>From 0ee4bb5a628ce88e717146b4831039747bd86cf7 Mon Sep 17 00:00:00 2001 From: shawn Date: Sun, 22 Dec 2013 14:31:38 -0500 Subject: [PATCH 01/25] partition_for_* --> shared/oval/ - Moved partition_for_* checks to shared/oval/ - Tested on RHEL7, added platform tag - Removed RHEL7 gconf OVAL (as they're not tested yet) - Symlinked partition_for_* back to appropriate RHEL6 and RHEL7 directories Signed-off-by: Shawn Wells --- :100644 120000 2081d18... 24da73c... T RHEL/6/input/checks/partition_for_home.xml :100644 120000 9c28c13... 1d91875... T RHEL/6/input/checks/partition_for_tmp.xml :100644 120000 2ed1d38... 760145b... T RHEL/6/input/checks/partition_for_var.xml :100644 120000 94d235b... f19e088... T RHEL/6/input/checks/partition_for_var_log.xml :100644 120000 b7a7d68... dc91923... T RHEL/6/input/checks/partition_for_var_log_audit.xml :100644 000000 f78fc89... 0000000... D RHEL/7/input/checks/gconf_gnome_disable_automount.xml :100644 000000 80045a3... 0000000... D RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml :100644 000000 0d012a7... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml :100644 000000 c77e608... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml :100644 000000 cc031fc... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml :100644 000000 8229d71... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml :100644 120000 55b25d0... 24da73c... T RHEL/7/input/checks/partition_for_home.xml :100644 120000 2438ac7... 1d91875... T RHEL/7/input/checks/partition_for_tmp.xml :100644 120000 db883eb... 760145b... T RHEL/7/input/checks/partition_for_var.xml :100644 120000 f0d2f30... f19e088... T RHEL/7/input/checks/partition_for_var_log.xml :100644 120000 a9e7f37... dc91923... T RHEL/7/input/checks/partition_for_var_log_audit.xml :000000 100644 0000000... eb50e33... A shared/oval/partition_for_home.xml :000000 100644 0000000... 83b482a... A shared/oval/partition_for_tmp.xml :000000 100644 0000000... d86610b... A shared/oval/partition_for_var.xml :000000 100644 0000000... 06cfffa... A shared/oval/partition_for_var_log.xml :000000 100644 0000000... ffe3092... A shared/oval/partition_for_var_log_audit.xml RHEL/6/input/checks/partition_for_home.xml | 27 +------------ RHEL/6/input/checks/partition_for_tmp.xml | 25 +----------- RHEL/6/input/checks/partition_for_var.xml | 27 +------------ RHEL/6/input/checks/partition_for_var_log.xml | 24 +---------- .../6/input/checks/partition_for_var_log_audit.xml | 28 +------------ .../input/checks/gconf_gnome_disable_automount.xml | 46 ---------------------- .../checks/gconf_gnome_disable_thumbnailers.xml | 32 --------------- ...f_gnome_screensaver_idle_activation_enabled.xml | 30 -------------- .../checks/gconf_gnome_screensaver_idle_delay.xml | 34 ---------------- .../gconf_gnome_screensaver_lock_enabled.xml | 29 -------------- .../checks/gconf_gnome_screensaver_mode_blank.xml | 29 -------------- RHEL/7/input/checks/partition_for_home.xml | 26 +----------- RHEL/7/input/checks/partition_for_tmp.xml | 24 +---------- RHEL/7/input/checks/partition_for_var.xml | 26 +----------- RHEL/7/input/checks/partition_for_var_log.xml | 23 +---------- .../7/input/checks/partition_for_var_log_audit.xml | 27 +------------ shared/oval/partition_for_home.xml | 28 +++++++++++++ shared/oval/partition_for_tmp.xml | 26 ++++++++++++ shared/oval/partition_for_var.xml | 27 +++++++++++++ shared/oval/partition_for_var_log.xml | 25 ++++++++++++ shared/oval/partition_for_var_log_audit.xml | 29 ++++++++++++++ 21 files changed, 145 insertions(+), 447 deletions(-) diff --git a/RHEL/6/input/checks/partition_for_home.xml b/RHEL/6/input/checks/partition_for_home.xml deleted file mode 100644 index 2081d18..0000000 --- a/RHEL/6/input/checks/partition_for_home.xml +++ /dev/null @@ -1,26 +0,0 @@ - - - - Ensure /home Located On Separate Partition - - Red Hat Enterprise Linux 6 - - If user home directories will be stored locally, create a - separate partition for /home. If /home will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - - - /home - - diff --git a/RHEL/6/input/checks/partition_for_home.xml b/RHEL/6/input/checks/partition_for_home.xml new file mode 120000 index 0000000..24da73c --- /dev/null +++ b/RHEL/6/input/checks/partition_for_home.