From d9309972e0008fc30ec97ffc8d914b3d275996e0 Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Thu, 11 Jul 2024 14:27:52 +0200 Subject: [PATCH] Deprecate repository. Remove last remaning files and update README where to find new scap-security-guide tests. --- Library/scap-common/lib.sh | 253 --------------- Library/scap-common/main.fmf | 10 - Library/scap-results/lib.sh | 289 ------------------ Library/scap-results/main.fmf | 11 - .../rule_waivers/rhel7/anssi_nt28_high-fail | 2 - .../rhel7/anssi_nt28_high-gui-fail | 1 - .../rhel7/cis_workstation_l2-gui-fail | 2 - .../rule_waivers/rhel7/cui-gui-fail | 1 - .../scap-results/rule_waivers/rhel7/e8-fail | 2 - .../rule_waivers/rhel7/e8-gui-fail | 2 - .../rule_waivers/rhel7/ospp-gui-fail | 1 - .../rule_waivers/rhel7/stig-gui-fail | 2 - .../rule_waivers/rhel8/anssi_bp28_high-fail | 1 - .../rhel8/anssi_bp28_high-gui-fail | 1 - .../scap-results/rule_waivers/rhel8/cis-fail | 4 - .../rhel8/cis_workstation_l2-fail | 4 - .../rhel8/cis_workstation_l2-gui-fail | 5 - .../scap-results/rule_waivers/rhel8/cui-fail | 4 - .../rule_waivers/rhel8/cui-gui-fail | 1 - .../scap-results/rule_waivers/rhel8/ospp-fail | 4 - .../rule_waivers/rhel8/ospp-gui-fail | 1 - .../rule_waivers/rhel8/pci-dss-fail | 2 - .../rule_waivers/rhel8/pci-dss-gui-fail | 2 - .../scap-results/rule_waivers/rhel8/stig-fail | 10 - .../rule_waivers/rhel8/stig-gui-error | 1 - .../rule_waivers/rhel8/stig-gui-fail | 12 - .../rule_waivers/rhel9/anssi_bp28_high-fail | 2 - .../rhel9/anssi_bp28_high-gui-fail | 1 - .../rule_waivers/rhel9/ccn_advanced-fail | 2 - .../scap-results/rule_waivers/rhel9/cis-fail | 6 - .../rhel9/cis_workstation_l2-fail | 4 - .../rhel9/cis_workstation_l2-gui-fail | 4 - .../scap-results/rule_waivers/rhel9/cui-fail | 4 - .../rule_waivers/rhel9/cui-gui-fail | 3 - .../rule_waivers/rhel9/e8-gui-fail | 1 - .../rule_waivers/rhel9/hipaa-gui-fail | 1 - .../rule_waivers/rhel9/ism_o-gui-fail | 1 - .../scap-results/rule_waivers/rhel9/ospp-fail | 4 - .../rule_waivers/rhel9/ospp-gui-fail | 3 - .../rule_waivers/rhel9/pci-dss-fail | 2 - .../rule_waivers/rhel9/pci-dss-gui-fail | 3 - .../scap-results/rule_waivers/rhel9/stig-fail | 10 - .../rule_waivers/rhel9/stig-gui-fail | 8 - README.md | 4 +- 44 files changed, 1 insertion(+), 690 deletions(-) delete mode 100644 Library/scap-common/lib.sh delete mode 100644 Library/scap-common/main.fmf delete mode 100644 Library/scap-results/lib.sh delete mode 100644 Library/scap-results/main.fmf delete mode 100644 Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/cis_workstation_l2-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/cui-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/e8-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/e8-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/ospp-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel7/stig-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/cis-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/cui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/cui-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/ospp-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/ospp-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/pci-dss-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/pci-dss-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/stig-fail delete mode 100644 Library/scap-results/rule_waivers/rhel8/stig-gui-error delete mode 100644 Library/scap-results/rule_waivers/rhel8/stig-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/ccn_advanced-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/cis-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/cui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/cui-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/e8-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/hipaa-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/ism_o-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/ospp-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/ospp-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/pci-dss-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/pci-dss-gui-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/stig-fail delete mode 100644 Library/scap-results/rule_waivers/rhel9/stig-gui-fail diff --git a/Library/scap-common/lib.sh b/Library/scap-common/lib.sh deleted file mode 100644 index a354631..0000000 --- a/Library/scap-common/lib.sh +++ /dev/null @@ -1,253 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# library-prefix = scapCommon -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - - -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Variables -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -true <<'=cut' -=pop - -=item scapCommonDISTRO - -Name of distribution which is set based on the host system. Variable is set by -scapCommonGetDistroName function. - -=item scapCommonDS - -Full path to datastream file from scap-security-guide package based -on the host system. Variable is set by scapCommonGetDSPath function. - -=back - -=cut - -scapCommonDISTRO="" -scapCommonDS="" - - -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Functions -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -scapCommonLibraryLoaded() { - return 0 -} - - -true <<'=cut' -=pod - -=head2 scapCommonGetDistroName - -Prints a name of the host distro. -Supported distros: - - Fedora - - RHEL - - CentOS Stream -Usage: - DISTRO=$(scapCommonGetDistroName) - -=cut -function scapCommonGetDistroName() { - if rlIsRHEL; then - echo "rhel$(rlGetDistroRelease)" - elif rlIsCentOS; then - if rlIsCentOS "<=8"; then - echo "centos$(rlGetDistroRelease)" - elif rlIsCentOS ">=9"; then - echo "cs$(rlGetDistroRelease)" - fi - else - echo "fedora" - fi -} - -scapCommonDISTRO=$(scapCommonGetDistroName) - - -true <<'=cut' -=pod - -=head2 scapCommonGetDSPath - -Prints a path to a datastream file from the scap-security-guide package based -on the host distro. Function accepts one optional argument DS_PREFIX_PATH - -a prefix directory path where a datastream for the host distro is located and -has a file name of "ssg-$(scapCommonGetDistroName)-ds.xml". -Supported distros: - - Fedora - - RHEL - - CentOS Stream -Usage: - DS=$(scapCommonGetDSPath) - or - DS=$(scapCommonGetDSPath ) - -=cut -function scapCommonGetDSPath() { - local ds_prefix_path="$1" - - if [ -z "$ds_prefix_path" ]; then - rpm -ql scap-security-guide | grep "ssg-$(scapCommonGetDistroName)-ds.xml" - else - echo "${ds_prefix_path}/ssg-$(scapCommonGetDistroName)-ds.xml" - fi -} - -scapCommonDS=$(scapCommonGetDSPath) - - -true <<'=cut' -=pod - -=head2 scapCommonIsProfileInDS - -Tries to find a PROFILE in DS. -Returns 0, if PROFILE is in DS. Otherwise returns 1. -Usage: - scapCommonIsProfileInDS || rlLog "Profile is not in datastream" - -=cut -function scapCommonIsProfileInDS() { - local datastream="$1" - local profile="$2" - - if [[ $profile != xccdf_org.ssgproject.content_profile_* ]]; then - profile="xccdf_org.ssgproject.content_profile_"$profile - fi - - local query="string(//*[local-name()=\"Profile\"][@id=\"$profile\"]/*)" - local result="$(xmllint --xpath "$query" $datastream)" - - if [ -z "$result" ]; then - rlLog "scapCommonIsProfileInDS: $profile profile is not in $datastream" - return 1 - fi - - rlLog "scapCommonIsProfileInDS: $profile profile is in $datastream" - return 0 -} - - -true <<'=cut' -=pod - -=head2 scapCommonIsRuleInProfile - -Tries to find RULES in a PROFILE from DS. If PROFILE is 'all', then -it will try to find the rules in datastream regardless of the profile. -Returns 0, if all RULES are in PROFILE. Otherwise (rules not in profile, -or profile not in ds) returns 1. -Usage: - scapCommonIsRuleInProfile || rlLog "Rules not in profile" - -Note: Rule prefix can be used, e.g. "dconf_" - will be checked -by "grep "xccdf_org.ssgproject.content_rule_dconf_" ds" or -"xmllint --xpath ...[starts-with(@idref, rule)].. ds" -=cut -function scapCommonIsRuleInProfile() { - local datastream="$1" - local rules="$2" - local profile="$3" - local ret_val=0 - - if [[ $profile == all ]]; then - for rule in ${rules}; do - if [[ $rule != xccdf_org.ssgproject.content_rule_* ]]; then - rule="xccdf_org.ssgproject.content_rule_"$rule - fi - if ! grep -q "$rule" "$datastream"; then - rlLog "scapCommonIsRuleInProfile: $rule rule is not in $datastream" - ret_val=1 - else - rlLog "scapCommonIsRuleInProfile: $rule is in $profile profile from $datastream" - fi - done - return $ret_val - fi - - if [[ $profile != xccdf_org.ssgproject.content_profile_* ]]; then - profile="xccdf_org.ssgproject.content_profile_"$profile - fi - - scapCommonIsProfileInDS "$datastream" "$profile" || return 1 - local query="" - for rule in ${rules}; do - if [[ $rule != xccdf_org.ssgproject.content_rule_* ]]; then - rule="xccdf_org.ssgproject.content_rule_"$rule - fi - query="count(//*[local-name()=\"Profile\"][@id=\"$profile\"]/*[local-name()=\"select\"][starts-with(@idref, \"$rule\")][@selected=\"true\"])" - local result="$(xmllint --xpath "$query" $datastream)" - if [ $result -eq 0 ]; then - rlLog "scapCommonIsRuleInProfile: $rule is not in $profile profile from $datastream" - ret_val=1 - else - rlLog "scapCommonIsRuleInProfile: $rule is in $profile profile from $datastream" - fi - done - - return $ret_val -} - - -true <<'=cut' -=pod - -=head2 scapCommonInstallAnsible - -Installs Ansible packages needed by Ansible remediations shipped in the -scap-security-guide package and returns 0 if installation is successful, -otherwise returns 1. -Usage: - scapCommonInstallAnsible || rlDie "Failed to install Ansible" - -=cut -function scapCommonInstallAnsible() { - if rlIsFedora; then - rlRun "dnf install -y ansible" || return 1 - rlAssertRpm ansible - elif rlIsRHEL 7 || rlIsCentOS 7; then - if ! rpm -q epel-release &>/dev/null; then - rlRun "yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm" - fi - rlRun "yum install --enablerepo=epel -y ansible" || return 1 - rlAssertRpm ansible - else - rlRun "dnf install -y ansible-core" || return 1 - rlAssertRpm ansible-core - rlRun "dnf install -y rhc-worker-playbook" 0-255 - if [ $? -ne 0 ]; then - rlLog "rhc-worker-playbook RPM not found, installing required collections from Ansible Galaxy" - # ansible-galaxy does not support removal of collections through CLI. - for i in $(seq 1 10); do - local rv=0 - rlLog "Install required collections from Ansible Galaxy (attempt: $i)" - rlRun "ansible-galaxy collection install community.general" 0-255 || rv=1 - rlRun "ansible-galaxy collection install ansible.posix" 0-255 || rv=1 - if [ $rv -eq 0 ]; then - break - else - if [ $i -eq 10 ]; then - rlFail "Failed to install required collections from Ansible Galaxy (attempt: $i)" - return 1 - fi - rlLogWarning "Failed to install required collections from Ansible Galaxy (attempt: $i)" - rlLog "Waiting 1m before another attempt.." - sleep 1m - fi - done - rlRun "ansible-galaxy collection list -v" 0 "List installed Ansible collections" - else - rlAssertRpm rhc-worker-playbook - rlRun "export ANSIBLE_COLLECTIONS_PATH=/usr/share/rhc-worker-playbook/ansible/collections/ansible_collections/" \ - 0 "Export path to Ansible collections from rhc-worker-playbook RPM" - fi - fi - return 0 -} diff --git a/Library/scap-common/main.fmf b/Library/scap-common/main.fmf deleted file mode 100644 index 10e0b64..0000000 --- a/Library/scap-common/main.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Library with common functions for work with SCAP content. -contact: Matus Marhefka -component: -- scap-security-guide -framework: beakerlib -require: -- library(distribution/Cleanup) -recommend: -- scap-security-guide -- libxml2 diff --git a/Library/scap-results/lib.sh b/Library/scap-results/lib.sh deleted file mode 100644 index 230154e..0000000 --- a/Library/scap-results/lib.sh +++ /dev/null @@ -1,289 +0,0 @@ -#!/bin/bash - -# library-prefix = scapRes -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Variables -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - - -true <<'=cut' -=pod - -=head2 scapResLibraryLoaded - -Verification callback which will be called by rlImport after sourcing the library -to make sure everything is all right. It makes sense to perform a basic sanity -test and check that all required packages are installed. - -Return 0 when the library is ready to serve. - -=cut - -scapResLibraryLoaded() { - rlImport "scap-common-lib/scap-common" || rlDie "Failed to import scap-common library" - return 0 -} - -# The library dir so we know where to look for library files -export scapResLibraryPath=$(realpath $(dirname ${BASH_SOURCE[0]})) - -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Functions -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -true <<'=cut' -=pod - -=head1 scapResIsRemediationImplemented -Check if a rule has implemented remediation. -If a remediation is implemented, return 0. Otherwise, return 1. -Usage: - scapResIsRemediationImplemented - -=cut - -function scapResIsRemediationImplemented() { - local rule="$1" - local type="$2" - local datastream="$3" - local type_xpath="" - - if [ "$type" == "bash" ]; then - type_xpath="urn:xccdf:fix:script:sh" - elif [ "$type" == "ansible" ]; then - type_xpath="urn:xccdf:fix:script:ansible" - fi - - local remediation_text="$(xmllint --xpath "//*[local-name()='fix'][@id='${rule}'][@system='${type_xpath}']" "$datastream" 2>/dev/null)" - - if [ -z "$remediation_text" ]; then - return 1 - else - return 0 - fi -} - - -true <<'=cut' -=pod - -=head1 scapResPrintResults -Gets, waives, and prints results from the *-xccdf-results.xml file (). -If a is defined, it will be used to get only specific results, e.g. -only