[PATCH 00/25] RHEL7 content import && RHEL7 CCP profile start

Shawn Wells shawn at redhat.com
Tue Dec 24 01:58:08 UTC 2013


-------------- next part --------------
>From a0ab66c2dae999d56c6ffd881f07de6caebbf075 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 13 Dec 2013 20:50:53 -0500
Subject: [PATCH 00/25] RHEL7 content import && RHEL7 CCP profile start

- Imported RHEL6 content into shared/, linked back to RHEL7 where appropriate
- Started RHEL7 CCP profile
- Updated RPM build with RHEL7 content

Shawn Wells (23):
  Updated RHEL7 idtranslate.pyc
  Added testcheck.py to shared/oval/
  Updated CPE platform tags for system_info_architecture_x86* to include
    RHEL7     - Tested checks on RHEL7
  selinux_state.xml --> shared/     - Updated CPE for RHEL7 (after
    retesting)     - Updated filename -> filepath in OVAL
  Added selinux_policytype to shared/ && RHEL7     - Moved RHEL6
    selinux_policytype to shared/     - Tested on RHEL7, updated CPE
  Adding selinux_state to shared
  Moved ensure_redhat_gpgkey_installed -> shared/     - RHEL7 testing   
     - Updating CPE info
  RHEL6/ensure_gpgcheck_globally_activated.xml --> shared     - Updated
    OVAL name to match XCCDF     - Tested on RHEL7, added CPE     -
    Moved to shared/
  Added ensure_gpgcheck_never_disabled.xml to RHEL7
  Added RHEL7 content into SSG RHEL RPM process
  package_aide_installed --> shared/
  accounts_password_reuse_limit --> shared/
  Migrated no_shelllogin_for_systemaccounts --> shared/
  no_empty_passwords --> shared/
  accounts_password_all_shadowed --> shared/
  accounts_no_uid_except_zero -> shared/
  accounts_password_minlen_login_defs --> shared/ && bugfix to RHEL6 CCP
    profile
  accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile
    update
  accounts_minimum_age_login_defs --> shared/ && RHEL6 CCP profile
    update
  accounts_password_warn_age_login_defs --> shared/ && RHT CCP profile
    update
  accounts_password_pam_cracklib_retry --> shared/
  Adding RHEL7 RHT-CCP profile
  Reset all RHEL7 CCEs     - All RHEL7 XCCDF checks will require new
    CCEs. Temporarily setting to RHEL7-CCE-TBD

shawn (2):
  partition_for_* --> shared/oval/     - Moved partition_for_* checks to
    shared/oval/     - Tested on RHEL7, added platform tag     - Removed
    RHEL7 gconf OVAL (as they're not tested yet)     - Symlinked
    partition_for_* back to appropriate RHEL6 and RHEL7 directories
  RHEL6: selinux_bootloader_notdisabled.xml ->
    enable_selinux_bootloader.xml     - Updated OVAL to match XCCDF name

