules file against specific > auditing guidance items after the pristine audit.rules template is > manipulated. > > So, if a single rule must be remediated, we can't blow away the whole > audit.rules file. Super fun sed scripts it is =3D/ > > > > I also think the first script that needs to be run is to tar the current > existing configurations (as a backup) before applying any fix just in case > we do something that jacks the users modifications to the system. > > > A prevailing thought has been to address backups once the remediations are > finished, as we'll have a better handle for which files will need > addressing. > > Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been to > create an OVAL check -- which is listed first in the profile -- which will > *always* fail. The remediation for said OVAL would be to perform the > backups. Anyone have a better idea? =3D/ > > > Anyway, just trying to get an idea of how to proceed set some goals for > my contributions. > > > These are *really* good questions. Thanks for starting the conversation! > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============2418921528860735122== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SXMgQXVnZWFzIGFuIG9wdGlvbj88ZGl2Pjxicj48L2Rpdj48ZGl2PlRo aXMgc2VlbXMgbGlrZSB0aGUgcGVyZmVjdCBvcHBvcnR1bml0eSB0byBzb2xpZGlmeSB0aGUgQXVn ZWFzIGxlbnNlcyByZWdhcmRpbmcgc2VjdXJpdHkgc2V0dGluZ3Mgd2hpbGUgbWFraW5nIGxpZmUg ZWFzaWVyIGZvciBldmVyeW9uZS48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRyZXZvcjwvZGl2 Pgo8L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFp bF9xdW90ZSI+T24gVGh1LCBPY3QgMywgMjAxMyBhdCA5OjQyIFBNLCBTaGF3biBXZWxscyA8c3Bh biBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpzaGF3bkByZWRoYXQuY29tIiB0YXJnZXQ9 Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2Nr cXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVy LWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CgogIAogICAgCiAgCiAgPGRp diBiZ2NvbG9yPSIjRkZGRkZGIiB0ZXh0PSIjMDAwMDAwIj48ZGl2IGNsYXNzPSJpbSI+CiAgICA8 ZGl2Pk9uIDEwLzMvMTMgMzoxMSBQTSwgPGEgaHJlZj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5j b20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPgogICAgICB3cm90ZTo8 YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkFsbCwKICAgICAgPGJy PgogICAgICA8YnI+CiAgICAgIEFzIGEgc3RhcnRpbmcgcG9pbnQgZm9yIHdyaXRpbmcgcmVtZWRp YXRpb24gZml4ZXMgaW4gdGhlIFNTRyAtIHNvLAogICAgICBJIGRpZCB0aGUgZm9sbG93aW5nOgog ICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgoKCgICQgbHMgfjxpPjxzcGFuPi88L3NwYW4+c2Nh cC1zZWN1cml0eS1ndWlkZS9SSEVMNi9pbnB1dC9jaGVja3M8c3Bhbj4vPC9zcGFuPjwvaT4qLnht bCB8IGF3ayAmIzM5O3sgcHJpbnQgJDEgfSYjMzk7IHwKICAgICAgc2VkIHMvXC5bXlwuXSokLy8g Jmd0OyB+L2NoZWNrcwogICAgICA8YnI+CiAgICAgIKCgoCAkIGxzIH48aT48c3Bhbj4vPC9zcGFu PnNjYXAtc2VjdXJpdHktZ3VpZGUvUkhFTDYvaW5wdXQvZml4ZXM8c3Bhbj4vPC9zcGFuPjwvaT4q LnNoIHwgYXdrICYjMzk7eyBwcmludCAkMSB9JiMzOTsgfAogICAgICBzZWQgcy9cLlteXC5dKiQv LyAmZ3Q7IH4vZml4ZXMKICAgICAgPGJyPgogICAgICCgoKAgJCBzZGlmZiB+L2ZpeGVzIH4vY2hl Y2tzIHwgbGVzcwogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgVGhlcmUmIzM5O3MgZmFpciBh IGJpdCBvZiB3b3JrIHRvIGJlIGRvbmUgZm9yIHRoZSBmaXggcmVtZWRpYXRpb25zLi4uCiAgICAg IDxicj4KICAgICAgPGJyPgogICAgICBTaW5jZSBJJiMzOTttIG5ldyB0byB0aGUgcHJvamVjdCwg SSB3YXMgd29uZGVyaW5nIGlmIHRoZXJlIHdhcyBhbnkKICAgICAgaWRlYXMgb3Igc3RhbmRhcmRz IHRvIGhvdyB0aGUgU1NHIHNob3VsZCBkaXN0cmlidXRlIHNvbWUgb2YgdGhlc2UKICAgICAgZml4 ZXMgLSBmb3IgZXhhbXBsZSAtIGEgd2hvbGVzYWxlIHJlcGxhY2VtZW50IG9mIHRoZSBhdWRpdC5y dWxlcwogICAgICBhbmQgYXVkaXRkLmNvbmYgbWlnaHQgYmUgcHJlZmVyYWJsZSB0aGFuIGRvaW5n IHBpZWNlbWVhbCBzZWQmIzM5O3MuPC9ibG9ja3F1b3RlPgogICAgPGJyPjwvZGl2PgogICAgSXQm IzM5O2QgYmUgb21neiBlYXNpZXIgdG8gYGNwIC91c3Ivc2hhcmUvZG9jL2F1ZGl0LSovc3RpZy5y dWxlcwogICAgL2V0Yy9hdWRpdC5ydWxlc2AsIGFuZCB0aGF0IGxpa2VseSBpcyB0aGUgcmlnaHQg Y2hvaWNlIGR1cmluZyBhbgogICAgaW5pdGlhbCBwcm92aXNpb25pbmcgcHJvY2Vzcy4gQnV0IHRo ZW4gU3lzQWRtaW5zIHRhaWxvciBhdWRpdCBydWxlcywKICAgIHRoZSBzeXN0ZW0gZXZvbHZlcywg YW5kIHdlIG5lZWQgdG8gZXZhbHVhdGUgdGhlIGF1ZGl0LnJ1bGVzIGZpbGUKICAgIGFnYWluc3Qg c3BlY2lmaWMgYXVkaXRpbmcgZ3VpZGFuY2UgaXRlbXMgYWZ0ZXIgdGhlIHByaXN0aW5lCiAgICBh dWRpdC5ydWxlcyB0ZW1wbGF0ZSBpcyBtYW5pcHVsYXRlZC4gPGJyPgogICAgPGJyPgogICAgU28s IGlmIGEgc2luZ2xlIHJ1bGUgbXVzdCBiZSByZW1lZGlhdGVkLCB3ZSBjYW4mIzM5O3QgYmxvdyBh d2F5IHRoZQogICAgd2hvbGUgYXVkaXQucnVsZXMgZmlsZS4gU3VwZXIgZnVuIHNlZCBzY3JpcHRz IGl0IGlzID0vPGRpdiBjbGFzcz0iaW0iPjxicj4KICAgIDxicj4KICAgIDxicj4KICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPiBJCiAgICAgIGFsc28gdGhpbmsgdGhlIGZpcnN0IHNjcmlwdCB0 aGF0IG5lZWRzIHRvIGJlIHJ1biBpcyB0byB0YXIgdGhlCiAgICAgIGN1cnJlbnQgZXhpc3Rpbmcg Y29uZmlndXJhdGlvbnMgKGFzIGEgYmFja3VwKSBiZWZvcmUgYXBwbHlpbmcgYW55CiAgICAgIGZp eCBqdXN0IGluIGNhc2Ugd2UgZG8gc29tZXRoaW5nIHRoYXQgamFja3MgdGhlIHVzZXJzCiAgICAg IG1vZGlmaWNhdGlvbnMgdG8gdGhlIHN5c3RlbS4KICAgICAgPGJyPgogICAgPC9ibG9ja3F1b3Rl PgogICAgPGJyPjwvZGl2PgogICAgQSBwcmV2YWlsaW5nIHRob3VnaHQgaGFzIGJlZW4gdG8gYWRk cmVzcyBiYWNrdXBzIG9uY2UgdGhlCiAgICByZW1lZGlhdGlvbnMgYXJlIGZpbmlzaGVkLCBhcyB3 ZSYjMzk7bGwgaGF2ZSBhIGJldHRlciBoYW5kbGUgZm9yIHdoaWNoCiAgICBmaWxlcyB3aWxsIG5l ZWQgYWRkcmVzc2luZy4gPGJyPgogICAgPGJyPgogICAgRm9yY2luZyB0aGUgYmFja3VwICh0aHJv dWdoIFhDQ0RGL09WQUwpIGlzIHRyaWNreS4gT25lIHRob3VnaHQgaGFzCiAgICBiZWVuIHRvIGNy ZWF0ZSBhbiBPVkFMIGNoZWNrIC0tIHdoaWNoIGlzIGxpc3RlZCBmaXJzdCBpbiB0aGUgcHJvZmls ZQogICAgLS0gd2hpY2ggd2lsbCAqYWx3YXlzKiBmYWlsLiBUaGUgcmVtZWRpYXRpb24gZm9yIHNh aWQgT1ZBTCB3b3VsZCBiZQogICAgdG8gcGVyZm9ybSB0aGUgYmFja3Vwcy4gQW55b25lIGhhdmUg YSBiZXR0ZXIgaWRlYT8gPS88ZGl2IGNsYXNzPSJpbSI+PGJyPgogICAgPGJyPgogICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIEFueXdheSwganVzdCB0cnlpbmcgdG8gZ2V0IGFuIGlk ZWEgb2YgaG93IHRvIHByb2NlZWQgc2V0IHNvbWUKICAgICAgZ29hbHMgZm9yIG15IGNvbnRyaWJ1 dGlvbnMuCiAgICAgIDxicj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj48L2Rpdj4KICAgIFRo ZXNlIGFyZSA8aT5yZWFsbHk8L2k+IGdvb2QgcXVlc3Rpb25zLiBUaGFua3MgZm9yIHN0YXJ0aW5n IHRoZQogICAgY29udmVyc2F0aW9uITxicj4KICAgIDxicj4KICA8L2Rpdj4KCjxicj5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4Kc2NhcC1zZWN1cml0 eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVk Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNl Y3VyaXR5LWd1aWRlPC9hPjxicj4KPGJyPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PGJyIGNsZWFy PSJhbGwiPjxkaXY+PGJyPjwvZGl2Pi0tIDxicj5UcmV2b3IgVmF1Z2hhbjxicj5WaWNlIFByZXNp ZGVudCwgT255eCBQb2ludCwgSW5jPGJyPig0MTApIDU0MS02Njk5PGJyPjxhIGhyZWY9Im1haWx0 bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIj50dmF1Z2hhbkBvbnl4cG9pbnQuY29tPC9hPjxicj48 YnI+LS0gVGhpcyBhY2NvdW50IG5vdCBhcHByb3ZlZCBmb3IgdW5lbmNyeXB0ZWQgcHJvcHJpZXRh cnkgaW5mb3JtYXRpb24gLS0KPC9kaXY+Cg== --===============2418921528860735122==-- From Joshua.Kayse at gtri.gatech.edu Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============8479751234429133328==" MIME-Version: 1.0 From: Kayse, Josh To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Fri, 04 Oct 2013 08:06:43 -0400 Message-ID: <524EAF53.2030507@gtri.gatech.edu> In-Reply-To: CANs+FoX-nAhQyNjokjqJ93S04iwDOU4+SUvaor8WjztvixaA3w@mail.gmail.com --===============8479751234429133328== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/04/2013 07:40 AM, Trevor Vaughan wrote: > Is Augeas an option? > > This seems like the perfect opportunity to solidify the Augeas lenses > regarding security settings while making life easier for everyone. > > Trevor > > > On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells > wrote: > > On 10/3/13 3:11 PM, fcaviggi(a)redhat.com > wrote: >> All, >> >> As a starting point for writing remediation fixes in the SSG - so, >> I did the following: >> >> $ ls ~//scap-security-guide/RHEL6/input/checks//*.xml | awk '{ >> print $1 }' | sed s/\.[^\.]*$// > ~/checks >> $ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh | awk '{ >> print $1 }' | sed s/\.[^\.]*$// > ~/fixes >> $ sdiff ~/fixes ~/checks | less >> >> There's fair a bit of work to be done for the fix remediations... >> >> Since I'm new to the project, I was wondering if there was any >> ideas or standards to how the SSG should distribute some of these >> fixes - for example - a wholesale replacement of the audit.rules >> and auditd.conf might be preferable than doing piecemeal sed's. > > It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules > /etc/audit.rules`, and that likely is the right choice during an > initial provisioning process. But then SysAdmins tailor audit rules, > the system evolves, and we need to evaluate the audit.rules file > against specific auditing guidance items after the pristine > audit.rules template is manipulated. > > So, if a single rule must be remediated, we can't blow away the > whole audit.rules file. Super fun sed scripts it is =3D/ > > I think that augeas is a good idea. We need to be careful that rules = that are inserted in to audit.rules happen before any '-e 2' line (if = one exists). Otherwise they will fail to be inserted because the audit = rules become locked. -josh -- = 404.407.6630 --===============8479751234429133328== Content-Type: application/pkcs7-signature MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIQGjCCBSYw ggMOoAMCAQICAgP+MA0GCSqGSIb3DQEBCwUAMGoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdHZW9y Z2lhMRAwDgYDVQQHEwdBdGxhbnRhMQ0wCwYDVQQKEwRHVFJJMQ4wDAYDVQQLEwVDVElTTDEYMBYG A1UEAxMPQ1RJU0wtR1RSSSBDQSAxMB4XDTEzMDUyOTE0MDExM1oXDTE0MDUyOTE0MDExM1owcTEL MAkGA1UEBhMCVVMxEDAOBgNVBAgTB0dlb3JnaWExEDAOBgNVBAcTB0F0bGFudGExDTALBgNVBAoT BEdUUkkxDjAMBgNVBAsTBUNUSVNMMQ8wDQYDVQQLEwZQZW9wbGUxDjAMBgNVBAMTBWprMjc1MIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxll8zKTK/ImmFXVVyRZJBow3CEq+5ESbE6XB x6o6vsEDExD8v0ZaZAINEaOpTSjiRk32ooeP5nkcWBunicYtLM+7bytp5by45W4I1nD8ACvalA1p iaic+OU8/zmDiqokVee3T46EbfGP+pGrFEElqquvhZzqbJWoUdCMhc0upcGyfs1jQtbhQcpd4Y1e Y0LNmmv1UTk09F5hjqoKccqrtyL0KPPATO2KFrB9K/cplCn5sHGlfSJXyQDfzyUD7oLdjfii3pXG x3P0dVZErsnFn5G/grZGm6NIKDd1XaQEkns4m3Yh6TegVv/MJoTtSuTGGSyEQImwU0oLEFvSQm1g XwIDAQABo4HOMIHLMB8GA1UdIwQYMBaAFJJUIWz3fObZCP7FFOzWGem+EkyYMFAGCCsGAQUFBwEB BEQwQjBABggrBgEFBQcwAYY0aHR0cDovL29jc3AuY3Rpc2wuZ3RyaS5nYXRlY2guZWR1OjExMTgw L29jc3AvZWUvb2NzcDAOBgNVHQ8BAf8EBAMCBSAwJwYDVR0RBCAwHoEcSm9zaHVhLktheXNlQGd0 cmkuZ2F0ZWNoLmVkdTAdBgNVHQ4EFgQUUW/jqpSAla5tyyfM/PWTcmm52iwwDQYJKoZIhvcNAQEL BQADggIBAGQna85MjDGl1gJtAveWYDKONroktIDKun9Nu4hnxUfjJJ2MrHF9NyoAt6mcO1dZCMZz Zzd2NHDH6S0Jqf6Lb1jDu5bp1MwoxDvMiB96G6MTH3vWWMKvKYK+2xuX4O7IQPkuRbIV9GCZB3C/ pMUjP2HMaxmRMUj35T8aNAozt4N2TGdsbO5PQ0NePJ+VMetEDQsluig7ABBQTyq7fFa9QXy0aSlz vPwMYC0ec23vM5N5ie+goz2QmVQWiHxGcf2Gm78FAnsUQhofJkMF/ArenfIUfPXx3tE9p1GcuIyg CQ5pi9l6zqjieDj+b7ZGT0Dvl4z1Jp7pl2X/1LkcdDxwyglQQS2SRYHHHyj5YDg/re6BSG3hL3XE ggJW8eGlQEqgw1Fgv4aVJlAMZWNuDhBico9qlC7OMbafki+luCgd+DWG3d9yfJDLmTGfVxvPuwTB 1qhZNlc5hg916mZWTTv8xid6fqL4nzmP4Yls0rxCp5PaQkSu4xGi3NF7VLqWUQlJENZR4NIEV6vy NSkUQJmflsC+lV6/nvDYdEIZXj8FI3mvh3kGje0QwRDwCbYXnlN3tElQ8PiCKN0Kxf8zQ2RBHExa mmsmiFCKeMGhrkPLFJpszHa/ZWm28afSVx6gGUfzU/ZMKbamoSk9MM8F/bKpEewa4gsnJhc8zkPB +qfj28llMIIFJjCCAw6gAwIBAgICA/8wDQYJKoZIhvcNAQELBQAwajELMAkGA1UEBhMCVVMxEDAO BgNVBAgTB0dlb3JnaWExEDAOBgNVBAcTB0F0bGFudGExDTALBgNVBAoTBEdUUkkxDjAMBgNVBAsT BUNUSVNMMRgwFgYDVQQDEw9DVElTTC1HVFJJIENBIDEwHhcNMTMwNTI5MTQwMTEzWhcNMTQwNTI5 MTQwMTEzWjBxMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHR2VvcmdpYTEQMA4GA1UEBxMHQXRsYW50 YTENMAsGA1UEChMER1RSSTEOMAwGA1UECxMFQ1RJU0wxDzANBgNVBAsTBlBlb3BsZTEOMAwGA1UE AxMFamsyNzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2ESM2CrmedPh/BqwzsguY gIDbnalqYarp/rhpqE0sPuYhGx5UT83RHZHZsPV7tjgJOuSziTLI+yPS4OSxSPjbQ7bepa47n77X eroMXx7kga2tulnZ36dhYigaKGBrkE4enXnTKjWr7iqjkG3BQo3pe70juriCRnm4/80U2DO/2A0I d1RTF7arrH4+zs/TXjvToF0soq44khGYVoAjrcyc+vEOLAElaGJp1df4BPwUgg3/TvWG8ij5UzSK Xsjb3zs/53hr1ibUCyp6jkp4ZjtoWw6F1N/LcymzgNay8mjAGHx4kcHPrWPHt9D5+vz3EH7TmtqG bK1SwUT3xeR23BmTAgMBAAGjgc4wgcswHwYDVR0jBBgwFoAUklQhbPd85tkI/sUU7NYZ6b4STJgw UAYIKwYBBQUHAQEERDBCMEAGCCsGAQUFBzABhjRodHRwOi8vb2NzcC5jdGlzbC5ndHJpLmdhdGVj aC5lZHU6MTExODAvb2NzcC9lZS9vY3NwMA4GA1UdDwEB/wQEAwIHgDAnBgNVHREEIDAegRxKb3No dWEuS2F5c2VAZ3RyaS5nYXRlY2guZWR1MB0GA1UdDgQWBBQxV6c/P9FLoi9NbVrWR0Uc7CaxeDAN BgkqhkiG9w0BAQsFAAOCAgEAKajl7/EiFJy78rUE4ujByYnp3e/j33GLCsS3S4hockjS9en/N80n I8R4kzAJ++cHafSH0izFoWS9y7Bie4msr0HF9QYJsk6a5kuVi+S+MRliE72eHXNRwsDQugKbJbvd vZq2zhSB6elSnc13ILbv2UCPrJxYx54pZXL/bQhSRi+nmiQyZyXUNR1yiLaciTPvMXH9uW/FNz2d lqyHnpujk/leOq4ARQYSdLFQ7dZh9xJD9PkjSCRAvB8c/x2qP/gfTBXO5oUxSR1JBTYmh7UsApLK t3jYF1X/Fvo98x4LZ5dBBhlCYAlp4xS8NDdV3j6oGWR3ro6XvzlZfv3QECOyFZT1rwZAAR0eTHbU vNGWSW5XN0dZDGJ0Z4ntNfcIC4HeZR7lbqiq8gq+ccFsskM0zULOjsHcKuePKRQVAiLd8FfA/LEC 6f/n1aqUfcGaD7o9dDYNGwGiEIZby1SnIMqK/luB10g8+q3WVKg+MT1s7X1nWe7syygOqznj8a1Z VyseIGx0+HOuUJWIRBUIe/sERnawBCIgZHXO8VOLIWQMyNe1ylTw90MdWAxRRPx6mRxIdqWR1hUb O9ODkoGLwmyWHKC/qNblVOMaWQmR8l7kLxNFwQkFGgJ3XboxAllrDF8o2RHc6HBPHdxRBLcfGALr rINuFIRmmd/hHuzrj7ETE2owggXCMIIDqqADAgECAggG0kwjIVFiRzANBgkqhkiG9w0BAQsFADBw MQswCQYDVQQGEwJVUzEQMA4GA1UECBMHR2VvcmdpYTEQMA4GA1UEBxMHQXRsYW50YTENMAsGA1UE ChMER1RSSTEOMAwGA1UECxMFQ1RJU0wxHjAcBgNVBAMTFUNUSVNMLUdUUkkgUEtJIFJvb3QgMTAe Fw0xMTA0MjcxNzA5NDRaFw0yMzA0MjcxNzA5NDRaMGoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdH ZW9yZ2lhMRAwDgYDVQQHEwdBdGxhbnRhMQ0wCwYDVQQKEwRHVFJJMQ4wDAYDVQQLEwVDVElTTDEY MBYGA1UEAxMPQ1RJU0wtR1RSSSBDQSAxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA sfmRQ/qpXynpVccOsyVUG3APEXBvNsoSNv7mQc1SA01nbsE9siNwEIicmyutvXDgmW8zBfoTO4cF ybtncZaSdGvC9etFobQkH2wOOczEXqRrxVLrkAPPk98bJn8jUv7nXxdkq/AEaHqESukD3wgVzRo4 kq+8OD6ZM/eXWlVYKbde+7U51nidLLVLhqiX8f+q47m311FwExhzpfYB48IVj13dmMuFb49akwf+ qpT1LUV/YL8QL8YjKg0e0T76VT4yqacZlkXOMKyfbgJ+DNvRyPqR/+S84kzIZlvzn9DA3Rc+RYaH wxmcUfEGiSu3hEq2ropbY5scjrPC8zh4FFK8LIwq6iVn0ce5xBe21TyGdTpshk1GZhOmz226/dAU /SV5wEO/CUrqbG6L5hoAWHwkmNJZSFmMdkBqJs4GmgwnD1Uakd7BkCWTH/V8zjaoTG6WHMygfb/F MfRGJrekcRbxZeCYhFTN7ROjRU9jjfFJrnnfv83wFQjruTj9LL95y8HYE/KAWl0c3ILIcjCxjKyM BHu8QeTqfrWzm6/LiO2yMUFdymiHau/TsV3foP7E7TslAldU1uSVo3AFn5rNPEZjGnjjlg//XPSx PxjxKjpakRBuJIess4rIq8sEQ6o8ovUFgM8VZfyEDzGbc/tMrb/+y2BxI1zBFomfNLUZ4nt62SEC AwEAAaNmMGQwHwYDVR0jBBgwFoAUFxCSy/lGy2+LAw+eUnto8/9ysawwHQYDVR0OBBYEFJJUIWz3 fObZCP7FFOzWGem+EkyYMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgECMA0GCSqG SIb3DQEBCwUAA4ICAQBzfvU2Yrs9zwQZRR9dEdHnNlMNDfgnl1cAOuw2VtVmSgCjohakhmxZEjTJ Qo9qj3m4uNRrIMfnf3FGC7UJmIfMP3JzGkB4oO38m7FKuvbYgC9vBTLZ4GQry4reblMDdYGzejkL 1e822T735Q8JJSTh+Hn5jDBxFxrszsShs4yBQcJVUP+3JRVRDZWf6x8NVvUQiPa4gf+LeB62qhWa 4mW4SkG5Yd8ze1mmUerPIPIPOQWQ1TPOBt/tMAuce1uy6tfqwqgPu6QEILj9lvqQ8gI1D+2aa9/f 1/iw/hjE+R/KsG+A/PvzJBk+w0nGMPk/Tw1iuTpkra410da548AywenBq50BBiMnrxRorma/+6Ad we0ycNAE1JEkCaI7/S3oEBpAnUi0oAj89h/abnVdH6idkNNCvcjvXOUUvhDBbhhkcOhnJwtErZsS pdGgw7NwY3YMjaZrL8E9zjS3X/zsmPAkwxAMupO991Ug8MBboAp5MYDc3vcrU18gw2Bru0BToHii Hb0lTcuiKwfxqIOQitNmsi2/xYDtwKpekOMSSQ/nvfHyWEa1ei/qx2lVDJOW2jpVbRFEZAIwv/lP dYdilwn/YQTTwauCu4kuDZN7+dgFnNplise7CwLIln1eLWQOCIiSPctSoO4KAJg2dreS7xxsHSF1 n491h8xZO/XPyCcfIjGCA2swggNnAgEBMHAwajELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0dlb3Jn aWExEDAOBgNVBAcTB0F0bGFudGExDTALBgNVBAoTBEdUUkkxDjAMBgNVBAsTBUNUSVNMMRgwFgYD VQQDEw9DVElTTC1HVFJJIENBIDECAgP/MAkGBSsOAwIaBQCgggHQMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEzMTAwNDEyMDY0M1owIwYJKoZIhvcNAQkEMRYEFA/9 5/dNQnT4IrEEqf1/cNumj9BWMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFl AwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw DQYIKoZIhvcNAwICASgwfwYJKwYBBAGCNxAEMXIwcDBqMQswCQYDVQQGEwJVUzEQMA4GA1UECBMH R2VvcmdpYTEQMA4GA1UEBxMHQXRsYW50YTENMAsGA1UEChMER1RSSTEOMAwGA1UECxMFQ1RJU0wx GDAWBgNVBAMTD0NUSVNMLUdUUkkgQ0EgMQICA/4wgYEGCyqGSIb3DQEJEAILMXKgcDBqMQswCQYD VQQGEwJVUzEQMA4GA1UECBMHR2VvcmdpYTEQMA4GA1UEBxMHQXRsYW50YTENMAsGA1UEChMER1RS STEOMAwGA1UECxMFQ1RJU0wxGDAWBgNVBAMTD0NUSVNMLUdUUkkgQ0EgMQICA/4wDQYJKoZIhvcN AQEBBQAEggEAKKP1ub22hqlqy2iW8A5cG+1z7IAfExDygZuVrJVP8r3vgy4PEOYqEK6YwOWLQBUk BEpeaQP5yoAoFGvostaim/IBp6B3IxiamiL4YHGIXBvIpk6UgTejR9Xom68ULxCSyqreFAqlR51t F+cHOWwFakWyAfCihOPqSGk6TydscjQwKdbSaforDnLLNUjR14Vt1aoNYoE7v1WCOAIoBBYS6xbO LHOlK5qSp50owmIcpb9rxZQqfidksNhY/gKmd+EHF64dVxBfVJkoQu0A7mV245Kkhmbp8cR3zglY QA2Jlp0jv4WA/YN0JMro7ZwM1KmLXKehgaG6v/iyOpr6Y96Q3AAAAAAAAA== --===============8479751234429133328==-- From fcaviggi at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============1455411898623140242==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Fri, 04 Oct 2013 08:50:23 -0400 Message-ID: <524EB98F.7040007@redhat.com> In-Reply-To: 524E1D1D.1000209@redhat.com --===============1455411898623140242== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hey Shawn, I was thinking this trough last night - I was wondering if we can use = checksums (sha256+) to determine if someone is using the "stock" = configuration and replace it with a fully STIGed version - I'm thinking = this would be best applicable to new installations of RHEL. I understand = the need for atomic fixes for pre-existing systems, where the SA has = modified the defaults, but I can guarantee you that most people just = want a STIG'ed box out of the gate on install. I'm just trying to think = in terms of long term and short term goals - the quicker we can satisfy = the majority of the users (the ones that want something STIG'ed out of = the box) the better acceptance the product will have, the long term = should be to modify things for the people that mucked with their = configurations, which I'm arguing is a minority. I go back to Star Trek II: Wrath of Khan with Spock, "It is logical. The = needs of the many = outweigh...the needs = of the few...or the = one." We need to get the ship out of danger, and then worry about the = needs of the few. What do you think of my solution? -Frank On 10/03/2013 09:42 PM, Shawn Wells wrote: > On 10/3/13 3:11 PM, fcaviggi(a)redhat.com wrote: >> All, >> >> As a starting point for writing remediation fixes in the SSG - so, I = >> did the following: >> >> $ ls ~/scap-security-guide/RHEL6/input/checks/*.xml | awk '{ = >> print $1 }' | sed s/\.[^\.]*$// > ~/checks >> $ ls ~/scap-security-guide/RHEL6/input/fixes/*.sh | awk '{ print = >> $1 }' | sed s/\.[^\.]*$// > ~/fixes >> $ sdiff ~/fixes ~/checks | less >> >> There's fair a bit of work to be done for the fix remediations... >> >> Since I'm new to the project, I was wondering if there was any ideas = >> or standards to how the SSG should distribute some of these fixes - = >> for example - a wholesale replacement of the audit.rules and = >> auditd.conf might be preferable than doing piecemeal sed's. > > It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules = > /etc/audit.rules`, and that likely is the right choice during an = > initial provisioning process. But then SysAdmins tailor audit rules, = > the system evolves, and we need to evaluate the audit.rules file = > against specific auditing guidance items after the pristine = > audit.rules template is manipulated. > > So, if a single rule must be remediated, we can't blow away the whole = > audit.rules file. Super fun sed scripts it is =3D/ > > >> I also think the first script that needs to be run is to tar the = >> current existing configurations (as a backup) before applying any fix = >> just in case we do something that jacks the users modifications to = >> the system. > > A prevailing thought has been to address backups once the remediations = > are finished, as we'll have a better handle for which files will need = > addressing. > > Forcing the backup (through XCCDF/OVAL) is tricky. One thought has = > been to create an OVAL check -- which is listed first in the profile = > -- which will *always* fail. The remediation for said OVAL would be to = > perform the backups. Anyone have a better idea? =3D/ > >> Anyway, just trying to get an idea of how to proceed set some goals = >> for my contributions. > > These are /really/ good questions. Thanks for starting the conversation! > > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============1455411898623140242== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5IZXkgU2hhd24sPGJyPgogICAgICA8YnI+CiAgICAgIEkgd2FzIHRoaW5raW5nIHRoaXMgdHJv dWdoIGxhc3QgbmlnaHQgLSBJIHdhcyB3b25kZXJpbmcgaWYgd2UgY2FuCiAgICAgIHVzZSBjaGVj a3N1bXMgKHNoYTI1NispIHRvIGRldGVybWluZSBpZiBzb21lb25lIGlzIHVzaW5nIHRoZQogICAg ICAic3RvY2siIGNvbmZpZ3VyYXRpb24gYW5kIHJlcGxhY2UgaXQgd2l0aCBhIGZ1bGx5IFNUSUdl ZCB2ZXJzaW9uIC0KICAgICAgSSdtIHRoaW5raW5nIHRoaXMgd291bGQgYmUgYmVzdCBhcHBsaWNh YmxlIHRvIG5ldyBpbnN0YWxsYXRpb25zIG9mCiAgICAgIFJIRUwuIEkgdW5kZXJzdGFuZCB0aGUg bmVlZCBmb3LCoCBhdG9taWMgZml4ZXMgZm9yIHByZS1leGlzdGluZwogICAgICBzeXN0ZW1zLCB3 aGVyZSB0aGUgU0EgaGFzIG1vZGlmaWVkIHRoZSBkZWZhdWx0cywgYnV0IEkgY2FuCiAgICAgIGd1 YXJhbnRlZSB5b3UgdGhhdCBtb3N0IHBlb3BsZSBqdXN0IHdhbnQgYSBTVElHJ2VkIGJveCBvdXQg b2YgdGhlCiAgICAgIGdhdGUgb24gaW5zdGFsbC4gSSdtIGp1c3QgdHJ5aW5nIHRvIHRoaW5rIGlu IHRlcm1zIG9mIGxvbmcgdGVybQogICAgICBhbmQgc2hvcnQgdGVybSBnb2FscyAtIHRoZSBxdWlj a2VyIHdlIGNhbiBzYXRpc2Z5IHRoZSBtYWpvcml0eSBvZgogICAgICB0aGUgdXNlcnMgKHRoZSBv bmVzIHRoYXQgd2FudCBzb21ldGhpbmcgU1RJRydlZCBvdXQgb2YgdGhlIGJveCkKICAgICAgdGhl IGJldHRlciBhY2NlcHRhbmNlIHRoZSBwcm9kdWN0IHdpbGwgaGF2ZSwgdGhlIGxvbmcgdGVybSBz aG91bGQKICAgICAgYmUgdG8gbW9kaWZ5IHRoaW5ncyBmb3IgdGhlIHBlb3BsZSB0aGF0IG11Y2tl ZCB3aXRoIHRoZWlyCiAgICAgIGNvbmZpZ3VyYXRpb25zLCB3aGljaCBJJ20gYXJndWluZyBpcyBh IG1pbm9yaXR5Ljxicj4KICAgICAgwqA8YnI+CiAgICAgIEkgZ28gYmFjayB0byBTdGFyIFRyZWsg SUk6IFdyYXRoIG9mIEtoYW4gd2l0aCBTcG9jaywgIkl0IGlzCiAgICAgIGxvZ2ljYWwuIFRoZSBu ZWVkcyBvZiB0aGUgbWFueSBvdXR3ZWlnaDxhCiAgICAgICAgaHJlZj0iaHR0cDovL3d3dy5pbWRi LmNvbS9uYW1lL25tMDAwMDYzOC8/cmVmXz10dF90cnZfcXUiPjxzcGFuCiAgICAgICAgICBjbGFz cz0iY2hhcmFjdGVyIj48L3NwYW4+PC9hPi4uLnRoZSBuZWVkcyBvZiB0aGUgZmV3PGEKICAgICAg ICBocmVmPSJodHRwOi8vd3d3LmltZGIuY29tL25hbWUvbm0wMDAwNTU5Lz9yZWZfPXR0X3Rydl9x dSI+PHNwYW4KICAgICAgICAgIGNsYXNzPSJjaGFyYWN0ZXIiPjwvc3Bhbj48L2E+Li4ub3IgdGhl IG9uZS4iwqAgV2UgbmVlZCB0byBnZXQKICAgICAgdGhlIHNoaXAgb3V0IG9mIGRhbmdlciwgYW5k IHRoZW4gd29ycnkgYWJvdXQgdGhlIG5lZWRzIG9mIHRoZSBmZXcuPGJyPgogICAgICA8YnI+CiAg ICAgIFdoYXQgZG8geW91IHRoaW5rIG9mIG15IHNvbHV0aW9uPzxicj4KICAgICAgPGJyPgogICAg ICAtRnJhbms8YnI+CiAgICAgIDxicj4KICAgICAgT24gMTAvMDMvMjAxMyAwOTo0MiBQTSwgU2hh d24gV2VsbHMgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZSBjaXRlPSJtaWQ6 NTI0RTFEMUQuMTAwMDIwOUByZWRoYXQuY29tIiB0eXBlPSJjaXRlIj4KICAgICAgPG1ldGEgY29u dGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUi PgogICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDEwLzMvMTMgMzoxMSBQTSwg PGEKICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1h YmJyZXZpYXRlZCIKICAgICAgICAgIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIj5m Y2F2aWdnaUByZWRoYXQuY29tPC9hPgogICAgICAgIHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAg ICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1MjREQzE3MC42MDEwNTAyQHJlZGhhdC5jb20iIHR5 cGU9ImNpdGUiPkFsbCwKCiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICBBcyBhIHN0 YXJ0aW5nIHBvaW50IGZvciB3cml0aW5nIHJlbWVkaWF0aW9uIGZpeGVzIGluIHRoZSBTU0cgLQog ICAgICAgIHNvLCBJIGRpZCB0aGUgZm9sbG93aW5nOiA8YnI+CiAgICAgICAgPGJyPgogICAgICAg IMKgwqDCoCAkIGxzIH48aSBjbGFzcz0ibW96LXR4dC1zbGFzaCI+PHNwYW4gY2xhc3M9Im1vei10 eHQtdGFnIj4vPC9zcGFuPnNjYXAtc2VjdXJpdHktZ3VpZGUvUkhFTDYvaW5wdXQvY2hlY2tzPHNw YW4KICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtdGFnIj4vPC9zcGFuPjwvaT4qLnhtbCB8IGF3 ayAneyBwcmludCAkMSB9JyB8CiAgICAgICAgc2VkIHMvXC5bXlwuXSokLy8gJmd0OyB+L2NoZWNr cyA8YnI+CiAgICAgICAgwqDCoMKgICQgbHMgfjxpIGNsYXNzPSJtb3otdHh0LXNsYXNoIj48c3Bh biBjbGFzcz0ibW96LXR4dC10YWciPi88L3NwYW4+c2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9p bnB1dC9maXhlczxzcGFuCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LXRhZyI+Lzwvc3Bhbj48 L2k+Ki5zaCB8IGF3ayAneyBwcmludCAkMSB9JyB8CiAgICAgICAgc2VkIHMvXC5bXlwuXSokLy8g Jmd0OyB+L2ZpeGVzIDxicj4KICAgICAgICDCoMKgwqAgJCBzZGlmZiB+L2ZpeGVzIH4vY2hlY2tz IHwgbGVzcyA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIFRoZXJlJ3MgZmFpciBhIGJpdCBvZiB3 b3JrIHRvIGJlIGRvbmUgZm9yIHRoZSBmaXgKICAgICAgICByZW1lZGlhdGlvbnMuLi4gPGJyPgog ICAgICAgIDxicj4KICAgICAgICBTaW5jZSBJJ20gbmV3IHRvIHRoZSBwcm9qZWN0LCBJIHdhcyB3 b25kZXJpbmcgaWYgdGhlcmUgd2FzIGFueQogICAgICAgIGlkZWFzIG9yIHN0YW5kYXJkcyB0byBo b3cgdGhlIFNTRyBzaG91bGQgZGlzdHJpYnV0ZSBzb21lIG9mCiAgICAgICAgdGhlc2UgZml4ZXMg LSBmb3IgZXhhbXBsZSAtIGEgd2hvbGVzYWxlIHJlcGxhY2VtZW50IG9mIHRoZQogICAgICAgIGF1 ZGl0LnJ1bGVzIGFuZCBhdWRpdGQuY29uZiBtaWdodCBiZSBwcmVmZXJhYmxlIHRoYW4gZG9pbmcK ICAgICAgICBwaWVjZW1lYWwgc2VkJ3MuPC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAgICAgIEl0 J2QgYmUgb21neiBlYXNpZXIgdG8gYGNwIC91c3Ivc2hhcmUvZG9jL2F1ZGl0LSovc3RpZy5ydWxl cwogICAgICAvZXRjL2F1ZGl0LnJ1bGVzYCwgYW5kIHRoYXQgbGlrZWx5IGlzIHRoZSByaWdodCBj aG9pY2UgZHVyaW5nIGFuCiAgICAgIGluaXRpYWwgcHJvdmlzaW9uaW5nIHByb2Nlc3MuIEJ1dCB0 aGVuIFN5c0FkbWlucyB0YWlsb3IgYXVkaXQKICAgICAgcnVsZXMsIHRoZSBzeXN0ZW0gZXZvbHZl cywgYW5kIHdlIG5lZWQgdG8gZXZhbHVhdGUgdGhlIGF1ZGl0LnJ1bGVzCiAgICAgIGZpbGUgYWdh aW5zdCBzcGVjaWZpYyBhdWRpdGluZyBndWlkYW5jZSBpdGVtcyBhZnRlciB0aGUgcHJpc3RpbmUK ICAgICAgYXVkaXQucnVsZXMgdGVtcGxhdGUgaXMgbWFuaXB1bGF0ZWQuIDxicj4KICAgICAgPGJy PgogICAgICBTbywgaWYgYSBzaW5nbGUgcnVsZSBtdXN0IGJlIHJlbWVkaWF0ZWQsIHdlIGNhbid0 IGJsb3cgYXdheSB0aGUKICAgICAgd2hvbGUgYXVkaXQucnVsZXMgZmlsZS4gU3VwZXIgZnVuIHNl ZCBzY3JpcHRzIGl0IGlzID0vPGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGJsb2Nr cXVvdGUgY2l0ZT0ibWlkOjUyNERDMTcwLjYwMTA1MDJAcmVkaGF0LmNvbSIgdHlwZT0iY2l0ZSI+ IEkKICAgICAgICBhbHNvIHRoaW5rIHRoZSBmaXJzdCBzY3JpcHQgdGhhdCBuZWVkcyB0byBiZSBy dW4gaXMgdG8gdGFyIHRoZQogICAgICAgIGN1cnJlbnQgZXhpc3RpbmcgY29uZmlndXJhdGlvbnMg KGFzIGEgYmFja3VwKSBiZWZvcmUgYXBwbHlpbmcKICAgICAgICBhbnkgZml4IGp1c3QgaW4gY2Fz ZSB3ZSBkbyBzb21ldGhpbmcgdGhhdCBqYWNrcyB0aGUgdXNlcnMKICAgICAgICBtb2RpZmljYXRp b25zIHRvIHRoZSBzeXN0ZW0uIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAg ICAgIEEgcHJldmFpbGluZyB0aG91Z2h0IGhhcyBiZWVuIHRvIGFkZHJlc3MgYmFja3VwcyBvbmNl IHRoZQogICAgICByZW1lZGlhdGlvbnMgYXJlIGZpbmlzaGVkLCBhcyB3ZSdsbCBoYXZlIGEgYmV0 dGVyIGhhbmRsZSBmb3Igd2hpY2gKICAgICAgZmlsZXMgd2lsbCBuZWVkIGFkZHJlc3NpbmcuIDxi cj4KICAgICAgPGJyPgogICAgICBGb3JjaW5nIHRoZSBiYWNrdXAgKHRocm91Z2ggWENDREYvT1ZB TCkgaXMgdHJpY2t5LiBPbmUgdGhvdWdodCBoYXMKICAgICAgYmVlbiB0byBjcmVhdGUgYW4gT1ZB TCBjaGVjayAtLSB3aGljaCBpcyBsaXN0ZWQgZmlyc3QgaW4gdGhlCiAgICAgIHByb2ZpbGUgLS0g d2hpY2ggd2lsbCAqYWx3YXlzKiBmYWlsLiBUaGUgcmVtZWRpYXRpb24gZm9yIHNhaWQgT1ZBTAog ICAgICB3b3VsZCBiZSB0byBwZXJmb3JtIHRoZSBiYWNrdXBzLiBBbnlvbmUgaGF2ZSBhIGJldHRl ciBpZGVhPyA9Lzxicj4KICAgICAgPGJyPgogICAgICA8YmxvY2txdW90ZSBjaXRlPSJtaWQ6NTI0 REMxNzAuNjAxMDUwMkByZWRoYXQuY29tIiB0eXBlPSJjaXRlIj4KICAgICAgICBBbnl3YXksIGp1 c3QgdHJ5aW5nIHRvIGdldCBhbiBpZGVhIG9mIGhvdyB0byBwcm9jZWVkIHNldCBzb21lCiAgICAg ICAgZ29hbHMgZm9yIG15IGNvbnRyaWJ1dGlvbnMuIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgog ICAgICA8YnI+CiAgICAgIFRoZXNlIGFyZSA8aT5yZWFsbHk8L2k+IGdvb2QgcXVlc3Rpb25zLiBU aGFua3MgZm9yIHN0YXJ0aW5nIHRoZQogICAgICBjb252ZXJzYXRpb24hPGJyPgogICAgICA8YnI+ CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+ PC9maWVsZHNldD4KICAgICAgPGJyPgogICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2NhcC1zZWN1cml0eS1ndWlkZSBtYWls aW5nIGxpc3QKPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRv OnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+c2NhcC1zZWN1cml0 eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8YSBjbGFzcz0ibW96LXR4dC1saW5r LWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9s aXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5v cmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPgo8L3ByZT4KICAgIDwv YmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxicj4KICAgIDxwcmUgY2xhc3M9Im1vei1zaWduYXR1 cmUiIGNvbHM9IjcyIj4tLSAKRnJhbmsgQ2F2aWdnaWEKQ29uc3VsdGFudCwgUHVibGljIFNlY3Rv cgo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZmNhdmln Z2lAcmVkaGF0LmNvbSI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4KKE0pICg1NzEpIDI5NS00NTYw PC9wcmU+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============1455411898623140242==-- From jlieskov at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============0543374038693363256==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Fri, 04 Oct 2013 13:11:09 -0400 Message-ID: <330874596.1539148.1380906669499.JavaMail.root@redhat.com> In-Reply-To: 384296917.1538759.1380906516494.JavaMail.root@redhat.com --===============0543374038693363256== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Introduce new SELinux section of the guide and first rule for it - check if SELinux is enabled in currently booted kernel. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============0543374038693363256== Content-Type: text/x-patch MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-Fedora-Introduce-Ensure-SELinux-Not-Disabled-in-Curr.patch" RnJvbSAwZTQ5MWY2M2M1MjM5MTQ2ZjZkYjM1M2U1YTNiN2E1Nzg1YTM0YmI4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4K RGF0ZTogRnJpLCA0IE9jdCAyMDEzIDE4OjU2OjA3ICswMjAwClN1YmplY3Q6IFtQQVRDSF0gW0Zl ZG9yYV0gSW50cm9kdWNlICdFbnN1cmUgU0VMaW51eCBOb3QgRGlzYWJsZWQgaW4gQ3VycmVudGx5 CiBSdW5uaW5nIEtlcm5lbCcgcnVsZQoKClNpZ25lZC1vZmYtYnk6IEphbiBMaWVza292c2t5IDxq bGllc2tvdkByZWRoYXQuY29tPgotLS0KIC4uLi9jaGVja3MvZW5hYmxlX3NlbGludXhfaW5fcnVu bmluZ19rZXJuZWwueG1sICAgIHwgMjQgKysrKysrKwogRmVkb3JhL2lucHV0L2d1aWRlLnhtbCAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMiArLQogRmVkb3JhL2lucHV0L2d1aWRlLnhz bHQgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMSArCiBGZWRvcmEvaW5wdXQvcHJvZmls ZXMvY29tbW9uLnhtbCAgICAgICAgICAgICAgICAgICB8ICAxICsKIEZlZG9yYS9pbnB1dC9zeXN0 ZW0vc2VsaW51eC54bWwgICAgICAgICAgICAgICAgICAgIHwgNzggKysrKysrKysrKysrKysrKysr KysrKwogRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyAgICAgICAgICAgICAgICAgICAg fCAgNSArLQogNiBmaWxlcyBjaGFuZ2VkLCAxMDkgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMo LSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBGZWRvcmEvaW5wdXQvY2hlY2tzL2VuYWJsZV9zZWxpbnV4 X2luX3J1bm5pbmdfa2VybmVsLnhtbAogY3JlYXRlIG1vZGUgMTAwNjQ0IEZlZG9yYS9pbnB1dC9z eXN0ZW0vc2VsaW51eC54bWwKCmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvY2hlY2tzL2VuYWJs ZV9zZWxpbnV4X2luX3J1bm5pbmdfa2VybmVsLnhtbCBiL0ZlZG9yYS9pbnB1dC9jaGVja3MvZW5h YmxlX3NlbGludXhfaW5fcnVubmluZ19rZXJuZWwueG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0Cmlu ZGV4IDAwMDAwMDAuLjE1ZWFiZjAKLS0tIC9kZXYvbnVsbAorKysgYi9GZWRvcmEvaW5wdXQvY2hl Y2tzL2VuYWJsZV9zZWxpbnV4X2luX3J1bm5pbmdfa2VybmVsLnhtbApAQCAtMCwwICsxLDI0IEBA Cis8ZGVmLWdyb3VwPgorICA8ZGVmaW5pdGlvbiBjbGFzcz0iY29tcGxpYW5jZSIgaWQ9ImVuYWJs ZV9zZWxpbnV4X2luX3J1bm5pbmdfa2VybmVsIiB2ZXJzaW9uPSIxIj4KKyAgICA8bWV0YWRhdGE+ CisgICAgICA8dGl0bGU+RW5zdXJlIFNFTGludXggTm90IERpc2FibGVkIGluIEN1cnJlbnRseSBS dW5uaW5nIEtlcm5lbDwvdGl0bGU+CisgICAgICA8YWZmZWN0ZWQgZmFtaWx5PSJ1bml4Ij4KKyAg ICAgICAgPHBsYXRmb3JtPkZlZG9yYSAxOTwvcGxhdGZvcm0+CisgICAgICA8L2FmZmVjdGVkPgor ICAgICAgPGRlc2NyaXB0aW9uPgorICAgICAgRW5zdXJlIFNFTGludXggaXMgbm90IGRpc2FibGVk IGluIHRoZSBjdXJyZW50bHkgcnVubmluZyBMaW51eCBrZXJuZWwuCisgICAgICA8L2Rlc2NyaXB0 aW9uPgorICAgIDwvbWV0YWRhdGE+CisgICAgPGNyaXRlcmlhIGNvbW1lbnQ9ImVuc3VyZSBTRUxp bnV4IGlzIG5vdCBkaXNhYmxlZCBpbiB0aGUgY3VycmVudGx5IHJ1bm5pbmcgTGludXgga2VybmVs IiBvcGVyYXRvcj0iQU5EIj4KKyAgICAgIDxjcml0ZXJpb24gY29tbWVudD0idmVyaWZ5IHNlbGlu dXhmcyBwcmVzZW50IGluIC9wcm9jL21vdW50cyBmaWxlIiB0ZXN0X3JlZj0idGVzdF9lbnN1cmVf c2VsaW51eGZzX2luX3Byb2NfbW91bnRzIiAvPgorICAgIDwvY3JpdGVyaWE+CisgIDwvZGVmaW5p dGlvbj4KKyAgPGluZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSJhbGwiIGNoZWNrX2V4 aXN0ZW5jZT0ib25seV9vbmVfZXhpc3RzIiBjb21tZW50PSJjaGVjayBmb3IgZXhpc3RlbmNlIG9m IHNlbGludXhmcyBpbiAvcHJvYy9tb3VudHMgZmlsZSIgaWQ9InRlc3RfZW5zdXJlX3NlbGludXhm c19pbl9wcm9jX21vdW50cyIgdmVyc2lvbj0iMSIgPgorICAgIDxpbmQ6b2JqZWN0IG9iamVjdF9y ZWY9Im9ial9lbnN1cmVfc2VsaW51eGZzX2luX3Byb2NfbW91bnRzIiAvPgorICA8L2luZDp0ZXh0 ZmlsZWNvbnRlbnQ1NF90ZXN0PgorICA8aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBpZD0i b2JqX2Vuc3VyZV9zZWxpbnV4ZnNfaW5fcHJvY19tb3VudHMiIHZlcnNpb249IjEiPgorICAgIDxp bmQ6ZmlsZXBhdGg+L3Byb2MvbW91bnRzPC9pbmQ6ZmlsZXBhdGg+CisgICAgPGluZDpwYXR0ZXJu IG9wZXJhdGlvbj0icGF0dGVybiBtYXRjaCI+XlxzKnNlbGludXhmc1xzKi9zeXMvZnMvc2VsaW51 eFxzKnNlbGludXhmc1xzKnJ3LHJlbGF0aW1lXHMqMFxzKjBccyokPC9pbmQ6cGF0dGVybj4KKyAg ICA8aW5kOmluc3RhbmNlIGRhdGF0eXBlPSJpbnQiIG9wZXJhdGlvbj0iZXF1YWxzIj4xPC9pbmQ6 aW5zdGFuY2U+CisgIDwvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdD4KKzwvZGVmLWdyb3Vw PgpkaWZmIC0tZ2l0IGEvRmVkb3JhL2lucHV0L2d1aWRlLnhtbCBiL0ZlZG9yYS9pbnB1dC9ndWlk ZS54bWwKaW5kZXggOGQyMWZlOC4uZWU0MGU0NyAxMDA2NDQKLS0tIGEvRmVkb3JhL2lucHV0L2d1 aWRlLnhtbAorKysgYi9GZWRvcmEvaW5wdXQvZ3VpZGUueG1sCkBAIC0zNiw1ICszNiw1IEBAIHRy YWRlbWFya3Mgb3IgdHJhZGVtYXJrcyBvZiBSZWQgSGF0LCBJbmMuIGluIHRoZSBVbml0ZWQgU3Rh dGVzIGFuZCBvdGhlcgogY291bnRyaWVzLiBBbGwgb3RoZXIgbmFtZXMgYXJlIHJlZ2lzdGVyZWQg dHJhZGVtYXJrcyBvciB0cmFkZW1hcmtzIG9mIHRoZWlyCiByZXNwZWN0aXZlIGNvbXBhbmllcy48 L3JlYXItbWF0dGVyPgogPHBsYXRmb3JtIGlkcmVmPSJjcGU6L286ZmVkb3JhcHJvamVjdDpmZWRv cmE6MTkiIC8+Ci08dmVyc2lvbj4wLjAuMzwvdmVyc2lvbj4KKzx2ZXJzaW9uPjAuMC40PC92ZXJz aW9uPgogPC9CZW5jaG1hcms+CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvZ3VpZGUueHNsdCBi L0ZlZG9yYS9pbnB1dC9ndWlkZS54c2x0CmluZGV4IGEyNGJkZDkuLjI3MDI1ZDYgMTAwNjQ0Ci0t LSBhL0ZlZG9yYS9pbnB1dC9ndWlkZS54c2x0CisrKyBiL0ZlZG9yYS9pbnB1dC9ndWlkZS54c2x0 CkBAIC0yNCw2ICsyNCw3IEBACiAgICAgPHhzbDpjb3B5PgogICAgICAgPHhzbDpjb3B5LW9mIHNl bGVjdD0iQCp8bm9kZSgpIiAvPgogICAgICAgPHhzbDphcHBseS10ZW1wbGF0ZXMgc2VsZWN0PSJk b2N1bWVudCgnc3lzdGVtL3NvZnR3YXJlL3NvZnR3YXJlLnhtbCcpIiAvPgorICAgICAgPHhzbDph cHBseS10ZW1wbGF0ZXMgc2VsZWN0PSJkb2N1bWVudCgnc3lzdGVtL3NlbGludXgueG1sJykiIC8+ CiAgICAgPC94c2w6Y29weT4KICAgPC94c2w6dGVtcGxhdGU+CiAKZGlmZiAtLWdpdCBhL0ZlZG9y YS9pbnB1dC9wcm9maWxlcy9jb21tb24ueG1sIGIvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1v bi54bWwKaW5kZXggYTdkODU2Zi4uNDk3YjczNiAxMDA2NDQKLS0tIGEvRmVkb3JhL2lucHV0L3By b2ZpbGVzL2NvbW1vbi54bWwKKysrIGIvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwK QEAgLTYsNSArNiw2IEBACiA8c2VsZWN0IGlkcmVmPSJlbnN1cmVfZ3BnY2hlY2tfbmV2ZXJfZGlz YWJsZWQiIHNlbGVjdGVkPSJ0cnVlIi8+CiA8c2VsZWN0IGlkcmVmPSJlbnN1cmVfeXVtX2ZlZG9y YV91cGRhdGVzX3JlcG9fZW5hYmxlZCIgc2VsZWN0ZWQ9InRydWUiLz4KIDxzZWxlY3QgaWRyZWY9 InNlY3VyaXR5X3BhdGNoZXNfdXBfdG9fZGF0ZSIgc2VsZWN0ZWQ9InRydWUiLz4KKzxzZWxlY3Qg aWRyZWY9ImVuYWJsZV9zZWxpbnV4X2luX3J1bm5pbmdfa2VybmVsIiBzZWxlY3RlZD0idHJ1ZSIv PgogCiA8L1Byb2ZpbGU+CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvc3lzdGVtL3NlbGludXgu eG1sIGIvRmVkb3JhL2lucHV0L3N5c3RlbS9zZWxpbnV4LnhtbApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwLi5iODllMjM1Ci0tLSAvZGV2L251bGwKKysrIGIvRmVkb3JhL2lucHV0 L3N5c3RlbS9zZWxpbnV4LnhtbApAQCAtMCwwICsxLDc4IEBACis8R3JvdXAgaWQ9InNlbGludXgi PgorPHRpdGxlPlNFTGludXg8L3RpdGxlPgorPGRlc2NyaXB0aW9uPlNFTGludXggaXMgYSBmZWF0 dXJlIG9mIHRoZSBMaW51eCBrZXJuZWwgd2hpY2ggY2FuIGJlCit1c2VkIHRvIGd1YXJkIGFnYWlu c3QgbWlzY29uZmlndXJlZCBvciBjb21wcm9taXNlZCBwcm9ncmFtcy4KK1NFTGludXggZW5mb3Jj ZXMgdGhlIGlkZWEgdGhhdCBwcm9ncmFtcyBzaG91bGQgYmUgbGltaXRlZCBpbiB3aGF0CitmaWxl cyB0aGV5IGNhbiBhY2Nlc3MgYW5kIHdoYXQgYWN0aW9ucyB0aGV5IGNhbiB0YWtlLgorPGJyIC8+ PGJyIC8+CitUaGUgZGVmYXVsdCBTRUxpbnV4IHBvbGljeSwgYXMgY29uZmlndXJlZCBvbiBGZWRv cmEsIGhhcyBiZWVuCitzdWZmaWNpZW50bHkgZGV2ZWxvcGVkIGFuZCBkZWJ1Z2dlZCB0aGF0IGl0 IHNob3VsZCBiZSB1c2FibGUgb24KK2FsbW9zdCBhbnkgRmVkb3JhIG1hY2hpbmUgd2l0aCBtaW5p bWFsIGNvbmZpZ3VyYXRpb24gYW5kIGEgc21hbGwKK2Ftb3VudCBvZiBzeXN0ZW0gYWRtaW5pc3Ry YXRvciB0cmFpbmluZy4gVGhpcyBwb2xpY3kgcHJldmVudHMKK3N5c3RlbSBzZXJ2aWNlcyAtIGlu Y2x1ZGluZyBtb3N0IG9mIHRoZSBjb21tb24gbmV0d29yay12aXNpYmxlCitzZXJ2aWNlcyBzdWNo IGFzIG1haWwgc2VydmVycywgRlRQIHNlcnZlcnMsIGFuZCBETlMgc2VydmVycyAtIGZyb20KK2Fj Y2Vzc2luZyBmaWxlcyB3aGljaCB0aG9zZSBzZXJ2aWNlcyBoYXZlIG5vIHZhbGlkIHJlYXNvbiB0 bworYWNjZXNzLiBUaGlzIGFjdGlvbiBhbG9uZSBwcmV2ZW50cyBhIGh1Z2UgYW1vdW50IG9mIHBv c3NpYmxlIGRhbWFnZQorZnJvbSBuZXR3b3JrIGF0dGFja3MgYWdhaW5zdCBzZXJ2aWNlcywgZnJv bSB0cm9qYW5lZCBzb2Z0d2FyZSwgYW5kCitzbyBmb3J0aC4KKzxiciAvPjxiciAvPgorVGhpcyBn dWlkZSByZWNvbW1lbmRzIHRoYXQgU0VMaW51eCBiZSBlbmFibGVkIHVzaW5nIHRoZQorZGVmYXVs dCAodGFyZ2V0ZWQpIHBvbGljeSBvbiBldmVyeSBGZWRvcmEgc3lzdGVtLCB1bmxlc3MgdGhhdAor c3lzdGVtIGhhcyByZXF1aXJlbWVudHMgd2hpY2ggbWFrZSBhIHN0cm9uZ2VyIHBvbGljeQorYXBw cm9wcmlhdGUuCis8L2Rlc2NyaXB0aW9uPgorCis8R3JvdXAgaWQ9ImVuYWJsaW5nX3NlbGludXgi PgorPHRpdGxlPkVuYWJsZSBTRUxpbnV4PC90aXRsZT4KKzxkZXNjcmlwdGlvbj5FZGl0IHRoZSBm aWxlIDx0dD4vZXRjL3NlbGludXgvY29uZmlnPC90dD4uIEFkZCBvciBjb3JyZWN0IHRoZQorZm9s bG93aW5nIGxpbmVzOgorPHByZT4KK1NFTElOVVg9ZW5mb3JjaW5nCitTRUxJTlVYVFlQRT10YXJn ZXRlZAorPC9wcmU+CitUaGUgZGlyZWN0aXZlIDx0dD5TRUxJTlVYPWVuZm9yY2luZzwvdHQ+IGVu YWJsZXMgU0VMaW51eCBhdCBib290IHRpbWUuCitJZiBTRUxpbnV4IGlzIHN1c3BlY3RlZCBvZiBp bnZvbHZlbWVudCB3aXRoIGJvb3QtdGltZSBwcm9ibGVtcworKHVubGlrZWx5KSwgaXQgaXMgcG9z c2libGUgdG8gYm9vdCBpbnRvIHRoZSB3YXJuaW5nLW9ubHkgbW9kZQorPHR0PlNFTElOVVg9cGVy bWlzc2l2ZTwvdHQ+IGZvciBkZWJ1Z2dpbmcgcHVycG9zZXMuIE1ha2UgY2VydGFpbiB0byBjaGFu Z2UKK3RoZSBtb2RlIGJhY2sgdG8gZW5mb3JjaW5nIGFmdGVyIGRlYnVnZ2luZywgc2V0IHRoZSBm aWxlc3lzdGVtcyB0bworYmUgcmVsYWJlbGVkIGZvciBjb25zaXN0ZW5jeSB1c2luZyB0aGUgY29t bWFuZCA8dHQ+dG91Y2gKKy8uYXV0b3JlbGFiZWw8L3R0PiwgYW5kIHJlYm9vdC4KKzxiciAvPjxi ciAvPgorSG93ZXZlciwgdGhlIEZlZG9yYSBkZWZhdWx0IFNFTGludXggY29uZmlndXJhdGlvbiBz aG91bGQgYmUKK3N1ZmZpY2llbnRseSByZWFzb25hYmxlIHRoYXQgbW9zdCBzeXN0ZW1zIHdpbGwg Ym9vdCB3aXRob3V0IHNlcmlvdXMKK3Byb2JsZW1zLiBTb21lIGFwcGxpY2F0aW9ucyB0aGF0IHJl cXVpcmUgZGVlcCBvciB1bnVzdWFsIHN5c3RlbQorcHJpdmlsZWdlcywgc3VjaCBhcyB2aXJ0dWFs IG1hY2hpbmUgc29mdHdhcmUsIG1heSBub3QgYmUgY29tcGF0aWJsZQord2l0aCBTRUxpbnV4IGlu IGl0cyBkZWZhdWx0IGNvbmZpZ3VyYXRpb24uIEhvd2V2ZXIsIHRoaXMgc2hvdWxkIGJlCit1bmNv bW1vbiwgYW5kIFNFTGludXgncyBhcHBsaWNhdGlvbiBzdXBwb3J0IGNvbnRpbnVlcyB0byBpbXBy b3ZlLgorSW4gb3RoZXIgY2FzZXMsIFNFTGludXggbWF5IHJldmVhbCB1bnVzdWFsIG9yIGluc2Vj dXJlIHByb2dyYW0KK2JlaGF2aW9yIGJ5IGRlc2lnbi4KKzxiciAvPjxiciAvPgorVGhlIGRpcmVj dGl2ZSA8dHQ+U0VMSU5VWFRZUEU9dGFyZ2V0ZWQ8L3R0PiBjb25maWd1cmVzIFNFTGludXggdG8g dXNlCit0aGUgZGVmYXVsdCB0YXJnZXRlZCBwb2xpY3kuCis8YnIgLz48YnIgLz4KK1RoZSBTRUxp bnV4IGJvb3QgbW9kZSBzcGVjaWZpZWQgaW4gPHR0Pi9ldGMvc2VsaW51eC9jb25maWc8L3R0PiBj YW4gYmUKK292ZXJyaWRkZW4gYnkgY29tbWFuZC1saW5lIGFyZ3VtZW50cyBwYXNzZWQgdG8gdGhl IGtlcm5lbC4gSXQgaXMKK25lY2Vzc2FyeSB0byBjaGVjayA8dHQ+L2V0Yy9ncnViMi5jZmc8L3R0 PiwgPHR0Pi9ldGMvZGVmYXVsdC9ncnViPC90dD4sCithbmQgPHR0PmdydWIyLW1rY29uZmlnPC90 dD4gdGVtcGxhdGVzIGZyb20gPHR0Pi9ldGMvZ3J1Yi5kPC90dD4gdG8gZW5zdXJlCit0aGF0IHRo aXMgaGFzIG5vdCBiZWVuIGRvbmUgYW5kIHRvIHByb3RlY3QgdGhlIGJvb3QgcHJvY2Vzcy4KKzwv ZGVzY3JpcHRpb24+CisKKzxSdWxlIGlkPSJlbmFibGVfc2VsaW51eF9pbl9ydW5uaW5nX2tlcm5l bCIgc2V2ZXJpdHk9Im1lZGl1bSI+Cis8dGl0bGU+RW5zdXJlIFNFTGludXggTm90IERpc2FibGVk IGluIEN1cnJlbnRseSBSdW5uaW5nIEtlcm5lbDwvdGl0bGU+Cis8ZGVzY3JpcHRpb24+CitTRUxp bnV4IGNhbiBiZSBkaXNhYmxlZCBhdCBib290IHRpbWUgdmlhIGEgPHR0PnNlbGludXg9MDwvdHQ+ IGtlcm5lbAorYm9vdCBjb21tYW5kLWxpbmUgcGFyYW1ldGVyLiBSZW1vdmUgYW55IGluc3RhbmNl cyBvZiA8dHQ+c2VsaW51eD0wPC90dD4KK2Zyb20gdGhlIGtlcm5lbCBib290IGNvbW1hbmQtbGlu ZSBhcmd1bWVudHMgdG8gcHJldmVudCBTRUxpbnV4IGZyb20gYmVpbmcKK2Rpc2FibGVkIGF0IGJv b3QuCis8L2Rlc2NyaXB0aW9uPgorPHJhdGlvbmFsZT4KK0Rpc2FibGluZyBhIG1ham9yIGhvc3Qg cHJvdGVjdGlvbiBmZWF0dXJlLCBzdWNoIGFzIFNFTGludXgsIGF0IGJvb3QgdGltZSBwcmV2ZW50 cworaXQgZnJvbSBjb25maW5pbmcgc3lzdGVtIHNlcnZpY2VzIGF0IGJvb3QgdGltZS4gRnVydGhl ciwgaXQgaW5jcmVhc2VzCit0aGUgY2hhbmNlcyB0aGF0IGl0IHdpbGwgcmVtYWluIG9mZiBkdXJp bmcgc3lzdGVtIG9wZXJhdGlvbi4KKzwvcmF0aW9uYWxlPgorPG92YWwgaWQ9ImVuYWJsZV9zZWxp bnV4X2luX3J1bm5pbmdfa2VybmVsIiAvPgorPHJlZiBuaXN0PSJBQy0zLEFDLTMoMyksQUMtNixB VS05IiBkaXNhPSIyMiwzMiIvPgorPC9SdWxlPgorPC9Hcm91cD4KKworPC9Hcm91cD4KZGlmZiAt LWdpdCBhL0ZlZG9yYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgYi9GZWRvcmEvc2NhcC1zZWN1 cml0eS1ndWlkZS5zcGVjCmluZGV4IGQ3MTE4ZTEuLjU4YzZlYzEgMTAwNjQ0Ci0tLSBhL0ZlZG9y YS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKKysrIGIvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3Vp ZGUuc3BlYwpAQCAtNSw3ICs1LDcgQEAKICMgZmlsZSBvbmUgbGV2ZWwgdXAgLSBpbiB0aGUgbWFp biBzY2FwLXNlY3VyaXR5LWd1aWRlIGRpcmVjdG9yeSAoaW5zdGVhZCBvZgogIyB0aGlzIG9uZSku CiAKLSVnbG9iYWwJZmVkb3Jhc3NncmVsZWFzZQkyLnJjMgorJWdsb2JhbAlmZWRvcmFzc2dyZWxl YXNlCTIucmMzCiAKIE5hbWU6CQlzY2FwLXNlY3VyaXR5LWd1aWRlCiBWZXJzaW9uOgkwLjEKQEAg LTUwLDYgKzUwLDkgQEAgcm0gLXJmICRSUE1fQlVJTERfUk9PVAogJXtfZGF0YWRpcn0veG1sL3Nj YXAvc3NnL2ZlZG9yYS8xOS8qCiAKICVjaGFuZ2Vsb2cKKyogRnJpIE9jdCAwNCAyMDEzIEphbiBp YW5ra28gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4gMC4xLTIucmMzCistIEludHJv ZHVjZSAnRW5zdXJlIFNFTGludXggTm90IERpc2FibGVkIGluIEN1cnJlbnRseSBSdW5uaW5nIEtl cm5lbCcgcnVsZS4KKwogKiBUaHUgT2N0IDAzIDIwMTMgSmFuIGlhbmtrbyBMaWVza292c2t5IDxq bGllc2tvdkByZWRoYXQuY29tPiAwLjEtMi5yYzIKIC0gSW50cm9kdWNlICdFbnN1cmUgWXVtIGZl ZG9yYS11cGRhdGVzIFJlcG9zaXRvcnkgRW5hYmxlZCcgcnVsZS4KIC0gSW50cm9kdWNlICdFbnN1 cmUgU29mdHdhcmUgU2VjdXJpdHkgUGF0Y2hlcyBJbnN0YWxsZWQnIHJ1bGUuCi0tIAoxLjcuMTEu NwoK --===============0543374038693363256==-- From fcaviggi at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============5112076519889528492==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Fri, 04 Oct 2013 14:49:32 -0400 Message-ID: <524F0DBC.8010704@redhat.com> In-Reply-To: 330874596.1539148.1380906669499.JavaMail.root@redhat.com --===============5112076519889528492== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Jan, You might consider checking if the '/selinux/enforce' file exists and = the file contains '1' (1 is enforcing). That would ensure that SELinux = enabled and enforcing the policy. Regards, Frank Caviggia On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: > Introduce new SELinux section of the guide and first rule > for it - check if SELinux is enabled in currently > booted kernel. > > Please review. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============5112076519889528492== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5KYW4sPGJyPgogICAgICA8YnI+CiAgICAgIFlvdSBtaWdodCBjb25zaWRlciBjaGVja2luZyBp ZiB0aGUgJy9zZWxpbnV4L2VuZm9yY2UnIGZpbGUgZXhpc3RzCiAgICAgIGFuZCB0aGUgZmlsZSBj b250YWlucyAnMScgKDEgaXMgZW5mb3JjaW5nKS4gVGhhdCB3b3VsZCBlbnN1cmUgdGhhdAogICAg ICBTRUxpbnV4IGVuYWJsZWQgYW5kIGVuZm9yY2luZyB0aGUgcG9saWN5Ljxicj4KICAgICAgPGJy PgogICAgICBSZWdhcmRzLDxicj4KICAgICAgPGJyPgogICAgICBGcmFuayBDYXZpZ2dpYTxicj4K ICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIE9uIDEwLzA0LzIwMTMgMDE6MTEgUE0sIEphbiBM aWVza292c2t5IHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKICAgICAgY2l0 ZT0ibWlkOjMzMDg3NDU5Ni4xNTM5MTQ4LjEzODA5MDY2Njk0OTkuSmF2YU1haWwucm9vdEByZWRo YXQuY29tIgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFwPSIiPgpJbnRyb2R1Y2Ug bmV3IFNFTGludXggc2VjdGlvbiBvZiB0aGUgZ3VpZGUgYW5kIGZpcnN0IHJ1bGUKZm9yIGl0IC0g Y2hlY2sgaWYgU0VMaW51eCBpcyBlbmFibGVkIGluIGN1cnJlbnRseQpib290ZWQga2VybmVsLgoK UGxlYXNlIHJldmlldy4KClRoYW5rIHlvdSAmYW1wOyZhbXA7IFJlZ2FyZHMsIEphbi4KLS0KSmFu IGlhbmtrbyBMaWVza292c2t5IC8gUmVkIEhhdCBTZWN1cml0eSBUZWNobm9sb2dpZXMgVGVhbTwv cHJlPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFk ZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPHByZSB3cmFwPSIiPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNjYXAtc2VjdXJpdHktZ3VpZGUg bWFpbGluZyBsaXN0CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1h aWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2Vj dXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPGEgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxt YW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZSI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0 ZWQub3JnL21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT4KPC9wcmU+CiAg ICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8cHJlIGNsYXNzPSJtb3otc2ln bmF0dXJlIiBjb2xzPSI3MiI+LS0gCkZyYW5rIENhdmlnZ2lhCkNvbnN1bHRhbnQsIFB1YmxpYyBT ZWN0b3IKPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZj YXZpZ2dpQHJlZGhhdC5jb20iPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSAoNTcxKSAyOTUt NDU2MDwvcHJlPgogIDwvYm9keT4KPC9odG1sPgo= --===============5112076519889528492==-- From fcaviggi at redhat.com Thu Aug 20 11:35:25 2015 Content-Type: multipart/mixed; boundary="===============0592659618081228797==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Fri, 04 Oct 2013 14:55:36 -0400 Message-ID: <524F0F28.2070204@redhat.com> In-Reply-To: 524F0DBC.8010704@redhat.com --===============0592659618081228797== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Jan, Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's = '/sys/fs/selinux/enforce' -Frank On 10/04/2013 02:49 PM, fcaviggi(a)redhat.com wrote: > Jan, > > You might consider checking if the '/selinux/enforce' file exists and = > the file contains '1' (1 is enforcing). That would ensure that SELinux = > enabled and enforcing the policy. > > Regards, > > Frank Caviggia > > > On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: >> Introduce new SELinux section of the guide and first rule >> for it - check if SELinux is enabled in currently >> booted kernel. >> >> Please review. >> >> Thank you && Regards, Jan. >> -- >> Jan iankko Lieskovsky / Red Hat Security Technologies Team >> >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > > -- = > Frank Caviggia > Consultant, Public Sector > fcaviggi(a)redhat.com > (M) (571) 295-4560 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============0592659618081228797== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5KYW4sPGJyPgogICAgICA8YnI+CiAgICAgIERvaC4gVGhlICcvc2VsaW51eC9lbmZvcmNlJyB3 YXMgUkhFTCA2IC0gZm9yIEZlZG9yYSAxOSAtIGl0J3MKICAgICAgJy9zeXMvZnMvc2VsaW51eC9l bmZvcmNlJzxicj4KICAgICAgPGJyPgogICAgICAtRnJhbms8YnI+CiAgICAgIDxicj4KICAgICAg PGJyPgogICAgICBPbiAxMC8wNC8yMDEzIDAyOjQ5IFBNLCA8YSBjbGFzcz0ibW96LXR4dC1saW5r LWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSI+ZmNhdmlnZ2lA cmVkaGF0LmNvbTwvYT4gd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZSBjaXRl PSJtaWQ6NTI0RjBEQkMuODAxMDcwNEByZWRoYXQuY29tIiB0eXBlPSJjaXRlIj4KICAgICAgPG1l dGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBodHRwLWVxdWl2PSJDb250ZW50 LVR5cGUiPgogICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPkphbiw8YnI+CiAgICAg ICAgPGJyPgogICAgICAgIFlvdSBtaWdodCBjb25zaWRlciBjaGVja2luZyBpZiB0aGUgJy9zZWxp bnV4L2VuZm9yY2UnIGZpbGUKICAgICAgICBleGlzdHMgYW5kIHRoZSBmaWxlIGNvbnRhaW5zICcx JyAoMSBpcyBlbmZvcmNpbmcpLiBUaGF0IHdvdWxkCiAgICAgICAgZW5zdXJlIHRoYXQgU0VMaW51 eCBlbmFibGVkIGFuZCBlbmZvcmNpbmcgdGhlIHBvbGljeS48YnI+CiAgICAgICAgPGJyPgogICAg ICAgIFJlZ2FyZHMsPGJyPgogICAgICAgIDxicj4KICAgICAgICBGcmFuayBDYXZpZ2dpYTxicj4K ICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIE9uIDEwLzA0LzIwMTMgMDE6MTEgUE0s IEphbiBMaWVza292c2t5IHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3Rl CiAgICAgICAgY2l0ZT0ibWlkOjMzMDg3NDU5Ni4xNTM5MTQ4LjEzODA5MDY2Njk0OTkuSmF2YU1h aWwucm9vdEByZWRoYXQuY29tIgogICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgIDxwcmUgd3Jh cD0iIj5JbnRyb2R1Y2UgbmV3IFNFTGludXggc2VjdGlvbiBvZiB0aGUgZ3VpZGUgYW5kIGZpcnN0 IHJ1bGUKZm9yIGl0IC0gY2hlY2sgaWYgU0VMaW51eCBpcyBlbmFibGVkIGluIGN1cnJlbnRseQpi b290ZWQga2VybmVsLgoKUGxlYXNlIHJldmlldy4KClRoYW5rIHlvdSAmYW1wOyZhbXA7IFJlZ2Fy ZHMsIEphbi4KLS0KSmFuIGlhbmtrbyBMaWVza292c2t5IC8gUmVkIEhhdCBTZWN1cml0eSBUZWNo bm9sb2dpZXMgVGVhbTwvcHJlPgogICAgICAgIDxicj4KICAgICAgICA8ZmllbGRzZXQgY2xhc3M9 Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0PgogICAgICAgIDxicj4KICAgICAgICA8 cHJlIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18Kc2NhcC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3QKPGEgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86c2NhcC1z ZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3VyaXR5LWd1aWRl QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0 ZWQub3JnL21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZSI+aHR0cHM6Ly9saXN0 cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwv YT4KPC9wcmU+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAg IDxwcmUgY2xhc3M9Im1vei1zaWduYXR1cmUiIGNvbHM9IjcyIj4tLSAKRnJhbmsgQ2F2aWdnaWEK Q29uc3VsdGFudCwgUHVibGljIFNlY3Rvcgo8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNz PSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQu Y29tIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPgooTSkgKDU3MSkgMjk1LTQ1NjA8L3ByZT4KICAg ICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2Zp ZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxwcmUgd3JhcD0iIj5fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcg bGlzdAo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86c2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl ZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGU8L2E+CjwvcHJlPgogICAgPC9ibG9j a3F1b3RlPgogICAgPGJyPgogICAgPGJyPgogICAgPHByZSBjbGFzcz0ibW96LXNpZ25hdHVyZSIg Y29scz0iNzIiPi0tIApGcmFuayBDYXZpZ2dpYQpDb25zdWx0YW50LCBQdWJsaWMgU2VjdG9yCjxh IGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmY2F2aWdnaUBy ZWRoYXQuY29tIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPgooTSkgKDU3MSkgMjk1LTQ1NjA8L3By ZT4KICA8L2JvZHk+CjwvaHRtbD4K --===============0592659618081228797==-- From jbachtel at bericotechnologies.com Thu Aug 20 11:35:26 2015 Content-Type: multipart/mixed; boundary="===============5092685072351924123==" MIME-Version: 1.0 From: Jeff Bachtel To: scap-security-guide at lists.fedorahosted.org Subject: CCE-27032-2 Date: Fri, 04 Oct 2013 20:13:38 -0400 Message-ID: --===============5092685072351924123== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I keep getting a fail on CCE-27032-2, even after rebuilding SSG from master. The bad thing is that find / -nouser and find / -nogroup are not finding whatever files are triggering the warning. Is there a debug flag I should be using for more details from oscap to track this down? Jeff --===============5092685072351924123== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SSBrZWVwIGdldHRpbmcgYSBmYWlsIG9uoENDRS0yNzAzMi0yLCBldmVu IGFmdGVyIHJlYnVpbGRpbmcgU1NHIGZyb20gbWFzdGVyLiBUaGUgYmFkIHRoaW5nIGlzIHRoYXQg ZmluZCAvIC1ub3VzZXIgYW5kIGZpbmQgLyAtbm9ncm91cCBhcmUgbm90IGZpbmRpbmcgd2hhdGV2 ZXIgZmlsZXMgYXJlIHRyaWdnZXJpbmcgdGhlIHdhcm5pbmcuPGRpdj48YnI+PC9kaXY+CjxkaXY+ SXMgdGhlcmUgYSBkZWJ1ZyBmbGFnIEkgc2hvdWxkIGJlIHVzaW5nIGZvciBtb3JlIGRldGFpbHMg ZnJvbSBvc2NhcCB0byB0cmFjayB0aGlzIGRvd24/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5K ZWZmPC9kaXY+PC9kaXY+Cg== --===============5092685072351924123==-- From shawn at redhat.