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_home.xml \ No newline at end of file diff --git a/RHEL/6/input/checks/partition_for_tmp.xml b/RHEL/6/input/checks/partition_for_tmp.xml deleted file mode 100644 index 9c28c13..0000000 --- a/RHEL/6/input/checks/partition_for_tmp.xml +++ /dev/null @@ -1,24 +0,0 @@ - - - - Ensure /tmp Located On Separate Partition - - Red Hat Enterprise Linux 6 - - The /tmp directory is a world-writable directory used for - temporary file storage. Verify that it has its own partition or logical - volume. - - - - - - - - - - - /tmp - - diff --git a/RHEL/6/input/checks/partition_for_tmp.xml b/RHEL/6/input/checks/partition_for_tmp.xml new file mode 120000 index 0000000..1d91875 --- /dev/null +++ b/RHEL/6/input/checks/partition_for_tmp.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_tmp.xml \ No newline at end of file diff --git a/RHEL/6/input/checks/partition_for_var.xml b/RHEL/6/input/checks/partition_for_var.xml deleted file mode 100644 index 2ed1d38..0000000 --- a/RHEL/6/input/checks/partition_for_var.xml +++ /dev/null @@ -1,26 +0,0 @@ - - - - Ensure /var Located On Separate Partition - - Red Hat Enterprise Linux 6 - - Ensuring that /var is mounted on its own partition enables - the setting of more restrictive mount options, which is used as temporary - storage by many program, particularly system services such as daemons. It - is not uncommon for the /var directory to contain world-writable - directories, installed by other software packages. - - - - - - - - - - - /var - - diff --git a/RHEL/6/input/checks/partition_for_var.xml b/RHEL/6/input/checks/partition_for_var.xml new file mode 120000 index 0000000..760145b --- /dev/null +++ b/RHEL/6/input/checks/partition_for_var.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var.xml \ No newline at end of file diff --git a/RHEL/6/input/checks/partition_for_var_log.xml b/RHEL/6/input/checks/partition_for_var_log.xml deleted file mode 100644 index 94d235b..0000000 --- a/RHEL/6/input/checks/partition_for_var_log.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Ensure /var/log Located On Separate Partition - - Red Hat Enterprise Linux 6 - - System logs are stored in the /var/log directory. Ensure - that it has its own partition or logical volume. - - - - - - - - - - - /var/log - - diff --git a/RHEL/6/input/checks/partition_for_var_log.xml b/RHEL/6/input/checks/partition_for_var_log.xml new file mode 120000 index 0000000..f19e088 --- /dev/null +++ b/RHEL/6/input/checks/partition_for_var_log.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var_log.xml \ No newline at end of file diff --git a/RHEL/6/input/checks/partition_for_var_log_audit.xml b/RHEL/6/input/checks/partition_for_var_log_audit.xml deleted file mode 100644 index b7a7d68..0000000 --- a/RHEL/6/input/checks/partition_for_var_log_audit.xml +++ /dev/null @@ -1,27 +0,0 @@ - - - - Ensure /var/log/audit Located On Separate Partition - - Red Hat Enterprise Linux 6 - - Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make absolutely - certain that it is large enough to store all audit logs that will be - created by the auditing daemon. - - - - - - - - - - - /var/log/audit - - diff --git a/RHEL/6/input/checks/partition_for_var_log_audit.xml b/RHEL/6/input/checks/partition_for_var_log_audit.xml new file mode 120000 index 0000000..dc91923 --- /dev/null +++ b/RHEL/6/input/checks/partition_for_var_log_audit.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var_log_audit.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/gconf_gnome_disable_automount.xml b/RHEL/7/input/checks/gconf_gnome_disable_automount.xml deleted file mode 100644 index f78fc89..0000000 --- a/RHEL/7/input/checks/gconf_gnome_disable_automount.xml +++ /dev/null @@ -1,46 +0,0 @@ - - - - Disable GNOME Automounting - - Red Hat Enterprise Linux 6 - - The system's default desktop environment, GNOME, will mount - devices and removable media (such as DVDs, CDs and USB flash drives) - whenever they are inserted into the system. Disable automount and autorun - within GNOME. - - - - - - - - - - - - - - false - - - /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml - /gconf/entry[@name='media_automount']/@value - - - - - - - true - - - /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml - /gconf/entry[@name='media_autorun_never']/@value - - diff --git a/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml deleted file mode 100644 index 80045a3..0000000 --- a/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml +++ /dev/null @@ -1,32 +0,0 @@ - - - - Disable All GNOME Thumbnailers - - Red Hat Enterprise Linux 6 - - The system's default desktop environment, GNOME, uses a - number of different thumbnailer programs to generate thumbnails for any - new or modified content in an opened folder. Disable the execution