[PATCH 00/15] Adding new profile, C2S
Shawn Wells
shawn at redhat.com
Mon Apr 14 16:34:42 UTC 2014
-------------- next part --------------
>From fb05b7c560fd6f54d5c2c92ea5a5853b228952b6 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Mon, 14 Apr 2014 12:31:30 -0400
Subject: [PATCH 00/15] Adding new profile, C2S
The following patchset prepares the codebase for the C2S profile.
For those not familiar with C2S, google "C2S Amazon"
It is our (Red Hat's) aspiration to have the C2S profile ship within SSG's pending inclusion in RHEL 6.6. To make this happen,
I wanted to release the current progress to the list. Any & all testing would be most welcome! Please report bugs to the list.
If you're interested in helping complete out the OVAL and remediation scripts, please send a note to the list on what control(s)
you're interested in taking on!
Shawn Wells (15):
New Remediation: sticky_world_writable_dirs.sh
New Remediation: enable_selinux_bootloader.sh
Moved RHEL6 selinux_state.sh to shared
Moved RHEL6 selinux_policytype.sh to shared/
New RHEL6 Rule: package_setroubleshoot_removed
typo fix
New Rule: package_mcstrans_removed
XCCDF Rule Rename: disable_setuid_coredumps -->
sysctl_fs_suid_dumpable
New RHEL6 Rule: package_telnet_removed
New RHEL6 rule: package_rsh_removed
New RHEL6 rule: package_ypbind_removed
New RHEL6 rule: package_tftp_removed
[bugfix] kernel_module_hfs_disabledplus -->
kernel_module_hfsplus_disabled
New Profile: C2S
Adding C2S into build system
RHEL/6/input/checks/package_mcstrans_removed.xml | 26 +
RHEL/6/input/checks/package_rsh_removed.xml | 26 +
.../checks/package_setroubleshoot_removed.xml | 26 +
RHEL/6/input/checks/package_telnet_removed.xml | 26 +
RHEL/6/input/checks/package_tftp_removed.xml | 26 +
RHEL/6/input/checks/templates/packages_removed.csv | 5 +
.../input/fixes/bash/enable_selinux_bootloader.sh | 1 +
RHEL/6/input/fixes/bash/selinux_policytype.sh | 9 +-
RHEL/6/input/fixes/bash/selinux_state.sh | 9 +-
.../input/fixes/bash/sticky_world_writable_dirs.sh | 1 +
RHEL/6/input/guide.xslt | 1 +
RHEL/6/input/profiles/C2S.xml | 713 ++++++++++++++++++++
RHEL/6/input/profiles/CS2.xml | 2 +-
RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 2 +-
.../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL/6/input/profiles/nist-CL-IL-AL.xml | 6 +-
.../input/profiles/stig-rhel6-server-upstream.xml | 11 +-
RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL/6/input/services/obsolete.xml | 61 ++
RHEL/6/input/system/permissions/execution.xml | 2 +-
RHEL/6/input/system/selinux.xml | 29 +
shared/fixes/bash/enable_selinux_bootloader.sh | 2 +
shared/fixes/bash/selinux_policytype.sh | 8 +
shared/fixes/bash/selinux_state.sh | 8 +
shared/fixes/bash/sticky_world_writable_dirs.sh | 4 +
25 files changed, 984 insertions(+), 24 deletions(-)
create mode 100644 RHEL/6/input/checks/package_mcstrans_removed.xml
create mode 100644 RHEL/6/input/checks/package_rsh_removed.xml
create mode 100644 RHEL/6/input/checks/package_setroubleshoot_removed.xml
create mode 100644 RHEL/6/input/checks/package_telnet_removed.xml
create mode 100644 RHEL/6/input/checks/package_tftp_removed.xml
create mode 120000 RHEL/6/input/fixes/bash/enable_selinux_bootloader.sh
mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_policytype.sh
mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_state.sh
create mode 120000 RHEL/6/input/fixes/bash/sticky_world_writable_dirs.sh
create mode 100644 RHEL/6/input/profiles/C2S.xml
create mode 100644 shared/fixes/bash/enable_selinux_bootloader.sh
create mode 100644 shared/fixes/bash/selinux_policytype.sh
create mode 100644 shared/fixes/bash/selinux_state.sh
create mode 100644 shared/fixes/bash/sticky_world_writable_dirs.sh
More information about the scap-security-guide
mailing list