Deprecate repository.
Remove last remaning files and update README where to find new scap-security-guide tests.
This commit is contained in:
Milan Lysonek
parent
04775f1d20
commit
d9309972e0
44 changed files with 1 additions and 690 deletions
|
|
@ -1,253 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
# library-prefix = scapCommon
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
# Variables
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
true <<'=cut'
|
||||
=pop
|
||||
|
||||
=item scapCommonDISTRO
|
||||
|
||||
Name of distribution which is set based on the host system. Variable is set by
|
||||
scapCommonGetDistroName function.
|
||||
|
||||
=item scapCommonDS
|
||||
|
||||
Full path to datastream file from scap-security-guide package based
|
||||
on the host system. Variable is set by scapCommonGetDSPath function.
|
||||
|
||||
=back
|
||||
|
||||
=cut
|
||||
|
||||
scapCommonDISTRO=""
|
||||
scapCommonDS=""
|
||||
|
||||
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
# Functions
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
scapCommonLibraryLoaded() {
|
||||
return 0
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapCommonGetDistroName
|
||||
|
||||
Prints a name of the host distro.
|
||||
Supported distros:
|
||||
- Fedora
|
||||
- RHEL
|
||||
- CentOS Stream
|
||||
Usage:
|
||||
DISTRO=$(scapCommonGetDistroName)
|
||||
|
||||
=cut
|
||||
function scapCommonGetDistroName() {
|
||||
if rlIsRHEL; then
|
||||
echo "rhel$(rlGetDistroRelease)"
|
||||
elif rlIsCentOS; then
|
||||
if rlIsCentOS "<=8"; then
|
||||
echo "centos$(rlGetDistroRelease)"
|
||||
elif rlIsCentOS ">=9"; then
|
||||
echo "cs$(rlGetDistroRelease)"
|
||||
fi
|
||||
else
|
||||
echo "fedora"
|
||||
fi
|
||||
}
|
||||
|
||||
scapCommonDISTRO=$(scapCommonGetDistroName)
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapCommonGetDSPath
|
||||
|
||||
Prints a path to a datastream file from the scap-security-guide package based
|
||||
on the host distro. Function accepts one optional argument DS_PREFIX_PATH -
|
||||
a prefix directory path where a datastream for the host distro is located and
|
||||
has a file name of "ssg-$(scapCommonGetDistroName)-ds.xml".
|
||||
Supported distros:
|
||||
- Fedora
|
||||
- RHEL
|
||||
- CentOS Stream
|
||||
Usage:
|
||||
DS=$(scapCommonGetDSPath)
|
||||
or
|
||||
DS=$(scapCommonGetDSPath <DS_PREFIX_PATH>)
|
||||
|
||||
=cut
|
||||
function scapCommonGetDSPath() {
|
||||
local ds_prefix_path="$1"
|
||||
|
||||
if [ -z "$ds_prefix_path" ]; then
|
||||
rpm -ql scap-security-guide | grep "ssg-$(scapCommonGetDistroName)-ds.xml"
|
||||
else
|
||||
echo "${ds_prefix_path}/ssg-$(scapCommonGetDistroName)-ds.xml"
|
||||
fi
|
||||
}
|
||||
|
||||
scapCommonDS=$(scapCommonGetDSPath)
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapCommonIsProfileInDS
|
||||
|
||||
Tries to find a PROFILE in DS.
|
||||
Returns 0, if PROFILE is in DS. Otherwise returns 1.
|
||||
Usage:
|
||||
scapCommonIsProfileInDS <DS> <PROFILE> || rlLog "Profile is not in datastream"
|
||||
|
||||
=cut
|
||||
function scapCommonIsProfileInDS() {
|
||||
local datastream="$1"
|
||||
local profile="$2"
|
||||
|
||||
if [[ $profile != xccdf_org.ssgproject.content_profile_* ]]; then
|
||||
profile="xccdf_org.ssgproject.content_profile_"$profile
|
||||
fi
|
||||
|
||||
local query="string(//*[local-name()=\"Profile\"][@id=\"$profile\"]/*)"
|
||||
local result="$(xmllint --xpath "$query" $datastream)"
|
||||
|
||||
if [ -z "$result" ]; then
|
||||
rlLog "scapCommonIsProfileInDS: $profile profile is not in $datastream"
|
||||
return 1
|
||||
fi
|
||||
|
||||
rlLog "scapCommonIsProfileInDS: $profile profile is in $datastream"
|
||||
return 0
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapCommonIsRuleInProfile
|
||||
|
||||
Tries to find RULES in a PROFILE from DS. If PROFILE is 'all', then
|
||||
it will try to find the rules in datastream regardless of the profile.
