[PATCH 0/8] Various OVAL cleanups
Shawn Wells
shawn.d.wells at gmail.com
Sun Jul 7 05:35:06 UTC 2013
-------------- next part --------------
>From ec96f1ed2864c2e5f6b529e7b41325036e7fb7db Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 01:33:18 -0400
Subject: [PATCH 0/8] Various OVAL cleanups
- Removed unreferenced OVAL checks
- Added OVAL for sysctl_* (through templates)
- Updated selinux_all_devicefiles_labeled
Shawn Wells (8):
Created OVAL + remediation for
sysctl_net_ipv6_conf_default_accept_redirects Created using
templates
Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra
Generated from templates
Corrected naming of set_sysctl_ipv6_default_accept_redirects
Updated naming of XCCDF rule
"set_sysctl_ipv6_default_accept_redirects" to
"set_sysctl_net_ipv6_default_accept_redirects"
Added OVAL mapping to world_writeable_files Mapped OVAL
file_permissions_unauthorized_world_writable to XCCDF
world_writeable_files
Updated selinux_all_devicefiles_labeled The check enumeration of
'none exist' was depricated for 'none satisfy' as of OVAL 5.3,
reference:
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/oval-common-schema.html#CheckEnumeration
Removing unreferenced file_ssh_host_keys_private_permissions.xml
Removing unreferenced file_ssh_host_keys_private_permissions.xml
Removing unreferenced OVAL file_ssh_host_keys_public_permissions.xml
Removed unreferenced OVAL rsyslog_files_exist_permissions.xml
This appears to have been replaced by rsyslog_files_ownership
.../file_ssh_host_keys_private_permissions.xml | 45 --------------------
.../file_ssh_host_keys_public_permissions.xml | 45 --------------------
.../checks/rsyslog_files_exist_permissions.xml | 21 ---------
.../checks/selinux_all_devicefiles_labeled.xml | 2 +-
.../sysctl_net_ipv6_conf_default_accept_ra.xml | 15 +++----
...sctl_net_ipv6_conf_default_accept_redirects.xml | 3 +-
RHEL6/input/checks/templates/sysctl_values.csv | 2 +
.../set_sysctl_net_ipv6_conf_default_accept_ra.sh | 16 +++++++
...ysctl_net_ipv6_conf_default_accept_redirects.sh | 16 +++++++
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL6/input/system/network/ipv6.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 1 +
15 files changed, 48 insertions(+), 128 deletions(-)
delete mode 100644 RHEL6/input/checks/file_ssh_host_keys_private_permissions.xml
delete mode 100644 RHEL6/input/checks/file_ssh_host_keys_public_permissions.xml
delete mode 100644 RHEL6/input/checks/rsyslog_files_exist_permissions.xml
create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh
More information about the scap-security-guide
mailing list