 Makefile                                           |  13 +-
 RHEL/6/Makefile                                    |   6 +-
 RHEL/6/input/auxiliary/stig_overlay.xml            |   2 +-
 RHEL/6/input/auxiliary/transition_notes.xml        |   2 +-
 .../checks/accounts_minimum_age_login_defs.xml     |  36 +-----
 .../6/input/checks/accounts_no_uid_except_zero.xml |  25 +---
 .../checks/accounts_password_all_shadowed.xml      |  26 +---
 .../checks/accounts_password_minlen_login_defs.xml |  35 +-----
 .../accounts_password_pam_cracklib_retry.xml       |  35 +-----
 .../input/checks/accounts_password_reuse_limit.xml |  33 +----
 .../accounts_password_warn_age_login_defs.xml      |  37 +-----
 RHEL/6/input/checks/enable_selinux_bootloader.xml  |  29 +++++
 .../checks/ensure_gpgcheck_globally_activated.xml  |   1 +
 .../checks/ensure_redhat_gpgkey_installed.xml      |  44 +------
 RHEL/6/input/checks/no_empty_passwords.xml         |  24 +---
 .../checks/no_shelllogin_for_systemaccounts.xml    |  24 +---
 RHEL/6/input/checks/package_aide_installed.xml     |  27 +---
 RHEL/6/input/checks/partition_for_home.xml         |  27 +---
 RHEL/6/input/checks/partition_for_tmp.xml          |  25 +---
 RHEL/6/input/checks/partition_for_var.xml          |  27 +---
 RHEL/6/input/checks/partition_for_var_log.xml      |  24 +---
 .../6/input/checks/partition_for_var_log_audit.xml |  28 +----
 .../checks/selinux_bootloader_notdisabled.xml      |  29 -----
 RHEL/6/input/checks/selinux_policytype.xml         |  37 +-----
 RHEL/6/input/checks/selinux_state.xml              |  36 +-----
 .../checks/yum_gpgcheck_global_activation.xml      |  25 ----
 RHEL/6/input/profiles/CS2.xml                      |   2 +-
 RHEL/6/input/profiles/common.xml                   |   2 +-
 .../6/input/profiles/fisma-medium-rhel6-server.xml |   2 +-
 RHEL/6/input/profiles/rht-ccp.xml                  |   9 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |   2 +-
 .../accounts/restrictions/password_storage.xml     |   2 +-
 RHEL/6/input/system/selinux.xml                    |   2 +-
 RHEL/7/Makefile                                    |   2 +
 .../checks/accounts_minimum_age_login_defs.xml     |   1 +
 .../7/input/checks/accounts_no_uid_except_zero.xml |   1 +
 .../checks/accounts_password_all_shadowed.xml      |   1 +
 .../checks/accounts_password_minlen_login_defs.xml |   1 +
 .../accounts_password_pam_cracklib_retry.xml       |   1 +
 .../input/checks/accounts_password_reuse_limit.xml |   1 +
 .../accounts_password_warn_age_login_defs.xml      |   1 +
 .../checks/ensure_gpgcheck_globally_activated.xml  |   1 +
 .../checks/ensure_gpgcheck_never_disabled.xml      |   1 +
 .../checks/ensure_redhat_gpgkey_installed.xml      |   1 +
 .../input/checks/gconf_gnome_disable_automount.xml |  46 -------
 .../checks/gconf_gnome_disable_thumbnailers.xml    |  32 -----
 ...f_gnome_screensaver_idle_activation_enabled.xml |  30 -----
 .../checks/gconf_gnome_screensaver_idle_delay.xml  |  34 -----
 .../gconf_gnome_screensaver_lock_enabled.xml       |  29 -----
 .../checks/gconf_gnome_screensaver_mode_blank.xml  |  29 -----
 RHEL/7/input/checks/no_empty_passwords.xml         |   1 +
 .../checks/no_shelllogin_for_systemaccounts.xml    |   1 +
 RHEL/7/input/checks/package_aide_installed.xml     |   1 +
 RHEL/7/input/checks/partition_for_home.xml         |  26 +---
 RHEL/7/input/checks/partition_for_tmp.xml          |  24 +---
 RHEL/7/input/checks/partition_for_var.xml          |  26 +---
 RHEL/7/input/checks/partition_for_var_log.xml      |  23 +---
 .../7/input/checks/partition_for_var_log_audit.xml |  27 +---
 RHEL/7/input/checks/selinux_policytype.xml         |   1 +
 RHEL/7/input/checks/selinux_state.xml              |   1 +
 RHEL/7/input/guide.xslt                            |  84 +++++++++++++
 RHEL/7/input/profiles/rht-ccp.xml                  | 138 +++++++++++++++++++++
 .../input/profiles/stig-rhel6-server-upstream.xml  |   7 --
 .../input/profiles/stig-rhel7-server-upstream.xml  |   7 ++
 RHEL/7/input/services/avahi.xml                    |  12 +-
 RHEL/7/input/services/base.xml                     |  48 +++----
 RHEL/7/input/services/cron.xml                     |   6 +-
 RHEL/7/input/services/dhcp.xml                     |  30 ++---
 RHEL/7/input/services/dns.xml                      |  10 +-
 RHEL/7/input/services/ftp.xml                      |  16 +--
 RHEL/7/input/services/http.xml                     |  50 ++++----
 RHEL/7/input/services/imap.xml                     |  12 +-
