[PATCH 00/25] RHEL7 content import && RHEL7 CCP profile start
Shawn Wells
shawn at redhat.com
Sat Dec 14 01:57:23 UTC 2013
-------------- next part --------------
>From a0ab66c2dae999d56c6ffd881f07de6caebbf075 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 13 Dec 2013 20:50:53 -0500
Subject: [PATCH 00/25] RHEL7 content import && RHEL7 CCP profile start
- Imported RHEL6 content into shared/, linked back to RHEL7 where appropriate
- Started RHEL7 CCP profile
- Updated RPM build with RHEL7 content
Shawn Wells (23):
Updated RHEL7 idtranslate.pyc
Added testcheck.py to shared/oval/
Updated CPE platform tags for system_info_architecture_x86* to include
RHEL7 - Tested checks on RHEL7
selinux_state.xml --> shared/ - Updated CPE for RHEL7 (after
retesting) - Updated filename -> filepath in OVAL
Added selinux_policytype to shared/ && RHEL7 - Moved RHEL6
selinux_policytype to shared/ - Tested on RHEL7, updated CPE
Adding selinux_state to shared
Moved ensure_redhat_gpgkey_installed -> shared/ - RHEL7 testing
- Updating CPE info
RHEL6/ensure_gpgcheck_globally_activated.xml --> shared - Updated
OVAL name to match XCCDF - Tested on RHEL7, added CPE -
Moved to shared/
Added ensure_gpgcheck_never_disabled.xml to RHEL7
Added RHEL7 content into SSG RHEL RPM process
package_aide_installed --> shared/
accounts_password_reuse_limit --> shared/
Migrated no_shelllogin_for_systemaccounts --> shared/
no_empty_passwords --> shared/
accounts_password_all_shadowed --> shared/
accounts_no_uid_except_zero -> shared/
accounts_password_minlen_login_defs --> shared/ && bugfix to RHEL6 CCP
profile
accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile
update
accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile
update
accounts_password_warn_age_login_defs --> shared/ && RHT CCP profile
update
accounts_password_pam_cracklib_retry --> shared/
Adding RHEL7 RHT-CCP profile
Reset all RHEL7 CCEs - All RHEL7 XCCDF checks will require new
CCEs. Temporarily setting to RHEL7-CCE-TBD
shawn (2):
partition_for_* --> shared/oval/ - Moved partition_for_* checks to
shared/oval/ - Tested on RHEL7, added platform tag - Removed
RHEL7 gconf OVAL (as they're not tested yet) - Symlinked
partition_for_* back to appropriate RHEL6 and RHEL7 directories
RHEL6: selinux_bootloader_notdisabled.xml ->
enable_selinux_bootloader.xml - Updated OVAL to match XCCDF name
Makefile | 13 +-
RHEL/6/Makefile | 6 +-
RHEL/6/input/auxiliary/stig_overlay.xml | 2 +-
RHEL/6/input/auxiliary/transition_notes.xml | 2 +-
.../checks/accounts_minimum_age_login_defs.xml | 36 +-----
.../6/input/checks/accounts_no_uid_except_zero.xml | 25 +---
.../checks/accounts_password_all_shadowed.xml | 26 +---
.../checks/accounts_password_minlen_login_defs.xml | 35 +-----
.../accounts_password_pam_cracklib_retry.xml | 35 +-----
.../input/checks/accounts_password_reuse_limit.xml | 33 +----
.../accounts_password_warn_age_login_defs.xml | 37 +-----
RHEL/6/input/checks/enable_selinux_bootloader.xml | 29 +++++
.../checks/ensure_gpgcheck_globally_activated.xml | 1 +
.../checks/ensure_redhat_gpgkey_installed.xml | 44 +------
RHEL/6/input/checks/no_empty_passwords.xml | 24 +---
.../checks/no_shelllogin_for_systemaccounts.xml | 24 +---
RHEL/6/input/checks/package_aide_installed.xml | 27 +---
RHEL/6/input/checks/partition_for_home.xml | 27 +---
RHEL/6/input/checks/partition_for_tmp.xml | 25 +---
RHEL/6/input/checks/partition_for_var.xml | 27 +---
RHEL/6/input/checks/partition_for_var_log.xml | 24 +---
.../6/input/checks/partition_for_var_log_audit.xml | 28 +----