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============5573848787659614479==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: CCE-27032-2 Date: Fri, 04 Oct 2013 20:28:49 -0400 Message-ID: <524F5D41.9020405@redhat.com> In-Reply-To: CAHahqg1Dae_vUHFfNzjU-+o48ZFn4NHpfN2qyNQmMYpk8oBN1A@mail.gmail.com --===============5573848787659614479== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 8:13 PM, Jeff Bachtel wrote: > I keep getting a fail on CCE-27032-2, even after rebuilding SSG from = > master. The bad thing is that find / -nouser and find / -nogroup are = > not finding whatever files are triggering the warning. > > Is there a debug flag I should be using for more details from oscap to = > track this down? > The failure should be in your results file. Since you're using source: [shawn(a)SSG-RHEL6 checks]$ pwd /var/www/html/scap-security-guide/RHEL6/input/checks [shawn(a)SSG-RHEL6 checks]$ sudo find / -xdev -type d -perm 0002 -uid +500 = -print [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py = dir_perms_world_writable_system_owned.xml Evaluating with OVAL tempfile : = /tmp/dir_perms_world_writable_system_owneddqzNLB.xml Writing results to : = /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results Definition oval:scap-security-guide.testing:def:148: false Evaluation done. Open your results file and check what's in the system_data area. It'll = indicate what files/dirs are causing the fail. On mine: [shawn(a)SSG-RHEL6 checks]$ grep -4 system_data = /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results /test directory -- Clearly the find command needs updating though --===============5573848787659614479==-- From shawn at redhat.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============6480014088732741414==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: CCE-27032-2 Date: Fri, 04 Oct 2013 20:32:23 -0400 Message-ID: <524F5E17.2060400@redhat.com> In-Reply-To: 524F5D41.9020405@redhat.com --===============6480014088732741414== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 8:28 PM, Shawn Wells wrote: > On 10/4/13 8:13 PM, Jeff Bachtel wrote: >> I keep getting a fail on CCE-27032-2, even after rebuilding SSG from = >> master. The bad thing is that find / -nouser and find / -nogroup are = >> not finding whatever files are triggering the warning. >> >> Is there a debug flag I should be using for more details from oscap = >> to track this down? >> > > The failure should be in your results file. Since you're using source: > > [shawn(a)SSG-RHEL6 checks]$ pwd > /var/www/html/scap-security-guide/RHEL6/input/checks > > [shawn(a)SSG-RHEL6 checks]$ sudo find / -xdev -type d -perm 0002 -uid = > +500 -print > > [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py = > dir_perms_world_writable_system_owned.xml > Evaluating with OVAL tempfile : = > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml > Writing results to : = > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results > Definition oval:scap-security-guide.testing:def:148: false > Evaluation done. > > Open your results file and check what's in the system_data area. It'll = > indicate what files/dirs are causing the fail. On mine: > > [shawn(a)SSG-RHEL6 checks]$ grep -4 system_data = > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results > version=3D"1" flag=3D"complete"> > > > > > > /test > > directory > -- = > > > Clearly the find command needs updating though To ensure updating the find command doesn't get forgotten about: https://fedorahosted.org/scap-security-guide/ticket/417 .... whoever feels ambitious to take that ticket, please do so! --===============6480014088732741414==-- From jbachtel at bericotechnologies.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============7376554559503771678==" MIME-Version: 1.0 From: Jeff Bachtel To: scap-security-guide at lists.fedorahosted.org Subject: Re: CCE-27032-2 Date: Fri, 04 Oct 2013 20:46:21 -0400 Message-ID: In-Reply-To: 524F5E17.2060400@redhat.com --===============7376554559503771678== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ah cool, but that's *no_files_unowned_by_user, *not *world_writable_files_system_ownership *(CCE-26642-9) that I had the false pos on. I'll try to log in in a few to update the ticket if you're busy. Jeff On Fri, Oct 4, 2013 at 8:32 PM, Shawn Wells wrote: > On 10/4/13 8:28 PM, Shawn Wells wrote: > >> On 10/4/13 8:13 PM, Jeff Bachtel wrote: >> >>> I keep getting a fail on CCE-27032-2, even after rebuilding SSG from >>> master. The bad thing is that find / -nouser and find / -nogroup are not >>> finding whatever files are triggering the warning. >>> >>> Is there a debug flag I should be using for more details from oscap to >>> track this down? >>> >>> >> The failure should be in your results file. Since you're using source: >> >> [shawn(a)SSG-RHEL6 checks]$ pwd >> /var/www/html/scap-security-**guide/RHEL6/input/checks >> >> [shawn(a)SSG-RHEL6 checks]$ sudo find / -xdev -type d -perm 0002 -uid +5= 00 >> -print >> >> [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py dir_perms_world_writable_** >> system_owned.xml >> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_** >> system_owneddqzNLB.xml >> Writing results to : /tmp/dir_perms_world_writable_** >> system_owneddqzNLB.xml-results >> Definition oval:scap-security-guide.**testing:def:148: false >> Evaluation done. >> >> Open your results file and check what's in the system_data area. It'll >> indicate what files/dirs are causing the fail. On mine: >> >> [shawn(a)SSG-RHEL6 checks]$ grep -4 system_data >> /tmp/dir_perms_world_writable_**system_owneddqzNLB.xml-results >> > version=3D"1" flag=3D"complete"> >> >> >> >> >> >> /test >> >> directory >> -- >> >> >> Clearly the find command needs updating though >> > To ensure updating the find command doesn't get forgotten about: > https://fedorahosted.org/scap-**security-guide/ticket/417 > > .... whoever feels ambitious to take that ticket, please do so! > > ______________________________**_________________ > scap-security-guide mailing list > scap-security-guide(a)lists.**fedorahosted.org > https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide > --===============7376554559503771678== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+QWggY29vbCwgYnV0IHRoYXQmIzM5O3OgPHN0cm9uZyBjbGFzcz0iIiBz dHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LWZhbWlseTpzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpt ZWRpdW07dGV4dC1hbGlnbjpqdXN0aWZ5Ij5ub19maWxlc191bm93bmVkX2J5X3VzZXIsIDwvc3Ry b25nPjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJjb2xvcjpyZ2IoMCwwLDApO2ZvbnQtZmFtaWx5OnNh bnMtc2VyaWY7Zm9udC1zaXplOm1lZGl1bTt0ZXh0LWFsaWduOmp1c3RpZnkiPm5vdKA8L3NwYW4+ PHN0cm9uZyBjbGFzcz0iIiBzdHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LWZhbWlseTpzYW5z LXNlcmlmO2ZvbnQtc2l6ZTptZWRpdW07dGV4dC1hbGlnbjpqdXN0aWZ5Ij53b3JsZF93cml0YWJs ZV9maWxlc19zeXN0ZW1fb3duZXJzaGlwIDwvc3Ryb25nPjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJj b2xvcjpyZ2IoMCwwLDApO2ZvbnQtZmFtaWx5OnNhbnMtc2VyaWY7Zm9udC1zaXplOm1lZGl1bTt0 ZXh0LWFsaWduOmp1c3RpZnkiPig8L3NwYW4+Q0NFLTI2NjQyLTkpIHRoYXQgSSBoYWQgdGhlIGZh bHNlIHBvcyBvbi48ZGl2Pgo8YnI+PC9kaXY+PGRpdj5JJiMzOTtsbCB0cnkgdG8gbG9nIGluIGlu IGEgZmV3IHRvIHVwZGF0ZSB0aGUgdGlja2V0IGlmIHlvdSYjMzk7cmUgYnVzeS48L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2PkplZmY8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+ PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gRnJpLCBPY3QgNCwgMjAxMyBhdCA4 OjMyIFBNLCBTaGF3biBXZWxscyA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpz aGF3bkByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwvYT4mZ3Q7 PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9 Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVm dDoxZXgiPjxkaXYgY2xhc3M9IkhPRW5aYiI+PGRpdiBjbGFzcz0iaDUiPk9uIDEwLzQvMTMgODoy OCBQTSwgU2hhd24gV2VsbHMgd3JvdGU6PGJyPgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVv dGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtw YWRkaW5nLWxlZnQ6MWV4Ij4KT24gMTAvNC8xMyA4OjEzIFBNLCBKZWZmIEJhY2h0ZWwgd3JvdGU6 PGJyPgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAg LjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4KSSBrZWVw IGdldHRpbmcgYSBmYWlsIG9uIENDRS0yNzAzMi0yLCBldmVuIGFmdGVyIHJlYnVpbGRpbmcgU1NH IGZyb20gbWFzdGVyLiBUaGUgYmFkIHRoaW5nIGlzIHRoYXQgZmluZCAvIC1ub3VzZXIgYW5kIGZp bmQgLyAtbm9ncm91cCBhcmUgbm90IGZpbmRpbmcgd2hhdGV2ZXIgZmlsZXMgYXJlIHRyaWdnZXJp bmcgdGhlIHdhcm5pbmcuPGJyPgo8YnI+CklzIHRoZXJlIGEgZGVidWcgZmxhZyBJIHNob3VsZCBi ZSB1c2luZyBmb3IgbW9yZSBkZXRhaWxzIGZyb20gb3NjYXAgdG8gdHJhY2sgdGhpcyBkb3duPzxi cj4KPGJyPgo8L2Jsb2NrcXVvdGU+Cjxicj4KVGhlIGZhaWx1cmUgc2hvdWxkIGJlIGluIHlvdXIg cmVzdWx0cyBmaWxlLiBTaW5jZSB5b3UmIzM5O3JlIHVzaW5nIHNvdXJjZTo8YnI+Cjxicj4KW3No YXduQFNTRy1SSEVMNiBjaGVja3NdJCBwd2Q8YnI+Ci92YXIvd3d3L2h0bWwvc2NhcC1zZWN1cml0 eS08dT48L3U+Z3VpZGUvUkhFTDYvaW5wdXQvY2hlY2tzPGJyPgo8YnI+CltzaGF3bkBTU0ctUkhF TDYgY2hlY2tzXSQgc3VkbyBmaW5kIC8gLXhkZXYgLXR5cGUgZCAtcGVybSAwMDAyIC11aWQgKzUw MCAtcHJpbnQ8YnI+Cjxicj4KW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCAuL3Rlc3RjaGVjay5w eSBkaXJfcGVybXNfd29ybGRfd3JpdGFibGVfPHU+PC91PnN5c3RlbV9vd25lZC54bWw8YnI+CkV2 YWx1YXRpbmcgd2l0aCBPVkFMIHRlbXBmaWxlIDogL3RtcC9kaXJfcGVybXNfd29ybGRfd3JpdGFi bGVfPHU+PC91PnN5c3RlbV9vd25lZGRxek5MQi54bWw8YnI+CldyaXRpbmcgcmVzdWx0cyB0byA6 IC90bXAvZGlyX3Blcm1zX3dvcmxkX3dyaXRhYmxlXzx1PjwvdT5zeXN0ZW1fb3duZWRkcXpOTEIu eG1sLXJlc3VsdHM8YnI+CkRlZmluaXRpb24gb3ZhbDpzY2FwLXNlY3VyaXR5LWd1aWRlLjx1Pjwv dT50ZXN0aW5nOmRlZjoxNDg6IGZhbHNlPGJyPgpFdmFsdWF0aW9uIGRvbmUuPGJyPgo8YnI+Ck9w ZW4geW91ciByZXN1bHRzIGZpbGUgYW5kIGNoZWNrIHdoYXQmIzM5O3MgaW4gdGhlIHN5c3RlbV9k YXRhIGFyZWEuIEl0JiMzOTtsbCBpbmRpY2F0ZSB3aGF0IGZpbGVzL2RpcnMgYXJlIGNhdXNpbmcg dGhlIGZhaWwuIE9uIG1pbmU6PGJyPgo8YnI+CltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgZ3Jl cCAtNCBzeXN0ZW1fZGF0YSAvdG1wL2Rpcl9wZXJtc193b3JsZF93cml0YWJsZV88dT48L3U+c3lz dGVtX293bmVkZHF6TkxCLnhtbC1yZXN1bHRzPGJyPgqgIKAgoCCgIKAgJmx0O29iamVjdCBpZD0m cXVvdDtvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUuPHU+PC91PnRlc3Rpbmc6b2JqOjE1MCZxdW90 OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsgZmxhZz0mcXVvdDtjb21wbGV0ZSZxdW90OyZndDs8YnI+ CqAgoCCgIKAgoCCgICZsdDtyZWZlcmVuY2UgaXRlbV9yZWY9JnF1b3Q7MTEwNDk4MSZxdW90Oy8m Z3Q7PGJyPgqgIKAgoCCgIKAgJmx0Oy9vYmplY3QmZ3Q7PGJyPgqgIKAgoCCgICZsdDsvY29sbGVj dGVkX29iamVjdHMmZ3Q7PGJyPgqgIKAgoCCgICZsdDtzeXN0ZW1fZGF0YSZndDs8YnI+CqAgoCCg IKAgoCAmbHQ7dW5peC1zeXM6ZmlsZV9pdGVtIGlkPSZxdW90OzExMDQ5ODEmcXVvdDsgc3RhdHVz PSZxdW90O2V4aXN0cyZxdW90OyZndDs8YnI+CqAgoCCgIKAgoCCgICZsdDt1bml4LXN5czpwYXRo Jmd0Oy90ZXN0Jmx0Oy91bml4LTx1PjwvdT5zeXM6cGF0aCZndDs8YnI+CqAgoCCgIKAgoCCgICZs dDt1bml4LXN5czpmaWxlbmFtZSZndDsmbHQ7L3VuaXgtc3lzOjx1PjwvdT5maWxlbmFtZSZndDs8 YnI+CqAgoCCgIKAgoCCgICZsdDt1bml4LXN5czp0eXBlJmd0O2RpcmVjdG9yeSZsdDsvPHU+PC91 PnVuaXgtc3lzOnR5cGUmZ3Q7PGJyPgotLSA8YnI+Cjxicj4KPGJyPgpDbGVhcmx5IHRoZSBmaW5k IGNvbW1hbmQgbmVlZHMgdXBkYXRpbmcgdGhvdWdoPGJyPgo8L2Jsb2NrcXVvdGU+PC9kaXY+PC9k aXY+ClRvIGVuc3VyZSB1cGRhdGluZyB0aGUgZmluZCBjb21tYW5kIGRvZXNuJiMzOTt0IGdldCBm b3Jnb3R0ZW4gYWJvdXQ6PGJyPgo8YSBocmVmPSJodHRwczovL2ZlZG9yYWhvc3RlZC5vcmcvc2Nh cC1zZWN1cml0eS1ndWlkZS90aWNrZXQvNDE3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9mZWRv cmFob3N0ZWQub3JnL3NjYXAtPHU+PC91PnNlY3VyaXR5LWd1aWRlL3RpY2tldC80MTc8L2E+PGJy Pgo8YnI+Ci4uLi4gd2hvZXZlciBmZWVscyBhbWJpdGlvdXMgdG8gdGFrZSB0aGF0IHRpY2tldCwg cGxlYXNlIGRvIHNvITxkaXYgY2xhc3M9IkhPRW5aYiI+PGRpdiBjbGFzcz0iaDUiPjxicj4KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPHU+PC91Pl9fX19fX19fX19fX19fX19fPGJyPgpz Y2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAt c2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNj YXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuPHU+PC91PmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8 YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9z Y2FwLXNlY3VyaXR5LWd1aWRlIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFo b3N0ZWQuPHU+PC91Pm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtPHU+PC91PnNlY3VyaXR5LWd1 aWRlPC9hPjxicj4KPC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============7376554559503771678==-- From shawn at redhat.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============6394035541272396065==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: CCE-27032-2 Date: Fri, 04 Oct 2013 20:57:04 -0400 Message-ID: <524F63E0.7000206@redhat.com> In-Reply-To: CAHahqg1h=xQs=MNVE1iiwt6G2bvFXYmLY2SONNzg631mdqu-0Q@mail.gmail.com --===============6394035541272396065== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 8:46 PM, Jeff Bachtel wrote: > Ah cool, but that's *no_files_unowned_by_user, *not = > *world_writable_files_system_ownership *(CCE-26642-9) that I had the = > false pos on. > > I'll try to log in in a few to update the ticket if you're busy. Hah, whoops. *I* was looking at the = dir_perms_world_writable_system_owned check. Either way, it's the same = process to see what's up. For CCE-27032-2/no_files_unowned_by_user, it's the same story... the = OCIL needs to be updated. [shawn(a)SSG-RHEL6 checks]$ sudo find / -xdev -nouser -print [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py no_files_unowned_by_user.xml Evaluating with OVAL tempfile : /tmp/no_files_unowned_by_userWvvmmI.xml Writing results to : /tmp/no_files_unowned_by_userWvvmmI.xml-results Definition oval:scap-security-guide.testing:def:152: false Evaluation done. [shawn(a)SSG-RHEL6 checks]$ vim ^C [shawn(a)SSG-RHEL6 checks]$ grep -4 system_data = /tmp/no_files_unowned_by_userWvvmmI.xml-results //.autofsck / .autofsck -- I updated the ticket to review *all* the OCIL checks. A few of us are on = #ssg on freenode tonight, and actively developing (so will be on the = list) until late EST > > > On Fri, Oct 4, 2013 at 8:32 PM, Shawn Wells > wrote: > > On 10/4/13 8:28 PM, Shawn Wells wrote: > > On 10/4/13 8:13 PM, Jeff Bachtel wrote: > > I keep getting a fail on CCE-27032-2, even after > rebuilding SSG from master. The bad thing is that find / > -nouser and find / -nogroup are not finding whatever files > are triggering the warning. > > Is there a debug flag I should be using for more details > from oscap to track this down? > > > The failure should be in your results file. Since you're using > source: > > [shawn(a)SSG-RHEL6 checks]$ pwd > /var/www/html/scap-security-guide/RHEL6/input/checks > > [shawn(a)SSG-RHEL6 checks]$ sudo find / -xdev -type d -perm 0002 > -uid +500 -print > > [shawn(a)SSG-RHEL6 checks]$ ./testcheck.py > dir_perms_world_writable_system_owned.xml > Evaluating with OVAL tempfile : > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml > Writing results to : > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results > Definition oval:scap-security-guide.testing:def:148: false > Evaluation done. > > Open your results file and check what's in the system_data > area. It'll indicate what files/dirs are causing the fail. On > mine: > > [shawn(a)SSG-RHEL6 checks]$ grep -4 system_data > /tmp/dir_perms_world_writable_system_owneddqzNLB.xml-results > id=3D"oval:scap-security-guide.testing:obj:150" version=3D"1" > flag=3D"complete"> > > > > > > /test > > directory > -- = > > > Clearly the find command needs updating though > > To ensure updating the find command doesn't get forgotten about: > https://fedorahosted.org/scap-security-guide/ticket/417 > > .... whoever feels ambitious to take that ticket, please do so! > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells --===============6394035541272396065== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC80LzEzIDg6NDYgUE0sIEplZmYgQmFjaHRlbCB3cm90ZTo8YnI+CiAgICA8L2Rpdj4K ICAgIDxibG9ja3F1b3RlCmNpdGU9Im1pZDpDQUhhaHFnMWg9eFFzPU1OVkUxaWl3dDZHMmJ2RlhZ bUxZMlNPTk56ZzYzMW1kcXUtMFFAbWFpbC5nbWFpbC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgog ICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4dC1odG1sIiBsYW5nPSJ4LXdlc3Rlcm4iPgogICAgICAg IDxkaXYgZGlyPSJsdHIiPkFoIGNvb2wsIGJ1dCB0aGF0J3PCoDxzdHJvbmcgY2xhc3M9IiIKc3R5 bGU9ImNvbG9yOnJnYigwLDAsMCk7Zm9udC1mYW1pbHk6c2Fucy1zZXJpZjtmb250LXNpemU6bWVk aXVtO3RleHQtYWxpZ246anVzdGlmeSI+bm9fZmlsZXNfdW5vd25lZF9ieV91c2VyLAogICAgICAg ICAgPC9zdHJvbmc+PHNwYW4gY2xhc3M9IiIKc3R5bGU9ImNvbG9yOnJnYigwLDAsMCk7Zm9udC1m YW1pbHk6c2Fucy1zZXJpZjtmb250LXNpemU6bWVkaXVtO3RleHQtYWxpZ246anVzdGlmeSI+bm90 wqA8L3NwYW4+PHN0cm9uZwogICAgICAgICAgICBjbGFzcz0iIgpzdHlsZT0iY29sb3I6cmdiKDAs MCwwKTtmb250LWZhbWlseTpzYW5zLXNlcmlmO2ZvbnQtc2l6ZTptZWRpdW07dGV4dC1hbGlnbjpq dXN0aWZ5Ij53b3JsZF93cml0YWJsZV9maWxlc19zeXN0ZW1fb3duZXJzaGlwCiAgICAgICAgICA8 L3N0cm9uZz48c3BhbiBjbGFzcz0iIgpzdHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LWZhbWls eTpzYW5zLXNlcmlmO2ZvbnQtc2l6ZTptZWRpdW07dGV4dC1hbGlnbjpqdXN0aWZ5Ij4oPC9zcGFu PkNDRS0yNjY0Mi05KQogICAgICAgICAgdGhhdCBJIGhhZCB0aGUgZmFsc2UgcG9zIG9uLgogICAg ICAgICAgPGRpdj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8 ZGl2PkknbGwgdHJ5IHRvIGxvZyBpbiBpbiBhIGZldyB0byB1cGRhdGUgdGhlIHRpY2tldCBpZgog ICAgICAgICAgICB5b3UncmUgYnVzeS48L2Rpdj4KICAgICAgICA8L2Rpdj4KICAgICAgPC9kaXY+ CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBIYWgsIHdob29wcy4gKkkqIHdhcyBsb29r aW5nIGF0IHRoZQogICAgZGlyX3Blcm1zX3dvcmxkX3dyaXRhYmxlX3N5c3RlbV9vd25lZCBjaGVj ay4gRWl0aGVyIHdheSwgaXQncyB0aGUKICAgIHNhbWUgcHJvY2VzcyB0byBzZWUgd2hhdCdzIHVw Ljxicj4KICAgIDxicj4KICAgIEZvciBDQ0UtMjcwMzItMi9ub19maWxlc191bm93bmVkX2J5X3Vz ZXIsIGl0J3MgdGhlIHNhbWUgc3RvcnkuLi4gdGhlCiAgICBPQ0lMIG5lZWRzIHRvIGJlIHVwZGF0 ZWQuIDxicj4KICAgIDxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgc3VkbyBmaW5k IC8gLXhkZXYgLW5vdXNlciAtcHJpbnQ8YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10k IC4vdGVzdGNoZWNrLnB5CiAgICBub19maWxlc191bm93bmVkX2J5X3VzZXIueG1sIDxicj4KICAg IEV2YWx1YXRpbmcgd2l0aCBPVkFMIHRlbXBmaWxlIDoKICAgIC90bXAvbm9fZmlsZXNfdW5vd25l ZF9ieV91c2VyV3Z2bW1JLnhtbDxicj4KICAgIFdyaXRpbmcgcmVzdWx0cyB0byA6IC90bXAvbm9f ZmlsZXNfdW5vd25lZF9ieV91c2VyV3Z2bW1JLnhtbC1yZXN1bHRzPGJyPgogICAgRGVmaW5pdGlv biBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTUyOiBmYWxzZTxicj4KICAg IEV2YWx1YXRpb24gZG9uZS48YnI+CiAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHZpbSBe Qzxicj4KICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQgZ3JlcCAtNCBzeXN0ZW1fZGF0YQog ICAgL3RtcC9ub19maWxlc191bm93bmVkX2J5X3VzZXJXdnZtbUkueG1sLXJlc3VsdHM8YnI+CiAg ICDCoMKgwqDCoMKgwqDCoMKgwqAgJmx0O29iamVjdCBpZD0ib3ZhbDpzY2FwLXNlY3VyaXR5LWd1 aWRlLnRlc3Rpbmc6b2JqOjE1NCIKICAgIHZlcnNpb249IjEiIGZsYWc9ImNvbXBsZXRlIiZndDs8 YnI+CiAgICDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgICZsdDtyZWZlcmVuY2UgaXRlbV9yZWY9IjEx MDU3NTEiLyZndDs8YnI+CiAgICDCoMKgwqDCoMKgwqDCoMKgwqAgJmx0Oy9vYmplY3QmZ3Q7PGJy PgogICAgwqDCoMKgwqDCoMKgwqAgJmx0Oy9jb2xsZWN0ZWRfb2JqZWN0cyZndDs8YnI+CiAgICDC oMKgwqDCoMKgwqDCoCAmbHQ7c3lzdGVtX2RhdGEmZ3Q7PGJyPgogICAgwqDCoMKgwqDCoMKgwqDC oMKgICZsdDt1bml4LXN5czpmaWxlX2l0ZW0gaWQ9IjExMDU3NTEiIHN0YXR1cz0iZXhpc3RzIiZn dDs8YnI+CiAgICDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAgICAmbHQ7dW5peC1zeXM6ZmlsZXBh dGgmZ3Q7Ly8uYXV0b2ZzY2smbHQ7L3VuaXgtc3lzOmZpbGVwYXRoJmd0Ozxicj4KICAgIMKgwqDC oMKgwqDCoMKgwqDCoMKgwqAgJmx0O3VuaXgtc3lzOnBhdGgmZ3Q7LyZsdDsvdW5peC1zeXM6cGF0 aCZndDs8YnI+CiAgICDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAgICAmbHQ7dW5peC1zeXM6Zmls ZW5hbWUmZ3Q7LmF1dG9mc2NrJmx0Oy91bml4LXN5czpmaWxlbmFtZSZndDs8YnI+CiAgICAtLTxi cj4KICAgIDxicj4KICAgIDxicj4KICAgIDxicj4KICAgIEkgdXBkYXRlZCB0aGUgdGlja2V0IHRv IHJldmlldyAqYWxsKiB0aGUgT0NJTCBjaGVja3MuIEEgZmV3IG9mIHVzCiAgICBhcmUgb24gI3Nz ZyBvbiBmcmVlbm9kZSB0b25pZ2h0LCBhbmQgYWN0aXZlbHkgZGV2ZWxvcGluZyAoc28gd2lsbCBi ZQogICAgb24gdGhlIGxpc3QpIHVudGlsIGxhdGUgRVNUPGJyPgogICAgPGJyPgogICAgPGJyPgog ICAgPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOkNBSGFo cWcxaD14UXM9TU5WRTFpaXd0NkcyYnZGWFltTFkyU09OTnpnNjMxbWRxdS0wUUBtYWlsLmdtYWls LmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LWh0bWwi IGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj4K ICAgICAgICAgIDxicj4KICAgICAgICAgIDxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBGcmks IE9jdCA0LCAyMDEzIGF0IDg6MzIgUE0sIFNoYXduCiAgICAgICAgICAgIFdlbGxzIDxzcGFuIGRp cj0ibHRyIj4mbHQ7PGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgICAgICAgaHJl Zj0ibWFpbHRvOnNoYXduQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5zaGF3bkByZWRoYXQu Y29tPC9hPiZndDs8L3NwYW4+CiAgICAgICAgICAgIHdyb3RlOjxicj4KICAgICAgICAgICAgPGJs b2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwCiAgICAgICAg ICAgICAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4K ICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJIT0VuWmIiPgogICAgICAgICAgICAgICAgPGRpdiBj bGFzcz0iaDUiPk9uIDEwLzQvMTMgODoyOCBQTSwgU2hhd24gV2VsbHMgd3JvdGU6PGJyPgogICAg ICAgICAgICAgICAgICA8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MCAwIDAKICAgICAgICAgICAgICAgICAgICAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNv bGlkO3BhZGRpbmctbGVmdDoxZXgiPgogICAgICAgICAgICAgICAgICAgIE9uIDEwLzQvMTMgODox MyBQTSwgSmVmZiBCYWNodGVsIHdyb3RlOjxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2tx dW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAKICAgICAgICAgICAg ICAgICAgICAgIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFl eCI+CiAgICAgICAgICAgICAgICAgICAgICBJIGtlZXAgZ2V0dGluZyBhIGZhaWwgb24gQ0NFLTI3 MDMyLTIsIGV2ZW4gYWZ0ZXIKICAgICAgICAgICAgICAgICAgICAgIHJlYnVpbGRpbmcgU1NHIGZy b20gbWFzdGVyLiBUaGUgYmFkIHRoaW5nIGlzIHRoYXQKICAgICAgICAgICAgICAgICAgICAgIGZp bmQgLyAtbm91c2VyIGFuZCBmaW5kIC8gLW5vZ3JvdXAgYXJlIG5vdCBmaW5kaW5nCiAgICAgICAg ICAgICAgICAgICAgICB3aGF0ZXZlciBmaWxlcyBhcmUgdHJpZ2dlcmluZyB0aGUgd2FybmluZy48 YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBJcyB0 aGVyZSBhIGRlYnVnIGZsYWcgSSBzaG91bGQgYmUgdXNpbmcgZm9yIG1vcmUKICAgICAgICAgICAg ICAgICAgICAgIGRldGFpbHMgZnJvbSBvc2NhcCB0byB0cmFjayB0aGlzIGRvd24/PGJyPgogICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgVGhlIGZhaWx1cmUg c2hvdWxkIGJlIGluIHlvdXIgcmVzdWx0cyBmaWxlLiBTaW5jZQogICAgICAgICAgICAgICAgICAg IHlvdSdyZSB1c2luZyBzb3VyY2U6PGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHB3ZDxicj4KICAgICAgICAg ICAgICAgICAgICAvdmFyL3d3dy9odG1sL3NjYXAtc2VjdXJpdHktZ3VpZGUvUkhFTDYvaW5wdXQv Y2hlY2tzPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBb c2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gZmluZCAvIC14ZGV2IC10eXBlIGQKICAgICAg ICAgICAgICAgICAgICAtcGVybSAwMDAyIC11aWQgKzUwMCAtcHJpbnQ8YnI+CiAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFtzaGF3bkBTU0ctUkhFTDYgY2hlY2tz XSQgLi90ZXN0Y2hlY2sucHkKICAgICAgICAgICAgICAgICAgICBkaXJfcGVybXNfd29ybGRfd3Jp dGFibGVfc3lzdGVtX293bmVkLnhtbDxicj4KICAgICAgICAgICAgICAgICAgICBFdmFsdWF0aW5n IHdpdGggT1ZBTCB0ZW1wZmlsZSA6CiAgICAgICAgICAgICAgICAgICAgL3RtcC9kaXJfcGVybXNf d29ybGRfd3JpdGFibGVfc3lzdGVtX293bmVkZHF6TkxCLnhtbDxicj4KICAgICAgICAgICAgICAg ICAgICBXcml0aW5nIHJlc3VsdHMgdG8gOiAvdG1wL2Rpcl9wZXJtc193b3JsZF93cml0YWJsZV9z eXN0ZW1fb3duZWRkcXpOTEIueG1sLXJlc3VsdHM8YnI+CiAgICAgICAgICAgICAgICAgICAgRGVm aW5pdGlvbiBvdmFsOnNjYXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpkZWY6MTQ4OgogICAgICAg ICAgICAgICAgICAgIGZhbHNlPGJyPgogICAgICAgICAgICAgICAgICAgIEV2YWx1YXRpb24gZG9u ZS48YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIE9wZW4g eW91ciByZXN1bHRzIGZpbGUgYW5kIGNoZWNrIHdoYXQncyBpbiB0aGUKICAgICAgICAgICAgICAg ICAgICBzeXN0ZW1fZGF0YSBhcmVhLiBJdCdsbCBpbmRpY2F0ZSB3aGF0IGZpbGVzL2RpcnMgYXJl CiAgICAgICAgICAgICAgICAgICAgY2F1c2luZyB0aGUgZmFpbC4gT24gbWluZTo8YnI+CiAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFtzaGF3bkBTU0ctUkhFTDYg Y2hlY2tzXSQgZ3JlcCAtNCBzeXN0ZW1fZGF0YQogICAgICAgICAgICAgICAgICAgIC90bXAvZGly X3Blcm1zX3dvcmxkX3dyaXRhYmxlX3N5c3RlbV9vd25lZGRxek5MQi54bWwtcmVzdWx0czxicj4K ICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCDCoCAmbHQ7b2JqZWN0IGlkPSJvdmFsOnNj YXAtc2VjdXJpdHktZ3VpZGUudGVzdGluZzpvYmo6MTUwIgogICAgICAgICAgICAgICAgICAgIHZl cnNpb249IjEiIGZsYWc9ImNvbXBsZXRlIiZndDs8YnI+CiAgICAgICAgICAgICAgICAgICAgwqAg wqAgwqAgwqAgwqAgwqAgJmx0O3JlZmVyZW5jZSBpdGVtX3JlZj0iMTEwNDk4MSIvJmd0Ozxicj4K ICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCDCoCAmbHQ7L29iamVjdCZndDs8YnI+CiAg ICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgJmx0Oy9jb2xsZWN0ZWRfb2JqZWN0cyZndDs8 YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgJmx0O3N5c3RlbV9kYXRhJmd0Ozxi cj4KICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCDCoCAmbHQ7dW5peC1zeXM6ZmlsZV9p dGVtIGlkPSIxMTA0OTgxIgogICAgICAgICAgICAgICAgICAgIHN0YXR1cz0iZXhpc3RzIiZndDs8 YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgwqAgwqAgJmx0O3VuaXgtc3lzOnBh dGgmZ3Q7L3Rlc3QmbHQ7L3VuaXgtc3lzOnBhdGgmZ3Q7PGJyPgogICAgICAgICAgICAgICAgICAg IMKgIMKgIMKgIMKgIMKgIMKgICZsdDt1bml4LXN5czpmaWxlbmFtZSZndDsmbHQ7L3VuaXgtc3lz OmZpbGVuYW1lJmd0Ozxicj4KICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCDCoCDCoCAm bHQ7dW5peC1zeXM6dHlwZSZndDtkaXJlY3RvcnkmbHQ7L3VuaXgtc3lzOnR5cGUmZ3Q7PGJyPgog ICAgICAgICAgICAgICAgICAgIC0tIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIENsZWFybHkgdGhlIGZpbmQg Y29tbWFuZCBuZWVkcyB1cGRhdGluZyB0aG91Z2g8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgIFRvIGVuc3VyZSB1cGRhdGluZyB0aGUgZmluZCBjb21tYW5kIGRvZXNuJ3QgZ2V0 IGZvcmdvdHRlbgogICAgICAgICAgICAgIGFib3V0Ojxicj4KICAgICAgICAgICAgICA8YSBtb3ot ZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgICAgICBocmVmPSJodHRwczovL2ZlZG9yYWhv c3RlZC5vcmcvc2NhcC1zZWN1cml0eS1ndWlkZS90aWNrZXQvNDE3IgogICAgICAgICAgICAgICAg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZmVkb3JhaG9zdGVkLm9yZy9zY2FwLXNlY3VyaXR5LWd1 aWRlL3RpY2tldC80MTc8L2E+PGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAu Li4uIHdob2V2ZXIgZmVlbHMgYW1iaXRpb3VzIHRvIHRha2UgdGhhdCB0aWNrZXQsIHBsZWFzZQog ICAgICAgICAgICAgIGRvIHNvIQogICAgICAgICAgICAgIDxkaXYgY2xhc3M9IkhPRW5aYiI+CiAg ICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJoNSI+PGJyPgogICAgICAgICAgICAgICAgICBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4KICAgICAgICAg ICAgICAgICAgc2NhcC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICAg ICAgICAgIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgICBocmVm PSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAg ICAgICAgICAgICAgICAgIHRhcmdldD0iX2JsYW5rIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3Rz LmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgogICAgICAgICAgICAgICAgICA8YSBtb3otZG8tbm90 LXNlbmQ9InRydWUiCmhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiCiAgICAgICAgICAgICAgICAgICAgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3NjYXAtc2VjdXJpdHktZ3VpZGU8L2E+PGJyPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAg ICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgIDwvZGl2 PgogICAgICAgICAgPGJyPgogICAgICAgIDwvZGl2PgogICAgICA8L2Rpdj4KICAgICAgPGJyPgog ICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0Pgog ICAgICA8YnI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBn cmFwaGljYWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZp eGVkOyBmb250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAgICAgICAg PHByZSB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCnNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGluZyBsaXN0CjxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOnNjYXAt c2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+c2NhcC1zZWN1cml0eS1ndWlk ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9z dGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiPmh0dHBzOi8vbGlz dHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGU8 L2E+CjwvcHJlPgogICAgICA8L2Rpdj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxi cj4KICAgIDxwcmUgY2xhc3M9Im1vei1zaWduYXR1cmUiIGNvbHM9IjcyIj4tLSAKU2hhd24gV2Vs bHMKRGlyZWN0b3IsIElubm92YXRpb24gUHJvZ3JhbXMKPGEgY2xhc3M9Im1vei10eHQtbGluay1h YmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOnNoYXduQHJlZGhhdC5jb20iPnNoYXduQHJlZGhhdC5j b208L2E+IHwgNDQzLjUzNC4wMTMwCkBzaGF3bmR3ZWxsczwvcHJlPgogIDwvYm9keT4KPC9odG1s Pgo= --===============6394035541272396065==-- From agilmore2 at gmail.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============5964346466578613694==" MIME-Version: 1.0 From: Andrew Gilmore To: scap-security-guide at lists.fedorahosted.org Subject: Re: CCE-27032-2 Date: Fri, 04 Oct 2013 19:32:47 -0600 Message-ID: In-Reply-To: CAHahqg1Dae_vUHFfNzjU-+o48ZFn4NHpfN2qyNQmMYpk8oBN1A@mail.gmail.com --===============5964346466578613694== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable My last crack at this led us to the test being completely inaccurate. It is not doing a find -nouser or any such like search. The archives should have more details. Andrew On Oct 4, 2013 6:13 PM, "Jeff Bachtel" wrote: > I keep getting a fail on CCE-27032-2, even after rebuilding SSG from > master. The bad thing is that find / -nouser and find / -nogroup are not > finding whatever files are triggering the warning. > > Is there a debug flag I should be using for more details from oscap to > track this down? > > Jeff > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > --===============5964346466578613694== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PHAgZGlyPSJsdHIiPk15IGxhc3QgY3JhY2sgYXQgdGhpcyBsZWQgdXMgdG8gdGhlIHRlc3QgYmVp bmcgY29tcGxldGVseSBpbmFjY3VyYXRlLiBJdCBpcyBub3QgZG9pbmcgYSBmaW5kIC1ub3VzZXIg b3IgYW55IHN1Y2ggbGlrZSBzZWFyY2guIDwvcD4KPHAgZGlyPSJsdHIiPlRoZSBhcmNoaXZlcyBz aG91bGQgaGF2ZSBtb3JlIGRldGFpbHMuPC9wPgo8cCBkaXI9Imx0ciI+QW5kcmV3PC9wPgo8ZGl2 IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gT2N0IDQsIDIwMTMgNjoxMyBQTSwgJnF1b3Q7SmVmZiBC YWNodGVsJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86amJhY2h0ZWxAYmVyaWNvdGVjaG5vbG9n aWVzLmNvbSI+amJhY2h0ZWxAYmVyaWNvdGVjaG5vbG9naWVzLmNvbTwvYT4mZ3Q7IHdyb3RlOjxi ciB0eXBlPSJhdHRyaWJ1dGlvbiI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHls ZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1s ZWZ0OjFleCI+CjxkaXYgZGlyPSJsdHIiPkkga2VlcCBnZXR0aW5nIGEgZmFpbCBvbqBDQ0UtMjcw MzItMiwgZXZlbiBhZnRlciByZWJ1aWxkaW5nIFNTRyBmcm9tIG1hc3Rlci4gVGhlIGJhZCB0aGlu ZyBpcyB0aGF0IGZpbmQgLyAtbm91c2VyIGFuZCBmaW5kIC8gLW5vZ3JvdXAgYXJlIG5vdCBmaW5k aW5nIHdoYXRldmVyIGZpbGVzIGFyZSB0cmlnZ2VyaW5nIHRoZSB3YXJuaW5nLjxkaXY+PGJyPjwv ZGl2PgoKPGRpdj5JcyB0aGVyZSBhIGRlYnVnIGZsYWcgSSBzaG91bGQgYmUgdXNpbmcgZm9yIG1v cmUgZGV0YWlscyBmcm9tIG9zY2FwIHRvIHRyYWNrIHRoaXMgZG93bj88L2Rpdj48ZGl2Pjxicj48 L2Rpdj48ZGl2PkplZmY8L2Rpdj48L2Rpdj4KPGJyPl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPgpzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcgbGlz dDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9z dGVkLm9yZyI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxi cj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlzdGlu Zm8vc2NhcC1zZWN1cml0eS1ndWlkZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVk b3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGU8L2E+PGJy Pgo8YnI+PC9ibG9ja3F1b3RlPjwvZGl2Pgo= --===============5964346466578613694==-- From shawn at redhat.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============4146029279673843430==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Fri, 04 Oct 2013 23:04:00 -0400 Message-ID: <524F81A0.6030005@redhat.com> In-Reply-To: 524F0F28.2070204@redhat.com --===============4146029279673843430== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 2:55 PM, fcaviggi(a)redhat.com wrote: > Jan, > > Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's = > '/sys/fs/selinux/enforce' > > -Frank > > > On 10/04/2013 02:49 PM, fcaviggi(a)redhat.com wrote: >> Jan, >> >> You might consider checking if the '/selinux/enforce' file exists and = >> the file contains '1' (1 is enforcing). That would ensure that = >> SELinux enabled and enforcing the policy. >> >> Regards, >> >> Frank Caviggia >> >> >> On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: >>> Introduce new SELinux section of the guide and first rule >>> for it - check if SELinux is enabled in currently >>> booted kernel. >>> >>> Please review. >>> >>> Thank you && Regards, Jan. >>> -- >>> Jan iankko Lieskovsky / Red Hat Security Technologies Team >>> Within the OVAL: + + + + + /proc/mounts + ^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\s*= $ + 1 + Caviggia and I were chatting earlier today.... while the /proc/mounts = reflects that selinux is loaded into the kernel, IIRC, it doesn't = indicate that it's actually *enforcing* on the system. This poses an = interesting challenge... Within the RHEL6 content, we: - Check for selinux=3D1 within grub - Check for SELINUX=3Denforcing within /etc/selinux/config These checks do not reflect *runtime* enablement of SELinux, but = unfortunately neither does /proc/mounts: > [shawn(a)SSG-RHEL6 checks]$ getenforce > Enforcing > > [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux > none /selinux selinuxfs rw,relatime 0 0 > > [shawn(a)SSG-RHEL6 checks]$ sudo setenforce 0 > [sudo] password for shawn: > > [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux > none /selinux selinuxfs rw,relatime 0 0 Is there another crafty way to verify that selinux is *enforcing*? = Perhaps checking the value in /etc/selinux instead? > [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce > 1 > [shawn(a)SSG-RHEL6 self]$ sudo setenforce 0 > > [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce > 0 If that's a non-reputable source of SELinux enablement, we should add an = appropriate XCCDF and OVAL rule to Fedora & RHEL streams. --===============4146029279673843430== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC80LzEzIDI6NTUgUE0sIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIj5mY2F2aWdnaUByZWRoYXQuY29tPC9h PgogICAgICB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1 MjRGMEYyOC4yMDcwMjA0QHJlZGhhdC5jb20iIHR5cGU9ImNpdGUiPgogICAgICA8bWV0YSBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+ CiAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+SmFuLDxicj4KICAgICAgICA8YnI+ CiAgICAgICAgRG9oLiBUaGUgJy9zZWxpbnV4L2VuZm9yY2UnIHdhcyBSSEVMIDYgLSBmb3IgRmVk b3JhIDE5IC0gaXQncwogICAgICAgICcvc3lzL2ZzL3NlbGludXgvZW5mb3JjZSc8YnI+CiAgICAg ICAgPGJyPgogICAgICAgIC1GcmFuazxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAg ICAgIE9uIDEwLzA0LzIwMTMgMDI6NDkgUE0sIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAg ICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICBocmVmPSJt YWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4KICAgICAg ICB3cm90ZTo8YnI+CiAgICAgIDwvZGl2PgogICAgICA8YmxvY2txdW90ZSBjaXRlPSJtaWQ6NTI0 RjBEQkMuODAxMDcwNEByZWRoYXQuY29tIiB0eXBlPSJjaXRlIj4KICAgICAgICA8bWV0YSBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiCiAgICAgICAgICBodHRwLWVxdWl2PSJDb250 ZW50LVR5cGUiPgogICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+SmFuLDxicj4K ICAgICAgICAgIDxicj4KICAgICAgICAgIFlvdSBtaWdodCBjb25zaWRlciBjaGVja2luZyBpZiB0 aGUgJy9zZWxpbnV4L2VuZm9yY2UnIGZpbGUKICAgICAgICAgIGV4aXN0cyBhbmQgdGhlIGZpbGUg Y29udGFpbnMgJzEnICgxIGlzIGVuZm9yY2luZykuIFRoYXQgd291bGQKICAgICAgICAgIGVuc3Vy ZSB0aGF0IFNFTGludXggZW5hYmxlZCBhbmQgZW5mb3JjaW5nIHRoZSBwb2xpY3kuPGJyPgogICAg ICAgICAgPGJyPgogICAgICAgICAgUmVnYXJkcyw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAg ICBGcmFuayBDYXZpZ2dpYTxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAg ICAgIE9uIDEwLzA0LzIwMTMgMDE6MTEgUE0sIEphbiBMaWVza292c2t5IHdyb3RlOjxicj4KICAg ICAgICA8L2Rpdj4KICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgY2l0ZT0ibWlkOjMzMDg3 NDU5Ni4xNTM5MTQ4LjEzODA5MDY2Njk0OTkuSmF2YU1haWwucm9vdEByZWRoYXQuY29tIgogICAg ICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgICA8cHJlIHdyYXA9IiI+SW50cm9kdWNlIG5ldyBT RUxpbnV4IHNlY3Rpb24gb2YgdGhlIGd1aWRlIGFuZCBmaXJzdCBydWxlCmZvciBpdCAtIGNoZWNr IGlmIFNFTGludXggaXMgZW5hYmxlZCBpbiBjdXJyZW50bHkKYm9vdGVkIGtlcm5lbC4KClBsZWFz ZSByZXZpZXcuCgpUaGFuayB5b3UgJmFtcDsmYW1wOyBSZWdhcmRzLCBKYW4uCi0tCkphbiBpYW5r a28gTGllc2tvdnNreSAvIFJlZCBIYXQgU2VjdXJpdHkgVGVjaG5vbG9naWVzIFRlYW08L3ByZT4K ICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDwvYmxvY2txdW90ZT4K ICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIFdpdGhpbiB0aGUgT1ZBTDo8YnI+CiAgICA8 YnI+CiAgICArwqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSJhbGwiCiAg ICBjaGVja19leGlzdGVuY2U9Im9ubHlfb25lX2V4aXN0cyIgY29tbWVudD0iY2hlY2sgZm9yIGV4 aXN0ZW5jZSBvZgogICAgc2VsaW51eGZzIGluIC9wcm9jL21vdW50cyBmaWxlIgogICAgaWQ9InRl c3RfZW5zdXJlX3NlbGludXhmc19pbl9wcm9jX21vdW50cyIgdmVyc2lvbj0iMSIgJmd0Ozxicj4K ICAgICvCoMKgwqAgJmx0O2luZDpvYmplY3Qgb2JqZWN0X3JlZj0ib2JqX2Vuc3VyZV9zZWxpbnV4 ZnNfaW5fcHJvY19tb3VudHMiCiAgICAvJmd0Ozxicj4KICAgICvCoCAmbHQ7L2luZDp0ZXh0Zmls ZWNvbnRlbnQ1NF90ZXN0Jmd0Ozxicj4KICAgICvCoCAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0 X29iamVjdAogICAgaWQ9Im9ial9lbnN1cmVfc2VsaW51eGZzX2luX3Byb2NfbW91bnRzIiB2ZXJz aW9uPSIxIiZndDs8YnI+CiAgICArwqDCoMKgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L3Byb2MvbW91 bnRzJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPgogICAgK8KgwqDCoCAmbHQ7aW5kOnBhdHRlcm4g b3BlcmF0aW9uPSJwYXR0ZXJuCm1hdGNoIiZndDteXHMqc2VsaW51eGZzXHMqL3N5cy9mcy9zZWxp bnV4XHMqc2VsaW51eGZzXHMqcncscmVsYXRpbWVccyowXHMqMFxzKiQmbHQ7L2luZDpwYXR0ZXJu Jmd0Ozxicj4KICAgICvCoMKgwqAgJmx0O2luZDppbnN0YW5jZSBkYXRhdHlwZT0iaW50IgogICAg b3BlcmF0aW9uPSJlcXVhbHMiJmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+CiAgICArwqAg Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KICAgIDxicj4KICAgIDxi cj4KICAgIENhdmlnZ2lhIGFuZCBJIHdlcmUgY2hhdHRpbmcgZWFybGllciB0b2RheS4uLi4gd2hp bGUgdGhlCiAgICAvcHJvYy9tb3VudHMgcmVmbGVjdHMgdGhhdCBzZWxpbnV4IGlzIGxvYWRlZCBp bnRvIHRoZSBrZXJuZWwsIElJUkMsCiAgICBpdCBkb2Vzbid0IGluZGljYXRlIHRoYXQgaXQncyBh Y3R1YWxseSAqZW5mb3JjaW5nKiBvbiB0aGUgc3lzdGVtLgogICAgVGhpcyBwb3NlcyBhbiBpbnRl cmVzdGluZyBjaGFsbGVuZ2UuLi48YnI+CiAgICA8YnI+CiAgICBXaXRoaW4gdGhlIFJIRUw2IGNv bnRlbnQsIHdlOjxicj4KICAgIC0gQ2hlY2sgZm9yIHNlbGludXg9MSB3aXRoaW4gZ3J1Yjxicj4K ICAgIC0gQ2hlY2sgZm9yIFNFTElOVVg9ZW5mb3JjaW5nIHdpdGhpbiAvZXRjL3NlbGludXgvY29u ZmlnPGJyPgogICAgPGJyPgogICAgVGhlc2UgY2hlY2tzIGRvIG5vdCByZWZsZWN0ICpydW50aW1l KiBlbmFibGVtZW50IG9mIFNFTGludXgsIGJ1dAogICAgdW5mb3J0dW5hdGVseSBuZWl0aGVyIGRv ZXMgL3Byb2MvbW91bnRzOjxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPltzaGF3bkBT U0ctUkhFTDYgY2hlY2tzXSQgZ2V0ZW5mb3JjZSA8YnI+CiAgICAgIEVuZm9yY2luZzxicj4KICAg ICAgPGJyPgogICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIGNhdCAvcHJvYy9tb3VudHMg fCBncmVwIHNlbGludXg8YnI+CiAgICAgIG5vbmUgL3NlbGludXggc2VsaW51eGZzIHJ3LHJlbGF0 aW1lIDAgMDxicj4KICAgICAgPGJyPgogICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1 ZG8gc2V0ZW5mb3JjZSAwPGJyPgogICAgICBbc3Vkb10gcGFzc3dvcmQgZm9yIHNoYXduOiA8YnI+ CiAgICAgIDxicj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBjYXQgL3Byb2MvbW91 bnRzIHwgZ3JlcCBzZWxpbnV4PGJyPgogICAgICBub25lIC9zZWxpbnV4IHNlbGludXhmcyBydyxy ZWxhdGltZSAwIDA8L2Jsb2NrcXVvdGU+CiAgICBJcyB0aGVyZSBhbm90aGVyIGNyYWZ0eSB3YXkg dG8gdmVyaWZ5IHRoYXQgc2VsaW51eCBpcyAqZW5mb3JjaW5nKj8KICAgIFBlcmhhcHMgY2hlY2tp bmcgdGhlIHZhbHVlIGluIC9ldGMvc2VsaW51eCBpbnN0ZWFkPzxicj4KICAgIDxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPltzaGF3bkBTU0ctUkhFTDYgc2VsZl0kIGNhdCAvc2VsaW51eC9lbmZvcmNl CiAgICAgIDxicj4KICAgICAgMTxicj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBzZWxmXSQgc3Vk byBzZXRlbmZvcmNlIDA8YnI+CiAgICAgIDxicj4KICAgICAgW3NoYXduQFNTRy1SSEVMNiBzZWxm XSQgY2F0IC9zZWxpbnV4L2VuZm9yY2UgPGJyPgogICAgICAwPC9ibG9ja3F1b3RlPgogICAgSWYg dGhhdCdzIGEgbm9uLXJlcHV0YWJsZSBzb3VyY2Ugb2YgU0VMaW51eCBlbmFibGVtZW50LCB3ZSBz aG91bGQKICAgIGFkZCBhbiBhcHByb3ByaWF0ZSBYQ0NERiBhbmQgT1ZBTCBydWxlIHRvIEZlZG9y YSAmYW1wOyBSSEVMIHN0cmVhbXMuPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============4146029279673843430==-- From shawn at redhat.com Thu Aug 20 11:35:27 2015 Content-Type: multipart/mixed; boundary="===============0348132296515096391==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Fri, 04 Oct 2013 23:05:24 -0400 Message-ID: <524F81F4.8060501@redhat.com> In-Reply-To: 524EAF53.2030507@gtri.gatech.edu --===============0348132296515096391== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 8:06 AM, Josh Kayse wrote: > On 10/04/2013 07:40 AM, Trevor Vaughan wrote: >> Is Augeas an option? >> >> This seems like the perfect opportunity to solidify the Augeas lenses >> regarding security settings while making life easier for everyone. >> >> Trevor >> >> >> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells > > wrote: >> >> On 10/3/13 3:11 PM, fcaviggi(a)redhat.com >> wrote: >>> All, >>> >>> As a starting point for writing remediation fixes in the SSG - so, >>> I did the following: >>> >>> $ ls ~//scap-security-guide/RHEL6/input/checks//*.xml | awk '{ >>> print $1 }' | sed s/\.[^\.]*$// > ~/checks >>> $ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh | awk '{ >>> print $1 }' | sed s/\.[^\.]