 RHEL/7/input/services/ldap.xml                     |   6 +-
 RHEL/7/input/services/mail.xml                     |   8 +-
 RHEL/7/input/services/nfs.xml                      |  32 ++---
 RHEL/7/input/services/ntp.xml                      |   6 +-
 RHEL/7/input/services/obsolete.xml                 |  28 ++---
 RHEL/7/input/services/printing.xml                 |   6 +-
 RHEL/7/input/services/smb.xml                      |   8 +-
 RHEL/7/input/services/snmp.xml                     |   8 +-
 RHEL/7/input/services/squid.xml                    |   4 +-
 RHEL/7/input/services/ssh.xml                      |  28 ++---
 RHEL/7/input/services/xorg.xml                     |   4 +-
 RHEL/7/input/system/accounts/banners.xml           |   8 +-
 RHEL/7/input/system/accounts/pam.xml               |  30 ++---
 RHEL/7/input/system/accounts/physical.xml          |  26 ++--
 .../accounts/restrictions/account_expiration.xml   |   6 +-
 .../accounts/restrictions/password_expiration.xml  |   8 +-
 .../accounts/restrictions/password_storage.xml     |   8 +-
 .../system/accounts/restrictions/root_logins.xml   |  14 +--
 RHEL/7/input/system/accounts/session.xml           |  16 +--
 RHEL/7/input/system/auditing.xml                   |  82 ++++++------
 RHEL/7/input/system/logging.xml                    |  26 ++--
 RHEL/7/input/system/network/ipsec.xml              |   2 +-
 RHEL/7/input/system/network/iptables.xml           |  10 +-
 RHEL/7/input/system/network/ipv6.xml               |  16 +--
 RHEL/7/input/system/network/kernel.xml             |  30 ++---
 RHEL/7/input/system/network/network.xml            |   4 +-
 RHEL/7/input/system/network/uncommon.xml           |   8 +-
 RHEL/7/input/system/network/wireless.xml           |   8 +-
 RHEL/7/input/system/permissions/execution.xml      |  16 +--
 RHEL/7/input/system/permissions/files.xml          |  46 +++----
 RHEL/7/input/system/permissions/mounting.xml       |  28 ++---
 RHEL/7/input/system/permissions/partitions.xml     |  22 ++--
 RHEL/7/input/system/selinux.xml                    |  12 +-
 RHEL/7/input/system/software/disk_partitioning.xml |  12 +-
 RHEL/7/input/system/software/integrity.xml         |  16 +--
 RHEL/7/input/system/software/updating.xml          |   8 +-
 RHEL/7/transforms/idtranslate.pyc                  | Bin 5314 -> 5149 bytes
 scap-security-guide.spec                           |  42 +++++--
 shared/oval/.gitignore                             |   1 +
 shared/oval/accounts_minimum_age_login_defs.xml    |  36 ++++++
 shared/oval/accounts_no_uid_except_zero.xml        |  24 ++++
 shared/oval/accounts_password_all_shadowed.xml     |  26 ++++
 .../oval/accounts_password_minlen_login_defs.xml   |  35 ++++++
 .../oval/accounts_password_pam_cracklib_retry.xml  |  35 ++++++
 shared/oval/accounts_password_reuse_limit.xml      |  33 +++++
 .../oval/accounts_password_warn_age_login_defs.xml |  37 ++++++
 shared/oval/ensure_gpgcheck_globally_activated.xml |  27 ++++
 shared/oval/ensure_gpgcheck_never_disabled.xml     |   2 +
 shared/oval/ensure_redhat_gpgkey_installed.xml     |  47 +++++++
 shared/oval/idtranslate.py                         | 138 +++++++++++++++++++++
 shared/oval/idtranslate.pyc                        | Bin 0 -> 5083 bytes
 shared/oval/no_empty_passwords.xml                 |  24 ++++
 shared/oval/no_shelllogin_for_systemaccounts.xml   |  24 ++++
 shared/oval/package_aide_installed.xml             |  27 ++++
 shared/oval/partition_for_home.xml                 |  28 +++++
 shared/oval/partition_for_tmp.xml                  |  26 ++++
 shared/oval/partition_for_var.xml                  |  27 ++++
 shared/oval/partition_for_var_log.xml              |  25 ++++
 shared/oval/partition_for_var_log_audit.xml        |  29 +++++
 shared/oval/selinux_policytype.xml                 |  38 ++++++
 shared/oval/selinux_state.xml                      |  35 ++++++
 shared/oval/system_info_architecture_x86.xml       |   1 +
 shared/oval/system_info_architecture_x86_64.xml    |   1 +
 shared/oval/testcheck.py                           | 124 ++++++++++++++++++
 136 files changed, 1599 insertions(+), 1334 deletions(-)
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_minimum_age_login_defs.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_no_uid_except_zero.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_all_shadowed.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_minlen_login_defs.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_retry.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_reuse_limit.xml
