On 3/29/13 8:28 PM, Shawn Wells wrote:
0003-Updated-package_screen_installed.patch
From c6170e4caad86c8ad4b2146b0098e8fef8c0f131 Mon Sep 17 00:00:00 2001
From: Shawn Wells<shawn(a)redhat.com>
Date: Fri, 29 Mar 2013 16:15:52 -0400
Subject: [PATCH 03/21] Updated package_screen_installed
- Changed XCCDF rule to match naming scheme of package_PACKAGE_installed
- Updated associated profiles
- Added screen to templates file, generating OVAL + BASH
---
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
RHEL6/input/checks/package_screen_installed.xml | 25 ++++++++++++++++++++
.../input/checks/templates/packages_installed.csv | 1 +
RHEL6/input/fixes/bash/package_screen_installed.sh | 1 +
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/manual_remediation.xml | 2 +-
RHEL6/input/system/accounts/physical.xml | 2 +-
7 files changed, 31 insertions(+), 4 deletions(-)
create mode 100644 RHEL6/input/checks/package_screen_installed.xml
create mode 100644 RHEL6/input/fixes/bash/package_screen_installed.sh
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml
b/RHEL6/input/auxiliary/alt-titles-stig.xml
index ca3f9ac..d4a9cf0 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -242,7 +242,7 @@ The graphical desktop environment must have automatic lock enabled.
<title rule="set_blank_screensaver" shorttitle="Implement Blank
Screen Saver">
The system must display a publicly-viewable pattern during a graphical desktop
environment session lock.
</title>
-<title rule="install_screen_package" shorttitle="Install the screen
Package">
+<title rule="package_screen_installed" shorttitle="Install the screen
Package">
The system must allow locking of the console screen.
</title>
<title rule="set_system_login_banner" shorttitle="Modify the System
Login Banner">
diff --git a/RHEL6/input/checks/package_screen_installed.xml
b/RHEL6/input/checks/package_screen_installed.xml
new file mode 100644
index 0000000..3be6486
--- /dev/null
+++ b/RHEL6/input/checks/package_screen_installed.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. -->
+ <definition class="compliance" id="package_screen_installed"
+ version="1">
+ <metadata>
+ <title>Package screen Installed</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The RPM package screen should be
installed.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="package screen is installed"
+ test_ref="test_package_screen_installed" />
+ </criteria>
+ </definition>
+ <linux:rpminfo_test check="all" check_existence="all_exist"
+ id="test_package_screen_installed" version="1"
+ comment="package screen is installed">
+ <linux:object object_ref="obj_package_screen" />
+ </linux:rpminfo_test>
+ <linux:rpminfo_object id="obj_package_screen" version="1">
+ <linux:name>screen</linux:name>
+ </linux:rpminfo_object>
+</def-group>
diff --git a/RHEL6/input/checks/templates/packages_installed.csv
b/RHEL6/input/checks/templates/packages_installed.csv
index 2a9fe8b..706cba3 100644
--- a/RHEL6/input/checks/templates/packages_installed.csv
+++ b/RHEL6/input/checks/templates/packages_installed.csv
@@ -16,3 +16,4 @@ psacct
rsyslog
vlock
vsftpd
+screen
diff --git a/RHEL6/input/fixes/bash/package_screen_installed.sh
b/RHEL6/input/fixes/bash/package_screen_installed.sh
new file mode 100644
index 0000000..cc566bf
--- /dev/null
+++ b/RHEL6/input/fixes/bash/package_screen_installed.sh
@@ -0,0 +1 @@
+yum -y install screen
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index d63a875..2a7565a 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -67,7 +67,7 @@
<select idref="bootloader_password" selected="true"/>
<select idref="require_singleuser_auth" selected="true"/>
<select idref="disable_interactive_boot" selected="true"/>
-<select idref="install_screen_package" selected="true"/>
+<select idref="package_screen_installed" selected="true"/>
<select idref="set_system_login_banner" selected="true"/>
<!-- CURRENTLY NOT IMPLEMENTED <select idref="set_gui_login_banner"
selected="true"/> -->
diff --git a/RHEL6/input/profiles/manual_remediation.xml
b/RHEL6/input/profiles/manual_remediation.xml
index 1767082..b831fa7 100644
--- a/RHEL6/input/profiles/manual_remediation.xml
+++ b/RHEL6/input/profiles/manual_remediation.xml
@@ -4,7 +4,7 @@
<select idref="package_aide_installed" selected="true"/>
<select idref="install_vsftpd" selected="true"/>
<select idref="install_openswan" selected="true"/>
-<select idref="install_screen_package" selected="true"/>
+<select idref="package_screen_installed" selected="true"/>
<select idref="bios_disable_usb_boot" selected="true"/>
<select idref="bootloader_password" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
diff --git a/RHEL6/input/system/accounts/physical.xml
b/RHEL6/input/system/accounts/physical.xml
index 4da9a73..e22f16b 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -357,7 +357,7 @@ A console screen locking mechanism is provided in the
<tt>screen</tt> package, which is not installed by default.
</description>
-<Rule id="install_screen_package">
+<Rule id="package_screen_installed">
<title>Install the screen Package</title>
<description>
To enable console screen locking, install the <tt>screen</tt> package:
-- 1.7.1
Pushed per Jeff's ack
$ git push
Counting objects: 35, done.
Compressing objects: 100% (18/18), done.
Writing objects: 100% (19/19), 2.10 KiB, done.
Total 19 (delta 14), reused 0 (delta 0)
To
ssh://git.fedorahosted.org/git/scap-security-guide.git
01fe249..fe33545 master -> master