of - these thumbnail applications within GNOME. - - - - - - - - - - - - - true - - - /etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml - /gconf/entry[@name='disable_all']/@value - - diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml deleted file mode 100644 index 0d012a7..0000000 --- a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - Implement idle activation of screen saver - - Red Hat Enterprise Linux 6 - - Idle activation of the screen saver should be - enabled. - - - - - - - - - - - - - true - - - /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml - /gconf/entry[@name='idle_activation_enabled']/@value - - diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml deleted file mode 100644 index c77e608..0000000 --- a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ /dev/null @@ -1,34 +0,0 @@ - - - - Configure GUI Screen Locking - - Red Hat Enterprise Linux 6 - - The allowed period of inactivity before the screensaver is - activated. - - - - - - - - - - - - - /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml - /gconf/entry[@name='idle_delay']/@value - - - - - - diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml deleted file mode 100644 index cc031fc..0000000 --- a/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ /dev/null @@ -1,29 +0,0 @@ - - - - Implement idle activation of screen lock - - Red Hat Enterprise Linux 6 - - Idle activation of the screen lock should be - enabled. - - - - - - - - - - - - - /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml - /gconf/entry[@name='lock_enabled']/@value - - - true - - diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml deleted file mode 100644 index 8229d71..0000000 --- a/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ /dev/null @@ -1,29 +0,0 @@ - - - - Implement blank screen saver - - Red Hat Enterprise Linux 6 - - The screen saver should be blank. - - - - - - - - - - - - - blank-only - - - /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml - /gconf/entry[@name='mode']/stringvalue[1]/text() - - diff --git a/RHEL/7/input/checks/partition_for_home.xml b/RHEL/7/input/checks/partition_for_home.xml deleted file mode 100644 index 55b25d0..0000000 --- a/RHEL/7/input/checks/partition_for_home.xml +++ /dev/null @@ -1,25 +0,0 @@ - - - - Ensure /home Located On Separate Partition - - Red Hat Enterprise Linux 7 - - If user home directories will be stored locally, create a - separate partition for /home. If /home will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - - /home - - diff --git a/RHEL/7/input/checks/partition_for_home.xml b/RHEL/7/input/checks/partition_for_home.xml new file mode 120000 index 0000000..24da73c --- /dev/null +++ b/RHEL/7/input/checks/partition_for_home.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_home.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/partition_for_tmp.xml b/RHEL/7/input/checks/partition_for_tmp.xml deleted file mode 100644 index 2438ac7..0000000 --- a/RHEL/7/input/checks/partition_for_tmp.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Ensure /tmp Located On Separate Partition - - Red Hat Enterprise Linux 7 - - The /tmp directory is a world-writable directory used for - temporary file storage. Verify that it has its own partition or logical - volume. - - - - - - - - - - /tmp - - diff --git a/RHEL/7/input/checks/partition_for_tmp.xml b/RHEL/7/input/checks/partition_for_tmp.xml new file mode 120000 index 0000000..1d91875 --- /dev/null +++ b/RHEL/7/input/checks/partition_for_tmp.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_tmp.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/partition_for_var.xml b/RHEL/7/input/checks/partition_for_var.xml deleted file mode 100644 index db883eb..0000000 --- a/RHEL/7/input/checks/partition_for_var.xml +++ /dev/null @@ -1,25 +0,0 @@ - - - - Ensure /var Located On Separate Partition - - Red Hat Enterprise Linux 7 - - Ensuring that /var is mounted on its own partition enables - the setting of more restrictive mount options, which is used as temporary - storage by many program, particularly system services such as daemons. It - is not uncommon for the /var directory to contain world-writable - directories, installed by other software packages. - - - - - - - - - - /var - - diff --git a/RHEL/7/input/checks/partition_for_var.xml b/RHEL/7/input/checks/partition_for_var.xml new file mode 120000 index 0000000..760145b --- /dev/null +++ b/RHEL/7/input/checks/partition_for_var.