|
||||
Returns 0, if all RULES are in PROFILE. Otherwise (rules not in profile,
|
||||
or profile not in ds) returns 1.
|
||||
Usage:
|
||||
scapCommonIsRuleInProfile <DS> <RULES> <PROFILE> || rlLog "Rules not in profile"
|
||||
|
||||
Note: Rule prefix can be used, e.g. "dconf_" - will be checked
|
||||
by "grep "xccdf_org.ssgproject.content_rule_dconf_" ds" or
|
||||
"xmllint --xpath ...[starts-with(@idref, rule)].. ds"
|
||||
=cut
|
||||
function scapCommonIsRuleInProfile() {
|
||||
local datastream="$1"
|
||||
local rules="$2"
|
||||
local profile="$3"
|
||||
local ret_val=0
|
||||
|
||||
if [[ $profile == all ]]; then
|
||||
for rule in ${rules}; do
|
||||
if [[ $rule != xccdf_org.ssgproject.content_rule_* ]]; then
|
||||
rule="xccdf_org.ssgproject.content_rule_"$rule
|
||||
fi
|
||||
if ! grep -q "$rule" "$datastream"; then
|
||||
rlLog "scapCommonIsRuleInProfile: $rule rule is not in $datastream"
|
||||
ret_val=1
|
||||
else
|
||||
rlLog "scapCommonIsRuleInProfile: $rule is in $profile profile from $datastream"
|
||||
fi
|
||||
done
|
||||
return $ret_val
|
||||
fi
|
||||
|
||||
if [[ $profile != xccdf_org.ssgproject.content_profile_* ]]; then
|
||||
profile="xccdf_org.ssgproject.content_profile_"$profile
|
||||
fi
|
||||
|
||||
scapCommonIsProfileInDS "$datastream" "$profile" || return 1
|
||||
local query=""
|
||||
for rule in ${rules}; do
|
||||
if [[ $rule != xccdf_org.ssgproject.content_rule_* ]]; then
|
||||
rule="xccdf_org.ssgproject.content_rule_"$rule
|
||||
fi
|
||||
query="count(//*[local-name()=\"Profile\"][@id=\"$profile\"]/*[local-name()=\"select\"][starts-with(@idref, \"$rule\")][@selected=\"true\"])"
|
||||
local result="$(xmllint --xpath "$query" $datastream)"
|
||||
if [ $result -eq 0 ]; then
|
||||
rlLog "scapCommonIsRuleInProfile: $rule is not in $profile profile from $datastream"
|
||||
ret_val=1
|
||||
else
|
||||
rlLog "scapCommonIsRuleInProfile: $rule is in $profile profile from $datastream"
|
||||
fi
|
||||
done
|
||||
|
||||
return $ret_val
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapCommonInstallAnsible
|
||||
|
||||
Installs Ansible packages needed by Ansible remediations shipped in the
|
||||
scap-security-guide package and returns 0 if installation is successful,
|
||||
otherwise returns 1.
|
||||
Usage:
|
||||
scapCommonInstallAnsible || rlDie "Failed to install Ansible"
|
||||
|
||||
=cut
|
||||
function scapCommonInstallAnsible() {
|
||||
if rlIsFedora; then
|
||||
rlRun "dnf install -y ansible" || return 1
|
||||
rlAssertRpm ansible
|
||||
elif rlIsRHEL 7 || rlIsCentOS 7; then
|
||||
if ! rpm -q epel-release &>/dev/null; then
|
||||
rlRun "yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
|
||||
fi
|
||||
rlRun "yum install --enablerepo=epel -y ansible" || return 1
|
||||
rlAssertRpm ansible
|
||||
else
|
||||
rlRun "dnf install -y ansible-core" || return 1
|
||||
rlAssertRpm ansible-core
|
||||
rlRun "dnf install -y rhc-worker-playbook" 0-255
|
||||
if [ $? -ne 0 ]; then
|
||||
rlLog "rhc-worker-playbook RPM not found, installing required collections from Ansible Galaxy"
