[PATCH 5/8] Add 'Installing and Maintaining Software' and 'Updating Software' XML files.

Shawn Wells shawn at redhat.com
Sat Sep 14 23:49:35 UTC 2013


On 9/13/13 1:35 AM, Jan Lieskovsky wrote:
>
> 0005-Add-Installing-and-Maintaining-Software-and-Updating.patch
>
>
>  From e0675a9045306f8bb35268e2fdddde52de00d62d Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Thu, 12 Sep 2013 17:23:20 +0200
> Subject: [PATCH 5/8] Add 'Installing and Maintaining Software' and 'Updating
>   Software' XML files.
>
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   FEDORA/input/system/software/software.xml |  8 ++++
>   FEDORA/input/system/software/updating.xml | 72 +++++++++++++++++++++++++++++++
>   2 files changed, 80 insertions(+)
>   create mode 100644 FEDORA/input/system/software/software.xml
>   create mode 100644 FEDORA/input/system/software/updating.xml
>
> diff --git a/FEDORA/input/system/software/software.xml b/FEDORA/input/system/software/software.xml
> new file mode 100644
> index 0000000..97558fb
> --- /dev/null
> +++ b/FEDORA/input/system/software/software.xml
> @@ -0,0 +1,8 @@
> +<Group id="software">
> +<title>Installing and Maintaining Software</title>
> +<description>The following sections contain information on
> +security-relevant choices during the initial operating system
> +installation process and the setup of software
> +updates.</description>
> +
> +</Group>
> diff --git a/FEDORA/input/system/software/updating.xml b/FEDORA/input/system/software/updating.xml
> new file mode 100644
> index 0000000..0ad4b79
> --- /dev/null
> +++ b/FEDORA/input/system/software/updating.xml
> @@ -0,0 +1,72 @@
> +<Group id="updating">
> +<title>Updating Software</title>
> +<description>The <tt>yum</tt> command line tool is used to install and
> +update software packages. The system also provides a graphical
> +software update tool in the <b>System</b> menu, in the <b>Administration</b> submenu,
> +called <b>Software Update</b>.
> +<br /><br />
> +Fedora systems contain an installed software catalog called
> +the RPM database, which records metadata of installed packages.  Tools such as
> +<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM
> +packages for software installation.  This allows for insight into the current
> +inventory of installed software on the system, and is highly recommended.
> +</description>
> +
> +<!-- REMINDER: Before telling people to update their systems
> +     via the security_patches_up_to_date rule, we must
> +     ensure they have configured an update source! -->
> +<Rule id="ensure_gpgcheck_globally_activated" severity="high">
> +<title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
> +<description>The <tt>gpgcheck</tt> option should be used to ensure
> +checking of an RPM package's signature always occurs prior to its
> +installation. To configure yum to check package signatures before installing
> +them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
> +the <tt>[main]</tt> section:
> +<pre>gpgcheck=1</pre>
> +</description>
> +<ocil clause="GPG checking is not enabled">
> +To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
> +inspect <tt>/etc/yum.conf</tt> and ensure the following appears in the
> +<tt>[main]</tt> section:
> +<pre>gpgcheck=1</pre>
> +A value of <tt>1</tt> indicates that <tt>gpgcheck</tt> is enabled. Absence of a
> +<tt>gpgcheck</tt> line or a setting of <tt>0</tt> indicates that it is
> +disabled.
> +</ocil>
> +<rationale>
> +Ensuring the validity of packages' cryptographic signatures prior to
> +installation ensures the provenance of the software and
> +protects against malicious tampering.
> +</rationale>
> +<ident cce="26709-6" />

These CCE's are operating system specific. We'll need to work with Steve 
Grubb (+Jeff and NIST?) to get new ones assigned for Fedora. For the 
time being, we should strip off CCE values for the Fedora content.

> +<oval id="yum_gpgcheck_global_activation" />
> +<ref nist="SI-7,MA-1(b)" disa="352,663" />
> +<tested by="MM" on="20120928"/>
^^ test attestation as mentioned by Dave

> +</Rule>
> +
> +<Rule id="ensure_gpgcheck_never_disabled" severity="high">
> +<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
> +<description>To ensure signature checking is not disabled for
> +any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
> +<pre>gpgcheck=0</pre>
> +</description>
> +<ocil clause="GPG checking is disabled">
> +To determine whether <tt>yum</tt> has been configured to disable
> +<tt>gpgcheck</tt> for any repos,  inspect all files in
> +<tt>/etc/yum.repos.d</tt> and ensure the following does not appear in any
> +sections:
> +<pre>gpgcheck=0</pre>
> +A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for that repo.
> +</ocil>
> +<rationale>
> +Ensuring all packages' cryptographic signatures are valid prior to
> +installation ensures the provenance of the software and
> +protects against malicious tampering.
> +</rationale>
> +<ident cce="26647-8" />
^^ CCE
> +<oval id="ensure_gpgcheck_never_disabled" />
> +<ref nist="SI-7,MA-1(b)" disa="352,663"/>
> +<tested by="MM" on="20120928"/>
^^ test attestation
> +</Rule>
> +
> +</Group>
> -- 1.7.11.7
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130914/eaa29340/attachment.html>


More information about the scap-security-guide mailing list