failed ones. You can specify remediation type via to check -if they are implemented, default value is "bash". -Usage: - scapResPrintResults - -=cut - -function scapResPrintResults() { - if [ $# -lt 5 ]; then - rlLogError "scapResPrintResults: Function requres 5 arguments" - return 1 - fi - - local results_xml="$1" - local datastream="$2" - local distro="$3" - local profile="$4" - local result_value="$5" - local server_with_gui="$6" - local remediation_type=${7:-"bash"} - local raw_results="" - if [ -n "$result_value" ]; then - local filter="//*[local-name()='rule-result'][*[local-name()='result' and text()='$result_value']]" - raw_results="$(xmllint --xpath "$filter" "$results_xml" 2>/dev/null)" - else - raw_results="$(cat "$results_xml")" - fi - # Get only result parts, remove unnecessary XML marks, and at the end - # format the output to the "RULE_ID - RESULT" format - local results=$(echo "$raw_results" \ - | grep -oE "(.*)" \ - | sed 's|.*idref="\([^"]*\)".*|\1|' \ - | sed 's|.*\([^<]*\)<.*|\1|' \ - | sed 'N;s/^\(xccdf.*\)\n\(.*\)$/\1,\2/g') - local waivers_file="" - if [ "$distro" == "centos8" ]; then - distro="rhel8" - elif [ "$distro" == "cs9" ]; then - distro="rhel9" - fi - if [ -n "$server_with_gui" ]; then - # Workaround for STIG, because it has special profile for Server with GUI packages - if [ "$profile" == "stig_gui" ]; then - profile="stig" - fi - waivers_file="$scapResLibraryPath/rule_waivers/$distro/$profile-gui-$result_value" - else - waivers_file="$scapResLibraryPath/rule_waivers/$distro/$profile-$result_value" - fi - local waivers="" - # If waivers file for the profile doesn't exist, we won't waive anything - if [ -f "$waivers_file" ]; then - rlLog "scapResPrintResults: using waivers from $waivers_file" - else - rlLog "scapResPrintResults: $result_value waivers file doesn't exist for this profile variant" - fi - - local to_be_waived="" - while IFS= read -r rule_and_result; do - if [ -z "$rule_and_result" ]; then - continue - fi - local rule_id="$(echo $rule_and_result | cut -d "," -f1)" - local rule_name="${rule_id#"xccdf_org.ssgproject.content_rule_"}" - local rule_result="$(echo $rule_and_result | cut -d "," -f2)" - # Check if the result should be waived. If so, waive it even when it passed but inform about it - if [ -f "$waivers_file" ]; then - to_be_waived="$(cat $waivers_file | grep "^$rule_name -")" - if [ -n "$to_be_waived" ]; then - local waive_rule="$(echo $to_be_waived | awk -F " - " '{print $1}')" - local waive_reason="$(echo $to_be_waived | awk -F " - " '{print $2}')" - rlLogInfo "scapResPrintResults: $rule_name - waived ($rule_result). Reason: $waive_reason" - continue - fi - fi - # Check if it has implemented remediation - if ! scapResIsRemediationImplemented $rule_name $remediation_type $datastream; then - rlLogInfo "scapResPrintResults: $rule_name - waived ($rule_result). Reason: $remediation_type remediation not implemented" - continue - fi - printf "$rule_id - $rule_result\n" - done <<< "$results" -} - - -true <<'=cut' -=pod - -=head2 scapResPrintBadResults - -Prints 'fail', 'error', and 'unknown' results in the following format: - - rule1 - result - rule2 - result - ... - -Usage: - scapResPrintBadResults - -Returns 0 and prints results on the stdout if an XML file with results exists, -and distro and profile are defined, non-zero otherwise. - -=cut - -function scapResPrintBadResults() { - if [ $# -lt 4 ]; then - rlLogError "scapResPrintBadResults: Function requres 4 arguments" - return 1 - fi - - local results_xml="$1" - local datastream="$2" - local distro="$3" - local profile="${4#"xccdf_org.ssgproject.content_profile_"}" - local server_with_gui="$5" - local remediation_type="$6" - - if [ ! -f "$results_xml" ] || [ -z "$distro" ] || [ -z "$profile" ]; then - return 1 - fi - - scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "fail" "$server_with_gui" "$remediation_type" - scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "error" "$server_with_gui" "$remediation_type" - scapResPrintResults "$results_xml" "$datastream" "$distro" "$profile" "unknown" "$server_with_gui" "$remediation_type" - return 0 -} - - -true <<'=cut' -=pod - -=head1 scapResAssertExists - -Assert that a document has a specific number of occurrences of a string. -The number of the occurrences can be filtered. -Usage: - scapResAssertExists - -Returns 0 if no unexpected results are printed. Otherwise returns 1. - -=cut - -function scapResAssertExists() { - if [ "$#" -lt 5 ]; then - rlLogError "scapResAssertExists: Function requires at least 