[PATCH] deletion of unused OVAL checks

Jeffrey Blank blank at eclipse.ncsc.mil
Fri May 17 02:23:17 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/checks/banner_gui_gdm.xml              |   30 ------
 RHEL6/input/checks/file_permissions_etc_skel.xml   |   54 ----------
 .../checks/file_permissions_samba_password.xml     |   36 -------
 RHEL6/input/checks/package_acpid_removed.xml       |   25 -----
 RHEL6/input/checks/package_rsh_removed.xml         |   25 -----
 RHEL6/input/checks/package_vlock_installed.xml     |   25 -----
 RHEL6/input/checks/package_vlock_removed.xml       |   25 -----
 ...mail_relay_smtp_auth_for_untrusted_networks.xml |  107 --------------------
 RHEL6/input/checks/selinux_enabled.xml             |   20 ----
 RHEL6/input/checks/service_sssd_disabled.xml       |   96 ------------------
 .../sysctl_net_ipv6_conf_all_disable_ipv6.xml      |   29 ------
 .../input/checks/templates/packages_installed.csv  |    1 -
 RHEL6/input/checks/templates/packages_removed.csv  |    3 -
 RHEL6/input/checks/templates/services_disabled.csv |    1 -
 14 files changed, 0 insertions(+), 477 deletions(-)
 delete mode 100644 RHEL6/input/checks/banner_gui_gdm.xml
 delete mode 100644 RHEL6/input/checks/file_permissions_etc_skel.xml
 delete mode 100644 RHEL6/input/checks/file_permissions_samba_password.xml
 delete mode 100644 RHEL6/input/checks/package_acpid_removed.xml
 delete mode 100644 RHEL6/input/checks/package_rsh_removed.xml
 delete mode 100644 RHEL6/input/checks/package_vlock_installed.xml
 delete mode 100644 RHEL6/input/checks/package_vlock_removed.xml
 delete mode 100644 RHEL6/input/checks/postfix_server_mail_relay_smtp_auth_for_untrusted_networks.xml
 delete mode 100644 RHEL6/input/checks/selinux_enabled.xml
 delete mode 100644 RHEL6/input/checks/service_sssd_disabled.xml
 delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml

diff --git a/RHEL6/input/checks/banner_gui_gdm.xml b/RHEL6/input/checks/banner_gui_gdm.xml
deleted file mode 100644
index b5a0be2..0000000
--- a/RHEL6/input/checks/banner_gui_gdm.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="banner_gui_gdm" version="1">
-    <metadata>
-      <title>Create Warning Banners for GUI Login Users</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Enable warning banner for GUI
-      login</description>
-    </metadata>
-    <criteria>
-      <criterion comment="check the value of InfoMsgFile=/etc/issue in /etc/gdm/custom.conf"
-      test_ref="test_20249" />
-    </criteria>
-  </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist"
-  comment="Tests the value of the InfoMsgFile=/etc/issue expression in the /etc/gdm/custom.conf file"
-  id="test_20249" version="1">
-    <ind:object object_ref="obj_20249" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_20249"
-  version="1">
-    <ind:path>/etc/gdm</ind:path>
-    <ind:filename>custom.conf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*InfoMsgFile[\s]*=[\s]*/etc/issue</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL6/input/checks/file_permissions_etc_skel.xml b/RHEL6/input/checks/file_permissions_etc_skel.xml
deleted file mode 100644
index 2500e19..0000000
--- a/RHEL6/input/checks/file_permissions_etc_skel.xml
+++ /dev/null
@@ -1,54 +0,0 @@
-<def-group>
-  <definition class="compliance" id="file_permissions_etc_skel" version="1">
-    <metadata>
-      <title>Verify /etc/skel Permissions</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Checks for correct permissions for all files and directories in /etc/skel.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion test_ref="test_file_permissions_etc_skel_directories" negate="true" />
-      <criterion test_ref="test_file_permissions_etc_skel_files" negate="true" />
-    </criteria>
-  </definition>
-  <unix:file_test check="all" check_existence="at_least_one_exists" comment="/etc/skel directories mode 0755" id="test_file_permissions_etc_skel_directories" version="1">
-    <unix:object object_ref="object_etc_skel_directories" />
-    <unix:state state_ref="state_not_mode_0755" />
-  </unix:file_test>
-  <unix:file_test check="all" check_existence="at_least_one_exists" comment="/etc/skel files mode 0644" id="test_file_permissions_etc_skel_files" version="1">
-    <unix:object object_ref="object_permissions_etc_skel_files" />
-    <unix:state state_ref="state_not_mode_0644" />
-  </unix:file_test>
-  <unix:file_object comment="/etc/skel directories" id="object_etc_skel_directories" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
-    <unix:path operation="equals">/etc/skel</unix:path>
-    <unix:filename xsi:nil="true" />
-    <filter action="include">state_not_mode_0755</filter>
-  </unix:file_object>
-  <unix:file_object comment="/etc/skel files" id="object_permissions_etc_skel_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
