[PATCH 0/8] Various OVAL cleanups

Shawn Wells shawn.d.wells at gmail.com
Sun Jul 7 05:35:06 UTC 2013


-------------- next part --------------
>From ec96f1ed2864c2e5f6b529e7b41325036e7fb7db Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 01:33:18 -0400
Subject: [PATCH 0/8] Various OVAL cleanups

- Removed unreferenced OVAL checks
- Added OVAL for sysctl_* (through templates)
- Updated selinux_all_devicefiles_labeled

Shawn Wells (8):
  Created OVAL + remediation for
    sysctl_net_ipv6_conf_default_accept_redirects     Created using
    templates
  Added OVAL + remediation for sysctl_net_ipv6_conf_default_accept_ra  
       Generated from templates
  Corrected naming of set_sysctl_ipv6_default_accept_redirects     
    Updated naming of XCCDF rule
    "set_sysctl_ipv6_default_accept_redirects" to
    "set_sysctl_net_ipv6_default_accept_redirects"
  Added OVAL mapping to world_writeable_files     Mapped OVAL
    file_permissions_unauthorized_world_writable to XCCDF
    world_writeable_files
  Updated selinux_all_devicefiles_labeled     The check enumeration of
    'none exist' was depricated for 'none satisfy' as of OVAL 5.3,
    reference:      
    http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/oval-common-schema.html#CheckEnumeration
  Removing unreferenced file_ssh_host_keys_private_permissions.xml     
    Removing unreferenced file_ssh_host_keys_private_permissions.xml
  Removing unreferenced OVAL file_ssh_host_keys_public_permissions.xml
  Removed unreferenced OVAL rsyslog_files_exist_permissions.xml     
    This appears to have been replaced by rsyslog_files_ownership

 .../file_ssh_host_keys_private_permissions.xml     |   45 --------------------
 .../file_ssh_host_keys_public_permissions.xml      |   45 --------------------
 .../checks/rsyslog_files_exist_permissions.xml     |   21 ---------
 .../checks/selinux_all_devicefiles_labeled.xml     |    2 +-
 .../sysctl_net_ipv6_conf_default_accept_ra.xml     |   15 +++----
 ...sctl_net_ipv6_conf_default_accept_redirects.xml |    3 +-
 RHEL6/input/checks/templates/sysctl_values.csv     |    2 +
 .../set_sysctl_net_ipv6_conf_default_accept_ra.sh  |   16 +++++++
 ...ysctl_net_ipv6_conf_default_accept_redirects.sh |   16 +++++++
 RHEL6/input/profiles/common.xml                    |    2 +-
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    2 +-
 RHEL6/input/system/network/ipv6.xml                |    2 +-
 RHEL6/input/system/permissions/files.xml           |    1 +
 15 files changed, 48 insertions(+), 128 deletions(-)
 delete mode 100644 RHEL6/input/checks/file_ssh_host_keys_private_permissions.xml
 delete mode 100644 RHEL6/input/checks/file_ssh_host_keys_public_permissions.xml
 delete mode 100644 RHEL6/input/checks/rsyslog_files_exist_permissions.xml
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh



More information about the scap-security-guide mailing list