On 9/13/13 1:35 AM, Jan Lieskovsky wrote:
0005-Add-Installing-and-Maintaining-Software-and-Updating.patch
From e0675a9045306f8bb35268e2fdddde52de00d62d Mon Sep 17 00:00:00 2001 From: Jan Lieskovskyjlieskov@redhat.com Date: Thu, 12 Sep 2013 17:23:20 +0200 Subject: [PATCH 5/8] Add 'Installing and Maintaining Software' and 'Updating Software' XML files.
Signed-off-by: Jan Lieskovskyjlieskov@redhat.com
FEDORA/input/system/software/software.xml | 8 ++++ FEDORA/input/system/software/updating.xml | 72 +++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 FEDORA/input/system/software/software.xml create mode 100644 FEDORA/input/system/software/updating.xml
diff --git a/FEDORA/input/system/software/software.xml b/FEDORA/input/system/software/software.xml new file mode 100644 index 0000000..97558fb --- /dev/null +++ b/FEDORA/input/system/software/software.xml @@ -0,0 +1,8 @@ +<Group id="software"> +<title>Installing and Maintaining Software</title> +<description>The following sections contain information on +security-relevant choices during the initial operating system +installation process and the setup of software +updates.</description>
+</Group> diff --git a/FEDORA/input/system/software/updating.xml b/FEDORA/input/system/software/updating.xml new file mode 100644 index 0000000..0ad4b79 --- /dev/null +++ b/FEDORA/input/system/software/updating.xml @@ -0,0 +1,72 @@ +<Group id="updating"> +<title>Updating Software</title> +<description>The <tt>yum</tt> command line tool is used to install and +update software packages. The system also provides a graphical +software update tool in the <b>System</b> menu, in the <b>Administration</b> submenu, +called <b>Software Update</b>. +<br /><br /> +Fedora systems contain an installed software catalog called +the RPM database, which records metadata of installed packages. Tools such as +<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM +packages for software installation. This allows for insight into the current +inventory of installed software on the system, and is highly recommended. +</description>
+<!-- REMINDER: Before telling people to update their systems
via the security_patches_up_to_date rule, we must
ensure they have configured an update source! -->
+<Rule id="ensure_gpgcheck_globally_activated" severity="high"> +<title>Ensure gpgcheck Enabled In Main Yum Configuration</title> +<description>The <tt>gpgcheck</tt> option should be used to ensure +checking of an RPM package's signature always occurs prior to its +installation. To configure yum to check package signatures before installing +them, ensure the following line appears in <tt>/etc/yum.conf</tt> in +the <tt>[main]</tt> section: +<pre>gpgcheck=1</pre> +</description> +<ocil clause="GPG checking is not enabled"> +To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>, +inspect <tt>/etc/yum.conf</tt> and ensure the following appears in the +<tt>[main]</tt> section: +<pre>gpgcheck=1</pre> +A value of <tt>1</tt> indicates that <tt>gpgcheck</tt> is enabled. Absence of a +<tt>gpgcheck</tt> line or a setting of <tt>0</tt> indicates that it is +disabled. +</ocil> +<rationale> +Ensuring the validity of packages' cryptographic signatures prior to +installation ensures the provenance of the software and +protects against malicious tampering. +</rationale> +<ident cce="26709-6" />
These CCE's are operating system specific. We'll need to work with Steve Grubb (+Jeff and NIST?) to get new ones assigned for Fedora. For the time being, we should strip off CCE values for the Fedora content.
+<oval id="yum_gpgcheck_global_activation" /> +<ref nist="SI-7,MA-1(b)" disa="352,663" /> +<tested by="MM" on="20120928"/>
^^ test attestation as mentioned by Dave
+</Rule>
+<Rule id="ensure_gpgcheck_never_disabled" severity="high"> +<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title> +<description>To ensure signature checking is not disabled for +any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form: +<pre>gpgcheck=0</pre> +</description> +<ocil clause="GPG checking is disabled"> +To determine whether <tt>yum</tt> has been configured to disable +<tt>gpgcheck</tt> for any repos, inspect all files in +<tt>/etc/yum.repos.d</tt> and ensure the following does not appear in any +sections: +<pre>gpgcheck=0</pre> +A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for that repo. +</ocil> +<rationale> +Ensuring all packages' cryptographic signatures are valid prior to +installation ensures the provenance of the software and +protects against malicious tampering. +</rationale> +<ident cce="26647-8" />
^^ CCE
+<oval id="ensure_gpgcheck_never_disabled" /> +<ref nist="SI-7,MA-1(b)" disa="352,663"/> +<tested by="MM" on="20120928"/>
^^ test attestation
+</Rule>
+</Group> -- 1.7.11.7
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org