*$// > ~/fixes >>> $ sdiff ~/fixes ~/checks | less >>> >>> There's fair a bit of work to be done for the fix remediations... >>> >>> Since I'm new to the project, I was wondering if there was any >>> ideas or standards to how the SSG should distribute some of these >>> fixes - for example - a wholesale replacement of the audit.rules >>> and auditd.conf might be preferable than doing piecemeal sed's. >> >> It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules >> /etc/audit.rules`, and that likely is the right choice during an >> initial provisioning process. But then SysAdmins tailor audit rules, >> the system evolves, and we need to evaluate the audit.rules file >> against specific auditing guidance items after the pristine >> audit.rules template is manipulated. >> >> So, if a single rule must be remediated, we can't blow away the >> whole audit.rules file. Super fun sed scripts it is =3D/ >> >> > > I think that augeas is a good idea. We need to be careful that rules = > that are inserted in to audit.rules happen before any '-e 2' line (if = > one exists). Otherwise they will fail to be inserted because the = > audit rules become locked. > > -josh = Augeas and puppet would be great, their downside is they don't ship = natively with RHEL :( Part of the goal is to enable the remediation with = native tooling first. IMO, Augeas scripts would be *fantastic* for Aqueduct! --===============0348132296515096391==-- From shawn at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============4248732626213278739==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Fri, 04 Oct 2013 23:08:30 -0400 Message-ID: <524F82AE.50701@redhat.com> In-Reply-To: 524EB98F.7040007@redhat.com --===============4248732626213278739== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 8:50 AM, fcaviggi(a)redhat.com wrote: > > I was thinking this trough last night - I was wondering if we can use = > checksums (sha256+) to determine if someone is using the "stock" = > configuration and replace it with a fully STIGed version - I'm = > thinking this would be best applicable to new installations of RHEL. I = > understand the need for atomic fixes for pre-existing systems, where = > the SA has modified the defaults, but I can guarantee you that most = > people just want a STIG'ed box out of the gate on install. I'm just = > trying to think in terms of long term and short term goals - the = > quicker we can satisfy the majority of the users (the ones that want = > something STIG'ed out of the box) the better acceptance the product = > will have, the long term should be to modify things for the people = > that mucked with their configurations, which I'm arguing is a minority. > > I go back to Star Trek II: Wrath of Khan with Spock, "It is logical. = > The needs of the many = > outweigh...the = > needs of the = > few...or the = > one." We need to get the ship out of danger, and then worry about the = > needs of the few. > > What do you think of my solution? Something like this? if rpm -V audit cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules else if audit rule misconfigured sed fix else echo audit_rule >> /etc/audit.rules fi fi I'm not particularly opposed. We'll want to ensure that the = /usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and if = not, submit RFEs). It'd be great if we could template these somehow. --===============4248732626213278739== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC80LzEzIDg6NTAgQU0sIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIj5mY2F2aWdnaUByZWRoYXQuY29tPC9h PgogICAgICB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1 MjRFQjk4Ri43MDQwMDA3QHJlZGhhdC5jb20iIHR5cGU9ImNpdGUiPjxicj4KICAgICAgSSB3YXMg dGhpbmtpbmcgdGhpcyB0cm91Z2ggbGFzdCBuaWdodCAtIEkgd2FzIHdvbmRlcmluZyBpZiB3ZSBj YW4KICAgICAgdXNlIGNoZWNrc3VtcyAoc2hhMjU2KykgdG8gZGV0ZXJtaW5lIGlmIHNvbWVvbmUg aXMgdXNpbmcgdGhlCiAgICAgICJzdG9jayIgY29uZmlndXJhdGlvbiBhbmQgcmVwbGFjZSBpdCB3 aXRoIGEgZnVsbHkgU1RJR2VkIHZlcnNpb24gLQogICAgICBJJ20gdGhpbmtpbmcgdGhpcyB3b3Vs ZCBiZSBiZXN0IGFwcGxpY2FibGUgdG8gbmV3IGluc3RhbGxhdGlvbnMgb2YKICAgICAgUkhFTC4g SSB1bmRlcnN0YW5kIHRoZSBuZWVkIGZvcsKgIGF0b21pYyBmaXhlcyBmb3IgcHJlLWV4aXN0aW5n CiAgICAgIHN5c3RlbXMsIHdoZXJlIHRoZSBTQSBoYXMgbW9kaWZpZWQgdGhlIGRlZmF1bHRzLCBi dXQgSSBjYW4KICAgICAgZ3VhcmFudGVlIHlvdSB0aGF0IG1vc3QgcGVvcGxlIGp1c3Qgd2FudCBh IFNUSUcnZWQgYm94IG91dCBvZiB0aGUKICAgICAgZ2F0ZSBvbiBpbnN0YWxsLiBJJ20ganVzdCB0 cnlpbmcgdG8gdGhpbmsgaW4gdGVybXMgb2YgbG9uZyB0ZXJtCiAgICAgIGFuZCBzaG9ydCB0ZXJt IGdvYWxzIC0gdGhlIHF1aWNrZXIgd2UgY2FuIHNhdGlzZnkgdGhlIG1ham9yaXR5IG9mCiAgICAg IHRoZSB1c2VycyAodGhlIG9uZXMgdGhhdCB3YW50IHNvbWV0aGluZyBTVElHJ2VkIG91dCBvZiB0 aGUgYm94KQogICAgICB0aGUgYmV0dGVyIGFjY2VwdGFuY2UgdGhlIHByb2R1Y3Qgd2lsbCBoYXZl LCB0aGUgbG9uZyB0ZXJtIHNob3VsZAogICAgICBiZSB0byBtb2RpZnkgdGhpbmdzIGZvciB0aGUg cGVvcGxlIHRoYXQgbXVja2VkIHdpdGggdGhlaXIKICAgICAgY29uZmlndXJhdGlvbnMsIHdoaWNo IEknbSBhcmd1aW5nIGlzIGEgbWlub3JpdHkuPGJyPgogICAgICDCoDxicj4KICAgICAgSSBnbyBi YWNrIHRvIFN0YXIgVHJlayBJSTogV3JhdGggb2YgS2hhbiB3aXRoIFNwb2NrLCAiSXQgaXMKICAg ICAgbG9naWNhbC4gVGhlIG5lZWRzIG9mIHRoZSBtYW55IG91dHdlaWdoPGEgbW96LWRvLW5vdC1z ZW5kPSJ0cnVlIgogICAgICAgIGhyZWY9Imh0dHA6Ly93d3cuaW1kYi5jb20vbmFtZS9ubTAwMDA2 MzgvP3JlZl89dHRfdHJ2X3F1Ij48c3BhbgogICAgICAgICAgY2xhc3M9ImNoYXJhY3RlciI+PC9z cGFuPjwvYT4uLi50aGUgbmVlZHMgb2YgdGhlIGZldzxhCiAgICAgICAgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIgogICAgICAgIGhyZWY9Imh0dHA6Ly93d3cuaW1kYi5jb20vbmFtZS9ubTAwMDA1NTkv P3JlZl89dHRfdHJ2X3F1Ij48c3BhbgogICAgICAgICAgY2xhc3M9ImNoYXJhY3RlciI+PC9zcGFu PjwvYT4uLi5vciB0aGUgb25lLiLCoCBXZSBuZWVkIHRvIGdldAogICAgICB0aGUgc2hpcCBvdXQg b2YgZGFuZ2VyLCBhbmQgdGhlbiB3b3JyeSBhYm91dCB0aGUgbmVlZHMgb2YgdGhlIGZldy48YnI+ CiAgICAgIDxicj4KICAgICAgV2hhdCBkbyB5b3UgdGhpbmsgb2YgbXkgc29sdXRpb24/PC9ibG9j a3F1b3RlPgogICAgPGJyPgogICAgU29tZXRoaW5nIGxpa2UgdGhpcz88YnI+CiAgICA8YnI+CiAg ICBpZiBycG0gLVYgYXVkaXQ8YnI+CiAgICDCoMKgwqAgY3AgL3Vzci9zaGFyZS9kb2MvYXVkaXQt Ki9zdGlnLnJ1bGVzIC9ldGMvYXVkaXQucnVsZXM8YnI+CiAgICBlbHNlPGJyPgogICAgwqDCoMKg IGlmIGF1ZGl0IHJ1bGUgbWlzY29uZmlndXJlZDxicj4KICAgIMKgwqDCoCDCoMKgwqAgc2VkIGZp eDxicj4KICAgIMKgwqDCoCBlbHNlPGJyPgogICAgwqDCoMKgIMKgwqDCoCBlY2hvIGF1ZGl0X3J1 bGUgJmd0OyZndDsgL2V0Yy9hdWRpdC5ydWxlczxicj4KICAgIMKgwqDCoCBmaTxicj4KICAgIGZp PGJyPgogICAgPGJyPgogICAgSSdtIG5vdCBwYXJ0aWN1bGFybHkgb3Bwb3NlZC4gV2UnbGwgd2Fu dCB0byBlbnN1cmUgdGhhdCB0aGUKICAgIC91c3Ivc2hhcmUvZG9jL2F1ZGl0LSovc3RpZy5ydWxl cyBmaWxlIG1lZXRzIHRoZSBTVElHL1NTRyBuZWVkcyAoYW5kCiAgICBpZiBub3QsIHN1Ym1pdCBS RkVzKS4gSXQnZCBiZSBncmVhdCBpZiB3ZSBjb3VsZCB0ZW1wbGF0ZSB0aGVzZQogICAgc29tZWhv dy48YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============4248732626213278739==-- From shawn at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============3004839279106510984==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Remediations involving sshd_config Date: Fri, 04 Oct 2013 23:15:14 -0400 Message-ID: <524F8442.1040900@redhat.com> In-Reply-To: B0F8BA03CBE85346A2A4A48A2A9365D401EA7422E59D@INOAVREX11.ptin.corpPT.com --===============3004839279106510984== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/4/13 3:52 AM, Rui Pedro Bernardino wrote: > Hi, > > I have exactly the same results but that=E2=80=99s not the point. This is= what I get on a system without a =E2=80=98Banner=E2=80=99 but with a 'Matc= h' group: > [root(a)seis64 ~]# ssh localhost > root(a)localhost's password: > [root(a)seis64 ~]# sshd_enable_warning_banner.sh > [root(a)seis64 ~]# /etc/init.d/sshd restart > Stopping sshd: [ OK ] > Starting sshd: [ OK ] > [root(a)seis64 ~]# ssh localhost > root(a)localhost's password: > > Still no banner. > > This is because the =E2=80=98Banner=E2=80=99 was appended to the end of s= shd_config and got =E2=80=98absorved=E2=80=99 by the Match rules (that use = anything following 'Match' until EOF or another 'Match'): > [root(a)seis64 ~]# tail -5 /etc/ssh/sshd_config > # Rules for sftponly group > Match group sftponly > X11Forwarding no > AllowTcpForwarding no > Banner /etc/issue > > This applies to all SSG's sshd_config fixes. Note not all configuration p= rimitives are acceptable on the =E2=80=9CMatch=E2=80=9D blocks, meaning sta= rting sshd will fail. > > Bottom line, new primitives must be inserted*before* Match blocks. Ah, yes, I see what you're talking about now. How's this? > # Attempt to adjust value, should string be present > grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \ > sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" = > /etc/ssh/sshd_config > if ! [ $? -eq 0 ]; then > # string not present, check for Match stanza > grep -q ^Match /etc/ssh/sshd_config && \ > sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords = > no\n&/' /etc/ssh/sshd_config > if ! [ $? -eq 0 ]; then > # Match stanza not present, add to bottom of = > /etc/ssh/sshd_config > echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config > fi > fi .... there has to be some easier / less fugly way through sed or awk... = anyone? --===============3004839279106510984== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC80LzEzIDM6NTIgQU0sIFJ1aSBQZWRybwogICAgICBCZXJuYXJkaW5vIHdyb3RlOjxi cj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOkIwRjhCQTAzQ0JFODUzNDZB MkE0QTQ4QTJBOTM2NUQ0MDFFQTc0MjJFNTlEQElOT0FWUkVYMTEucHRpbi5jb3JwUFQuY29tIgog ICAgICB0eXBlPSJjaXRlIj4KICAgICAgPHByZSB3cmFwPSIiPkhpLAoKSSBoYXZlIGV4YWN0bHkg dGhlIHNhbWUgcmVzdWx0cyBidXQgdGhhdOKAmXMgbm90IHRoZSBwb2ludC4gVGhpcyBpcyB3aGF0 IEkgZ2V0IG9uIGEgc3lzdGVtIHdpdGhvdXQgYSDigJhCYW5uZXLigJkgYnV0IHdpdGggYSAnTWF0 Y2gnIGdyb3VwOgoJW3Jvb3RAc2VpczY0IH5dIyBzc2ggbG9jYWxob3N0Cglyb290QGxvY2FsaG9z dCdzIHBhc3N3b3JkOiAgICAgICAgICAgICAgICAgICAgCglbcm9vdEBzZWlzNjQgfl0jIHNzaGRf ZW5hYmxlX3dhcm5pbmdfYmFubmVyLnNoCglbcm9vdEBzZWlzNjQgfl0jIC9ldGMvaW5pdC5kL3Nz aGQgcmVzdGFydAoJU3RvcHBpbmcgc3NoZDogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBbICBPSyAgXQoJU3RhcnRpbmcgc3NoZDogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBbICBPSyAgXQoJW3Jvb3RAc2VpczY0IH5dIyBzc2gg bG9jYWxob3N0Cglyb290QGxvY2FsaG9zdCdzIHBhc3N3b3JkOgoKU3RpbGwgbm8gYmFubmVyLiAK ClRoaXMgaXMgYmVjYXVzZSB0aGUg4oCYQmFubmVy4oCZIHdhcyBhcHBlbmRlZCB0byB0aGUgZW5k IG9mIHNzaGRfY29uZmlnIGFuZCBnb3Qg4oCYYWJzb3J2ZWTigJkgYnkgdGhlIE1hdGNoIHJ1bGVz ICh0aGF0IHVzZSBhbnl0aGluZyBmb2xsb3dpbmcgJ01hdGNoJyB1bnRpbCBFT0Ygb3IgYW5vdGhl ciAnTWF0Y2gnKToKCVtyb290QHNlaXM2NCB+XSMgdGFpbCAtNSAvZXRjL3NzaC9zc2hkX2NvbmZp ZwoJIyBSdWxlcyBmb3Igc2Z0cG9ubHkgZ3JvdXAKCU1hdGNoIGdyb3VwIHNmdHBvbmx5CglYMTFG b3J3YXJkaW5nIG5vCglBbGxvd1RjcEZvcndhcmRpbmcgbm8KCUJhbm5lciAvZXRjL2lzc3VlCgpU aGlzIGFwcGxpZXMgdG8gYWxsIFNTRydzIHNzaGRfY29uZmlnIGZpeGVzLiBOb3RlIG5vdCBhbGwg Y29uZmlndXJhdGlvbiBwcmltaXRpdmVzIGFyZSBhY2NlcHRhYmxlIG9uIHRoZSDigJxNYXRjaOKA nSBibG9ja3MsIG1lYW5pbmcgc3RhcnRpbmcgc3NoZCB3aWxsIGZhaWwuCgpCb3R0b20gbGluZSwg bmV3IHByaW1pdGl2ZXMgbXVzdCBiZSBpbnNlcnRlZCA8YiBjbGFzcz0ibW96LXR4dC1zdGFyIj48 c3BhbiBjbGFzcz0ibW96LXR4dC10YWciPio8L3NwYW4+YmVmb3JlPHNwYW4gY2xhc3M9Im1vei10 eHQtdGFnIj4qPC9zcGFuPjwvYj4gTWF0Y2ggYmxvY2tzLgo8L3ByZT4KICAgIDwvYmxvY2txdW90 ZT4KICAgIDxicj4KICAgIEFoLCB5ZXMsIEkgc2VlIHdoYXQgeW91J3JlIHRhbGtpbmcgYWJvdXQg bm93LiBIb3cncyB0aGlzPzxicj4KICAgIDxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PiMgQXR0ZW1wdCB0byBhZGp1c3QgdmFsdWUsIHNob3VsZCBzdHJpbmcgYmUKICAgICAgcHJlc2Vu dDxicj4KICAgICAgZ3JlcCAtcSBeUGVybWl0RW1wdHlQYXNzd29yZHMgL2V0Yy9zc2gvc3NoZF9j b25maWcgJmFtcDsmYW1wOyBcPGJyPgogICAgICDCoCBzZWQgLWkgInMvUGVybWl0RW1wdHlQYXNz d29yZHMuKi9QZXJtaXRFbXB0eVBhc3N3b3JkcyBuby9nIgogICAgICAvZXRjL3NzaC9zc2hkX2Nv bmZpZzxicj4KICAgICAgaWYgISBbICQ/IC1lcSAwIF07IHRoZW48YnI+CiAgICAgIMKgwqDCoMKg wqDCoMKgICMgc3RyaW5nIG5vdCBwcmVzZW50LCBjaGVjayBmb3IgTWF0Y2ggc3RhbnphPGJyPgog ICAgICDCoMKgwqDCoMKgwqDCoCBncmVwIC1xIF5NYXRjaCAvZXRjL3NzaC9zc2hkX2NvbmZpZyAm YW1wOyZhbXA7IFw8YnI+CiAgICAgIMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBzZWQg JzAsLy4qTWF0Y2guKi9zLy4qTWF0Y2gqLi9QZXJtaXRFbXB0eVBhc3N3b3JkcwogICAgICBub1xu JmFtcDsvJyAvZXRjL3NzaC9zc2hkX2NvbmZpZzxicj4KICAgICAgwqDCoMKgwqDCoMKgwqAgaWYg ISBbICQ/IC1lcSAwIF07IHRoZW48YnI+CiAgICAgIMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCAjIE1hdGNoIHN0YW56YSBub3QgcHJlc2VudCwgYWRkIHRvIGJvdHRvbSBvZgogICAgICAv ZXRjL3NzaC9zc2hkX2NvbmZpZzxicj4KICAgICAgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgIGVjaG8gIlBlcm1pdEVtcHR5UGFzc3dvcmRzIG5vIiAmZ3Q7Jmd0OwogICAgICAvZXRjL3Nz aC9zc2hkX2NvbmZpZzxicj4KICAgICAgwqDCoMKgwqDCoMKgwqAgZmk8YnI+CiAgICAgIGZpPC9i bG9ja3F1b3RlPgogICAgPGJyPgogICAgLi4uLiB0aGVyZSBoYXMgdG8gYmUgc29tZSBlYXNpZXIg LyBsZXNzIGZ1Z2x5IHdheSB0aHJvdWdoIHNlZCBvcgogICAgYXdrLi4uIGFueW9uZT88YnI+CiAg ICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============3004839279106510984==-- From shawn at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============5631534718479450723==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Changed the gconf_gnome_screensaver_idle_delay check to pass on values less than or equal to those in the profile. This allows users to reduce the time until the screensaver begins without causing the test to fail. Date: Fri, 04 Oct 2013 23:26:30 -0400 Message-ID: <524F86E6.7090409@redhat.com> In-Reply-To: 1380805192-12015-2-git-send-email-coopercd@ornl.gov --===============5631534718479450723== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/3/13 8:59 AM, Caleb Cooper wrote: > Signed-off-by: Caleb Cooper > --- > .../checks/gconf_gnome_screensaver_idle_delay.xml | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/= RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml > index 4a675a9..70cc1c2 100644 > --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml > +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml > @@ -20,7 +20,7 @@ > /gconf/dir[@nam= e=3D'schemas']/dir[@name=3D'apps']/dir[@name=3D'gnome-screensaver']/entry[@= name=3D'idle_delay']/local_schema[1]/default[1]/@value > > > - > + > > - > + > Ack --===============5631534718479450723==-- From bmillett at gmail.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============2110068038713751253==" MIME-Version: 1.0 From: Brian Millett To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 06:57:08 -0500 Message-ID: <20131005065708.3992e2dd@dufus> In-Reply-To: 524EB98F.7040007@redhat.com --===============2110068038713751253== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Fri, 04 Oct 2013 08:50:23 -0400 fcaviggi(a)redhat.com wrote: > I was thinking this trough last night - I was wondering if we can use > checksums (sha256+) to determine if someone is using the "stock" > configuration and replace it with a fully STIGed version - I'm thinking t= his > would be best applicable to new installations of RHEL. I understand the n= eed > for=C2=A0 atomic fixes for pre-existing systems, where the SA has modifie= d the > defaults, but I can guarantee you that most people just want a STIG'ed box > out of the gate on install. I'm just trying to think in terms of long term > and short term goals - the quicker we can satisfy the majority of the use= rs > (the ones that want something STIG'ed out of the box) the better acceptan= ce > the product will have, the long term should be to modify things for the > people that mucked with their configurations, which I'm arguing is a > minority. Well, not really. I've set up ssg for several clients and not a single one wants to use it as is, they have all different requirements. Some need a different banner, some different password parameters, some different ssh, etc. All I'm saying is my experience is that most want to modify. -- = Brian Millett "The guerrillas, whose ancestors migrated to Mars from Earth over the past hundred years, have demanded independence for the Mars Colony or, and I quote, 'The sand will run red with Earther blood.'" -- [ Derek Mobotabwe, ISN News, "A Voice in the Wilderness I"] --===============2110068038713751253==-- From fcaviggi at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============1092580308911969988==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Sat, 05 Oct 2013 12:07:39 -0400 Message-ID: <5250394B.9060902@redhat.com> In-Reply-To: 524F81A0.6030005@redhat.com --===============1092580308911969988== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Shawn, If these files exist and contain '1': '/selinux/enforce' - RHEL 6 '/sys/fs/selinux/enforce' - Fedora 19 Then SELinux is enabled and enforcing - the filesystem can only exist if = SELinux is enabled, the contents are the enforcement status. -Frank On 10/04/2013 11:04 PM, Shawn Wells wrote: > On 10/4/13 2:55 PM, fcaviggi(a)redhat.com wrote: >> Jan, >> >> Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's = >> '/sys/fs/selinux/enforce' >> >> -Frank >> >> >> On 10/04/2013 02:49 PM, fcaviggi(a)redhat.com wrote: >>> Jan, >>> >>> You might consider checking if the '/selinux/enforce' file exists = >>> and the file contains '1' (1 is enforcing). That would ensure that = >>> SELinux enabled and enforcing the policy. >>> >>> Regards, >>> >>> Frank Caviggia >>> >>> >>> On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: >>>> Introduce new SELinux section of the guide and first rule >>>> for it - check if SELinux is enabled in currently >>>> booted kernel. >>>> >>>> Please review. >>>> >>>> Thank you && Regards, Jan. >>>> -- >>>> Jan iankko Lieskovsky / Red Hat Security Technologies Team >>>> > > Within the OVAL: > > + check_existence=3D"only_one_exists" comment=3D"check for existence of = > selinuxfs in /proc/mounts file" = > id=3D"test_ensure_selinuxfs_in_proc_mounts" version=3D"1" > > + > + > + id=3D"obj_ensure_selinuxfs_in_proc_mounts" version=3D"1"> > + /proc/mounts > + match">^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\= s*$ > + 1 > + > > > Caviggia and I were chatting earlier today.... while the /proc/mounts = > reflects that selinux is loaded into the kernel, IIRC, it doesn't = > indicate that it's actually *enforcing* on the system. This poses an = > interesting challenge... > > Within the RHEL6 content, we: > - Check for selinux=3D1 within grub > - Check for SELINUX=3Denforcing within /etc/selinux/config > > These checks do not reflect *runtime* enablement of SELinux, but = > unfortunately neither does /proc/mounts: >> [shawn(a)SSG-RHEL6 checks]$ getenforce >> Enforcing >> >> [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux >> none /selinux selinuxfs rw,relatime 0 0 >> >> [shawn(a)SSG-RHEL6 checks]$ sudo setenforce 0 >> [sudo] password for shawn: >> >> [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux >> none /selinux selinuxfs rw,relatime 0 0 > Is there another crafty way to verify that selinux is *enforcing*? = > Perhaps checking the value in /etc/selinux instead? >> [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce >> 1 >> [shawn(a)SSG-RHEL6 self]$ sudo setenforce 0 >> >> [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce >> 0 > If that's a non-reputable source of SELinux enablement, we should add = > an appropriate XCCDF and OVAL rule to Fedora & RHEL streams. > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============1092580308911969988== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5TaGF3biwgPGJyPgogICAgICA8YnI+CiAgICAgIElmIHRoZXNlIGZpbGVzIGV4aXN0IGFuZCBj b250YWluICcxJzo8YnI+CiAgICAgIDxicj4KICAgICAgwqDCoMKgICcvc2VsaW51eC9lbmZvcmNl JyAtIFJIRUwgNjxicj4KICAgICAgwqDCoMKgICcvc3lzL2ZzL3NlbGludXgvZW5mb3JjZScgLSBG ZWRvcmEgMTk8YnI+CiAgICAgIDxicj4KICAgICAgVGhlbiBTRUxpbnV4IGlzIGVuYWJsZWQgYW5k IGVuZm9yY2luZyAtIHRoZSBmaWxlc3lzdGVtIGNhbiBvbmx5CiAgICAgIGV4aXN0IGlmIFNFTGlu dXggaXMgZW5hYmxlZCwgdGhlIGNvbnRlbnRzIGFyZSB0aGUgZW5mb3JjZW1lbnQKICAgICAgc3Rh dHVzLjxicj4KICAgICAgPGJyPgogICAgICAtRnJhbms8YnI+CiAgICAgIDxicj4KICAgICAgPGJy PgogICAgICBPbiAxMC8wNC8yMDEzIDExOjA0IFBNLCBTaGF3biBXZWxscyB3cm90ZTo8YnI+CiAg ICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1MjRGODFBMC42MDMwMDA1QHJlZGhh dC5jb20iIHR5cGU9ImNpdGUiPgogICAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJz ZXQ9VVRGLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1v ei1jaXRlLXByZWZpeCI+T24gMTAvNC8xMyAyOjU1IFBNLCA8YQogICAgICAgICAgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAg aHJlZj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5jb20iPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+ CiAgICAgICAgd3JvdGU6PGJyPgogICAgICA8L2Rpdj4KICAgICAgPGJsb2NrcXVvdGUgY2l0ZT0i bWlkOjUyNEYwRjI4LjIwNzAyMDRAcmVkaGF0LmNvbSIgdHlwZT0iY2l0ZSI+CiAgICAgICAgPG1l dGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IgogICAgICAgICAgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIj4KICAgICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPkph biw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBEb2guIFRoZSAnL3NlbGludXgvZW5mb3Jj ZScgd2FzIFJIRUwgNiAtIGZvciBGZWRvcmEgMTkgLSBpdCdzCiAgICAgICAgICAnL3N5cy9mcy9z ZWxpbnV4L2VuZm9yY2UnPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgLUZyYW5rPGJyPgog ICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgT24gMTAvMDQvMjAxMyAwMjo0 OSBQTSwgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgICBjbGFzcz0ibW96LXR4 dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVk aGF0LmNvbSI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4KICAgICAgICAgIHdyb3RlOjxicj4KICAg ICAgICA8L2Rpdj4KICAgICAgICA8YmxvY2txdW90ZSBjaXRlPSJtaWQ6NTI0RjBEQkMuODAxMDcw NEByZWRoYXQuY29tIiB0eXBlPSJjaXRlIj4KICAgICAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQv aHRtbDsgY2hhcnNldD1VVEYtOCIKICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBl Ij4KICAgICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+SmFuLDxicj4KICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICBZb3UgbWlnaHQgY29uc2lkZXIgY2hlY2tpbmcgaWYgdGhl ICcvc2VsaW51eC9lbmZvcmNlJyBmaWxlCiAgICAgICAgICAgIGV4aXN0cyBhbmQgdGhlIGZpbGUg Y29udGFpbnMgJzEnICgxIGlzIGVuZm9yY2luZykuIFRoYXQKICAgICAgICAgICAgd291bGQgZW5z dXJlIHRoYXQgU0VMaW51eCBlbmFibGVkIGFuZCBlbmZvcmNpbmcgdGhlIHBvbGljeS48YnI+CiAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgUmVnYXJkcyw8YnI+CiAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgRnJhbmsgQ2F2aWdnaWE8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICBPbiAxMC8wNC8yMDEzIDAxOjExIFBNLCBKYW4gTGllc2tvdnNr eSB3cm90ZTo8YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxibG9ja3F1b3RlCiAgICAg ICAgICAgIGNpdGU9Im1pZDozMzA4NzQ1OTYuMTUzOTE0OC4xMzgwOTA2NjY5NDk5LkphdmFNYWls LnJvb3RAcmVkaGF0LmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgIDxw cmUgd3JhcD0iIj5JbnRyb2R1Y2UgbmV3IFNFTGludXggc2VjdGlvbiBvZiB0aGUgZ3VpZGUgYW5k IGZpcnN0IHJ1bGUKZm9yIGl0IC0gY2hlY2sgaWYgU0VMaW51eCBpcyBlbmFibGVkIGluIGN1cnJl bnRseQpib290ZWQga2VybmVsLgoKUGxlYXNlIHJldmlldy4KClRoYW5rIHlvdSAmYW1wOyZhbXA7 IFJlZ2FyZHMsIEphbi4KLS0KSmFuIGlhbmtrbyBMaWVza292c2t5IC8gUmVkIEhhdCBTZWN1cml0 eSBUZWNobm9sb2dpZXMgVGVhbTwvcHJlPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg IDxicj4KICAgICAgV2l0aGluIHRoZSBPVkFMOjxicj4KICAgICAgPGJyPgogICAgICArwqAgJmx0 O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSJhbGwiCiAgICAgIGNoZWNrX2V4aXN0 ZW5jZT0ib25seV9vbmVfZXhpc3RzIiBjb21tZW50PSJjaGVjayBmb3IgZXhpc3RlbmNlIG9mCiAg ICAgIHNlbGludXhmcyBpbiAvcHJvYy9tb3VudHMgZmlsZSIKICAgICAgaWQ9InRlc3RfZW5zdXJl X3NlbGludXhmc19pbl9wcm9jX21vdW50cyIgdmVyc2lvbj0iMSIgJmd0Ozxicj4KICAgICAgK8Kg wqDCoCAmbHQ7aW5kOm9iamVjdAogICAgICBvYmplY3RfcmVmPSJvYmpfZW5zdXJlX3NlbGludXhm c19pbl9wcm9jX21vdW50cyIgLyZndDs8YnI+CiAgICAgICvCoCAmbHQ7L2luZDp0ZXh0ZmlsZWNv bnRlbnQ1NF90ZXN0Jmd0Ozxicj4KICAgICAgK8KgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRf b2JqZWN0CiAgICAgIGlkPSJvYmpfZW5zdXJlX3NlbGludXhmc19pbl9wcm9jX21vdW50cyIgdmVy c2lvbj0iMSImZ3Q7PGJyPgogICAgICArwqDCoMKgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L3Byb2Mv bW91bnRzJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPgogICAgICArwqDCoMKgICZsdDtpbmQ6cGF0 dGVybiBvcGVyYXRpb249InBhdHRlcm4KbWF0Y2giJmd0O15ccypzZWxpbnV4ZnNccyovc3lzL2Zz L3NlbGludXhccypzZWxpbnV4ZnNccypydyxyZWxhdGltZVxzKjBccyowXHMqJCZsdDsvaW5kOnBh dHRlcm4mZ3Q7PGJyPgogICAgICArwqDCoMKgICZsdDtpbmQ6aW5zdGFuY2UgZGF0YXR5cGU9Imlu dCIKICAgICAgb3BlcmF0aW9uPSJlcXVhbHMiJmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+ CiAgICAgICvCoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7PGJyPgogICAg ICA8YnI+CiAgICAgIDxicj4KICAgICAgQ2F2aWdnaWEgYW5kIEkgd2VyZSBjaGF0dGluZyBlYXJs aWVyIHRvZGF5Li4uLiB3aGlsZSB0aGUKICAgICAgL3Byb2MvbW91bnRzIHJlZmxlY3RzIHRoYXQg c2VsaW51eCBpcyBsb2FkZWQgaW50byB0aGUga2VybmVsLAogICAgICBJSVJDLCBpdCBkb2Vzbid0 IGluZGljYXRlIHRoYXQgaXQncyBhY3R1YWxseSAqZW5mb3JjaW5nKiBvbiB0aGUKICAgICAgc3lz dGVtLiBUaGlzIHBvc2VzIGFuIGludGVyZXN0aW5nIGNoYWxsZW5nZS4uLjxicj4KICAgICAgPGJy PgogICAgICBXaXRoaW4gdGhlIFJIRUw2IGNvbnRlbnQsIHdlOjxicj4KICAgICAgLSBDaGVjayBm b3Igc2VsaW51eD0xIHdpdGhpbiBncnViPGJyPgogICAgICAtIENoZWNrIGZvciBTRUxJTlVYPWVu Zm9yY2luZyB3aXRoaW4gL2V0Yy9zZWxpbnV4L2NvbmZpZzxicj4KICAgICAgPGJyPgogICAgICBU aGVzZSBjaGVja3MgZG8gbm90IHJlZmxlY3QgKnJ1bnRpbWUqIGVuYWJsZW1lbnQgb2YgU0VMaW51 eCwgYnV0CiAgICAgIHVuZm9ydHVuYXRlbHkgbmVpdGhlciBkb2VzIC9wcm9jL21vdW50czo8YnI+ CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPltzaGF3bkBTU0ctUkhFTDYgY2hlY2tzXSQg Z2V0ZW5mb3JjZSA8YnI+CiAgICAgICAgRW5mb3JjaW5nPGJyPgogICAgICAgIDxicj4KICAgICAg ICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIGNhdCAvcHJvYy9tb3VudHMgfCBncmVwIHNlbGlu dXg8YnI+CiAgICAgICAgbm9uZSAvc2VsaW51eCBzZWxpbnV4ZnMgcncscmVsYXRpbWUgMCAwPGJy PgogICAgICAgIDxicj4KICAgICAgICBbc2hhd25AU1NHLVJIRUw2IGNoZWNrc10kIHN1ZG8gc2V0 ZW5mb3JjZSAwPGJyPgogICAgICAgIFtzdWRvXSBwYXNzd29yZCBmb3Igc2hhd246IDxicj4KICAg ICAgICA8YnI+CiAgICAgICAgW3NoYXduQFNTRy1SSEVMNiBjaGVja3NdJCBjYXQgL3Byb2MvbW91 bnRzIHwgZ3JlcCBzZWxpbnV4PGJyPgogICAgICAgIG5vbmUgL3NlbGludXggc2VsaW51eGZzIHJ3 LHJlbGF0aW1lIDAgMDwvYmxvY2txdW90ZT4KICAgICAgSXMgdGhlcmUgYW5vdGhlciBjcmFmdHkg d2F5IHRvIHZlcmlmeSB0aGF0IHNlbGludXggaXMgKmVuZm9yY2luZyo/CiAgICAgIFBlcmhhcHMg Y2hlY2tpbmcgdGhlIHZhbHVlIGluIC9ldGMvc2VsaW51eCBpbnN0ZWFkPzxicj4KICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3NoYXduQFNTRy1SSEVMNiBzZWxmXSQgY2F0CiAgICAgICAg L3NlbGludXgvZW5mb3JjZSA8YnI+CiAgICAgICAgMTxicj4KICAgICAgICBbc2hhd25AU1NHLVJI RUw2IHNlbGZdJCBzdWRvIHNldGVuZm9yY2UgMDxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3No YXduQFNTRy1SSEVMNiBzZWxmXSQgY2F0IC9zZWxpbnV4L2VuZm9yY2UgPGJyPgogICAgICAgIDA8 L2Jsb2NrcXVvdGU+CiAgICAgIElmIHRoYXQncyBhIG5vbi1yZXB1dGFibGUgc291cmNlIG9mIFNF TGludXggZW5hYmxlbWVudCwgd2Ugc2hvdWxkCiAgICAgIGFkZCBhbiBhcHByb3ByaWF0ZSBYQ0NE RiBhbmQgT1ZBTCBydWxlIHRvIEZlZG9yYSAmYW1wOyBSSEVMCiAgICAgIHN0cmVhbXMuPGJyPgog ICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwv ZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPHByZSB3cmFwPSIiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGlu ZyBsaXN0CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpz Y2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHkt Z3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPGEgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlz dGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZSI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3Jn L21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT4KPC9wcmU+CiAgICA8L2Js b2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8cHJlIGNsYXNzPSJtb3otc2lnbmF0dXJl IiBjb2xzPSI3MiI+LS0gCkZyYW5rIENhdmlnZ2lhCkNvbnN1bHRhbnQsIFB1YmxpYyBTZWN0b3IK PGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZjYXZpZ2dp QHJlZGhhdC5jb20iPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSAoNTcxKSAyOTUtNDU2MDwv cHJlPgogIDwvYm9keT4KPC9odG1sPgo= --===============1092580308911969988==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============2461706503076489372==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 21:26:10 -0400 Message-ID: In-Reply-To: 524F81F4.8060501@redhat.com --===============2461706503076489372== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ok, so how do we make it happen? Trevor On Fri, Oct 4, 2013 at 11:05 PM, Shawn Wells wrote: > On 10/4/13 8:06 AM, Josh Kayse wrote: > >> On 10/04/2013 07:40 AM, Trevor Vaughan wrote: >> >>> Is Augeas an option? >>> >>> This seems like the perfect opportunity to solidify the Augeas lenses >>> regarding security settings while making life easier for everyone. >>> >>> Trevor >>> >>> >>> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells >> > wrote: >>> >>> On 10/3/13 3:11 PM, fcaviggi(a)redhat.com >>> wrote: >>> >>>> All, >>>> >>>> As a starting point for writing remediation fixes in the SSG - so, >>>> I did the following: >>>> >>>> $ ls ~//scap-security-guide/RHEL6/**input/checks//*.xml | awk >>>> '{ >>>> print $1 }' | sed s/\.[^\.]*$// > ~/checks >>>> $ ls ~//scap-security-guide/RHEL6/**input/fixes//*.sh | awk '{ >>>> print $1 }' | sed s/\.[^\.]*$// > ~/fixes >>>> $ sdiff ~/fixes ~/checks | less >>>> >>>> There's fair a bit of work to be done for the fix remediations... >>>> >>>> Since I'm new to the project, I was wondering if there was any >>>> ideas or standards to how the SSG should distribute some of these >>>> fixes - for example - a wholesale replacement of the audit.rules >>>> and auditd.conf might be preferable than doing piecemeal sed's. >>>> >>> >>> It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.**rules >>> /etc/audit.rules`, and that likely is the right choice during an >>> initial provisioning process. But then SysAdmins tailor audit rules, >>> the system evolves, and we need to evaluate the audit.rules file >>> against specific auditing guidance items after the pristine >>> audit.rules template is manipulated. >>> >>> So, if a single rule must be remediated, we can't blow away the >>> whole audit.rules file. Super fun sed scripts it is =3D/ >>> >>> >>> >> >> I think that augeas is a good idea. We need to be careful that rules >> that are inserted in to audit.rules happen before any '-e 2' line (if one >> exists). Otherwise they will fail to be inserted because the audit rules >> become locked. >> >> -josh >> > > Augeas and puppet would be great, their downside is they don't ship > natively with RHEL :( Part of the goal is to enable the remediation with > native tooling first. IMO, Augeas scripts would be *fantastic* for Aquedu= ct! > > ______________________________**_________________ > scap-security-guide mailing list > scap-security-guide(a)lists.**fedorahosted.org > https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============2461706503076489372== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+T2ssIHNvIGhvdyBkbyB3ZSBtYWtlIGl0IGhhcHBlbj88ZGl2Pjxicj48 L2Rpdj48ZGl2PlRyZXZvcjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+ PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBGcmksIE9jdCA0LCAyMDEzIGF0IDExOjA1 IFBNLCBTaGF3biBXZWxscyA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpzaGF3 bkByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwvYT4mZ3Q7PC9z cGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h cmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDox ZXgiPjxkaXYgY2xhc3M9IkhPRW5aYiI+PGRpdiBjbGFzcz0iaDUiPk9uIDEwLzQvMTMgODowNiBB TSwgSm9zaCBLYXlzZSB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRp bmctbGVmdDoxZXgiPgpPbiAxMC8wNC8yMDEzIDA3OjQwIEFNLCBUcmV2b3IgVmF1Z2hhbiB3cm90 ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAg MCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgpJcyBB dWdlYXMgYW4gb3B0aW9uPzxicj4KPGJyPgpUaGlzIHNlZW1zIGxpa2UgdGhlIHBlcmZlY3Qgb3Bw b3J0dW5pdHkgdG8gc29saWRpZnkgdGhlIEF1Z2VhcyBsZW5zZXM8YnI+CnJlZ2FyZGluZyBzZWN1 cml0eSBzZXR0aW5ncyB3aGlsZSBtYWtpbmcgbGlmZSBlYXNpZXIgZm9yIGV2ZXJ5b25lLjxicj4K PGJyPgpUcmV2b3I8YnI+Cjxicj4KPGJyPgpPbiBUaHUsIE9jdCAzLCAyMDEzIGF0IDk6NDIgUE0s IFNoYXduIFdlbGxzICZsdDs8YSBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPnNoYXduQHJlZGhhdC5jb208L2E+PGJyPgombHQ7bWFpbHRvOjxhIGhyZWY9Im1h aWx0bzpzaGF3bkByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwv YT4mZ3Q7Jmd0OyB3cm90ZTo8YnI+Cjxicj4KoCCgIE9uIDEwLzMvMTMgMzoxMSBQTSwgPGEgaHJl Zj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUBy ZWRoYXQuY29tPC9hPiAmbHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQu Y29tIiB0YXJnZXQ9Il9ibGFuayI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4mZ3Q7PGJyPgqgIKAg d3JvdGU6PGJyPgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46 MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4K oCCgIEFsbCw8YnI+Cjxicj4KoCCgIEFzIGEgc3RhcnRpbmcgcG9pbnQgZm9yIHdyaXRpbmcgcmVt ZWRpYXRpb24gZml4ZXMgaW4gdGhlIFNTRyAtIHNvLDxicj4KoCCgIEkgZGlkIHRoZSBmb2xsb3dp bmc6PGJyPgo8YnI+CqAgoCCgIKAgJCBscyB+Ly9zY2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2Lzx1 PjwvdT5pbnB1dC9jaGVja3MvLyoueG1sIHwgYXdrICYjMzk7ezxicj4KoCCgIHByaW50ICQxIH0m IzM5OyB8IHNlZCBzL1wuW15cLl0qJC8vICZndDsgfi9jaGVja3M8YnI+CqAgoCCgIKAgJCBscyB+ Ly9zY2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2Lzx1PjwvdT5pbnB1dC9maXhlcy8vKi5zaCB8IGF3 ayAmIzM5O3s8YnI+CqAgoCBwcmludCAkMSB9JiMzOTsgfCBzZWQgcy9cLlteXC5dKiQvLyAmZ3Q7 IH4vZml4ZXM8YnI+CqAgoCCgIKAgJCBzZGlmZiB+L2ZpeGVzIH4vY2hlY2tzIHwgbGVzczxicj4K PGJyPgqgIKAgVGhlcmUmIzM5O3MgZmFpciBhIGJpdCBvZiB3b3JrIHRvIGJlIGRvbmUgZm9yIHRo ZSBmaXggcmVtZWRpYXRpb25zLi4uPGJyPgo8YnI+CqAgoCBTaW5jZSBJJiMzOTttIG5ldyB0byB0 aGUgcHJvamVjdCwgSSB3YXMgd29uZGVyaW5nIGlmIHRoZXJlIHdhcyBhbnk8YnI+CqAgoCBpZGVh cyBvciBzdGFuZGFyZHMgdG8gaG93IHRoZSBTU0cgc2hvdWxkIGRpc3RyaWJ1dGUgc29tZSBvZiB0 aGVzZTxicj4KoCCgIGZpeGVzIC0gZm9yIGV4YW1wbGUgLSBhIHdob2xlc2FsZSByZXBsYWNlbWVu dCBvZiB0aGUgYXVkaXQucnVsZXM8YnI+CqAgoCBhbmQgYXVkaXRkLmNvbmYgbWlnaHQgYmUgcHJl ZmVyYWJsZSB0aGFuIGRvaW5nIHBpZWNlbWVhbCBzZWQmIzM5O3MuPGJyPgo8L2Jsb2NrcXVvdGU+ Cjxicj4KoCCgIEl0JiMzOTtkIGJlIG9tZ3ogZWFzaWVyIHRvIGBjcCAvdXNyL3NoYXJlL2RvYy9h dWRpdC0qL3N0aWcuPHU+PC91PnJ1bGVzPGJyPgqgIKAgL2V0Yy9hdWRpdC5ydWxlc2AsIGFuZCB0 aGF0IGxpa2VseSBpcyB0aGUgcmlnaHQgY2hvaWNlIGR1cmluZyBhbjxicj4KoCCgIGluaXRpYWwg cHJvdmlzaW9uaW5nIHByb2Nlc3MuIEJ1dCB0aGVuIFN5c0FkbWlucyB0YWlsb3IgYXVkaXQgcnVs ZXMsPGJyPgqgIKAgdGhlIHN5c3RlbSBldm9sdmVzLCBhbmQgd2UgbmVlZCB0byBldmFsdWF0ZSB0 aGUgYXVkaXQucnVsZXMgZmlsZTxicj4KoCCgIGFnYWluc3Qgc3BlY2lmaWMgYXVkaXRpbmcgZ3Vp ZGFuY2UgaXRlbXMgYWZ0ZXIgdGhlIHByaXN0aW5lPGJyPgqgIKAgYXVkaXQucnVsZXMgdGVtcGxh dGUgaXMgbWFuaXB1bGF0ZWQuPGJyPgo8YnI+CqAgoCBTbywgaWYgYSBzaW5nbGUgcnVsZSBtdXN0 IGJlIHJlbWVkaWF0ZWQsIHdlIGNhbiYjMzk7dCBibG93IGF3YXkgdGhlPGJyPgqgIKAgd2hvbGUg YXVkaXQucnVsZXMgZmlsZS4gU3VwZXIgZnVuIHNlZCBzY3JpcHRzIGl0IGlzID0vPGJyPgo8YnI+ CiZsdDtzbmlwJmd0Ozxicj4KPC9ibG9ja3F1b3RlPgo8YnI+CkkgdGhpbmsgdGhhdCBhdWdlYXMg aXMgYSBnb29kIGlkZWEuIKBXZSBuZWVkIHRvIGJlIGNhcmVmdWwgdGhhdCBydWxlcyB0aGF0IGFy ZSBpbnNlcnRlZCBpbiB0byBhdWRpdC5ydWxlcyBoYXBwZW4gYmVmb3JlIGFueSAmIzM5Oy1lIDIm IzM5OyBsaW5lIChpZiBvbmUgZXhpc3RzKS4goE90aGVyd2lzZSB0aGV5IHdpbGwgZmFpbCB0byBi ZSBpbnNlcnRlZCBiZWNhdXNlIHRoZSBhdWRpdCBydWxlcyBiZWNvbWUgbG9ja2VkLjxicj4KCjxi cj4KLWpvc2ggPGJyPgo8L2Jsb2NrcXVvdGU+Cjxicj48L2Rpdj48L2Rpdj4KQXVnZWFzIGFuZCBw dXBwZXQgd291bGQgYmUgZ3JlYXQsIHRoZWlyIGRvd25zaWRlIGlzIHRoZXkgZG9uJiMzOTt0IHNo aXAgbmF0aXZlbHkgd2l0aCBSSEVMIDooIFBhcnQgb2YgdGhlIGdvYWwgaXMgdG8gZW5hYmxlIHRo ZSByZW1lZGlhdGlvbiB3aXRoIG5hdGl2ZSB0b29saW5nIGZpcnN0LiBJTU8sIEF1Z2VhcyBzY3Jp cHRzIHdvdWxkIGJlICpmYW50YXN0aWMqIGZvciBBcXVlZHVjdCE8ZGl2IGNsYXNzPSJIT0VuWmIi Pgo8ZGl2IGNsYXNzPSJoNSI+PGJyPgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX188dT48 L3U+X19fX19fX19fX19fX19fX188YnI+CnNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGluZyBsaXN0 PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0 ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy48dT48L3U+ ZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9z dGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC48dT48L3U+b3JnL21haWxtYW4vbGlzdGlu Zm8vc2NhcC08dT48L3U+c2VjdXJpdHktZ3VpZGU8L2E+PGJyPgo8L2Rpdj48L2Rpdj48L2Jsb2Nr cXVvdGU+PC9kaXY+PGJyPjxiciBjbGVhcj0iYWxsIj48ZGl2Pjxicj48L2Rpdj4tLSA8YnI+VHJl dm9yIFZhdWdoYW48YnI+VmljZSBQcmVzaWRlbnQsIE9ueXggUG9pbnQsIEluYzxicj4oNDEwKSA1 NDEtNjY5OTxicj48YSBocmVmPSJtYWlsdG86dHZhdWdoYW5Ab255eHBvaW50LmNvbSI+dHZhdWdo YW5Ab255eHBvaW50LmNvbTwvYT48YnI+PGJyPi0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQg Zm9yIHVuZW5jcnlwdGVkIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIC0tCjwvZGl2Pgo= --===============2461706503076489372==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============7967917846087226492==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 21:24:31 -0400 Message-ID: In-Reply-To: 20131005065708.3992e2dd@dufus --===============7967917846087226492== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable +1 EVERYONE wants to modify at least one rule. It needs to be easy to do so and run your own checks else people will just start writing other tools. Trevor On Sat, Oct 5, 2013 at 7:57 AM, Brian Millett wrote: > On Fri, 04 Oct 2013 08:50:23 -0400 > fcaviggi(a)redhat.com wrote: > > > I was thinking this trough last night - I was wondering if we can use > > checksums (sha256+) to determine if someone is using the "stock" > > configuration and replace it with a fully STIGed version - I'm thinking > this > > would be best applicable to new installations of RHEL. I understand the > need > > for atomic fixes for pre-existing systems, where the SA has modified t= he > > defaults, but I can guarantee you that most people just want a STIG'ed > box > > out of the gate on install. I'm just trying to think in terms of long > term > > and short term goals - the quicker we can satisfy the majority of the > users > > (the ones that want something STIG'ed out of the box) the better > acceptance > > the product will have, the long term should be to modify things for the > > people that mucked with their configurations, which I'm arguing is a > > minority. > > Well, not really. I've set up ssg for several clients and not a single o= ne > wants to use it as is, they have all different requirements. Some need a > different banner, some different password parameters, some different ssh, > etc. All I'm saying is my experience is that most want to modify. > > -- > Brian Millett > "The guerrillas, whose ancestors migrated to Mars from Earth over the past > hundred years, have demanded independence for the Mars Colony or, and I > quote, 'The sand will run red with Earther blood.'" > -- [ Derek Mobotabwe, ISN News, "A Voice in the Wilderness I"] > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============7967917846087226492== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+KzE8ZGl2Pjxicj48L2Rpdj48ZGl2PkVWRVJZT05FIHdhbnRzIHRvIG1v ZGlmeSBhdCBsZWFzdCBvbmUgcnVsZS4gSXQgbmVlZHMgdG8gYmUgZWFzeSB0byBkbyBzbyBhbmQg cnVuIHlvdXIgb3duIGNoZWNrcyBlbHNlIHBlb3BsZSB3aWxsIGp1c3Qgc3RhcnQgd3JpdGluZyBv dGhlciB0b29scy48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRyZXZvcjwvZGl2PjwvZGl2Pgo8 ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+ T24gU2F0LCBPY3QgNSwgMjAxMyBhdCA3OjU3IEFNLCBCcmlhbiBNaWxsZXR0IDxzcGFuIGRpcj0i bHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOmJtaWxsZXR0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxh bmsiPmJtaWxsZXR0QGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxl ZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CjxkaXYgY2xhc3M9ImltIj5PbiBG cmksIDA0IE9jdCAyMDEzIDA4OjUwOjIzIC0wNDAwPGJyPgo8YSBocmVmPSJtYWlsdG86ZmNhdmln Z2lAcmVkaGF0LmNvbSI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4gd3JvdGU6PGJyPgo8YnI+CiZn dDsgSSB3YXMgdGhpbmtpbmcgdGhpcyB0cm91Z2ggbGFzdCBuaWdodCAtIEkgd2FzIHdvbmRlcmlu ZyBpZiB3ZSBjYW4gdXNlPGJyPgomZ3Q7IGNoZWNrc3VtcyAoc2hhMjU2KykgdG8gZGV0ZXJtaW5l IGlmIHNvbWVvbmUgaXMgdXNpbmcgdGhlICZxdW90O3N0b2NrJnF1b3Q7PGJyPgomZ3Q7IGNvbmZp Z3VyYXRpb24gYW5kIHJlcGxhY2UgaXQgd2l0aCBhIGZ1bGx5IFNUSUdlZCB2ZXJzaW9uIC0gSSYj Mzk7bSB0aGlua2luZyB0aGlzPGJyPgomZ3Q7IHdvdWxkIGJlIGJlc3QgYXBwbGljYWJsZSB0byBu ZXcgaW5zdGFsbGF0aW9ucyBvZiBSSEVMLiBJIHVuZGVyc3RhbmQgdGhlIG5lZWQ8YnI+CiZndDsg Zm9yoCBhdG9taWMgZml4ZXMgZm9yIHByZS1leGlzdGluZyBzeXN0ZW1zLCB3aGVyZSB0aGUgU0Eg aGFzIG1vZGlmaWVkIHRoZTxicj4KJmd0OyBkZWZhdWx0cywgYnV0IEkgY2FuIGd1YXJhbnRlZSB5 b3UgdGhhdCBtb3N0IHBlb3BsZSBqdXN0IHdhbnQgYSBTVElHJiMzOTtlZCBib3g8YnI+CiZndDsg b3V0IG9mIHRoZSBnYXRlIG9uIGluc3RhbGwuIEkmIzM5O20ganVzdCB0cnlpbmcgdG8gdGhpbmsg aW4gdGVybXMgb2YgbG9uZyB0ZXJtPGJyPgomZ3Q7IGFuZCBzaG9ydCB0ZXJtIGdvYWxzIC0gdGhl IHF1aWNrZXIgd2UgY2FuIHNhdGlzZnkgdGhlIG1ham9yaXR5IG9mIHRoZSB1c2Vyczxicj4KJmd0 OyAodGhlIG9uZXMgdGhhdCB3YW50IHNvbWV0aGluZyBTVElHJiMzOTtlZCBvdXQgb2YgdGhlIGJv eCkgdGhlIGJldHRlciBhY2NlcHRhbmNlPGJyPgomZ3Q7IHRoZSBwcm9kdWN0IHdpbGwgaGF2ZSwg dGhlIGxvbmcgdGVybSBzaG91bGQgYmUgdG8gbW9kaWZ5IHRoaW5ncyBmb3IgdGhlPGJyPgomZ3Q7 IHBlb3BsZSB0aGF0IG11Y2tlZCB3aXRoIHRoZWlyIGNvbmZpZ3VyYXRpb25zLCB3aGljaCBJJiMz OTttIGFyZ3VpbmcgaXMgYTxicj4KJmd0OyBtaW5vcml0eS48YnI+Cjxicj4KPC9kaXY+V2VsbCwg bm90IHJlYWxseS4goEkmIzM5O3ZlIHNldCB1cCBzc2cgZm9yIHNldmVyYWwgY2xpZW50cyBhbmQg bm90IGEgc2luZ2xlIG9uZTxicj4Kd2FudHMgdG8gdXNlIGl0IGFzIGlzLCB0aGV5IGhhdmUgYWxs IGRpZmZlcmVudCByZXF1aXJlbWVudHMuIKBTb21lIG5lZWQgYTxicj4KZGlmZmVyZW50IGJhbm5l ciwgc29tZSBkaWZmZXJlbnQgcGFzc3dvcmQgcGFyYW1ldGVycywgc29tZSBkaWZmZXJlbnQgc3No LDxicj4KZXRjLiCgQWxsIEkmIzM5O20gc2F5aW5nIGlzIG15IGV4cGVyaWVuY2UgaXMgdGhhdCBt b3N0IHdhbnQgdG8gbW9kaWZ5Ljxicj4KPHNwYW4gY2xhc3M9IkhPRW5aYiI+PGZvbnQgY29sb3I9 IiM4ODg4ODgiPjxicj4KLS08YnI+CkJyaWFuIE1pbGxldHQ8YnI+CiZxdW90O1RoZSBndWVycmls bGFzLCB3aG9zZSBhbmNlc3RvcnMgbWlncmF0ZWQgdG8gTWFycyBmcm9tIEVhcnRoIG92ZXIgdGhl IHBhc3Q8YnI+CqBodW5kcmVkIHllYXJzLCBoYXZlIGRlbWFuZGVkIGluZGVwZW5kZW5jZSBmb3Ig dGhlIE1hcnMgQ29sb255IG9yLCBhbmQgSTxicj4KoHF1b3RlLCAmIzM5O1RoZSBzYW5kIHdpbGwg cnVuIHJlZCB3aXRoIEVhcnRoZXIgYmxvb2QuJiMzOTsmcXVvdDs8YnI+CqAgoC0tIFsgRGVyZWsg TW9ib3RhYndlLCBJU04gTmV3cywgJnF1b3Q7QSBWb2ljZSBpbiB0aGUgV2lsZGVybmVzcyBJJnF1 b3Q7XTxicj4KPC9mb250Pjwvc3Bhbj48ZGl2IGNsYXNzPSJIT0VuWmIiPjxkaXYgY2xhc3M9Img1 Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4Kc2Nh cC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNl Y3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVk b3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5m by9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwv ZGl2Pjxicj48YnIgY2xlYXI9ImFsbCI+PGRpdj48YnI+PC9kaXY+LS0gPGJyPlRyZXZvciBWYXVn aGFuPGJyPlZpY2UgUHJlc2lkZW50LCBPbnl4IFBvaW50LCBJbmM8YnI+KDQxMCkgNTQxLTY2OTk8 YnI+PGEgaHJlZj0ibWFpbHRvOnR2YXVnaGFuQG9ueXhwb2ludC5jb20iPnR2YXVnaGFuQG9ueXhw b2ludC5jb208L2E+PGJyPjxicj4tLSBUaGlzIGFjY291bnQgbm90IGFwcHJvdmVkIGZvciB1bmVu Y3J5cHRlZCBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbiAtLQo8L2Rpdj4K --===============7967917846087226492==-- From kseifried at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============6618167708595525924==" MIME-Version: 1.0 From: Kurt Seifried To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 21:08:49 -0600 Message-ID: <5250D441.8030008@redhat.com> In-Reply-To: CANs+FoU0QWCi5Z-e97Ojth8Gc-oSWNX4UHTL9408jem49BLErQ@mail.gmail.com --===============6618167708595525924== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/05/2013 07:26 PM, Trevor Vaughan wrote: > Ok, so how do we make it happen? > = > Trevor Also addition of rules, I have like 10-20 product specific rules I'd like to add (and release publicly), it;s on my todo list for a few months now, haven't had time to do it since there is no quick/easy way to do it =3D(.Being able to take an existing rule and modify it would handle about half of what I want, so yeah, +1 =3D). - -- = Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSUNRBAAoJEBYNRVNeJnmTP6MP/3avFc9dpkpPWMLR0xdiSAtD ujMlBoggV9bC7CP/LyeYne7iHpYKO/dTOBeOEbWrjUmqU/m2hvjixG6cTVz5xVU8 htbCeazRsSSVIhnMajmI8hKR0SE/rBfizYshX6DYxRgx9v3ow3tw/yxmJocLWO5v uPLuFHPYVF2JjX+4Bb1Ej5S4TSjmdUhsDHRa0cJ2r3I9F8GdhRsxO0fYo0SQMW2b eXAPvc2jwSGWKLoFfGCNq1EYxVdkOSsuBOH3dlyiEGcXDWpAppg8NNshd/9Q0+jv FAXgUubLi41vXZAxSo3xzCbz9NUrs1tNwMLj2MSmOLC8bhycrirOLyDGFnQFDEaB jEhCgto08xa5M19QwjyodCt4kwy3qr56lpflmB19BgAePvHCI39DQsZBiOzcXnZg JCTWRNRJzjVXQdR+xMZgIkgJQkGJtNgULHiq+96W+pO/1pfSRujH1gHDKyudo1Jh raNeb+ZCahgdZqtqSEFqYm4JkopWsQyIoWLSZOuIPXsO5Y6P2qm75tx/VGspF1rB DEqjaH2BdBDnG+XnfoHo/D6VGJbOMbcgGNT+r+CDam9gkHImrJPIFp/+4GNmp1je K5vp6hp2BSsrccRKz7DnBjdHrmHHypzJ+/8KORyr0CbnHyX+2eZJGdtOT+VhLvkI cxEiyptTu1wDUP4DgrVB =3Dkmr6 -----END PGP SIGNATURE----- --===============6618167708595525924==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============6554145566241386570==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 21:27:04 -0400 Message-ID: In-Reply-To: 524EAF53.2030507@gtri.gatech.edu --===============6554145566241386570== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Personally, I'm massively opposed to '-e 2'. I really like the ability to audit new things as I add them without rebooting my systems. Trevor On Fri, Oct 4, 2013 at 8:06 AM, Josh Kayse = wrote: > On 10/04/2013 07:40 AM, Trevor Vaughan wrote: > >> Is Augeas an option? >> >> This seems like the perfect opportunity to solidify the Augeas lenses >> regarding security settings while making life easier for everyone. >> >> Trevor >> >> >> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells > > wrote: >> >> On 10/3/13 3:11 PM, fcaviggi(a)redhat.com >> wrote: >> >>> All, >>> >>> As a starting point for writing remediation fixes in the SSG - so, >>> I did the following: >>> >>> $ ls ~//scap-security-guide/RHEL6/**input/checks//*.xml | awk '{ >>> >>> print $1 }' | sed s/\.[^\.]*$// > ~/checks >>> $ ls ~//scap-security-guide/RHEL6/**input/fixes//*.sh | awk '{ >>> >>> print $1 }' | sed s/\.[^\.]*$// > ~/fixes >>> $ sdiff ~/fixes ~/checks | less >>> >>> There's fair a bit of work to be done for the fix remediations... >>> >>> Since I'm new to the project, I was wondering if there was any >>> ideas or standards to how the SSG should distribute some of these >>> fixes - for example - a wholesale replacement of the audit.rules >>> and auditd.conf might be preferable than doing piecemeal sed's. >>> >> >> It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.