[PATCH] XCCDF Profile Cleanup, take 2

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 30 02:49:08 UTC 2013


-------------- next part --------------
>From 19a6cb1d6d0def970255255248eaa86824656e29 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 29 Sep 2013 22:48:10 -0400
Subject: [PATCH] XCCDF Profile Cleanup, take 2
  - Forgot that test profile needed by make-eval (thanks, jeff!)
  - Cleaned up USGCB profile errors, added to build so people can test
  - Commented out test, FTP, and desktop profiles (largely since nobody is actively developing them)

---
 RHEL6/input/guide.xslt                      |    7 ++++---
 RHEL6/input/profiles/usgcb-rhel6-server.xml |   24 +++++++++---------------
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/RHEL6/input/guide.xslt b/RHEL6/input/guide.xslt
index f2e1ae6..3a54052 100644
--- a/RHEL6/input/guide.xslt
+++ b/RHEL6/input/guide.xslt
@@ -8,13 +8,14 @@
       <xsl:copy-of select="@*|node()" />
 
        <!-- adding profiles here -->
-		<xsl:apply-templates select="document('profiles/test.xml')" />
+		<!-- <xsl:apply-templates select="document('profiles/test.xml')" /> -->
 		<xsl:apply-templates select="document('profiles/CS2.xml')" />
 		<xsl:apply-templates select="document('profiles/common.xml')" />
-		<xsl:apply-templates select="document('profiles/desktop.xml')" />
+		<!-- <xsl:apply-templates select="document('profiles/desktop.xml')" /> -->
 		<xsl:apply-templates select="document('profiles/server.xml')" />
-		<xsl:apply-templates select="document('profiles/ftp.xml')" />
+		<!-- <xsl:apply-templates select="document('profiles/ftp.xml')" /> -->
 		<xsl:apply-templates select="document('profiles/stig-rhel6-server.xml')" />
+		<xsl:apply-templates select="document('profiles/usgcb-rhel6-server.xml')" />
 
