From c6170e4caad86c8ad4b2146b0098e8fef8c0f131 Mon Sep 17 00:00:00 2001 From: Shawn Wells <shawn@redhat.com> Date: Fri, 29 Mar 2013 16:15:52 -0400 Subject: [PATCH 03/21] Updated package_screen_installed - Changed XCCDF rule to match naming scheme of package_PACKAGE_installed - Updated associated profiles - Added screen to templates file, generating OVAL + BASH --- RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/checks/package_screen_installed.xml | 25 ++++++++++++++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_screen_installed.sh | 1 + RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/manual_remediation.xml | 2 +- RHEL6/input/system/accounts/physical.xml | 2 +- 7 files changed, 31 insertions(+), 4 deletions(-) create mode 100644 RHEL6/input/checks/package_screen_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_screen_installed.sh diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index ca3f9ac..d4a9cf0 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -242,7 +242,7 @@ The graphical desktop environment must have automatic lock enabled. <title rule="set_blank_screensaver" shorttitle="Implement Blank Screen Saver"> The system must display a publicly-viewable pattern during a graphical desktop environment session lock. </title> -<title rule="install_screen_package" shorttitle="Install the screen Package"> +<title rule="package_screen_installed" shorttitle="Install the screen Package"> The system must allow locking of the console screen. </title> <title rule="set_system_login_banner" shorttitle="Modify the System Login Banner"> diff --git a/RHEL6/input/checks/package_screen_installed.xml b/RHEL6/input/checks/package_screen_installed.xml new file mode 100644 index 0000000..3be6486 --- /dev/null +++ b/RHEL6/input/checks/package_screen_installed.xml @@ -0,0 +1,25 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_screen_installed" + version="1"> + <metadata> + <title>Package screen Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package screen should be installed.</description> + </metadata> + <criteria> + <criterion comment="package screen is installed" + test_ref="test_package_screen_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_screen_installed" version="1" + comment="package screen is installed"> + <linux:object object_ref="obj_package_screen" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_screen" version="1"> + <linux:name>screen</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 2a9fe8b..706cba3 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -16,3 +16,4 @@ psacct rsyslog vlock vsftpd +screen diff --git a/RHEL6/input/fixes/bash/package_screen_installed.sh b/RHEL6/input/fixes/bash/package_screen_installed.sh new file mode 100644 index 0000000..cc566bf --- /dev/null +++ b/RHEL6/input/fixes/bash/package_screen_installed.sh @@ -0,0 +1 @@ +yum -y install screen diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index d63a875..2a7565a 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -67,7 +67,7 @@ <select idref="bootloader_password" selected="true"/> <select idref="require_singleuser_auth" selected="true"/> <select idref="disable_interactive_boot" selected="true"/> -<select idref="install_screen_package" selected="true"/> +<select idref="package_screen_installed" selected="true"/> <select idref="set_system_login_banner" selected="true"/> <!-- CURRENTLY NOT IMPLEMENTED <select idref="set_gui_login_banner" selected="true"/> --> diff --git a/RHEL6/input/profiles/manual_remediation.xml b/RHEL6/input/profiles/manual_remediation.xml index 1767082..b831fa7 100644 --- a/RHEL6/input/profiles/manual_remediation.xml +++ b/RHEL6/input/profiles/manual_remediation.xml @@ -4,7 +4,7 @@ <select idref="package_aide_installed" selected="true"/> <select idref="install_vsftpd" selected="true"/> <select idref="install_openswan" selected="true"/> -<select idref="install_screen_package" selected="true"/> +<select idref="package_screen_installed" selected="true"/> <select idref="bios_disable_usb_boot" selected="true"/> <select idref="bootloader_password" selected="true"/> <select idref="rsyslog_send_messages_to_logserver" selected="true"/> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 4da9a73..e22f16b 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -357,7 +357,7 @@ A console screen locking mechanism is provided in the <tt>screen</tt> package, which is not installed by default. </description> -<Rule id="install_screen_package"> +<Rule id="package_screen_installed"> <title>Install the screen Package</title> <description> To enable console screen locking, install the <tt>screen</tt> package:-- 1.7.1