-    <unix:path operation="equals">/etc/skel</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_not_mode_0644</filter>
-  </unix:file_object>
-  <unix:file_state id="state_not_mode_0755" version="1" operator="OR">
-    <!-- if any one of these is true then mode is NOT 0755 (hence the OR operator) -->
-    <unix:suid datatype="boolean">true</unix:suid>
-    <unix:sgid datatype="boolean">true</unix:sgid>
-    <unix:sticky datatype="boolean">true</unix:sticky>
-    <unix:gwrite datatype="boolean">true</unix:gwrite>
-    <unix:owrite datatype="boolean">true</unix:owrite>
-  </unix:file_state>
-  <unix:file_state id="state_not_mode_0644" version="1" operator="OR">
-    <!-- if any one of these is true then mode is NOT 0644 (hence the OR operator) -->
-    <unix:suid datatype="boolean">true</unix:suid>
-    <unix:sgid datatype="boolean">true</unix:sgid>
-    <unix:sticky datatype="boolean">true</unix:sticky>
-    <unix:uexec datatype="boolean">true</unix:uexec>
-    <unix:gwrite datatype="boolean">true</unix:gwrite>
-    <unix:gexec datatype="boolean">true</unix:gexec>
-    <unix:owrite datatype="boolean">true</unix:owrite>
-    <unix:oexec datatype="boolean">true</unix:oexec>
-  </unix:file_state>
-</def-group>
diff --git a/RHEL6/input/checks/file_permissions_samba_password.xml b/RHEL6/input/checks/file_permissions_samba_password.xml
deleted file mode 100644
index d954fc5..0000000
--- a/RHEL6/input/checks/file_permissions_samba_password.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-<def-group>
-  <definition class="compliance" id="file_permissions_samba_password" version="1">
-    <metadata>
-      <title>Verify Samba Password File Permissions</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Checks for correct permissions for all files in /var/lib/samba/private.</description>
-    </metadata>
-    <criteria>
-      <criterion test_ref="test_samba_password_files_mode" negate="true" />
-    </criteria>
-  </definition>
-  <unix:file_test check="all" check_existence="all_exist" comment="samba password files uid" id="test_samba_password_files_mode" version="1">
-    <unix:object object_ref="object_permissions_samba_password_files" />
-    <unix:state state_ref="state_samba_password_bad_mode" />
-  </unix:file_test>
-  <unix:file_object comment="all files in /var/lib/samba/private" id="object_permissions_samba_password_files" version="1">
-    <unix:path var_ref="var_permissions_samba_private_directory" />
-    <unix:filename operation="pattern match">.*</unix:filename>
-    <filter action="include">state_samba_password_bad_mode</filter>
-  </unix:file_object>
-  <unix:file_state id="state_samba_password_bad_mode" version="1" operator="OR">
-    <unix:suid datatype="boolean">true</unix:suid>
-    <unix:sgid datatype="boolean">true</unix:sgid>
-    <unix:sticky datatype="boolean">true</unix:sticky>
-    <unix:uexec datatype="boolean">true</unix:uexec>
-    <unix:gread datatype="boolean">true</unix:gread>
-    <unix:gwrite datatype="boolean">true</unix:gwrite>
-    <unix:gexec datatype="boolean">true</unix:gexec>
-    <unix:oread datatype="boolean">true</unix:oread>
-    <unix:owrite datatype="boolean">true</unix:owrite>
-    <unix:oexec datatype="boolean">true</unix:oexec>
-  </unix:file_state>
-  <external_variable comment="path to samba private directory" datatype="string" id="var_permissions_samba_private_directory" version="1" />
-</def-group>
diff --git a/RHEL6/input/checks/package_acpid_removed.xml b/RHEL6/input/checks/package_acpid_removed.xml
deleted file mode 100644
index bde6175..0000000
--- a/RHEL6/input/checks/package_acpid_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_acpid_removed"
-  version="1">
-    <metadata>
-      <title>Package acpid Removed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package acpid should be removed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package acpid is removed"
-      test_ref="test_package_acpid_removed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="none_exist"
-  id="test_package_acpid_removed" version="1"
-  comment="package acpid is removed">
-    <linux:object object_ref="obj_package_acpid_removed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_acpid_removed" version="1">
-    <linux:name>acpid</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_rsh_removed.xml b/RHEL6/input/checks/package_rsh_removed.xml
deleted file mode 100644
index 1ebfb67..0000000
--- a/RHEL6/input/checks/package_rsh_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_rsh_removed"
-  version="1">
-    <metadata>
-      <title>Package rsh Removed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package rsh should be removed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package rsh is removed"