**rules >> /etc/audit.rules`, and that likely is the right choice during an >> initial provisioning process. But then SysAdmins tailor audit rules, >> the system evolves, and we need to evaluate the audit.rules file >> against specific auditing guidance items after the pristine >> audit.rules template is manipulated. >> >> So, if a single rule must be remediated, we can't blow away the >> whole audit.rules file. Super fun sed scripts it is =3D/ >> >> >> > > I think that augeas is a good idea. We need to be careful that rules that > are inserted in to audit.rules happen before any '-e 2' line (if one > exists). Otherwise they will fail to be inserted because the audit rules > become locked. > > -josh > > -- > 404.407.6630 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============6554145566241386570== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+UGVyc29uYWxseSwgSSYjMzk7bSBtYXNzaXZlbHkgb3Bwb3NlZCB0byAm IzM5Oy1lIDImIzM5Oy48ZGl2Pjxicj48L2Rpdj48ZGl2PkkgcmVhbGx5IGxpa2UgdGhlIGFiaWxp dHkgdG8gYXVkaXQgbmV3IHRoaW5ncyBhcyBJIGFkZCB0aGVtIHdpdGhvdXQgcmVib290aW5nIG15 IHN5c3RlbXMuPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UcmV2b3I8L2Rpdj48L2Rpdj4KPGRp diBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9u IEZyaSwgT2N0IDQsIDIwMTMgYXQgODowNiBBTSwgSm9zaCBLYXlzZSA8c3BhbiBkaXI9Imx0ciI+ Jmx0OzxhIGhyZWY9Im1haWx0bzpKb3NodWEuS2F5c2VAZ3RyaS5nYXRlY2guZWR1IiB0YXJnZXQ9 Il9ibGFuayI+Sm9zaHVhLktheXNlQGd0cmkuZ2F0ZWNoLmVkdTwvYT4mZ3Q7PC9zcGFuPiB3cm90 ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAg MCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYg Y2xhc3M9ImltIj5PbiAxMC8wNC8yMDEzIDA3OjQwIEFNLCBUcmV2b3IgVmF1Z2hhbiB3cm90ZTo8 YnI+CjwvZGl2PjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjow IDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxk aXYgY2xhc3M9ImltIj4KSXMgQXVnZWFzIGFuIG9wdGlvbj88YnI+Cjxicj4KVGhpcyBzZWVtcyBs aWtlIHRoZSBwZXJmZWN0IG9wcG9ydHVuaXR5IHRvIHNvbGlkaWZ5IHRoZSBBdWdlYXMgbGVuc2Vz PGJyPgpyZWdhcmRpbmcgc2VjdXJpdHkgc2V0dGluZ3Mgd2hpbGUgbWFraW5nIGxpZmUgZWFzaWVy IGZvciBldmVyeW9uZS48YnI+Cjxicj4KVHJldm9yPGJyPgo8YnI+Cjxicj4KT24gVGh1LCBPY3Qg MywgMjAxMyBhdCA5OjQyIFBNLCBTaGF3biBXZWxscyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXdu QHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5zaGF3bkByZWRoYXQuY29tPC9hPjxicj48L2Rp dj4KJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnNoYXduQHJlZGhhdC5jb208L2E+Jmd0OyZndDsgd3JvdGU6PGJyPgo8YnI+CqAgoCBP biAxMC8zLzEzIDM6MTEgUE0sIDxhIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIiB0 YXJnZXQ9Il9ibGFuayI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4gJmx0O21haWx0bzo8YSBocmVm PSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmZjYXZpZ2dpQHJl ZGhhdC5jb208L2E+Jmd0Ozxicj4KoCCgIHdyb3RlOjxicj4KPGJsb2NrcXVvdGUgY2xhc3M9Imdt YWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mg c29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBjbGFzcz0iaW0iPgqgIKAgQWxsLDxicj4KPGJy PgqgIKAgQXMgYSBzdGFydGluZyBwb2ludCBmb3Igd3JpdGluZyByZW1lZGlhdGlvbiBmaXhlcyBp biB0aGUgU1NHIC0gc28sPGJyPgqgIKAgSSBkaWQgdGhlIGZvbGxvd2luZzo8YnI+Cjxicj48L2Rp dj4KoCCgIKAgoCAkIGxzIH4vL3NjYXAtc2VjdXJpdHktZ3VpZGUvUkhFTDYvPHU+PC91PmlucHV0 L2NoZWNrcy8vKi54bWwgfCBhd2sgJiMzOTt7PGRpdiBjbGFzcz0iaW0iPjxicj4KoCCgIHByaW50 ICQxIH0mIzM5OyB8IHNlZCBzL1wuW15cLl0qJC8vICZndDsgfi9jaGVja3M8YnI+PC9kaXY+CqAg oCCgIKAgJCBscyB+Ly9zY2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2Lzx1PjwvdT5pbnB1dC9maXhl cy8vKi5zaCB8IGF3ayAmIzM5O3s8ZGl2IGNsYXNzPSJpbSI+PGJyPgqgIKAgcHJpbnQgJDEgfSYj Mzk7IHwgc2VkIHMvXC5bXlwuXSokLy8gJmd0OyB+L2ZpeGVzPGJyPgqgIKAgoCCgICQgc2RpZmYg fi9maXhlcyB+L2NoZWNrcyB8IGxlc3M8YnI+Cjxicj4KoCCgIFRoZXJlJiMzOTtzIGZhaXIgYSBi aXQgb2Ygd29yayB0byBiZSBkb25lIGZvciB0aGUgZml4IHJlbWVkaWF0aW9ucy4uLjxicj4KPGJy PgqgIKAgU2luY2UgSSYjMzk7bSBuZXcgdG8gdGhlIHByb2plY3QsIEkgd2FzIHdvbmRlcmluZyBp ZiB0aGVyZSB3YXMgYW55PGJyPgqgIKAgaWRlYXMgb3Igc3RhbmRhcmRzIHRvIGhvdyB0aGUgU1NH IHNob3VsZCBkaXN0cmlidXRlIHNvbWUgb2YgdGhlc2U8YnI+CqAgoCBmaXhlcyAtIGZvciBleGFt cGxlIC0gYSB3aG9sZXNhbGUgcmVwbGFjZW1lbnQgb2YgdGhlIGF1ZGl0LnJ1bGVzPGJyPgqgIKAg YW5kIGF1ZGl0ZC5jb25mIG1pZ2h0IGJlIHByZWZlcmFibGUgdGhhbiBkb2luZyBwaWVjZW1lYWwg c2VkJiMzOTtzLjxicj4KPC9kaXY+PC9ibG9ja3F1b3RlPjxkaXYgY2xhc3M9ImltIj4KPGJyPgqg IKAgSXQmIzM5O2QgYmUgb21neiBlYXNpZXIgdG8gYGNwIC91c3Ivc2hhcmUvZG9jL2F1ZGl0LSov c3RpZy48dT48L3U+cnVsZXM8YnI+CqAgoCAvZXRjL2F1ZGl0LnJ1bGVzYCwgYW5kIHRoYXQgbGlr ZWx5IGlzIHRoZSByaWdodCBjaG9pY2UgZHVyaW5nIGFuPGJyPgqgIKAgaW5pdGlhbCBwcm92aXNp b25pbmcgcHJvY2Vzcy4gQnV0IHRoZW4gU3lzQWRtaW5zIHRhaWxvciBhdWRpdCBydWxlcyw8YnI+ CqAgoCB0aGUgc3lzdGVtIGV2b2x2ZXMsIGFuZCB3ZSBuZWVkIHRvIGV2YWx1YXRlIHRoZSBhdWRp dC5ydWxlcyBmaWxlPGJyPgqgIKAgYWdhaW5zdCBzcGVjaWZpYyBhdWRpdGluZyBndWlkYW5jZSBp dGVtcyBhZnRlciB0aGUgcHJpc3RpbmU8YnI+CqAgoCBhdWRpdC5ydWxlcyB0ZW1wbGF0ZSBpcyBt YW5pcHVsYXRlZC48YnI+Cjxicj4KoCCgIFNvLCBpZiBhIHNpbmdsZSBydWxlIG11c3QgYmUgcmVt ZWRpYXRlZCwgd2UgY2FuJiMzOTt0IGJsb3cgYXdheSB0aGU8YnI+CqAgoCB3aG9sZSBhdWRpdC5y dWxlcyBmaWxlLiBTdXBlciBmdW4gc2VkIHNjcmlwdHMgaXQgaXMgPS88YnI+Cjxicj48L2Rpdj4K Jmx0O3NuaXAmZ3Q7PGJyPgo8L2Jsb2NrcXVvdGU+Cjxicj4KSSB0aGluayB0aGF0IGF1Z2VhcyBp cyBhIGdvb2QgaWRlYS4goFdlIG5lZWQgdG8gYmUgY2FyZWZ1bCB0aGF0IHJ1bGVzIHRoYXQgYXJl IGluc2VydGVkIGluIHRvIGF1ZGl0LnJ1bGVzIGhhcHBlbiBiZWZvcmUgYW55ICYjMzk7LWUgMiYj Mzk7IGxpbmUgKGlmIG9uZSBleGlzdHMpLiCgT3RoZXJ3aXNlIHRoZXkgd2lsbCBmYWlsIHRvIGJl IGluc2VydGVkIGJlY2F1c2UgdGhlIGF1ZGl0IHJ1bGVzIGJlY29tZSBsb2NrZWQuPHNwYW4gY2xh c3M9IkhPRW5aYiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KCjxicj4KLWpvc2g8YnI+Cjxi cj4KLS0gPGJyPgo8YSBocmVmPSJ0ZWw6NDA0LjQwNy42NjMwIiB2YWx1ZT0iKzE0MDQ0MDc2NjMw IiB0YXJnZXQ9Il9ibGFuayI+NDA0LjQwNy42NjMwPC9hPjxicj4KPGJyPgo8L2ZvbnQ+PC9zcGFu Pjxicj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4K c2NhcC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2Fw LXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3Vp ZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0 aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPGJyPjwvYmxvY2txdW90ZT48L2Rpdj48 YnI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGJyPjwvZGl2Pi0tIDxicj5UcmV2b3IgVmF1Z2hhbjxi cj5WaWNlIFByZXNpZGVudCwgT255eCBQb2ludCwgSW5jPGJyPig0MTApIDU0MS02Njk5PGJyPjxh IGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIj50dmF1Z2hhbkBvbnl4cG9pbnQu Y29tPC9hPjxicj48YnI+LS0gVGhpcyBhY2NvdW50IG5vdCBhcHByb3ZlZCBmb3IgdW5lbmNyeXB0 ZWQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gLS0KPC9kaXY+Cg== --===============6554145566241386570==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============2337360225535129363==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Fun with limits.conf Date: Sat, 05 Oct 2013 21:35:04 -0400 Message-ID: In-Reply-To: 52499884.2050103@redhat.com --===============2337360225535129363== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable As a note, both: * - core 0 AND * hard core 0 * soft core 0 Should pass. Trevor On Mon, Sep 30, 2013 at 11:28 AM, wrote: > All, > > Most of the guidance for RHEL security has suggested setting the following > in /etc/security/limits.conf: > > * hard core 0 > > I have generally set this to: > > * - core 0 > > Because this sets both the hard and soft limits on the system. Most SCAP > scanners are looking for very specific values there. I'm looking at > modifying the checks to pass either 'hard' or '-' for the value. > > I'd also to fix the maxlogins in the rule (*max_concurrent_login_sessions= *) > in /etc/security/limits.conf to look for the DOD default (10) and lower to > satisfy the check. Security standards are there as a baseline, why 'fail' > the setting for exceeding the baseline value? > > Regards, > > Frank Caviggia > > -- > Frank Caviggia > Consultant, Public Sectorfcaviggi(a)redhat.com > (M) (571) 295-4560 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============2337360225535129363== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+QXMgYSBub3RlLCBib3RoOjxkaXY+PGJyPjwvZGl2PjxkaXY+KiCgLSCg Y29yZSCgMDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+QU5EPC9kaXY+PGRpdj48YnI+PC9kaXY+ PGRpdj4qIKBoYXJkIKBjb3JlIDA8L2Rpdj48ZGl2PiogoHNvZnQgoCBjb3JlIDA8L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2PlNob3VsZCBwYXNzLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ClRy ZXZvcjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGJyPjxkaXYgY2xh c3M9ImdtYWlsX3F1b3RlIj5PbiBNb24sIFNlcCAzMCwgMjAxMyBhdCAxMToyOCBBTSwgIDxzcGFu IGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5jb20iIHRhcmdl dD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj4K PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7 Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgCgogICAgCiAg CiAgPGRpdiBiZ2NvbG9yPSIjRkZGRkZGIiB0ZXh0PSIjMDAwMDAwIj4KICAgIEFsbCw8YnI+CiAg ICA8YnI+CiAgICBNb3N0IG9mIHRoZSBndWlkYW5jZSBmb3IgUkhFTCBzZWN1cml0eSBoYXMgc3Vn Z2VzdGVkIHNldHRpbmcgdGhlCiAgICBmb2xsb3dpbmcgaW4gL2V0Yy9zZWN1cml0eS9saW1pdHMu Y29uZjo8YnI+CiAgICA8YnI+CiAgICCgoKAgoKCgICqgoKAgaGFyZKCgoCBjb3JloKCgIDA8YnI+ CiAgICA8YnI+CiAgICBJIGhhdmUgZ2VuZXJhbGx5IHNldCB0aGlzIHRvOjxicj4KICAgIDxicj4K ICAgIKCgoCCgoKAgKqCgoCAtIKCgIGNvcmWgoKAgMDxicj4KICAgIDxicj4KICAgIEJlY2F1c2Ug dGhpcyBzZXRzIGJvdGggdGhlIGhhcmQgYW5kIHNvZnQgbGltaXRzIG9uIHRoZSBzeXN0ZW0uIE1v c3QKICAgIFNDQVAgc2Nhbm5lcnMgYXJlIGxvb2tpbmcgZm9yIHZlcnkgc3BlY2lmaWMgdmFsdWVz IHRoZXJlLqAgSSYjMzk7bQogICAgbG9va2luZyBhdCBtb2RpZnlpbmcgdGhlIGNoZWNrcyB0byBw YXNzIGVpdGhlciAmIzM5O2hhcmQmIzM5OyBvciAmIzM5Oy0mIzM5OyBmb3IgdGhlCiAgICB2YWx1 ZS48YnI+CiAgICA8YnI+CiAgICBJJiMzOTtkIGFsc28gdG8gZml4IHRoZSBtYXhsb2dpbnMgaW4g dGhlIHJ1bGUgKDxzdHJvbmc+bWF4X2NvbmN1cnJlbnRfbG9naW5fc2Vzc2lvbnM8L3N0cm9uZz4p CiAgICBpbiAvZXRjL3NlY3VyaXR5L2xpbWl0cy5jb25mIHRvIGxvb2sgZm9yIHRoZSBET0QgZGVm YXVsdCAoMTApIGFuZAogICAgbG93ZXIgdG8gc2F0aXNmeSB0aGUgY2hlY2suIFNlY3VyaXR5IHN0 YW5kYXJkcyBhcmUgdGhlcmUgYXMgYQogICAgYmFzZWxpbmUsIHdoeSAmIzM5O2ZhaWwmIzM5OyB0 aGUgc2V0dGluZyBmb3IgZXhjZWVkaW5nIHRoZSBiYXNlbGluZSB2YWx1ZT88YnI+CiAgICA8YnI+ CiAgICBSZWdhcmRzLDxicj4KICAgIDxicj4KICAgIEZyYW5rIENhdmlnZ2lhPHNwYW4gY2xhc3M9 IkhPRW5aYiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KICAgIDxicj4KICAgIDxwcmUgY29s cz0iNzIiPi0tIApGcmFuayBDYXZpZ2dpYQpDb25zdWx0YW50LCBQdWJsaWMgU2VjdG9yCjxhIGhy ZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZmNhdmlnZ2lA cmVkaGF0LmNvbTwvYT4KKE0pIDxhIGhyZWY9InRlbDolMjg1NzElMjklMjAyOTUtNDU2MCIgdmFs dWU9IisxNTcxMjk1NDU2MCIgdGFyZ2V0PSJfYmxhbmsiPig1NzEpIDI5NS00NTYwPC9hPjwvcHJl PgogIDwvZm9udD48L3NwYW4+PC9kaXY+Cgo8YnI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnI+CnNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGluZyBsaXN0 PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0 ZWQub3JnIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJy Pgo8YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5m by9zY2FwLXNlY3VyaXR5LWd1aWRlIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRv cmFob3N0ZWQub3JnL21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT48YnI+ Cjxicj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjxiciBjbGVhcj0iYWxsIj48ZGl2Pjxicj48L2Rp dj4tLSA8YnI+VHJldm9yIFZhdWdoYW48YnI+VmljZSBQcmVzaWRlbnQsIE9ueXggUG9pbnQsIElu Yzxicj4oNDEwKSA1NDEtNjY5OTxicj48YSBocmVmPSJtYWlsdG86dHZhdWdoYW5Ab255eHBvaW50 LmNvbSI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+PGJyPi0tIFRoaXMgYWNjb3VudCBu b3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIC0tCjwv ZGl2Pgo= --===============2337360225535129363==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============6945776415445036190==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Fun with limits.conf Date: Sat, 05 Oct 2013 21:35:56 -0400 Message-ID: In-Reply-To: CANs+FoXRfGDw3z3Jo2UN-Vev5B-LE9zpg7M+rLa9S-1xgnvxOg@mail.gmail.com --===============6945776415445036190== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sorry for the double post. I just wanted to make sure that the presence of the 'soft' line didn't throw an error. On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan wr= ote: > As a note, both: > > * - core 0 > > AND > > * hard core 0 > * soft core 0 > > Should pass. > > Trevor > > > On Mon, Sep 30, 2013 at 11:28 AM, wrote: > >> All, >> >> Most of the guidance for RHEL security has suggested setting the >> following in /etc/security/limits.conf: >> >> * hard core 0 >> >> I have generally set this to: >> >> * - core 0 >> >> Because this sets both the hard and soft limits on the system. Most SCAP >> scanners are looking for very specific values there. I'm looking at >> modifying the checks to pass either 'hard' or '-' for the value. >> >> I'd also to fix the maxlogins in the rule (*max_concurrent_login_sessions >> *) in /etc/security/limits.conf to look for the DOD default (10) and >> lower to satisfy the check. Security standards are there as a baseline, = why >> 'fail' the setting for exceeding the baseline value? >> >> Regards, >> >> Frank Caviggia >> >> -- >> Frank Caviggia >> Consultant, Public Sectorfcaviggi(a)redhat.com >> (M) (571) 295-4560 >> >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> >> > > > -- > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============6945776415445036190== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+U29ycnkgZm9yIHRoZSBkb3VibGUgcG9zdC4gSSBqdXN0IHdhbnRlZCB0 byBtYWtlIHN1cmUgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgdGhlICYjMzk7c29mdCYjMzk7IGxpbmUg ZGlkbiYjMzk7dCB0aHJvdyBhbiBlcnJvci48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+ PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gU2F0LCBPY3QgNSwgMjAxMyBhdCA5 OjM1IFBNLCBUcmV2b3IgVmF1Z2hhbiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0 bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+dHZhdWdoYW5Ab255eHBv aW50LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFp bF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNv bGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgZGlyPSJsdHIiPkFzIGEgbm90ZSwgYm90aDo8ZGl2 Pjxicj48L2Rpdj48ZGl2PiogoC0goGNvcmUgoDA8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkFO RDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+CiogoGhhcmQgoGNvcmUgMDwvZGl2PjxkaXY+KiCg c29mdCCgIGNvcmUgMDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+U2hvdWxkIHBhc3MuPC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj4KVHJldm9yPC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxf ZXh0cmEiPjxicj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPjxkaXY+PGRpdiBjbGFzcz0i aDUiPk9uIE1vbiwgU2VwIDMwLCAyMDEzIGF0IDExOjI4IEFNLCAgPHNwYW4gZGlyPSJsdHIiPiZs dDs8YSBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmZj YXZpZ2dpQHJlZGhhdC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPgoKPC9kaXY+PC9kaXY+ PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7 Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRpdj48ZGl2IGNs YXNzPSJoNSI+CiAgCgogICAgCiAgCiAgPGRpdiBiZ2NvbG9yPSIjRkZGRkZGIiB0ZXh0PSIjMDAw MDAwIj4KICAgIEFsbCw8YnI+CiAgICA8YnI+CiAgICBNb3N0IG9mIHRoZSBndWlkYW5jZSBmb3Ig UkhFTCBzZWN1cml0eSBoYXMgc3VnZ2VzdGVkIHNldHRpbmcgdGhlCiAgICBmb2xsb3dpbmcgaW4g L2V0Yy9zZWN1cml0eS9saW1pdHMuY29uZjo8YnI+CiAgICA8YnI+CiAgICCgoKAgoKCgICqgoKAg aGFyZKCgoCBjb3JloKCgIDA8YnI+CiAgICA8YnI+CiAgICBJIGhhdmUgZ2VuZXJhbGx5IHNldCB0 aGlzIHRvOjxicj4KICAgIDxicj4KICAgIKCgoCCgoKAgKqCgoCAtIKCgIGNvcmWgoKAgMDxicj4K ICAgIDxicj4KICAgIEJlY2F1c2UgdGhpcyBzZXRzIGJvdGggdGhlIGhhcmQgYW5kIHNvZnQgbGlt aXRzIG9uIHRoZSBzeXN0ZW0uIE1vc3QKICAgIFNDQVAgc2Nhbm5lcnMgYXJlIGxvb2tpbmcgZm9y IHZlcnkgc3BlY2lmaWMgdmFsdWVzIHRoZXJlLqAgSSYjMzk7bQogICAgbG9va2luZyBhdCBtb2Rp ZnlpbmcgdGhlIGNoZWNrcyB0byBwYXNzIGVpdGhlciAmIzM5O2hhcmQmIzM5OyBvciAmIzM5Oy0m IzM5OyBmb3IgdGhlCiAgICB2YWx1ZS48YnI+CiAgICA8YnI+CiAgICBJJiMzOTtkIGFsc28gdG8g Zml4IHRoZSBtYXhsb2dpbnMgaW4gdGhlIHJ1bGUgKDxzdHJvbmc+bWF4X2NvbmN1cnJlbnRfbG9n aW5fc2Vzc2lvbnM8L3N0cm9uZz4pCiAgICBpbiAvZXRjL3NlY3VyaXR5L2xpbWl0cy5jb25mIHRv IGxvb2sgZm9yIHRoZSBET0QgZGVmYXVsdCAoMTApIGFuZAogICAgbG93ZXIgdG8gc2F0aXNmeSB0 aGUgY2hlY2suIFNlY3VyaXR5IHN0YW5kYXJkcyBhcmUgdGhlcmUgYXMgYQogICAgYmFzZWxpbmUs IHdoeSAmIzM5O2ZhaWwmIzM5OyB0aGUgc2V0dGluZyBmb3IgZXhjZWVkaW5nIHRoZSBiYXNlbGlu ZSB2YWx1ZT88YnI+CiAgICA8YnI+CiAgICBSZWdhcmRzLDxicj4KICAgIDxicj4KICAgIEZyYW5r IENhdmlnZ2lhPHNwYW4+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KICAgIDxicj4KICAgIDxw cmUgY29scz0iNzIiPi0tIApGcmFuayBDYXZpZ2dpYQpDb25zdWx0YW50LCBQdWJsaWMgU2VjdG9y CjxhIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZmNh dmlnZ2lAcmVkaGF0LmNvbTwvYT4KKE0pIDxhIGhyZWY9InRlbDolMjg1NzElMjklMjAyOTUtNDU2 MCIgdmFsdWU9IisxNTcxMjk1NDU2MCIgdGFyZ2V0PSJfYmxhbmsiPig1NzEpIDI5NS00NTYwPC9h PjwvcHJlPgogIDwvZm9udD48L3NwYW4+PC9kaXY+Cgo8YnI+PC9kaXY+PC9kaXY+PGRpdiBjbGFz cz0iaW0iPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJy PgpzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNj YXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhy ZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAt c2VjdXJpdHktZ3VpZGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3Rl ZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPGJyPjwv ZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48c3BhbiBjbGFzcz0iSE9FblpiIj48Zm9udCBjb2xvcj0i Izg4ODg4OCI+PGJyPjxiciBjbGVhcj0iYWxsIj48ZGl2Pjxicj48L2Rpdj4tLSA8YnI+VHJldm9y IFZhdWdoYW48YnI+VmljZSBQcmVzaWRlbnQsIE9ueXggUG9pbnQsIEluYzxicj48YSBocmVmPSJ0 ZWw6JTI4NDEwJTI5JTIwNTQxLTY2OTkiIHZhbHVlPSIrMTQxMDU0MTY2OTkiIHRhcmdldD0iX2Js YW5rIj4oNDEwKSA1NDEtNjY5OTwvYT48YnI+CjxhIGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4 cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+ PGJyPi0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkIHByb3ByaWV0 YXJ5IGluZm9ybWF0aW9uIC0tCjwvZm9udD48L3NwYW4+PC9kaXY+CjwvYmxvY2txdW90ZT48L2Rp dj48YnI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGJyPjwvZGl2Pi0tIDxicj5UcmV2b3IgVmF1Z2hh bjxicj5WaWNlIFByZXNpZGVudCwgT255eCBQb2ludCwgSW5jPGJyPig0MTApIDU0MS02Njk5PGJy PjxhIGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIj50dmF1Z2hhbkBvbnl4cG9p bnQuY29tPC9hPjxicj48YnI+LS0gVGhpcyBhY2NvdW50IG5vdCBhcHByb3ZlZCBmb3IgdW5lbmNy eXB0ZWQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gLS0KPC9kaXY+Cg== --===============6945776415445036190==-- From fcaviggi at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============1277484442146553899==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: Fun with limits.conf Date: Sat, 05 Oct 2013 23:25:34 -0400 Message-ID: <5250D82E.6000005@redhat.com> In-Reply-To: CANs+FoXifHAiGb1vZaHCgvkWRBNTqLKpUyx2H=ZCfJeH-Fckqw@mail.gmail.com --===============1277484442146553899== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Trevor, The hard and '-' (which sets both hard and soft) are the primary = controls, 'soft' is overruled by the 'hard' setting. That's why those are the most important to check. Regards, Frank On 10/05/2013 09:35 PM, Trevor Vaughan wrote: > Sorry for the double post. I just wanted to make sure that the = > presence of the 'soft' line didn't throw an error. > > > On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan > wrote: > > As a note, both: > > * - core 0 > > AND > > * hard core 0 > * soft core 0 > > Should pass. > > Trevor > > > On Mon, Sep 30, 2013 at 11:28 AM, > wrote: > > All, > > Most of the guidance for RHEL security has suggested setting > the following in /etc/security/limits.conf: > > * hard core 0 > > I have generally set this to: > > * - core 0 > > Because this sets both the hard and soft limits on the system. > Most SCAP scanners are looking for very specific values > there. I'm looking at modifying the checks to pass either > 'hard' or '-' for the value. > > I'd also to fix the maxlogins in the rule > (*max_concurrent_login_sessions*) in /etc/security/limits.conf > to look for the DOD default (10) and lower to satisfy the > check. Security standards are there as a baseline, why 'fail' > the setting for exceeding the baseline value? > > Regards, > > Frank Caviggia > > -- = > Frank Caviggia > Consultant, Public Sector > fcaviggi(a)redhat.com > (M)(571) 295-4560 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/scap-security-gui= de > > > > > -- = > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary > information -- > > > > > -- = > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============1277484442146553899== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9SVNP LTg4NTktMSIKICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICA8L2hlYWQ+CiAgPGJv ZHkgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAwMDAwMCI+CiAgICA8ZGl2IGNsYXNzPSJtb3ot Y2l0ZS1wcmVmaXgiPlRyZXZvciw8YnI+CiAgICAgIDxicj4KICAgICAgVGhlIGhhcmQgYW5kICct JyAod2hpY2ggc2V0cyBib3RoIGhhcmQgYW5kIHNvZnQpIGFyZSB0aGUgcHJpbWFyeQogICAgICBj b250cm9scywgJ3NvZnQnIGlzIG92ZXJydWxlZCBieSB0aGUgJ2hhcmQnIHNldHRpbmcuPGJyPgog ICAgICA8YnI+CiAgICAgIFRoYXQncyB3aHkgdGhvc2UgYXJlIHRoZSBtb3N0IGltcG9ydGFudCB0 byBjaGVjay48YnI+CiAgICAgIDxicj4KICAgICAgUmVnYXJkcyw8YnI+CiAgICAgIDxicj4KICAg ICAgRnJhbms8YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIE9uIDEw LzA1LzIwMTMgMDk6MzUgUE0sIFRyZXZvciBWYXVnaGFuIHdyb3RlOjxicj4KICAgIDwvZGl2Pgog ICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOkNBTnMrRm9YaWZIQWlHYjF2WmFIQ2d2a1dSQk5UcUxL cFV5eDJIPVpDZkplSC1GY2txd0BtYWlsLmdtYWlsLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAg ICAgIDxkaXYgZGlyPSJsdHIiPlNvcnJ5IGZvciB0aGUgZG91YmxlIHBvc3QuIEkganVzdCB3YW50 ZWQgdG8gbWFrZQogICAgICAgIHN1cmUgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgdGhlICdzb2Z0JyBs aW5lIGRpZG4ndCB0aHJvdyBhbiBlcnJvci48L2Rpdj4KICAgICAgPGRpdiBjbGFzcz0iZ21haWxf ZXh0cmEiPjxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUi Pk9uIFNhdCwgT2N0IDUsIDIwMTMgYXQgOTozNSBQTSwgVHJldm9yCiAgICAgICAgICBWYXVnaGFu IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAg ICAgIGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+ dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT4mZ3Q7PC9zcGFuPgogICAgICAgICAgd3JvdGU6PGJy PgogICAgICAgICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2lu OjAgMCAwCiAgICAgICAgICAgIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGlu Zy1sZWZ0OjFleCI+CiAgICAgICAgICAgIDxkaXYgZGlyPSJsdHIiPkFzIGEgbm90ZSwgYm90aDoK ICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAg ICA8ZGl2PiogJm5ic3A7LSAmbmJzcDtjb3JlICZuYnNwOzA8L2Rpdj4KICAgICAgICAgICAgICA8 ZGl2Pjxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2PkFORDwvZGl2 PgogICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgIDxkaXY+CiAgICAgICAgICAgICAgICAqICZuYnNwO2hhcmQgJm5ic3A7Y29yZSAwPC9kaXY+ CiAgICAgICAgICAgICAgPGRpdj4qICZuYnNwO3NvZnQgJm5ic3A7IGNvcmUgMDwvZGl2PgogICAg ICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxk aXY+U2hvdWxkIHBhc3MuPC9kaXY+CiAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAg ICAgPC9kaXY+CiAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgIFRyZXZvcjwvZGl2 PgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxfZXh0cmEi Pjxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxf cXVvdGUiPgogICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgICAgPGRpdiBjbGFz cz0iaDUiPk9uIE1vbiwgU2VwIDMwLCAyMDEzIGF0IDExOjI4IEFNLCA8c3BhbgogICAgICAgICAg ICAgICAgICAgICAgZGlyPSJsdHIiPiZsdDs8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAg ICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIgogICAg ICAgICAgICAgICAgICAgICAgICB0YXJnZXQ9Il9ibGFuayI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwv YT4mZ3Q7PC9zcGFuPgogICAgICAgICAgICAgICAgICAgIHdyb3RlOjxicj4KICAgICAgICAgICAg ICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMAogICAgICAgICAg ICAgICAgICAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgi PgogICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9 Img1Ij4KICAgICAgICAgICAgICAgICAgICAgIDxkaXYgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0i IzAwMDAwMCI+IEFsbCw8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgTW9zdCBvZiB0aGUgZ3VpZGFuY2UgZm9yIFJIRUwgc2VjdXJpdHkgaGFz CiAgICAgICAgICAgICAgICAgICAgICAgIHN1Z2dlc3RlZCBzZXR0aW5nIHRoZSBmb2xsb3dpbmcg aW4KICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9zZWN1cml0eS9saW1pdHMuY29uZjo8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgJm5i c3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyAqJm5ic3A7Jm5ic3A7Jm5ic3A7IGhh cmQmbmJzcDsmbmJzcDsmbmJzcDsgY29yZSZuYnNwOyZuYnNwOyZuYnNwOyAwPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEkgaGF2ZSBnZW5l cmFsbHkgc2V0IHRoaXMgdG86PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsg KiZuYnNwOyZuYnNwOyZuYnNwOyAtICZuYnNwOyZuYnNwOyBjb3JlJm5ic3A7Jm5ic3A7Jm5ic3A7 IDA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgQmVjYXVzZSB0aGlzIHNldHMgYm90aCB0aGUgaGFyZCBhbmQgc29mdCBsaW1pdHMKICAgICAg ICAgICAgICAgICAgICAgICAgb24gdGhlIHN5c3RlbS4gTW9zdCBTQ0FQIHNjYW5uZXJzIGFyZSBs b29raW5nCiAgICAgICAgICAgICAgICAgICAgICAgIGZvciB2ZXJ5IHNwZWNpZmljIHZhbHVlcyB0 aGVyZS4mbmJzcDsgSSdtIGxvb2tpbmcgYXQKICAgICAgICAgICAgICAgICAgICAgICAgbW9kaWZ5 aW5nIHRoZSBjaGVja3MgdG8gcGFzcyBlaXRoZXIgJ2hhcmQnIG9yCiAgICAgICAgICAgICAgICAg ICAgICAgICctJyBmb3IgdGhlIHZhbHVlLjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICBJJ2QgYWxzbyB0byBmaXggdGhlIG1heGxvZ2lucyBp biB0aGUgcnVsZSAoPHN0cm9uZz5tYXhfY29uY3VycmVudF9sb2dpbl9zZXNzaW9uczwvc3Ryb25n PikKICAgICAgICAgICAgICAgICAgICAgICAgaW4gL2V0Yy9zZWN1cml0eS9saW1pdHMuY29uZiB0 byBsb29rIGZvciB0aGUgRE9ECiAgICAgICAgICAgICAgICAgICAgICAgIGRlZmF1bHQgKDEwKSBh bmQgbG93ZXIgdG8gc2F0aXNmeSB0aGUgY2hlY2suCiAgICAgICAgICAgICAgICAgICAgICAgIFNl Y3VyaXR5IHN0YW5kYXJkcyBhcmUgdGhlcmUgYXMgYSBiYXNlbGluZSwgd2h5CiAgICAgICAgICAg ICAgICAgICAgICAgICdmYWlsJyB0aGUgc2V0dGluZyBmb3IgZXhjZWVkaW5nIHRoZSBiYXNlbGlu ZQogICAgICAgICAgICAgICAgICAgICAgICB2YWx1ZT88YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgUmVnYXJkcyw8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgRnJhbmsgQ2F2aWdnaWE8 c3Bhbj48Zm9udCBjb2xvcj0iIzg4ODg4OCI+PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHByZSBjb2xzPSI3MiI+LS0gCkZy YW5rIENhdmlnZ2lhCkNvbnN1bHRhbnQsIFB1YmxpYyBTZWN0b3IKPGEgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIiBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsi PmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGhy ZWY9InRlbDolMjg1NzElMjklMjAyOTUtNDU2MCIgdmFsdWU9IisxNTcxMjk1NDU2MCIgdGFyZ2V0 PSJfYmxhbmsiPig1NzEpIDI5NS00NTYwPC9hPjwvcHJlPgogICAgICAgICAgICAgICAgICAgICAg ICAgIDwvZm9udD48L3NwYW4+PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgICAgICA8ZGl2IGNsYXNzPSJpbSI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnI+CiAgICAgICAgICAgICAgICAgICAgc2NhcC1zZWN1cml0eS1ndWlk ZSBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICAgICAgICAgICAgPGEgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIgogICAgICAgICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHkt Z3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICAgICAgICAgIHRhcmdl dD0iX2JsYW5rIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ PGJyPgogICAgICAgICAgICAgICAgICAgIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKaHJlZj0i aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlzdGluZm8vc2NhcC1zZWN1 cml0eS1ndWlkZSIKICAgICAgICAgICAgICAgICAgICAgIHRhcmdldD0iX2JsYW5rIj5odHRwczov L2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1 aWRlPC9hPjxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwv ZGl2PgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgIDxzcGFuIGNsYXNzPSJIT0VuWmIiPjxmb250IGNvbG9yPSIjODg4ODg4Ij48 YnI+CiAgICAgICAgICAgICAgICAgIDxiciBjbGVhcj0iYWxsIj4KICAgICAgICAgICAgICAgICAg PGRpdj48YnI+CiAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAtLSA8 YnI+CiAgICAgICAgICAgICAgICAgIFRyZXZvciBWYXVnaGFuPGJyPgogICAgICAgICAgICAgICAg ICBWaWNlIFByZXNpZGVudCwgT255eCBQb2ludCwgSW5jPGJyPgogICAgICAgICAgICAgICAgICA8 YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgICAgICAgICAgaHJlZj0idGVsOiUy ODQxMCUyOSUyMDU0MS02Njk5IiB2YWx1ZT0iKzE0MTA1NDE2Njk5IgogICAgICAgICAgICAgICAg ICAgIHRhcmdldD0iX2JsYW5rIj4oNDEwKSA1NDEtNjY5OTwvYT48YnI+CiAgICAgICAgICAgICAg ICAgIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgICBocmVmPSJt YWlsdG86dHZhdWdoYW5Ab255eHBvaW50LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnR2YXVnaGFuQG9u eXhwb2ludC5jb208L2E+PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgIC0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkCiAgICAgICAg ICAgICAgICAgIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIC0tCiAgICAgICAgICAgICAgICA8L2Zv bnQ+PC9zcGFuPjwvZGl2PgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIDwvZGl2Pgog ICAgICAgIDxicj4KICAgICAgICA8YnIgY2xlYXI9ImFsbCI+CiAgICAgICAgPGRpdj48YnI+CiAg ICAgICAgPC9kaXY+CiAgICAgICAgLS0gPGJyPgogICAgICAgIFRyZXZvciBWYXVnaGFuPGJyPgog ICAgICAgIFZpY2UgUHJlc2lkZW50LCBPbnl4IFBvaW50LCBJbmM8YnI+CiAgICAgICAgKDQxMCkg NTQxLTY2OTk8YnI+CiAgICAgICAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBocmVmPSJtYWls dG86dHZhdWdoYW5Ab255eHBvaW50LmNvbSI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+ CiAgICAgICAgPGJyPgogICAgICAgIC0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVu ZW5jcnlwdGVkIHByb3ByaWV0YXJ5CiAgICAgICAgaW5mb3JtYXRpb24gLS0KICAgICAgPC9kaXY+ CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8cHJlIGNsYXNzPSJtb3ot c2lnbmF0dXJlIiBjb2xzPSI3MiI+LS0gCkZyYW5rIENhdmlnZ2lhCkNvbnN1bHRhbnQsIFB1Ymxp YyBTZWN0b3IKPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRv OmZjYXZpZ2dpQHJlZGhhdC5jb20iPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSAoNTcxKSAy OTUtNDU2MDwvcHJlPgogIDwvYm9keT4KPC9odG1sPgo= --===============1277484442146553899==-- From fcaviggi at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============0328229847357331816==" MIME-Version: 1.0 From: Frank Caviggia To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 23:33:19 -0400 Message-ID: <5250D9FF.8080108@redhat.com> In-Reply-To: CANs+FoXQ__BBNUJF3k_XMz1jEL88hRKgynbHPtmsebLRJbyJ_w@mail.gmail.com --===============0328229847357331816== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Trevor, The -e 2 setting ensures that the audit rules are immutable until the = next reboot. It ensures the configuration can't be changed by doing = someone doing something nefarious to the system. Regards, Frank On 10/05/2013 09:27 PM, Trevor Vaughan wrote: > Personally, I'm massively opposed to '-e 2'. > > I really like the ability to audit new things as I add them without = > rebooting my systems. > > Trevor > > > On Fri, Oct 4, 2013 at 8:06 AM, Josh Kayse = > > = > wrote: > > On 10/04/2013 07:40 AM, Trevor Vaughan wrote: > > Is Augeas an option? > > This seems like the perfect opportunity to solidify the Augeas > lenses > regarding security settings while making life easier for everyone. > > Trevor > > > On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells > >> wrote: > > On 10/3/13 3:11 PM, fcaviggi(a)redhat.com > > > wrote: > > All, > > As a starting point for writing remediation fixes in > the SSG - so, > I did the following: > > $ ls > ~//scap-security-guide/RHEL6/input/checks//*.xml | awk '{ > > print $1 }' | sed s/\.[^\.]*$// > ~/checks > $ ls > ~//scap-security-guide/RHEL6/input/fixes//*.sh | awk '{ > > print $1 }' | sed s/\.[^\.]*$// > ~/fixes > $ sdiff ~/fixes ~/checks | less > > There's fair a bit of work to be done for the fix > remediations... > > Since I'm new to the project, I was wondering if there > was any > ideas or standards to how the SSG should distribute > some of these > fixes - for example - a wholesale replacement of the > audit.rules > and auditd.conf might be preferable than doing > piecemeal sed's. > > > It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules > /etc/audit.rules`, and that likely is the right choice > during an > initial provisioning process. But then SysAdmins tailor > audit rules, > the system evolves, and we need to evaluate the > audit.rules file > against specific auditing guidance items after the pristine > audit.rules template is manipulated. > > So, if a single rule must be remediated, we can't blow > away the > whole audit.rules file. Super fun sed scripts it is =3D/ > > > > > I think that augeas is a good idea. We need to be careful that > rules that are inserted in to audit.rules happen before any '-e 2' > line (if one exists). Otherwise they will fail to be inserted > because the audit rules become locked. > > -josh > > -- = > 404.407.6630 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > > > > -- = > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Frank Caviggia Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 --===============0328229847357331816== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5UcmV2b3IsPGJyPgogICAgICA8YnI+CiAgICAgIFRoZSAtZSAyIHNldHRpbmcgZW5zdXJlcyB0 aGF0IHRoZSBhdWRpdCBydWxlcyBhcmUgaW1tdXRhYmxlIHVudGlsCiAgICAgIHRoZSBuZXh0IHJl Ym9vdC7CoCBJdCBlbnN1cmVzIHRoZSBjb25maWd1cmF0aW9uIGNhbid0IGJlIGNoYW5nZWQgYnkK ICAgICAgZG9pbmcgc29tZW9uZSBkb2luZyBzb21ldGhpbmcgbmVmYXJpb3VzIHRvIHRoZSBzeXN0 ZW0uPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZHMsPGJyPgogICAgICA8YnI+CiAgICAgIEZy YW5rPGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgT24gMTAvMDUvMjAxMyAwOToyNyBQ TSwgVHJldm9yIFZhdWdoYW4gd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZQpj aXRlPSJtaWQ6Q0FOcytGb1hRX19CQk5VSkYza19YTXoxakVMODhoUktneW5iSFB0bXNlYkxSSmJ5 Sl93QG1haWwuZ21haWwuY29tIgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPGRpdiBkaXI9Imx0 ciI+UGVyc29uYWxseSwgSSdtIG1hc3NpdmVseSBvcHBvc2VkIHRvICctZSAyJy4KICAgICAgICA8 ZGl2Pjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2PkkgcmVhbGx5IGxpa2UgdGhlIGFi aWxpdHkgdG8gYXVkaXQgbmV3IHRoaW5ncyBhcyBJIGFkZCB0aGVtCiAgICAgICAgICB3aXRob3V0 IHJlYm9vdGluZyBteSBzeXN0ZW1zLjwvZGl2PgogICAgICAgIDxkaXY+PGJyPgogICAgICAgIDwv ZGl2PgogICAgICAgIDxkaXY+VHJldm9yPC9kaXY+CiAgICAgIDwvZGl2PgogICAgICA8ZGl2IGNs YXNzPSJnbWFpbF9leHRyYSI+PGJyPgogICAgICAgIDxicj4KICAgICAgICA8ZGl2IGNsYXNzPSJn bWFpbF9xdW90ZSI+T24gRnJpLCBPY3QgNCwgMjAxMyBhdCA4OjA2IEFNLCBKb3NoCiAgICAgICAg ICBLYXlzZSA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAg ICAgICAgICAgICBocmVmPSJtYWlsdG86Sm9zaHVhLktheXNlQGd0cmkuZ2F0ZWNoLmVkdSIgdGFy Z2V0PSJfYmxhbmsiPkpvc2h1YS5LYXlzZUBndHJpLmdhdGVjaC5lZHU8L2E+Jmd0Ozwvc3Bhbj4K ICAgICAgICAgIHdyb3RlOjxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9x dW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMAogICAgICAgICAgICAuOGV4O2JvcmRlci1sZWZ0OjFw eCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJp bSI+T24gMTAvMDQvMjAxMyAwNzo0MCBBTSwgVHJldm9yIFZhdWdoYW4KICAgICAgICAgICAgICB3 cm90ZTo8YnI+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8YmxvY2txdW90ZSBjbGFz cz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAKICAgICAgICAgICAgICAuOGV4O2Jv cmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgogICAgICAgICAgICAg IDxkaXYgY2xhc3M9ImltIj4KICAgICAgICAgICAgICAgIElzIEF1Z2VhcyBhbiBvcHRpb24/PGJy PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgVGhpcyBzZWVtcyBsaWtlIHRo ZSBwZXJmZWN0IG9wcG9ydHVuaXR5IHRvIHNvbGlkaWZ5IHRoZQogICAgICAgICAgICAgICAgQXVn ZWFzIGxlbnNlczxicj4KICAgICAgICAgICAgICAgIHJlZ2FyZGluZyBzZWN1cml0eSBzZXR0aW5n cyB3aGlsZSBtYWtpbmcgbGlmZSBlYXNpZXIgZm9yCiAgICAgICAgICAgICAgICBldmVyeW9uZS48 YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBUcmV2b3I8YnI+CiAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBPbiBU aHUsIE9jdCAzLCAyMDEzIGF0IDk6NDIgUE0sIFNoYXduIFdlbGxzICZsdDs8YQogICAgICAgICAg ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiIGhyZWY9Im1haWx0bzpzaGF3bkByZWRoYXQu Y29tIgogICAgICAgICAgICAgICAgICB0YXJnZXQ9Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwv YT48YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgJmx0O21haWx0bzo8YSBt b3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86c2hhd25A cmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnNoYXduQHJlZGhhdC5jb208L2E+Jmd0OyZndDsK ICAgICAgICAgICAgICB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg IMKgIMKgIE9uIDEwLzMvMTMgMzoxMSBQTSwgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAg ICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5jb20iIHRhcmdldD0iX2Js YW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPgogICAgICAgICAgICAgICZsdDttYWlsdG86PGEg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZjYXZp Z2dpQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPiZn dDs8YnI+CiAgICAgICAgICAgICAgwqAgwqAgd3JvdGU6PGJyPgogICAgICAgICAgICAgIDxibG9j a3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMAogICAgICAgICAg ICAgICAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4K ICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImltIj4KICAgICAgICAgICAgICAgICAgwqAgwqAg QWxsLDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCBB cyBhIHN0YXJ0aW5nIHBvaW50IGZvciB3cml0aW5nIHJlbWVkaWF0aW9uIGZpeGVzCiAgICAgICAg ICAgICAgICAgIGluIHRoZSBTU0cgLSBzbyw8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIEkg ZGlkIHRoZSBmb2xsb3dpbmc6PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgICQgbHMgfi8vc2NhcC1zZWN1 cml0eS1ndWlkZS9SSEVMNi9pbnB1dC9jaGVja3MvLyoueG1sCiAgICAgICAgICAgICAgICB8IGF3 ayAnewogICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iaW0iPjxicj4KICAgICAgICAgICAgICAg ICAgwqAgwqAgcHJpbnQgJDEgfScgfCBzZWQgcy9cLlteXC5dKiQvLyAmZ3Q7IH4vY2hlY2tzPGJy PgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCAkIGxz IH4vL3NjYXAtc2VjdXJpdHktZ3VpZGUvUkhFTDYvaW5wdXQvZml4ZXMvLyouc2gKICAgICAgICAg ICAgICAgIHwgYXdrICd7CiAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJpbSI+PGJyPgogICAg ICAgICAgICAgICAgICDCoCDCoCBwcmludCAkMSB9JyB8IHNlZCBzL1wuW15cLl0qJC8vICZndDsg fi9maXhlczxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgJCBzZGlmZiB+L2ZpeGVz IH4vY2hlY2tzIHwgbGVzczxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICDCoCDCoCBUaGVyZSdzIGZhaXIgYSBiaXQgb2Ygd29yayB0byBiZSBkb25lIGZvciB0aGUg Zml4CiAgICAgICAgICAgICAgICAgIHJlbWVkaWF0aW9ucy4uLjxicj4KICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCBTaW5jZSBJJ20gbmV3IHRvIHRoZSBwcm9q ZWN0LCBJIHdhcyB3b25kZXJpbmcgaWYKICAgICAgICAgICAgICAgICAgdGhlcmUgd2FzIGFueTxi cj4KICAgICAgICAgICAgICAgICAgwqAgwqAgaWRlYXMgb3Igc3RhbmRhcmRzIHRvIGhvdyB0aGUg U1NHIHNob3VsZAogICAgICAgICAgICAgICAgICBkaXN0cmlidXRlIHNvbWUgb2YgdGhlc2U8YnI+ CiAgICAgICAgICAgICAgICAgIMKgIMKgIGZpeGVzIC0gZm9yIGV4YW1wbGUgLSBhIHdob2xlc2Fs ZSByZXBsYWNlbWVudCBvZgogICAgICAgICAgICAgICAgICB0aGUgYXVkaXQucnVsZXM8YnI+CiAg ICAgICAgICAgICAgICAgIMKgIMKgIGFuZCBhdWRpdGQuY29uZiBtaWdodCBiZSBwcmVmZXJhYmxl IHRoYW4gZG9pbmcKICAgICAgICAgICAgICAgICAgcGllY2VtZWFsIHNlZCdzLjxicj4KICAgICAg ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICA8ZGl2IGNsYXNzPSJpbSI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICDC oCDCoCBJdCdkIGJlIG9tZ3ogZWFzaWVyIHRvIGBjcAogICAgICAgICAgICAgICAgL3Vzci9zaGFy ZS9kb2MvYXVkaXQtKi9zdGlnLnJ1bGVzPGJyPgogICAgICAgICAgICAgICAgwqAgwqAgL2V0Yy9h dWRpdC5ydWxlc2AsIGFuZCB0aGF0IGxpa2VseSBpcyB0aGUgcmlnaHQKICAgICAgICAgICAgICAg IGNob2ljZSBkdXJpbmcgYW48YnI+CiAgICAgICAgICAgICAgICDCoCDCoCBpbml0aWFsIHByb3Zp c2lvbmluZyBwcm9jZXNzLiBCdXQgdGhlbiBTeXNBZG1pbnMKICAgICAgICAgICAgICAgIHRhaWxv ciBhdWRpdCBydWxlcyw8YnI+CiAgICAgICAgICAgICAgICDCoCDCoCB0aGUgc3lzdGVtIGV2b2x2 ZXMsIGFuZCB3ZSBuZWVkIHRvIGV2YWx1YXRlIHRoZQogICAgICAgICAgICAgICAgYXVkaXQucnVs ZXMgZmlsZTxicj4KICAgICAgICAgICAgICAgIMKgIMKgIGFnYWluc3Qgc3BlY2lmaWMgYXVkaXRp bmcgZ3VpZGFuY2UgaXRlbXMgYWZ0ZXIgdGhlCiAgICAgICAgICAgICAgICBwcmlzdGluZTxicj4K ICAgICAgICAgICAgICAgIMKgIMKgIGF1ZGl0LnJ1bGVzIHRlbXBsYXRlIGlzIG1hbmlwdWxhdGVk Ljxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIMKgIMKgIFNvLCBpZiBh IHNpbmdsZSBydWxlIG11c3QgYmUgcmVtZWRpYXRlZCwgd2UgY2FuJ3QKICAgICAgICAgICAgICAg IGJsb3cgYXdheSB0aGU8YnI+CiAgICAgICAgICAgICAgICDCoCDCoCB3aG9sZSBhdWRpdC5ydWxl cyBmaWxlLiBTdXBlciBmdW4gc2VkIHNjcmlwdHMgaXQgaXMKICAgICAgICAgICAgICAgID0vPGJy PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAg ICZsdDtzbmlwJmd0Ozxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgIEkgdGhpbmsgdGhhdCBhdWdlYXMgaXMgYSBnb29kIGlkZWEuIMKgV2Ug bmVlZCB0byBiZSBjYXJlZnVsCiAgICAgICAgICAgIHRoYXQgcnVsZXMgdGhhdCBhcmUgaW5zZXJ0 ZWQgaW4gdG8gYXVkaXQucnVsZXMgaGFwcGVuIGJlZm9yZQogICAgICAgICAgICBhbnkgJy1lIDIn IGxpbmUgKGlmIG9uZSBleGlzdHMpLiDCoE90aGVyd2lzZSB0aGV5IHdpbGwgZmFpbAogICAgICAg ICAgICB0byBiZSBpbnNlcnRlZCBiZWNhdXNlIHRoZSBhdWRpdCBydWxlcyBiZWNvbWUgbG9ja2Vk LjxzcGFuCiAgICAgICAgICAgICAgY2xhc3M9IkhPRW5aYiI+PGZvbnQgY29sb3I9IiM4ODg4ODgi Pjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC1qb3NoPGJyPgogICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgLS0gPGJyPgogICAgICAgICAgICAgICAg PGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBocmVmPSJ0ZWw6NDA0LjQwNy42NjMwIgogICAgICAg ICAgICAgICAgICB2YWx1ZT0iKzE0MDQ0MDc2NjMwIiB0YXJnZXQ9Il9ibGFuayI+NDA0LjQwNy42 NjMwPC9hPjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2ZvbnQ+PC9z cGFuPjxicj4KICAgICAgICAgICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+CiAgICAgICAgICAgIHNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGluZyBs aXN0PGJyPgogICAgICAgICAgICA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAg ICAgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZyI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KICAg ICAgICAgICAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgpocmVmPSJodHRwczovL2xpc3RzLmZl ZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlIgogICAg ICAgICAgICAgIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcv bWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KICAgICAgICAgICAg PGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIDwvZGl2PgogICAgICAgIDxicj4K ICAgICAgICA8YnIgY2xlYXI9ImFsbCI+CiAgICAgICAgPGRpdj48YnI+CiAgICAgICAgPC9kaXY+ CiAgICAgICAgLS0gPGJyPgogICAgICAgIFRyZXZvciBWYXVnaGFuPGJyPgogICAgICAgIFZpY2Ug UHJlc2lkZW50LCBPbnl4IFBvaW50LCBJbmM8YnI+CiAgICAgICAgKDQxMCkgNTQxLTY2OTk8YnI+ CiAgICAgICAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBocmVmPSJtYWlsdG86dHZhdWdoYW5A b255eHBvaW50LmNvbSI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+CiAgICAgICAgPGJy PgogICAgICAgIC0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkIHBy b3ByaWV0YXJ5CiAgICAgICAgaW5mb3JtYXRpb24gLS0KICAgICAgPC9kaXY+CiAgICAgIDxicj4K ICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4K ICAgICAgPGJyPgogICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18Kc2NhcC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3QKPGEg Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJp dHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0 cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBo cmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2Fw LXNlY3VyaXR5LWd1aWRlIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9s aXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPgo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4K ICAgIDxicj4KICAgIDxicj4KICAgIDxwcmUgY2xhc3M9Im1vei1zaWduYXR1cmUiIGNvbHM9Ijcy Ij4tLSAKRnJhbmsgQ2F2aWdnaWEKQ29uc3VsdGFudCwgUHVibGljIFNlY3Rvcgo8YSBjbGFzcz0i bW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNv bSI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4KKE0pICg1NzEpIDI5NS00NTYwPC9wcmU+CiAgPC9i b2R5Pgo8L2h0bWw+Cg== --===============0328229847357331816==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============1185804153976797727==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 23:52:45 -0400 Message-ID: In-Reply-To: 5250D9FF.8080108@redhat.com --===============1185804153976797727== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Yeah, I know. But I like to change my audit rules when I add new services/items that need to be audited. Anywhere that's actually paying you money to keep their servers up isn't going to be thrilled with you rebooting them....ever. If you're actually auditing your audit rules and offloading your logs, you'll see someone changing them and thus can react to the change. -e 2 makes your system *less* secure in many SLA settings (since you can't actually audit as much as you should be given system changes) and should be in the realm of 'ideal'. Trevor On Sat, Oct 5, 2013 at 11:33 PM, wrote: > Trevor, > > The -e 2 setting ensures that the audit rules are immutable until the next > reboot. It ensures the configuration can't be changed by doing someone > doing something nefarious to the system. > > Regards, > > Frank > > > > On 10/05/2013 09:27 PM, Trevor Vaughan wrote: > > Personally, I'm massively opposed to '-e 2'. > > I really like the ability to audit new things as I add them without > rebooting my systems. > > Trevor > > > On Fri, Oct 4, 2013 at 8:06 AM, Josh Kayse wrote: > >> On 10/04/2013 07:40 AM, Trevor Vaughan wrote: >> >>> Is Augeas an option? >>> >>> This seems like the perfect opportunity to solidify the Augeas lenses >>> regarding security settings while making life easier for everyone. >>> >>> Trevor >>> >>> >>> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells >> > wrote: >>> >>> On 10/3/13 3:11 PM, fcaviggi(a)redhat.com >>> wrote: >>> >>>> All, >>>> >>>> As a starting point for writing remediation fixes in the SSG - so, >>>> I did the following: >>>> >>>> $ ls ~//scap-security-guide/RHEL6/input/checks//*.xml | awk '{ >>>> >>>> print $1 }' | sed s/\.[^\.]*$// > ~/checks >>>> $ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh | awk '{ >>>> >>>> print $1 }' | sed s/\.[^\.]*$// > ~/fixes >>>> $ sdiff ~/fixes ~/checks | less >>>> >>>> There's fair a bit of work to be done for the fix remediations... >>>> >>>> Since I'm new to the project, I was wondering if there was any >>>> ideas or standards to how the SSG should distribute some of these >>>> fixes - for example - a wholesale replacement of the audit.rules >>>> and auditd.conf might be preferable than doing piecemeal sed's. >>>> >>> >>> It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules >>> /etc/audit.rules`, and that likely is the right choice during an >>> initial provisioning process. But then SysAdmins tailor audit rules, >>> the system evolves, and we need to evaluate the audit.rules file >>> against specific auditing guidance items after the pristine >>> audit.rules template is manipulated. >>> >>> So, if a single rule must be remediated, we can't blow away the >>> whole audit.rules file. Super fun sed scripts it is =3D/ >>> >>> >>> >> >> I think that augeas is a good idea. We need to be careful that rules >> that are inserted in to audit.rules happen before any '-e 2' line (if one >> exists). Otherwise they will fail to be inserted because the audit rules >> become locked. >> >> -josh >> >> -- >> 404.407.6630 >> >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> >> > > > -- > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- > > > _______________________________________________ > scap-security-guide mailing listscap-security-guide(a)lists.fedorahosted.