[PATCH 00/26] Resubmission of C2S profile
Shawn Wells
shawn at redhat.com
Tue Apr 15 18:49:11 UTC 2014
On 4/15/14, 2:30 PM, Shawn Wells wrote:
>
> 0000-cover-letter.patch
>
>
> From 6d8d3b510c9261c022f70efa633d45b1acb1f26a Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Mon, 14 Apr 2014 23:29:41 -0400
> Subject: [PATCH 00/26] Resubmission of C2S profile
>
> After a few coffees and croissants this morning @ RHT Summit,
> Jeff and I made friends and hashed out the details of the C2S profile.
>
> Resubmitting patches to reflect Jan's feedback and adding details within
> the C2S profile on rule mappings.
>
> Shawn Wells (26):
> New Remediation: sticky_world_writable_dirs.sh
> New Remediation: enable_selinux_bootloader.sh
> Moved RHEL6 selinux_state.sh to shared
> Moved RHEL6 selinux_policytype.sh to shared/
> New RHEL6 Rule: package_setroubleshoot_removed
> typo fix
> New Rule: package_mcstrans_removed
> XCCDF Rule Rename: disable_setuid_coredumps -->
> sysctl_fs_suid_dumpable
> New RHEL6 Rule: package_telnet_removed
> New RHEL6 rule: package_rsh_removed
> New RHEL6 rule: package_ypbind_removed
> New RHEL6 rule: package_tftp_removed
> [bugfix] kernel_module_hfs_disabledplus -->
> kernel_module_hfsplus_disabled
> New Profile: C2S
> Adding C2S into build system
> Mapped C2S 9.2.11 to gid_passwd_group_same
> C2S 1.1.6 --> mount_option_var_tmp_bind_var
> C2S 1.1.10 --> mount_option_nodev_nonroot_local_partitions
> C2S 3.2 --> packagegroup_xwindows_remove
> C2S 3.16 --> postfix_network_listening_disabled
> Adding rsyslog_nolisten mapping
> C2S 6.1.10 --> service_atd_disabled
> C2S 7.1.1 --> accounts_maximum_age_login_defs
> Updating C2S profile
> Updating RHEL/6/output/.gitignore
> Updating commit per Jan's feedback
>
> RHEL/6/input/checks/package_mcstrans_removed.xml | 26 +
> RHEL/6/input/checks/package_rsh_removed.xml | 26 +
> .../checks/package_setroubleshoot_removed.xml | 26 +
> RHEL/6/input/checks/package_telnet_removed.xml | 26 +
> RHEL/6/input/checks/package_tftp_removed.xml | 26 +
> RHEL/6/input/checks/templates/packages_removed.csv | 5 +
> .../input/fixes/bash/enable_selinux_bootloader.sh | 1 +
> RHEL/6/input/fixes/bash/selinux_policytype.sh | 9 +-
> RHEL/6/input/fixes/bash/selinux_state.sh | 9 +-
> .../input/fixes/bash/sticky_world_writable_dirs.sh | 1 +
> RHEL/6/input/guide.xslt | 1 +
> RHEL/6/input/profiles/C2S.xml | 724 ++++++++++++++++++++
> RHEL/6/input/profiles/CS2.xml | 2 +-
> RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 2 +-
> .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
> RHEL/6/input/profiles/nist-CL-IL-AL.xml | 6 +-
> .../input/profiles/stig-rhel6-server-upstream.xml | 11 +-
> RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
> RHEL/6/input/services/obsolete.xml | 61 ++
> RHEL/6/input/system/permissions/execution.xml | 2 +-
> RHEL/6/input/system/selinux.xml | 29 +
> shared/fixes/bash/enable_selinux_bootloader.sh | 2 +
> shared/fixes/bash/selinux_policytype.sh | 8 +
> shared/fixes/bash/selinux_state.sh | 8 +
> shared/fixes/bash/sticky_world_writable_dirs.sh | 4 +
> 25 files changed, 995 insertions(+), 24 deletions(-)
> create mode 100644 RHEL/6/input/checks/package_mcstrans_removed.xml
> create mode 100644 RHEL/6/input/checks/package_rsh_removed.xml
> create mode 100644 RHEL/6/input/checks/package_setroubleshoot_removed.xml
> create mode 100644 RHEL/6/input/checks/package_telnet_removed.xml
> create mode 100644 RHEL/6/input/checks/package_tftp_removed.xml
> create mode 120000 RHEL/6/input/fixes/bash/enable_selinux_bootloader.sh
> mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_policytype.sh
> mode change 100644 => 120000 RHEL/6/input/fixes/bash/selinux_state.sh
> create mode 120000 RHEL/6/input/fixes/bash/sticky_world_writable_dirs.sh
> create mode 100644 RHEL/6/input/profiles/C2S.xml
> mode change 100644 => 100755 RHEL/6/output/.gitignore
> create mode 100644 shared/fixes/bash/enable_selinux_bootloader.sh
> create mode 100644 shared/fixes/bash/selinux_policytype.sh
> create mode 100644 shared/fixes/bash/selinux_state.sh
> create mode 100644 shared/fixes/bash/sticky_world_writable_dirs.sh
>
Also, not reflected in EMail... ran make && scan:
$ make
$ sudo oscap xccdf eval --profile C2S --cpe
output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
... no errors ...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140415/e8692403/attachment-0001.html>
More information about the scap-security-guide
mailing list