[PATCH 00/15] Adding new profile, C2S

Shawn Wells shawn at redhat.com
Mon Apr 14 16:34:42 UTC 2014


-------------- next part --------------
>From fb05b7c560fd6f54d5c2c92ea5a5853b228952b6 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Mon, 14 Apr 2014 12:31:30 -0400
Subject: [PATCH 00/15] Adding new profile, C2S

The following patchset prepares the codebase for the C2S profile.

For those not familiar with C2S, google "C2S Amazon"

It is our (Red Hat's) aspiration to have the C2S profile ship within SSG's pending inclusion in RHEL 6.6. To make this happen,
I wanted to release the current progress to the list. Any & all testing would be most welcome! Please report bugs to the list.
If you're interested in helping complete out the OVAL and remediation scripts, please send a note to the list on what control(s)
you're interested in taking on!

Shawn Wells (15):
  New Remediation: sticky_world_writable_dirs.sh
  New Remediation: enable_selinux_bootloader.sh
  Moved RHEL6 selinux_state.sh to shared
  Moved RHEL6 selinux_policytype.sh to shared/
  New RHEL6 Rule: package_setroubleshoot_removed
  typo fix
  New Rule: package_mcstrans_removed
  XCCDF Rule Rename: disable_setuid_coredumps -->
    sysctl_fs_suid_dumpable
  New RHEL6 Rule: package_telnet_removed
  New RHEL6 rule: package_rsh_removed
  New RHEL6 rule: package_ypbind_removed
  New RHEL6 rule: package_tftp_removed
  [bugfix] kernel_module_hfs_disabledplus -->
    kernel_module_hfsplus_disabled
  New Profile: C2S
  Adding C2S into build system

 RHEL/6/input/checks/package_mcstrans_removed.xml   |   26 +
 RHEL/6/input/checks/package_rsh_removed.xml        |   26 +
 .../checks/package_setroubleshoot_removed.xml      |   26 +
 RHEL/6/input/checks/package_telnet_removed.xml     |   26 +
 RHEL/6/input/checks/package_tftp_removed.xml       |   26 +
 RHEL/6/input/checks/templates/packages_removed.csv |    5 +
 .../input/fixes/bash/enable_selinux_bootloader.sh  |    1 +
 RHEL/6/input/fixes/bash/selinux_policytype.sh      |    9 +-
 RHEL/6/input/fixes/bash/selinux_state.sh           |    9 +-
 .../input/fixes/bash/sticky_world_writable_dirs.sh |    1 +
 RHEL/6/input/guide.xslt                            |    1 +
 RHEL/6/input/profiles/C2S.xml                      |  713 ++++++++++++++++++++
 RHEL/6/input/profiles/CS2.xml                      |    2 +-
 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml           |    2 +-
 .../6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL/6/input/profiles/nist-CL-IL-AL.xml            |    6 +-
 .../input/profiles/stig-rhel6-server-upstream.xml  |   11 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |    2 +-
 RHEL/6/input/services/obsolete.xml                 |   61 ++
 RHEL/6/input/system/permissions/execution.xml      |    2 +-
 RHEL/6/input/system/selinux.xml                    |   29 +
 shared/fixes/bash/enable_selinux_bootloader.sh     |    2 +
 shared/fixes/bash/selinux_policytype.sh            |    8 +
 shared/fixes/bash/selinux_state.sh                 |    8 +
 shared/fixes/bash/sticky_world_writable_dirs.sh    |    4 +
 25 files changed, 984 insertions(+), 24 deletions(-)
 create mode 100644 RHEL/6/input/checks/package_mcstrans_removed.xml
 create mode 100644 RHEL/6/input/checks/package_rsh_removed.xml
 create mode 100644 RHEL/6/input/checks/package_setroubleshoot_removed.xml
 create mode 100644 RHEL/6/input/checks/package_telnet_removed.xml
 create mode 100644 RHEL/6/input/checks/package_tftp_removed.xml
 create mode 120000 RHEL/6/input/fixes/bash/enable_selinux_bootloader.sh
 mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_policytype.sh
 mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_state.sh
 create mode 120000 RHEL/6/input/fixes/bash/sticky_world_writable_dirs.sh
 create mode 100644 RHEL/6/input/profiles/C2S.xml
 create mode 100644 shared/fixes/bash/enable_selinux_bootloader.sh
 create mode 100644 shared/fixes/bash/selinux_policytype.sh
 create mode 100644 shared/fixes/bash/selinux_state.sh
 create mode 100644 shared/fixes/bash/sticky_world_writable_dirs.sh



More information about the scap-security-guide mailing list