= orghttps://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > > > -- > Frank Caviggia > Consultant, Public Sectorfcaviggi(a)redhat.com > (M) (571) 295-4560 > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============1185804153976797727== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+WWVhaCwgSSBrbm93LjxkaXY+PGJyPjwvZGl2PjxkaXY+QnV0IEkgbGlr ZSB0byBjaGFuZ2UgbXkgYXVkaXQgcnVsZXMgd2hlbiBJIGFkZCBuZXcgc2VydmljZXMvaXRlbXMg dGhhdCBuZWVkIHRvIGJlIGF1ZGl0ZWQuPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5Bbnl3aGVy ZSB0aGF0JiMzOTtzIGFjdHVhbGx5IHBheWluZyB5b3UgbW9uZXkgdG8ga2VlcCB0aGVpciBzZXJ2 ZXJzIHVwIGlzbiYjMzk7dCBnb2luZyB0byBiZSB0aHJpbGxlZCB3aXRoIHlvdSByZWJvb3Rpbmcg dGhlbS4uLi5ldmVyLjwvZGl2Pgo8ZGl2Pjxicj48L2Rpdj48ZGl2PklmIHlvdSYjMzk7cmUgYWN0 dWFsbHkgYXVkaXRpbmcgeW91ciBhdWRpdCBydWxlcyBhbmQgb2ZmbG9hZGluZyB5b3VyIGxvZ3Ms IHlvdSYjMzk7bGwgc2VlIHNvbWVvbmUgY2hhbmdpbmcgdGhlbSBhbmQgdGh1cyBjYW4gcmVhY3Qg dG8gdGhlIGNoYW5nZS48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pi1lIDIgbWFrZXMgeW91ciBz eXN0ZW0gKmxlc3MqIHNlY3VyZSBpbiBtYW55IFNMQSBzZXR0aW5ncyAoc2luY2UgeW91IGNhbiYj Mzk7dCBhY3R1YWxseSBhdWRpdCBhcyBtdWNoIGFzIHlvdSBzaG91bGQgYmUgZ2l2ZW4gc3lzdGVt IGNoYW5nZXMpIGFuZCBzaG91bGQgYmUgaW4gdGhlIHJlYWxtIG9mICYjMzk7aWRlYWwmIzM5Oy48 L2Rpdj4KPGRpdj48YnI+PC9kaXY+PGRpdj5UcmV2b3I8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJn bWFpbF9leHRyYSI+PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gU2F0LCBPY3Qg NSwgMjAxMyBhdCAxMTozMyBQTSwgIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRv OmZjYXZpZ2dpQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29t PC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj4KPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3Rl IiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFk ZGluZy1sZWZ0OjFleCI+CiAgCiAgICAKICAKICA8ZGl2IGJnY29sb3I9IiNGRkZGRkYiIHRleHQ9 IiMwMDAwMDAiPgogICAgPGRpdj5UcmV2b3IsPGJyPgogICAgICA8YnI+CiAgICAgIFRoZSAtZSAy IHNldHRpbmcgZW5zdXJlcyB0aGF0IHRoZSBhdWRpdCBydWxlcyBhcmUgaW1tdXRhYmxlIHVudGls CiAgICAgIHRoZSBuZXh0IHJlYm9vdC6gIEl0IGVuc3VyZXMgdGhlIGNvbmZpZ3VyYXRpb24gY2Fu JiMzOTt0IGJlIGNoYW5nZWQgYnkKICAgICAgZG9pbmcgc29tZW9uZSBkb2luZyBzb21ldGhpbmcg bmVmYXJpb3VzIHRvIHRoZSBzeXN0ZW0uPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZHMsPGJy PgogICAgICA8YnI+CiAgICAgIEZyYW5rPGRpdj48ZGl2IGNsYXNzPSJoNSI+PGJyPgogICAgICA8 YnI+CiAgICAgIDxicj4KICAgICAgT24gMTAvMDUvMjAxMyAwOToyNyBQTSwgVHJldm9yIFZhdWdo YW4gd3JvdGU6PGJyPgogICAgPC9kaXY+PC9kaXY+PC9kaXY+PGRpdj48ZGl2IGNsYXNzPSJoNSI+ CiAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4KICAgICAgPGRpdiBkaXI9Imx0ciI+UGVyc29u YWxseSwgSSYjMzk7bSBtYXNzaXZlbHkgb3Bwb3NlZCB0byAmIzM5Oy1lIDImIzM5Oy4KICAgICAg ICA8ZGl2Pjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2PkkgcmVhbGx5IGxpa2UgdGhl IGFiaWxpdHkgdG8gYXVkaXQgbmV3IHRoaW5ncyBhcyBJIGFkZCB0aGVtCiAgICAgICAgICB3aXRo b3V0IHJlYm9vdGluZyBteSBzeXN0ZW1zLjwvZGl2PgogICAgICAgIDxkaXY+PGJyPgogICAgICAg IDwvZGl2PgogICAgICAgIDxkaXY+VHJldm9yPC9kaXY+CiAgICAgIDwvZGl2PgogICAgICA8ZGl2 IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPgogICAgICAgIDxicj4KICAgICAgICA8ZGl2IGNsYXNz PSJnbWFpbF9xdW90ZSI+T24gRnJpLCBPY3QgNCwgMjAxMyBhdCA4OjA2IEFNLCBKb3NoCiAgICAg ICAgICBLYXlzZSA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpKb3NodWEuS2F5 c2VAZ3RyaS5nYXRlY2guZWR1IiB0YXJnZXQ9Il9ibGFuayI+Sm9zaHVhLktheXNlQGd0cmkuZ2F0 ZWNoLmVkdTwvYT4mZ3Q7PC9zcGFuPgogICAgICAgICAgd3JvdGU6PGJyPgogICAgICAgICAgPGJs b2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9y ZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgICAgICAgICAgIDxk aXY+T24gMTAvMDQvMjAxMyAwNzo0MCBBTSwgVHJldm9yIFZhdWdoYW4KICAgICAgICAgICAgICB3 cm90ZTo8YnI+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8YmxvY2txdW90ZSBjbGFz cz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHgg I2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4KICAgICAgICAgICAgICA8ZGl2PgogICAgICAg ICAgICAgICAgSXMgQXVnZWFzIGFuIG9wdGlvbj88YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICBUaGlzIHNlZW1zIGxpa2UgdGhlIHBlcmZlY3Qgb3Bwb3J0dW5pdHkgdG8g c29saWRpZnkgdGhlCiAgICAgICAgICAgICAgICBBdWdlYXMgbGVuc2VzPGJyPgogICAgICAgICAg ICAgICAgcmVnYXJkaW5nIHNlY3VyaXR5IHNldHRpbmdzIHdoaWxlIG1ha2luZyBsaWZlIGVhc2ll ciBmb3IKICAgICAgICAgICAgICAgIGV2ZXJ5b25lLjxicj4KICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgIFRyZXZvcjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgIE9uIFRodSwgT2N0IDMsIDIwMTMgYXQgOTo0MiBQ TSwgU2hhd24gV2VsbHMgJmx0OzxhIGhyZWY9Im1haWx0bzpzaGF3bkByZWRoYXQuY29tIiB0YXJn ZXQ9Il9ibGFuayI+c2hhd25AcmVkaGF0LmNvbTwvYT48YnI+CiAgICAgICAgICAgICAgPC9kaXY+ CiAgICAgICAgICAgICAgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNv bSIgdGFyZ2V0PSJfYmxhbmsiPnNoYXduQHJlZGhhdC5jb208L2E+Jmd0OyZndDsKICAgICAgICAg ICAgICB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIKAgoCBPbiAx MC8zLzEzIDM6MTEgUE0sIDxhIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIiB0YXJn ZXQ9Il9ibGFuayI+ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4KICAgICAgICAgICAgICAmbHQ7bWFp bHRvOjxhIGhyZWY9Im1haWx0bzpmY2F2aWdnaUByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+ ZmNhdmlnZ2lAcmVkaGF0LmNvbTwvYT4mZ3Q7PGJyPgogICAgICAgICAgICAgIKAgoCB3cm90ZTo8 YnI+CiAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0i bWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0 OjFleCI+CiAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICCgIKAgQWxsLDxi cj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICCgIKAgQXMgYSBzdGFy dGluZyBwb2ludCBmb3Igd3JpdGluZyByZW1lZGlhdGlvbiBmaXhlcwogICAgICAgICAgICAgICAg ICBpbiB0aGUgU1NHIC0gc28sPGJyPgogICAgICAgICAgICAgICAgICCgIKAgSSBkaWQgdGhlIGZv bGxvd2luZzo8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDwvZGl2 PgogICAgICAgICAgICAgICAgoCCgIKAgoCAkIGxzIH4vL3NjYXAtc2VjdXJpdHktZ3VpZGUvUkhF TDYvaW5wdXQvY2hlY2tzLy8qLnhtbAogICAgICAgICAgICAgICAgfCBhd2sgJiMzOTt7CiAgICAg ICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgICAgoCCgIHByaW50ICQxIH0mIzM5 OyB8IHNlZCBzL1wuW15cLl0qJC8vICZndDsgfi9jaGVja3M8YnI+CiAgICAgICAgICAgICAgICA8 L2Rpdj4KICAgICAgICAgICAgICAgIKAgoCCgIKAgJCBscyB+Ly9zY2FwLXNlY3VyaXR5LWd1aWRl L1JIRUw2L2lucHV0L2ZpeGVzLy8qLnNoCiAgICAgICAgICAgICAgICB8IGF3ayAmIzM5O3sKICAg ICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICCgIKAgcHJpbnQgJDEgfSYj Mzk7IHwgc2VkIHMvXC5bXlwuXSokLy8gJmd0OyB+L2ZpeGVzPGJyPgogICAgICAgICAgICAgICAg ICCgIKAgoCCgICQgc2RpZmYgfi9maXhlcyB+L2NoZWNrcyB8IGxlc3M8YnI+CiAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgoCCgIFRoZXJlJiMzOTtzIGZhaXIgYSBiaXQg b2Ygd29yayB0byBiZSBkb25lIGZvciB0aGUgZml4CiAgICAgICAgICAgICAgICAgIHJlbWVkaWF0 aW9ucy4uLjxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICCgIKAg U2luY2UgSSYjMzk7bSBuZXcgdG8gdGhlIHByb2plY3QsIEkgd2FzIHdvbmRlcmluZyBpZgogICAg ICAgICAgICAgICAgICB0aGVyZSB3YXMgYW55PGJyPgogICAgICAgICAgICAgICAgICCgIKAgaWRl YXMgb3Igc3RhbmRhcmRzIHRvIGhvdyB0aGUgU1NHIHNob3VsZAogICAgICAgICAgICAgICAgICBk aXN0cmlidXRlIHNvbWUgb2YgdGhlc2U8YnI+CiAgICAgICAgICAgICAgICAgIKAgoCBmaXhlcyAt IGZvciBleGFtcGxlIC0gYSB3aG9sZXNhbGUgcmVwbGFjZW1lbnQgb2YKICAgICAgICAgICAgICAg ICAgdGhlIGF1ZGl0LnJ1bGVzPGJyPgogICAgICAgICAgICAgICAgICCgIKAgYW5kIGF1ZGl0ZC5j b25mIG1pZ2h0IGJlIHByZWZlcmFibGUgdGhhbiBkb2luZwogICAgICAgICAgICAgICAgICBwaWVj ZW1lYWwgc2VkJiMzOTtzLjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAg IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgoCCgIEl0JiMzOTtkIGJlIG9tZ3ogZWFzaWVyIHRvIGBjcAogICAgICAg ICAgICAgICAgL3Vzci9zaGFyZS9kb2MvYXVkaXQtKi9zdGlnLnJ1bGVzPGJyPgogICAgICAgICAg ICAgICAgoCCgIC9ldGMvYXVkaXQucnVsZXNgLCBhbmQgdGhhdCBsaWtlbHkgaXMgdGhlIHJpZ2h0 CiAgICAgICAgICAgICAgICBjaG9pY2UgZHVyaW5nIGFuPGJyPgogICAgICAgICAgICAgICAgoCCg IGluaXRpYWwgcHJvdmlzaW9uaW5nIHByb2Nlc3MuIEJ1dCB0aGVuIFN5c0FkbWlucwogICAgICAg ICAgICAgICAgdGFpbG9yIGF1ZGl0IHJ1bGVzLDxicj4KICAgICAgICAgICAgICAgIKAgoCB0aGUg c3lzdGVtIGV2b2x2ZXMsIGFuZCB3ZSBuZWVkIHRvIGV2YWx1YXRlIHRoZQogICAgICAgICAgICAg ICAgYXVkaXQucnVsZXMgZmlsZTxicj4KICAgICAgICAgICAgICAgIKAgoCBhZ2FpbnN0IHNwZWNp ZmljIGF1ZGl0aW5nIGd1aWRhbmNlIGl0ZW1zIGFmdGVyIHRoZQogICAgICAgICAgICAgICAgcHJp c3RpbmU8YnI+CiAgICAgICAgICAgICAgICCgIKAgYXVkaXQucnVsZXMgdGVtcGxhdGUgaXMgbWFu aXB1bGF0ZWQuPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgoCCgIFNv LCBpZiBhIHNpbmdsZSBydWxlIG11c3QgYmUgcmVtZWRpYXRlZCwgd2UgY2FuJiMzOTt0CiAgICAg ICAgICAgICAgICBibG93IGF3YXkgdGhlPGJyPgogICAgICAgICAgICAgICAgoCCgIHdob2xlIGF1 ZGl0LnJ1bGVzIGZpbGUuIFN1cGVyIGZ1biBzZWQgc2NyaXB0cyBpdCBpcwogICAgICAgICAgICAg ICAgPS88YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAg ICAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgSSB0aGluayB0aGF0IGF1Z2VhcyBpcyBhIGdvb2QgaWRl YS4goFdlIG5lZWQgdG8gYmUgY2FyZWZ1bAogICAgICAgICAgICB0aGF0IHJ1bGVzIHRoYXQgYXJl IGluc2VydGVkIGluIHRvIGF1ZGl0LnJ1bGVzIGhhcHBlbiBiZWZvcmUKICAgICAgICAgICAgYW55 ICYjMzk7LWUgMiYjMzk7IGxpbmUgKGlmIG9uZSBleGlzdHMpLiCgT3RoZXJ3aXNlIHRoZXkgd2ls bCBmYWlsCiAgICAgICAgICAgIHRvIGJlIGluc2VydGVkIGJlY2F1c2UgdGhlIGF1ZGl0IHJ1bGVz IGJlY29tZSBsb2NrZWQuPHNwYW4+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC1qb3NoPGJyPgogICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgLS0gPGJyPgogICAgICAgICAgICAgICAgPGEgaHJlZj0idGVsOjQw NC40MDcuNjYzMCIgdmFsdWU9IisxNDA0NDA3NjYzMCIgdGFyZ2V0PSJfYmxhbmsiPjQwNC40MDcu NjYzMDwvYT48YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9mb250Pjwv c3Bhbj48YnI+CiAgICAgICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fPGJyPgogICAgICAgICAgICBzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcg bGlzdDxicj4KICAgICAgICAgICAgPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJpdHktZ3Vp ZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CiAgICAgICAgICAgIDxhIGhyZWY9Imh0 dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJp dHktZ3VpZGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcv bWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KICAgICAgICAgICAg PGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIDwvZGl2PgogICAgICAgIDxicj4K ICAgICAgICA8YnIgY2xlYXI9ImFsbCI+CiAgICAgICAgPGRpdj48YnI+CiAgICAgICAgPC9kaXY+ CiAgICAgICAgLS0gPGJyPgogICAgICAgIFRyZXZvciBWYXVnaGFuPGJyPgogICAgICAgIFZpY2Ug UHJlc2lkZW50LCBPbnl4IFBvaW50LCBJbmM8YnI+CiAgICAgICAgPGEgaHJlZj0idGVsOiUyODQx MCUyOSUyMDU0MS02Njk5IiB2YWx1ZT0iKzE0MTA1NDE2Njk5IiB0YXJnZXQ9Il9ibGFuayI+KDQx MCkgNTQxLTY2OTk8L2E+PGJyPgogICAgICAgIDxhIGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4 cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+ CiAgICAgICAgPGJyPgogICAgICAgIC0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVu ZW5jcnlwdGVkIHByb3ByaWV0YXJ5CiAgICAgICAgaW5mb3JtYXRpb24gLS0KICAgICAgPC9kaXY+ CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0PjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAg PHByZT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzY2Fw LXNlY3VyaXR5LWd1aWRlIG1haWxpbmcgbGlzdAo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0 eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1 cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8YSBocmVmPSJodHRwczovL2xp c3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRl IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4v bGlzdGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT4KPC9wcmU+CiAgICA8L2Jsb2NrcXVvdGU+ CiAgICA8YnI+CiAgICA8YnI+CiAgICA8L2Rpdj48L2Rpdj48c3BhbiBjbGFzcz0iSE9FblpiIj48 Zm9udCBjb2xvcj0iIzg4ODg4OCI+PHByZSBjb2xzPSI3MiI+LS0gCkZyYW5rIENhdmlnZ2lhCkNv bnN1bHRhbnQsIFB1YmxpYyBTZWN0b3IKPGEgaHJlZj0ibWFpbHRvOmZjYXZpZ2dpQHJlZGhhdC5j b20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPgooTSkgPGEgaHJlZj0i dGVsOiUyODU3MSUyOSUyMDI5NS00NTYwIiB2YWx1ZT0iKzE1NzEyOTU0NTYwIiB0YXJnZXQ9Il9i bGFuayI+KDU3MSkgMjk1LTQ1NjA8L2E+PC9wcmU+CiAgPC9mb250Pjwvc3Bhbj48L2Rpdj4KCjxi cj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4Kc2Nh cC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNl Y3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVk b3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5m by9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPGJyPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+ PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGJyPjwvZGl2Pi0tIDxicj5UcmV2b3IgVmF1Z2hhbjxicj5W aWNlIFByZXNpZGVudCwgT255eCBQb2ludCwgSW5jPGJyPig0MTApIDU0MS02Njk5PGJyPjxhIGhy ZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIj50dmF1Z2hhbkBvbnl4cG9pbnQuY29t PC9hPjxicj48YnI+LS0gVGhpcyBhY2NvdW50IG5vdCBhcHByb3ZlZCBmb3IgdW5lbmNyeXB0ZWQg cHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gLS0KPC9kaXY+Cg== --===============1185804153976797727==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============6929903785088677886==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Fun with limits.conf Date: Sat, 05 Oct 2013 23:53:35 -0400 Message-ID: In-Reply-To: 5250D82E.6000005@redhat.com --===============6929903785088677886== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I just found the relevant code and have no worries. Thanks for the response! Trevor On Sat, Oct 5, 2013 at 11:25 PM, wrote: > Trevor, > > The hard and '-' (which sets both hard and soft) are the primary controls, > 'soft' is overruled by the 'hard' setting. > > That's why those are the most important to check. > > Regards, > > Frank > > > > > On 10/05/2013 09:35 PM, Trevor Vaughan wrote: > > Sorry for the double post. I just wanted to make sure that the presence of > the 'soft' line didn't throw an error. > > > On Sat, Oct 5, 2013 at 9:35 PM, Trevor Vaughan = wrote: > >> As a note, both: >> >> * - core 0 >> >> AND >> >> * hard core 0 >> * soft core 0 >> >> Should pass. >> >> Trevor >> >> >> On Mon, Sep 30, 2013 at 11:28 AM, wrote: >> >>> All, >>> >>> Most of the guidance for RHEL security has suggested setting the >>> following in /etc/security/limits.conf: >>> >>> * hard core 0 >>> >>> I have generally set this to: >>> >>> * - core 0 >>> >>> Because this sets both the hard and soft limits on the system. Most SCAP >>> scanners are looking for very specific values there. I'm looking at >>> modifying the checks to pass either 'hard' or '-' for the value. >>> >>> I'd also to fix the maxlogins in the rule (* >>> max_concurrent_login_sessions*) in /etc/security/limits.conf to look >>> for the DOD default (10) and lower to satisfy the check. Security stand= ards >>> are there as a baseline, why 'fail' the setting for exceeding the basel= ine >>> value? >>> >>> Regards, >>> >>> Frank Caviggia >>> >>> -- >>> Frank Caviggia >>> Consultant, Public Sectorfcaviggi(a)redhat.com >>> (M) (571) 295-4560 >>> >>> >>> _______________________________________________ >>> scap-security-guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >>> >>> >> >> >> -- >> Trevor Vaughan >> Vice President, Onyx Point, Inc >> (410) 541-6699 >> tvaughan(a)onyxpoint.com >> >> -- This account not approved for unencrypted proprietary information -- >> > > > > -- > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan(a)onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- > > > > -- > Frank Caviggia > Consultant, Public Sectorfcaviggi(a)redhat.com > (M) (571) 295-4560 > > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============6929903785088677886== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SSBqdXN0IGZvdW5kIHRoZSByZWxldmFudCBjb2RlIGFuZCBoYXZlIG5v IHdvcnJpZXMuPGRpdj48YnI+PC9kaXY+PGRpdj5UaGFua3MgZm9yIHRoZSByZXNwb25zZSE8L2Rp dj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRyZXZvcjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWls X2V4dHJhIj48YnI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBTYXQsIE9jdCA1LCAy MDEzIGF0IDExOjI1IFBNLCAgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86ZmNh dmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+ Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0 eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5n LWxlZnQ6MWV4Ij4KICAKICAgIAogIAogIDxkaXYgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAw MDAwMCI+CiAgICA8ZGl2PlRyZXZvciw8YnI+CiAgICAgIDxicj4KICAgICAgVGhlIGhhcmQgYW5k ICYjMzk7LSYjMzk7ICh3aGljaCBzZXRzIGJvdGggaGFyZCBhbmQgc29mdCkgYXJlIHRoZSBwcmlt YXJ5CiAgICAgIGNvbnRyb2xzLCAmIzM5O3NvZnQmIzM5OyBpcyBvdmVycnVsZWQgYnkgdGhlICYj Mzk7aGFyZCYjMzk7IHNldHRpbmcuPGJyPgogICAgICA8YnI+CiAgICAgIFRoYXQmIzM5O3Mgd2h5 IHRob3NlIGFyZSB0aGUgbW9zdCBpbXBvcnRhbnQgdG8gY2hlY2suPGJyPgogICAgICA8YnI+CiAg ICAgIFJlZ2FyZHMsPGJyPgogICAgICA8YnI+CiAgICAgIEZyYW5rPGRpdj48ZGl2IGNsYXNzPSJo NSI+PGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICBPbiAxMC8wNS8y MDEzIDA5OjM1IFBNLCBUcmV2b3IgVmF1Z2hhbiB3cm90ZTo8YnI+CiAgICA8L2Rpdj48L2Rpdj48 L2Rpdj48ZGl2PjxkaXYgY2xhc3M9Img1Ij4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgog ICAgICA8ZGl2IGRpcj0ibHRyIj5Tb3JyeSBmb3IgdGhlIGRvdWJsZSBwb3N0LiBJIGp1c3Qgd2Fu dGVkIHRvIG1ha2UKICAgICAgICBzdXJlIHRoYXQgdGhlIHByZXNlbmNlIG9mIHRoZSAmIzM5O3Nv ZnQmIzM5OyBsaW5lIGRpZG4mIzM5O3QgdGhyb3cgYW4gZXJyb3IuPC9kaXY+CiAgICAgIDxkaXYg Y2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+CiAgICAgICAgPGJyPgogICAgICAgIDxkaXYgY2xhc3M9 ImdtYWlsX3F1b3RlIj5PbiBTYXQsIE9jdCA1LCAyMDEzIGF0IDk6MzUgUE0sIFRyZXZvcgogICAg ICAgICAgVmF1Z2hhbiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzp0dmF1Z2hh bkBvbnl4cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwv YT4mZ3Q7PC9zcGFuPgogICAgICAgICAgd3JvdGU6PGJyPgogICAgICAgICAgPGJsb2NrcXVvdGUg Y2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6 MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgICAgICAgICAgIDxkaXYgZGlyPSJs dHIiPkFzIGEgbm90ZSwgYm90aDoKICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAg ICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2PiogoC0goGNvcmUgoDA8L2Rpdj4KICAgICAgICAg ICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2PkFO RDwvZGl2PgogICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICAqIKBoYXJkIKBjb3JlIDA8L2Rpdj4KICAg ICAgICAgICAgICA8ZGl2PiogoHNvZnQgoCBjb3JlIDA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2 Pjxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2PlNob3VsZCBwYXNz LjwvZGl2PgogICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICBUcmV2b3I8L2Rpdj4KICAgICAgICAgICAg PC9kaXY+CiAgICAgICAgICAgIDxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+CiAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj4KICAgICAg ICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+T24gTW9uLCBTZXAgMzAsIDIw MTMgYXQgMTE6MjggQU0sIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOmZjYXZp Z2dpQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5mY2F2aWdnaUByZWRoYXQuY29tPC9hPiZn dDs8L3NwYW4+CiAgICAgICAgICAgICAgICAgICAgd3JvdGU6PGJyPgogICAgICAgICAgICAgICAg ICA8L2Rpdj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxl ZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+CiAgICAgICAgICAgICAgICAgIDxk aXY+CiAgICAgICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgICAgICAgIDxkaXYg Ymdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAwMDAwMCI+IEFsbCw8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgTW9zdCBvZiB0aGUgZ3VpZGFu Y2UgZm9yIFJIRUwgc2VjdXJpdHkgaGFzCiAgICAgICAgICAgICAgICAgICAgICAgIHN1Z2dlc3Rl ZCBzZXR0aW5nIHRoZSBmb2xsb3dpbmcgaW4KICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9z ZWN1cml0eS9saW1pdHMuY29uZjo8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgoKCgIKCgoCAqoKCgIGhhcmSgoKAgY29yZaCgoCAwPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEkgaGF2 ZSBnZW5lcmFsbHkgc2V0IHRoaXMgdG86PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIKCgoCCgoKAgKqCgoCAtIKCgIGNvcmWgoKAgMDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBCZWNh dXNlIHRoaXMgc2V0cyBib3RoIHRoZSBoYXJkIGFuZCBzb2Z0IGxpbWl0cwogICAgICAgICAgICAg ICAgICAgICAgICBvbiB0aGUgc3lzdGVtLiBNb3N0IFNDQVAgc2Nhbm5lcnMgYXJlIGxvb2tpbmcK ICAgICAgICAgICAgICAgICAgICAgICAgZm9yIHZlcnkgc3BlY2lmaWMgdmFsdWVzIHRoZXJlLqAg SSYjMzk7bSBsb29raW5nIGF0CiAgICAgICAgICAgICAgICAgICAgICAgIG1vZGlmeWluZyB0aGUg Y2hlY2tzIHRvIHBhc3MgZWl0aGVyICYjMzk7aGFyZCYjMzk7IG9yCiAgICAgICAgICAgICAgICAg ICAgICAgICYjMzk7LSYjMzk7IGZvciB0aGUgdmFsdWUuPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEkmIzM5O2QgYWxzbyB0byBmaXggdGhl IG1heGxvZ2lucyBpbiB0aGUgcnVsZSAoPHN0cm9uZz5tYXhfY29uY3VycmVudF9sb2dpbl9zZXNz aW9uczwvc3Ryb25nPikKICAgICAgICAgICAgICAgICAgICAgICAgaW4gL2V0Yy9zZWN1cml0eS9s aW1pdHMuY29uZiB0byBsb29rIGZvciB0aGUgRE9ECiAgICAgICAgICAgICAgICAgICAgICAgIGRl ZmF1bHQgKDEwKSBhbmQgbG93ZXIgdG8gc2F0aXNmeSB0aGUgY2hlY2suCiAgICAgICAgICAgICAg ICAgICAgICAgIFNlY3VyaXR5IHN0YW5kYXJkcyBhcmUgdGhlcmUgYXMgYSBiYXNlbGluZSwgd2h5 CiAgICAgICAgICAgICAgICAgICAgICAgICYjMzk7ZmFpbCYjMzk7IHRoZSBzZXR0aW5nIGZvciBl eGNlZWRpbmcgdGhlIGJhc2VsaW5lCiAgICAgICAgICAgICAgICAgICAgICAgIHZhbHVlPzxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBSZWdh cmRzLDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICBGcmFuayBDYXZpZ2dpYTxzcGFuPjxmb250IGNvbG9yPSIjODg4ODg4Ij48YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 cHJlIGNvbHM9IjcyIj4tLSAKRnJhbmsgQ2F2aWdnaWEKQ29uc3VsdGFudCwgUHVibGljIFNlY3Rv cgo8YSBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmZj YXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSA8YSBocmVmPSJ0ZWw6JTI4NTcxJTI5JTIwMjk1LTQ1 NjAiIHZhbHVlPSIrMTU3MTI5NTQ1NjAiIHRhcmdldD0iX2JsYW5rIj4oNTcxKSAyOTUtNDU2MDwv YT48L3ByZT4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2ZvbnQ+PC9zcGFuPjwvZGl2Pgog ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4KICAgICAgICAgICAgICAgICAg ICBzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxpbmcgbGlzdDxicj4KICAgICAgICAgICAgICAgICAg ICA8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0 ZWQub3JnPC9hPjxicj4KICAgICAgICAgICAgICAgICAgICA8YSBocmVmPSJodHRwczovL2xpc3Rz LmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlz dGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8c3Bhbj48Zm9udCBjb2xvcj0iIzg4 ODg4OCI+PGJyPgogICAgICAgICAgICAgICAgICA8YnIgY2xlYXI9ImFsbCI+CiAgICAgICAgICAg ICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAg ICAgLS0gPGJyPgogICAgICAgICAgICAgICAgICBUcmV2b3IgVmF1Z2hhbjxicj4KICAgICAgICAg ICAgICAgICAgVmljZSBQcmVzaWRlbnQsIE9ueXggUG9pbnQsIEluYzxicj4KICAgICAgICAgICAg ICAgICAgPGEgaHJlZj0idGVsOiUyODQxMCUyOSUyMDU0MS02Njk5IiB2YWx1ZT0iKzE0MTA1NDE2 Njk5IiB0YXJnZXQ9Il9ibGFuayI+KDQxMCkgNTQxLTY2OTk8L2E+PGJyPgogICAgICAgICAgICAg ICAgICA8YSBocmVmPSJtYWlsdG86dHZhdWdoYW5Ab255eHBvaW50LmNvbSIgdGFyZ2V0PSJfYmxh bmsiPnR2YXVnaGFuQG9ueXhwb2ludC5jb208L2E+PGJyPgogICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgIC0tIFRoaXMgYWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVuZW5j cnlwdGVkCiAgICAgICAgICAgICAgICAgIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIC0tCiAgICAg ICAgICAgICAgICA8L2ZvbnQ+PC9zcGFuPjwvZGl2PgogICAgICAgICAgPC9ibG9ja3F1b3RlPgog ICAgICAgIDwvZGl2PgogICAgICAgIDxicj4KICAgICAgICA8YnIgY2xlYXI9ImFsbCI+CiAgICAg ICAgPGRpdj48YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAgLS0gPGJyPgogICAgICAgIFRyZXZv ciBWYXVnaGFuPGJyPgogICAgICAgIFZpY2UgUHJlc2lkZW50LCBPbnl4IFBvaW50LCBJbmM8YnI+ CiAgICAgICAgPGEgaHJlZj0idGVsOiUyODQxMCUyOSUyMDU0MS02Njk5IiB2YWx1ZT0iKzE0MTA1 NDE2Njk5IiB0YXJnZXQ9Il9ibGFuayI+KDQxMCkgNTQxLTY2OTk8L2E+PGJyPgogICAgICAgIDxh IGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+dHZh dWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+CiAgICAgICAgPGJyPgogICAgICAgIC0tIFRoaXMg YWNjb3VudCBub3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkIHByb3ByaWV0YXJ5CiAgICAgICAg aW5mb3JtYXRpb24gLS0KICAgICAgPC9kaXY+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAg ICA8YnI+CiAgICA8cHJlIGNvbHM9IjcyIj4tLSAKRnJhbmsgQ2F2aWdnaWEKQ29uc3VsdGFudCwg UHVibGljIFNlY3Rvcgo8YSBocmVmPSJtYWlsdG86ZmNhdmlnZ2lAcmVkaGF0LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmZjYXZpZ2dpQHJlZGhhdC5jb208L2E+CihNKSA8YSBocmVmPSJ0ZWw6JTI4NTcx JTI5JTIwMjk1LTQ1NjAiIHZhbHVlPSIrMTU3MTI5NTQ1NjAiIHRhcmdldD0iX2JsYW5rIj4oNTcx KSAyOTUtNDU2MDwvYT48L3ByZT4KICA8L2Rpdj48L2Rpdj48L2Rpdj4KCjwvYmxvY2txdW90ZT48 L2Rpdj48YnI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGJyPjwvZGl2Pi0tIDxicj5UcmV2b3IgVmF1 Z2hhbjxicj5WaWNlIFByZXNpZGVudCwgT255eCBQb2ludCwgSW5jPGJyPig0MTApIDU0MS02Njk5 PGJyPjxhIGhyZWY9Im1haWx0bzp0dmF1Z2hhbkBvbnl4cG9pbnQuY29tIj50dmF1Z2hhbkBvbnl4 cG9pbnQuY29tPC9hPjxicj48YnI+LS0gVGhpcyBhY2NvdW50IG5vdCBhcHByb3ZlZCBmb3IgdW5l bmNyeXB0ZWQgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24gLS0KPC9kaXY+Cg== --===============6929903785088677886==-- From kseifried at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============2996208993598222047==" MIME-Version: 1.0 From: Kurt Seifried To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sat, 05 Oct 2013 22:29:08 -0600 Message-ID: <5250E714.9080900@redhat.com> In-Reply-To: CANs+FoVOWzx7AG0rDZLeB4T00A+oyAZsDDgzwB47WQKgVk+VOg@mail.gmail.com --===============2996208993598222047== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Putting my cloud hat on: You shouldn't build reliable servers. You should build reliable services. Mind. blown. let that sink it. ;) - -- = Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSUOcUAAoJEBYNRVNeJnmTdWwP/1RvWsDS/LWJhOy2ZS5yNDyp O7IFBQVHkvFNBuXEh9UBiVLaEFPIdG2ezbnzamF/hLtvzFFWmw51UQNAW1NEtrG/ 0GzO7eKoAM/W+ig5uZXQu+FVgQVuZJsh/lCDjMknSeAWEjc4WJU4dcJDaNkQi4iE QGapldcCdq8y3HlY3pGdYjXJ+DezNufw5NPqSZGJlmjs6QSGDpu5o6Ve6j4SWYl3 A4YsGsEjwGjeUb9mUKQn2yoxwbFx3sOat6ploA1yly/0teOwDwh+ayJQ0fIT5usW REbnIoMoXIvmlC4YlIRQb99pZU1M0YYYtXR05azDURfmeUZPjriaSiI7CDSWJpBN yXQiXoTiRkO04uBjgaDQtfUqiZewP3WKrrj3tmsO6wa9mjXxW11mP38KR7PqqVI8 eKnzXP1QoJKNrTIlza5cbFgFw10wOZLDWDA5DckFY8Lgd5WxHaHbotXr2SenHwJk w7kNQH6CQlgB0cP6irU+RUNRjD9eWcKfjay8kspYeJbMY2hDuzfFrgeoreGFyHGI SG7TxaG68sy3C8knRSkaWz/UigFsXSHQPi5ZWi/rbK1EUXGUOylRXUm1yXmlxJxs 2GVungRGku54yEgS+4xiQ3x5I5XJxt7APl4+8bqrgqBZvPuoQGJuY1PClNLkCC4v DwSvawFa/Xw6y/kd8N4i =3DuZx5 -----END PGP SIGNATURE----- --===============2996208993598222047==-- From tvaughan at onyxpoint.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============1488318583646646118==" MIME-Version: 1.0 From: Trevor Vaughan To: scap-security-guide at lists.fedorahosted.org Subject: Re: Checks vs. Fixes Date: Sun, 06 Oct 2013 10:00:04 -0400 Message-ID: In-Reply-To: 5250E714.9080900@redhat.com --===============1488318583646646118== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Heh, pass your cloud hat to my customers and I'll buy you lunch. Until then..... On Sun, Oct 6, 2013 at 12:29 AM, Kurt Seifried wro= te: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Putting my cloud hat on: > > You shouldn't build reliable servers. > > You should build reliable services. > > Mind. blown. let that sink it. ;) > > - -- > Kurt Seifried Red Hat Security Response Team (SRT) > PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.14 (GNU/Linux) > > iQIcBAEBAgAGBQJSUOcUAAoJEBYNRVNeJnmTdWwP/1RvWsDS/LWJhOy2ZS5yNDyp > O7IFBQVHkvFNBuXEh9UBiVLaEFPIdG2ezbnzamF/hLtvzFFWmw51UQNAW1NEtrG/ > 0GzO7eKoAM/W+ig5uZXQu+FVgQVuZJsh/lCDjMknSeAWEjc4WJU4dcJDaNkQi4iE > QGapldcCdq8y3HlY3pGdYjXJ+DezNufw5NPqSZGJlmjs6QSGDpu5o6Ve6j4SWYl3 > A4YsGsEjwGjeUb9mUKQn2yoxwbFx3sOat6ploA1yly/0teOwDwh+ayJQ0fIT5usW > REbnIoMoXIvmlC4YlIRQb99pZU1M0YYYtXR05azDURfmeUZPjriaSiI7CDSWJpBN > yXQiXoTiRkO04uBjgaDQtfUqiZewP3WKrrj3tmsO6wa9mjXxW11mP38KR7PqqVI8 > eKnzXP1QoJKNrTIlza5cbFgFw10wOZLDWDA5DckFY8Lgd5WxHaHbotXr2SenHwJk > w7kNQH6CQlgB0cP6irU+RUNRjD9eWcKfjay8kspYeJbMY2hDuzfFrgeoreGFyHGI > SG7TxaG68sy3C8knRSkaWz/UigFsXSHQPi5ZWi/rbK1EUXGUOylRXUm1yXmlxJxs > 2GVungRGku54yEgS+4xiQ3x5I5XJxt7APl4+8bqrgqBZvPuoQGJuY1PClNLkCC4v > DwSvawFa/Xw6y/kd8N4i > =3DuZx5 > -----END PGP SIGNATURE----- > -- = Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information -- --===============1488318583646646118== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SGVoLCBwYXNzIHlvdXIgY2xvdWQgaGF0IHRvIG15IGN1c3RvbWVycyBh bmQgSSYjMzk7bGwgYnV5IHlvdSBsdW5jaC48ZGl2Pjxicj48L2Rpdj48ZGl2PlVudGlsIHRoZW4u Li4uLjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGJyPjxkaXYgY2xh c3M9ImdtYWlsX3F1b3RlIj5PbiBTdW4sIE9jdCA2LCAyMDEzIGF0IDEyOjI5IEFNLCBLdXJ0IFNl aWZyaWVkIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOmtzZWlmcmllZEByZWRo YXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+a3NlaWZyaWVkQHJlZGhhdC5jb208L2E+Jmd0Ozwvc3Bh bj4gd3JvdGU6PGJyPgo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4 Ij48ZGl2IGNsYXNzPSJpbSI+LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLTxicj4K SGFzaDogU0hBMTxicj4KPGJyPgo8L2Rpdj5QdXR0aW5nIG15IGNsb3VkIGhhdCBvbjo8YnI+Cjxi cj4KWW91IHNob3VsZG4mIzM5O3QgYnVpbGQgcmVsaWFibGUgc2VydmVycy48YnI+Cjxicj4KWW91 IHNob3VsZCBidWlsZCByZWxpYWJsZSBzZXJ2aWNlcy48YnI+Cjxicj4KTWluZC4gYmxvd24uIGxl dCB0aGF0IHNpbmsgaXQuIDspPGJyPgo8ZGl2IGNsYXNzPSJpbSI+PGJyPgotIC0tPGJyPgpLdXJ0 IFNlaWZyaWVkIFJlZCBIYXQgU2VjdXJpdHkgUmVzcG9uc2UgVGVhbSAoU1JUKTxicj4KUEdQOiAw eDVFMjY3OTkzIEE5MEIgRjk5NSA3MzUwIDE0OEYgNjZCRiA3NTU0IDE2MEQgNDU1MyA1RTI2IDc5 OTM8YnI+Ci0tLS0tQkVHSU4gUEdQIFNJR05BVFVSRS0tLS0tPGJyPgpWZXJzaW9uOiBHbnVQRyB2 MS40LjE0IChHTlUvTGludXgpPGJyPgo8YnI+CjwvZGl2PmlRSWNCQUVCQWdBR0JRSlNVT2NVQUFv SkVCWU5SVk5lSm5tVGRXd1AvMVJ2V3NEUy9MV0poT3kyWlM1eU5EeXA8YnI+Ck83SUZCUVZIa3ZG TkJ1WEVoOVVCaVZMYUVGUElkRzJlemJuemFtRi9oTHR2ekZGV213NTFVUU5BVzFORXRyRy88YnI+ CjBHek83ZUtvQU0vVytpZzV1WlhRdStGVmdRVnVaSnNoL2xDRGpNa25TZUFXRWpjNFdKVTRkY0pE YU5rUWk0aUU8YnI+ClFHYXBsZGNDZHE4eTNIbFkzcEdkWWpYSitEZXpOdWZ3NU5QcVNaR0psbWpz NlFTR0RwdTVvNlZlNmo0U1dZbDM8YnI+CkE0WXNHc0Vqd0dqZVViOW1VS1FuMnlveHdiRngzc09h dDZwbG9BMXlseS8wdGVPd0R3aCtheUpRMGZJVDV1c1c8YnI+ClJFYm5Jb01vWEl2bWxDNFlsSVJR Yjk5cFpVMU0wWVlZdFhSMDVhekRVUmZtZVVaUGpyaWFTaUk3Q0RTV0pwQk48YnI+CnlYUWlYb1Rp UmtPMDR1QmpnYURRdGZVcWlaZXdQM1dLcnJqM3Rtc082d2E5bWpYeFcxMW1QMzhLUjdQcXFWSTg8 YnI+CmVLbnpYUDFRb0pLTnJUSWx6YTVjYkZnRncxMHdPWkxEV0RBNURja0ZZOExnZDVXeEhhSGJv dFhyMlNlbkh3Sms8YnI+Cnc3a05RSDZDUWxnQjBjUDZpclUrUlVOUmpEOWVXY0tmamF5OGtzcFll SmJNWTJoRHV6ZkZyZ2VvcmVHRnlIR0k8YnI+ClNHN1R4YUc2OHN5M0M4a25SU2thV3ovVWlnRnNY U0hRUGk1WldpL3JiSzFFVVhHVU95bFJYVW0xeVhtbHhKeHM8YnI+CjJHVnVuZ1JHa3U1NHlFZ1Mr NHhpUTN4NUk1WEp4dDdBUGw0KzhicXJncUJadlB1b1FHSnVZMVBDbE5Ma0NDNHY8YnI+CkR3U3Zh d0ZhL1h3Nnkva2Q4TjRpPGJyPgo9dVp4NTxicj4KLS0tLS1FTkQgUEdQIFNJR05BVFVSRS0tLS0t PGJyPgo8L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjxiciBjbGVhcj0iYWxsIj48ZGl2Pjxicj48L2Rp dj4tLSA8YnI+VHJldm9yIFZhdWdoYW48YnI+VmljZSBQcmVzaWRlbnQsIE9ueXggUG9pbnQsIElu Yzxicj4oNDEwKSA1NDEtNjY5OTxicj48YSBocmVmPSJtYWlsdG86dHZhdWdoYW5Ab255eHBvaW50 LmNvbSI+dHZhdWdoYW5Ab255eHBvaW50LmNvbTwvYT48YnI+PGJyPi0tIFRoaXMgYWNjb3VudCBu b3QgYXBwcm92ZWQgZm9yIHVuZW5jcnlwdGVkIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uIC0tCjwv ZGl2Pgo= --===============1488318583646646118==-- From shawn at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============5537779992689947497==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Sun, 06 Oct 2013 22:40:48 -0400 Message-ID: <52521F30.6010804@redhat.com> In-Reply-To: 5250394B.9060902@redhat.com --===============5537779992689947497== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/5/13 12:07 PM, fcaviggi(a)redhat.com wrote: > Shawn, > > If these files exist and contain '1': > > '/selinux/enforce' - RHEL 6 > '/sys/fs/selinux/enforce' - Fedora 19 > > Then SELinux is enabled and enforcing - the filesystem can only exist = > if SELinux is enabled, the contents are the enforcement status. So then, should we update the existing SELinux OVAL to check for both = the static /etc/selinux/config *and* runtime /selinux/enforce values? --===============5537779992689947497==-- From shawn at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============4697630101271762338==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Introduction Date: Sun, 06 Oct 2013 22:56:58 -0400 Message-ID: <525222FA.8050405@redhat.com> In-Reply-To: F7D6A12B572935439E34065CFADC851CEB39CD5BB5@EXCHMBB.ornl.gov --===============4697630101271762338== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/3/13 8:03 AM, Cooper, Caleb D. wrote: > > Hello everyone, > > I have been working with the SSG for the last few months and am now = > confident enough to start contributing (assuming I can figure this git = > stuff out). I look forward to working with you all and improving this = > project. > > Thanks for having me. > > Caleb Cooper > Welcome, and thanks for jumping in so quickly with patches! --===============4697630101271762338== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8zLzEzIDg6MDMgQU0sIENvb3BlciwgQ2FsZWIgRC4KICAgICAgd3JvdGU6PGJyPgog ICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6RjdENkExMkI1NzI5MzU0 MzlFMzQwNjVDRkFEQzg1MUNFQjM5Q0Q1QkI1QEVYQ0hNQkIub3JubC5nb3YiCiAgICAgIHR5cGU9 ImNpdGUiPgogICAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRl eHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CiAgICAgIDxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29u dGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkCiAgICAgICAgbWVkaXVtKSI+CiAgICAg IDxzdHlsZT48IS0tCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8KQGZvbnQtZmFjZQoJe2ZvbnQtZmFt aWx5OkNhbGlicmk7CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9Ci8qIFN0eWxlIERl ZmluaXRpb25zICovCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwKCXtt YXJnaW46MGluOwoJbWFyZ2luLWJvdHRvbTouMDAwMXB0OwoJZm9udC1zaXplOjExLjBwdDsKCWZv bnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7fQphOmxpbmssIHNwYW4uTXNvSHlwZXJs aW5rCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5OwoJY29sb3I6Ymx1ZTsKCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQKCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7Cgljb2xvcjpwdXJwbGU7Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30Kc3Bhbi5FbWFpbFN0eWxlMTcKCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3Nl OwoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsKCWNvbG9yOndpbmRvd3RleHQ7 fQouTXNvQ2hwRGVmYXVsdAoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5OwoJZm9udC1mYW1p bHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjt9CkBwYWdlIFdvcmRTZWN0aW9uMQoJe3NpemU6OC41 aW4gMTEuMGluOwoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30KZGl2LldvcmRTZWN0 aW9uMQoJe3BhZ2U6V29yZFNlY3Rpb24xO30KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+CjxvOnNoYXBlbGF5b3V0IHY6 ZXh0PSJlZGl0Ij4KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+CjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4KICAgICAgPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4K ICAgICAgICA8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxsbyBldmVyeW9uZSw8bzpwPjwvbzpwPjwv cD4KICAgICAgICA8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPsKgPC9vOnA+PC9wPgogICAgICAg IDxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSBiZWVuIHdvcmtpbmcgd2l0aCB0aGUgU1NHIGZv ciB0aGUKICAgICAgICAgIGxhc3QgZmV3IG1vbnRocyBhbmQgYW0gbm93IGNvbmZpZGVudCBlbm91 Z2ggdG8gc3RhcnQKICAgICAgICAgIGNvbnRyaWJ1dGluZyAoYXNzdW1pbmcgSSBjYW4gZmlndXJl IHRoaXMgZ2l0IHN0dWZmIG91dCkuIEkKICAgICAgICAgIGxvb2sgZm9yd2FyZCB0byB3b3JraW5n IHdpdGggeW91IGFsbCBhbmQgaW1wcm92aW5nIHRoaXMKICAgICAgICAgIHByb2plY3QuPG86cD48 L286cD48L3A+CiAgICAgICAgPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD7CoDwvbzpwPjwvcD4K ICAgICAgICA8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgZm9yIGhhdmluZyBtZS48bzpwPjwv bzpwPjwvcD4KICAgICAgICA8cCBjbGFzcz0iTXNvTm9ybWFsIj5DYWxlYiBDb29wZXI8L3A+CiAg ICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgV2VsY29tZSwgYW5kIHRo YW5rcyBmb3IganVtcGluZyBpbiBzbyBxdWlja2x5IHdpdGggcGF0Y2hlcyE8YnI+CiAgPC9ib2R5 Pgo8L2h0bWw+Cg== --===============4697630101271762338==-- From jlieskov at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============9025650779970495057==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Mon, 07 Oct 2013 05:03:30 -0400 Message-ID: <135855796.2061866.1381136610455.JavaMail.root@redhat.com> In-Reply-To: 524F0DBC.8010704@redhat.com --===============9025650779970495057== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello Frank, thank you for your reply. > Jan, > = > You might consider checking if the '/selinux/enforce' file exists and the > file contains '1' (1 is enforcing). That would ensure that SELinux enabled > and enforcing the policy. I intentionally wanted to avoid checking of some explicit file location (du= e the reason the location would change - as it did already), and rather wanted to= check runtime kernel in the way libselinux is doing in init_selinuxmnt(): [1] https://android.googlesource.com/platform/external/libselinux/+/maste= r/src/init.c = The test should check only if current kernel has SELinux loaded - there wil= l be dedicated test for checking if SELinux is enforcing due reasons i will ment= ion later. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > Regards, > = > Frank Caviggia > = > = > On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: > = > = > = > Introduce new SELinux section of the guide and first rule > for it - check if SELinux is enabled in currently > booted kernel. > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > = > _______________________________________________ > scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted= .org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > = > = > -- > Frank Caviggia > Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============9025650779970495057==-- From jlieskov at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============7914821701949454939==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Mon, 07 Oct 2013 05:05:10 -0400 Message-ID: <966342565.2062287.1381136710823.JavaMail.root@redhat.com> In-Reply-To: 524F0F28.2070204@redhat.com --===============7914821701949454939== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable > Jan, > = > Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's > '/sys/fs/selinux/enforce' Yeah, that's why i would rather test just if current kernel has selinuxfs loaded / mounted, without exact file location. Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies > = > -Frank > = > = > On 10/04/2013 02:49 PM, fcaviggi(a)redhat.com wrote: > = > = > = > Jan, > = > You might consider checking if the '/selinux/enforce' file exists and the > file contains '1' (1 is enforcing). That would ensure that SELinux enabled > and enforcing the policy. > = > Regards, > = > Frank Caviggia > = > = > On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: > = > = > = > Introduce new SELinux section of the guide and first rule > for it - check if SELinux is enabled in currently > booted kernel. > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > = > _______________________________________________ > scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted= .org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > = > = > -- > Frank Caviggia > Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 > = > = > _______________________________________________ > scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted= .org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > = > = > -- > Frank Caviggia > Consultant, Public Sector fcaviggi(a)redhat.com (M) (571) 295-4560 > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============7914821701949454939==-- From jlieskov at redhat.com Thu Aug 20 11:35:28 2015 Content-Type: multipart/mixed; boundary="===============2411676979866653852==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Mon, 07 Oct 2013 05:27:28 -0400 Message-ID: <375332117.2071126.1381138048361.JavaMail.root@redhat.com> In-Reply-To: 524F81A0.6030005@redhat.com --===============2411676979866653852== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Shawn, Frank, > Jan, > = > Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's > '/sys/fs/selinux/enforce' > = > -Frank > = > = > On 10/04/2013 02:49 PM, fcaviggi(a)redhat.com wrote: > = > = > = > Jan, > = > You might consider checking if the '/selinux/enforce' file exists and the > file contains '1' (1 is enforcing). That would ensure that SELinux enabled > and enforcing the policy. > = > Regards, > = > Frank Caviggia > = > = > On 10/04/2013 01:11 PM, Jan Lieskovsky wrote: > = > = > = > Introduce new SELinux section of the guide and first rule > for it - check if SELinux is enabled in currently > booted kernel. > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > = > Within the OVAL: > = > + comment=3D"check for existence of selinuxfs in /proc/mounts file" > id=3D"test_ensure_selinuxfs_in_proc_mounts" version=3D"1" > > + > + > + version=3D"1"> > + /proc/mounts > + match">^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\= s*$ > + 1 > + > = > = > Caviggia and I were chatting earlier today.... while the /proc/mounts > reflects that selinux is loaded into the kernel, IIRC, it doesn't indicate > that it's actually *enforcing* on the system. That proposed test should truly only check if SELinux is loaded in the curr= ently running kernel (there will be another rule for checking if SELinux is in en= forcing state yet). The reason for separation is as follows: Y * SELinux completely disabled? =3D=3D=3D=3D> fix / remediate it by settin= g SELINUX in /etc/selinux/config to 'enforcing' value [fix the config= ] and export the "reboot" variable - ensure the reboot is need= ed [fix the next running environment] Y * SELinux is in permissive mode? =3D=3D=3D=3D> fix / remediate it by settin= g SELINUX in /etc/selinux/config to 'enforcing' value [fix the confid= ] and also call 'setenforce 1' in user space [fix the= actual running environment] = > This poses an interesting > challenge... > = > Within the RHEL6 content, we: > - Check for selinux=3D1 within grub This is OK for default boot command line form, but can't ensure user / admi= n didn't provide selinux=3D0 on the kernel command line. > - Check for SELINUX=3Denforcing within /etc/selinux/config Again OK. But checks only configuration (again user / admin could do 'enfor= cing=3D0' on the command line and configuration wouldn't have impact on it). > = > These checks do not reflect *runtime* enablement of SELinux, but > unfortunately neither does /proc/mounts: Based on libselinux, and should only check if SELinux file system is loaded= in the currently booted kernel. For enforcing there will be another test (above). > = > = > [shawn(a)SSG-RHEL6 checks]$ getenforce > Enforcing > = > [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux > none /selinux selinuxfs rw,relatime 0 0 > = > [shawn(a)SSG-RHEL6 checks]$ sudo setenforce 0 > [sudo] password for shawn: > = > [shawn(a)SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux > none /selinux selinuxfs rw,relatime 0 0 Is there another crafty way to ve= rify > that selinux is *enforcing*? Perhaps checking the value in /etc/selinux > instead? To split into subcases, i think there are two scenarios to check: * in the configuration: - is enabled / is enforcing? =3D> check /etc/selinux/config * in the runtime: - is enabled? (IOW check if selinux=3D0/enforcing=3D0 wasn't provided on = the kernel command line) =3D> check if selinuxfs is mounted - is enforcing? - like Frank mentioned already, check /sys/fs/selinux/enf= orcing: # cat /sys/fs/selinux/enforce ; echo 1 # getenforce Enforcing # setenforce 0 # cat /sys/fs/selinux/enforce ; echo 0 The question is what should SSG check (if the system configuration is sane?= , if the running instance is safe?, or both?). If both, then we need to check all four cases. > = > = > [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce > 1 > [shawn(a)SSG-RHEL6 self]$ sudo setenforce 0 > = > [shawn(a)SSG-RHEL6 self]$ cat /selinux/enforce > 0 If that's a non-reputable source of SELinux enablement, we should add an > appropriate XCCDF and OVAL rule to Fedora & RHEL streams. Like Frank already pointed out, on RHEL-6 the selinuxfs would be placed und= er /selinux, therefore we should check /selinux/enforcing (=3D1 for enforcing,= =3D0 for permissive) for RHEL-6. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============2411676979866653852==-- From jlieskov at redhat.com Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============0007618800237869349==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Mon, 07 Oct 2013 05:32:33 -0400 Message-ID: <74336564.2072247.1381138353884.JavaMail.root@redhat.com> In-Reply-To: 52521F30.6010804@redhat.com --===============0007618800237869349== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Shawn, > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Monday, October 7, 2013 4:40:48 AM > Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in C= urrently Running Kernel' rule > = > On 10/5/13 12:07 PM, fcaviggi(a)redhat.com wrote: > > Shawn, > > > > If these files exist and contain '1': > > > > '/selinux/enforce' - RHEL 6 > > '/sys/fs/selinux/enforce' - Fedora 19 > > > > Then SELinux is enabled and enforcing - the filesystem can only exist > > if SELinux is enabled, the contents are the enforcement status. > = > So then, should we update the existing SELinux OVAL to check for both > the static /etc/selinux/config *and* runtime /selinux/enforce values? See my reply in other post. If we want to check just proper configuration, current rules (check if SELinux enforcing / SELinux policy targeted) are sufficient. But if we want to check also the running system, then yes, we should update the rules to check if SELinux is loaded and if /selinux/en= force =3D 1 for RHEL-6. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============0007618800237869349==-- From pvrabec at redhat.com Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============4000043008990184159==" MIME-Version: 1.0 From: Peter Vrabec To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule Date: Mon, 07 Oct 2013 16:49:28 +0200 Message-ID: <5252C9F8.4020704@redhat.com> In-Reply-To: 52521F30.6010804@redhat.com --===============4000043008990184159== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Shawn, I assume you need to define a scope whether runtime settings should be = covered or not. My assumption was that the guide is about configuration = settings. http://scap-securityguide.rhcloud.com/RHEL6/output/rhel6-guide.html "This guide presents a catalog of security-relevant configuration = settings ... " Peter. On 10/07/2013 04:40 AM, Shawn Wells wrote: > On 10/5/13 12:07 PM, fcaviggi(a)redhat.com wrote: >> Shawn, >> >> If these files exist and contain '1': >> >> '/selinux/enforce' - RHEL 6 >> '/sys/fs/selinux/enforce' - Fedora 19 >> >> Then SELinux is enabled and enforcing - the filesystem can only exist >> if SELinux is enabled, the contents are the enforcement status. > > So then, should we update the existing SELinux OVAL to check for both > the static /etc/selinux/config *and* runtime /selinux/enforce values? > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============4000043008990184159==-- From coopercd at ornl.gov Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============8204948999824210375==" MIME-Version: 1.0 From: Caleb Cooper To: scap-security-guide at lists.fedorahosted.org Subject: Adding banner messages to the list of selectors. Date: Mon, 07 Oct 2013 12:01:08 -0400 Message-ID: --===============8204948999824210375== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable This is concerning the RHEL6 content but might also be applicable to others: At my work, we use a different login banner than the one that the DoD uses = and I would like to add content for our banner message. However, I want to = do this in such a way that would be useful to other institutions. To that e= nd, I would like to change the way the banner message OVAL checks and XCCDF= content are created to allow users to add a large number of banner message= s to their profiles without a lot of work. I am planning to design a script= which would handle this. However, there is currently no system in place for me to implement this. I = would like this to fit with the overall design strategy of the project so p= lease let me know how you would like me to move forward. So far I have thou= ght of the following methods for a script to programmatically generate this= content: 1. Add a folder of text files into the auxiliary folder containing all of t= he banners with their selector ID as file names. The script would parse the= se at build time and add them to the "login_banner_text" rule inside the in= put/systems/accounts/banners.xml file. In addition it would append the full= banner message to the "set_system_login_banner" rules. Pros: A. This is the smallest change from the way the banner message is chec= ked now. B. Would require the very little work or XML knowledge by the user -- = as all that would be required is creating a simple text file and adding a s= ingle selector to their profile. Cons: A. Currently there are no scripts outside the checks/templates folder.