.../checks/selinux_bootloader_notdisabled.xml | 29 -----
RHEL/6/input/checks/selinux_policytype.xml | 37 +-----
RHEL/6/input/checks/selinux_state.xml | 36 +-----
.../checks/yum_gpgcheck_global_activation.xml | 25 ----
RHEL/6/input/profiles/CS2.xml | 2 +-
RHEL/6/input/profiles/common.xml | 2 +-
.../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL/6/input/profiles/rht-ccp.xml | 9 +-
RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
.../accounts/restrictions/password_storage.xml | 2 +-
RHEL/6/input/system/selinux.xml | 2 +-
RHEL/7/Makefile | 2 +
.../checks/accounts_minimum_age_login_defs.xml | 1 +
.../7/input/checks/accounts_no_uid_except_zero.xml | 1 +
.../checks/accounts_password_all_shadowed.xml | 1 +
.../checks/accounts_password_minlen_login_defs.xml | 1 +
.../accounts_password_pam_cracklib_retry.xml | 1 +
.../input/checks/accounts_password_reuse_limit.xml | 1 +
.../accounts_password_warn_age_login_defs.xml | 1 +
.../checks/ensure_gpgcheck_globally_activated.xml | 1 +
.../checks/ensure_gpgcheck_never_disabled.xml | 1 +
.../checks/ensure_redhat_gpgkey_installed.xml | 1 +
.../input/checks/gconf_gnome_disable_automount.xml | 46 -------
.../checks/gconf_gnome_disable_thumbnailers.xml | 32 -----
...f_gnome_screensaver_idle_activation_enabled.xml | 30 -----
.../checks/gconf_gnome_screensaver_idle_delay.xml | 34 -----
.../gconf_gnome_screensaver_lock_enabled.xml | 29 -----
.../checks/gconf_gnome_screensaver_mode_blank.xml | 29 -----
RHEL/7/input/checks/no_empty_passwords.xml | 1 +
.../checks/no_shelllogin_for_systemaccounts.xml | 1 +
RHEL/7/input/checks/package_aide_installed.xml | 1 +
RHEL/7/input/checks/partition_for_home.xml | 26 +---
RHEL/7/input/checks/partition_for_tmp.xml | 24 +---
RHEL/7/input/checks/partition_for_var.xml | 26 +---
RHEL/7/input/checks/partition_for_var_log.xml | 23 +---
.../7/input/checks/partition_for_var_log_audit.xml | 27 +---
RHEL/7/input/checks/selinux_policytype.xml | 1 +
RHEL/7/input/checks/selinux_state.xml | 1 +
RHEL/7/input/guide.xslt | 84 +++++++++++++
RHEL/7/input/profiles/rht-ccp.xml | 138 +++++++++++++++++++++
.../input/profiles/stig-rhel6-server-upstream.xml | 7 --
.../input/profiles/stig-rhel7-server-upstream.xml | 7 ++
RHEL/7/input/services/avahi.xml | 12 +-
RHEL/7/input/services/base.xml | 48 +++----
RHEL/7/input/services/cron.xml | 6 +-
RHEL/7/input/services/dhcp.xml | 30 ++---
RHEL/7/input/services/dns.xml | 10 +-
RHEL/7/input/services/ftp.xml | 16 +--
RHEL/7/input/services/http.xml | 50 ++++----
RHEL/7/input/services/imap.xml | 12 +-
RHEL/7/input/services/ldap.xml | 6 +-
RHEL/7/input/services/mail.xml | 8 +-
RHEL/7/input/services/nfs.xml | 32 ++---
RHEL/7/input/services/ntp.xml | 6 +-
RHEL/7/input/services/obsolete.xml | 28 ++---
RHEL/7/input/services/printing.xml | 6 +-
RHEL/7/input/services/smb.xml | 8 +-
RHEL/7/input/services/snmp.xml | 8 +-
RHEL/7/input/services/squid.xml | 4 +-
RHEL/7/input/services/ssh.xml | 28 ++---
RHEL/7/input/services/xorg.xml | 4 +-
RHEL/7/input/system/accounts/banners.xml | 8 +-
RHEL/7/input/system/accounts/pam.xml | 30 ++---
RHEL/7/input/system/accounts/physical.xml | 26 ++--
.../accounts/restrictions/account_expiration.xml | 6 +-
.../accounts/restrictions/password_expiration.xml | 8 +-
.../accounts/restrictions/password_storage.xml | 8 +-
.../system/accounts/restrictions/root_logins.xml | 14 +--
RHEL/7/input/system/accounts/session.xml | 16 +--
RHEL/7/input/system/auditing.xml | 82 ++++++------
RHEL/7/input/system/logging.xml | 26 ++--
RHEL/7/input/system/network/ipsec.xml | 2 +-