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/partition_for_var_log.xml b/RHEL/7/input/checks/partition_for_var_log.xml deleted file mode 100644 index f0d2f30..0000000 --- a/RHEL/7/input/checks/partition_for_var_log.xml +++ /dev/null @@ -1,22 +0,0 @@ - - - - Ensure /var/log Located On Separate Partition - - Red Hat Enterprise Linux 7 - - System logs are stored in the /var/log directory. Ensure - that it has its own partition or logical volume. - - - - - - - - - - /var/log - - diff --git a/RHEL/7/input/checks/partition_for_var_log.xml b/RHEL/7/input/checks/partition_for_var_log.xml new file mode 120000 index 0000000..f19e088 --- /dev/null +++ b/RHEL/7/input/checks/partition_for_var_log.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var_log.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/partition_for_var_log_audit.xml b/RHEL/7/input/checks/partition_for_var_log_audit.xml deleted file mode 100644 index a9e7f37..0000000 --- a/RHEL/7/input/checks/partition_for_var_log_audit.xml +++ /dev/null @@ -1,26 +0,0 @@ - - - - Ensure /var/log/audit Located On Separate Partition - - Red Hat Enterprise Linux 7 - - Audit logs are stored in the /var/log/audit directory. - Ensure that it has its own partition or logical volume. Make absolutely - certain that it is large enough to store all audit logs that will be - created by the auditing daemon. - - - - - - - - - - /var/log/audit - - diff --git a/RHEL/7/input/checks/partition_for_var_log_audit.xml b/RHEL/7/input/checks/partition_for_var_log_audit.xml new file mode 120000 index 0000000..dc91923 --- /dev/null +++ b/RHEL/7/input/checks/partition_for_var_log_audit.xml @@ -0,0 +1 @@ +../../../../shared/oval/partition_for_var_log_audit.xml \ No newline at end of file diff --git a/shared/oval/partition_for_home.xml b/shared/oval/partition_for_home.xml new file mode 100644 index 0000000..eb50e33 --- /dev/null +++ b/shared/oval/partition_for_home.xml @@ -0,0 +1,28 @@ + + + + Ensure /home Located On Separate Partition + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + If user home directories will be stored locally, create a + separate partition for /home. If /home will be mounted from another + system such as an NFS server, then creating a separate partition is not + necessary at this time, and the mountpoint can instead be configured + later. + + + + + + + + + + + + /home + + diff --git a/shared/oval/partition_for_tmp.xml b/shared/oval/partition_for_tmp.xml new file mode 100644 index 0000000..83b482a --- /dev/null +++ b/shared/oval/partition_for_tmp.xml @@ -0,0 +1,26 @@ + + + + Ensure /tmp Located On Separate Partition + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + The /tmp directory is a world-writable directory used for + temporary file storage. Verify that it has its own partition or logical + volume. + + + + + + + + + + + + /tmp + + diff --git a/shared/oval/partition_for_var.xml b/shared/oval/partition_for_var.xml new file mode 100644 index 0000000..d86610b --- /dev/null +++ b/shared/oval/partition_for_var.xml @@ -0,0 +1,27 @@ + + + + Ensure /var Located On Separate Partition + + Red Hat Enterprise Linux 7 + + Ensuring that /var is mounted on its own partition enables + the setting of more restrictive mount options, which is used as temporary + storage by many program, particularly system services such as daemons. It + is not uncommon for the /var directory to contain world-writable + directories, installed by other software packages. + + + + + + + + + + + + /var + + diff --git a/shared/oval/partition_for_var_log.xml b/shared/oval/partition_for_var_log.xml new file mode 100644 index 0000000..06cfffa --- /dev/null +++ b/shared/oval/partition_for_var_log.xml @@ -0,0 +1,25 @@ + + + + Ensure /var/log Located On Separate Partition + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + System logs are stored in the /var/log directory. Ensure + that it has its own partition or logical volume. + + + + + + + + + + + + /var/log + + diff --git a/shared/oval/partition_for_var_log_audit.xml b/shared/oval/partition_for_var_log_audit.xml new file mode 100644 index 0000000..ffe3092 --- /dev/null +++ b/shared/oval/partition_for_var_log_audit.xml @@ -0,0 +1,29 @@ + + + + Ensure /var/log/audit Located On Separate Partition + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + Audit logs are stored in the /var/log/audit directory. + Ensure that it has its own partition or logical volume. Make absolutely + certain that it is large enough to store all audit logs that will be + created by the auditing daemon. + + + + + + + + + + + + /var/log/audit + + -- 1.8.3.1