>From a0ab66c2dae999d56c6ffd881f07de6caebbf075 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 13 Dec 2013 20:50:53 -0500 Subject: [PATCH 00/25] RHEL7 content import && RHEL7 CCP profile start - Imported RHEL6 content into shared/, linked back to RHEL7 where appropriate - Started RHEL7 CCP profile - Updated RPM build with RHEL7 content Shawn Wells (23): Updated RHEL7 idtranslate.pyc Added testcheck.py to shared/oval/ Updated CPE platform tags for system_info_architecture_x86* to include RHEL7 - Tested checks on RHEL7 selinux_state.xml --> shared/ - Updated CPE for RHEL7 (after retesting) - Updated filename -> filepath in OVAL Added selinux_policytype to shared/ && RHEL7 - Moved RHEL6 selinux_policytype to shared/ - Tested on RHEL7, updated CPE Adding selinux_state to shared Moved ensure_redhat_gpgkey_installed -> shared/ - RHEL7 testing - Updating CPE info RHEL6/ensure_gpgcheck_globally_activated.xml --> shared - Updated OVAL name to match XCCDF - Tested on RHEL7, added CPE - Moved to shared/ Added ensure_gpgcheck_never_disabled.xml to RHEL7 Added RHEL7 content into SSG RHEL RPM process package_aide_installed --> shared/ accounts_password_reuse_limit --> shared/ Migrated no_shelllogin_for_systemaccounts --> shared/ no_empty_passwords --> shared/ accounts_password_all_shadowed --> shared/ accounts_no_uid_except_zero -> shared/ accounts_password_minlen_login_defs --> shared/ && bugfix to RHEL6 CCP profile accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile update accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile update accounts_password_warn_age_login_defs --> shared/ && RHT CCP profile update accounts_password_pam_cracklib_retry --> shared/ Adding RHEL7 RHT-CCP profile Reset all RHEL7 CCEs - All RHEL7 XCCDF checks will require new CCEs. Temporarily setting to RHEL7-CCE-TBD shawn (2): partition_for_* --> shared/oval/ - Moved partition_for_* checks to shared/oval/ - Tested on RHEL7, added platform tag - Removed RHEL7 gconf OVAL (as they're not tested yet) - Symlinked partition_for_* back to appropriate RHEL6 and RHEL7 directories RHEL6: selinux_bootloader_notdisabled.xml -> enable_selinux_bootloader.xml - Updated OVAL to match XCCDF name Makefile | 13 +- RHEL/6/Makefile | 6 +- RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- RHEL/6/input/auxiliary/transition_notes.xml | 2 +- .../checks/accounts_minimum_age_login_defs.xml | 36 +----- .../6/input/checks/accounts_no_uid_except_zero.xml | 25 +--- .../checks/accounts_password_all_shadowed.xml | 26 +--- .../checks/accounts_password_minlen_login_defs.xml | 35 +----- .../accounts_password_pam_cracklib_retry.xml | 35 +----- .../input/checks/accounts_password_reuse_limit.xml | 33 +---- .../accounts_password_warn_age_login_defs.xml | 37 +----- RHEL/6/input/checks/enable_selinux_bootloader.xml | 29 +++++ .../checks/ensure_gpgcheck_globally_activated.xml | 1 + .../checks/ensure_redhat_gpgkey_installed.xml | 44 +------ RHEL/6/input/checks/no_empty_passwords.xml | 24 +--- .../checks/no_shelllogin_for_systemaccounts.xml | 24 +--- RHEL/6/input/checks/package_aide_installed.xml | 27 +--- RHEL/6/input/checks/partition_for_home.xml | 27 +--- RHEL/6/input/checks/partition_for_tmp.xml | 25 +--- RHEL/6/input/checks/partition_for_var.xml | 27 +--- RHEL/6/input/checks/partition_for_var_log.xml | 24 +--- .../6/input/checks/partition_for_var_log_audit.xml | 28 +---- .../checks/selinux_bootloader_notdisabled.xml | 29 ----- RHEL/6/input/checks/selinux_policytype.xml | 37 +----- RHEL/6/input/checks/selinux_state.xml | 36 +----- .../checks/yum_gpgcheck_global_activation.xml | 25 ---- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/rht-ccp.xml | 9 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- .../accounts/restrictions/password_storage.xml | 2 +- RHEL/6/input/system/selinux.xml | 2 +- RHEL/7/Makefile | 2 + .../checks/accounts_minimum_age_login_defs.xml | 1 + .../7/input/checks/accounts_no_uid_except_zero.xml | 1 + .../checks/accounts_password_all_shadowed.xml | 1 + .../checks/accounts_password_minlen_login_defs.xml | 1 + .../accounts_password_pam_cracklib_retry.xml | 1 + .../input/checks/accounts_password_reuse_limit.xml | 1 + .../accounts_password_warn_age_login_defs.xml | 1 + .../checks/ensure_gpgcheck_globally_activated.xml | 1 + .../checks/ensure_gpgcheck_never_disabled.xml | 1 + .../checks/ensure_redhat_gpgkey_installed.xml | 1 + .../input/checks/gconf_gnome_disable_automount.xml | 46 ------- .../checks/gconf_gnome_disable_thumbnailers.xml | 32 ----- ...f_gnome_screensaver_idle_activation_enabled.xml | 30 ----- .../checks/gconf_gnome_screensaver_idle_delay.xml | 34 ----- .../gconf_gnome_screensaver_lock_enabled.xml | 29 ----- .../checks/gconf_gnome_screensaver_mode_blank.xml | 29 ----- RHEL/7/input/checks/no_empty_passwords.xml | 1 + .../checks/no_shelllogin_for_systemaccounts.xml | 1 + RHEL/7/input/checks/package_aide_installed.xml | 1 + RHEL/7/input/checks/partition_for_home.xml | 26 +--- RHEL/7/input/checks/partition_for_tmp.xml | 24 +--- RHEL/7/input/checks/partition_for_var.xml | 26 +--- RHEL/7/input/checks/partition_for_var_log.xml | 23 +--- .../7/input/checks/partition_for_var_log_audit.xml | 27 +--- RHEL/7/input/checks/selinux_policytype.xml | 1 + RHEL/7/input/checks/selinux_state.xml | 1 + RHEL/7/input/guide.xslt | 84 +++++++++++++ RHEL/7/input/profiles/rht-ccp.xml | 138 +++++++++++++++++++++ .../input/profiles/stig-rhel6-server-upstream.xml | 7 -- .../input/profiles/stig-rhel7-server-upstream.xml | 7 ++ RHEL/7/input/services/avahi.xml | 12 +- RHEL/7/input/services/base.xml | 48 +++---- RHEL/7/input/services/cron.xml | 6 +- RHEL/7/input/services/dhcp.xml | 30 ++--- RHEL/7/input/services/dns.xml | 10 +- RHEL/7/input/services/ftp.xml | 16 +-- RHEL/7/input/services/http.xml | 50 ++++---- RHEL/7/input/services/imap.xml | 12 +- RHEL/7/input/services/ldap.xml | 6 +- RHEL/7/input/services/mail.xml | 8 +- RHEL/7/input/services/nfs.xml | 32 ++--- RHEL/7/input/services/ntp.xml | 6 +- RHEL/7/input/services/obsolete.xml | 28 ++--- RHEL/7/input/services/printing.xml | 6 +- RHEL/7/input/services/smb.xml | 8 +- RHEL/7/input/services/snmp.xml | 8 +- RHEL/7/input/services/squid.xml | 4 +- RHEL/7/input/services/ssh.xml | 28 ++--- RHEL/7/input/services/xorg.xml | 4 +- RHEL/7/input/system/accounts/banners.xml | 8 +- RHEL/7/input/system/accounts/pam.xml | 30 ++--- RHEL/7/input/system/accounts/physical.xml | 26 ++-- .../accounts/restrictions/account_expiration.xml | 6 +- .../accounts/restrictions/password_expiration.xml | 8 +- .../accounts/restrictions/password_storage.xml | 8 +- .../system/accounts/restrictions/root_logins.xml | 14 +-- RHEL/7/input/system/accounts/session.xml | 16 +-- RHEL/7/input/system/auditing.xml | 82 ++++++------ RHEL/7/input/system/logging.xml | 26 ++-- RHEL/7/input/system/network/ipsec.xml | 2 +- RHEL/7/input/system/network/iptables.xml | 10 +- RHEL/7/input/system/network/ipv6.xml | 16 +-- RHEL/7/input/system/network/kernel.xml | 30 ++--- RHEL/7/input/system/network/network.xml | 4 +- RHEL/7/input/system/network/uncommon.xml | 8 +- RHEL/7/input/system/network/wireless.xml | 8 +- RHEL/7/input/system/permissions/execution.xml | 16 +-- RHEL/7/input/system/permissions/files.xml | 46 +++---- RHEL/7/input/system/permissions/mounting.xml | 28 ++--- RHEL/7/input/system/permissions/partitions.xml | 22 ++-- RHEL/7/input/system/selinux.xml | 12 +- RHEL/7/input/system/software/disk_partitioning.xml | 12 +- RHEL/7/input/system/software/integrity.xml | 16 +-- RHEL/7/input/system/software/updating.xml | 8 +- RHEL/7/transforms/idtranslate.pyc | Bin 5314 -> 5149 bytes scap-security-guide.spec | 42 +++++-- shared/oval/.gitignore | 1 + shared/oval/accounts_minimum_age_login_defs.xml | 36 ++++++ shared/oval/accounts_no_uid_except_zero.xml | 24 ++++ shared/oval/accounts_password_all_shadowed.xml | 26 ++++ .../oval/accounts_password_minlen_login_defs.xml | 35 ++++++ .../oval/accounts_password_pam_cracklib_retry.xml | 35 ++++++ shared/oval/accounts_password_reuse_limit.xml | 33 +++++ .../oval/accounts_password_warn_age_login_defs.xml | 37 ++++++ shared/oval/ensure_gpgcheck_globally_activated.xml | 27 ++++ shared/oval/ensure_gpgcheck_never_disabled.xml | 2 + shared/oval/ensure_redhat_gpgkey_installed.xml | 47 +++++++ shared/oval/idtranslate.py | 138 +++++++++++++++++++++ shared/oval/idtranslate.pyc | Bin 0 -> 5083 bytes shared/oval/no_empty_passwords.xml | 24 ++++ shared/oval/no_shelllogin_for_systemaccounts.xml | 24 ++++ shared/oval/package_aide_installed.xml | 27 ++++ shared/oval/partition_for_home.xml | 28 +++++ shared/oval/partition_for_tmp.xml | 26 ++++ shared/oval/partition_for_var.xml | 27 ++++ shared/oval/partition_for_var_log.xml | 25 ++++ shared/oval/partition_for_var_log_audit.xml | 29 +++++ shared/oval/selinux_policytype.xml | 38 ++++++ shared/oval/selinux_state.xml | 35 ++++++ shared/oval/system_info_architecture_x86.xml | 1 + shared/oval/system_info_architecture_x86_64.xml | 1 + shared/oval/testcheck.py | 124 ++++++++++++++++++ 136 files changed, 1599 insertions(+), 1334 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/accounts_minimum_age_login_defs.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_no_uid_except_zero.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_all_shadowed.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_minlen_login_defs.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_retry.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_reuse_limit.xml mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_warn_age_login_defs.xml create mode 100644 RHEL/6/input/checks/enable_selinux_bootloader.xml create mode 120000 RHEL/6/input/checks/ensure_gpgcheck_globally_activated.xml mode change 100644 => 120000 RHEL/6/input/checks/ensure_redhat_gpgkey_installed.xml mode change 100644 => 120000 RHEL/6/input/checks/no_empty_passwords.xml mode change 100644 => 120000 RHEL/6/input/checks/no_shelllogin_for_systemaccounts.xml mode change 100644 => 120000 RHEL/6/input/checks/package_aide_installed.xml mode change 100644 => 120000 RHEL/6/input/checks/partition_for_home.xml mode change 100644 => 120000 RHEL/6/input/checks/partition_for_tmp.xml mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var.xml mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log.xml mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log_audit.xml delete mode 100644 RHEL/6/input/checks/selinux_bootloader_notdisabled.xml mode change 100644 => 120000 RHEL/6/input/checks/selinux_policytype.xml mode change 100644 => 120000 RHEL/6/input/checks/selinux_state.xml delete mode 100644 RHEL/6/input/checks/yum_gpgcheck_global_activation.xml create mode 120000 RHEL/7/input/checks/accounts_minimum_age_login_defs.xml create mode 120000 RHEL/7/input/checks/accounts_no_uid_except_zero.xml create mode 120000 RHEL/7/input/checks/accounts_password_all_shadowed.xml create mode 120000 RHEL/7/input/checks/accounts_password_minlen_login_defs.xml create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_retry.xml create mode 120000 RHEL/7/input/checks/accounts_password_reuse_limit.xml create mode 120000 RHEL/7/input/checks/accounts_password_warn_age_login_defs.xml create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_globally_activated.xml create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_never_disabled.xml create mode 120000 RHEL/7/input/checks/ensure_redhat_gpgkey_installed.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_automount.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml create mode 120000 RHEL/7/input/checks/no_empty_passwords.xml create mode 120000 RHEL/7/input/checks/no_shelllogin_for_systemaccounts.xml create mode 120000 RHEL/7/input/checks/package_aide_installed.xml mode change 100644 => 120000 RHEL/7/input/checks/partition_for_home.xml mode change 100644 => 120000 RHEL/7/input/checks/partition_for_tmp.xml mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var.xml mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log.xml mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log_audit.xml create mode 120000 RHEL/7/input/checks/selinux_policytype.xml create mode 120000 RHEL/7/input/checks/selinux_state.xml create mode 100644 RHEL/7/input/profiles/rht-ccp.xml delete mode 100644 RHEL/7/input/profiles/stig-rhel6-server-upstream.xml create mode 100644 RHEL/7/input/profiles/stig-rhel7-server-upstream.xml create mode 100644 shared/oval/.gitignore create mode 100644 shared/oval/accounts_minimum_age_login_defs.xml create mode 100644 shared/oval/accounts_no_uid_except_zero.xml create mode 100644 shared/oval/accounts_password_all_shadowed.xml create mode 100644 shared/oval/accounts_password_minlen_login_defs.xml create mode 100644 shared/oval/accounts_password_pam_cracklib_retry.xml create mode 100644 shared/oval/accounts_password_reuse_limit.xml create mode 100644 shared/oval/accounts_password_warn_age_login_defs.xml create mode 100644 shared/oval/ensure_gpgcheck_globally_activated.xml create mode 100644 shared/oval/ensure_redhat_gpgkey_installed.xml create mode 100755 shared/oval/idtranslate.py create mode 100644 shared/oval/idtranslate.pyc create mode 100644 shared/oval/no_empty_passwords.xml create mode 100644 shared/oval/no_shelllogin_for_systemaccounts.xml create mode 100644 shared/oval/package_aide_installed.xml create mode 100644 shared/oval/partition_for_home.xml create mode 100644 shared/oval/partition_for_tmp.xml create mode 100644 shared/oval/partition_for_var.xml create mode 100644 shared/oval/partition_for_var_log.xml create mode 100644 shared/oval/partition_for_var_log_audit.xml create mode 100644 shared/oval/selinux_policytype.xml create mode 100644 shared/oval/selinux_state.xml create mode 100755 shared/oval/testcheck.py -- 1.8.3.1