|
||||
# ansible-galaxy does not support removal of collections through CLI.
|
||||
for i in $(seq 1 10); do
|
||||
local rv=0
|
||||
rlLog "Install required collections from Ansible Galaxy (attempt: $i)"
|
||||
rlRun "ansible-galaxy collection install community.general" 0-255 || rv=1
|
||||
rlRun "ansible-galaxy collection install ansible.posix" 0-255 || rv=1
|
||||
if [ $rv -eq 0 ]; then
|
||||
break
|
||||
else
|
||||
if [ $i -eq 10 ]; then
|
||||
rlFail "Failed to install required collections from Ansible Galaxy (attempt: $i)"
|
||||
return 1
|
||||
fi
|
||||
rlLogWarning "Failed to install required collections from Ansible Galaxy (attempt: $i)"
|
||||
rlLog "Waiting 1m before another attempt.."
|
||||
sleep 1m
|
||||
fi
|
||||
done
|
||||
rlRun "ansible-galaxy collection list -v" 0 "List installed Ansible collections"
|
||||
else
|
||||
rlAssertRpm rhc-worker-playbook
|
||||
rlRun "export ANSIBLE_COLLECTIONS_PATH=/usr/share/rhc-worker-playbook/ansible/collections/ansible_collections/" \
|
||||
0 "Export path to Ansible collections from rhc-worker-playbook RPM"
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
summary: Library with common functions for work with SCAP content.
|
||||
contact: Matus Marhefka <mmarhefk@redhat.com>
|
||||
component:
|
||||
- scap-security-guide
|
||||
framework: beakerlib
|
||||
require:
|
||||
- library(distribution/Cleanup)
|
||||
recommend:
|
||||
- scap-security-guide
|
||||
- libxml2
|
||||
|
|
@ -1,289 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
# library-prefix = scapRes
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
# Variables
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapResLibraryLoaded
|
||||
|
||||
Verification callback which will be called by rlImport after sourcing the library
|
||||
to make sure everything is all right. It makes sense to perform a basic sanity
|
||||
test and check that all required packages are installed.
|
||||
|
||||
Return 0 when the library is ready to serve.
|
||||
|
||||
=cut
|
||||
|
||||
scapResLibraryLoaded() {
|
||||
rlImport "scap-common-lib/scap-common" || rlDie "Failed to import scap-common library"
|
||||
return 0
|
||||
}
|
||||
|
||||
# The library dir so we know where to look for library files
|
||||
export scapResLibraryPath=$(realpath $(dirname ${BASH_SOURCE[0]}))
|
||||
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
# Functions
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head1 scapResIsRemediationImplemented
|
||||
Check if a rule has implemented remediation.
|
||||
If a remediation is implemented, return 0. Otherwise, return 1.
|
||||
Usage:
|
||||
scapResIsRemediationImplemented <RULE_ID> <REMEDIATION_TYPE> <DATASTREAM>
|
||||
|
||||
=cut
|
||||
|
||||
function scapResIsRemediationImplemented() {
|
||||
local rule="$1"
|
||||
local type="$2"
|
||||
local datastream="$3"
|
||||
local type_xpath=""
|
||||
|
||||
if [ "$type" == "bash" ]; then
|
||||
type_xpath="urn:xccdf:fix:script:sh"
|
||||
elif [ "$type" == "ansible" ]; then
|
||||
type_xpath="urn:xccdf:fix:script:ansible"
|
||||
fi
|
||||
|
||||
local remediation_text="$(xmllint --xpath "//*[local-name()='fix'][@id='${rule}'][@system='${type_xpath}']" "$datastream" 2>/dev/null)"
|
||||
|
||||
if [ -z "$remediation_text" ]; then
|
||||
return 1
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head1 scapResPrintResults
|
||||
Gets, waives, and prints results from the *-xccdf-results.xml file (<RESULTS>).
|
||||
If a <RESULT-VALUE> is defined, it will be used to get only specific results, e.g.
|
||||
only failed ones. You can specify remediation type via <REMEDIATION_TYPE> to check
|
||||
if they are implemented, default value is "bash".
