<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 9/13/13 1:35 AM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
      type="cite">
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0005-Add-Installing-and-Maintaining-Software-and-Updating.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From e0675a9045306f8bb35268e2fdddde52de00d62d Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 12 Sep 2013 17:23:20 +0200
Subject: [PATCH 5/8] Add 'Installing and Maintaining Software' and 'Updating
 Software' XML files.


Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 FEDORA/input/system/software/software.xml |  8 ++++
 FEDORA/input/system/software/updating.xml | 72 +++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 FEDORA/input/system/software/software.xml
 create mode 100644 FEDORA/input/system/software/updating.xml

diff --git a/FEDORA/input/system/software/software.xml b/FEDORA/input/system/software/software.xml
new file mode 100644
index 0000000..97558fb
--- /dev/null
+++ b/FEDORA/input/system/software/software.xml
@@ -0,0 +1,8 @@
+&lt;Group id="software"&gt;
+&lt;title&gt;Installing and Maintaining Software&lt;/title&gt;
+&lt;description&gt;The following sections contain information on
+security-relevant choices during the initial operating system
+installation process and the setup of software
+updates.&lt;/description&gt;
+
+&lt;/Group&gt;
diff --git a/FEDORA/input/system/software/updating.xml b/FEDORA/input/system/software/updating.xml
new file mode 100644
index 0000000..0ad4b79
--- /dev/null
+++ b/FEDORA/input/system/software/updating.xml
@@ -0,0 +1,72 @@
+&lt;Group id="updating"&gt;
+&lt;title&gt;Updating Software&lt;/title&gt;
+&lt;description&gt;The &lt;tt&gt;yum&lt;/tt&gt; command line tool is used to install and
+update software packages. The system also provides a graphical
+software update tool in the &lt;b&gt;System&lt;/b&gt; menu, in the &lt;b&gt;Administration&lt;/b&gt; submenu,
+called &lt;b&gt;Software Update&lt;/b&gt;.
+&lt;br /&gt;&lt;br /&gt;
+Fedora systems contain an installed software catalog called
+the RPM database, which records metadata of installed packages.  Tools such as
+&lt;tt&gt;yum&lt;/tt&gt; or the graphical &lt;b&gt;Software Update&lt;/b&gt; ensure usage of RPM
+packages for software installation.  This allows for insight into the current
+inventory of installed software on the system, and is highly recommended.
+&lt;/description&gt;
+
+&lt;!-- REMINDER: Before telling people to update their systems
+     via the security_patches_up_to_date rule, we must
+     ensure they have configured an update source! --&gt;
+&lt;Rule id="ensure_gpgcheck_globally_activated" severity="high"&gt;
+&lt;title&gt;Ensure gpgcheck Enabled In Main Yum Configuration&lt;/title&gt;
+&lt;description&gt;The &lt;tt&gt;gpgcheck&lt;/tt&gt; option should be used to ensure
+checking of an RPM package's signature always occurs prior to its
+installation. To configure yum to check package signatures before installing
+them, ensure the following line appears in &lt;tt&gt;/etc/yum.conf&lt;/tt&gt; in
+the &lt;tt&gt;[main]&lt;/tt&gt; section:
+&lt;pre&gt;gpgcheck=1&lt;/pre&gt;
+&lt;/description&gt;
+&lt;ocil clause="GPG checking is not enabled"&gt;
+To determine whether &lt;tt&gt;yum&lt;/tt&gt; is configured to use &lt;tt&gt;gpgcheck&lt;/tt&gt;,
+inspect &lt;tt&gt;/etc/yum.conf&lt;/tt&gt; and ensure the following appears in the
+&lt;tt&gt;[main]&lt;/tt&gt; section:
+&lt;pre&gt;gpgcheck=1&lt;/pre&gt;
+A value of &lt;tt&gt;1&lt;/tt&gt; indicates that &lt;tt&gt;gpgcheck&lt;/tt&gt; is enabled. Absence of a
+&lt;tt&gt;gpgcheck&lt;/tt&gt; line or a setting of &lt;tt&gt;0&lt;/tt&gt; indicates that it is
+disabled.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Ensuring the validity of packages' cryptographic signatures prior to
+installation ensures the provenance of the software and
+protects against malicious tampering.
+&lt;/rationale&gt;
+&lt;ident cce="26709-6" /&gt;</pre>
      </div>
    </blockquote>
    <br>
    These CCE's are operating system specific. We'll need to work with
    Steve Grubb (+Jeff and NIST?) to get new ones assigned for Fedora.
    For the time being, we should strip off CCE values for the Fedora
    content.<br>
    <br>
    <blockquote
      cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+&lt;oval id="yum_gpgcheck_global_activation" /&gt;
+&lt;ref nist="SI-7,MA-1(b)" disa="352,663" /&gt;
+&lt;tested by="MM" on="20120928"/&gt;</pre>
      </div>
    </blockquote>
    ^^ test attestation as mentioned by Dave<br>
    <br>
    <blockquote
      cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+&lt;/Rule&gt;
+
+&lt;Rule id="ensure_gpgcheck_never_disabled" severity="high"&gt;
+&lt;title&gt;Ensure gpgcheck Enabled For All Yum Package Repositories&lt;/title&gt;
+&lt;description&gt;To ensure signature checking is not disabled for
+any repos, remove any lines from files in &lt;tt&gt;/etc/yum.repos.d&lt;/tt&gt; of the form:
+&lt;pre&gt;gpgcheck=0&lt;/pre&gt;
+&lt;/description&gt;
+&lt;ocil clause="GPG checking is disabled"&gt;
+To determine whether &lt;tt&gt;yum&lt;/tt&gt; has been configured to disable
+&lt;tt&gt;gpgcheck&lt;/tt&gt; for any repos,  inspect all files in
+&lt;tt&gt;/etc/yum.repos.d&lt;/tt&gt; and ensure the following does not appear in any
+sections:
+&lt;pre&gt;gpgcheck=0&lt;/pre&gt;
+A value of &lt;tt&gt;0&lt;/tt&gt; indicates that &lt;tt&gt;gpgcheck&lt;/tt&gt; has been disabled for that repo.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Ensuring all packages' cryptographic signatures are valid prior to
+installation ensures the provenance of the software and
+protects against malicious tampering.
+&lt;/rationale&gt;
+&lt;ident cce="26647-8" /&gt;</pre>
      </div>
    </blockquote>
    ^^ CCE<br>
    <blockquote
      cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+&lt;oval id="ensure_gpgcheck_never_disabled" /&gt;
+&lt;ref nist="SI-7,MA-1(b)" disa="352,663"/&gt;
+&lt;tested by="MM" on="20120928"/&gt;</pre>
      </div>
    </blockquote>
    ^^ test attestation<br>
    <blockquote
      cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">
+&lt;/Rule&gt;
+
+&lt;/Group&gt;
<div class="moz-txt-sig">-- 
1.7.11.7

</div></pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>