RHEL/7/input/system/network/iptables.xml | 10 +-
RHEL/7/input/system/network/ipv6.xml | 16 +--
RHEL/7/input/system/network/kernel.xml | 30 ++---
RHEL/7/input/system/network/network.xml | 4 +-
RHEL/7/input/system/network/uncommon.xml | 8 +-
RHEL/7/input/system/network/wireless.xml | 8 +-
RHEL/7/input/system/permissions/execution.xml | 16 +--
RHEL/7/input/system/permissions/files.xml | 46 +++----
RHEL/7/input/system/permissions/mounting.xml | 28 ++---
RHEL/7/input/system/permissions/partitions.xml | 22 ++--
RHEL/7/input/system/selinux.xml | 12 +-
RHEL/7/input/system/software/disk_partitioning.xml | 12 +-
RHEL/7/input/system/software/integrity.xml | 16 +--
RHEL/7/input/system/software/updating.xml | 8 +-
RHEL/7/transforms/idtranslate.pyc | Bin 5314 -> 5149 bytes
scap-security-guide.spec | 42 +++++--
shared/oval/.gitignore | 1 +
shared/oval/accounts_minimum_age_login_defs.xml | 36 ++++++
shared/oval/accounts_no_uid_except_zero.xml | 24 ++++
shared/oval/accounts_password_all_shadowed.xml | 26 ++++
.../oval/accounts_password_minlen_login_defs.xml | 35 ++++++
.../oval/accounts_password_pam_cracklib_retry.xml | 35 ++++++
shared/oval/accounts_password_reuse_limit.xml | 33 +++++
.../oval/accounts_password_warn_age_login_defs.xml | 37 ++++++
shared/oval/ensure_gpgcheck_globally_activated.xml | 27 ++++
shared/oval/ensure_gpgcheck_never_disabled.xml | 2 +
shared/oval/ensure_redhat_gpgkey_installed.xml | 47 +++++++
shared/oval/idtranslate.py | 138 +++++++++++++++++++++
shared/oval/idtranslate.pyc | Bin 0 -> 5083 bytes
shared/oval/no_empty_passwords.xml | 24 ++++
shared/oval/no_shelllogin_for_systemaccounts.xml | 24 ++++
shared/oval/package_aide_installed.xml | 27 ++++
shared/oval/partition_for_home.xml | 28 +++++
shared/oval/partition_for_tmp.xml | 26 ++++
shared/oval/partition_for_var.xml | 27 ++++
shared/oval/partition_for_var_log.xml | 25 ++++
shared/oval/partition_for_var_log_audit.xml | 29 +++++
shared/oval/selinux_policytype.xml | 38 ++++++
shared/oval/selinux_state.xml | 35 ++++++
shared/oval/system_info_architecture_x86.xml | 1 +
shared/oval/system_info_architecture_x86_64.xml | 1 +
shared/oval/testcheck.py | 124 ++++++++++++++++++
136 files changed, 1599 insertions(+), 1334 deletions(-)
mode change 100644 => 120000 RHEL/6/input/checks/accounts_minimum_age_login_defs.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_no_uid_except_zero.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_all_shadowed.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_minlen_login_defs.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_retry.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_reuse_limit.xml
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_warn_age_login_defs.xml
create mode 100644 RHEL/6/input/checks/enable_selinux_bootloader.xml
create mode 120000 RHEL/6/input/checks/ensure_gpgcheck_globally_activated.xml
mode change 100644 => 120000 RHEL/6/input/checks/ensure_redhat_gpgkey_installed.xml
mode change 100644 => 120000 RHEL/6/input/checks/no_empty_passwords.xml
mode change 100644 => 120000 RHEL/6/input/checks/no_shelllogin_for_systemaccounts.xml
mode change 100644 => 120000 RHEL/6/input/checks/package_aide_installed.xml
mode change 100644 => 120000 RHEL/6/input/checks/partition_for_home.xml
mode change 100644 => 120000 RHEL/6/input/checks/partition_for_tmp.xml
mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var.xml
mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log.xml
mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log_audit.xml