5 arguments!" - return 1 - fi - - local result_string="$1" - local document="$2" - local datastream="$3" - local distro="$4" - local profile="${5#"xccdf_org.ssgproject.content_profile_"}" - local server_with_gui="$6" - local kickstart_filter="$(echo "$7" | tr " " "\n")" - - # Count result occurrences when verifying that results are in the document - if [[ "$result_string" == "//"* ]]; then - filter="//*[local-name()='TestResult']" - local expected_occurrences=1 - local occurrences=$(xmllint --xpath "count($filter)" $document 2>/dev/null) - if test $occurrences -eq $expected_occurrences; then - return 0 - else - rlLogFatal "scapResAssertExists: incorrect number ($occurrences) of test results in the $document document." - return 1 - fi - fi - - local results="$(scapResPrintResults "$document" "$datastream" "$distro" "$profile" "$result_string" "$server_with_gui")" - - local kickstart_results="" - if [ -n "$results" ]; then - # Let's do ssg-kickstart specific filtering - while IFS= read -r result; do - local rule_name="$(echo "$result" | awk -F " - " '{print $1}')" - local to_be_waived="$(echo "$kickstart_filter" | grep "$rule_name$")" - if [ -n "$to_be_waived" ]; then - rlLogInfo "scapResAssertExists: $rule_name - waived ($result_string) by ssg-kickstart filter" - else - kickstart_results="$kickstart_results$result\n" - fi - done <<< "$results" - if [ -n "$kickstart_results" ]; then - printf "There are unexpected \"$result_string\" results:\n" - printf "$kickstart_results" - return 1 - fi - fi - - return 0 -} - -true <<'=cut' -=pod - -=head1 scapResPrintResultsCount -Counter number of rule-result elements matching string. -Usage: - scapResGetResultsCount - -Returns count of the string in the document. - -=cut - -function scapResPrintResultsCount() { - if [ -z "$1" ] || [ -z "$2" ]; then - rlLogError "scapResPrintResultsCount: Function requires 2 arguments!" - return 1 - fi - - local document="$1" - local filter="count(//*[local-name()='rule-result'][*[local-name()='result' and text()='$2']])" - - xmllint --xpath "$filter" "$document" -} diff --git a/Library/scap-results/main.fmf b/Library/scap-results/main.fmf deleted file mode 100644 index 43a8833..0000000 --- a/Library/scap-results/main.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: Tools for work with scap results -contact: Milan Lysonek -component: -- scap-security-guide -framework: beakerlib -require: -- libxml2 -recommend: -- url: https://src.fedoraproject.org/tests/scap-security-guide.git - name: /Library/scap-common - nick: scap-common-lib diff --git a/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-fail b/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-fail deleted file mode 100644 index 224e8b0..0000000 --- a/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-fail +++ /dev/null @@ -1,2 +0,0 @@ -grub2_password - to prevent hard-coded passwords, automatic remediation of this control is not available -postfix_network_listening_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more diff --git a/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-gui-fail b/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-gui-fail deleted file mode 100644 index 349e4c4..0000000 --- a/Library/scap-results/rule_waivers/rhel7/anssi_nt28_high-gui-fail +++ /dev/null @@ -1 +0,0 @@ -postfix_network_listening_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more diff --git a/Library/scap-results/rule_waivers/rhel7/cis_workstation_l2-gui-fail b/Library/scap-results/rule_waivers/rhel7/cis_workstation_l2-gui-fail deleted file mode 100644 index 8a390be..0000000 --- a/Library/scap-results/rule_waivers/rhel7/cis_workstation_l2-gui-fail +++ /dev/null @@ -1,2 +0,0 @@ -service_avahi-daemon_disabled - bz1828871, won't be fixed in RHEL7 but can be fixed by running remediation once more -sysctl_net_ipv4_ip_forward - bz1825810 diff --git a/Library/scap-results/rule_waivers/rhel7/cui-gui-fail b/Library/scap-results/rule_waivers/rhel7/cui-gui-fail deleted file mode 100644 index 1e2cdc0..0000000 --- a/Library/scap-results/rule_waivers/rhel7/cui-gui-fail +++ /dev/null @@ -1 +0,0 @@ -sysctl_net_ipv4_ip_forward - bz1825810 (only in GUI) diff --git a/Library/scap-results/rule_waivers/rhel7/e8-fail b/Library/scap-results/rule_waivers/rhel7/e8-fail deleted file mode 100644 index c10b7f5..0000000 --- a/Library/scap-results/rule_waivers/rhel7/e8-fail +++ /dev/null @@ -1,2 +0,0 @@ -rpm_verify_permissions - bz1778661 abrt package -rpm_verify_ownership - bz1778661 abrt package diff --git a/Library/scap-results/rule_waivers/rhel7/e8-gui-fail