[PATCH 00/21] DISA FSO Patch Sync

Shawn Wells shawn at redhat.com
Mon Jul 28 03:47:08 UTC 2014


On 7/27/14, 11:26 PM, Shawn Wells wrote:
> DISA FSO has provided the following patches based on end-user feedback and updates done amongst the DISA FSO staff. Submitting to list on their behalf.
>
> -shawn
>
> Leland Steinke (21):
>    Update aide_build_database
>    Add VMS/DPMS mappings in stig_overlay
>    Update VRelease attributes for DISA FSO VMS tags
>    Add set_ip6tables_default_rule to common, map to STIG RHEL-06-000523
>    Update VRelease attribute for RHEL-06-000008
>      (ensure_redhat_gpgkey_installed)
>    Add reload to set_ip6tables_default_rule
>    [bugfix] modify file_permissions_library_dirs to follow symlinks
>    [bugfix] Modify file_permissions_binary_dirs to follow symlinks
>    Increment VRelease for
>      sysctl_ipv6_default_accept_redirects/RHEL-06-000099
>    Check syscall audits explicitly to avoid partial matches
>    Add applicability statement to audit_rules_time_stime/RHEL-06-000169
>    Give SELinux precedence over HBSS in install_hids/RHEL-06-000285
>    Update install_antivirus/RHEL-06-000284 from uvscan to VSEL/nails
>    Remove display_login_attempts/RHEL-06-000506 from RHEL 6 STIG
>    Add display_login_attempts/RHEL-06-000372 to STIG
>    [bugfix] Update selinux_all_devicefiles to "any_exist"
>    Increment OVAL version for selinux_all_devicefiles_labeled
>    Update OVAL version for sysctl_net_ipv6_conf_default_accept_redirects
>    Fix lowercase in system/auditing.xml
>    Update severity of aide_build_database in stig_overlay.xml
>    [bugfix] Correct static sysctl.conf check regex and increment
>      versions
>
>   RHEL/6/input/auxiliary/stig_overlay.xml            |   87 +++++++++++---------
>   .../checks/selinux_all_devicefiles_labeled.xml     |    2 +-
>   RHEL/6/input/checks/sysctl_fs_suid_dumpable.xml    |    2 +-
>   .../input/checks/sysctl_kernel_dmesg_restrict.xml  |    2 +-
>   RHEL/6/input/checks/sysctl_kernel_exec_shield.xml  |    2 +-
>   .../checks/sysctl_kernel_randomize_va_space.xml    |    2 +-
>   .../sysctl_net_ipv4_conf_all_accept_redirects.xml  |    2 +-
>   ...ysctl_net_ipv4_conf_all_accept_source_route.xml |    2 +-
>   .../sysctl_net_ipv4_conf_all_log_martians.xml      |    2 +-
>   .../checks/sysctl_net_ipv4_conf_all_rp_filter.xml  |    2 +-
>   .../sysctl_net_ipv4_conf_all_secure_redirects.xml  |    2 +-
>   .../sysctl_net_ipv4_conf_all_send_redirects.xml    |    2 +-
>   ...sctl_net_ipv4_conf_default_accept_redirects.xml |    2 +-
>   ...l_net_ipv4_conf_default_accept_source_route.xml |    2 +-
>   .../sysctl_net_ipv4_conf_default_rp_filter.xml     |    2 +-
>   ...sctl_net_ipv4_conf_default_secure_redirects.xml |    2 +-
>   ...sysctl_net_ipv4_conf_default_send_redirects.xml |    2 +-
>   ...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml |    2 +-
>   ..._net_ipv4_icmp_ignore_bogus_error_responses.xml |    2 +-
>   RHEL/6/input/checks/sysctl_net_ipv4_ip_forward.xml |    2 +-
>   .../checks/sysctl_net_ipv4_tcp_syncookies.xml      |    2 +-
>   .../sysctl_net_ipv6_conf_default_accept_ra.xml     |    2 +-
>   ...sctl_net_ipv6_conf_default_accept_redirects.xml |    2 +-
>   RHEL/6/input/checks/templates/template_sysctl      |    2 +-
>   RHEL/6/input/profiles/common.xml                   |    1 +
>   RHEL/6/input/system/accounts/pam.xml               |    2 +-
>   RHEL/6/input/system/auditing.xml                   |    3 +
>   RHEL/6/input/system/network/iptables.xml           |    2 +
>   RHEL/6/input/system/permissions/files.xml          |    4 +-
>   RHEL/6/input/system/software/integrity.xml         |   27 ++++--
>   30 files changed, 97 insertions(+), 75 deletions(-)
>

went through patches individually - they were OK (once exception, patch 18)

pushing patches on FSO's behalf...
$ git push
Enter passphrase for key '/home/shawnw/.ssh/id_rsa':
Counting objects: 240, done.
Delta compression using up to 2 threads.
Compressing objects: 100% (202/202), done.
Writing objects: 100% (202/202), 17.90 KiB, done.
Total 202 (delta 157), reused 0 (delta 0)
To ssh://shawndwells@git.fedorahosted.org/git/scap-security-guide.git
    c20e040..c1c1972  master -> master


More information about the scap-security-guide mailing list