-      test_ref="test_package_rsh_removed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="none_exist"
-  id="test_package_rsh_removed" version="1"
-  comment="package rsh is removed">
-    <linux:object object_ref="obj_package_rsh_removed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_rsh_removed" version="1">
-    <linux:name>rsh</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_vlock_installed.xml b/RHEL6/input/checks/package_vlock_installed.xml
deleted file mode 100644
index fff7a00..0000000
--- a/RHEL6/input/checks/package_vlock_installed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_vlock_installed"
-  version="1">
-    <metadata>
-      <title>Package vlock Installed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package vlock should be installed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package vlock is installed"
-      test_ref="test_package_vlock_installed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="all_exist"
-  id="test_package_vlock_installed" version="1"
-  comment="package vlock is installed">
-    <linux:object object_ref="obj_package_vlock_installed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_vlock_installed" version="1">
-    <linux:name>vlock</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/package_vlock_removed.xml b/RHEL6/input/checks/package_vlock_removed.xml
deleted file mode 100644
index 570efb5..0000000
--- a/RHEL6/input/checks/package_vlock_removed.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="package_vlock_removed"
-  version="1">
-    <metadata>
-      <title>Package vlock Removed</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The RPM package vlock should be removed.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="package vlock is removed"
-      test_ref="test_package_vlock_removed" />
-    </criteria>
-  </definition>
-  <linux:rpminfo_test check="all" check_existence="none_exist"
-  id="test_package_vlock_removed" version="1"
-  comment="package vlock is removed">
-    <linux:object object_ref="obj_package_vlock_removed" />
-  </linux:rpminfo_test>
-  <linux:rpminfo_object id="obj_package_vlock_removed" version="1">
-    <linux:name>vlock</linux:name>
-  </linux:rpminfo_object>
-</def-group>
diff --git a/RHEL6/input/checks/postfix_server_mail_relay_smtp_auth_for_untrusted_networks.xml b/RHEL6/input/checks/postfix_server_mail_relay_smtp_auth_for_untrusted_networks.xml
deleted file mode 100644
index bbfeed6..0000000
--- a/RHEL6/input/checks/postfix_server_mail_relay_smtp_auth_for_untrusted_networks.xml
+++ /dev/null
@@ -1,107 +0,0 @@
-<def-group>
-  <definition class="compliance"
-  id="postfix_server_mail_relay_smtp_auth_for_untrusted_networks" version="1">
-    <metadata>
-      <title>Configure Postfix to Require Authentication for Untrusted Networks</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Ensure untrusted networks are not able to use MTA without authentication.</description>
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="Enable sasl." 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_enable_sasl" />
-      <criterion comment="Permit sasl." 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_permit_sasl" />
-      <criterion comment="Authenticate via sasl." 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_pwcheck" />
-      <criterion comment="Enable saslauthd at runlevel 3" 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel3_saslauthd" />
-      <criterion comment="Enable saslauthd at runlevel 4" 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel4_saslauthd" />
-      <criterion comment="Enable saslauthd at runlevel 5" 
-      test_ref="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel5_saslauthd" />
-    </criteria>
-  </definition>
- 
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for pwcheck set to saslauthd" 
-  id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_enable_sasl" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_enable_sasl" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_enable_sasl"
-  version="1">
-    <ind:subexpression operation="equals">yes</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_enable_sasl" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_sasl_auth_enable[\s]*=[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Require untrusted nets to authenticate for relay" 
-  id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_permit_sasl" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_permit_sasl" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_permit_sasl" version="1">
-    <ind:path>/etc/postfix</ind:path>