b/Library/scap-results/rule_waivers/rhel7/e8-gui-fail deleted file mode 100644 index c10b7f5..0000000 --- a/Library/scap-results/rule_waivers/rhel7/e8-gui-fail +++ /dev/null @@ -1,2 +0,0 @@ -rpm_verify_permissions - bz1778661 abrt package -rpm_verify_ownership - bz1778661 abrt package diff --git a/Library/scap-results/rule_waivers/rhel7/ospp-gui-fail b/Library/scap-results/rule_waivers/rhel7/ospp-gui-fail deleted file mode 100644 index 1e2cdc0..0000000 --- a/Library/scap-results/rule_waivers/rhel7/ospp-gui-fail +++ /dev/null @@ -1 +0,0 @@ -sysctl_net_ipv4_ip_forward - bz1825810 (only in GUI) diff --git a/Library/scap-results/rule_waivers/rhel7/stig-gui-fail b/Library/scap-results/rule_waivers/rhel7/stig-gui-fail deleted file mode 100644 index 5f29777..0000000 --- a/Library/scap-results/rule_waivers/rhel7/stig-gui-fail +++ /dev/null @@ -1,2 +0,0 @@ -rpm_verify_ownership - /run/gdm has wrong ownership, bz1976233 -sysctl_net_ipv4_ip_forward - bz1825810 diff --git a/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-fail b/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-fail deleted file mode 100644 index 2a63964..0000000 --- a/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-fail +++ /dev/null @@ -1 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-gui-fail b/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-gui-fail deleted file mode 100644 index 2a63964..0000000 --- a/Library/scap-results/rule_waivers/rhel8/anssi_bp28_high-gui-fail +++ /dev/null @@ -1 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel8/cis-fail b/Library/scap-results/rule_waivers/rhel8/cis-fail deleted file mode 100644 index 4a27b47..0000000 --- a/Library/scap-results/rule_waivers/rhel8/cis-fail +++ /dev/null @@ -1,4 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-fail b/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-fail deleted file mode 100644 index 4a27b47..0000000 --- a/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-fail +++ /dev/null @@ -1,4 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-gui-fail b/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-gui-fail deleted file mode 100644 index 0c6a72c..0000000 --- a/Library/scap-results/rule_waivers/rhel8/cis_workstation_l2-gui-fail +++ /dev/null @@ -1,5 +0,0 @@ -sysctl_net_ipv4_ip_forward - bz1929805 -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel8/cui-fail b/Library/scap-results/rule_waivers/rhel8/cui-fail deleted file mode 100644 index 127a38b..0000000 --- a/Library/scap-results/rule_waivers/rhel8/cui-fail +++ /dev/null @@ -1,4 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel8/cui-gui-fail b/Library/scap-results/rule_waivers/rhel8/cui-gui-fail deleted file mode 100644 index 23bd006..0000000 --- a/Library/scap-results/rule_waivers/rhel8/cui-gui-fail +++ /dev/null @@ -1 +0,0 @@ -no_tmux_in_shells - needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) diff --git a/Library/scap-results/rule_waivers/rhel8/ospp-fail b/Library/scap-results/rule_waivers/rhel8/ospp-fail deleted file mode 100644 index 127a38b..0000000 --- a/Library/scap-results/rule_waivers/rhel8/ospp-fail +++ /dev/null @@ -1,4 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel8/ospp-gui-fail b/Library/scap-results/rule_waivers/rhel8/ospp-gui-fail deleted file mode 100644 index 23bd006..0000000 --- a/Library/scap-results/rule_waivers/rhel8/ospp-gui-fail +++ /dev/null @@ -1 +0,0 @@ -no_tmux_in_shells - needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) diff --git a/Library/scap-results/rule_waivers/rhel8/pci-dss-fail b/Library/scap-results/rule_waivers/rhel8/pci-dss-fail deleted file mode 100644 index 9d3dd30..0000000 --- a/Library/scap-results/rule_waivers/rhel8/pci-dss-fail +++ /dev/null @@ -1,2 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel8/pci-dss-gui-fail b/Library/scap-results/rule_waivers/rhel8/pci-dss-gui-fail deleted file mode 100644 index 9d3dd30..0000000 --- a/Library/scap-results/rule_waivers/rhel8/pci-dss-gui-fail +++ /dev/null @@ -1,2 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel8/stig-fail b/Library/scap-results/rule_waivers/rhel8/stig-fail deleted file mode 100644 index 0ac17b3..0000000 --- a/Library/scap-results/rule_waivers/rhel8/stig-fail +++ /dev/null @@ -1,10 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -accounts_password_set_max_life_existing - bz2050232 -accounts_password_set_min_life_existing - bz2050232 -postfix_prevent_unrestricted_relay - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no postfix, during remediation phase