|
 |
9be3b2 |
From bd790153e02c1d1725f59f5d88c65c77eb1421e9 Mon Sep 17 00:00:00 2001
|
|
|
9be3b2 |
From: Gabriel Becker <ggasparb@redhat.com>
|
|
|
9be3b2 |
Date: Tue, 24 Aug 2021 12:48:46 +0200
|
|
|
9be3b2 |
Subject: [PATCH] Add a new selector for var_system_crypto_policy and use it
|
|
|
9be3b2 |
RHEL8 CIS.
|
|
|
9be3b2 |
|
|
|
9be3b2 |
This new selector is used to select explicit DEFAULT value in RHEL8 CIS
|
|
|
9be3b2 |
L1 profiles. The "default" selector cannot be selected and it causes
|
|
|
9be3b2 |
errors if used.
|
|
|
9be3b2 |
---
|
|
|
9be3b2 |
controls/cis_rhel8.yml | 2 +-
|
|
|
9be3b2 |
.../software/integrity/crypto/var_system_crypto_policy.var | 1 +
|
|
|
9be3b2 |
2 files changed, 2 insertions(+), 1 deletion(-)
|
|
|
9be3b2 |
|
|
|
9be3b2 |
diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml
|
|
|
9be3b2 |
index 29d972427cf..c0d3f5f40de 100644
|
|
|
9be3b2 |
--- a/controls/cis_rhel8.yml
|
|
|
9be3b2 |
+++ b/controls/cis_rhel8.yml
|
|
|
9be3b2 |
@@ -553,7 +553,7 @@ controls:
|
|
|
9be3b2 |
automated: yes
|
|
|
9be3b2 |
rules:
|
|
|
9be3b2 |
- configure_crypto_policy
|
|
|
9be3b2 |
- - var_system_crypto_policy=default
|
|
|
9be3b2 |
+ - var_system_crypto_policy=default_policy
|
|
|
9be3b2 |
|
|
|
9be3b2 |
# This rule works in conjunction with the configure_crypto_policy above.
|
|
|
9be3b2 |
# If a system is remediated to CIS Level 1, just the rule above will apply
|
|
|
9be3b2 |
diff --git a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
|
|
|
9be3b2 |
index ce301154a39..8b89848d122 100644
|
|
|
9be3b2 |
--- a/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
|
|
|
9be3b2 |
+++ b/linux_os/guide/system/software/integrity/crypto/var_system_crypto_policy.var
|
|
|
9be3b2 |
@@ -13,6 +13,7 @@ interactive: false
|
|
|
9be3b2 |
|
|
|
9be3b2 |
options:
|
|
|
9be3b2 |
default: DEFAULT
|
|
|
9be3b2 |
+ default_policy: DEFAULT
|
|
|
9be3b2 |
default_nosha1: "DEFAULT:NO-SHA1"
|
|
|
9be3b2 |
fips: FIPS
|
|
|
9be3b2 |
fips_ospp: "FIPS:OSPP"
|