= As this does not create an oval check it doesn't make sense to keep it the= re. 2. Create a script which builds entire banner rules based on the contents o= f files stored in a folder in auxiliary. Therefore, rather than simply appe= nding new messages to the "login_banner_text" and "set_system_login_banner"= rules it would create entirely new rules for each banner. Pros: A. This would make the output of checks smaller and reduce complexity = of each banner rule. B. Would remove the need to external variables in the banner checks. Cons: A. This would vastly increase the size of the banner.xml file. B. Would require changing the OVAL content logic. C. Currently there are no scripts outside the checks/templates folder.= As this does not create an oval check it doesn't make sense to keep it the= re. 3. Create a checks template script which generates OVAL content for each su= pplied banner instead of using the external variables from "login_banner_te= xt". Pros: A. Would simplify the OVAL checks. B. Would not require a new folder outside the current system of folder= s. C. Would fit with the current system of OVAL checks most closely. Cons: A. Does not create any XCCDF content, requiring the user to provide th= is. B. Parsing a CSV of banner messages would be problematic, so solution = would be to use separate files for each banner -- which does not fit the cu= rrent system. If you can help me pick one of these, suggest a better solution, or explain= why no change should be made I would appreciate the advice. Thanks, Caleb Cooper --===============8204948999824210375== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PXVzLWFzY2lpIj48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250 ZW50PSJNaWNyb3NvZnQgV29yZCAxNCAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0KLyog Rm9udCBEZWZpbml0aW9ucyAqLwpAZm9udC1mYWNlCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsKCXBh bm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8KcC5N c29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbAoJe21hcmdpbjowaW47CgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7Cglmb250LXNpemU6MTEuMHB0OwoJZm9udC1mYW1pbHk6IkNhbGli cmkiLCJzYW5zLXNlcmlmIjt9CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsKCXttc28tc3R5bGUt cHJpb3JpdHk6OTk7Cgljb2xvcjpibHVlOwoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9CmE6 dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZAoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsKCWNvbG9yOnB1cnBsZTsKCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQpwLk1zb0xpc3RQ YXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoCgl7bXNv LXN0eWxlLXByaW9yaXR5OjM0OwoJbWFyZ2luLXRvcDowaW47CgltYXJnaW4tcmlnaHQ6MGluOwoJ bWFyZ2luLWJvdHRvbTowaW47CgltYXJnaW4tbGVmdDouNWluOwoJbWFyZ2luLWJvdHRvbTouMDAw MXB0OwoJZm9udC1zaXplOjExLjBwdDsKCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJp ZiI7fQpzcGFuLkVtYWlsU3R5bGUxNwoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7 Cglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiOwoJY29sb3I6d2luZG93dGV4dDt9 Ci5Nc29DaHBEZWZhdWx0Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7Cglmb250LWZhbWls eToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO30KQHBhZ2UgV29yZFNlY3Rpb24xCgl7c2l6ZTo4LjVp biAxMS4waW47CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQpkaXYuV29yZFNlY3Rp b24xCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQovKiBMaXN0IERlZmluaXRpb25zICovCkBsaXN0IGww Cgl7bXNvLWxpc3QtaWQ6NDY3MTYzOTY5OwoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7Cgltc28tbGlz dC10ZW1wbGF0ZS1pZHM6Nzk0MTg3OTgyIDY3Njk4NzA5IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4 NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30KQGxpc3Qg bDA6bGV2ZWwxCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtdXBwZXI7Cgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdp bi1sZWZ0OjEuMGluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDA6bGV2ZWwyCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjEuNWluOwoJ dGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDA6bGV2ZWwzCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246cmlnaHQ7CgltYXJnaW4tbGVmdDoyLjBpbjsKCXRleHQtaW5kZW50Oi05 LjBwdDt9CkBsaXN0IGwwOmxldmVsNAoJe21zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6Mi41aW47Cgl0ZXh0LWluZGVu dDotLjI1aW47fQpAbGlzdCBsMDpsZXZlbDUKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBo YS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6My4waW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlz dCBsMDpsZXZlbDYKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsKCW1zby1s ZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsKCW1h cmdpbi1sZWZ0OjMuNWluOwoJdGV4dC1pbmRlbnQ6LTkuMHB0O30KQGxpc3QgbDA6bGV2ZWw3Cgl7 bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 CgltYXJnaW4tbGVmdDo0LjBpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwwOmxldmVs OAoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDo0 LjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwwOmxldmVsOQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6NS4waW47Cgl0ZXh0LWlu ZGVudDotOS4wcHQ7fQpAbGlzdCBsMQoJe21zby1saXN0LWlkOjY4MzQ3NzU3NDsKCW1zby1saXN0 LXR5cGU6aHlicmlkOwoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xNTc1MzM4MjMwIDY3Njk4NzA5 IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3 Njk4NzEzIDY3Njk4NzE1O30KQGxpc3QgbDE6bGV2ZWwxCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YWxwaGEtdXBwZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjEuMjVpbjsKCXRleHQtaW5kZW50Oi0uMjVp bjt9CkBsaXN0IGwxOmxldmVsMgoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy OwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7CgltYXJnaW4tbGVmdDoxLjc1aW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsMTps ZXZlbDMKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsKCW1zby1sZXZlbC10 YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsKCW1hcmdpbi1s ZWZ0OjIuMjVpbjsKCXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGwxOmxldmVsNAoJe21zby1s ZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFy Z2luLWxlZnQ6Mi43NWluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDE6bGV2ZWw1Cgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjMuMjVp bjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwxOmxldmVsNgoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6My43NWluOwoJdGV4dC1pbmRl bnQ6LTkuMHB0O30KQGxpc3QgbDE6bGV2ZWw3Cgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDo0LjI1aW47Cgl0ZXh0 LWluZGVudDotLjI1aW47fQpAbGlzdCBsMTpsZXZlbDgKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6NC43NWluOwoJdGV4dC1pbmRlbnQ6LS4yNWlu O30KQGxpc3QgbDE6bGV2ZWw5Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7 Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmln aHQ7CgltYXJnaW4tbGVmdDo1LjI1aW47Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBsMgoJ e21zby1saXN0LWlkOjczODQ3NjU2MTsKCW1zby1saXN0LXR5cGU6aHlicmlkOwoJbXNvLWxpc3Qt dGVtcGxhdGUtaWRzOjIzOTA4NjczOCA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcw MyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9CkBsaXN0IGwy OmxldmVsMQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0OwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDI6bGV2ZWwyCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsK CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBs aXN0IGwyOmxldmVsMwoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJ dGV4dC1pbmRlbnQ6LTkuMHB0O30KQGxpc3QgbDI6bGV2ZWw0Cgl7bXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7Cgl0ZXh0LWluZGVudDotLjI1 aW47fQpAbGlzdCBsMjpsZXZlbDUKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dl cjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0OwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDI6bGV2ZWw2Cgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBs MjpsZXZlbDcKCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwyOmxldmVsOAoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7Cgl0ZXh0LWluZGVudDotLjI1aW47fQpA bGlzdCBsMjpsZXZlbDkKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsKCW1z by1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsK CXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGwzCgl7bXNvLWxpc3QtaWQ6ODIyNTAzMDI2OwoJ bXNvLWxpc3QtdHlwZTpoeWJyaWQ7Cgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTcxNzA4Mzk0MiA2 NzY5ODcwOSA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5 ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9CkBsaXN0IGwzOmxldmVsMQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmFscGhhLXVwcGVyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDoxNTMuMHB0OwoJdGV4dC1pbmRl bnQ6LS4yNWluO30KQGxpc3QgbDM6bGV2ZWwyCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxw aGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjE4OS4wcHQ7Cgl0ZXh0LWluZGVudDotLjI1aW47fQpA bGlzdCBsMzpsZXZlbDMKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsKCW1z by1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsK CW1hcmdpbi1sZWZ0OjIyNS4wcHQ7Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBsMzpsZXZl bDQKCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsKCW1hcmdpbi1sZWZ0OjI2MS4wcHQ7Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBs MzpsZXZlbDUKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsKCW1zby1sZXZl bC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2lu LWxlZnQ6Mjk3LjBwdDsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwzOmxldmVsNgoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6MzMzLjBw dDsKCXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGwzOmxldmVsNwoJe21zby1sZXZlbC10YWIt c3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6 MzY5LjBwdDsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGwzOmxldmVsOAoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDo0MDUuMHB0OwoJdGV4 dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDM6bGV2ZWw5Cgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246cmlnaHQ7CgltYXJnaW4tbGVmdDo0NDEuMHB0OwoJdGV4dC1pbmRlbnQ6LTku MHB0O30KQGxpc3QgbDQKCXttc28tbGlzdC1pZDo4OTczOTc0MjU7Cgltc28tbGlzdC10eXBlOmh5 YnJpZDsKCW1zby1saXN0LXRlbXBsYXRlLWlkczotODM5NjA5Njc0IDY3Njk4NzA5IDY3Njk4NzEz IDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3 Njk4NzE1O30KQGxpc3QgbDQ6bGV2ZWwxCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEt dXBwZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsKCW1hcmdpbi1sZWZ0OjEuMGluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3Qg bDQ6bGV2ZWwyCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdp bi1sZWZ0OjEuNWluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDQ6bGV2ZWwzCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7CgltYXJnaW4tbGVmdDoyLjBpbjsK CXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGw0OmxldmVsNAoJe21zby1sZXZlbC10YWItc3Rv cDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6Mi41 aW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsNDpsZXZlbDUKCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDphbHBoYS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6My4waW47Cgl0ZXh0LWluZGVu dDotLjI1aW47fQpAbGlzdCBsNDpsZXZlbDYKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21h bi1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsKCW1hcmdpbi1sZWZ0OjMuNWluOwoJdGV4dC1pbmRlbnQ6LTkuMHB0O30KQGxp c3QgbDQ6bGV2ZWw3Cgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDo0LjBpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9 CkBsaXN0IGw0OmxldmVsOAoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 CgltYXJnaW4tbGVmdDo0LjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGw0OmxldmVs OQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6 NS4waW47Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBsNQoJe21zby1saXN0LWlkOjEwMzY5 MzMwNzg7Cgltc28tbGlzdC10eXBlOmh5YnJpZDsKCW1zby1saXN0LXRlbXBsYXRlLWlkczotODQ2 MzA1Mjc2IDY3Njk4NzA5IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4 NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30KQGxpc3QgbDU6bGV2ZWwxCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtdXBwZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsK CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjEuMjVpbjsKCXRl eHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGw1OmxldmVsMgoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmFscGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDoxLjc1aW47Cgl0ZXh0LWluZGVudDotLjI1 aW47fQpAbGlzdCBsNTpsZXZlbDMKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dl cjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpy aWdodDsKCW1hcmdpbi1sZWZ0OjIuMjVpbjsKCXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGw1 OmxldmVsNAoJe21zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6Mi43NWluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxp c3QgbDU6bGV2ZWw1Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1h cmdpbi1sZWZ0OjMuMjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGw1OmxldmVsNgoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6My43 NWluOwoJdGV4dC1pbmRlbnQ6LTkuMHB0O30KQGxpc3QgbDU6bGV2ZWw3Cgl7bXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVm dDo0LjI1aW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsNTpsZXZlbDgKCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6NC43NWluOwoJdGV4 dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDU6bGV2ZWw5Cgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246cmlnaHQ7CgltYXJnaW4tbGVmdDo1LjI1aW47Cgl0ZXh0LWluZGVudDotOS4w cHQ7fQpAbGlzdCBsNgoJe21zby1saXN0LWlkOjE0ODk2MzcyOTg7Cgltc28tbGlzdC10eXBlOmh5 YnJpZDsKCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTIyMzY1NjYwMiAxNDIzNDYyNzU4IDY3Njk4 NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEz IDY3Njk4NzE1O30KQGxpc3QgbDY6bGV2ZWwxCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxw aGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjEuNzVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjsKCW1z by1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpOwoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2Fs aWJyaTsKCW1zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJpOwoJbXNvLWJpZGktZm9udC1mYW1p bHk6IlRpbWVzIE5ldyBSb21hbiI7fQpAbGlzdCBsNjpsZXZlbDIKCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDphbHBoYS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6Mi4yNWluOwoJdGV4dC1pbmRlbnQ6 LS4yNWluO30KQGxpc3QgbDY6bGV2ZWwzCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246cmlnaHQ7CgltYXJnaW4tbGVmdDoyLjc1aW47Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlz dCBsNjpsZXZlbDQKCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjMuMjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9 CkBsaXN0IGw2OmxldmVsNQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 CgltYXJnaW4tbGVmdDozLjc1aW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsNjpsZXZl bDYKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsKCW1zby1sZXZlbC10YWIt c3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsKCW1hcmdpbi1sZWZ0 OjQuMjVpbjsKCXRleHQtaW5kZW50Oi05LjBwdDt9CkBsaXN0IGw2OmxldmVsNwoJe21zby1sZXZl bC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2lu LWxlZnQ6NC43NWluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDY6bGV2ZWw4Cgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjUuMjVpbjsK CXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGw2OmxldmVsOQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJbWFyZ2luLWxlZnQ6NS43NWluOwoJdGV4dC1pbmRlbnQ6 LTkuMHB0O30KQGxpc3QgbDcKCXttc28tbGlzdC1pZDoxNjA0OTkyNzU3OwoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7Cgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTI3NzMxMjUzOCA2NzY5ODcwOSA2NzY5 ODcwOSA2NzY5ODcxNSA2NzY5ODcwOSA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcx MyA2NzY5ODcxNTt9CkBsaXN0IGw3OmxldmVsMQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFs cGhhLXVwcGVyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7Cgl0ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsNzpsZXZlbDIKCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS11cHBlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25l OwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJdGV4dC1pbmRlbnQ6LS4yNWluO30K QGxpc3QgbDc6bGV2ZWwzCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7Cglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7 Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBsNzpsZXZlbDQKCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDphbHBoYS11cHBlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDc6bGV2 ZWw1Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCXRleHQtaW5kZW50 Oi0uMjVpbjt9CkBsaXN0IGw3OmxldmVsNgoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFu LWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOnJpZ2h0OwoJdGV4dC1pbmRlbnQ6LTkuMHB0O30KQGxpc3QgbDc6bGV2ZWw3Cgl7bXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7Cgl0ZXh0 LWluZGVudDotLjI1aW47fQpAbGlzdCBsNzpsZXZlbDgKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0OwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDc6bGV2ZWw5Cgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7Cgl0ZXh0LWluZGVudDotOS4w cHQ7fQpAbGlzdCBsOAoJe21zby1saXN0LWlkOjE5MzI4MTE2OTY7Cgltc28tbGlzdC10eXBlOmh5 YnJpZDsKCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTgzOTQ0MzI5NCAtMTcyNTAzMjU2NiA2NzY5 ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcx MyA2NzY5ODcxNTt9CkBsaXN0IGw4OmxldmVsMQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFs cGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDoxLjc1aW47Cgl0ZXh0LWluZGVudDotLjI1aW47fQpA bGlzdCBsODpsZXZlbDIKCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsKCW1z by1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJ bWFyZ2luLWxlZnQ6Mi4yNWluOwoJdGV4dC1pbmRlbnQ6LS4yNWluO30KQGxpc3QgbDg6bGV2ZWwz Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7CgltYXJnaW4tbGVmdDoy Ljc1aW47Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQpAbGlzdCBsODpsZXZlbDQKCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsKCW1hcmdpbi1s ZWZ0OjMuMjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBsaXN0IGw4OmxldmVsNQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOwoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7CgltYXJnaW4tbGVmdDozLjc1aW47Cgl0 ZXh0LWluZGVudDotLjI1aW47fQpAbGlzdCBsODpsZXZlbDYKCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpyb21hbi1sb3dlcjsKCW1zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpyaWdodDsKCW1hcmdpbi1sZWZ0OjQuMjVpbjsKCXRleHQtaW5kZW50Oi05 LjBwdDt9CkBsaXN0IGw4OmxldmVsNwoJe21zby1sZXZlbC10YWItc3RvcDpub25lOwoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0OwoJbWFyZ2luLWxlZnQ6NC43NWluOwoJdGV4dC1pbmRl bnQ6LS4yNWluO30KQGxpc3QgbDg6bGV2ZWw4Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxw aGEtbG93ZXI7Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsKCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsKCW1hcmdpbi1sZWZ0OjUuMjVpbjsKCXRleHQtaW5kZW50Oi0uMjVpbjt9CkBs aXN0IGw4OmxldmVsOQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOwoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0OwoJ bWFyZ2luLWxlZnQ6NS43NWluOwoJdGV4dC1pbmRlbnQ6LTkuMHB0O30Kb2wKCXttYXJnaW4tYm90 dG9tOjBpbjt9CnVsCgl7bWFyZ2luLWJvdHRvbTowaW47fQotLT48L3N0eWxlPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPgo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPgo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4KPG86c2hhcGVs YXlvdXQgdjpleHQ9ImVkaXQiPgo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4KPC9v OnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPjwvaGVhZD48Ym9keSBsYW5nPUVOLVVTIGxp bms9Ymx1ZSB2bGluaz1wdXJwbGU+PGRpdiBjbGFzcz1Xb3JkU2VjdGlvbjE+PHAgY2xhc3M9TXNv Tm9ybWFsIHN0eWxlPSdtYXJnaW4tbGVmdDouMjVpbic+VGhpcyBpcyBjb25jZXJuaW5nIHRoZSBS SEVMNiBjb250ZW50IGJ1dCBtaWdodCBhbHNvIGJlIGFwcGxpY2FibGUgdG8gb3RoZXJzOjxvOnA+ PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwvbzpwPjwvcD48cCBjbGFz cz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1sZWZ0Oi4yNWluJz5BdCBteSB3b3JrLCB3ZSB1c2Ug YSBkaWZmZXJlbnQgbG9naW4gYmFubmVyIHRoYW4gdGhlIG9uZSB0aGF0IHRoZSBEb0QgdXNlcyBh bmQgSSB3b3VsZCBsaWtlIHRvIGFkZCBjb250ZW50IGZvciBvdXIgYmFubmVyIG1lc3NhZ2UuIEhv d2V2ZXIsIEkgd2FudCB0byBkbyB0aGlzIGluIHN1Y2ggYSB3YXkgdGhhdCB3b3VsZCBiZSB1c2Vm dWwgdG8gb3RoZXIgaW5zdGl0dXRpb25zLiBUbyB0aGF0IGVuZCwgSSB3b3VsZCBsaWtlIHRvIGNo YW5nZSB0aGUgd2F5IHRoZSBiYW5uZXIgbWVzc2FnZSBPVkFMIGNoZWNrcyBhbmQgWENDREYgY29u dGVudCBhcmUgY3JlYXRlZCB0byBhbGxvdyB1c2VycyB0byBhZGQgYSBsYXJnZSBudW1iZXIgb2Yg YmFubmVyIG1lc3NhZ2VzIHRvIHRoZWlyIHByb2ZpbGVzIHdpdGhvdXQgYSBsb3Qgb2Ygd29yay4g SSBhbSBwbGFubmluZyB0byBkZXNpZ24gYSBzY3JpcHQgd2hpY2ggd291bGQgaGFuZGxlIHRoaXMu PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxw IGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWxlZnQ6LjI1aW4nPkhvd2V2ZXIsIHRoZXJl IGlzIGN1cnJlbnRseSBubyBzeXN0ZW0gaW4gcGxhY2UgZm9yIG1lIHRvIGltcGxlbWVudCB0aGlz LiBJIHdvdWxkIGxpa2UgdGhpcyB0byBmaXQgd2l0aCB0aGUgb3ZlcmFsbCBkZXNpZ24gc3RyYXRl Z3kgb2YgdGhlIHByb2plY3Qgc28gcGxlYXNlIGxldCBtZSBrbm93IGhvdyB5b3Ugd291bGQgbGlr ZSBtZSB0byBtb3ZlIGZvcndhcmQuIFNvIGZhciBJIGhhdmUgdGhvdWdodCBvZiB0aGUgZm9sbG93 aW5nIG1ldGhvZHMgZm9yIGEgc2NyaXB0IHRvIHByb2dyYW1tYXRpY2FsbHkgZ2VuZXJhdGUgdGhp cyBjb250ZW50OjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwv bzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1sZWZ0Oi4yNWluJz4xLiBB ZGQgYSBmb2xkZXIgb2YgdGV4dCBmaWxlcyBpbnRvIHRoZSBhdXhpbGlhcnkgZm9sZGVyIGNvbnRh aW5pbmcgYWxsIG9mIHRoZSBiYW5uZXJzIHdpdGggdGhlaXIgc2VsZWN0b3IgSUQgYXMgZmlsZSBu YW1lcy4gVGhlIHNjcmlwdCB3b3VsZCBwYXJzZSB0aGVzZSBhdCBidWlsZCB0aW1lIGFuZCBhZGQg dGhlbSB0byB0aGUgJiM4MjIwO2xvZ2luX2Jhbm5lcl90ZXh0JiM4MjIxOyBydWxlIGluc2lkZSB0 aGUgaW5wdXQvc3lzdGVtcy9hY2NvdW50cy9iYW5uZXJzLnhtbCBmaWxlLiBJbiBhZGRpdGlvbiBp dCB3b3VsZCBhcHBlbmQgdGhlIGZ1bGwgYmFubmVyIG1lc3NhZ2UgdG8gdGhlICYjODIyMDtzZXRf c3lzdGVtX2xvZ2luX2Jhbm5lciYjODIyMTsgcnVsZXMuIDxvOnA+PC9vOnA+PC9wPjxwIGNsYXNz PU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWxlZnQ6LjVpbic+UHJvczo8bzpwPjwvbzpwPjwvcD48 cCBjbGFzcz1Nc29MaXN0UGFyYWdyYXBoIHN0eWxlPSdtYXJnaW4tbGVmdDoxLjI1aW47dGV4dC1p bmRlbnQ6LS4yNWluO21zby1saXN0Omw1IGxldmVsMSBsZm80Jz48IVtpZiAhc3VwcG9ydExpc3Rz XT48c3BhbiBzdHlsZT0nbXNvLWxpc3Q6SWdub3JlJz5BLjxzcGFuIHN0eWxlPSdmb250OjcuMHB0 ICJUaW1lcyBOZXcgUm9tYW4iJz4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFu Pjwvc3Bhbj48IVtlbmRpZl0+VGhpcyBpcyB0aGUgc21hbGxlc3QgY2hhbmdlIGZyb20gdGhlIHdh eSB0aGUgYmFubmVyIG1lc3NhZ2UgaXMgY2hlY2tlZCBub3cuPG86cD48L286cD48L3A+PHAgY2xh c3M9TXNvTGlzdFBhcmFncmFwaCBzdHlsZT0nbWFyZ2luLWxlZnQ6MS4yNWluO3RleHQtaW5kZW50 Oi0uMjVpbjttc28tbGlzdDpsNSBsZXZlbDEgbGZvNCc+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNw YW4gc3R5bGU9J21zby1saXN0Oklnbm9yZSc+Qi48c3BhbiBzdHlsZT0nZm9udDo3LjBwdCAiVGlt ZXMgTmV3IFJvbWFuIic+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bhbj48L3Nw YW4+PCFbZW5kaWZdPldvdWxkIHJlcXVpcmUgdGhlIHZlcnkgbGl0dGxlIHdvcmsgb3IgWE1MIGtu b3dsZWRnZSBieSB0aGUgdXNlciAtLSBhcyBhbGwgdGhhdCB3b3VsZCBiZSByZXF1aXJlZCBpcyBj cmVhdGluZyBhIHNpbXBsZSB0ZXh0IGZpbGUgYW5kIGFkZGluZyBhIHNpbmdsZSBzZWxlY3RvciB0 byB0aGVpciBwcm9maWxlLjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0n bWFyZ2luLWxlZnQ6LjVpbic+Q29uczo8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29MaXN0UGFy YWdyYXBoIHN0eWxlPSdtYXJnaW4tbGVmdDoxLjI1aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1s aXN0OmwxIGxldmVsMSBsZm81Jz48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0nbXNv LWxpc3Q6SWdub3JlJz5BLjxzcGFuIHN0eWxlPSdmb250OjcuMHB0ICJUaW1lcyBOZXcgUm9tYW4i Jz4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ Q3VycmVudGx5IHRoZXJlIGFyZSBubyBzY3JpcHRzIG91dHNpZGUgdGhlIGNoZWNrcy90ZW1wbGF0 ZXMgZm9sZGVyLiBBcyB0aGlzIGRvZXMgbm90IGNyZWF0ZSBhbiBvdmFsIGNoZWNrIGl0IGRvZXNu JiM4MjE3O3QgbWFrZSBzZW5zZSB0byBrZWVwIGl0IHRoZXJlLjxvOnA+PC9vOnA+PC9wPjxwIGNs YXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWxlZnQ6MS4waW4nPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWxlZnQ6LjI1aW4nPjIuIENyZWF0 ZSBhIHNjcmlwdCB3aGljaCBidWlsZHMgZW50aXJlIGJhbm5lciBydWxlcyBiYXNlZCBvbiB0aGUg Y29udGVudHMgb2YgZmlsZXMgc3RvcmVkIGluIGEgZm9sZGVyIGluIGF1eGlsaWFyeS4gVGhlcmVm b3JlLCByYXRoZXIgdGhhbiBzaW1wbHkgYXBwZW5kaW5nIG5ldyBtZXNzYWdlcyB0byB0aGUgJiM4 MjIwO2xvZ2luX2Jhbm5lcl90ZXh0JiM4MjIxOyBhbmQgJiM4MjIwO3NldF9zeXN0ZW1fbG9naW5f YmFubmVyJiM4MjIxOyBydWxlcyBpdCB3b3VsZCBjcmVhdGUgZW50aXJlbHkgbmV3IHJ1bGVzIGZv ciBlYWNoIGJhbm5lci48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21h cmdpbi1sZWZ0Oi41aW4nPlByb3M6PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTGlzdFBhcmFn cmFwaCBzdHlsZT0nbWFyZ2luLWxlZnQ6MS4yNWluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlz dDpsMyBsZXZlbDEgbGZvNic+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9J21zby1s aXN0Oklnbm9yZSc+QS48c3BhbiBzdHlsZT0nZm9udDo3LjBwdCAiVGltZXMgTmV3IFJvbWFuIic+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPlRo aXMgd291bGQgbWFrZSB0aGUgb3V0cHV0IG9mIGNoZWNrcyBzbWFsbGVyIGFuZCByZWR1Y2UgY29t cGxleGl0eSBvZiBlYWNoIGJhbm5lciBydWxlLjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb0xp c3RQYXJhZ3JhcGggc3R5bGU9J21hcmdpbi1sZWZ0OjEuMjVpbjt0ZXh0LWluZGVudDotLjI1aW47 bXNvLWxpc3Q6bDMgbGV2ZWwxIGxmbzYnPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxl PSdtc28tbGlzdDpJZ25vcmUnPkIuPHNwYW4gc3R5bGU9J2ZvbnQ6Ny4wcHQgIlRpbWVzIE5ldyBS b21hbiInPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+PC9zcGFuPjwhW2Vu ZGlmXT5Xb3VsZCByZW1vdmUgdGhlIG5lZWQgdG8gZXh0ZXJuYWwgdmFyaWFibGVzIGluIHRoZSBi YW5uZXIgY2hlY2tzLjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFy Z2luLWxlZnQ6LjVpbic+Q29uczo8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29MaXN0UGFyYWdy YXBoIHN0eWxlPSdtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6 bDcgbGV2ZWwyIGxmbzcnPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSdtc28tbGlz dDpJZ25vcmUnPkEuPHNwYW4gc3R5bGU9J2ZvbnQ6Ny4wcHQgIlRpbWVzIE5ldyBSb21hbiInPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5UaGlz IHdvdWxkIHZhc3RseSBpbmNyZWFzZSB0aGUgc2l6ZSBvZiB0aGUgYmFubmVyLnhtbCBmaWxlLjxv OnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb0xpc3RQYXJhZ3JhcGggc3R5bGU9J21hcmdpbi1sZWZ0 OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsNyBsZXZlbDIgbGZvNyc+PCFbaWYg IXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9J21zby1saXN0Oklnbm9yZSc+Qi48c3BhbiBzdHls ZT0nZm9udDo3LjBwdCAiVGltZXMgTmV3IFJvbWFuIic+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IDwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPldvdWxkIHJlcXVpcmUgY2hhbmdpbmcgdGhl IE9WQUwgY29udGVudCBsb2dpYy48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29MaXN0UGFyYWdy YXBoIHN0eWxlPSdtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6 bDcgbGV2ZWwyIGxmbzcnPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSdtc28tbGlz dDpJZ25vcmUnPkMuPHNwYW4gc3R5bGU9J2ZvbnQ6Ny4wcHQgIlRpbWVzIE5ldyBSb21hbiInPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5DdXJy ZW50bHkgdGhlcmUgYXJlIG5vIHNjcmlwdHMgb3V0c2lkZSB0aGUgY2hlY2tzL3RlbXBsYXRlcyBm b2xkZXIuIEFzIHRoaXMgZG9lcyBub3QgY3JlYXRlIGFuIG92YWwgY2hlY2sgaXQgZG9lc24mIzgy MTc7dCBtYWtlIHNlbnNlIHRvIGtlZXAgaXQgdGhlcmUuPG86cD48L286cD48L3A+PHAgY2xhc3M9 TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0n bWFyZ2luLWxlZnQ6LjI1aW4nPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1h bCBzdHlsZT0nbWFyZ2luLWxlZnQ6LjI1aW4nPjMuIENyZWF0ZSBhIGNoZWNrcyB0ZW1wbGF0ZSBz Y3JpcHQgd2hpY2ggZ2VuZXJhdGVzIE9WQUwgY29udGVudCBmb3IgZWFjaCBzdXBwbGllZCBiYW5u ZXIgaW5zdGVhZCBvZiB1c2luZyB0aGUgZXh0ZXJuYWwgdmFyaWFibGVzIGZyb20gJiM4MjIwO2xv Z2luX2Jhbm5lcl90ZXh0JiM4MjIxOy48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwg c3R5bGU9J21hcmdpbi1sZWZ0Oi4yNWluJz4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgUHJvczo8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29MaXN0UGFyYWdyYXBo IHN0eWxlPSdtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzgnPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSdtc28tbGlzdDpJ Z25vcmUnPkEuPHNwYW4gc3R5bGU9J2ZvbnQ6Ny4wcHQgIlRpbWVzIE5ldyBSb21hbiInPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5Xb3VsZCBz aW1wbGlmeSB0aGUgT1ZBTCBjaGVja3MuPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTGlzdFBh cmFncmFwaCBzdHlsZT0nbWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1s aXN0OmwwIGxldmVsMSBsZm84Jz48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0nbXNv LWxpc3Q6SWdub3JlJz5CLjxzcGFuIHN0eWxlPSdmb250OjcuMHB0ICJUaW1lcyBOZXcgUm9tYW4i Jz4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ V291bGQgbm90IHJlcXVpcmUgYSBuZXcgZm9sZGVyIG91dHNpZGUgdGhlIGN1cnJlbnQgc3lzdGVt IG9mIGZvbGRlcnMuPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTGlzdFBhcmFncmFwaCBzdHls ZT0nbWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVs MSBsZm84Jz48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0nbXNvLWxpc3Q6SWdub3Jl Jz5DLjxzcGFuIHN0eWxlPSdmb250OjcuMHB0ICJUaW1lcyBOZXcgUm9tYW4iJz4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+V291bGQgZml0IHdp dGggdGhlIGN1cnJlbnQgc3lzdGVtIG9mIE9WQUwgY2hlY2tzIG1vc3QgY2xvc2VseS48bzpwPjwv bzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1sZWZ0Oi4yNWluJz4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQ29uczo8bzpwPjwvbzpwPjwv cD48cCBjbGFzcz1Nc29MaXN0UGFyYWdyYXBoIHN0eWxlPSdtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0 LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDQgbGV2ZWwxIGxmbzknPjwhW2lmICFzdXBwb3J0TGlz dHNdPjxzcGFuIHN0eWxlPSdtc28tbGlzdDpJZ25vcmUnPkEuPHNwYW4gc3R5bGU9J2ZvbnQ6Ny4w cHQgIlRpbWVzIE5ldyBSb21hbiInPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3Nw YW4+PC9zcGFuPjwhW2VuZGlmXT5Eb2VzIG5vdCBjcmVhdGUgYW55IFhDQ0RGIGNvbnRlbnQsIHJl cXVpcmluZyB0aGUgdXNlciB0byBwcm92aWRlIHRoaXMuPG86cD48L286cD48L3A+PHAgY2xhc3M9 TXNvTGlzdFBhcmFncmFwaCBzdHlsZT0nbWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4y NWluO21zby1saXN0Omw0IGxldmVsMSBsZm85Jz48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBz dHlsZT0nbXNvLWxpc3Q6SWdub3JlJz5CLjxzcGFuIHN0eWxlPSdmb250OjcuMHB0ICJUaW1lcyBO ZXcgUm9tYW4iJz4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPjwvc3Bhbj48 IVtlbmRpZl0+UGFyc2luZyBhIENTViBvZiBiYW5uZXIgbWVzc2FnZXMgd291bGQgYmUgcHJvYmxl bWF0aWMsIHNvIHNvbHV0aW9uIHdvdWxkIGJlIHRvIHVzZSBzZXBhcmF0ZSBmaWxlcyBmb3IgZWFj aCBiYW5uZXIgLS0gd2hpY2ggZG9lcyBub3QgZml0IHRoZSBjdXJyZW50IHN5c3RlbS48bzpwPjwv bzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1sZWZ0Oi4yNWluJz48bzpw PiZuYnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tbGVmdDouMjVpbic+SWYgeW91IGNhbiBo ZWxwIG1lIHBpY2sgb25lIG9mIHRoZXNlLCBzdWdnZXN0IGEgYmV0dGVyIHNvbHV0aW9uLCBvciBl eHBsYWluIHdoeSBubyBjaGFuZ2Ugc2hvdWxkIGJlIG1hZGUgSSB3b3VsZCBhcHByZWNpYXRlIHRo ZSBhZHZpY2UuPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4t bGVmdDouMjVpbic+PG86cD4mbmJzcDs8L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxl PSdtYXJnaW4tbGVmdDouMjVpbic+VGhhbmtzLDxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05v cm1hbCBzdHlsZT0nbWFyZ2luLWxlZnQ6LjI1aW4nPkNhbGViIENvb3BlcjxvOnA+PC9vOnA+PC9w PjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3Jt YWw+PG86cD4mbmJzcDs8L286cD48L3A+PC9kaXY+PC9ib2R5PjwvaHRtbD4= --===============8204948999824210375==-- From jlieskov at redhat.com Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============7923848869865776448==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Introduce new RPM versioning scheme for RHEL6 / JBossEAP content Date: Mon, 07 Oct 2013 13:06:43 -0400 Message-ID: <335059424.2364832.1381165603781.JavaMail.root@redhat.com> In-Reply-To: 530540835.2353582.1381164857483.JavaMail.root@redhat.com --===============7923848869865776448== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Based on request from: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-October= /004210.html introduce also new RPM versioning scheme also for RHEL6/JBossEAP5 content. * Makefile changes: - retrieve necessary values from RHEL-6 spec file, - organize Makefile into sections (RHEL-6 section, Fedora section below, custom macros definition follows, then Makefile targets), - in the 'srpm' target remove explicit setting of following variables: - ARCH - not needed, defined in *.spec directly, - PKGNAME, VERSION, RELEASE - defined in *.spec directly, - VENDOR - defined in *.spec directly, - PACKAGER - not needed. When building in Koji, packager will be set automatically to "Fedora Project", when building locally it's not needed (rpmlint complains when PACKAGER set up directly), - _sysconfdir on RHEL-6 system is defined too (as can be double-checked by rpm --eval), so no need to re-define it exactly. = * scap-security-guide.spec changes: - introduce 'redhatssgrelease', - add Vendor && BuildArch, - update missing %changelog records with proper entries (according to the git log) * the only remaining rpmlint warning to be fixed is exact source location. Tests: - a, RHEL-6 (make tarball, srpm, rpm passes), final xccdf eval passes, guide is generated correctly, - b, Fedora (make fedora-{tarball, srpm, rpm}), final xccdf eval pass, guide is generated correctly. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============7923848869865776448== Content-Type: text/x-patch MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-Introduce-new-RPM-versioning-scheme-for-RHEL6-JBossE.patch" RnJvbSAzMDRhZjkyYjRlNDYyOTMzM2NhOGIwNDc5ZGIxZTJkNWYzNDFiNjdiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNvbT4K RGF0ZTogTW9uLCA3IE9jdCAyMDEzIDE4OjUwOjE5ICswMjAwClN1YmplY3Q6IFtQQVRDSF0gSW50 cm9kdWNlIG5ldyBSUE0gdmVyc2lvbmluZyBzY2hlbWUgZm9yIFJIRUw2IC8gSkJvc3NFQVAKIGNv bnRlbnQKCgpTaWduZWQtb2ZmLWJ5OiBKYW4gTGllc2tvdnNreSA8amxpZXNrb3ZAcmVkaGF0LmNv bT4KLS0tCiBNYWtlZmlsZSAgICAgICAgICAgICAgICAgfCAzMiArKysrKysrKysrKystLS0tLS0t LS0tLS0tLS0tLS0tLQogc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjIHwgMjMgKysrKysrKysrKysr KysrLS0tLS0tLS0KIDIgZmlsZXMgY2hhbmdlZCwgMjcgaW5zZXJ0aW9ucygrKSwgMjggZGVsZXRp b25zKC0pCgpkaWZmIC0tZ2l0IGEvTWFrZWZpbGUgYi9NYWtlZmlsZQppbmRleCAyNjBjODMzLi44 YTA2N2JjIDEwMDY0NAotLS0gYS9NYWtlZmlsZQorKysgYi9NYWtlZmlsZQpAQCAtMSw0MyArMSwz NiBAQAotVkVSU0lPTiA6PSAwLjEKLVJFTEVBU0UgOj0gMTIuZWw2Ci1QS0dOQU1FIDo9IHNjYXAt c2VjdXJpdHktZ3VpZGUKLVBLRyA6PSAkKFBLR05BTUUpLSQoVkVSU0lPTikKLQotQVJDSCA6PSBu b2FyY2gKLVZFTkRPUiA6PSBzY2FwLXNlY3VyaXR5LWd1aWRlCi1QQUNLQUdFUiA6PSBzY2FwLXNl Y3VyaXR5LWd1aWRlCi0KKyMgRGVmaW5lIFJIRUw2IC8gSkJvc3NFQVA1IHNwZWNpZmljIHZhcmlh YmxlcyBiZWxvdwogUk9PVF9ESVIgPz0gJChDVVJESVIpCi0KIFJQTV9TUEVDIDo9ICQoUk9PVF9E SVIpL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYworUEtHTkFNRSA6PSAkKHNoZWxsIHNlZCAtbmUg J3MvTmFtZTpcdFx0XCguKlwpL1wxL3AnICQoUlBNX1NQRUMpKQorVkVSU0lPTiA6PSAkKHNoZWxs IHNlZCAtbmUgJ3MvVmVyc2lvbjpcdFwoLipcKS9cMS9wJyAkKFJQTV9TUEVDKSkKK1JFREhBVF9T U0dfUkVMRUFTRSA6PSAkKHNoZWxsIHNlZCAtbmUgJ3MvXlwoLipcKXJlZGhhdHNzZ3JlbGVhc2Vc dFwoLipcKS9cMi9wJyAkKFJQTV9TUEVDKSkKK1JFREhBVF9ESVNUIDo9ICQoc2hlbGwgcnBtIC0t ZXZhbCAnJXtkaXN0fScpCitSRUxFQVNFIDo9ICQoUkVESEFUX1NTR19SRUxFQVNFKSQoUkVESEFU X0RJU1QpCitQS0cgOj0gJChQS0dOQU1FKS0kKFZFUlNJT04pLSQoUkVESEFUX1NTR19SRUxFQVNF KQogCitBUkNIIDo9IG5vYXJjaAogVEFSQkFMTCA9ICQoUlBNX1RPUERJUikvU09VUkNFUy8kKFBL RykudGFyLmd6CiAKIFJQTV9ERVBTIDo9IHRhcmJhbGwgJChSUE1fU1BFQykgTWFrZWZpbGUKLQog UlBNX1RNUERJUiA/PSAkKFJPT1RfRElSKS9ycG1idWlsZAogUlBNX1RPUERJUiA/PSAkKFJQTV9U TVBESVIpL3NyYy9yZWRoYXQKIFJQTV9CVUlMRFJPT1QgPz0gJChSUE1fVE1QRElSKS9ycG0tYnVp bGRyb290Ci0KLQotTUtESVIgPSB0ZXN0IC1kICQoMSkgfHwgbWtkaXIgLXAgJCgxKQotCiBSUE1C VUlMRF9BUkdTIDo9IC0tZGVmaW5lICdfdG9wZGlyICQoUlBNX1RPUERJUiknICAtLWRlZmluZSAn X3RtcHBhdGggJChSUE1fVE1QRElSKScKIAogIyBEZWZpbmUgRmVkb3JhIHNwZWNpZmljIHZhcmlh YmxlcyBiZWxvdwogRkVET1JBX1NQRUMgOj0gJChST09UX0RJUikvRmVkb3JhL3NjYXAtc2VjdXJp dHktZ3VpZGUuc3BlYwogRkVET1JBX1JQTV9ERVBTIDo9ICQoRkVET1JBX1NQRUMpIE1ha2VmaWxl Ci0KIEZFRE9SQV9OQU1FIDo9ICQoUEtHTkFNRSkKIEZFRE9SQV9WRVJTSU9OIDo9ICQoc2hlbGwg c2VkIC1uZSAncy9WZXJzaW9uOlx0XCguKlwpL1wxL3AnICQoRkVET1JBX1NQRUMpKQogRkVET1JB X1NTR19SRUxFQVNFIDo9ICQoc2hlbGwgc2VkIC1uZSAncy9eXCguKlwpXHRmZWRvcmFzc2dyZWxl YXNlXHRcKC4qXCkvXDIvcCcgJChGRURPUkFfU1BFQykpCi0KIEZFRE9SQV9QS0cgOj0gJChGRURP UkFfTkFNRSktJChGRURPUkFfVkVSU0lPTiktJChGRURPUkFfU1NHX1JFTEVBU0UpCiBGRURPUkFf VEFSQkFMTCA6PSAkKFJQTV9UT1BESVIpL1NPVVJDRVMvJChGRURPUkFfUEtHKS50YXIuZ3oKIEZF RE9SQV9ESVNUIDo9ICQoc2hlbGwgcnBtIC0tZXZhbCAnJXtkaXN0fScpCiAKICMgRGVmaW5lIGN1 c3RvbSBjYW5uZWQgc2VxdWVuY2VzIC8gbWFjcm9zIGJlbG93CiAKK01LRElSID0gdGVzdCAtZCAk KDEpIHx8IG1rZGlyIC1wICQoMSkKKwogZGVmaW5lIHJwbS1wcmVwCiAJJChjYWxsIE1LRElSLCQo UlBNX1RNUERJUikvJChQS0cpKQogCSQoY2FsbCBNS0RJUiwkKFJQTV9CVUlMRFJPT1QpKQpAQCAt MTE3LDggKzExMCw3IEBAIHppcGZpbGU6CiAKIHNycG06ICQoUlBNX0RFUFMpCiAJQGVjaG8gIkJ1 aWxkaW5nICQoUEtHTkFNRSkgU1JQTS4uLiIKLQllY2hvIC1lICIlZGVmaW5lIGFyY2ggJChBUkNI KVxuJWRlZmluZSBwa2duYW1lICQoUEtHTkFNRSlcbiVkZWZpbmUgX3N5c2NvbmZkaXIgL2V0Y1xu JWRlZmluZSB2ZXJzaW9uICQoVkVSU0lPTilcbiVkZWZpbmUgcmVsZWFzZSAkKFJFTEVBU0UpXG4l ZGVmaW5lIHZlbmRvciAkKFZFTkRPUilcbiVkZWZpbmUgcGFja2FnZXIgJChQQUNLQUdFUikiID4g JChSUE1fVE9QRElSKS9TUEVDUy8kKG5vdGRpciAkKFJQTV9TUEVDKSkKLQljYXQgJChSUE1fU1BF QykgPj4gJChSUE1fVE9QRElSKS9TUEVDUy8kKG5vdGRpciAkKFJQTV9TUEVDKSkKKwljYXQgJChS UE1fU1BFQykgPiAkKFJQTV9UT1BESVIpL1NQRUNTLyQobm90ZGlyICQoUlBNX1NQRUMpKQogCWNk ICQoUlBNX1RPUERJUikgJiYgcnBtYnVpbGQgJChSUE1CVUlMRF9BUkdTKSAtLXRhcmdldD0kKEFS Q0gpIC1icyBTUEVDUy8kKG5vdGRpciAkKFJQTV9TUEVDKSkgLS1ub2RlcHMKIAogZmVkb3JhLXNy cG06ICQoRkVET1JBX1JQTV9ERVBTKQpAQCAtMTQwLDcgKzEzMiw3IEBAIGZlZG9yYS1zcnBtOiAk KEZFRE9SQV9SUE1fREVQUykKIAogcnBtOiBzcnBtCiAJIEBlY2hvICJCdWlsZGluZyAkKFBLRykg UlBNLi4uIgotCSBjZCAkKFJQTV9UT1BESVIpL1NSUE1TICYmIHJwbWJ1aWxkIC0tcmVidWlsZCAt LXRhcmdldD0kKEFSQ0gpICQoUlBNQlVJTERfQVJHUykgLS1idWlsZHJvb3QgJChSUE1fQlVJTERS T09UKSAtYmIgJChQS0cpLSQoUkVMRUFTRSkuc3JjLnJwbQorCSBjZCAkKFJQTV9UT1BESVIpL1NS UE1TICYmIHJwbWJ1aWxkIC0tcmVidWlsZCAtLXRhcmdldD0kKEFSQ0gpICQoUlBNQlVJTERfQVJH UykgLS1idWlsZHJvb3QgJChSUE1fQlVJTERST09UKSAtYmIgJChQS0cpJChSRURIQVRfRElTVCku c3JjLnJwbQogCiBmZWRvcmEtcnBtOiBmZWRvcmEtc3JwbQogCUBlY2hvICJCdWlsZGluZyBGZWRv cmEgJChGRURPUkFfUEtHKSBSUE0gcGFja2FnZS4uLiIKZGlmZiAtLWdpdCBhL3NjYXAtc2VjdXJp dHktZ3VpZGUuc3BlYyBiL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYwppbmRleCAzZjkxNDk5Li5h Y2VmYmQ5IDEwMDY0NAotLS0gYS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMKKysrIGIvc2NhcC1z ZWN1cml0eS1ndWlkZS5zcGVjCkBAIC0xLDE2ICsxLDIwIEBACi1OYW1lOiAgICAgICAgICAgc2Nh cC1zZWN1cml0eS1ndWlkZQotVmVyc2lvbjoJJXt2ZXJzaW9ufQotUmVsZWFzZToJJXtyZWxlYXNl fQorCislZ2xvYmFsCQlyZWRoYXRzc2dyZWxlYXNlCTE0LnJjMQorCitOYW1lOgkJc2NhcC1zZWN1 cml0eS1ndWlkZQorVmVyc2lvbjoJMC4xCitSZWxlYXNlOgkle3JlZGhhdHNzZ3JlbGVhc2V9JXs/ ZGlzdH0KIFN1bW1hcnk6CVNlY3VyaXR5IGd1aWRhbmNlIGFuZCBiYXNlbGluZXMgaW4gU0NBUCBm b3JtYXRzCitWZW5kb3I6CQlzY2FwLXNlY3VyaXR5LWd1aWRlCiAKIEdyb3VwOgkJU3lzdGVtIEVu dmlyb25tZW50L0Jhc2UKIExpY2Vuc2U6CVB1YmxpYyBEb21haW4KIFVSTDoJCWh0dHBzOi8vZmVk b3JhaG9zdGVkLm9yZy9zY2FwLXNlY3VyaXR5LWd1aWRlLwogCi1Tb3VyY2UwOgkle25hbWV9LSV7 dmVyc2lvbn0udGFyLmd6CitTb3VyY2UwOgkle25hbWV9LSV7dmVyc2lvbn0tJXtyZWRoYXRzc2dy ZWxlYXNlfS50YXIuZ3oKIEJ1aWxkUm9vdDoJJShta3RlbXAgLXVkICV7X3RtcHBhdGh9LyV7bmFt ZX0tJXt2ZXJzaW9ufS0le3JlbGVhc2V9LVhYWFhYWCkKIAotQnVpbGRBcmNoOgkle2FyY2h9CitC dWlsZEFyY2g6CW5vYXJjaAogCiBCdWlsZFJlcXVpcmVzOgljb3JldXRpbHMsIGxpYnhzbHQsIGV4 cGF0LCBweXRob24sIG9wZW5zY2FwLXV0aWxzID49IDAuOS4xLCBweXRob24tbHhtbAogUmVxdWly ZXM6CWZpbGVzeXN0ZW0sIG9wZW5zY2FwLXV0aWxzID49IDAuOS4xCkBAIC0yMiw3ICsyNiw3IEBA IGNhdGFsb2cgb2YgcHJhY3RpY2FsIGhhcmRlbmluZyBhZHZpY2UgYW5kIGxpbmtzIGl0IHRvIGdv dmVybm1lbnQgcmVxdWlyZW1lbnRzCiB3aGVyZSBhcHBsaWNhYmxlLiBUaGUgcHJvamVjdCBicmlk Z2VzIHRoZSBnYXAgYmV0d2VlbiBnZW5lcmFsaXplZCBwb2xpY3kKIHJlcXVpcmVtZW50cyBhbmQg c3BlY2lmaWMgaW1wbGVtZW50YXRpb24gZ3VpZGFuY2UuCiAlcHJlcAotJXNldHVwIC1xIAorJXNl dHVwIC1xIC1uICV7bmFtZX0tJXt2ZXJzaW9ufS0le3JlZGhhdHNzZ3JlbGVhc2V9CiAKICVidWls ZAogY2QgUkhFTDYgJiYgbWFrZSBkaXN0CkBAIC01MiwxMSArNTYsMTQgQEAgcm0gLXJmICRSUE1f QlVJTERfUk9PVAogJWxhbmcoZW4pICV7X21hbmRpcn0vZW4vbWFuOC9zY2FwLXNlY3VyaXR5LWd1 aWRlLjguZ3oKIAogJWNoYW5nZWxvZworKiBNb24gT2N0IDA3IDIwMTMgSmFuIGlhbmtrbyBMaWVz a292c2t5IDxqbGllc2tvdkByZWRoYXQuY29tPiAwLjEtMTQucmMxCistIENoYW5nZSBSUE0gdmVy c2lvbmluZyBzY2hlbWUgdG8gaW5jbHVkZSByZWxlYXNlIGludG8gdGFyYmFsbAorCiAqIFNhdCBT ZXAgMjggMjAxMyBTaGF3biBXZWxscyA8c2hhd25AcmVkaGF0LmNvbT4gMC4xLTEzCi0tIHRlc3QK Ky0gVXBkYXRlZCBSUE0gc3BlYyBmaWxlIHRvIGZpeCBycG1saW50IHdhcm5pbmdzCiAKICogV2Vk IEp1biAyNiAyMDEzIFNoYXduIFdlbGxzIDxzaGF3bkByZWRoYXQuY29tPiAwLjEtMTIKLS0gCist IFVwZGF0ZWQgUlBNIHZlcnNpb24gdG8gMC4xLTEyCiAKICogRnJpIEFwciAyNiAyMDEzIFNoYXdu IFdlbGxzIDxzaGF3bkByZWRoYXQuY29tPiAwLjEtMTEKIC0gU2lnbmlmaWNhbnQgYW1vdW50IG9m IE9WQUwgYnVnZml4ZXMKLS0gCjEuNy4xMS43Cgo= --===============7923848869865776448==-- From rui-p-bernardino at ptinovacao.pt Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============5753309125694464299==" MIME-Version: 1.0 From: Rui Pedro Bernardino To: scap-security-guide at lists.fedorahosted.org Subject: RE: Adding banner messages to the list of selectors. Date: Tue, 08 Oct 2013 10:13:53 +0100 Message-ID: In-Reply-To: F7D6A12B572935439E34065CFADC851CEB39E7D931@EXCHMBB.ornl.gov --===============5753309125694464299== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I find setting the login_banner_text in each profile adequate for my needs = and I also maintain multiple profiles. Even the bash fixes work perfectly (= if you define the text appropriately). I did change the XCCDF to reflect the profile login_banner_text; inputs/acc= ounts/banners.xml: (...) Modify the System Login Banner To configure the system login banner:

Edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer.
	                 <--- HERE. I replaced t=
he DoD text with this.
(...) This way, both the evals and guides always have the text according to the p= rofile. Ok, seting a large number of different login_banner_text for long b= anners can be a real pain; if you must, I like the 1st method. Regards -- Rui Pedro Bernardino CTE2/Tecnologias e Desenvolvimento PT Inova=C3=A7=C3=A3o From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-sec= urity-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Cooper, Caleb D. Sent: segunda-feira, 7 de Outubro de 2013 17:01 To: scap-security-guide(a)lists.fedorahosted.org Subject: Adding banner messages to the list of selectors. This is concerning the RHEL6 content but might also be applicable to others: At my work, we use a different login banner than the one that the DoD uses = and I would like to add content for our banner message. However, I want to = do this in such a way that would be useful to other institutions. To that e= nd, I would like to change the way the banner message OVAL checks and XCCDF= content are created to allow users to add a large number of banner message= s to their profiles without a lot of work. I am planning to design a script= which would handle this. However, there is currently no system in place for me to implement this. I = would like this to fit with the overall design strategy of the project so p= lease let me know how you would like me to move forward. So far I have thou= ght of the following methods for a script to programmatically generate this= content: 1. Add a folder of text files into the auxiliary folder containing all of t= he banners with their selector ID as file names. The script would parse the= se at build time and add them to the "login_banner_text" rule inside the in= put/systems/accounts/banners.xml file. In addition it would append the full= banner message to the "set_system_login_banner" rules. = Pros: A. This is the smallest change from the way the banner message is checked n= ow. B. Would require the very little work or XML knowledge by the user -- as al= l that would be required is creating a simple text file and adding a single= selector to their profile. Cons: A. Currently there are no scripts outside the checks/templates folder. As t= his does not create an oval check it doesn't make sense to keep it there. 2. Create a script which builds entire banner rules based on the contents o= f files stored in a folder in auxiliary. Therefore, rather than simply appe= nding new messages to the "login_banner_text" and "set_system_login_banner"= rules it would create entirely new rules for each banner. Pros: A. This would make the output of checks smaller and reduce complexity of ea= ch banner rule. B. Would remove the need to external variables in the banner checks. Cons: A. This would vastly increase the size of the banner.xml file. B. Would require changing the OVAL content logic. C. Currently there are no scripts outside the checks/templates folder. As t= his does not create an oval check it doesn't make sense to keep it there. 3. Create a checks template script which generates OVAL content for each su= pplied banner instead of using the external variables from "login_banner_te= xt". =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Pros: A. Would simplify the OVAL checks. B. Would not require a new folder outside the current system of folders. C. Would fit with the current system of OVAL checks most closely. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Cons: A. Does not create any XCCDF content, requiring the user to provide this. B. Parsing a CSV of banner messages would be problematic, so solution would= be to use separate files for each banner -- which does not fit the current= system. If you can help me pick one of these, suggest a better solution, or explain= why no change should be made I would appreciate the advice. Thanks, Caleb Cooper --===============5753309125694464299==-- From rui-p-bernardino at ptinovacao.pt Thu Aug 20 11:35:29 2015 Content-Type: multipart/mixed; boundary="===============7892204268479994935==" MIME-Version: 1.0 From: Rui Pedro Bernardino To: scap-security-guide at lists.fedorahosted.org Subject: RE: Adding banner messages to the list of selectors. Date: Tue, 08 Oct 2013 13:13:13 +0100 Message-ID: In-Reply-To: B0F8BA03CBE85346A2A4A48A2A9365D401EA742A1604@INOAVREX11.ptin.corpPT.com --===============7892204268479994935== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Forgot to mention that you must use 'set-value' instead of 'refine-value' o= n the profile definition, eg: > > + > + > = >