postfix is installed, but this rule is not remediated) -configure_bashrc_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) diff --git a/Library/scap-results/rule_waivers/rhel8/stig-gui-error b/Library/scap-results/rule_waivers/rhel8/stig-gui-error deleted file mode 100644 index 15992da..0000000 --- a/Library/scap-results/rule_waivers/rhel8/stig-gui-error +++ /dev/null @@ -1 +0,0 @@ -accounts_umask_interactive_users - openscap error due to scan of binary files bz2033246 diff --git a/Library/scap-results/rule_waivers/rhel8/stig-gui-fail b/Library/scap-results/rule_waivers/rhel8/stig-gui-fail deleted file mode 100644 index e3e70a3..0000000 --- a/Library/scap-results/rule_waivers/rhel8/stig-gui-fail +++ /dev/null @@ -1,12 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -accounts_password_set_max_life_existing - bz2050232 -accounts_password_set_min_life_existing - bz2050232 -sysctl_net_ipv4_ip_forward - bz1929805 -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated) -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -sysctl_net_ipv4_conf_all_forwarding - https://github.com/ComplianceAsCode/content/issues/9316, the rule fails because of Libvirt enabling ipv4 forwarding, Libvirt is installed as part of GUI -postfix_prevent_unrestricted_relay - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no postfix, during remediation phase postfix is installed, but this rule is not remediated) -configure_bashrc_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) diff --git a/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-fail b/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-fail deleted file mode 100644 index f4794f3..0000000 --- a/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-fail +++ /dev/null @@ -1,2 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_unix_remember - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating diff --git a/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-gui-fail b/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-gui-fail deleted file mode 100644 index 2a63964..0000000 --- a/Library/scap-results/rule_waivers/rhel9/anssi_bp28_high-gui-fail +++ /dev/null @@ -1 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel9/ccn_advanced-fail b/Library/scap-results/rule_waivers/rhel9/ccn_advanced-fail deleted file mode 100644 index 0a338ec..0000000 --- a/Library/scap-results/rule_waivers/rhel9/ccn_advanced-fail +++ /dev/null @@ -1,2 +0,0 @@ -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel9/cis-fail b/Library/scap-results/rule_waivers/rhel9/cis-fail deleted file mode 100644 index 02c0e87..0000000 --- a/Library/scap-results/rule_waivers/rhel9/cis-fail +++ /dev/null @@ -1,6 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_pwhistory_remember_password_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating -accounts_password_pam_pwhistory_remember_system_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-fail b/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-fail deleted file mode 100644 index 4a27b47..0000000 --- a/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-fail +++ /dev/null @@ -1,4 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-gui-fail b/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-gui-fail deleted file mode 100644 index 4a27b47..0000000 --- a/Library/scap-results/rule_waivers/rhel9/cis_workstation_l2-gui-fail +++ /dev/null @@ -1,4 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -service_nftables_disabled - https://github.com/ComplianceAsCode/content/issues/10424 (nftables service is not seen during first scan) diff --git a/Library/scap-results/rule_waivers/rhel9/cui-fail b/Library/scap-results/rule_waivers/rhel9/cui-fail deleted file mode 100644 index 127a38b..0000000 --- a/Library/scap-results/rule_waivers/rhel9/cui-fail +++ /dev/null @@ -1,4 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel9/cui-gui-fail b/Library/scap-results/rule_waivers/rhel9/cui-gui-fail deleted file mode 100644 index abb1cd9..0000000 --- a/Library/scap-results/rule_waivers/rhel9/cui-gui-fail +++ /dev/null @@ -1,3 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because bashrc was not configured with tmux) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel9/e8-gui-fail b/Library/scap-results/rule_waivers/rhel9/e8-gui-fail deleted file mode 100644 index 2aeb2f7..0000000 --- a/Library/scap-results/rule_waivers/rhel9/e8-gui-fail +++ /dev/null @@ -1 +0,0 @@ -rpm_verify_permissions - bz1999586 /var/log/gdm diff --git a/Library/scap-results/rule_waivers/rhel9/hipaa-gui-fail