>From 6d8d3b510c9261c022f70efa633d45b1acb1f26a Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 14 Apr 2014 23:29:41 -0400 Subject: [PATCH 00/26] Resubmission of C2S profile After a few coffees and croissants this morning @ RHT Summit, Jeff and I made friends and hashed out the details of the C2S profile. Resubmitting patches to reflect Jan's feedback and adding details within the C2S profile on rule mappings. Shawn Wells (26): New Remediation: sticky_world_writable_dirs.sh New Remediation: enable_selinux_bootloader.sh Moved RHEL6 selinux_state.sh to shared Moved RHEL6 selinux_policytype.sh to shared/ New RHEL6 Rule: package_setroubleshoot_removed typo fix New Rule: package_mcstrans_removed XCCDF Rule Rename: disable_setuid_coredumps --> sysctl_fs_suid_dumpable New RHEL6 Rule: package_telnet_removed New RHEL6 rule: package_rsh_removed New RHEL6 rule: package_ypbind_removed New RHEL6 rule: package_tftp_removed [bugfix] kernel_module_hfs_disabledplus --> kernel_module_hfsplus_disabled New Profile: C2S Adding C2S into build system Mapped C2S 9.2.11 to gid_passwd_group_same C2S 1.1.6 --> mount_option_var_tmp_bind_var C2S 1.1.10 --> mount_option_nodev_nonroot_local_partitions C2S 3.2 --> packagegroup_xwindows_remove C2S 3.16 --> postfix_network_listening_disabled Adding rsyslog_nolisten mapping C2S 6.1.10 --> service_atd_disabled C2S 7.1.1 --> accounts_maximum_age_login_defs Updating C2S profile Updating RHEL/6/output/.gitignore Updating commit per Jan's feedback RHEL/6/input/checks/package_mcstrans_removed.xml | 26 + RHEL/6/input/checks/package_rsh_removed.xml | 26 + .../checks/package_setroubleshoot_removed.xml | 26 + RHEL/6/input/checks/package_telnet_removed.xml | 26 + RHEL/6/input/checks/package_tftp_removed.xml | 26 + RHEL/6/input/checks/templates/packages_removed.csv | 5 + .../input/fixes/bash/enable_selinux_bootloader.sh | 1 + RHEL/6/input/fixes/bash/selinux_policytype.sh | 9 +- RHEL/6/input/fixes/bash/selinux_state.sh | 9 +- .../input/fixes/bash/sticky_world_writable_dirs.sh | 1 + RHEL/6/input/guide.xslt | 1 + RHEL/6/input/profiles/C2S.xml | 724 ++++++++++++++++++++ RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/nist-CL-IL-AL.xml | 6 +- .../input/profiles/stig-rhel6-server-upstream.xml | 11 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL/6/input/services/obsolete.xml | 61 ++ RHEL/6/input/system/permissions/execution.xml | 2 +- RHEL/6/input/system/selinux.xml | 29 + shared/fixes/bash/enable_selinux_bootloader.sh | 2 + shared/fixes/bash/selinux_policytype.sh | 8 + shared/fixes/bash/selinux_state.sh | 8 + shared/fixes/bash/sticky_world_writable_dirs.sh | 4 + 25 files changed, 995 insertions(+), 24 deletions(-) create mode 100644 RHEL/6/input/checks/package_mcstrans_removed.xml create mode 100644 RHEL/6/input/checks/package_rsh_removed.xml create mode 100644 RHEL/6/input/checks/package_setroubleshoot_removed.xml create mode 100644 RHEL/6/input/checks/package_telnet_removed.xml create mode 100644 RHEL/6/input/checks/package_tftp_removed.xml create mode 120000 RHEL/6/input/fixes/bash/enable_selinux_bootloader.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_policytype.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_state.sh create mode 120000 RHEL/6/input/fixes/bash/sticky_world_writable_dirs.sh create mode 100644 RHEL/6/input/profiles/C2S.xml mode change 100644 => 100755 RHEL/6/output/.gitignore create mode 100644 shared/fixes/bash/enable_selinux_bootloader.sh create mode 100644 shared/fixes/bash/selinux_policytype.sh create mode 100644 shared/fixes/bash/selinux_state.sh create mode 100644 shared/fixes/bash/sticky_world_writable_dirs.sh