delete mode 100644 RHEL/6/input/checks/selinux_bootloader_notdisabled.xml
mode change 100644 => 120000 RHEL/6/input/checks/selinux_policytype.xml
mode change 100644 => 120000 RHEL/6/input/checks/selinux_state.xml
delete mode 100644 RHEL/6/input/checks/yum_gpgcheck_global_activation.xml
create mode 120000 RHEL/7/input/checks/accounts_minimum_age_login_defs.xml
create mode 120000 RHEL/7/input/checks/accounts_no_uid_except_zero.xml
create mode 120000 RHEL/7/input/checks/accounts_password_all_shadowed.xml
create mode 120000 RHEL/7/input/checks/accounts_password_minlen_login_defs.xml
create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_retry.xml
create mode 120000 RHEL/7/input/checks/accounts_password_reuse_limit.xml
create mode 120000 RHEL/7/input/checks/accounts_password_warn_age_login_defs.xml
create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_globally_activated.xml
create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_never_disabled.xml
create mode 120000 RHEL/7/input/checks/ensure_redhat_gpgkey_installed.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_automount.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml
delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml
create mode 120000 RHEL/7/input/checks/no_empty_passwords.xml
create mode 120000 RHEL/7/input/checks/no_shelllogin_for_systemaccounts.xml
create mode 120000 RHEL/7/input/checks/package_aide_installed.xml
mode change 100644 => 120000 RHEL/7/input/checks/partition_for_home.xml
mode change 100644 => 120000 RHEL/7/input/checks/partition_for_tmp.xml
mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var.xml
mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log.xml
mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log_audit.xml
create mode 120000 RHEL/7/input/checks/selinux_policytype.xml
create mode 120000 RHEL/7/input/checks/selinux_state.xml
create mode 100644 RHEL/7/input/profiles/rht-ccp.xml
delete mode 100644 RHEL/7/input/profiles/stig-rhel6-server-upstream.xml
create mode 100644 RHEL/7/input/profiles/stig-rhel7-server-upstream.xml
create mode 100644 shared/oval/.gitignore
create mode 100644 shared/oval/accounts_minimum_age_login_defs.xml
create mode 100644 shared/oval/accounts_no_uid_except_zero.xml
create mode 100644 shared/oval/accounts_password_all_shadowed.xml
create mode 100644 shared/oval/accounts_password_minlen_login_defs.xml
create mode 100644 shared/oval/accounts_password_pam_cracklib_retry.xml
create mode 100644 shared/oval/accounts_password_reuse_limit.xml
create mode 100644 shared/oval/accounts_password_warn_age_login_defs.xml
create mode 100644 shared/oval/ensure_gpgcheck_globally_activated.xml
create mode 100644 shared/oval/ensure_redhat_gpgkey_installed.xml
create mode 100755 shared/oval/idtranslate.py
create mode 100644 shared/oval/idtranslate.pyc
create mode 100644 shared/oval/no_empty_passwords.xml
create mode 100644 shared/oval/no_shelllogin_for_systemaccounts.xml
create mode 100644 shared/oval/package_aide_installed.xml
create mode 100644 shared/oval/partition_for_home.xml
create mode 100644 shared/oval/partition_for_tmp.xml
create mode 100644 shared/oval/partition_for_var.xml
create mode 100644 shared/oval/partition_for_var_log.xml
create mode 100644 shared/oval/partition_for_var_log_audit.xml
create mode 100644 shared/oval/selinux_policytype.xml
create mode 100644 shared/oval/selinux_state.xml
create mode 100755 shared/oval/testcheck.py
--
1.8.3.1
More information about the scap-security-guide
mailing list