        <Value id="conditional_clause" type="string" operator="equals">
                  <title>A conditional clause for check statements.</title>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index d96e4f2..5d0407d 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -17,8 +17,6 @@
 <select idref="rpm_verify_hashes" selected="true" />
 <select idref="mountopt_nodev_on_nonroot_partitions" selected="true" />
 <select idref="mountopt_nodev_on_removable_partitions" selected="true" />
-<select idref="mount_option_tmp_nodev" selected="true" />
-<select idref="mount_option_dev_shm_nodev" selected="true" />
 <select idref="mountopt_noexec_on_removable_partitions" selected="true" />
 <select idref="mountopt_nosuid_on_removable_partitions" selected="true" />
 <select idref="mount_option_tmp_nodev" selected="true" />
@@ -31,7 +29,7 @@
 <select idref="kernel_module_cramfs_disabled" selected="true" />
 <select idref="kernel_module_freevxfs_disabled" selected="true" />
 <select idref="kernel_module_hfs_disabled" selected="true" />
-<select idref="kernel_module_hfs_disabledplus" selected="true" />
+<select idref="kernel_module_hfsplus_disabled" selected="true" />
 <select idref="kernel_module_jffs2_disabled" selected="true" />
 <select idref="kernel_module_squashfs_disabled" selected="true" />
 <select idref="kernel_module_udf_disabled" selected="true" />
@@ -60,7 +58,7 @@
 <select idref="disable_users_coredumps" selected="true" />
 <select idref="enable_randomize_va_space" selected="true" />
 <select idref="enable_execshield" selected="true" />
-<select idref="install_PAE_kernel_on_x86" selected="true" />
+<select idref="install_PAE_kernel_on_x86-32" selected="true" />
 <select idref="securetty_root_login_console_only" selected="true" /> <!-- slightly different language than rhel5 -->
 <select idref="restrict_serial_port_logins" selected="true" />
 <select idref="no_empty_passwords" selected="true" />
@@ -103,7 +101,7 @@
 <select idref="permissions_grub_conf" selected="true" />
 <select idref="bootloader_password" selected="true" />
 <select idref="disable_interactive_boot" selected="true" />
-<refine-value idref="inactivity_timeout_value" selector="15" />
+<refine-value idref="inactivity_timeout_value" selector="15_minutes" />
 <select idref="set_screensaver_inactivity_timeout" selected="true" />
 <select idref="enable_screensaver_after_idle" selected="true" />
 <select idref="enable_screensaver_password_lock" selected="true" />
@@ -120,10 +118,10 @@
 <select idref="sysctl_ipv4_ip_forward" selected="true" />
 <select idref="sysctl_ipv4_all_send_redirects" selected="true" />
 <select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" />
-<refine-value idref="sysctl_net_ipv4_conf_all_secure_redirects_value" selector="0" />
+<refine-value idref="sysctl_net_ipv4_conf_all_secure_redirects_value" selector="disabled" />
 <select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true" />
 <refine-value idref="sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled" />
-<select idef="sysctl_net_ipv4_conf_all_accept_redirects" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true" />
 <refine-value idref="sysctl_net_ipv4_conf_all_accept_source_route_value" selector="disabled" />
 <select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true" />
 <refine-value idref="sysctl_net_ipv4_conf_default_secure_redirects_value" selector="disabled" />
@@ -131,7 +129,6 @@
 <refine-value idref="sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled" />
 <select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true" />
 <refine-value idref="sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled" />
-<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true" />
 <refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" selector="enabled" />
 <select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" />
 <refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled" />
@@ -145,7 +142,6 @@
 <refine-value idref="sysctl_net_ipv4_conf_default_rp_filter_value" selector="enabled" />
 <select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
 <select idref="wireless_disable_in_bios" selected="true" />
-<select idref="deactivate_wireless_interfaces" selected="true" />
 <select idref="service_bluetooth_disabled" selected="true" />
 <select idref="kernel_module_ipv6_option_disabled" selected="true" />
 <select idref="network_ipv6_disable_rpc" selected="true" />
@@ -202,14 +198,12 @@
 <select idref="uninstall_xinetd" selected="true" />
 <select idref="disable_telnet_service" selected="true" />
 <select idref="uninstall_telnet_server" selected="true" />
-<select idref="uninstall_rsh" selected="true" />
+<select idref="uninstall_rsh-server" selected="true" />
 <select idref="disable_ypbind" selected="true" />
 <select idref="uninstall_ypserv" selected="true" />
 <select idref="disable_tftp" selected="true" />
 <select idref="uninstall_tftp-server" selected="true" />
-<select idref="wireless_disable_in_bios" selected="true" />
 <select idref="deactivate_wireless_interfaces" selected="true" />
-<select idref="service_bluetooth_disabled" selected="true" />
 <select idref="kernel_module_bluetooth_disabled" selected="true" />
 <select idref="service_kdump_disabled" selected="true" />
 <select idref="network_disable_zeroconf" selected="true" />
@@ -217,7 +211,7 @@
 <select idref="disable_anacron" selected="true" />
 <!-- PLACEHOLDER: cron file perms go here when ready -->
 <select idref="sshd_allow_only_protocol2" selected="true" />
-<select idref="service_atd_disabled" selected="true" \>
+<select idref="service_atd_disabled" selected="true" />
 <select idref="sshd_set_keepalive" selected="true" />
 <select idref="sshd_set_idle_timeout" selected="true" />
 <select idref="sshd_disable_rhosts" selected="true" />
@@ -259,9 +253,9 @@
 <select idref="require_smb_client_signing" selected="true" />
 <select idref="require_smb_client_signing_mount.cifs" selected="true" />
 <select idref="disable_squid" selected="true" />
-<select idref="uninetall_squid" selected="true" />
+<select idref="uninstall_squid" selected="true" />
 <select idref="disable_snmpd" selected="true" />
-<select idref="uninstall_net" selected="true" />
+<select idref="uninstall_net-snmp" selected="true" />
 <select idref="service_autofs_disabled" selected="true" />
 <refine-value idref="var_account_disable_post_pw_expiration" selector="30" />
 <select idref="account_disable_post_pw_expiration" selected="true" />
-- 
1.7.1



More information about the scap-security-guide mailing list