b/Library/scap-results/rule_waivers/rhel9/hipaa-gui-fail deleted file mode 100644 index 588b660..0000000 --- a/Library/scap-results/rule_waivers/rhel9/hipaa-gui-fail +++ /dev/null @@ -1 +0,0 @@ -rpm_verify_permissions - bz2069297 /var/lib/fprint diff --git a/Library/scap-results/rule_waivers/rhel9/ism_o-gui-fail b/Library/scap-results/rule_waivers/rhel9/ism_o-gui-fail deleted file mode 100644 index fc65cda..0000000 --- a/Library/scap-results/rule_waivers/rhel9/ism_o-gui-fail +++ /dev/null @@ -1 +0,0 @@ -rpm_verify_permissions - bz2069297 (wrong permissions on /var/lib/fprint) diff --git a/Library/scap-results/rule_waivers/rhel9/ospp-fail b/Library/scap-results/rule_waivers/rhel9/ospp-fail deleted file mode 100644 index 165836b..0000000 --- a/Library/scap-results/rule_waivers/rhel9/ospp-fail +++ /dev/null @@ -1,4 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated) -zipl_bootmap_is_up_to_date - https://github.com/openscap/openscap/issues/1880, needs to be remediated once more (passes in initial scan, during remediation phase other zipl rules break it, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel9/ospp-gui-fail b/Library/scap-results/rule_waivers/rhel9/ospp-gui-fail deleted file mode 100644 index 9d457e1..0000000 --- a/Library/scap-results/rule_waivers/rhel9/ospp-gui-fail +++ /dev/null @@ -1,3 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated) diff --git a/Library/scap-results/rule_waivers/rhel9/pci-dss-fail b/Library/scap-results/rule_waivers/rhel9/pci-dss-fail deleted file mode 100644 index 9d3dd30..0000000 --- a/Library/scap-results/rule_waivers/rhel9/pci-dss-fail +++ /dev/null @@ -1,2 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel9/pci-dss-gui-fail b/Library/scap-results/rule_waivers/rhel9/pci-dss-gui-fail deleted file mode 100644 index d596a2a..0000000 --- a/Library/scap-results/rule_waivers/rhel9/pci-dss-gui-fail +++ /dev/null @@ -1,3 +0,0 @@ -rpm_verify_permissions - bz2069297 /var/lib/fprint -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/Library/scap-results/rule_waivers/rhel9/stig-fail b/Library/scap-results/rule_waivers/rhel9/stig-fail deleted file mode 100644 index a9b2f96..0000000 --- a/Library/scap-results/rule_waivers/rhel9/stig-fail +++ /dev/null @@ -1,10 +0,0 @@ -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -accounts_password_set_max_life_existing - bz2050232 -accounts_password_set_min_life_existing - bz2050232 -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated) -accounts_password_pam_pwhistory_remember_password_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating -accounts_password_pam_pwhistory_remember_system_auth - TEMPORARY WAIVER, the rule must be investigated and clarified what's going on. Waiving now because it blocks gating diff --git a/Library/scap-results/rule_waivers/rhel9/stig-gui-fail b/Library/scap-results/rule_waivers/rhel9/stig-gui-fail deleted file mode 100644 index e2d5181..0000000 --- a/Library/scap-results/rule_waivers/rhel9/stig-gui-fail +++ /dev/null @@ -1,8 +0,0 @@ -no_tmux_in_shells - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (passes in initial scan because of no tmux, during remediation phase tmux is installed, fails during the final scan because the tmux was added to shells) -accounts_password_set_max_life_existing - bz2050232 -accounts_password_set_min_life_existing - bz2050232 -configure_usbguard_auditbackend - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no usbguard, during remediation phase usbguard is installed, but this rule is not remediated) -configure_bashrc_exec_tmux - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (notapplicable in initial scan because of no tmux, during remediation phase usbguard is installed, but this rule is not remediated) -set_password_hashing_algorithm_systemauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -set_password_hashing_algorithm_passwordauth - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) -accounts_password_pam_retry - https://github.com/OpenSCAP/openscap/issues/1880, needs to be remediated once more (pass in initial scan, enable_authselect breaks it, but this rule is not remediated as it passed in initial scan) diff --git a/README.md b/README.md index b310338..c2fa1b2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1 @@ -# scap-security-guide - -The scap-security-guide CI repository \ No newline at end of file +This repository was deprecated. The scap-security-guide tests are now implemented in [Contest](https://github.com/RHSecurityCompliance/contest/) repository.