> diff --git a/Fedora/input/system/accounts/restrictions/password_expiratio= n.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml > new file mode 100644 > index 0000000..73d48c6 > --- /dev/null > +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml > @@ -0,0 +1,177 @@ > + > +Set Password Expiration Parameters > +The file /etc/login.defs controls several > +password-related settings. Programs such as passwd, > +su, and login consult /etc/login.defs to dete= rmine > +behavior with regard to password aging, expiration warnings, > +and length. See the man page login.defs(5) for more information. > +

> +Users should be forced to change their passwords, in order to > +decrease the utility of compromised passwords. However, the need to > +change passwords often should be balanced against the risk that > +users will reuse or write down passwords if forced to change them > +too often. Forcing password changes every 90-360 days, depending on > +the environment, is recommended. Set the appropriate value as > +PASS_MAX_DAYS and apply it to existing accounts with the > +-M flag. > +

> +The PASS_MIN_DAYS (-m) setting prevents password > +changes for 7 days after the first change, to discourage password > +cycling. If you use this setting, train users to contact an administrator > +for an emergency password change in case a new password becomes > +compromised. The PASS_WARN_AGE (-W) setting gives > +users 7 days of warnings at login time that their passwords are about to= expire. > +

> +For example, for each existing human user USER, expiration parame= ters > +could be adjusted to a 180 day maximum password age, 7 day minimum passw= ord > +age, and 7 day warning period with the following command: > +
# chage -M 180 -m 7 -W 7 USER
> +
> + > + > +minimum password length > +Minimum number of characters in password > +This will only check new passwords > +12 > +6 > + > +8 > +10 > +12 > +14 > + > + > + > +maximum password age > +Maximum age of password in days > +This will only apply to newly created acco= unts > +60 > +60 > +90 > +120 > +180 > + > + > + > +minimum password age > +Minimum age of password in days > +This will only apply to newly created acco= unts > +7 > +7 > +5 > +1 > +2 > +0 > + > + > + > +warning days before password expires > +The number of days' warning given before a password expires= . > +This will only apply to newly created acco= unts > +7 > +0 > +7 > +14 > + > + > + > +Set Password Minimum Length in login.defs > +To specify password length requirements for new accounts, > +edit the file /etc/login.defs and add or correct the following > +lines: > +
PASS_MIN_LEN 12
> +

> +Nowadays recommended values, considered as secure by various organizatio= ns > +focused on topic of computer security, range from 12 (FISMA) up= to > +14 (DoD) characters for password length requirements. > +If a program consults /etc/login.defs and also another PAM modu= le > +(such as pam_cracklib) during a password change operation, > +then the most restrictive must be satisfied. See PAM section > +for more information about enforcing password quality requirements. > +
> + > +To check the minimum password length, run the command: > +
$ grep PASS_MIN_LEN /etc/login.defs
> +Passwords of length 12 characters and more are nowadays > +considered to be a standard requirement. > +
> + > +Requiring a minimum password length makes password > +cracking attacks more difficult by ensuring a larger > +search space. However, any security benefit from an onerous requirement > +must be carefully weighed against usability problems, support costs, or > +counterproductive behavior that may result. > + > + > + > +
> + > + > +Set Password Minimum Age > +To specify password minimum age for new accounts, > +edit the file /etc/login.defs and add or correct the > +following line, replacing the DAYS item as appropriate: > +
PASS_MIN_DAYS DAYS
> +A value of 1 day is considered to be sufficient for many environments. > +
> + > +To check the minimum password age, run the command: > +
$ grep PASS_MIN_DAYS /etc/login.defs
> +A value of 1 day is considered to be sufficient for many environments. > +
> + > +Setting the minimum password age protects against users cycling > +back to a favorite password after satisfying the password reuse > +requirement. > + > + > + > +
> + > + > +Set Password Maximum Age > +To specify password maximum age for new accounts, > +edit the file /etc/login.defs and add or correct the > +following line, replacing the DAYS item appropriately: > +
PASS_MAX_DAYS DAYS
> +A value of 180 days is sufficient for many environments. > +
> + > +To check the maximum password age, run the command: > +
$ grep PASS_MAX_DAYS /etc/login.defs
> +A value of 180 days is sufficient for many environments. > +
> + > +Setting the password maximum age ensures users are required to > +periodically change their passwords. This could possibly decrease > +the utility of a stolen password. Requiring shorter password lifetimes > +increases the risk of users writing down the password in a convenient > +location subject to physical compromise. > + > + > +
> + > + > +Set Password Warning Age > +To specify how many days prior to password > +expiration that a warning will be issued to users, > +edit the file /etc/login.defs and add or correct > + the following line, replacing the DAYS item as appropriate: > +
PASS_WARN_AGE DAYS
> +A value of 7 days would be nowadays considered to be a standard. > + > +
> + > +To check the password warning age, run the command: > +
$ grep PASS_WARN_AGE /etc/login.defs
> +A value of 7 days would be nowadays considered to be a standard. > +
> + > +Setting the password warning age enables users to make the change > +at a practical time. > + > + > + > +
> + > +
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide= .spec > index 73eab57..1abe666 100644 > --- a/Fedora/scap-security-guide.spec > +++ b/Fedora/scap-security-guide.spec > @@ -5,7 +5,7 @@ > # file one level up - in the main scap-security-guide directory (instea= d of > # this one). > = > -%global fedorassgrelease 2.rc2 > +%global fedorassgrelease 2.rc3 > = > Name: scap-security-guide > Version: 0.1 > @@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT > %{_datadir}/xml/scap/ssg/fedora/19/* > = > %changelog > +* Thu Oct 10 2013 Jan iankko Lieskovsky 0.1-2.rc3 > +- Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora > + > * Thu Oct 10 2013 Jan iankko Lieskovsky 0.1-2.r= c2 > - Introduce 'Account and Access Control' section > - Convert following "Verify Proper Storage and Existence of Password Ha= shes" section > -- 1.7.11.7 ack --===============8229476321873323050== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8xMC8xMyAxMjo0NSBQTSwgSmFuIExpZXNrb3Zza3kKICAgICAgd3JvdGU6PGJyPgog ICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MTE1OTE1MTExNS40MTEz ODU1LjEzODE0MjM1MzIyNzEuSmF2YU1haWwucm9vdEByZWRoYXQuY29tIgogICAgICB0eXBlPSJj aXRlIj4KICAgICAgPGRpdiBjbGFzcz0ibW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBo aWNhbC1xdW90ZT0idHJ1ZSIKICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7 IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgbGFuZz0ieC11bmljb2RlIj4KICAgICAgICA8cHJl IHdyYXA9IiI+VGhpcyBwYXRjaCBjb252ZXJ0cyAoYW5kIGluY2x1ZGVzKSBmb3VyIGV4aXN0aW5n IHJ1bGVzIGZyb20gUkhFTDYKJ1NldCBQYXNzd29yZCBFeHBpcmF0aW9uIFBhcmFtZXRlcnMnIHNl Y3Rpb24gdG8gKGludG8pIEZlZG9yYS4KClRlc3Rpbmc6CiogYWxsIHRlc3RzIG9mIG1ha2UgZmVk b3JhLXRhcmJhbGwsIGZlZG9yYS1zcnBtLCBmZWRvcmEtcnBtIGhhdmUgcGFzc2VkLAoqIGFsbCB0 ZXN0cyB3aXRoaW4gRmVkb3JhIG9mICdtYWtlIC8gbWFrZSB2YWxpZGF0ZSAvIG1ha2UgdmFsaWRh dGUteG1sIC8KICBtYWtlIGNoZWNrcyAvIG1ha2UgZ3VpZGUgLyBtYWtlIGNvbnRlbnQgLyBtYWtl IGV2YWwtY29tbW9uJyBoYXZlIHBhc3NlZAogIHdpdGggdGhlIHByb3Bvc2FsLgoKUGxlYXNlIHJl dmlldy4KClRoYW5rIHlvdSAmYW1wOyZhbXA7IFJlZ2FyZHMsIEphbi4KLS0KSmFuIGlhbmtrbyBM aWVza292c2t5IC8gUmVkIEhhdCBTZWN1cml0eSBUZWNobm9sb2dpZXMgVGVhbTwvcHJlPgogICAg ICA8L2Rpdj4KICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50 SGVhZGVyIj48bGVnZW5kCiAgICAgICAgICBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXJOYW1l Ij4wMDAxLUZlZG9yYS1Db252ZXJ0LWZvdXItUkhFTDYtcnVsZXMtZnJvbS1TZXQtUGFzc3dvcmQt RXgucGF0Y2g8L2xlZ2VuZD48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxkaXYgY2xhc3M9 Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGljYWwtcXVvdGU9InRydWUiCiAgICAg ICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNpemU6IDEycHg7IgogICAg ICAgIGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgPHByZSB3cmFwPSIiPkZyb20gNWU1ZGJiOTI5 ZmU4Mzc2ZjcyZDcxZjUyNmY1ZTAyZTRlZDRhODQxZCBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEK RnJvbTogSmFuIExpZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96 LXR4dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0 O2psaWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPgpEYXRlOiBUaHUsIDEwIE9jdCAyMDEzIDE4OjM5 OjExICswMjAwClN1YmplY3Q6IFtQQVRDSF0gW0ZlZG9yYV0gQ29udmVydCBmb3VyIFJIRUw2IHJ1 bGVzIGZyb20gJ1NldCBQYXNzd29yZAogRXhwaXJhdGlvbiBQYXJhbWV0ZXJzJyBzZWN0aW9uIHRv IEZlZG9yYQoKClNpZ25lZC1vZmYtYnk6IEphbiBMaWVza292c2t5IDxhIG1vei1kby1ub3Qtc2Vu ZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmpsaWVz a292QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4KLS0tCiAuLi4v Y2hlY2tzL2FjY291bnRzX21heGltdW1fYWdlX2xvZ2luX2RlZnMueG1sICAgICB8ICAzMiArKysr CiAuLi4vY2hlY2tzL2FjY291bnRzX21pbmltdW1fYWdlX2xvZ2luX2RlZnMueG1sICAgICB8ICAz NCArKysrCiAuLi4vY2hlY2tzL2FjY291bnRzX3Bhc3N3b3JkX21pbmxlbl9sb2dpbl9kZWZzLnht bCB8ICAzMyArKysrCiAuLi4vYWNjb3VudHNfcGFzc3dvcmRfd2Fybl9hZ2VfbG9naW5fZGVmcy54 bWwgICAgICB8ICAzNSArKysrCiBGZWRvcmEvaW5wdXQvZ3VpZGUueG1sICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMiArLQogRmVkb3JhL2lucHV0L2d1aWRlLnhzbHQgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDEgKwogRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54 bWwgICAgICAgICAgICAgICAgICAgfCAgIDQgKwogLi4uL2FjY291bnRzL3Jlc3RyaWN0aW9ucy9w YXNzd29yZF9leHBpcmF0aW9uLnhtbCAgfCAxNzcgKysrKysrKysrKysrKysrKysrKysrCiBGZWRv cmEvc2NhcC1zZWN1cml0eS1ndWlkZS5zcGVjICAgICAgICAgICAgICAgICAgICB8ICAgNSArLQog OSBmaWxlcyBjaGFuZ2VkLCAzMjEgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMoLSkKIGNyZWF0 ZSBtb2RlIDEwMDY0NCBGZWRvcmEvaW5wdXQvY2hlY2tzL2FjY291bnRzX21heGltdW1fYWdlX2xv Z2luX2RlZnMueG1sCiBjcmVhdGUgbW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L2NoZWNrcy9hY2Nv dW50c19taW5pbXVtX2FnZV9sb2dpbl9kZWZzLnhtbAogY3JlYXRlIG1vZGUgMTAwNjQ0IEZlZG9y YS9pbnB1dC9jaGVja3MvYWNjb3VudHNfcGFzc3dvcmRfbWlubGVuX2xvZ2luX2RlZnMueG1sCiBj cmVhdGUgbW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L2NoZWNrcy9hY2NvdW50c19wYXNzd29yZF93 YXJuX2FnZV9sb2dpbl9kZWZzLnhtbAogY3JlYXRlIG1vZGUgMTAwNjQ0IEZlZG9yYS9pbnB1dC9z eXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bhc3N3b3JkX2V4cGlyYXRpb24ueG1sCgpkaWZm IC0tZ2l0IGEvRmVkb3JhL2lucHV0L2NoZWNrcy9hY2NvdW50c19tYXhpbXVtX2FnZV9sb2dpbl9k ZWZzLnhtbCBiL0ZlZG9yYS9pbnB1dC9jaGVja3MvYWNjb3VudHNfbWF4aW11bV9hZ2VfbG9naW5f ZGVmcy54bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNWU5NjExOAotLS0g L2Rldi9udWxsCisrKyBiL0ZlZG9yYS9pbnB1dC9jaGVja3MvYWNjb3VudHNfbWF4aW11bV9hZ2Vf bG9naW5fZGVmcy54bWwKQEAgLTAsMCArMSwzMiBAQAorJmx0O2RlZi1ncm91cCZndDsKKyAgJmx0 O2RlZmluaXRpb24gY2xhc3M9ImNvbXBsaWFuY2UiIGlkPSJhY2NvdW50c19tYXhpbXVtX2FnZV9s b2dpbl9kZWZzIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7bWV0YWRhdGEmZ3Q7CisgICAgICAm bHQ7dGl0bGUmZ3Q7U2V0IFBhc3N3b3JkIEV4cGlyYXRpb24gUGFyYW1ldGVycyZsdDsvdGl0bGUm Z3Q7CisgICAgICAmbHQ7YWZmZWN0ZWQgZmFtaWx5PSJ1bml4IiZndDsKKyAgICAgICAgJmx0O3Bs YXRmb3JtJmd0O0ZlZG9yYSAxOSZsdDsvcGxhdGZvcm0mZ3Q7CisgICAgICAmbHQ7L2FmZmVjdGVk Jmd0OworICAgICAgJmx0O2Rlc2NyaXB0aW9uJmd0O1RoZSBtYXhpbXVtIHBhc3N3b3JkIGFnZSBw b2xpY3kgc2hvdWxkIG1lZXQgbWluaW11bSByZXF1aXJlbWVudHMuJmx0Oy9kZXNjcmlwdGlvbiZn dDsKKyAgICAmbHQ7L21ldGFkYXRhJmd0OworICAgICZsdDtjcml0ZXJpYSBjb21tZW50PSJ0aGUg dmFsdWUgUEFTU19NQVhfREFZUyBzaG91bGQgYmUgc2V0IGFwcHJvcHJpYXRlbHkgaW4gL2V0Yy9s b2dpbi5kZWZzIiZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9InRlc3RfcGFzc19t YXhfZGF5cyIgLyZndDsKKyAgICAmbHQ7L2NyaXRlcmlhJmd0OworICAmbHQ7L2RlZmluaXRpb24m Z3Q7CisKKyAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSJhbGwiIGNvbW1l bnQ9InRoZSB2YWx1ZSBQQVNTX01BWF9EQVlTIHNob3VsZCBiZSBzZXQgYXBwcm9wcmlhdGVseSBp biAvZXRjL2xvZ2luLmRlZnMiIGlkPSJ0ZXN0X3Bhc3NfbWF4X2RheXMiIHZlcnNpb249IjEiJmd0 OworICAgICZsdDtpbmQ6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9ldGNfbG9naW5fZGVmc19w YXNzX21heCIgLyZndDsKKyAgICAmbHQ7aW5kOnN0YXRlIHN0YXRlX3JlZj0ic3RhdGVfYWNjb3Vu dHNfbWF4aW11bV9hZ2VfbG9naW5fZGVmcyIgLyZndDsKKyAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250 ZW50NTRfdGVzdCZndDsKKworICAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBpZD0i b2JqZWN0X2V0Y19sb2dpbl9kZWZzX3Bhc3NfbWF4IiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7 aW5kOmZpbGVwYXRoJmd0Oy9ldGMvbG9naW4uZGVmcyZsdDsvaW5kOmZpbGVwYXRoJmd0OworICAg ICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249InBhdHRlcm4gbWF0Y2giJmd0O15bXHNdPGIgY2xh c3M9Im1vei10eHQtc3RhciI+PHNwYW4gY2xhc3M9Im1vei10eHQtdGFnIj4qPC9zcGFuPlBBU1Nf TUFYX0RBWVNbXHNdKyhcZCspXHM8c3BhbiBjbGFzcz0ibW96LXR4dC10YWciPio8L3NwYW4+PC9i PiQmbHQ7L2luZDpwYXR0ZXJuJmd0OworICAgICZsdDtpbmQ6aW5zdGFuY2UgZGF0YXR5cGU9Imlu dCImZ3Q7MSZsdDsvaW5kOmluc3RhbmNlJmd0OworICAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1 NF9vYmplY3QmZ3Q7CisKKyAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSBpZD0ic3Rh dGVfYWNjb3VudHNfbWF4aW11bV9hZ2VfbG9naW5fZGVmcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAg Jmx0O2luZDpzdWJleHByZXNzaW9uIG9wZXJhdGlvbj0ibGVzcyB0aGFuIG9yIGVxdWFsIiB2YXJf cmVmPSJ2YXJfYWNjb3VudHNfbWF4aW11bV9hZ2VfbG9naW5fZGVmcyIgZGF0YXR5cGU9ImludCIg LyZndDsKKyAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7CisKKyAgJmx0O2V4 dGVybmFsX3ZhcmlhYmxlIGNvbW1lbnQ9Im1heGltdW0gcGFzc3dvcmQgYWdlIiBkYXRhdHlwZT0i aW50IiBpZD0idmFyX2FjY291bnRzX21heGltdW1fYWdlX2xvZ2luX2RlZnMiIHZlcnNpb249IjEi IC8mZ3Q7CisKKyZsdDsvZGVmLWdyb3VwJmd0OwpkaWZmIC0tZ2l0IGEvRmVkb3JhL2lucHV0L2No ZWNrcy9hY2NvdW50c19taW5pbXVtX2FnZV9sb2dpbl9kZWZzLnhtbCBiL0ZlZG9yYS9pbnB1dC9j aGVja3MvYWNjb3VudHNfbWluaW11bV9hZ2VfbG9naW5fZGVmcy54bWwKbmV3IGZpbGUgbW9kZSAx MDA2NDQKaW5kZXggMDAwMDAwMC4uODc5MTdlMAotLS0gL2Rldi9udWxsCisrKyBiL0ZlZG9yYS9p bnB1dC9jaGVja3MvYWNjb3VudHNfbWluaW11bV9hZ2VfbG9naW5fZGVmcy54bWwKQEAgLTAsMCAr MSwzNCBAQAorJmx0O2RlZi1ncm91cCZndDsKKyAgJmx0O2RlZmluaXRpb24gY2xhc3M9ImNvbXBs aWFuY2UiIGlkPSJhY2NvdW50c19taW5pbXVtX2FnZV9sb2dpbl9kZWZzIiB2ZXJzaW9uPSIxIiZn dDsKKyAgICAmbHQ7bWV0YWRhdGEmZ3Q7CisgICAgICAmbHQ7dGl0bGUmZ3Q7U2V0IFBhc3N3b3Jk IEV4cGlyYXRpb24gUGFyYW1ldGVycyZsdDsvdGl0bGUmZ3Q7CisgICAgICAmbHQ7YWZmZWN0ZWQg ZmFtaWx5PSJ1bml4IiZndDsKKyAgICAgICAgJmx0O3BsYXRmb3JtJmd0O0ZlZG9yYSAxOSZsdDsv cGxhdGZvcm0mZ3Q7CisgICAgICAmbHQ7L2FmZmVjdGVkJmd0OworICAgICAgJmx0O2Rlc2NyaXB0 aW9uJmd0O1RoZSBtaW5pbXVtIHBhc3N3b3JkIGFnZSBwb2xpY3kgc2hvdWxkIGJlIHNldCBhcHBy b3ByaWF0ZWx5LiZsdDsvZGVzY3JpcHRpb24mZ3Q7CisgICAgJmx0Oy9tZXRhZGF0YSZndDsKKyAg ICAmbHQ7Y3JpdGVyaWEgY29tbWVudD0idGhlIHZhbHVlIFBBU1NfTUlOX0RBWVMgc2hvdWxkIGJl IHNldCBhcHByb3ByaWF0ZWx5IGluIC9ldGMvbG9naW4uZGVmcyImZ3Q7CisgICAgICAmbHQ7Y3Jp dGVyaW9uIHRlc3RfcmVmPSJ0ZXN0X3Bhc3NfbWluX2RheXMiIC8mZ3Q7CisgICAgJmx0Oy9jcml0 ZXJpYSZndDsKKyAgJmx0Oy9kZWZpbml0aW9uJmd0OworCisgICZsdDtpbmQ6dGV4dGZpbGVjb250 ZW50NTRfdGVzdCBjaGVjaz0iYWxsIgorICBjb21tZW50PSJUZXN0cyB0aGUgdmFsdWUgb2YgUEFT U19NSU5fREFZUyBpbiAvZXRjL2xvZ2luLmRlZnMiCisgIGlkPSJ0ZXN0X3Bhc3NfbWluX2RheXMi IHZlcnNpb249IjEiJmd0OworICAgICZsdDtpbmQ6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9l dGNfbG9naW5fZGVmc19wYXNzX21pbl9hZ2UiIC8mZ3Q7CisgICAgJmx0O2luZDpzdGF0ZSBzdGF0 ZV9yZWY9InN0YXRlX2V0Y19sb2dpbl9kZWZzX3Bhc3NfbWluX2FnZSIgLyZndDsKKyAgJmx0Oy9p bmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCZndDsKKworICAmbHQ7aW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCBpZD0ib2JqZWN0X2V0Y19sb2dpbl9kZWZzX3Bhc3NfbWluX2FnZSIgdmVyc2lv bj0iMSImZ3Q7CisgICAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2xvZ2luLmRlZnMmbHQ7L2lu ZDpmaWxlcGF0aCZndDsKKyAgICAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSJwYXR0ZXJuIG1h dGNoIiZndDteW1xzXTxiIGNsYXNzPSJtb3otdHh0LXN0YXIiPjxzcGFuIGNsYXNzPSJtb3otdHh0 LXRhZyI+Kjwvc3Bhbj5QQVNTX01JTl9EQVlTW1xzXSsoXGQrKVxzPHNwYW4gY2xhc3M9Im1vei10 eHQtdGFnIj4qPC9zcGFuPjwvYj4kJmx0Oy9pbmQ6cGF0dGVybiZndDsKKyAgICAmbHQ7aW5kOmlu c3RhbmNlIGRhdGF0eXBlPSJpbnQiJmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDsKKyAgJmx0Oy9p bmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0OworCisgICZsdDtpbmQ6dGV4dGZpbGVjb250 ZW50NTRfc3RhdGUgaWQ9InN0YXRlX2V0Y19sb2dpbl9kZWZzX3Bhc3NfbWluX2FnZSIgdmVyc2lv bj0iMSImZ3Q7CisgICAgJmx0O2luZDpzdWJleHByZXNzaW9uIG9wZXJhdGlvbj0iZ3JlYXRlciB0 aGFuIG9yIGVxdWFsIiB2YXJfcmVmPSJ2YXJfYWNjb3VudHNfbWluaW11bV9hZ2VfbG9naW5fZGVm cyIgZGF0YXR5cGU9ImludCIgLyZndDsKKyAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3Rh dGUmZ3Q7CisKKyAgJmx0O2V4dGVybmFsX3ZhcmlhYmxlIGNvbW1lbnQ9Im1pbmltdW0gcGFzc3dv cmQgYWdlIGluIGRheXMiIGRhdGF0eXBlPSJpbnQiIGlkPSJ2YXJfYWNjb3VudHNfbWluaW11bV9h Z2VfbG9naW5fZGVmcyIgdmVyc2lvbj0iMSIgLyZndDsKKworJmx0Oy9kZWYtZ3JvdXAmZ3Q7CmRp ZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvY2hlY2tzL2FjY291bnRzX3Bhc3N3b3JkX21pbmxlbl9s b2dpbl9kZWZzLnhtbCBiL0ZlZG9yYS9pbnB1dC9jaGVja3MvYWNjb3VudHNfcGFzc3dvcmRfbWlu bGVuX2xvZ2luX2RlZnMueG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmUz Y2UxMzAKLS0tIC9kZXYvbnVsbAorKysgYi9GZWRvcmEvaW5wdXQvY2hlY2tzL2FjY291bnRzX3Bh c3N3b3JkX21pbmxlbl9sb2dpbl9kZWZzLnhtbApAQCAtMCwwICsxLDMzIEBACismbHQ7ZGVmLWdy b3VwJmd0OworCisgICZsdDtkZWZpbml0aW9uIGNsYXNzPSJjb21wbGlhbmNlIiBpZD0iYWNjb3Vu dHNfcGFzc3dvcmRfbWlubGVuX2xvZ2luX2RlZnMiIHZlcnNpb249IjEiJmd0OworICAgICZsdDtt ZXRhZGF0YSZndDsKKyAgICAgICZsdDt0aXRsZSZndDtTZXQgUGFzc3dvcmQgRXhwaXJhdGlvbiBQ YXJhbWV0ZXJzJmx0Oy90aXRsZSZndDsKKyAgICAgICZsdDthZmZlY3RlZCBmYW1pbHk9InVuaXgi Jmd0OworICAgICAgICAmbHQ7cGxhdGZvcm0mZ3Q7RmVkb3JhIDE5Jmx0Oy9wbGF0Zm9ybSZndDsK KyAgICAgICZsdDsvYWZmZWN0ZWQmZ3Q7CisgICAgICAmbHQ7ZGVzY3JpcHRpb24mZ3Q7VGhlIHBh c3N3b3JkIG1pbmltdW0gbGVuZ3RoIHNob3VsZCBiZSBzZXQgYXBwcm9wcmlhdGVseS4mbHQ7L2Rl c2NyaXB0aW9uJmd0OworICAgICZsdDsvbWV0YWRhdGEmZ3Q7CisgICAgJmx0O2NyaXRlcmlhIG9w ZXJhdG9yPSJBTkQiJmd0OworICAgICAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0idGVzdF9ldGNf bG9naW5fZGVmcyIgLyZndDsKKyAgICAmbHQ7L2NyaXRlcmlhJmd0OworICAmbHQ7L2RlZmluaXRp b24mZ3Q7CisKKyAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSJhbGwiIGNv bW1lbnQ9ImNoZWNrIFBBU1NfTUlOX0xFTiBpbiAvZXRjL2xvZ2luLmRlZnMiIGlkPSJ0ZXN0X2V0 Y19sb2dpbl9kZWZzIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7aW5kOm9iamVjdCBvYmplY3Rf cmVmPSJvYmplY3RfZXRjX2xvZ2luX2RlZnMiIC8mZ3Q7CisgICAgJmx0O2luZDpzdGF0ZSBzdGF0 ZV9yZWY9InN0YXRlX2FjY291bnRzX3Bhc3N3b3JkX21pbmxlbl9sb2dpbl9kZWZzIiAvJmd0Owor ICAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0Jmd0OworCisgICZsdDtpbmQ6dGV4dGZp bGVjb250ZW50NTRfb2JqZWN0IGlkPSJvYmplY3RfZXRjX2xvZ2luX2RlZnMiIHZlcnNpb249IjEi Jmd0OworICAgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9sb2dpbi5kZWZzJmx0Oy9pbmQ6Zmls ZXBhdGgmZ3Q7CisgICAgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0icGF0dGVybiBtYXRjaCIm Z3Q7XlBBU1NfTUlOX0xFTlxzKyhcZCspXHMqJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7CisgICAgJmx0 O2luZDppbnN0YW5jZSBkYXRhdHlwZT0iaW50IiZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7Cisg ICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDsKKworICAmbHQ7aW5kOnRleHRm aWxlY29udGVudDU0X3N0YXRlIGlkPSJzdGF0ZV9hY2NvdW50c19wYXNzd29yZF9taW5sZW5fbG9n aW5fZGVmcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O2luZDpzdWJleHByZXNzaW9uIG9wZXJh dGlvbj0iZ3JlYXRlciB0aGFuIG9yIGVxdWFsIiB2YXJfcmVmPSJ2YXJfYWNjb3VudHNfcGFzc3dv cmRfbWlubGVuX2xvZ2luX2RlZnMiIGRhdGF0eXBlPSJpbnQiIC8mZ3Q7CisgICZsdDsvaW5kOnRl eHRmaWxlY29udGVudDU0X3N0YXRlJmd0OworCisgICZsdDtleHRlcm5hbF92YXJpYWJsZSBjb21t ZW50PSJwYXNzd29yZCBtaW5pbXVtIGxlbmd0aCIgZGF0YXR5cGU9ImludCIgaWQ9InZhcl9hY2Nv dW50c19wYXNzd29yZF9taW5sZW5fbG9naW5fZGVmcyIgdmVyc2lvbj0iMSIgLyZndDsKKworJmx0 Oy9kZWYtZ3JvdXAmZ3Q7CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvY2hlY2tzL2FjY291bnRz X3Bhc3N3b3JkX3dhcm5fYWdlX2xvZ2luX2RlZnMueG1sIGIvRmVkb3JhL2lucHV0L2NoZWNrcy9h Y2NvdW50c19wYXNzd29yZF93YXJuX2FnZV9sb2dpbl9kZWZzLnhtbApuZXcgZmlsZSBtb2RlIDEw MDY0NAppbmRleCAwMDAwMDAwLi41MjMwYWYxCi0tLSAvZGV2L251bGwKKysrIGIvRmVkb3JhL2lu cHV0L2NoZWNrcy9hY2NvdW50c19wYXNzd29yZF93YXJuX2FnZV9sb2dpbl9kZWZzLnhtbApAQCAt MCwwICsxLDM1IEBACismbHQ7ZGVmLWdyb3VwJmd0OworICAmbHQ7ZGVmaW5pdGlvbiBjbGFzcz0i Y29tcGxpYW5jZSIgaWQ9ImFjY291bnRzX3Bhc3N3b3JkX3dhcm5fYWdlX2xvZ2luX2RlZnMiIHZl cnNpb249IjEiJmd0OworICAgICZsdDttZXRhZGF0YSZndDsKKyAgICAgICZsdDt0aXRsZSZndDtT ZXQgUGFzc3dvcmQgRXhwaXJhdGlvbiBQYXJhbWV0ZXJzJmx0Oy90aXRsZSZndDsKKyAgICAgICZs dDthZmZlY3RlZCBmYW1pbHk9InVuaXgiJmd0OworICAgICAgICAmbHQ7cGxhdGZvcm0mZ3Q7RmVk b3JhIDE5Jmx0Oy9wbGF0Zm9ybSZndDsKKyAgICAgICZsdDsvYWZmZWN0ZWQmZ3Q7CisgICAgICAm bHQ7ZGVzY3JpcHRpb24mZ3Q7VGhlIHBhc3N3b3JkIGV4cGlyYXRpb24gd2FybmluZyBhZ2Ugc2hv dWxkIGJlIHNldCBhcHByb3ByaWF0ZWx5LiZsdDsvZGVzY3JpcHRpb24mZ3Q7CisgICAgJmx0Oy9t ZXRhZGF0YSZndDsKKyAgICAmbHQ7Y3JpdGVyaWEmZ3Q7CisgICAgICAmbHQ7Y3JpdGVyaW9uIHRl c3RfcmVmPSJ0ZXN0X3Bhc3Nfd2Fybl9hZ2UiIC8mZ3Q7CisgICAgJmx0Oy9jcml0ZXJpYSZndDsK KyAgJmx0Oy9kZWZpbml0aW9uJmd0OworCisgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVz dCBjaGVjaz0iYWxsIgorICBjb21tZW50PSJUZXN0cyB0aGUgdmFsdWUgb2YgUEFTU19XQVJOX0FH RSBpbiAvZXRjL2xvZ2luLmRlZnMiCisgIGlkPSJ0ZXN0X3Bhc3Nfd2Fybl9hZ2UiIHZlcnNpb249 IjEiJmd0OworICAgICZsdDtpbmQ6b2JqZWN0IG9iamVjdF9yZWY9Im9iamVjdF9ldGNfbG9naW5f ZGVmc19wYXNzX3dhcm5fYWdlIiAvJmd0OworICAgICZsdDtpbmQ6c3RhdGUgc3RhdGVfcmVmPSJz dGF0ZV9ldGNfbG9naW5fZGVmc19wYXNzX3dhcm5fYWdlIiAvJmd0OworICAmbHQ7L2luZDp0ZXh0 ZmlsZWNvbnRlbnQ1NF90ZXN0Jmd0OworCisgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2Jq ZWN0IGlkPSJvYmplY3RfZXRjX2xvZ2luX2RlZnNfcGFzc193YXJuX2FnZSIKKyAgdmVyc2lvbj0i MSImZ3Q7CisgICAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2xvZ2luLmRlZnMmbHQ7L2luZDpm aWxlcGF0aCZndDsKKyAgICAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSJwYXR0ZXJuIG1hdGNo IiZndDteW1xzXTxiIGNsYXNzPSJtb3otdHh0LXN0YXIiPjxzcGFuIGNsYXNzPSJtb3otdHh0LXRh ZyI+Kjwvc3Bhbj5QQVNTX1dBUk5fQUdFW1xzXSooXGQrKVxzPHNwYW4gY2xhc3M9Im1vei10eHQt dGFnIj4qPC9zcGFuPjwvYj4kJmx0Oy9pbmQ6cGF0dGVybiZndDsKKyAgICAmbHQ7aW5kOmluc3Rh bmNlIGRhdGF0eXBlPSJpbnQiJmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDsKKyAgJmx0Oy9pbmQ6 dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0OworCisgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50 NTRfc3RhdGUgaWQ9InN0YXRlX2V0Y19sb2dpbl9kZWZzX3Bhc3Nfd2Fybl9hZ2UiIHZlcnNpb249 IjEiJmd0OworICAgICZsdDtpbmQ6c3ViZXhwcmVzc2lvbiBvcGVyYXRpb249ImdyZWF0ZXIgdGhh biBvciBlcXVhbCIgdmFyX3JlZj0idmFyX2FjY291bnRzX3Bhc3N3b3JkX3dhcm5fYWdlX2xvZ2lu X2RlZnMiIGRhdGF0eXBlPSJpbnQiIC8mZ3Q7CisgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0 X3N0YXRlJmd0OworCisgICZsdDtleHRlcm5hbF92YXJpYWJsZSBjb21tZW50PSJwYXNzd29yZCBl eHBpcmF0aW9uIHdhcm5pbmcgYWdlIGluIGRheXMiIGRhdGF0eXBlPSJpbnQiIGlkPSJ2YXJfYWNj b3VudHNfcGFzc3dvcmRfd2Fybl9hZ2VfbG9naW5fZGVmcyIgdmVyc2lvbj0iMSIgLyZndDsKKwor Jmx0Oy9kZWYtZ3JvdXAmZ3Q7CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvZ3VpZGUueG1sIGIv RmVkb3JhL2lucHV0L2d1aWRlLnhtbAppbmRleCBjNzZiNzk1Li42ZTI3NmIxIDEwMDY0NAotLS0g YS9GZWRvcmEvaW5wdXQvZ3VpZGUueG1sCisrKyBiL0ZlZG9yYS9pbnB1dC9ndWlkZS54bWwKQEAg LTM2LDUgKzM2LDUgQEAgdHJhZGVtYXJrcyBvciB0cmFkZW1hcmtzIG9mIFJlZCBIYXQsIEluYy4g aW4gdGhlIFVuaXRlZCBTdGF0ZXMgYW5kIG90aGVyCiBjb3VudHJpZXMuIEFsbCBvdGhlciBuYW1l cyBhcmUgcmVnaXN0ZXJlZCB0cmFkZW1hcmtzIG9yIHRyYWRlbWFya3Mgb2YgdGhlaXIKIHJlc3Bl Y3RpdmUgY29tcGFuaWVzLiZsdDsvcmVhci1tYXR0ZXImZ3Q7CiAmbHQ7cGxhdGZvcm0gaWRyZWY9 ImNwZTovbzpmZWRvcmFwcm9qZWN0OmZlZG9yYToxOSIgLyZndDsKLSZsdDt2ZXJzaW9uJmd0OzAu MC4xJmx0Oy92ZXJzaW9uJmd0OworJmx0O3ZlcnNpb24mZ3Q7MC4wLjImbHQ7L3ZlcnNpb24mZ3Q7 CiAmbHQ7L0JlbmNobWFyayZndDsKZGlmZiAtLWdpdCBhL0ZlZG9yYS9pbnB1dC9ndWlkZS54c2x0 IGIvRmVkb3JhL2lucHV0L2d1aWRlLnhzbHQKaW5kZXggOGJkZjg2ZS4uNTU5MDQyZSAxMDA2NDQK LS0tIGEvRmVkb3JhL2lucHV0L2d1aWRlLnhzbHQKKysrIGIvRmVkb3JhL2lucHV0L2d1aWRlLnhz bHQKQEAgLTQ2LDYgKzQ2LDcgQEAKICAgICAmbHQ7eHNsOmNvcHkmZ3Q7CiAgICAgICAmbHQ7eHNs OmNvcHktb2Ygc2VsZWN0PSJAKnxub2RlKCkiIC8mZ3Q7CiAgICAgICAmbHQ7eHNsOmFwcGx5LXRl bXBsYXRlcyBzZWxlY3Q9ImRvY3VtZW50KCdzeXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bh c3N3b3JkX3N0b3JhZ2UueG1sJykiIC8mZ3Q7CisgICAgICAmbHQ7eHNsOmFwcGx5LXRlbXBsYXRl cyBzZWxlY3Q9ImRvY3VtZW50KCdzeXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bhc3N3b3Jk X2V4cGlyYXRpb24ueG1sJykiIC8mZ3Q7CiAgICAgJmx0Oy94c2w6Y29weSZndDsKICAgJmx0Oy94 c2w6dGVtcGxhdGUmZ3Q7CiAKZGlmZiAtLWdpdCBhL0ZlZG9yYS9pbnB1dC9wcm9maWxlcy9jb21t b24ueG1sIGIvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKaW5kZXggMjczOWEzMy4u ODNlMzQ3OCAxMDA2NDQKLS0tIGEvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKKysr IGIvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKQEAgLTgsNSArOCw5IEBACiAmbHQ7 c2VsZWN0IGlkcmVmPSJub19oYXNoZXNfb3V0c2lkZV9zaGFkb3ciIHNlbGVjdGVkPSJ0cnVlIi8m Z3Q7CiAmbHQ7c2VsZWN0IGlkcmVmPSJnaWRfcGFzc3dkX2dyb3VwX3NhbWUiIHNlbGVjdGVkPSJ0 cnVlIi8mZ3Q7CiAmbHQ7c2VsZWN0IGlkcmVmPSJub19uZXRyY19maWxlcyIgc2VsZWN0ZWQ9InRy dWUiLyZndDsKKyZsdDtzZWxlY3QgaWRyZWY9ImFjY291bnRzX3Bhc3N3b3JkX21pbmxlbl9sb2dp bl9kZWZzIiBzZWxlY3RlZD0idHJ1ZSIvJmd0OworJmx0O3NlbGVjdCBpZHJlZj0iYWNjb3VudHNf bWluaW11bV9hZ2VfbG9naW5fZGVmcyIgc2VsZWN0ZWQ9InRydWUiLyZndDsKKyZsdDtzZWxlY3Qg aWRyZWY9ImFjY291bnRzX21heGltdW1fYWdlX2xvZ2luX2RlZnMiIHNlbGVjdGVkPSJ0cnVlIi8m Z3Q7CismbHQ7c2VsZWN0IGlkcmVmPSJhY2NvdW50c19wYXNzd29yZF93YXJuX2FnZV9sb2dpbl9k ZWZzIiBzZWxlY3RlZD0idHJ1ZSIvJmd0OwogCiAmbHQ7L1Byb2ZpbGUmZ3Q7CmRpZmYgLS1naXQg YS9GZWRvcmEvaW5wdXQvc3lzdGVtL2FjY291bnRzL3Jlc3RyaWN0aW9ucy9wYXNzd29yZF9leHBp cmF0aW9uLnhtbCBiL0ZlZG9yYS9pbnB1dC9zeXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bh c3N3b3JkX2V4cGlyYXRpb24ueG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LjczZDQ4YzYKLS0tIC9kZXYvbnVsbAorKysgYi9GZWRvcmEvaW5wdXQvc3lzdGVtL2FjY291bnRz L3Jlc3RyaWN0aW9ucy9wYXNzd29yZF9leHBpcmF0aW9uLnhtbApAQCAtMCwwICsxLDE3NyBAQAor Jmx0O0dyb3VwIGlkPSJwYXNzd29yZF9leHBpcmF0aW9uIiZndDsKKyZsdDt0aXRsZSZndDtTZXQg UGFzc3dvcmQgRXhwaXJhdGlvbiBQYXJhbWV0ZXJzJmx0Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlw dGlvbiZndDtUaGUgZmlsZSAmbHQ7dHQmZ3Q7L2V0Yy9sb2dpbi5kZWZzJmx0Oy90dCZndDsgY29u dHJvbHMgc2V2ZXJhbAorcGFzc3dvcmQtcmVsYXRlZCBzZXR0aW5ncy4gUHJvZ3JhbXMgc3VjaCBh cyAmbHQ7dHQmZ3Q7cGFzc3dkJmx0Oy90dCZndDssCismbHQ7dHQmZ3Q7c3UmbHQ7L3R0Jmd0Oywg YW5kICZsdDt0dCZndDtsb2dpbiZsdDsvdHQmZ3Q7IGNvbnN1bHQgJmx0O3R0Jmd0Oy9ldGMvbG9n aW4uZGVmcyZsdDsvdHQmZ3Q7IHRvIGRldGVybWluZQorYmVoYXZpb3Igd2l0aCByZWdhcmQgdG8g cGFzc3dvcmQgYWdpbmcsIGV4cGlyYXRpb24gd2FybmluZ3MsCithbmQgbGVuZ3RoLiBTZWUgdGhl IG1hbiBwYWdlICZsdDt0dCZndDtsb2dpbi5kZWZzKDUpJmx0Oy90dCZndDsgZm9yIG1vcmUgaW5m b3JtYXRpb24uCismbHQ7YnIvJmd0OyZsdDtici8mZ3Q7CitVc2VycyBzaG91bGQgYmUgZm9yY2Vk IHRvIGNoYW5nZSB0aGVpciBwYXNzd29yZHMsIGluIG9yZGVyIHRvCitkZWNyZWFzZSB0aGUgdXRp bGl0eSBvZiBjb21wcm9taXNlZCBwYXNzd29yZHMuIEhvd2V2ZXIsIHRoZSBuZWVkIHRvCitjaGFu Z2UgcGFzc3dvcmRzIG9mdGVuIHNob3VsZCBiZSBiYWxhbmNlZCBhZ2FpbnN0IHRoZSByaXNrIHRo YXQKK3VzZXJzIHdpbGwgcmV1c2Ugb3Igd3JpdGUgZG93biBwYXNzd29yZHMgaWYgZm9yY2VkIHRv IGNoYW5nZSB0aGVtCit0b28gb2Z0ZW4uIEZvcmNpbmcgcGFzc3dvcmQgY2hhbmdlcyBldmVyeSA5 MC0zNjAgZGF5cywgZGVwZW5kaW5nIG9uCit0aGUgZW52aXJvbm1lbnQsIGlzIHJlY29tbWVuZGVk LiBTZXQgdGhlIGFwcHJvcHJpYXRlIHZhbHVlIGFzCismbHQ7dHQmZ3Q7UEFTU19NQVhfREFZUyZs dDsvdHQmZ3Q7IGFuZCBhcHBseSBpdCB0byBleGlzdGluZyBhY2NvdW50cyB3aXRoIHRoZQorJmx0 O3R0Jmd0Oy1NJmx0Oy90dCZndDsgZmxhZy4KKyZsdDticiAvJmd0OyZsdDticiAvJmd0OworVGhl ICZsdDt0dCZndDtQQVNTX01JTl9EQVlTJmx0Oy90dCZndDsgKCZsdDt0dCZndDstbSZsdDsvdHQm Z3Q7KSBzZXR0aW5nIHByZXZlbnRzIHBhc3N3b3JkCitjaGFuZ2VzIGZvciA3IGRheXMgYWZ0ZXIg dGhlIGZpcnN0IGNoYW5nZSwgdG8gZGlzY291cmFnZSBwYXNzd29yZAorY3ljbGluZy4gSWYgeW91 IHVzZSB0aGlzIHNldHRpbmcsIHRyYWluIHVzZXJzIHRvIGNvbnRhY3QgYW4gYWRtaW5pc3RyYXRv cgorZm9yIGFuIGVtZXJnZW5jeSBwYXNzd29yZCBjaGFuZ2UgaW4gY2FzZSBhIG5ldyBwYXNzd29y ZCBiZWNvbWVzCitjb21wcm9taXNlZC4gVGhlICZsdDt0dCZndDtQQVNTX1dBUk5fQUdFJmx0Oy90 dCZndDsgKCZsdDt0dCZndDstVyZsdDsvdHQmZ3Q7KSBzZXR0aW5nIGdpdmVzCit1c2VycyA3IGRh eXMgb2Ygd2FybmluZ3MgYXQgbG9naW4gdGltZSB0aGF0IHRoZWlyIHBhc3N3b3JkcyBhcmUgYWJv dXQgdG8gZXhwaXJlLgorJmx0O2JyIC8mZ3Q7Jmx0O2JyIC8mZ3Q7CitGb3IgZXhhbXBsZSwgZm9y IGVhY2ggZXhpc3RpbmcgaHVtYW4gdXNlciAmbHQ7aSZndDtVU0VSJmx0Oy9pJmd0OywgZXhwaXJh dGlvbiBwYXJhbWV0ZXJzCitjb3VsZCBiZSBhZGp1c3RlZCB0byBhIDE4MCBkYXkgbWF4aW11bSBw YXNzd29yZCBhZ2UsIDcgZGF5IG1pbmltdW0gcGFzc3dvcmQKK2FnZSwgYW5kIDcgZGF5IHdhcm5p bmcgcGVyaW9kIHdpdGggdGhlIGZvbGxvd2luZyBjb21tYW5kOgorJmx0O3ByZSZndDsjIGNoYWdl IC1NIDE4MCAtbSA3IC1XIDcgVVNFUiZsdDsvcHJlJmd0OworJmx0Oy9kZXNjcmlwdGlvbiZndDsK KworJmx0O1ZhbHVlIGlkPSJ2YXJfYWNjb3VudHNfcGFzc3dvcmRfbWlubGVuX2xvZ2luX2RlZnMi IHR5cGU9Im51bWJlciIgJmd0OworJmx0O3RpdGxlJmd0O21pbmltdW0gcGFzc3dvcmQgbGVuZ3Ro Jmx0Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlwdGlvbiZndDtNaW5pbXVtIG51bWJlciBvZiBjaGFy YWN0ZXJzIGluIHBhc3N3b3JkJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZsdDt3YXJuaW5nIGNhdGVn b3J5PSJnZW5lcmFsIiZndDtUaGlzIHdpbGwgb25seSBjaGVjayBuZXcgcGFzc3dvcmRzJmx0Oy93 YXJuaW5nJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIiJmd0OzEyJmx0Oy92YWx1ZSZndDsKKyZs dDt2YWx1ZSBzZWxlY3Rvcj0iNiImZ3Q7NiZsdDsvdmFsdWUmZ3Q7CismbHQ7IS0tIE5JU1QgODAw LTUzIHJlcXVpcmVzIDEgaW4gYSBtaWxsaW9uIHVzaW5nIGJydXRlIGZvcmNlIHdoaWNoIHRyYW5z bGF0ZXMgdG8gc2l4IG51bWJlcnMgLS0mZ3Q7CismbHQ7dmFsdWUgc2VsZWN0b3I9IjgiJmd0Ozgm bHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIxMCImZ3Q7MTAmbHQ7L3ZhbHVlJmd0 OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIxMiImZ3Q7MTImbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVl IHNlbGVjdG9yPSIxNCImZ3Q7MTQmbHQ7L3ZhbHVlJmd0OworJmx0Oy9WYWx1ZSZndDsKKworJmx0 O1ZhbHVlIGlkPSJ2YXJfYWNjb3VudHNfbWF4aW11bV9hZ2VfbG9naW5fZGVmcyIgdHlwZT0ibnVt YmVyIiAmZ3Q7CismbHQ7dGl0bGUmZ3Q7bWF4aW11bSBwYXNzd29yZCBhZ2UmbHQ7L3RpdGxlJmd0 OworJmx0O2Rlc2NyaXB0aW9uJmd0O01heGltdW0gYWdlIG9mIHBhc3N3b3JkIGluIGRheXMmbHQ7 L2Rlc2NyaXB0aW9uJmd0OworJmx0O3dhcm5pbmcgY2F0ZWdvcnk9ImdlbmVyYWwiJmd0O1RoaXMg d2lsbCBvbmx5IGFwcGx5IHRvIG5ld2x5IGNyZWF0ZWQgYWNjb3VudHMmbHQ7L3dhcm5pbmcmZ3Q7 CismbHQ7dmFsdWUgc2VsZWN0b3I9IiImZ3Q7NjAmbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNl bGVjdG9yPSI2MCImZ3Q7NjAmbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSI5MCIm Z3Q7OTAmbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIxMjAiJmd0OzEyMCZsdDsv dmFsdWUmZ3Q7CismbHQ7dmFsdWUgc2VsZWN0b3I9IjE4MCImZ3Q7MTgwJmx0Oy92YWx1ZSZndDsK KyZsdDsvVmFsdWUmZ3Q7CisKKyZsdDtWYWx1ZSBpZD0idmFyX2FjY291bnRzX21pbmltdW1fYWdl X2xvZ2luX2RlZnMiIHR5cGU9Im51bWJlciIgJmd0OworJmx0O3RpdGxlJmd0O21pbmltdW0gcGFz c3dvcmQgYWdlJmx0Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlwdGlvbiZndDtNaW5pbXVtIGFnZSBv ZiBwYXNzd29yZCBpbiBkYXlzJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZsdDt3YXJuaW5nIGNhdGVn b3J5PSJnZW5lcmFsIiZndDtUaGlzIHdpbGwgb25seSBhcHBseSB0byBuZXdseSBjcmVhdGVkIGFj Y291bnRzJmx0Oy93YXJuaW5nJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIiJmd0OzcmbHQ7L3Zh bHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSI3IiZndDs3Jmx0Oy92YWx1ZSZndDsKKyZsdDt2 YWx1ZSBzZWxlY3Rvcj0iNSImZ3Q7NSZsdDsvdmFsdWUmZ3Q7CismbHQ7dmFsdWUgc2VsZWN0b3I9 IjEiJmd0OzEmbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIyIiZndDsyJmx0Oy92 YWx1ZSZndDsKKyZsdDt2YWx1ZSBzZWxlY3Rvcj0iMCImZ3Q7MCZsdDsvdmFsdWUmZ3Q7CismbHQ7 L1ZhbHVlJmd0OworCismbHQ7VmFsdWUgaWQ9InZhcl9hY2NvdW50c19wYXNzd29yZF93YXJuX2Fn ZV9sb2dpbl9kZWZzIiB0eXBlPSJudW1iZXIiICZndDsKKyZsdDt0aXRsZSZndDt3YXJuaW5nIGRh eXMgYmVmb3JlIHBhc3N3b3JkIGV4cGlyZXMmbHQ7L3RpdGxlJmd0OworJmx0O2Rlc2NyaXB0aW9u Jmd0O1RoZSBudW1iZXIgb2YgZGF5cycgd2FybmluZyBnaXZlbiBiZWZvcmUgYSBwYXNzd29yZCBl eHBpcmVzLiZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7d2FybmluZyBjYXRlZ29yeT0iZ2VuZXJh bCImZ3Q7VGhpcyB3aWxsIG9ubHkgYXBwbHkgdG8gbmV3bHkgY3JlYXRlZCBhY2NvdW50cyZsdDsv d2FybmluZyZndDsKKyZsdDt2YWx1ZSBzZWxlY3Rvcj0iIiZndDs3Jmx0Oy92YWx1ZSZndDsKKyZs dDt2YWx1ZSBzZWxlY3Rvcj0iMCImZ3Q7MCZsdDsvdmFsdWUmZ3Q7CismbHQ7dmFsdWUgc2VsZWN0 b3I9IjciJmd0OzcmbHQ7L3ZhbHVlJmd0OworJmx0O3ZhbHVlIHNlbGVjdG9yPSIxNCImZ3Q7MTQm bHQ7L3ZhbHVlJmd0OworJmx0Oy9WYWx1ZSZndDsKKworJmx0O1J1bGUgaWQ9ImFjY291bnRzX3Bh c3N3b3JkX21pbmxlbl9sb2dpbl9kZWZzIiBzZXZlcml0eT0ibWVkaXVtIiZndDsKKyZsdDt0aXRs ZSZndDtTZXQgUGFzc3dvcmQgTWluaW11bSBMZW5ndGggaW4gbG9naW4uZGVmcyZsdDsvdGl0bGUm Z3Q7CismbHQ7ZGVzY3JpcHRpb24mZ3Q7VG8gc3BlY2lmeSBwYXNzd29yZCBsZW5ndGggcmVxdWly ZW1lbnRzIGZvciBuZXcgYWNjb3VudHMsCitlZGl0IHRoZSBmaWxlICZsdDt0dCZndDsvZXRjL2xv Z2luLmRlZnMmbHQ7L3R0Jmd0OyBhbmQgYWRkIG9yIGNvcnJlY3QgdGhlIGZvbGxvd2luZworbGlu ZXM6CismbHQ7cHJlJmd0O1BBU1NfTUlOX0xFTiAxMiZsdDshLS0gJmx0O3N1YiBpZHJlZj0idmFy X2FjY291bnRzX3Bhc3N3b3JkX21pbmxlbl9sb2dpbl9kZWZzIiZndDsgLS0mZ3Q7Jmx0Oy9wcmUm Z3Q7CismbHQ7YnIvJmd0OyZsdDtici8mZ3Q7CitOb3dhZGF5cyByZWNvbW1lbmRlZCB2YWx1ZXMs IGNvbnNpZGVyZWQgYXMgc2VjdXJlIGJ5IHZhcmlvdXMgb3JnYW5pemF0aW9ucworZm9jdXNlZCBv biB0b3BpYyBvZiBjb21wdXRlciBzZWN1cml0eSwgcmFuZ2UgZnJvbSAmbHQ7dHQmZ3Q7MTIgKEZJ U01BKSZsdDsvdHQmZ3Q7IHVwIHRvCismbHQ7dHQmZ3Q7MTQgKERvRCkmbHQ7L3R0Jmd0OyBjaGFy YWN0ZXJzIGZvciBwYXNzd29yZCBsZW5ndGggcmVxdWlyZW1lbnRzLgorSWYgYSBwcm9ncmFtIGNv bnN1bHRzICZsdDt0dCZndDsvZXRjL2xvZ2luLmRlZnMmbHQ7L3R0Jmd0OyBhbmQgYWxzbyBhbm90 aGVyIFBBTSBtb2R1bGUKKyhzdWNoIGFzICZsdDt0dCZndDtwYW1fY3JhY2tsaWImbHQ7L3R0Jmd0 OykgZHVyaW5nIGEgcGFzc3dvcmQgY2hhbmdlIG9wZXJhdGlvbiwKK3RoZW4gdGhlIG1vc3QgcmVz dHJpY3RpdmUgbXVzdCBiZSBzYXRpc2ZpZWQuIFNlZSBQQU0gc2VjdGlvbgorZm9yIG1vcmUgaW5m b3JtYXRpb24gYWJvdXQgZW5mb3JjaW5nIHBhc3N3b3JkIHF1YWxpdHkgcmVxdWlyZW1lbnRzLgor Jmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZsdDtvY2lsIGNsYXVzZT0iaXQgaXMgbm90IHNldCB0byB0 aGUgcmVxdWlyZWQgdmFsdWUiJmd0OworVG8gY2hlY2sgdGhlIG1pbmltdW0gcGFzc3dvcmQgbGVu Z3RoLCBydW4gdGhlIGNvbW1hbmQ6CismbHQ7cHJlJmd0OyQgZ3JlcCBQQVNTX01JTl9MRU4gL2V0 Yy9sb2dpbi5kZWZzJmx0Oy9wcmUmZ3Q7CitQYXNzd29yZHMgb2YgbGVuZ3RoICZsdDt0dCZndDsx MiZsdDsvdHQmZ3Q7IGNoYXJhY3RlcnMgYW5kIG1vcmUgYXJlIG5vd2FkYXlzCitjb25zaWRlcmVk IHRvIGJlIGEgc3RhbmRhcmQgcmVxdWlyZW1lbnQuCismbHQ7L29jaWwmZ3Q7CismbHQ7cmF0aW9u YWxlJmd0OworUmVxdWlyaW5nIGEgbWluaW11bSBwYXNzd29yZCBsZW5ndGggbWFrZXMgcGFzc3dv cmQKK2NyYWNraW5nIGF0dGFja3MgbW9yZSBkaWZmaWN1bHQgYnkgZW5zdXJpbmcgYSBsYXJnZXIK K3NlYXJjaCBzcGFjZS4gSG93ZXZlciwgYW55IHNlY3VyaXR5IGJlbmVmaXQgZnJvbSBhbiBvbmVy b3VzIHJlcXVpcmVtZW50CittdXN0IGJlIGNhcmVmdWxseSB3ZWlnaGVkIGFnYWluc3QgdXNhYmls aXR5IHByb2JsZW1zLCBzdXBwb3J0IGNvc3RzLCBvcgorY291bnRlcnByb2R1Y3RpdmUgYmVoYXZp b3IgdGhhdCBtYXkgcmVzdWx0LgorJmx0Oy9yYXRpb25hbGUmZ3Q7CismbHQ7b3ZhbCBpZD0iYWNj b3VudHNfcGFzc3dvcmRfbWlubGVuX2xvZ2luX2RlZnMiIHZhbHVlPSJ2YXJfYWNjb3VudHNfcGFz c3dvcmRfbWlubGVuX2xvZ2luX2RlZnMiLyZndDsKKyZsdDtyZWYgbmlzdD0iSUEtNShmKSxJQS01 KDEpKGEpIiBkaXNhPSIyMDUiLyZndDsKKyZsdDsvUnVsZSZndDsKKworJmx0O1J1bGUgaWQ9ImFj Y291bnRzX21pbmltdW1fYWdlX2xvZ2luX2RlZnMiIHNldmVyaXR5PSJtZWRpdW0iJmd0OworJmx0 O3RpdGxlJmd0O1NldCBQYXNzd29yZCBNaW5pbXVtIEFnZSZsdDsvdGl0bGUmZ3Q7CismbHQ7ZGVz Y3JpcHRpb24mZ3Q7VG8gc3BlY2lmeSBwYXNzd29yZCBtaW5pbXVtIGFnZSBmb3IgbmV3IGFjY291 bnRzLAorZWRpdCB0aGUgZmlsZSAmbHQ7dHQmZ3Q7L2V0Yy9sb2dpbi5kZWZzJmx0Oy90dCZndDsg YW5kIGFkZCBvciBjb3JyZWN0IHRoZQorZm9sbG93aW5nIGxpbmUsIHJlcGxhY2luZyB0aGUgJmx0 O2kmZ3Q7REFZUyZsdDsvaSZndDsgaXRlbSBhcyBhcHByb3ByaWF0ZTogCismbHQ7cHJlJmd0O1BB U1NfTUlOX0RBWVMgJmx0O2kmZ3Q7REFZUyZsdDsvaSZndDsmbHQ7L3ByZSZndDsKK0EgdmFsdWUg b2YgMSBkYXkgaXMgY29uc2lkZXJlZCB0byBiZSBzdWZmaWNpZW50IGZvciBtYW55IGVudmlyb25t ZW50cy4KKyZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7b2NpbCBjbGF1c2U9Iml0IGlzIG5vdCBz ZXQgdG8gdGhlIHJlcXVpcmVkIHZhbHVlIiZndDsKK1RvIGNoZWNrIHRoZSBtaW5pbXVtIHBhc3N3 b3JkIGFnZSwgcnVuIHRoZSBjb21tYW5kOgorJmx0O3ByZSZndDskIGdyZXAgUEFTU19NSU5fREFZ UyAvZXRjL2xvZ2luLmRlZnMmbHQ7L3ByZSZndDsKK0EgdmFsdWUgb2YgMSBkYXkgaXMgY29uc2lk ZXJlZCB0byBiZSBzdWZmaWNpZW50IGZvciBtYW55IGVudmlyb25tZW50cy4KKyZsdDsvb2NpbCZn dDsKKyZsdDtyYXRpb25hbGUmZ3Q7CitTZXR0aW5nIHRoZSBtaW5pbXVtIHBhc3N3b3JkIGFnZSBw cm90ZWN0cyBhZ2FpbnN0IHVzZXJzIGN5Y2xpbmcKK2JhY2sgdG8gYSBmYXZvcml0ZSBwYXNzd29y ZCBhZnRlciBzYXRpc2Z5aW5nIHRoZSBwYXNzd29yZCByZXVzZQorcmVxdWlyZW1lbnQuCismbHQ7 L3JhdGlvbmFsZSZndDsKKyZsdDtvdmFsIGlkPSJhY2NvdW50c19taW5pbXVtX2FnZV9sb2dpbl9k ZWZzIiB2YWx1ZT0idmFyX2FjY291bnRzX21pbmltdW1fYWdlX2xvZ2luX2RlZnMiLyZndDsKKyZs dDtyZWYgbmlzdD0iSUEtNShmKSxJQS01KDEpKGQpIiBkaXNhPSIxOTgiLyZndDsKKyZsdDsvUnVs ZSZndDsKKworJmx0O1J1bGUgaWQ9ImFjY291bnRzX21heGltdW1fYWdlX2xvZ2luX2RlZnMiIHNl dmVyaXR5PSJtZWRpdW0iJmd0OworJmx0O3RpdGxlJmd0O1NldCBQYXNzd29yZCBNYXhpbXVtIEFn ZSZsdDsvdGl0bGUmZ3Q7CismbHQ7ZGVzY3JpcHRpb24mZ3Q7VG8gc3BlY2lmeSBwYXNzd29yZCBt YXhpbXVtIGFnZSBmb3IgbmV3IGFjY291bnRzLAorZWRpdCB0aGUgZmlsZSAmbHQ7dHQmZ3Q7L2V0 Yy9sb2dpbi5kZWZzJmx0Oy90dCZndDsgYW5kIGFkZCBvciBjb3JyZWN0IHRoZQorZm9sbG93aW5n IGxpbmUsIHJlcGxhY2luZyB0aGUgJmx0O2kmZ3Q7REFZUyZsdDsvaSZndDsgaXRlbSBhcHByb3By aWF0ZWx5OgorJmx0O3ByZSZndDtQQVNTX01BWF9EQVlTICZsdDtpJmd0O0RBWVMmbHQ7L2kmZ3Q7 Jmx0Oy9wcmUmZ3Q7CitBIHZhbHVlIG9mIDE4MCBkYXlzIGlzIHN1ZmZpY2llbnQgZm9yIG1hbnkg ZW52aXJvbm1lbnRzLiAKKyZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7b2NpbCBjbGF1c2U9Iml0 IGlzIG5vdCBzZXQgdG8gdGhlIHJlcXVpcmVkIHZhbHVlIiZndDsKK1RvIGNoZWNrIHRoZSBtYXhp bXVtIHBhc3N3b3JkIGFnZSwgcnVuIHRoZSBjb21tYW5kOgorJmx0O3ByZSZndDskIGdyZXAgUEFT U19NQVhfREFZUyAvZXRjL2xvZ2luLmRlZnMmbHQ7L3ByZSZndDsKK0EgdmFsdWUgb2YgMTgwIGRh eXMgaXMgc3VmZmljaWVudCBmb3IgbWFueSBlbnZpcm9ubWVudHMuIAorJmx0Oy9vY2lsJmd0Owor Jmx0O3JhdGlvbmFsZSZndDsKK1NldHRpbmcgdGhlIHBhc3N3b3JkIG1heGltdW0gYWdlIGVuc3Vy ZXMgdXNlcnMgYXJlIHJlcXVpcmVkIHRvCitwZXJpb2RpY2FsbHkgY2hhbmdlIHRoZWlyIHBhc3N3 b3Jkcy4gVGhpcyBjb3VsZCBwb3NzaWJseSBkZWNyZWFzZQordGhlIHV0aWxpdHkgb2YgYSBzdG9s ZW4gcGFzc3dvcmQuIFJlcXVpcmluZyBzaG9ydGVyIHBhc3N3b3JkIGxpZmV0aW1lcworaW5jcmVh c2VzIHRoZSByaXNrIG9mIHVzZXJzIHdyaXRpbmcgZG93biB0aGUgcGFzc3dvcmQgaW4gYSBjb252 ZW5pZW50Citsb2NhdGlvbiBzdWJqZWN0IHRvIHBoeXNpY2FsIGNvbXByb21pc2UuJmx0Oy9yYXRp b25hbGUmZ3Q7CismbHQ7b3ZhbCBpZD0iYWNjb3VudHNfbWF4aW11bV9hZ2VfbG9naW5fZGVmcyIg dmFsdWU9InZhcl9hY2NvdW50c19tYXhpbXVtX2FnZV9sb2dpbl9kZWZzIi8mZ3Q7CismbHQ7cmVm IG5pc3Q9IklBLTUoZiksSUEtNShnKSxJQS01KDEpKGQpIiBkaXNhPSIxODAsMTk5IiAvJmd0Owor Jmx0Oy9SdWxlJmd0OworCismbHQ7UnVsZSBpZD0iYWNjb3VudHNfcGFzc3dvcmRfd2Fybl9hZ2Vf bG9naW5fZGVmcyImZ3Q7CismbHQ7dGl0bGUmZ3Q7U2V0IFBhc3N3b3JkIFdhcm5pbmcgQWdlJmx0 Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlwdGlvbiZndDtUbyBzcGVjaWZ5IGhvdyBtYW55IGRheXMg cHJpb3IgdG8gcGFzc3dvcmQKK2V4cGlyYXRpb24gdGhhdCBhIHdhcm5pbmcgd2lsbCBiZSBpc3N1 ZWQgdG8gdXNlcnMsCitlZGl0IHRoZSBmaWxlICZsdDt0dCZndDsvZXRjL2xvZ2luLmRlZnMmbHQ7 L3R0Jmd0OyBhbmQgYWRkIG9yIGNvcnJlY3QKKyB0aGUgZm9sbG93aW5nIGxpbmUsIHJlcGxhY2lu ZyB0aGUgJmx0O2kmZ3Q7REFZUyZsdDsvaSZndDsgaXRlbSBhcyBhcHByb3ByaWF0ZToKKyZsdDtw cmUmZ3Q7UEFTU19XQVJOX0FHRSAmbHQ7aSZndDtEQVlTJmx0Oy9pJmd0OyZsdDsvcHJlJmd0Owor QSB2YWx1ZSBvZiA3IGRheXMgd291bGQgYmUgbm93YWRheXMgY29uc2lkZXJlZCB0byBiZSBhIHN0 YW5kYXJkLgorJmx0OyEtLSAmbHQ7c3ViIGlkcmVmPSJhY2NvdW50c19wYXNzd29yZF93YXJuX2Fn ZV9sb2dpbl9kZWZzX2xvZ2luX2RlZnNfdmFsdWUiIC8mZ3Q7IC0tJmd0OworJmx0Oy9kZXNjcmlw dGlvbiZndDsKKyZsdDtvY2lsIGNsYXVzZT0iaXQgaXMgbm90IHNldCB0byB0aGUgcmVxdWlyZWQg dmFsdWUiJmd0OworVG8gY2hlY2sgdGhlIHBhc3N3b3JkIHdhcm5pbmcgYWdlLCBydW4gdGhlIGNv bW1hbmQ6CismbHQ7cHJlJmd0OyQgZ3JlcCBQQVNTX1dBUk5fQUdFIC9ldGMvbG9naW4uZGVmcyZs dDsvcHJlJmd0OworQSB2YWx1ZSBvZiA3IGRheXMgd291bGQgYmUgbm93YWRheXMgY29uc2lkZXJl ZCB0byBiZSBhIHN0YW5kYXJkLgorJmx0Oy9vY2lsJmd0OworJmx0O3JhdGlvbmFsZSZndDsKK1Nl dHRpbmcgdGhlIHBhc3N3b3JkIHdhcm5pbmcgYWdlIGVuYWJsZXMgdXNlcnMgdG8gbWFrZSB0aGUg Y2hhbmdlCithdCBhIHByYWN0aWNhbCB0aW1lLgorJmx0Oy9yYXRpb25hbGUmZ3Q7CismbHQ7b3Zh bCBpZD0iYWNjb3VudHNfcGFzc3dvcmRfd2Fybl9hZ2VfbG9naW5fZGVmcyIgdmFsdWU9InZhcl9h Y2NvdW50c19wYXNzd29yZF93YXJuX2FnZV9sb2dpbl9kZWZzIiAvJmd0OworJmx0O3JlZiBuaXN0 PSJJQS01KGYpIiAvJmd0OworJmx0Oy9SdWxlJmd0OworCismbHQ7L0dyb3VwJmd0OwpkaWZmIC0t Z2l0IGEvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyBiL0ZlZG9yYS9zY2FwLXNlY3Vy aXR5LWd1aWRlLnNwZWMKaW5kZXggNzNlYWI1Ny4uMWFiZTY2NiAxMDA2NDQKLS0tIGEvRmVkb3Jh L3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYworKysgYi9GZWRvcmEvc2NhcC1zZWN1cml0eS1ndWlk ZS5zcGVjCkBAIC01LDcgKzUsNyBAQAogIyBmaWxlIG9uZSBsZXZlbCB1cCAtIGluIHRoZSBtYWlu IHNjYXAtc2VjdXJpdHktZ3VpZGUgZGlyZWN0b3J5IChpbnN0ZWFkIG9mCiAjIHRoaXMgb25lKS4K IAotJWdsb2JhbAlmZWRvcmFzc2dyZWxlYXNlCTIucmMyCislZ2xvYmFsCWZlZG9yYXNzZ3JlbGVh c2UJMi5yYzMKIAogTmFtZToJCXNjYXAtc2VjdXJpdHktZ3VpZGUKIFZlcnNpb246CTAuMQpAQCAt NTAsNiArNTAsOSBAQCBybSAtcmYgJFJQTV9CVUlMRF9ST09UCiAle19kYXRhZGlyfS94bWwvc2Nh cC9zc2cvZmVkb3JhLzE5LyoKIAogJWNoYW5nZWxvZworKiBUaHUgT2N0IDEwIDIwMTMgSmFuIGlh bmtrbyBMaWVza292c2t5IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQt bGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmpsaWVza292QHJlZGhhdC5jb20iPiZsdDtqbGll c2tvdkByZWRoYXQuY29tJmd0OzwvYT4gMC4xLTIucmMzCistIENvbnZlcnQgZm91ciBSSEVMNiAn U2V0IFBhc3N3b3JkIEV4cGlyYXRpb24gUGFyYW1ldGVyJyBydWxlcyB0byBGZWRvcmEKKwogKiBU aHUgT2N0IDEwIDIwMTMgSmFuIGlhbmtrbyBMaWVza292c2t5IDxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmpsaWVza292 QHJlZGhhdC5jb20iPiZsdDtqbGllc2tvdkByZWRoYXQuY29tJmd0OzwvYT4gMC4xLTIucmMyCiAt IEludHJvZHVjZSAnQWNjb3VudCBhbmQgQWNjZXNzIENvbnRyb2wnIHNlY3Rpb24KIC0gQ29udmVy dCBmb2xsb3dpbmcgIlZlcmlmeSBQcm9wZXIgU3RvcmFnZSBhbmQgRXhpc3RlbmNlIG9mIFBhc3N3 b3JkIEhhc2hlcyIgc2VjdGlvbgo8ZGl2IGNsYXNzPSJtb3otdHh0LXNpZyI+LS0gCjEuNy4xMS43 Cgo8L2Rpdj48L3ByZT4KICAgICAgPC9kaXY+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAg ICBhY2s8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============8229476321873323050==-- From shawn at redhat.com Thu Aug 20 11:35:31 2015 Content-Type: multipart/mixed; boundary="===============2376182210924377421==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'. Convert four RHEL-6 rules from its 'Verify Proper Storage' subsection to Fedora Date: Thu, 10 Oct 2013 16:44:04 -0400 Message-ID: <52571194.9020708@redhat.com> In-Reply-To: 1494505829.4045764.1381416769395.JavaMail.root@redhat.com --===============2376182210924377421== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/10/13 10:52 AM, Jan Lieskovsky wrote: > This patch introduces new 'Accounts and Access Control' section > for Fedora content. Also convert four existing RHEL-6 rules from > 'Protect Accounts by Restricting Password-Based Login' and include > them into Fedora. > > Please review. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0001-Fedora-Introduce-Accounts-and-Access-Control-Section.patch > > > From d5049e0baca827e33de5dbd7da28cf037c2eed40 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Thu, 10 Oct 2013 16:40:14 +0200 > Subject: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'. > Convert four RHEL-6 rules from its 'Verify Proper Storage' > subsection to Fedora > > > Signed-off-by: Jan Lieskovsky > --- > .../checks/accounts_password_all_shadowed.xml | 24 +++++ > Fedora/input/checks/no_empty_passwords.xml | 22 +++++ > Fedora/input/checks/no_netrc_files.xml | 22 +++++ > Fedora/input/guide.xslt | 15 +++ > Fedora/input/profiles/common.xml | 4 + > Fedora/input/system/accounts/accounts.xml | 11 +++ > .../accounts/restrictions/password_storage.xml | 107 ++++++++++++++= +++++++ > .../system/accounts/restrictions/restrictions.xml | 13 +++ > Fedora/scap-security-guide.spec | 11 ++- > 9 files changed, 228 insertions(+), 1 deletion(-) > create mode 100644 Fedora/input/checks/accounts_password_all_shadowed.x= ml > create mode 100644 Fedora/input/checks/no_empty_passwords.xml > create mode 100644 Fedora/input/checks/no_netrc_files.xml > create mode 100644 Fedora/input/system/accounts/accounts.xml > create mode 100644 Fedora/input/system/accounts/restrictions/password_s= torage.xml > create mode 100644 Fedora/input/system/accounts/restrictions/restrictio= ns.xml > > diff --git a/Fedora/input/checks/accounts_password_all_shadowed.xml b/Fed= ora/input/checks/accounts_password_all_shadowed.xml > new file mode 100644 > index 0000000..42b7482 > --- /dev/null > +++ b/Fedora/input/checks/accounts_password_all_shadowed.xml > @@ -0,0 +1,24 @@ > + > + > + > + All Password Hashes Shadowed > + > + Fedora 19 > + > + All password hashes should be shadowed. > + > + > + > + > + > + > + > + > + > + > + .* > + > + > + x > + > + > diff --git a/Fedora/input/checks/no_empty_passwords.xml b/Fedora/input/ch= ecks/no_empty_passwords.xml > new file mode 100644 > index 0000000..054d643 > --- /dev/null > +++ b/Fedora/input/checks/no_empty_passwords.xml > @@ -0,0 +1,22 @@ > + > + > + > + No nullok Option in /etc/pam.d/system-auth > + > + Fedora 19 > + > + The file /etc/pam.d/system-auth should not contain th= e nullok option > + > + > + > + > + > + > + > + > + > + /etc/pam.d/system-auth > + \s*nullok\s* > + 1 > + > + > diff --git a/Fedora/input/checks/no_netrc_files.xml b/Fedora/input/checks= /no_netrc_files.xml > new file mode 100644 > index 0000000..740a98b > --- /dev/null > +++ b/Fedora/input/checks/no_netrc_files.xml > @@ -0,0 +1,22 @@ > + > + > + > + Verify No netrc Files Exist > + > + Fedora 19 > + > + The .netrc files contain login information used to au= to-login into FTP servers and reside in the user's home directory. Any .net= rc files should be removed. > + > + > + > + > + > + > + > + > + > + > + /home > + ^\.netrc$ > + > + > diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt > index a24bdd9..8bdf86e 100644 > --- a/Fedora/input/guide.xslt > +++ b/Fedora/input/guide.xslt > @@ -24,6 +24,7 @@ > > > > + > > > = > @@ -34,6 +35,20 @@ > > > = > + > + > + > + > + > + > + > + > + > + > + > + > + > + > > > > diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/com= mon.xml > index 18c8f3e..2739a33 100644 > --- a/Fedora/input/profiles/common.xml > +++ b/Fedora/input/profiles/common.xml > @@ -4,5 +4,9 @@ > = > > + > + > = >