-    <ind:filename>main.cf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*smtpd_recipient_restrictions[\s]*=[\n\s]*([\s]+\S*[\n\s])*permit_mynetworks,[\n\s]*permit_sasl_authenticated,*[\n\s]*reject_unauth_destination</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist" 
-  comment="Test for pwcheck set to saslauthd" 
-  id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_pwcheck" version="1">
-    <ind:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_pwcheck" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_pwcheck"
-  version="1">
-    <ind:subexpression operation="equals">saslauthd</ind:subexpression>
-  </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_pwcheck" version="1">
-    <ind:path>/usr/lib/sasl2</ind:path>
-    <ind:filename>smtpd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*pwcheck_method[\s]*:[\s]*(.+)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <unix:runlevel_state comment="configured to start"
-  id="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_service_saslauthd_off" version="1">
-    <unix:start datatype="boolean">true</unix:start>
-    <unix:kill datatype="boolean">false</unix:kill>
-  </unix:runlevel_state>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel3_saslauthd"
-  version="2">
-    <unix:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel3_saslauthd" />
-    <unix:state state_ref="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_service_saslauthd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel4_saslauthd"
-  version="2">
-    <unix:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel4_saslauthd" />
-    <unix:state state_ref="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_service_saslauthd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel5_saslauthd"
-  version="2">
-    <unix:object object_ref="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel5_saslauthd" />
-    <unix:state state_ref="state_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_service_saslauthd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel3_saslauthd" version="1">
-    <unix:service_name>saslauthd</unix:service_name>
-    <unix:runlevel operation="equals">3</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel4_saslauthd" version="1">
-    <unix:service_name>saslauthd</unix:service_name>
-    <unix:runlevel operation="equals">4</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_postfix_server_mail_relay_smtp_auth_for_untrusted_networks_runlevel5_saslauthd" version="1">
-    <unix:service_name>saslauthd</unix:service_name>
-    <unix:runlevel operation="equals">5</unix:runlevel>
-  </unix:runlevel_object>
-
-</def-group>
diff --git a/RHEL6/input/checks/selinux_enabled.xml b/RHEL6/input/checks/selinux_enabled.xml
deleted file mode 100644
index 377f022..0000000
--- a/RHEL6/input/checks/selinux_enabled.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<def-group>
-  <definition class="compliance" id="selinux_enabled" version="1">
-    <metadata>
-      <title>Ensure SELinux is Properly Enabled</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>SELinux should be enabled on the local system.</description>
-    </metadata>
-    <criteria>
-      <criterion comment="/selinux exists" test_ref="test_selinux_enabled" />
-    </criteria>
-  </definition>
-  <linux:partition_test check="all" check_existence="all_exist" id="test_selinux_enabled" version="1" comment="/selinux partition exists">
-    <linux:object object_ref="object_selinux_enabled" />
-  </linux:partition_test>
-  <linux:partition_object id="object_selinux_enabled" version="1">
-    <linux:mount_point>/selinux</linux:mount_point>
-  </linux:partition_object>
-</def-group>
diff --git a/RHEL6/input/checks/service_sssd_disabled.xml b/RHEL6/input/checks/service_sssd_disabled.xml
deleted file mode 100644
index 23f2ac8..0000000
--- a/RHEL6/input/checks/service_sssd_disabled.xml
+++ /dev/null
@@ -1,96 +0,0 @@
-<def-group>
-  <!-- THIS FILE IS GENERATED by create_services_disabled.py.  DO NOT EDIT.  -->
-  <definition class="compliance" id="service_sssd_disabled"
-  version="1">
-    <metadata>
-      <title>Service sssd Disabled</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The sssd service should be disabled if possible.</description>
-    </metadata>
-    <criteria operator="AND" comment="service sssd is not configured to start">
-      <criterion comment="sssd runlevel 0" test_ref="test_runlevel0_sssd" />
-      <criterion comment="sssd runlevel 1" test_ref="test_runlevel1_sssd" />
-      <criterion comment="sssd runlevel 2" test_ref="test_runlevel2_sssd" />
-      <criterion comment="sssd runlevel 3" test_ref="test_runlevel3_sssd" />
-      <criterion comment="sssd runlevel 4" test_ref="test_runlevel4_sssd" />
-      <criterion comment="sssd runlevel 5" test_ref="test_runlevel5_sssd" />
