From 79cc156873783521c974385b9594630d97d1f35c Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Thu, 3 Oct 2013 19:34:35 +0200
Subject: [PATCH 2/2] [Fedora] Introduce 'Ensure Software Security Patches
 Installed' rule


Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 Fedora/Makefile                                    |  7 ++++++-
 .../checks/sce/bash/security_patches_up_to_date.sh | 18 +++++++++++++++++
 Fedora/input/guide.xml                             |  2 +-
 Fedora/input/profiles/common.xml                   |  1 +
 Fedora/input/system/software/updating.xml          | 23 ++++++++++++++++++++++
 Fedora/scap-security-guide.spec                    |  1 +
 6 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100755 Fedora/input/checks/sce/bash/security_patches_up_to_date.sh

diff --git a/Fedora/Makefile b/Fedora/Makefile
index e608354..381c003 100644
--- a/Fedora/Makefile
+++ b/Fedora/Makefile
@@ -32,6 +32,8 @@ guide: shorthand2xccdf
 content: shorthand2xccdf guide checks
 	$(TRANS)/cpe_generate.py $(OUT)/unlinked-$(PROD)-oval.xml $(IN)/checks/platform/$(PROD)-cpe-dictionary.xml $(ID)
 	$(TRANS)/relabelids.py unlinked-$(PROD)-xccdf.xml $(ID)
+	# copy particular SCE scripts into output directory too
+	cp -r $(IN)/checks/sce $(OUT)
 
 validate-xml:
 	oscap xccdf validate-xml $(OUT)/$(ID)-$(PROD)-xccdf.xml
@@ -44,16 +46,19 @@ validate: validate-xml
 
 # items in dist are expected for distribution in an rpm
 dist: guide content
-	mkdir -p $(DIST)/guide $(DIST)/content
+	mkdir -p $(DIST)/guide $(DIST)/content $(DIST)/content/sce
 	cp $(OUT)/*-guide.html $(DIST)/guide
 	cp $(OUT)/$(ID)-$(PROD)-xccdf.xml $(DIST)/content
 	cp $(OUT)/$(ID)-$(PROD)-oval.xml $(DIST)/content
 	cp $(OUT)/$(ID)-$(PROD)-cpe-dictionary.xml $(DIST)/content
 	cp $(OUT)/$(ID)-$(PROD)-cpe-oval.xml $(DIST)/content
+	# copy particular SCE scripts too
+	cp -r $(IN)/checks/sce $(DIST)/content
 
 eval-common: content
 	oscap xccdf eval --profile common $(OUT)/$(ID)-$(PROD)-xccdf.xml
 
 clean:
 	rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf  $(OUT)/*.spec $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
+	rm -rf $(OUT)/sce
 	rm -rf $(DIST)/content $(DIST)/guide
diff --git a/Fedora/input/checks/sce/bash/security_patches_up_to_date.sh b/Fedora/input/checks/sce/bash/security_patches_up_to_date.sh
new file mode 100755
index 0000000..7e796fa
--- /dev/null
+++ b/Fedora/input/checks/sce/bash/security_patches_up_to_date.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+check_for_updates()
+{
+	local SEC_UPDTS_AVAIL
+	SEC_UPDTS_AVAIL=$(yum --security check-update)
+	RET_VAL=$?
+}
+
+check_for_updates
+
+if [[ $RET_VAL -eq 0 ]]
+then
+	echo "System is updated with regard to available security updates."
+	exit $XCCDF_RESULT_PASS
+fi
+
+exit $XCCDF_RESULT_FAIL
diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
index 6e276b1..8d21fe8 100644
--- a/Fedora/input/guide.xml
+++ b/Fedora/input/guide.xml
@@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other
 countries. All other names are registered trademarks or trademarks of their
 respective companies.</rear-matter>
 <platform idref="cpe:/o:fedoraproject:fedora:19" />
-<version>0.0.2</version>
+<version>0.0.3</version>
 </Benchmark>
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 10c1d14..a7d856f 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -5,5 +5,6 @@
 <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
 <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
 <select idref="ensure_yum_fedora_updates_repo_enabled" selected="true"/>
+<select idref="security_patches_up_to_date" selected="true"/>
 
 </Profile>
diff --git a/Fedora/input/system/software/updating.xml b/Fedora/input/system/software/updating.xml
index b03c42f..a5bc6be 100644
--- a/Fedora/input/system/software/updating.xml
+++ b/Fedora/input/system/software/updating.xml
@@ -82,4 +82,27 @@ use a yum server and fedora-updates repository needs to be enabled.
 <oval id="ensure_yum_fedora_updates_repo_enabled" />
 </Rule>
 
+<Rule id="security_patches_up_to_date" severity="high">
+<title>Ensure Software Security Patches Installed</title>
+<description>If the system is joined a yum server, run the following command
+to install security updates:
+<pre># yum update-minimal --security</pre>
+</description>
+<rationale>
+Installing software security updates is a fundamental mitigation against
+the exploitation of publicly-known vulnerabilities.
+</rationale>
+    <complex-check operator="AND" negate="false">
+        <!-- First check if fedora-updates.repo is enabled. -->
+        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+            <check-content-ref href="unlinked-fedora19-oval.xml" name="ensure_yum_fedora_updates_repo_enabled" />
+        </check>
+        <!-- Then check if there are any security updates available. -->
+        <check system="http://open-scap.org/page/SCE">
+            <check-content-ref href="sce/bash/security_patches_up_to_date.sh" />
+        </check>
+    </complex-check>
+<ref nist="SI-2,MA-1(b)" disa="1227,1233"/>
+</Rule>
+
 </Group>
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index f0ebd16..d7118e1 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -52,6 +52,7 @@ rm -rf $RPM_BUILD_ROOT
 %changelog
 * Thu Oct 03 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc2
 - Introduce 'Ensure Yum fedora-updates Repository Enabled' rule.
+- Introduce 'Ensure Software Security Patches Installed' rule.
 
 * Wed Oct 02 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc1
 - Set proper name of the build directory in the spec's %setup macro.
-- 
1.7.11.7