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_warn_age_login_defs.xml
 create mode 100644 RHEL/6/input/checks/enable_selinux_bootloader.xml
 create mode 120000 RHEL/6/input/checks/ensure_gpgcheck_globally_activated.xml
 mode change 100644 => 120000 RHEL/6/input/checks/ensure_redhat_gpgkey_installed.xml
 mode change 100644 => 120000 RHEL/6/input/checks/no_empty_passwords.xml
 mode change 100644 => 120000 RHEL/6/input/checks/no_shelllogin_for_systemaccounts.xml
 mode change 100644 => 120000 RHEL/6/input/checks/package_aide_installed.xml
 mode change 100644 => 120000 RHEL/6/input/checks/partition_for_home.xml
 mode change 100644 => 120000 RHEL/6/input/checks/partition_for_tmp.xml
 mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var.xml
 mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log.xml
 mode change 100644 => 120000 RHEL/6/input/checks/partition_for_var_log_audit.xml
 delete mode 100644 RHEL/6/input/checks/selinux_bootloader_notdisabled.xml
 mode change 100644 => 120000 RHEL/6/input/checks/selinux_policytype.xml
 mode change 100644 => 120000 RHEL/6/input/checks/selinux_state.xml
 delete mode 100644 RHEL/6/input/checks/yum_gpgcheck_global_activation.xml
 create mode 120000 RHEL/7/input/checks/accounts_minimum_age_login_defs.xml
 create mode 120000 RHEL/7/input/checks/accounts_no_uid_except_zero.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_all_shadowed.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_minlen_login_defs.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_retry.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_reuse_limit.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_warn_age_login_defs.xml
 create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_globally_activated.xml
 create mode 120000 RHEL/7/input/checks/ensure_gpgcheck_never_disabled.xml
 create mode 120000 RHEL/7/input/checks/ensure_redhat_gpgkey_installed.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_automount.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml
 delete mode 100644 RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml
 create mode 120000 RHEL/7/input/checks/no_empty_passwords.xml
 create mode 120000 RHEL/7/input/checks/no_shelllogin_for_systemaccounts.xml
 create mode 120000 RHEL/7/input/checks/package_aide_installed.xml
 mode change 100644 => 120000 RHEL/7/input/checks/partition_for_home.xml
 mode change 100644 => 120000 RHEL/7/input/checks/partition_for_tmp.xml
 mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var.xml
 mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log.xml
 mode change 100644 => 120000 RHEL/7/input/checks/partition_for_var_log_audit.xml
 create mode 120000 RHEL/7/input/checks/selinux_policytype.xml
 create mode 120000 RHEL/7/input/checks/selinux_state.xml
 create mode 100644 RHEL/7/input/profiles/rht-ccp.xml
 delete mode 100644 RHEL/7/input/profiles/stig-rhel6-server-upstream.xml
 create mode 100644 RHEL/7/input/profiles/stig-rhel7-server-upstream.xml
 create mode 100644 shared/oval/.gitignore
 create mode 100644 shared/oval/accounts_minimum_age_login_defs.xml
 create mode 100644 shared/oval/accounts_no_uid_except_zero.xml
 create mode 100644 shared/oval/accounts_password_all_shadowed.xml
 create mode 100644 shared/oval/accounts_password_minlen_login_defs.xml
 create mode 100644 shared/oval/accounts_password_pam_cracklib_retry.xml
 create mode 100644 shared/oval/accounts_password_reuse_limit.xml
 create mode 100644 shared/oval/accounts_password_warn_age_login_defs.xml
 create mode 100644 shared/oval/ensure_gpgcheck_globally_activated.xml
 create mode 100644 shared/oval/ensure_redhat_gpgkey_installed.xml
 create mode 100755 shared/oval/idtranslate.py
 create mode 100644 shared/oval/idtranslate.pyc
 create mode 100644 shared/oval/no_empty_passwords.xml
 create mode 100644 shared/oval/no_shelllogin_for_systemaccounts.xml
 create mode 100644 shared/oval/package_aide_installed.xml
 create mode 100644 shared/oval/partition_for_home.xml
 create mode 100644 shared/oval/partition_for_tmp.xml
 create mode 100644 shared/oval/partition_for_var.xml
 create mode 100644 shared/oval/partition_for_var_log.xml
 create mode 100644 shared/oval/partition_for_var_log_audit.xml
 create mode 100644 shared/oval/selinux_policytype.xml
 create mode 100644 shared/oval/selinux_state.xml
 create mode 100755 shared/oval/testcheck.py

-- 
1.8.3.1



More information about the scap-security-guide mailing list