-      <criterion comment="sssd runlevel 6" test_ref="test_runlevel6_sssd" />
-    </criteria>
-  </definition>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel0_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel0_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel1_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel1_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel2_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel2_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel3_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel3_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel4_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel4_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel5_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel5_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_test check="all" check_existence="any_exist"
-  comment="Runlevel test" id="test_runlevel6_sssd"
-  version="2">
-    <unix:object object_ref="obj_runlevel6_sssd" />
-    <unix:state state_ref="state_service_sssd_off" />
-  </unix:runlevel_test>
-  <unix:runlevel_object id="obj_runlevel0_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">0</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel1_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">1</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel2_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">2</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel3_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">3</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel4_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">4</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel5_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">5</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_object id="obj_runlevel6_sssd" version="1">
-    <unix:service_name>sssd</unix:service_name>
-    <unix:runlevel operation="equals">6</unix:runlevel>
-  </unix:runlevel_object>
-  <unix:runlevel_state comment="not configured to start" id="state_service_sssd_off" version="1">
-    <unix:start datatype="boolean">false</unix:start>
-    <unix:kill datatype="boolean">true</unix:kill>
-  </unix:runlevel_state>
-</def-group>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml
deleted file mode 100644
index 9a7a1e0..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<def-group>
-  <definition class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
-    <metadata>
-      <title>Kernel Runtime Parameter "net.ipv6.conf.all.disable_ipv6" Check</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The kernel runtime parameter "net.ipv6.conf.all.disable_ipv6" should be set to "1".</description>
-      <!-- generated by create_sysctl_checks.py -->
-    </metadata>
-    <criteria operator="OR">
-      <extend_definition comment="IPv6 disabled or..." definition_ref="kernel_module_ipv6_option_disabled" />
-      <criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" />
-    </criteria>
-  </definition>
-
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
-    <unix:object object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" />
-    <unix:state state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" />
-  </unix:sysctl_test>
-
-  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
-    <unix:name>net.ipv6.conf.all.disable_ipv6</unix:name>
-  </unix:sysctl_object>
-
-  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
-    <unix:value datatype="int" operation="equals">1</unix:value>
-  </unix:sysctl_state>
-</def-group>
diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv
index 706cba3..f0a2960 100644
--- a/RHEL6/input/checks/templates/packages_installed.csv
+++ b/RHEL6/input/checks/templates/packages_installed.csv
@@ -14,6 +14,5 @@ policycoreutils
 postfix
 psacct
 rsyslog
-vlock
 vsftpd
 screen
diff --git a/RHEL6/input/checks/templates/packages_removed.csv b/RHEL6/input/checks/templates/packages_removed.csv
index 697f658..a454d5e 100644
--- a/RHEL6/input/checks/templates/packages_removed.csv
+++ b/RHEL6/input/checks/templates/packages_removed.csv
@@ -1,5 +1,4 @@
 abrt
-acpid
 at
 autofs
 bind
@@ -32,7 +31,6 @@ qpid-cpp-server
 quota
 rhnsd
 rpcbind
-rsh
 rsh-server
 samba-common
 samba
@@ -46,7 +44,6 @@ talk
 talk-server
 telnet-server
 tftp-server
-vlock
 vsftpd
 xinetd
 xorg-x11-server-common
diff --git a/RHEL6/input/checks/templates/services_disabled.csv b/RHEL6/input/checks/templates/services_disabled.csv
index 74e93e4..0c25379 100644
--- a/RHEL6/input/checks/templates/services_disabled.csv
+++ b/RHEL6/input/checks/templates/services_disabled.csv
@@ -3,7 +3,6 @@ acpid,
 autofs,
 certmonger,
 cgred,
-sssd,
 atd,at
 avahi-daemon,
 bluetooth,
-- 
1.7.1



More information about the scap-security-guide mailing list