|
||||
Usage:
|
||||
scapResPrintResults <RESULTS> <DATASTREAM> <DISTRO> <PROFILE> <RESULT-VALUE> <SERVER_WITH_GUI> <REMEDIATION_TYPE>
|
||||
|
||||
=cut
|
||||
|
||||
function scapResPrintResults() {
|
||||
if [ $# -lt 5 ]; then
|
||||
rlLogError "scapResPrintResults: Function requres 5 arguments"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local results_xml="$1"
|
||||
local datastream="$2"
|
||||
local distro="$3"
|
||||
local profile="$4"
|
||||
local result_value="$5"
|
||||
local server_with_gui="$6"
|
||||
local remediation_type=${7:-"bash"}
|
||||
local raw_results=""
|
||||
if [ -n "$result_value" ]; then
|
||||
local filter="//*[local-name()='rule-result'][*[local-name()='result' and text()='$result_value']]"
|
||||
raw_results="$(xmllint --xpath "$filter" "$results_xml" 2>/dev/null)"
|
||||
else
|
||||
raw_results="$(cat "$results_xml")"
|
||||
fi
|
||||
# Get only result parts, remove unnecessary XML marks, and at the end
|
||||
# format the output to the "RULE_ID - RESULT" format
|
||||
local results=$(echo "$raw_results" \
|
||||
| grep -oE "(<rule-result.*|<result>.*)" \
|
||||
| sed 's|.*idref="\([^"]*\)".*|\1|' \
|
||||
| sed 's|.*<result>\([^<]*\)<.*|\1|' \
|
||||
| sed 'N;s/^\(xccdf.*\)\n\(.*\)$/\1,\2/g')
|
||||
local waivers_file=""
|
||||
if [ "$distro" == "centos8" ]; then
|
||||
distro="rhel8"
|
||||
elif [ "$distro" == "cs9" ]; then
|
||||
distro="rhel9"
|
||||
fi
|
||||
if [ -n "$server_with_gui" ]; then
|
||||
# Workaround for STIG, because it has special profile for Server with GUI packages
|
||||
if [ "$profile" == "stig_gui" ]; then
|
||||
profile="stig"
|
||||
fi
|
||||
waivers_file="$scapResLibraryPath/rule_waivers/$distro/$profile-gui-$result_value"
|
||||
else
|
||||
waivers_file="$scapResLibraryPath/rule_waivers/$distro/$profile-$result_value"
|
||||
fi
|
||||
local waivers=""
|
||||
# If waivers file for the profile doesn't exist, we won't waive anything
|
||||
if [ -f "$waivers_file" ]; then
|
||||
rlLog "scapResPrintResults: using waivers from $waivers_file"
|
||||
else
|
||||
rlLog "scapResPrintResults: $result_value waivers file doesn't exist for this profile variant"
|
||||
fi
|
||||
|
||||
local to_be_waived=""
|
||||
while IFS= read -r rule_and_result; do
|
||||
if [ -z "$rule_and_result" ]; then
|
||||
continue
|
||||
fi
|
||||
local rule_id="$(echo $rule_and_result | cut -d "," -f1)"
|
||||
local rule_name="${rule_id#"xccdf_org.ssgproject.content_rule_"}"
|
||||
local rule_result="$(echo $rule_and_result | cut -d "," -f2)"
|
||||
# Check if the result should be waived. If so, waive it even when it passed but inform about it
|
||||
if [ -f "$waivers_file" ]; then
|
||||
to_be_waived="$(cat $waivers_file | grep "^$rule_name -")"
|
||||
if [ -n "$to_be_waived" ]; then
|
||||
local waive_rule="$(echo $to_be_waived | awk -F " - " '{print $1}')"
|
||||
local waive_reason="$(echo $to_be_waived | awk -F " - " '{print $2}')"
|
||||
rlLogInfo "scapResPrintResults: $rule_name - waived ($rule_result). Reason: $waive_reason"
|
||||
continue
|
||||
fi
|
||||
fi
|
||||
# Check if it has implemented remediation
|
||||
if ! scapResIsRemediationImplemented $rule_name $remediation_type $datastream; then
|
||||
rlLogInfo "scapResPrintResults: $rule_name - waived ($rule_result). Reason: $remediation_type remediation not implemented"
|
||||
continue
|
||||
fi
|
||||
printf "$rule_id - $rule_result\n"
|
||||
done <<< "$results"
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head2 scapResPrintBadResults
|
||||
|
||||
Prints 'fail', 'error', and 'unknown' results in the following format:
|
||||
|
||||
rule1 - result
|
||||
rule2 - result
|
||||
...
|
||||
|
||||
Usage:
|
||||
scapResPrintBadResults <RESULTS_XCCDF> <DATASTREAM> <DISTRO> <PROFILE> <SERVER_WITH_GUI> <REMEDIATION_TYPE>
|
||||
|
||||
Returns 0 and prints results on the stdout if an XML file with results exists,
|
||||
and distro and profile are defined, non-zero otherwise.
