<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/13/13 1:35 AM, Jan Lieskovsky
wrote:<br>
</div>
<blockquote
cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
type="cite">
<br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">0005-Add-Installing-and-Maintaining-Software-and-Updating.patch</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">From e0675a9045306f8bb35268e2fdddde52de00d62d Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com"><jlieskov@redhat.com></a>
Date: Thu, 12 Sep 2013 17:23:20 +0200
Subject: [PATCH 5/8] Add 'Installing and Maintaining Software' and 'Updating
Software' XML files.
Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com"><jlieskov@redhat.com></a>
---
FEDORA/input/system/software/software.xml | 8 ++++
FEDORA/input/system/software/updating.xml | 72 +++++++++++++++++++++++++++++++
2 files changed, 80 insertions(+)
create mode 100644 FEDORA/input/system/software/software.xml
create mode 100644 FEDORA/input/system/software/updating.xml
diff --git a/FEDORA/input/system/software/software.xml b/FEDORA/input/system/software/software.xml
new file mode 100644
index 0000000..97558fb
--- /dev/null
+++ b/FEDORA/input/system/software/software.xml
@@ -0,0 +1,8 @@
+<Group id="software">
+<title>Installing and Maintaining Software</title>
+<description>The following sections contain information on
+security-relevant choices during the initial operating system
+installation process and the setup of software
+updates.</description>
+
+</Group>
diff --git a/FEDORA/input/system/software/updating.xml b/FEDORA/input/system/software/updating.xml
new file mode 100644
index 0000000..0ad4b79
--- /dev/null
+++ b/FEDORA/input/system/software/updating.xml
@@ -0,0 +1,72 @@
+<Group id="updating">
+<title>Updating Software</title>
+<description>The <tt>yum</tt> command line tool is used to install and
+update software packages. The system also provides a graphical
+software update tool in the <b>System</b> menu, in the <b>Administration</b> submenu,
+called <b>Software Update</b>.
+<br /><br />
+Fedora systems contain an installed software catalog called
+the RPM database, which records metadata of installed packages. Tools such as
+<tt>yum</tt> or the graphical <b>Software Update</b> ensure usage of RPM
+packages for software installation. This allows for insight into the current
+inventory of installed software on the system, and is highly recommended.
+</description>
+
+<!-- REMINDER: Before telling people to update their systems
+ via the security_patches_up_to_date rule, we must
+ ensure they have configured an update source! -->
+<Rule id="ensure_gpgcheck_globally_activated" severity="high">
+<title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
+<description>The <tt>gpgcheck</tt> option should be used to ensure
+checking of an RPM package's signature always occurs prior to its
+installation. To configure yum to check package signatures before installing
+them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
+the <tt>[main]</tt> section:
+<pre>gpgcheck=1</pre>
+</description>
+<ocil clause="GPG checking is not enabled">
+To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
+inspect <tt>/etc/yum.conf</tt> and ensure the following appears in the
+<tt>[main]</tt> section:
+<pre>gpgcheck=1</pre>
+A value of <tt>1</tt> indicates that <tt>gpgcheck</tt> is enabled. Absence of a
+<tt>gpgcheck</tt> line or a setting of <tt>0</tt> indicates that it is
+disabled.
+</ocil>
+<rationale>
+Ensuring the validity of packages' cryptographic signatures prior to
+installation ensures the provenance of the software and
+protects against malicious tampering.
+</rationale>
+<ident cce="26709-6" /></pre>
</div>
</blockquote>
<br>
These CCE's are operating system specific. We'll need to work with
Steve Grubb (+Jeff and NIST?) to get new ones assigned for Fedora.
For the time being, we should strip off CCE values for the Fedora
content.<br>
<br>
<blockquote
cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">
+<oval id="yum_gpgcheck_global_activation" />
+<ref nist="SI-7,MA-1(b)" disa="352,663" />
+<tested by="MM" on="20120928"/></pre>
</div>
</blockquote>
^^ test attestation as mentioned by Dave<br>
<br>
<blockquote
cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">
+</Rule>
+
+<Rule id="ensure_gpgcheck_never_disabled" severity="high">
+<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
+<description>To ensure signature checking is not disabled for
+any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
+<pre>gpgcheck=0</pre>
+</description>
+<ocil clause="GPG checking is disabled">
+To determine whether <tt>yum</tt> has been configured to disable
+<tt>gpgcheck</tt> for any repos, inspect all files in
+<tt>/etc/yum.repos.d</tt> and ensure the following does not appear in any
+sections:
+<pre>gpgcheck=0</pre>
+A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for that repo.
+</ocil>
+<rationale>
+Ensuring all packages' cryptographic signatures are valid prior to
+installation ensures the provenance of the software and
+protects against malicious tampering.
+</rationale>
+<ident cce="26647-8" /></pre>
</div>
</blockquote>
^^ CCE<br>
<blockquote
cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">
+<oval id="ensure_gpgcheck_never_disabled" />
+<ref nist="SI-7,MA-1(b)" disa="352,663"/>
+<tested by="MM" on="20120928"/></pre>
</div>
</blockquote>
^^ test attestation<br>
<blockquote
cite="mid:718200356.12440874.1379054118537.JavaMail.root@redhat.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">
+</Rule>
+
+</Group>
<div class="moz-txt-sig">--
1.7.11.7
</div></pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-unicode">
<pre wrap="">_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
</body>
</html>