tests/scap-security-guide
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Waive rpcbind (beakerlib dependency) and world writable files (beakerlib issue)

Browse source
This commit is contained in:
Milan Lysonek 2023-01-26 10:13:09 +01:00
commit fd0fd94d12
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Sanity/ansible-machine-hardening/runtest.sh
View file

@ -18,11 +18,16 @@ TIMESTAMP_FILE="/test_timestamp"
# removed. The accounts_password_set_max_life_existing rule requires password
# change after hardening, skip it unselect mount_option as we can't remediate it.
# Rsync is required by tmt, don't remove it from machine.
# rpcbind is required by beakerlib.
# World writable files are created after reboot by beakerlib - remove when https://github.com/beakerlib/beakerlib/issues/149 is fixed.
EXTENDED_LIST="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed
xccdf_org.ssgproject.content_rule_package_gssproxy_removed
xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
xccdf_org.ssgproject.content_rule_mount_option_.*
xccdf_org.ssgproject.content_rule_package_rsync_removed"
xccdf_org.ssgproject.content_rule_package_rsync_removed
xccdf_org.ssgproject.content_rule_package_rpcbind_removed
xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable"
# On CentOS, exclude rules that check if OS is FIPS certified
if rlIsCentOS; then

7
Sanity/machine-hardening/runtest.sh
View file

@ -18,11 +18,16 @@ TIMESTAMP_FILE="/test_timestamp"
# removed. The accounts_password_set_max_life_existing rule requires password
# change after hardening, skip it unselect mount_option as we can't remediate it.
# Rsync is required by tmt, don't remove it from machine.
# rpcbind is required by beakerlib.
# World writable files are created after reboot by beakerlib - remove when https://github.com/beakerlib/beakerlib/issues/149 is fixed.
EXTENDED_LIST="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed
xccdf_org.ssgproject.content_rule_package_gssproxy_removed
xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
xccdf_org.ssgproject.content_rule_mount_option_.*
xccdf_org.ssgproject.content_rule_package_rsync_removed"
xccdf_org.ssgproject.content_rule_package_rsync_removed
xccdf_org.ssgproject.content_rule_package_rpcbind_removed
xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable"
# On CentOS, exclude rules that check if OS is FIPS certified
if rlIsCentOS; then