|
||||
|
||||
=cut
|
||||
|
||||
function scapResPrintBadResults() {
|
||||
if [ $# -lt 4 ]; then
|
||||
rlLogError "scapResPrintBadResults: Function requres 4 arguments"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local results_xml="$1"
|
||||
local datastream="$2"
|
||||
local distro="$3"
|
||||
local profile="${4#"xccdf_org.ssgproject.content_profile_"}"
|
||||
local server_with_gui="$5"
|
||||
local remediation_type="$6"
|
||||
|
||||
if [ ! -f "$results_xml" ] || [ -z "$distro" ] || [ -z "$profile" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "fail" "$server_with_gui" "$remediation_type"
|
||||
scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "error" "$server_with_gui" "$remediation_type"
|
||||
scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "unknown" "$server_with_gui" "$remediation_type"
|
||||
return 0
|
||||
}
|
||||
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head1 scapResAssertExists
|
||||
|
||||
Assert that a document has a specific number of occurrences of a string.
|
||||
The number of the occurrences can be filtered.
|
||||
Usage:
|
||||
scapResAssertExists <STRING> <DOCUMENT> <DATASTREAM> <DISTRO> <PROFILE> <SERVER_WITH_GUI> <KS_SPECIFIC_FILTER>
|
||||
|
||||
Returns 0 if no unexpected results are printed. Otherwise returns 1.
|
||||
|
||||
=cut
|
||||
|
||||
function scapResAssertExists() {
|
||||
if [ "$#" -lt 5 ]; then
|
||||
rlLogError "scapResAssertExists: Function requires at least 5 arguments!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local result_string="$1"
|
||||
local document="$2"
|
||||
local datastream="$3"
|
||||
local distro="$4"
|
||||
local profile="${5#"xccdf_org.ssgproject.content_profile_"}"
|
||||
local server_with_gui="$6"
|
||||
local kickstart_filter="$(echo "$7" | tr " " "\n")"
|
||||
|
||||
# Count result occurrences when verifying that results are in the document
|
||||
if [[ "$result_string" == "//"* ]]; then
|
||||
filter="//*[local-name()='TestResult']"
|
||||
local expected_occurrences=1
|
||||
local occurrences=$(xmllint --xpath "count($filter)" $document 2>/dev/null)
|
||||
if test $occurrences -eq $expected_occurrences; then
|
||||
return 0
|
||||
else
|
||||
rlLogFatal "scapResAssertExists: incorrect number ($occurrences) of test results in the $document document."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
local results="$(scapResPrintResults "$document" "$datastream" "$distro" "$profile" "$result_string" "$server_with_gui")"
|
||||
|
||||
local kickstart_results=""
|
||||
if [ -n "$results" ]; then
|
||||
# Let's do ssg-kickstart specific filtering
|
||||
while IFS= read -r result; do
|
||||
local rule_name="$(echo "$result" | awk -F " - " '{print $1}')"
|
||||
local to_be_waived="$(echo "$kickstart_filter" | grep "$rule_name$")"
|
||||
if [ -n "$to_be_waived" ]; then
|
||||
rlLogInfo "scapResAssertExists: $rule_name - waived ($result_string) by ssg-kickstart filter"
|
||||
else
|
||||
kickstart_results="$kickstart_results$result\n"
|
||||
fi
|
||||
done <<< "$results"
|
||||
if [ -n "$kickstart_results" ]; then
|
||||
printf "There are unexpected \"$result_string\" results:\n"
|
||||
printf "$kickstart_results"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
true <<'=cut'
|
||||
=pod
|
||||
|
||||
=head1 scapResPrintResultsCount
|
||||
Counter number of rule-result elements matching <STRING_TO_COUNT> string.
|
||||
Usage:
|
||||
scapResGetResultsCount <DOCUMENT_FILE> <STRING_TO_COUNT>
|
||||
|
||||
Returns count of the string in the document.