> diff --git a/Fedora/input/system/accounts/accounts.xml b/Fedora/input/sys= tem/accounts/accounts.xml > new file mode 100644 > index 0000000..044d85d > --- /dev/null > +++ b/Fedora/input/system/accounts/accounts.xml > @@ -0,0 +1,11 @@ > + > +Account and Access Control > +In traditional Unix security, if an attacker gains > +shell access to a certain login account, they can perform any action > +or access any file to which that account has access. Therefore, > +making it more difficult for unauthorized people to gain shell > +access to accounts, particularly to privileged accounts, is a > +necessary part of securing a system. This section introduces > +mechanisms for restricting access to accounts under Fedora. > + > + > diff --git a/Fedora/input/system/accounts/restrictions/password_storage.x= ml b/Fedora/input/system/accounts/restrictions/password_storage.xml > new file mode 100644 > index 0000000..d1bbcd3 > --- /dev/null > +++ b/Fedora/input/system/accounts/restrictions/password_storage.xml > @@ -0,0 +1,107 @@ > + > +Verify Proper Storage and Existence of Password > +Hashes > + > +By default, password hashes for local accounts are stored > +in the second field (colon-separated) in > +/etc/shadow. This file should be readable only by > +processes running with root credentials, preventing users from > +casually accessing others' password hashes and attempting > +to crack them. > +However, it remains possible to misconfigure the system > +and store password hashes > +in world-readable files such as /etc/passwd, or > +to even store passwords themselves in plaintext on the system. > +Using system-provided tools for password change/creation > +should allow administrators to avoid such misconfiguration. > + > + > + > +Prevent Log In to Accounts With Empty Password > +If an account is configured for password authentication > +but does not have an assigned password, it may be possible to log > +into the account without authentication. Remove any instances of the nullok > +option in /etc/pam.d/system-auth to > +prevent logins with empty passwords. > + > + > +To verify that null passwords cannot be used, run the following command: > +
# grep nullok /etc/pam.d/system-auth
> +If this produces any output, it may be possible to log into accounts > +with empty passwords. > +
> + > +If an account has an empty password, anyone could log in and > +run commands with the privileges of that account. Accounts with > +empty passwords should never be used in operational > +environments. > + > + > + > +
> + > + > +Verify All Account Password Hashes are Shadowed > + > +If any password hashes are stored in /etc/passwd (in the second= field, > +instead of an x), the cause of this misconfiguration should be > +investigated. The account should have its password reset and the hash s= hould be > +properly stored, or the account should be deleted entirely. > + > + > +To check that no password hashes are stored in > +/etc/passwd, run the following command: > +
# awk -F: '($2 !=3D "x") {print}' /etc/passwd
> +If it produces any output, then a password hash is > +stored in /etc/passwd. > +
> + > +The hashes for all user account passwords should be stored in > +the file /etc/shadow and never in /etc/passwd, > +which is readable by all users. > + > + > + > +
> + > + > +All GIDs referenced in /etc/passwd must be defined in /etc/group<= /title> > +<description> > +Add a group to the system for each GID referenced without a correspondin= g group. > +</description> > +<ocil clause=3D"there is output"> > +To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt= >/etc/group</tt>, > +run the following command: > +<pre># pwck -qr</pre> > +There should be no output. > +</ocil> > +<rationale> > +Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</t= t> could lead to a user having unintended rights. > +</rationale> > +<ref disa=3D"366" /> > +</Rule> > + > +<Rule id=3D"no_netrc_files" severity=3D"medium"> > +<title>Verify No netrc Files Exist > +The .netrc files contain login information > +used to auto-login into FTP servers and reside in the user's home > +directory. These files may contain unencrypted passwords to > +remote FTP servers making them susceptible to access by unauthorized > +users and should not be used. Any .netrc files should be remov= ed. > + > + > +To check the system for the existence of any .netrc files, > +run the following command: > +
# find /home -xdev -name .netrc
> + > +
> + > +Unencrypted passwords for remote FTP servers may be stored in .netrc= > +files. DoD policy requires passwords be encrypted in storage and not used > +in access scripts. > + > + > + > +
> + > +
> diff --git a/Fedora/input/system/accounts/restrictions/restrictions.xml b= /Fedora/input/system/accounts/restrictions/restrictions.xml > new file mode 100644 > index 0000000..febead6 > --- /dev/null > +++ b/Fedora/input/system/accounts/restrictions/restrictions.xml > @@ -0,0 +1,13 @@ > + > +Protect Accounts by Restricting Password-Based Login > +Conventionally, Unix shell accounts are accessed by > +providing a username and password to a login program, which tests > +these values for correctness using the /etc/passwd and > +/etc/shadow files. Password-based login is vulnerable to > +guessing of weak passwords, and to sniffing and man-in-the-middle > +attacks against passwords entered over a network or at an insecure > +console. Therefore, mechanisms for accessing accounts by entering > +usernames and passwords should be restricted to those which are > +operationally necessary. > + > + > diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide= .spec > index 4ef3713..73eab57 100644 > --- a/Fedora/scap-security-guide.spec > +++ b/Fedora/scap-security-guide.spec > @@ -5,7 +5,7 @@ > # file one level up - in the main scap-security-guide directory (instea= d of > # this one). > = > -%global fedorassgrelease 2.rc1 > +%global fedorassgrelease 2.rc2 > = > Name: scap-security-guide > Version: 0.1 > @@ -50,6 +50,15 @@ rm -rf $RPM_BUILD_ROOT > %{_datadir}/xml/scap/ssg/fedora/19/* > = > %changelog > +* Thu Oct 10 2013 Jan iankko Lieskovsky 0.1-2.rc2 > +- Introduce 'Account and Access Control' section > +- Convert following "Verify Proper Storage and Existence of Password Has= hes" section > + rules to Fedora: > + * Prevent Log In to Accounts With Empty Password > + * Verify All Account Password Hashes are Shadowed > + * All GIDs referenced in /etc/passwd must be defined in /etc/group > + * Verify No netrc Files Exist > + > * Wed Oct 02 2013 Jan iankko Lieskovsky 0.1-2.r= c1 > - Set proper name of the build directory in the spec's %setup macro. > - Replace hard-wired paths with macros. Preserve attributes when copyin= g files. > -- 1.7.11.7 ack --===============2376182210924377421== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8xMC8xMyAxMDo1MiBBTSwgSmFuIExpZXNrb3Zza3kKICAgICAgd3JvdGU6PGJyPgog ICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MTQ5NDUwNTgyOS40MDQ1 NzY0LjEzODE0MTY3NjkzOTUuSmF2YU1haWwucm9vdEByZWRoYXQuY29tIgogICAgICB0eXBlPSJj aXRlIj4KICAgICAgPGRpdiBjbGFzcz0ibW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBo aWNhbC1xdW90ZT0idHJ1ZSIKICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7 IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgbGFuZz0ieC11bmljb2RlIj4KICAgICAgICA8cHJl IHdyYXA9IiI+VGhpcyBwYXRjaCBpbnRyb2R1Y2VzIG5ldyAnQWNjb3VudHMgYW5kIEFjY2VzcyBD b250cm9sJyBzZWN0aW9uCmZvciBGZWRvcmEgY29udGVudC4gQWxzbyBjb252ZXJ0IGZvdXIgZXhp c3RpbmcgUkhFTC02IHJ1bGVzIGZyb20KJ1Byb3RlY3QgQWNjb3VudHMgYnkgUmVzdHJpY3Rpbmcg UGFzc3dvcmQtQmFzZWQgTG9naW4nIGFuZCBpbmNsdWRlCnRoZW0gaW50byBGZWRvcmEuCgpQbGVh c2UgcmV2aWV3LgoKVGhhbmsgeW91ICZhbXA7JmFtcDsgUmVnYXJkcywgSmFuLgotLQpKYW4gaWFu a2tvIExpZXNrb3Zza3kgLyBSZWQgSGF0IFNlY3VyaXR5IFRlY2hub2xvZ2llcyBUZWFtPC9wcmU+ CiAgICAgIDwvZGl2PgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFj aG1lbnRIZWFkZXIiPjxsZWdlbmQKICAgICAgICAgIGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRl ck5hbWUiPjAwMDEtRmVkb3JhLUludHJvZHVjZS1BY2NvdW50cy1hbmQtQWNjZXNzLUNvbnRyb2wt U2VjdGlvbi5wYXRjaDwvbGVnZW5kPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPGRpdiBj bGFzcz0ibW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIK ICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsi CiAgICAgICAgbGFuZz0ieC13ZXN0ZXJuIj4KICAgICAgICA8cHJlIHdyYXA9IiI+RnJvbSBkNTA0 OWUwYmFjYTgyN2UzM2RlNWRiZDdkYTI4Y2YwMzdjMmVlZDQwIE1vbiBTZXAgMTcgMDA6MDA6MDAg MjAwMQpGcm9tOiBKYW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNz PSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29t Ij4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+CkRhdGU6IFRodSwgMTAgT2N0IDIwMTMg MTY6NDA6MTQgKzAyMDAKU3ViamVjdDogW1BBVENIXSBbRmVkb3JhXSBJbnRyb2R1Y2UgJ0FjY291 bnRzIGFuZCBBY2Nlc3MgQ29udHJvbCBTZWN0aW9uJy4KIENvbnZlcnQgZm91ciBSSEVMLTYgcnVs ZXMgZnJvbSBpdHMgJ1ZlcmlmeSBQcm9wZXIgU3RvcmFnZScKIHN1YnNlY3Rpb24gdG8gRmVkb3Jh CgoKU2lnbmVkLW9mZi1ieTogSmFuIExpZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVl IiBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVk aGF0LmNvbSI+Jmx0O2psaWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPgotLS0KIC4uLi9jaGVja3Mv YWNjb3VudHNfcGFzc3dvcmRfYWxsX3NoYWRvd2VkLnhtbCAgICAgIHwgIDI0ICsrKysrCiBGZWRv cmEvaW5wdXQvY2hlY2tzL25vX2VtcHR5X3Bhc3N3b3Jkcy54bWwgICAgICAgICB8ICAyMiArKysr KwogRmVkb3JhL2lucHV0L2NoZWNrcy9ub19uZXRyY19maWxlcy54bWwgICAgICAgICAgICAgfCAg MjIgKysrKysKIEZlZG9yYS9pbnB1dC9ndWlkZS54c2x0ICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgIDE1ICsrKwogRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwgICAgICAgICAg ICAgICAgICAgfCAgIDQgKwogRmVkb3JhL2lucHV0L3N5c3RlbS9hY2NvdW50cy9hY2NvdW50cy54 bWwgICAgICAgICAgfCAgMTEgKysrCiAuLi4vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bhc3N3b3Jk X3N0b3JhZ2UueG1sICAgICB8IDEwNyArKysrKysrKysrKysrKysrKysrKysKIC4uLi9zeXN0ZW0v YWNjb3VudHMvcmVzdHJpY3Rpb25zL3Jlc3RyaWN0aW9ucy54bWwgIHwgIDEzICsrKwogRmVkb3Jh L3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYyAgICAgICAgICAgICAgICAgICAgfCAgMTEgKystCiA5 IGZpbGVzIGNoYW5nZWQsIDIyOCBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCiBjcmVhdGUg bW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L2NoZWNrcy9hY2NvdW50c19wYXNzd29yZF9hbGxfc2hh ZG93ZWQueG1sCiBjcmVhdGUgbW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L2NoZWNrcy9ub19lbXB0 eV9wYXNzd29yZHMueG1sCiBjcmVhdGUgbW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L2NoZWNrcy9u b19uZXRyY19maWxlcy54bWwKIGNyZWF0ZSBtb2RlIDEwMDY0NCBGZWRvcmEvaW5wdXQvc3lzdGVt L2FjY291bnRzL2FjY291bnRzLnhtbAogY3JlYXRlIG1vZGUgMTAwNjQ0IEZlZG9yYS9pbnB1dC9z eXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Bhc3N3b3JkX3N0b3JhZ2UueG1sCiBjcmVhdGUg bW9kZSAxMDA2NDQgRmVkb3JhL2lucHV0L3N5c3RlbS9hY2NvdW50cy9yZXN0cmljdGlvbnMvcmVz dHJpY3Rpb25zLnhtbAoKZGlmZiAtLWdpdCBhL0ZlZG9yYS9pbnB1dC9jaGVja3MvYWNjb3VudHNf cGFzc3dvcmRfYWxsX3NoYWRvd2VkLnhtbCBiL0ZlZG9yYS9pbnB1dC9jaGVja3MvYWNjb3VudHNf cGFzc3dvcmRfYWxsX3NoYWRvd2VkLnhtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwLi40MmI3NDgyCi0tLSAvZGV2L251bGwKKysrIGIvRmVkb3JhL2lucHV0L2NoZWNrcy9hY2Nv dW50c19wYXNzd29yZF9hbGxfc2hhZG93ZWQueG1sCkBAIC0wLDAgKzEsMjQgQEAKKyZsdDtkZWYt Z3JvdXAmZ3Q7CisgICZsdDtkZWZpbml0aW9uIGNsYXNzPSJjb21wbGlhbmNlIiBpZD0iYWNjb3Vu dHNfcGFzc3dvcmRfYWxsX3NoYWRvd2VkIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7bWV0YWRh dGEmZ3Q7CisgICAgICAmbHQ7dGl0bGUmZ3Q7QWxsIFBhc3N3b3JkIEhhc2hlcyBTaGFkb3dlZCZs dDsvdGl0bGUmZ3Q7CisgICAgICAmbHQ7YWZmZWN0ZWQgZmFtaWx5PSJ1bml4IiZndDsKKyAgICAg ICAgJmx0O3BsYXRmb3JtJmd0O0ZlZG9yYSAxOSZsdDsvcGxhdGZvcm0mZ3Q7CisgICAgICAmbHQ7 L2FmZmVjdGVkJmd0OworICAgICAgJmx0O2Rlc2NyaXB0aW9uJmd0O0FsbCBwYXNzd29yZCBoYXNo ZXMgc2hvdWxkIGJlIHNoYWRvd2VkLiZsdDsvZGVzY3JpcHRpb24mZ3Q7CisgICAgJmx0Oy9tZXRh ZGF0YSZndDsKKyAgICAmbHQ7Y3JpdGVyaWEmZ3Q7CisgICAgICAmbHQ7Y3JpdGVyaW9uIGNvbW1l bnQ9InBhc3N3b3JkIGhhc2hlcyBhcmUgc2hhZG93ZWQiIHRlc3RfcmVmPSJ0ZXN0X2FjY291bnRz X3Bhc3N3b3JkX2FsbF9zaGFkb3dlZCIgLyZndDsKKyAgICAmbHQ7L2NyaXRlcmlhJmd0OworICAm bHQ7L2RlZmluaXRpb24mZ3Q7CisgICZsdDt1bml4OnBhc3N3b3JkX3Rlc3QgY2hlY2s9ImFsbCIg Y29tbWVudD0icGFzc3dvcmQgaGFzaGVzIGFyZSBzaGFkb3dlZCIgaWQ9InRlc3RfYWNjb3VudHNf cGFzc3dvcmRfYWxsX3NoYWRvd2VkIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7dW5peDpvYmpl Y3Qgb2JqZWN0X3JlZj0ib2JqZWN0X2FjY291bnRzX3Bhc3N3b3JkX2FsbF9zaGFkb3dlZCIgLyZn dDsKKyAgICAmbHQ7dW5peDpzdGF0ZSBzdGF0ZV9yZWY9InN0YXRlX2FjY291bnRzX3Bhc3N3b3Jk X2FsbF9zaGFkb3dlZCIgLyZndDsKKyAgJmx0Oy91bml4OnBhc3N3b3JkX3Rlc3QmZ3Q7CisgICZs dDt1bml4OnBhc3N3b3JkX29iamVjdCBpZD0ib2JqZWN0X2FjY291bnRzX3Bhc3N3b3JkX2FsbF9z aGFkb3dlZCIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O3VuaXg6dXNlcm5hbWUgb3BlcmF0aW9u PSJwYXR0ZXJuIG1hdGNoIiZndDsuKiZsdDsvdW5peDp1c2VybmFtZSZndDsKKyAgJmx0Oy91bml4 OnBhc3N3b3JkX29iamVjdCZndDsKKyAgJmx0O3VuaXg6cGFzc3dvcmRfc3RhdGUgaWQ9InN0YXRl X2FjY291bnRzX3Bhc3N3b3JkX2FsbF9zaGFkb3dlZCIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0 O3VuaXg6cGFzc3dvcmQmZ3Q7eCZsdDsvdW5peDpwYXNzd29yZCZndDsKKyAgJmx0Oy91bml4OnBh c3N3b3JkX3N0YXRlJmd0OworJmx0Oy9kZWYtZ3JvdXAmZ3Q7CmRpZmYgLS1naXQgYS9GZWRvcmEv aW5wdXQvY2hlY2tzL25vX2VtcHR5X3Bhc3N3b3Jkcy54bWwgYi9GZWRvcmEvaW5wdXQvY2hlY2tz L25vX2VtcHR5X3Bhc3N3b3Jkcy54bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAw MC4uMDU0ZDY0MwotLS0gL2Rldi9udWxsCisrKyBiL0ZlZG9yYS9pbnB1dC9jaGVja3Mvbm9fZW1w dHlfcGFzc3dvcmRzLnhtbApAQCAtMCwwICsxLDIyIEBACismbHQ7ZGVmLWdyb3VwJmd0OworICAm bHQ7ZGVmaW5pdGlvbiBjbGFzcz0iY29tcGxpYW5jZSIgaWQ9Im5vX2VtcHR5X3Bhc3N3b3JkcyIg dmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O21ldGFkYXRhJmd0OworICAgICAgJmx0O3RpdGxlJmd0 O05vIG51bGxvayBPcHRpb24gaW4gL2V0Yy9wYW0uZC9zeXN0ZW0tYXV0aCZsdDsvdGl0bGUmZ3Q7 CisgICAgICAmbHQ7YWZmZWN0ZWQgZmFtaWx5PSJ1bml4IiZndDsKKyAgICAgICAgJmx0O3BsYXRm b3JtJmd0O0ZlZG9yYSAxOSZsdDsvcGxhdGZvcm0mZ3Q7CisgICAgICAmbHQ7L2FmZmVjdGVkJmd0 OworICAgICAgJmx0O2Rlc2NyaXB0aW9uJmd0O1RoZSBmaWxlIC9ldGMvcGFtLmQvc3lzdGVtLWF1 dGggc2hvdWxkIG5vdCBjb250YWluIHRoZSBudWxsb2sgb3B0aW9uJmx0Oy9kZXNjcmlwdGlvbiZn dDsKKyAgICAmbHQ7L21ldGFkYXRhJmd0OworICAgICZsdDtjcml0ZXJpYSZndDsKKyAgICAgICZs dDtjcml0ZXJpb24gY29tbWVudD0ibWFrZSBzdXJlIHRoZSBudWxsb2sgb3B0aW9uIGlzIG5vdCB1 c2VkIGluIC9ldGMvcGFtLmQvc3lzdGVtLWF1dGgiIHRlc3RfcmVmPSJ0ZXN0X25vX2VtcHR5X3Bh c3N3b3JkcyIgLyZndDsKKyAgICAmbHQ7L2NyaXRlcmlhJmd0OworICAmbHQ7L2RlZmluaXRpb24m Z3Q7CisgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCBjaGVjaz0iYWxsIiBjaGVja19l eGlzdGVuY2U9Im5vbmVfZXhpc3QiIGNvbW1lbnQ9Im1ha2Ugc3VyZSBudWxsb2sgaXMgbm90IHVz ZWQgaW4gL2V0Yy9wYW0uZC9zeXN0ZW0tYXV0aCIgaWQ9InRlc3Rfbm9fZW1wdHlfcGFzc3dvcmRz IiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7aW5kOm9iamVjdCBvYmplY3RfcmVmPSJvYmplY3Rf bm9fZW1wdHlfcGFzc3dvcmRzIiAvJmd0OworICAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90 ZXN0Jmd0OworICAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBpZD0ib2JqZWN0X25v X2VtcHR5X3Bhc3N3b3JkcyIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O2luZDpmaWxlcGF0aCZn dDsvZXRjL3BhbS5kL3N5c3RlbS1hdXRoJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7CisgICAgJmx0O2lu ZDpwYXR0ZXJuIG9wZXJhdGlvbj0icGF0dGVybiBtYXRjaCImZ3Q7XHMqbnVsbG9rXHMqJmx0Oy9p bmQ6cGF0dGVybiZndDsKKyAgICAmbHQ7aW5kOmluc3RhbmNlIGRhdGF0eXBlPSJpbnQiJmd0OzEm bHQ7L2luZDppbnN0YW5jZSZndDsKKyAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0 Jmd0OworJmx0Oy9kZWYtZ3JvdXAmZ3Q7CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvY2hlY2tz L25vX25ldHJjX2ZpbGVzLnhtbCBiL0ZlZG9yYS9pbnB1dC9jaGVja3Mvbm9fbmV0cmNfZmlsZXMu eG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjc0MGE5OGIKLS0tIC9kZXYv bnVsbAorKysgYi9GZWRvcmEvaW5wdXQvY2hlY2tzL25vX25ldHJjX2ZpbGVzLnhtbApAQCAtMCww ICsxLDIyIEBACismbHQ7ZGVmLWdyb3VwJmd0OworICAmbHQ7ZGVmaW5pdGlvbiBjbGFzcz0iY29t cGxpYW5jZSIgaWQ9Im5vX25ldHJjX2ZpbGVzIiB2ZXJzaW9uPSIxIiZndDsKKyAgICAmbHQ7bWV0 YWRhdGEmZ3Q7CisgICAgICAmbHQ7dGl0bGUmZ3Q7VmVyaWZ5IE5vIG5ldHJjIEZpbGVzIEV4aXN0 Jmx0Oy90aXRsZSZndDsKKyAgICAgICZsdDthZmZlY3RlZCBmYW1pbHk9InVuaXgiJmd0OworICAg ICAgICAmbHQ7cGxhdGZvcm0mZ3Q7RmVkb3JhIDE5Jmx0Oy9wbGF0Zm9ybSZndDsKKyAgICAgICZs dDsvYWZmZWN0ZWQmZ3Q7CisgICAgICAmbHQ7ZGVzY3JpcHRpb24mZ3Q7VGhlIC5uZXRyYyBmaWxl cyBjb250YWluIGxvZ2luIGluZm9ybWF0aW9uIHVzZWQgdG8gYXV0by1sb2dpbiBpbnRvIEZUUCBz ZXJ2ZXJzIGFuZCByZXNpZGUgaW4gdGhlIHVzZXIncyBob21lIGRpcmVjdG9yeS4gQW55IC5uZXRy YyBmaWxlcyBzaG91bGQgYmUgcmVtb3ZlZC4mbHQ7L2Rlc2NyaXB0aW9uJmd0OworICAgICZsdDsv bWV0YWRhdGEmZ3Q7CisgICAgJmx0O2NyaXRlcmlhJmd0OworICAgICAgJmx0O2NyaXRlcmlvbiB0 ZXN0X3JlZj0idGVzdF9ub19uZXRyY19maWxlc19ob21lIiBuZWdhdGU9InRydWUiIC8mZ3Q7Cisg ICAgJmx0Oy9jcml0ZXJpYSZndDsKKyAgJmx0Oy9kZWZpbml0aW9uJmd0OworICAmbHQ7dW5peDpm aWxlX3Rlc3QgY2hlY2s9ImFsbCIgY2hlY2tfZXhpc3RlbmNlPSJhdF9sZWFzdF9vbmVfZXhpc3Rz IiBjb21tZW50PSJsb29rIGZvciAubmV0cmMgaW4gL2hvbWUiIGlkPSJ0ZXN0X25vX25ldHJjX2Zp bGVzX2hvbWUiIHZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVm PSJvYmplY3Rfbm9fbmV0cmNfZmlsZXNfaG9tZSIgLyZndDsKKyAgJmx0Oy91bml4OmZpbGVfdGVz dCZndDsKKyAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0ibG9vayBmb3IgLm5ldHJjIGlu IC9ob21lIiBpZD0ib2JqZWN0X25vX25ldHJjX2ZpbGVzX2hvbWUiIHZlcnNpb249IjEiJmd0Owor ICAgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSJkaXJlY3RvcmllcyIgcmVjdXJzZV9kaXJl Y3Rpb249ImRvd24iIG1heF9kZXB0aD0iMSIgcmVjdXJzZV9maWxlX3N5c3RlbT0iYWxsIiAvJmd0 OworICAgICZsdDt1bml4OnBhdGggb3BlcmF0aW9uPSJlcXVhbHMiJmd0Oy9ob21lJmx0Oy91bml4 OnBhdGgmZ3Q7CisgICAgJmx0O3VuaXg6ZmlsZW5hbWUgb3BlcmF0aW9uPSJwYXR0ZXJuIG1hdGNo IiZndDteXC5uZXRyYyQmbHQ7L3VuaXg6ZmlsZW5hbWUmZ3Q7CisgICZsdDsvdW5peDpmaWxlX29i amVjdCZndDsKKyZsdDsvZGVmLWdyb3VwJmd0OwpkaWZmIC0tZ2l0IGEvRmVkb3JhL2lucHV0L2d1 aWRlLnhzbHQgYi9GZWRvcmEvaW5wdXQvZ3VpZGUueHNsdAppbmRleCBhMjRiZGQ5Li44YmRmODZl IDEwMDY0NAotLS0gYS9GZWRvcmEvaW5wdXQvZ3VpZGUueHNsdAorKysgYi9GZWRvcmEvaW5wdXQv Z3VpZGUueHNsdApAQCAtMjQsNiArMjQsNyBAQAogICAgICZsdDt4c2w6Y29weSZndDsKICAgICAg ICZsdDt4c2w6Y29weS1vZiBzZWxlY3Q9IkAqfG5vZGUoKSIgLyZndDsKICAgICAgICZsdDt4c2w6 YXBwbHktdGVtcGxhdGVzIHNlbGVjdD0iZG9jdW1lbnQoJ3N5c3RlbS9zb2Z0d2FyZS9zb2Z0d2Fy ZS54bWwnKSIgLyZndDsKKyAgICAgICZsdDt4c2w6YXBwbHktdGVtcGxhdGVzIHNlbGVjdD0iZG9j dW1lbnQoJ3N5c3RlbS9hY2NvdW50cy9hY2NvdW50cy54bWwnKSIgLyZndDsKICAgICAmbHQ7L3hz bDpjb3B5Jmd0OwogICAmbHQ7L3hzbDp0ZW1wbGF0ZSZndDsKIApAQCAtMzQsNiArMzUsMjAgQEAK ICAgICAmbHQ7L3hzbDpjb3B5Jmd0OwogICAmbHQ7L3hzbDp0ZW1wbGF0ZSZndDsKIAorICAmbHQ7 eHNsOnRlbXBsYXRlIG1hdGNoPSJHcm91cFtAaWQ9J2FjY291bnRzJ10iJmd0OworICAgICZsdDt4 c2w6Y29weSZndDsKKyAgICAgICZsdDt4c2w6Y29weS1vZiBzZWxlY3Q9IkAqfG5vZGUoKSIgLyZn dDsKKyAgICAgICZsdDt4c2w6YXBwbHktdGVtcGxhdGVzIHNlbGVjdD0iZG9jdW1lbnQoJ3N5c3Rl bS9hY2NvdW50cy9yZXN0cmljdGlvbnMvcmVzdHJpY3Rpb25zLnhtbCcpIiAvJmd0OworICAgICZs dDsveHNsOmNvcHkmZ3Q7CisgICZsdDsveHNsOnRlbXBsYXRlJmd0OworCisgICZsdDt4c2w6dGVt cGxhdGUgbWF0Y2g9Ikdyb3VwW0BpZD0nYWNjb3VudHMtcmVzdHJpY3Rpb25zJ10iJmd0OworICAg ICZsdDt4c2w6Y29weSZndDsKKyAgICAgICZsdDt4c2w6Y29weS1vZiBzZWxlY3Q9IkAqfG5vZGUo KSIgLyZndDsKKyAgICAgICZsdDt4c2w6YXBwbHktdGVtcGxhdGVzIHNlbGVjdD0iZG9jdW1lbnQo J3N5c3RlbS9hY2NvdW50cy9yZXN0cmljdGlvbnMvcGFzc3dvcmRfc3RvcmFnZS54bWwnKSIgLyZn dDsKKyAgICAmbHQ7L3hzbDpjb3B5Jmd0OworICAmbHQ7L3hzbDp0ZW1wbGF0ZSZndDsKKwogICAm bHQ7IS0tIGNvcHkgZXZlcnl0aGluZyBlbHNlIHRocm91Z2ggdG8gZmluYWwgb3V0cHV0IC0tJmd0 OwogICAmbHQ7eHNsOnRlbXBsYXRlIG1hdGNoPSJAKnxub2RlKCkiJmd0OwogICAgICZsdDt4c2w6 Y29weSZndDsKZGlmZiAtLWdpdCBhL0ZlZG9yYS9pbnB1dC9wcm9maWxlcy9jb21tb24ueG1sIGIv RmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKaW5kZXggMThjOGYzZS4uMjczOWEzMyAx MDA2NDQKLS0tIGEvRmVkb3JhL2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKKysrIGIvRmVkb3Jh L2lucHV0L3Byb2ZpbGVzL2NvbW1vbi54bWwKQEAgLTQsNSArNCw5IEBACiAKICZsdDtzZWxlY3Qg aWRyZWY9ImVuc3VyZV9ncGdjaGVja19nbG9iYWxseV9hY3RpdmF0ZWQiIHNlbGVjdGVkPSJ0cnVl Ii8mZ3Q7CiAmbHQ7c2VsZWN0IGlkcmVmPSJlbnN1cmVfZ3BnY2hlY2tfbmV2ZXJfZGlzYWJsZWQi IHNlbGVjdGVkPSJ0cnVlIi8mZ3Q7CismbHQ7c2VsZWN0IGlkcmVmPSJub19lbXB0eV9wYXNzd29y ZHMiIHNlbGVjdGVkPSJ0cnVlIi8mZ3Q7CismbHQ7c2VsZWN0IGlkcmVmPSJub19oYXNoZXNfb3V0 c2lkZV9zaGFkb3ciIHNlbGVjdGVkPSJ0cnVlIi8mZ3Q7CismbHQ7c2VsZWN0IGlkcmVmPSJnaWRf cGFzc3dkX2dyb3VwX3NhbWUiIHNlbGVjdGVkPSJ0cnVlIi8mZ3Q7CismbHQ7c2VsZWN0IGlkcmVm PSJub19uZXRyY19maWxlcyIgc2VsZWN0ZWQ9InRydWUiLyZndDsKIAogJmx0Oy9Qcm9maWxlJmd0 OwpkaWZmIC0tZ2l0IGEvRmVkb3JhL2lucHV0L3N5c3RlbS9hY2NvdW50cy9hY2NvdW50cy54bWwg Yi9GZWRvcmEvaW5wdXQvc3lzdGVtL2FjY291bnRzL2FjY291bnRzLnhtbApuZXcgZmlsZSBtb2Rl IDEwMDY0NAppbmRleCAwMDAwMDAwLi4wNDRkODVkCi0tLSAvZGV2L251bGwKKysrIGIvRmVkb3Jh L2lucHV0L3N5c3RlbS9hY2NvdW50cy9hY2NvdW50cy54bWwKQEAgLTAsMCArMSwxMSBAQAorJmx0 O0dyb3VwIGlkPSJhY2NvdW50cyImZ3Q7CismbHQ7dGl0bGUmZ3Q7QWNjb3VudCBhbmQgQWNjZXNz IENvbnRyb2wmbHQ7L3RpdGxlJmd0OworJmx0O2Rlc2NyaXB0aW9uJmd0O0luIHRyYWRpdGlvbmFs IFVuaXggc2VjdXJpdHksIGlmIGFuIGF0dGFja2VyIGdhaW5zCitzaGVsbCBhY2Nlc3MgdG8gYSBj ZXJ0YWluIGxvZ2luIGFjY291bnQsIHRoZXkgY2FuIHBlcmZvcm0gYW55IGFjdGlvbgorb3IgYWNj ZXNzIGFueSBmaWxlIHRvIHdoaWNoIHRoYXQgYWNjb3VudCBoYXMgYWNjZXNzLiBUaGVyZWZvcmUs CittYWtpbmcgaXQgbW9yZSBkaWZmaWN1bHQgZm9yIHVuYXV0aG9yaXplZCBwZW9wbGUgdG8gZ2Fp biBzaGVsbAorYWNjZXNzIHRvIGFjY291bnRzLCBwYXJ0aWN1bGFybHkgdG8gcHJpdmlsZWdlZCBh Y2NvdW50cywgaXMgYQorbmVjZXNzYXJ5IHBhcnQgb2Ygc2VjdXJpbmcgYSBzeXN0ZW0uIFRoaXMg c2VjdGlvbiBpbnRyb2R1Y2VzCittZWNoYW5pc21zIGZvciByZXN0cmljdGluZyBhY2Nlc3MgdG8g YWNjb3VudHMgdW5kZXIgRmVkb3JhLgorJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZsdDsvR3JvdXAm Z3Q7CmRpZmYgLS1naXQgYS9GZWRvcmEvaW5wdXQvc3lzdGVtL2FjY291bnRzL3Jlc3RyaWN0aW9u cy9wYXNzd29yZF9zdG9yYWdlLnhtbCBiL0ZlZG9yYS9pbnB1dC9zeXN0ZW0vYWNjb3VudHMvcmVz dHJpY3Rpb25zL3Bhc3N3b3JkX3N0b3JhZ2UueG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4 IDAwMDAwMDAuLmQxYmJjZDMKLS0tIC9kZXYvbnVsbAorKysgYi9GZWRvcmEvaW5wdXQvc3lzdGVt L2FjY291bnRzL3Jlc3RyaWN0aW9ucy9wYXNzd29yZF9zdG9yYWdlLnhtbApAQCAtMCwwICsxLDEw NyBAQAorJmx0O0dyb3VwIGlkPSJwYXNzd29yZF9zdG9yYWdlIiZndDsKKyZsdDt0aXRsZSZndDtW ZXJpZnkgUHJvcGVyIFN0b3JhZ2UgYW5kIEV4aXN0ZW5jZSBvZiBQYXNzd29yZAorSGFzaGVzJmx0 Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlwdGlvbiZndDsKK0J5IGRlZmF1bHQsIHBhc3N3b3JkIGhh c2hlcyBmb3IgbG9jYWwgYWNjb3VudHMgYXJlIHN0b3JlZAoraW4gdGhlIHNlY29uZCBmaWVsZCAo Y29sb24tc2VwYXJhdGVkKSBpbgorJmx0O3R0Jmd0Oy9ldGMvc2hhZG93Jmx0Oy90dCZndDsuIFRo aXMgZmlsZSBzaG91bGQgYmUgcmVhZGFibGUgb25seSBieQorcHJvY2Vzc2VzIHJ1bm5pbmcgd2l0 aCByb290IGNyZWRlbnRpYWxzLCBwcmV2ZW50aW5nIHVzZXJzIGZyb20KK2Nhc3VhbGx5IGFjY2Vz c2luZyBvdGhlcnMnIHBhc3N3b3JkIGhhc2hlcyBhbmQgYXR0ZW1wdGluZwordG8gY3JhY2sgdGhl bS4KK0hvd2V2ZXIsIGl0IHJlbWFpbnMgcG9zc2libGUgdG8gbWlzY29uZmlndXJlIHRoZSBzeXN0 ZW0KK2FuZCBzdG9yZSBwYXNzd29yZCBoYXNoZXMKK2luIHdvcmxkLXJlYWRhYmxlIGZpbGVzIHN1 Y2ggYXMgJmx0O3R0Jmd0Oy9ldGMvcGFzc3dkJmx0Oy90dCZndDssIG9yCit0byBldmVuIHN0b3Jl IHBhc3N3b3JkcyB0aGVtc2VsdmVzIGluIHBsYWludGV4dCBvbiB0aGUgc3lzdGVtLgorVXNpbmcg c3lzdGVtLXByb3ZpZGVkIHRvb2xzIGZvciBwYXNzd29yZCBjaGFuZ2UvY3JlYXRpb24KK3Nob3Vs ZCBhbGxvdyBhZG1pbmlzdHJhdG9ycyB0byBhdm9pZCBzdWNoIG1pc2NvbmZpZ3VyYXRpb24uCism bHQ7L2Rlc2NyaXB0aW9uJmd0OworCismbHQ7UnVsZSBpZD0ibm9fZW1wdHlfcGFzc3dvcmRzIiBz ZXZlcml0eT0iaGlnaCImZ3Q7CismbHQ7dGl0bGUmZ3Q7UHJldmVudCBMb2cgSW4gdG8gQWNjb3Vu dHMgV2l0aCBFbXB0eSBQYXNzd29yZCZsdDsvdGl0bGUmZ3Q7CismbHQ7ZGVzY3JpcHRpb24mZ3Q7 SWYgYW4gYWNjb3VudCBpcyBjb25maWd1cmVkIGZvciBwYXNzd29yZCBhdXRoZW50aWNhdGlvbgor YnV0IGRvZXMgbm90IGhhdmUgYW4gYXNzaWduZWQgcGFzc3dvcmQsIGl0IG1heSBiZSBwb3NzaWJs ZSB0byBsb2cKK2ludG8gdGhlIGFjY291bnQgd2l0aG91dCBhdXRoZW50aWNhdGlvbi4gUmVtb3Zl IGFueSBpbnN0YW5jZXMgb2YgdGhlICZsdDt0dCZndDtudWxsb2smbHQ7L3R0Jmd0Oworb3B0aW9u IGluICZsdDt0dCZndDsvZXRjL3BhbS5kL3N5c3RlbS1hdXRoJmx0Oy90dCZndDsgdG8KK3ByZXZl bnQgbG9naW5zIHdpdGggZW1wdHkgcGFzc3dvcmRzLgorJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZs dDtvY2lsIGNsYXVzZT0iTlVMTCBwYXNzd29yZHMgY2FuIGJlIHVzZWQiJmd0OworVG8gdmVyaWZ5 IHRoYXQgbnVsbCBwYXNzd29yZHMgY2Fubm90IGJlIHVzZWQsIHJ1biB0aGUgZm9sbG93aW5nIGNv bW1hbmQ6CismbHQ7cHJlJmd0OyMgZ3JlcCBudWxsb2sgL2V0Yy9wYW0uZC9zeXN0ZW0tYXV0aCZs dDsvcHJlJmd0OworSWYgdGhpcyBwcm9kdWNlcyBhbnkgb3V0cHV0LCBpdCBtYXkgYmUgcG9zc2li bGUgdG8gbG9nIGludG8gYWNjb3VudHMKK3dpdGggZW1wdHkgcGFzc3dvcmRzLgorJmx0Oy9vY2ls Jmd0OworJmx0O3JhdGlvbmFsZSZndDsKK0lmIGFuIGFjY291bnQgaGFzIGFuIGVtcHR5IHBhc3N3 b3JkLCBhbnlvbmUgY291bGQgbG9nIGluIGFuZAorcnVuIGNvbW1hbmRzIHdpdGggdGhlIHByaXZp bGVnZXMgb2YgdGhhdCBhY2NvdW50LiBBY2NvdW50cyB3aXRoCitlbXB0eSBwYXNzd29yZHMgc2hv dWxkIG5ldmVyIGJlIHVzZWQgaW4gb3BlcmF0aW9uYWwKK2Vudmlyb25tZW50cy4KKyZsdDsvcmF0 aW9uYWxlJmd0OworJmx0O292YWwgaWQ9Im5vX2VtcHR5X3Bhc3N3b3JkcyIgLyZndDsKKyZsdDty ZWYgbmlzdD0iSUEtNShiKSxJQS01KGMpLElBLTUoMSkoYSkiIC8mZ3Q7CismbHQ7L1J1bGUmZ3Q7 CisKKyZsdDtSdWxlIGlkPSJub19oYXNoZXNfb3V0c2lkZV9zaGFkb3ciIHNldmVyaXR5PSJtZWRp dW0iJmd0OworJmx0O3RpdGxlJmd0O1ZlcmlmeSBBbGwgQWNjb3VudCBQYXNzd29yZCBIYXNoZXMg YXJlIFNoYWRvd2VkJmx0Oy90aXRsZSZndDsKKyZsdDtkZXNjcmlwdGlvbiZndDsKK0lmIGFueSBw YXNzd29yZCBoYXNoZXMgYXJlIHN0b3JlZCBpbiAmbHQ7dHQmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L3R0 Jmd0OyAoaW4gdGhlIHNlY29uZCBmaWVsZCwKK2luc3RlYWQgb2YgYW4gJmx0O3R0Jmd0O3gmbHQ7 L3R0Jmd0OyksIHRoZSBjYXVzZSBvZiB0aGlzIG1pc2NvbmZpZ3VyYXRpb24gc2hvdWxkIGJlCitp bnZlc3RpZ2F0ZWQuICBUaGUgYWNjb3VudCBzaG91bGQgaGF2ZSBpdHMgcGFzc3dvcmQgcmVzZXQg YW5kIHRoZSBoYXNoIHNob3VsZCBiZQorcHJvcGVybHkgc3RvcmVkLCBvciB0aGUgYWNjb3VudCBz aG91bGQgYmUgZGVsZXRlZCBlbnRpcmVseS4KKyZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7b2Np bCBjbGF1c2U9ImFueSBzdG9yZWQgaGFzaGVzIGFyZSBmb3VuZCBpbiAvZXRjL3Bhc3N3ZCImZ3Q7 CitUbyBjaGVjayB0aGF0IG5vIHBhc3N3b3JkIGhhc2hlcyBhcmUgc3RvcmVkIGluCismbHQ7dHQm Z3Q7L2V0Yy9wYXNzd2QmbHQ7L3R0Jmd0OywgcnVuIHRoZSBmb2xsb3dpbmcgY29tbWFuZDoKKyZs dDtwcmUmZ3Q7IyBhd2sgLUY6ICcoJDIgIT0gIngiKSB7cHJpbnR9JyAvZXRjL3Bhc3N3ZCZsdDsv cHJlJmd0OworSWYgaXQgcHJvZHVjZXMgYW55IG91dHB1dCwgdGhlbiBhIHBhc3N3b3JkIGhhc2gg aXMKK3N0b3JlZCBpbiAmbHQ7dHQmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L3R0Jmd0Oy4KKyZsdDsvb2Np bCZndDsKKyZsdDtyYXRpb25hbGUmZ3Q7CitUaGUgaGFzaGVzIGZvciBhbGwgdXNlciBhY2NvdW50 IHBhc3N3b3JkcyBzaG91bGQgYmUgc3RvcmVkIGluCit0aGUgZmlsZSAmbHQ7dHQmZ3Q7L2V0Yy9z aGFkb3cmbHQ7L3R0Jmd0OyBhbmQgbmV2ZXIgaW4gJmx0O3R0Jmd0Oy9ldGMvcGFzc3dkJmx0Oy90 dCZndDssCit3aGljaCBpcyByZWFkYWJsZSBieSBhbGwgdXNlcnMuCismbHQ7L3JhdGlvbmFsZSZn dDsKKyZsdDtvdmFsIGlkPSJhY2NvdW50c19wYXNzd29yZF9hbGxfc2hhZG93ZWQiIC8mZ3Q7Cism bHQ7cmVmIG5pc3Q9IklBLTUoaCkiIGRpc2E9IjIwMSIgLyZndDsKKyZsdDsvUnVsZSZndDsKKwor Jmx0O1J1bGUgaWQ9ImdpZF9wYXNzd2RfZ3JvdXBfc2FtZSImZ3Q7CismbHQ7dGl0bGUmZ3Q7QWxs IEdJRHMgcmVmZXJlbmNlZCBpbiAvZXRjL3Bhc3N3ZCBtdXN0IGJlIGRlZmluZWQgaW4gL2V0Yy9n cm91cCZsdDsvdGl0bGUmZ3Q7CismbHQ7ZGVzY3JpcHRpb24mZ3Q7CitBZGQgYSBncm91cCB0byB0 aGUgc3lzdGVtIGZvciBlYWNoIEdJRCByZWZlcmVuY2VkIHdpdGhvdXQgYSBjb3JyZXNwb25kaW5n IGdyb3VwLgorJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyZsdDtvY2lsIGNsYXVzZT0idGhlcmUgaXMg b3V0cHV0IiZndDsKK1RvIGVuc3VyZSBhbGwgR0lEcyByZWZlcmVuY2VkIGluICZsdDt0dCZndDsv ZXRjL3Bhc3N3ZCZsdDsvdHQmZ3Q7IGFyZSBkZWZpbmVkIGluICZsdDt0dCZndDsvZXRjL2dyb3Vw Jmx0Oy90dCZndDssIAorcnVuIHRoZSBmb2xsb3dpbmcgY29tbWFuZDoKKyZsdDtwcmUmZ3Q7IyBw d2NrIC1xciZsdDsvcHJlJmd0OworVGhlcmUgc2hvdWxkIGJlIG5vIG91dHB1dC4KKyZsdDsvb2Np bCZndDsKKyZsdDtyYXRpb25hbGUmZ3Q7CitJbmNvbnNpc3RlbmN5IGluIEdJRHMgYmV0d2VlbiAm bHQ7dHQmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L3R0Jmd0OyBhbmQgJmx0O3R0Jmd0Oy9ldGMvZ3JvdXAm bHQ7L3R0Jmd0OyBjb3VsZCBsZWFkIHRvIGEgdXNlciBoYXZpbmcgdW5pbnRlbmRlZCByaWdodHMu CismbHQ7L3JhdGlvbmFsZSZndDsKKyZsdDtyZWYgZGlzYT0iMzY2IiAvJmd0OworJmx0Oy9SdWxl Jmd0OworCismbHQ7UnVsZSBpZD0ibm9fbmV0cmNfZmlsZXMiIHNldmVyaXR5PSJtZWRpdW0iJmd0 OworJmx0O3RpdGxlJmd0O1ZlcmlmeSBObyBuZXRyYyBGaWxlcyBFeGlzdCZsdDsvdGl0bGUmZ3Q7 CismbHQ7ZGVzY3JpcHRpb24mZ3Q7VGhlICZsdDt0dCZndDsubmV0cmMmbHQ7L3R0Jmd0OyBmaWxl cyBjb250YWluIGxvZ2luIGluZm9ybWF0aW9uCit1c2VkIHRvIGF1dG8tbG9naW4gaW50byBGVFAg c2VydmVycyBhbmQgcmVzaWRlIGluIHRoZSB1c2VyJ3MgaG9tZQorZGlyZWN0b3J5LiBUaGVzZSBm aWxlcyBtYXkgY29udGFpbiB1bmVuY3J5cHRlZCBwYXNzd29yZHMgdG8KK3JlbW90ZSBGVFAgc2Vy dmVycyBtYWtpbmcgdGhlbSBzdXNjZXB0aWJsZSB0byBhY2Nlc3MgYnkgdW5hdXRob3JpemVkCit1 c2VycyBhbmQgc2hvdWxkIG5vdCBiZSB1c2VkLiAgQW55ICZsdDt0dCZndDsubmV0cmMmbHQ7L3R0 Jmd0OyBmaWxlcyBzaG91bGQgYmUgcmVtb3ZlZC4KKyZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7 b2NpbCBjbGF1c2U9ImFueSAubmV0cmMgZmlsZXMgZXhpc3QiJmd0OworVG8gY2hlY2sgdGhlIHN5 c3RlbSBmb3IgdGhlIGV4aXN0ZW5jZSBvZiBhbnkgJmx0O3R0Jmd0Oy5uZXRyYyZsdDsvdHQmZ3Q7 IGZpbGVzLAorcnVuIHRoZSBmb2xsb3dpbmcgY29tbWFuZDoKKyZsdDtwcmUmZ3Q7IyBmaW5kIC9o b21lIC14ZGV2IC1uYW1lIC5uZXRyYyZsdDsvcHJlJmd0OworJmx0OyEtLSBuZWVkcyBmaXh1cCB0 byBsaW1pdCBzZWFyY2ggdG8gaG9tZSBkaXJzIC0tJmd0OworJmx0Oy9vY2lsJmd0OworJmx0O3Jh dGlvbmFsZSZndDsKK1VuZW5jcnlwdGVkIHBhc3N3b3JkcyBmb3IgcmVtb3RlIEZUUCBzZXJ2ZXJz IG1heSBiZSBzdG9yZWQgaW4gJmx0O3R0Jmd0Oy5uZXRyYyZsdDsvdHQmZ3Q7CitmaWxlcy4gRG9E IHBvbGljeSByZXF1aXJlcyBwYXNzd29yZHMgYmUgZW5jcnlwdGVkIGluIHN0b3JhZ2UgYW5kIG5v dCB1c2VkCitpbiBhY2Nlc3Mgc2NyaXB0cy4KKyZsdDsvcmF0aW9uYWxlJmd0OworJmx0O292YWwg aWQ9Im5vX25ldHJjX2ZpbGVzIiAvJmd0OworJmx0O3JlZiBuaXN0PSJJQS01KGgpIiBkaXNhPSIx OTYiIC8mZ3Q7CismbHQ7L1J1bGUmZ3Q7CisKKyZsdDsvR3JvdXAmZ3Q7CmRpZmYgLS1naXQgYS9G ZWRvcmEvaW5wdXQvc3lzdGVtL2FjY291bnRzL3Jlc3RyaWN0aW9ucy9yZXN0cmljdGlvbnMueG1s IGIvRmVkb3JhL2lucHV0L3N5c3RlbS9hY2NvdW50cy9yZXN0cmljdGlvbnMvcmVzdHJpY3Rpb25z LnhtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5mZWJlYWQ2Ci0tLSAvZGV2 L251bGwKKysrIGIvRmVkb3JhL2lucHV0L3N5c3RlbS9hY2NvdW50cy9yZXN0cmljdGlvbnMvcmVz dHJpY3Rpb25zLnhtbApAQCAtMCwwICsxLDEzIEBACismbHQ7R3JvdXAgaWQ9ImFjY291bnRzLXJl c3RyaWN0aW9ucyImZ3Q7CismbHQ7dGl0bGUmZ3Q7UHJvdGVjdCBBY2NvdW50cyBieSBSZXN0cmlj dGluZyBQYXNzd29yZC1CYXNlZCBMb2dpbiZsdDsvdGl0bGUmZ3Q7CismbHQ7ZGVzY3JpcHRpb24m Z3Q7Q29udmVudGlvbmFsbHksIFVuaXggc2hlbGwgYWNjb3VudHMgYXJlIGFjY2Vzc2VkIGJ5Citw cm92aWRpbmcgYSB1c2VybmFtZSBhbmQgcGFzc3dvcmQgdG8gYSBsb2dpbiBwcm9ncmFtLCB3aGlj aCB0ZXN0cwordGhlc2UgdmFsdWVzIGZvciBjb3JyZWN0bmVzcyB1c2luZyB0aGUgJmx0O3R0Jmd0 Oy9ldGMvcGFzc3dkJmx0Oy90dCZndDsgYW5kCismbHQ7dHQmZ3Q7L2V0Yy9zaGFkb3cmbHQ7L3R0 Jmd0OyBmaWxlcy4gUGFzc3dvcmQtYmFzZWQgbG9naW4gaXMgdnVsbmVyYWJsZSB0bworZ3Vlc3Np bmcgb2Ygd2VhayBwYXNzd29yZHMsIGFuZCB0byBzbmlmZmluZyBhbmQgbWFuLWluLXRoZS1taWRk bGUKK2F0dGFja3MgYWdhaW5zdCBwYXNzd29yZHMgZW50ZXJlZCBvdmVyIGEgbmV0d29yayBvciBh dCBhbiBpbnNlY3VyZQorY29uc29sZS4gVGhlcmVmb3JlLCBtZWNoYW5pc21zIGZvciBhY2Nlc3Np bmcgYWNjb3VudHMgYnkgZW50ZXJpbmcKK3VzZXJuYW1lcyBhbmQgcGFzc3dvcmRzIHNob3VsZCBi ZSByZXN0cmljdGVkIHRvIHRob3NlIHdoaWNoIGFyZQorb3BlcmF0aW9uYWxseSBuZWNlc3Nhcnku Jmx0Oy9kZXNjcmlwdGlvbiZndDsKKworJmx0Oy9Hcm91cCZndDsKZGlmZiAtLWdpdCBhL0ZlZG9y YS9zY2FwLXNlY3VyaXR5LWd1aWRlLnNwZWMgYi9GZWRvcmEvc2NhcC1zZWN1cml0eS1ndWlkZS5z cGVjCmluZGV4IDRlZjM3MTMuLjczZWFiNTcgMTAwNjQ0Ci0tLSBhL0ZlZG9yYS9zY2FwLXNlY3Vy aXR5LWd1aWRlLnNwZWMKKysrIGIvRmVkb3JhL3NjYXAtc2VjdXJpdHktZ3VpZGUuc3BlYwpAQCAt NSw3ICs1LDcgQEAKICMgZmlsZSBvbmUgbGV2ZWwgdXAgLSBpbiB0aGUgbWFpbiBzY2FwLXNlY3Vy aXR5LWd1aWRlIGRpcmVjdG9yeSAoaW5zdGVhZCBvZgogIyB0aGlzIG9uZSkuCiAKLSVnbG9iYWwJ ZmVkb3Jhc3NncmVsZWFzZQkyLnJjMQorJWdsb2JhbAlmZWRvcmFzc2dyZWxlYXNlCTIucmMyCiAK IE5hbWU6CQlzY2FwLXNlY3VyaXR5LWd1aWRlCiBWZXJzaW9uOgkwLjEKQEAgLTUwLDYgKzUwLDE1 IEBAIHJtIC1yZiAkUlBNX0JVSUxEX1JPT1QKICV7X2RhdGFkaXJ9L3htbC9zY2FwL3NzZy9mZWRv cmEvMTkvKgogCiAlY2hhbmdlbG9nCisqIFRodSBPY3QgMTAgMjAxMyBKYW4gaWFua2tvIExpZXNr b3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIz OTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZAcmVkaGF0LmNvbSI+Jmx0O2psaWVza292QHJlZGhh dC5jb20mZ3Q7PC9hPiAwLjEtMi5yYzIKKy0gSW50cm9kdWNlICdBY2NvdW50IGFuZCBBY2Nlc3Mg Q29udHJvbCcgc2VjdGlvbgorLSBDb252ZXJ0IGZvbGxvd2luZyAiVmVyaWZ5IFByb3BlciBTdG9y YWdlIGFuZCBFeGlzdGVuY2Ugb2YgUGFzc3dvcmQgSGFzaGVzIiBzZWN0aW9uCisgIHJ1bGVzIHRv IEZlZG9yYToKKyAgKiBQcmV2ZW50IExvZyBJbiB0byBBY2NvdW50cyBXaXRoIEVtcHR5IFBhc3N3 b3JkCisgICogVmVyaWZ5IEFsbCBBY2NvdW50IFBhc3N3b3JkIEhhc2hlcyBhcmUgU2hhZG93ZWQK KyAgKiBBbGwgR0lEcyByZWZlcmVuY2VkIGluIC9ldGMvcGFzc3dkIG11c3QgYmUgZGVmaW5lZCBp biAvZXRjL2dyb3VwCisgICogVmVyaWZ5IE5vIG5ldHJjIEZpbGVzIEV4aXN0CisKICogV2VkIE9j dCAwMiAyMDEzIEphbiBpYW5ra28gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUi IGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRo YXQuY29tIj4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+IDAuMS0yLnJjMQogLSBTZXQg cHJvcGVyIG5hbWUgb2YgdGhlIGJ1aWxkIGRpcmVjdG9yeSBpbiB0aGUgc3BlYydzICVzZXR1cCBt YWNyby4KIC0gUmVwbGFjZSBoYXJkLXdpcmVkIHBhdGhzIHdpdGggbWFjcm9zLiBQcmVzZXJ2ZSBh dHRyaWJ1dGVzIHdoZW4gY29weWluZyBmaWxlcy4KPGRpdiBjbGFzcz0ibW96LXR4dC1zaWciPi0t IAoxLjcuMTEuNwoKPC9kaXY+PC9wcmU+CiAgICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3RlPgog ICAgPGJyPgogICAgYWNrPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============2376182210924377421==-- From shawn at redhat.com Thu Aug 20 11:35:31 2015 Content-Type: multipart/mixed; boundary="===============7290674238017953849==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Introduce new RPM versioning scheme for RHEL6 / JBossEAP content Date: Thu, 10 Oct 2013 16:49:16 -0400 Message-ID: <525712CC.4000205@redhat.com> In-Reply-To: 335059424.2364832.1381165603781.JavaMail.root@redhat.com --===============7290674238017953849== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/7/13 1:06 PM, Jan Lieskovsky wrote: > Based on request from: > https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Octo= ber/004210.html > > introduce also new RPM versioning scheme also for RHEL6/JBossEAP5 content. > > * Makefile changes: > - retrieve necessary values from RHEL-6 spec file, > - organize Makefile into sections (RHEL-6 section, > Fedora section below, custom macros definition follows, > then Makefile targets), > - in the 'srpm' target remove explicit setting of following variables: > - ARCH - not needed, defined in *.spec directly, > - PKGNAME, VERSION, RELEASE - defined in *.spec directly, > - VENDOR - defined in *.spec directly, > - PACKAGER - not needed. When building in Koji, packager will be > set automatically to "Fedora Project", when building locally it's > not needed (rpmlint complains when PACKAGER set up directly), > - _sysconfdir on RHEL-6 system is defined too (as can be double-checked > by rpm --eval), so no need to re-define it exactly. > = > * scap-security-guide.spec changes: > - introduce 'redhatssgrelease', > - add Vendor && BuildArch, > - update missing %changelog records with proper entries (according > to the git log) > > * the only remaining rpmlint warning to be fixed is exact source location. > > Tests: > - a, RHEL-6 (make tarball, srpm, rpm passes), final xccdf eval passes, > guide is generated correctly, > - b, Fedora (make fedora-{tarball, srpm, rpm}), final xccdf eval pass, > guide is generated correctly. > > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team This is *fantastic*!! Thank you! ack! --===============7290674238017953849==-- From shawn at redhat.com Thu Aug 20 11:35:31 2015 Content-Type: multipart/mixed; boundary="===============8159257748002750150==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Remediation requirements (was Checks vs. Fixes) Date: Thu, 10 Oct 2013 16:50:49 -0400 Message-ID: <52571329.5070907@redhat.com> In-Reply-To: 3B19C5019D6E384EB6A8838D621D6FFF02612DFF@naeanrfkez36v.nadsusea.nads.navy.mil --===============8159257748002750150== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/8/13 9:47 AM, Truhn, Chad M CTR NSWCDD, CXA30 wrote: > * I didn't want to highjack the other 'Checks vs. Fixes' thread so I'm > spinning off on to another one. > > I have spent a lot of time thinking about just this type of thing. > Currently the conversation is on auditing rules, but I think the topic > applies in multiple areas with regards to automated remediation. From > what I have seen there are two main ways that SSG is used: > > 1) Fully SSG compliant machine (or as close as possible) for policy > reasons from above (DoD mandates STIG compliance, the customer says so, > etc) > 2) Mostly SSG compliant machine because we all want to be secure, but we > are willing to forgo certain aspects out of necessity or convenience. > > Regardless of which side of this you are on, everyone wants a tool that > makes this process as easy as possible for them. Unfortunately, this is > hard. If we can contain each remediation step into it's own little > environment I think it's possible to make both sides mostly happy. > > To make that tougher, you can't ever assume what state a machine is in > when the SSG is run against it. It could be a brand new build with > completely stock files or it could be a machine that has been in > production for years and has various changes (compliant or not) that > can't be changed wholesale. And then to make it even worse, we can't > all use the same tools (like Puppet and Augeas or even perl) which could > potentially make the job easier. There was some talk about later > versions having extra capabilities when possible, but for now it's > keeping everything as generic as possible. > > I think it comes down to requirements. Obviously I don't make these > decisions, but from the conversations I have seen and IMO they include > something along the lines of: > > 1) Must use RHEL delivered tools only and sticking to the most common > tools > -- A conversation went on earlier this year where bash was > chosen as almost every machine has it. I believe there was talk of > later versions supporting other tools though. > > 2) Each remediation step should take care of all things needed to make > that finding compliant, but should NOT change the way another finding is > handled > -- To use audit as an example: Which finding would do the > wholesale replace of the audit.rules file? > -- What happens if that finding is already satisfied and > the file isn't replaced and all other audit.rules findings are still > open? > -- Or if you replace it wholesale with every audit > finding then you are doing duplicate work and potentially blowing away > valid, non-SSG enforced changes. Just because I have one line wrong > doesn't mean I want every line to be right. > > 3) No remediation change should be dependent on another remediation > change > -- Similar to #2, but rather than step A breaking step B, step B > should not rely on step A in order for step B to be compliant > > > I am sure there are others that I am not thinking of right now, but I > hope I got the point across. If these can be pretty clearly defined I > think a lot of the questions I see on this list could be answered by > stepping through this list. It's not always the easy way, but I would > argue it's the RIGHT way. And if someone wants to skip a remediation > step (-e 2, for example) everything else should apply as needed and then > the user can go on their merry way. It would be a lot of Regex > terribleness, but I think it would be the most portable from system to > system and site to site. > > Does that sound reasonable? > > * I wish I could think of a good 'Do it right the first time' quote... > > wanted to quickly acknowledge the thread -- many of the govvies have = been off and are just getting unburied. Jeff or myself will respond = shortly to this, but you've hit the nail on many of these topics! -- = Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells --===============8159257748002750150==-- From maura at eclipse.ncsc.mil Thu Aug 20 11:35:31 2015 Content-Type: multipart/mixed; boundary="===============8803621478449643830==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Prettied up custom stylesheet at Jeff's request Date: Thu, 10 Oct 2013 17:46:12 -0400 Message-ID: <1381441573-3869-1-git-send-email-maura@eclipse.ncsc.mil> --===============8803621478449643830== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I added more color and a few new fields that had been dropped by the transf= orms. The images were also replaced. Various other minor formatting changes= were made. - Maura Dailey Maura Dailey (1): Made some corrections to the XSLT transforms to remedy missing fields, replaced PNG files with different images, added background colors and borders to code and header elements, created table for Security Identifiers and References (and added prefixes to references to make the source more obvious) RHEL6/output/images/collapsed.png | Bin 1075 -> 742 bytes RHEL6/output/images/expanded.png | Bin 1090 -> 1206 bytes RHEL6/transforms/xccdf2html.xslt | 249 +++++++++++++++++++++++++--------= ---- 3 files changed, 171 insertions(+), 78 deletions(-) --===============8803621478449643830==-- From maura at eclipse.ncsc.mil Thu Aug 20 11:35:31 2015 Content-Type: multipart/mixed; boundary="===============0145334269417647557==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: [PATCH] Made some corrections to the XSLT transforms to remedy missing fields, replaced PNG files with different images, added background colors and borders to code and header elements, created table for Security Identifiers and References (and added prefixes to references to make the source more obvious) Date: Thu, 10 Oct 2013 17:46:13 -0400 Message-ID: <1381441573-3869-2-git-send-email-maura@eclipse.ncsc.mil> In-Reply-To: 1381441573-3869-1-git-send-email-maura@eclipse.ncsc.mil --===============0145334269417647557== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Signed-off-by: Maura Dailey --- RHEL6/output/images/collapsed.png | Bin 1075 -> 742 bytes RHEL6/output/images/expanded.png | Bin 1090 -> 1206 bytes RHEL6/transforms/xccdf2html.xslt | 249 +++++++++++++++++++++++++--------= ---- 3 files changed, 171 insertions(+), 78 deletions(-) diff --git a/RHEL6/output/images/collapsed.png b/RHEL6/output/images/collap= sed.png index ffe32f6d3f6d4d862a5001e7b60bb92db7ada80d..0e7089159d3aa747e8e6aeac5d6= 1e97fd1327d74 100644 GIT binary patch literal 742 zcmVPx#24YJ`L;(K){{a7>y{D4^000SaNLh0L0Rx2q0Rx2rrBpor00007bV*G`2i*z^ z5EuhMO*aPs00L%7L_t(o!`<0Sh)!V`2k_r#XpGCq-C!geMNLSd7`ZIiAd<^Mv#>H) zlTs{XYauB$MOKO_QLGfrLJ8$kC`q}DalbR;*gRjIM80o)bG~DqI;-Jo7fdV>#7N^1`jY5vjW@?G+;SqVwaDCbEW&(D!dpDa8lcEdHe0Nhh|KP_D{3U<~X!P zMqgqX#$zRp;!C{yguC$p3$g||A9n)CMGTEB4n`B&Q$+fPPMpQ4tN;$g?pTKjw*IEg zCfvfuAWeez*qN1%HsDNTC<&7M8pE+Iviz(XI@*l;DTX)xq1|X~2vT+Sg^vEI9FH(E zfYxIK&c)>E_#9cgfQKp2)3VUfdRz`r&#<|KJ`=3DDGCj(FtpswQp=3D2p7YP3Ve=3DIxwRQ z$y$X|coY4<2DuJmPNnzi;sl3+Af-ehfcCkL*2Q2&!mKT`eSeN1vz4 ze*=3D5MsFW28V}U0jB||Di#F5yDOR2IaXdfWoQOJ9V8%rH%P?&(CmhBHK*4wDK*{GV# z^b4WR^;VZ_vygkcwKuk!9vu72;vIu6IQ@%UbYNd(thQfT{{QaKl>1|6t`F|HzWS&| zYfPTt2-atH=3DqYutE&9CIxRPRJpB@`aB}QB7^0GS%9V;i+$nh00|G_1CYp}LO4u3=3DZ Y1jF(x4v6=3D%=3DKufz07*qoM6N<$f_lPC;{X5v literal 1075 zcmV-31kC%1P)Px#32;bRa{vGf6951U69E94oEQKA1K3GKK~!jg?VC++8b=3Ds_pJlz6PaA&)6O4^x z1O|424M{*XHY{cr5}ZSOZO=3DWn$KKjoulWP*xtIQm9x6pjq(qjL<`6}Zl~dYFdrqeZ ziz=3D}kJI2iN5uWqx`@WB6(CoakC_)IqCxmC%1-Q*rc+!~)PdZcKNyh{5-4DO;+wXty z_U*sJu17kG5JG(ZB`l zcQNt_x{k(a)6@(mP4aj`Tx%v?0!@aUMsqhq4i=3DDBAVX*F~Lfmt_dlfs2Fd>X&ci?x(a)d z>y)@2TaZ|q94;;V|AUIc&0>=3DK9g~8-!MLpU3zzhV5JK?y$x9wTdC6LQk%P8LV>idF zx9^ay(Dw|VMJVXQwsh_~C03Tg1Bp3k1}fY`RXtS7TO4#uvYGfmV_y|T2qC`z(a)mCIy zj-(a)2n+Kkd|m#9(a)UXqqY|$7N825aR1^f9B1fe(a)jgii3Djk4LbV;B9WlfT<0NWNuP(N zsnn_&y6qBMn^D*D_HbSJU9y=3Dt2OX12c?(r_=3DioNfJ>=3DQ**F1avnw6z6cbyWpr4tJJ zq~;vz44-D!J40hP$3fdESD$9=3D_sw zY=3DN#*!rIH>_j#`zdn9N0ECPX9S`D3hc9H0{`M%?fjc^Y|QMgmSLDw-c@`+17KaxxO zJcJNDeDs2ck6w^mU#8nOsqbu~X&8WnB3kdt`+b z1(a)vqJ+cK!$P7SPEGIGN6a{-!rC$kw_jSM{gNC+#6LQ!AGwsb1DQc{}%Lls_J2+^$P zX*KdhSNcB?Tn5*LJst(Kki=3D;kluMhgwRU>ACcLr~rdiLk-_VEJq?anJsvgRvO`N8I zSxDmX4F3X3ig0vgo>n7Ivz}-1g42uJ3`|&6JydR`uq~aUzCN;-=3DT{bvtwyjdgXUh2 z`MJO#YLZG{!kVU1y`93g4D(a)VbZ0?5PlEQ28MQqE!+RYIT$!(a+;zD7scZQux8r#xG z?&`B2J}A7ASjK4@)N5ISWBd`zY2Fj|`7~El!j{{byM;L3EqKf(Y2002ovPDHLkV1hoC1c?9u diff --git a/RHEL6/output/images/expanded.png b/RHEL6/output/images/expande= d.png index e360e8aa51b703fc79a0ba757c52d7bef5d85db7..468b56d1f127c722c10aa6b4c44= 679cd786c37f4 100644 GIT binary patch literal 1206 zcmV;n1WEgeP)Px#24YJ`L;(K){{a7>y{D4^000SaNLh0L0Rx2q0Rx2rrBpor00007bV*G`2i*z^ z5Hm6U>YMHW00cHkL_t(o!`0bOs8nSb$MKK%N;d;X0#DvxM||T{EL5(G`e)triIV3*J1vg z>zx_xfnm;h&+|Ud_dMr4?|Fac4B{Ppk3Uhv-yS}D3?JYCF2POI@LI3j=3D1;aN*J=3D=3D*5JIymL+3*Ea|j6=3D{Sxbv93$N>muHGl4Ez0 zdn_5t%d$?>lK?er$0v9$Yb+GYYoS^x!J}A?omh#Fas57EpNQ(dg&|CfT(CCr%Q&_N z9~ej+#_=3DuA2jp0qB?8vs%!lx9O!hA{oP0Z*9{vZS|4_uMMf|&#+3^n-<46g#VK0e;(zC+h|$-J;8NPuts}1F8|yZ+l!h} zR4b+Zcmhd=3D{Hq0Vh?i2gjjim#vw-h_CT9ZWM~;;dTSHS}BcSb<#8% zJDESFtU&yL~fe(a)wP=3DC-GaV_z1btXS}E1KROMRoXx|%o zx&{p=3DBQPxPQkAnfdn3MXL*IQD(MF_?24z^V650$t>gy7Z`V{4b^|(( zy2-6d`UTxq-Aq=3DM^b(a)+Bx|x(J>9@^_mojx6kN3;RWB+m-f9Ndzb~7G}q3mV(Ci!0n z_uZD_H~+oWugCti45c9+WM2=3DaWV~{+Ih7*dX3_=3DS%B*dhqe|UqjEF UG6-tKMF0Q*07*qoM6N<$g7E1?s{jB1 literal 1090 zcmV-I1ikx-P)Px#32;bRa{vGf6951U69E94oEQKA1LsLZK~!jg?VHPT8b=3Dg{|DMqd!~JfA5fZW} z5HMV1Y(rTf7z9W*_5EwyhvUsm1QamuUxh_$--5sa*;(M1v|2)d-`dX0<;dJ+zfvwl;HNGKs{2KiD;%EH!`)krk83S^eINrSb)3qEQ)AZHx7Y5Ya)|6P*4wmN~uC`plwQ3Ou<(yPdDw&)fBM}dC zwdE29faR?&B7YMnYU!P&cb3|J4Nqgn=3D(F zc@^#?@u+`KsE?3vqh7*ZDI+w2N}evdV2la%5fTP~h4*D7udridJ{7;?goV9v6P9HP zPehG()Flio2;m z6H(a)T}Qfw*OB#!Q1k5K1cEEkM+A;InTTNUKyUJj zMIB7XO{p=3DYE|Kn?*TQoVlHAWr33uIn6!J-_0C+J?15W}jMVm+oGsZBVwxomLVbDK9 zJ{y-FM>^}wCM_+=3D>zTw-w25(a)2nRE>O-XTRSpXKPVfJVJUG8W0DQC$sLUC4iTuOJaV z=3D~PI*UpJ9TMMFJCt+ni5b7>2|a=3Dmspy#3g6>l@~JMd^V1g zPK9bX0KjNiM=3DBL19g}oDp-x_u$?6JH;ePKBnRJX~tVX?rqr(EpSeuXvo2EgQyr?!B zpF+MxnonE8mBdfUXX6<3kBB1r7;@o4K8dcoFEz%KWl!05RmrF_$HtJoqx9IRM0oI^ ziew(a)ZsPA;#L(a)eqMNAw>`giX`H>`c5e!Pq|~9F-_L*DbuZaP6t%9w>j5qfEHCn}XXY z3-ysHzw)B=3Do~L(?wTx7}scdR&v|U=3D~4e43U~C>wgFAT zr-K(a)zpLuvK`cjH4T7+$T2a{3bfB&!S=3Dg(a)A6t<|ze~s1$yqn2udES9#>3_3NtMF)8M =