|
||||
|
||||
=cut
|
||||
|
||||
function scapResPrintResultsCount() {
|
||||
if [ -z "$1" ] || [ -z "$2" ]; then
|
||||
rlLogError "scapResPrintResultsCount: Function requires 2 arguments!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local document="$1"
|
||||
local filter="count(//*[local-name()='rule-result'][*[local-name()='result' and text()='$2']])"
|
||||
|
||||
xmllint --xpath "$filter" "$document"
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
summary: Tools for work with scap results
|
||||
contact: Milan Lysonek <mlysonek@redhat.com>
|
||||
component:
|
||||
- scap-security-guide
|
||||
framework: beakerlib
|
||||
require:
|
||||
- libxml2
|
||||
recommend:
|
||||
- url: https://src.fedoraproject.org/tests/scap-security-guide.git
|
||||
name: /Library/scap-common
|
||||
nick: scap-common-lib
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
grub2_password - to prevent hard-coded passwords, automatic remediation of this control is not available
|
||||
postfix_network_listening_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more
|
||||
|
|
@ -1 +0,0 @@
|
|||
postfix_network_listening_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
service_avahi-daemon_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more
|
||||
sysctl_net_ipv4_ip_forward - bz1825810
|
||||
|
|
@ -1 +0,0 @@
|
|||
sysctl_net_ipv4_ip_forward - bz1825810 (only in GUI)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
rpm_verify_permissions - bz1778661 abrt package
|
||||
rpm_verify_ownership - bz1778661 abrt package
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
rpm_verify_permissions - bz1778661 abrt package
|
||||
rpm_verify_ownership - bz1778661 abrt package
|
||||
|
|
@ -1 +0,0 @@
|
|||
sysctl_net_ipv4_ip_forward - bz1825810 (only in GUI)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
rpm_verify_ownership - /run/gdm has wrong ownership, bz1976233
|
||||
sysctl_net_ipv4_ip_forward - bz1825810
|
||||
|
|
@ -1 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
sysctl_net_ipv4_ip_forward - bz1929805
|
||||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated)
|
||||
|
|
@ -1 +0,0 @@
|
|||
no_tmux_in_shells - needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated)
|
||||
|
|
@ -1 +0,0 @@
|
|||
no_tmux_in_shells - needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
accounts_password_set_max_life_existing - bz2050232
|
||||
accounts_password_set_min_life_existing - bz2050232
|
||||
postfix_prevent_unrestricted_relay - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no postfix, during remediation phase postfix is installed, but this rule is not remediated)
|
||||
configure_bashrc_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
|
|
@ -1 +0,0 @@
|
|||
accounts_umask_interactive_users - openscap error due to scan of binary files bz2033246
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
accounts_password_set_max_life_existing - bz2050232
|
||||
accounts_password_set_min_life_existing - bz2050232
|
||||
sysctl_net_ipv4_ip_forward - bz1929805
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
sysctl_net_ipv4_conf_all_forwarding - https://github.com/ComplianceAsCode/content/issues/9316, the rule fails because of Libvirt enabling ipv4 forwarding, Libvirt is installed as part of GUI
|
||||
postfix_prevent_unrestricted_relay - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no postfix, during remediation phase postfix is installed, but this rule is not remediated)
|
||||
configure_bashrc_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_unix_remember - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating
|
||||
|
|
@ -1 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_pwhistory_remember_password_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating
|
||||
accounts_password_pam_pwhistory_remember_system_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
|
|
@ -1 +0,0 @@
|
|||
rpm_verify_permissions - bz1999586 /var/log/gdm
|
||||
|
|
@ -1 +0,0 @@
|
|||
rpm_verify_permissions - bz2069297 /var/lib/fprint
|
||||
|
|
@ -1 +0,0 @@
|
|||
rpm_verify_permissions - bz2069297 (wrong permissions on /var/lib/fprint)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
rpm_verify_permissions - bz2069297 /var/lib/fprint
|
||||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
accounts_password_set_max_life_existing - bz2050232
|
||||
accounts_password_set_min_life_existing - bz2050232
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
accounts_password_pam_pwhistory_remember_password_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating
|
||||
accounts_password_pam_pwhistory_remember_system_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells)
|
||||
accounts_password_set_max_life_existing - bz2050232
|
||||
accounts_password_set_min_life_existing - bz2050232
|
||||
configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated)
|
||||
set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan)
|
||||
|
|
@ -1,3 +1 @@
|
|||
# scap-security-guide
|
||||
|
||||
The scap-security-guide CI repository
|
||||
This repository was deprecated. The scap-security-guide tests are now implemented in [Contest](https://github.com/RHSecurityCompliance/contest/) repository.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue