|
 |
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
|
|
07cb6b |
index 8a28af022a7..02c69bddd27 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/ansible/shared.yml
|
|
|
07cb6b |
@@ -1,4 +1,4 @@
|
|
|
07cb6b |
-# platform = multi_platform_sle
|
|
|
07cb6b |
+# platform = multi_platform_all
|
|
|
07cb6b |
# reboot = false
|
|
|
07cb6b |
# strategy = restrict
|
|
|
07cb6b |
# complexity = high
|
|
|
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
|
|
07cb6b |
index a7182849548..db89a5e47a1 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/rule.yml
|
|
|
07cb6b |
@@ -31,6 +31,8 @@ rationale: |-
|
|
|
07cb6b |
of initiating changes, including upgrades and modifications.
|
|
|
07cb6b |
|
|
|
07cb6b |
identifiers:
|
|
|
07cb6b |
+ cce@rhel8: CCE-88692-9
|
|
|
07cb6b |
+ cce@rhel9: CCE-88693-7
|
|
|
07cb6b |
cce@sle12: CCE-83234-5
|
|
|
07cb6b |
cce@sle15: CCE-85753-2
|
|
|
07cb6b |
|
|
|
07cb6b |
@@ -40,6 +42,8 @@ references:
|
|
|
07cb6b |
disa: CCI-001499
|
|
|
07cb6b |
nerc-cip: CIP-003-8 R6
|
|
|
07cb6b |
nist: CM-5,CM-5(6),CM-5(6).1
|
|
|
07cb6b |
+ srg: SRG-OS-000259-GPOS-00100
|
|
|
07cb6b |
+ stigid@rhel8: RHEL-08-010331
|
|
|
07cb6b |
stigid@sle12: SLES-12-010872
|
|
|
07cb6b |
stigid@sle15: SLES-15-010352
|
|
|
07cb6b |
stigid@ubuntu2004: UBTU-20-010427
|
|
|
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
|
|
07cb6b |
index af078463b05..6e957c302ac 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/all_dirs_ok.pass.sh
|
|
|
07cb6b |
@@ -1,4 +1,4 @@
|
|
|
07cb6b |
-# platform = multi_platform_sle,multi_platform_ubuntu
|
|
|
07cb6b |
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
|
|
07cb6b |
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
|
|
07cb6b |
for dirPath in $DIRS; do
|
|
|
07cb6b |
find "$dirPath" -perm /022 -type d -exec chmod go-w '{}' \;
|
|
|
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
|
|
07cb6b |
index d58616bcafb..55ff9cebd4f 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/owner_only_writable_dir.pass.sh
|
|
|
07cb6b |
@@ -1,4 +1,4 @@
|
|
|
07cb6b |
-# platform = multi_platform_sle,multi_platform_ubuntu
|
|
|
07cb6b |
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
|
|
07cb6b |
DIRS="/lib /lib64 /usr/lib /usr/lib64"
|
|
|
07cb6b |
for dirPath in $DIRS; do
|
|
|
07cb6b |
chmod -R 755 "$dirPath"
|
|
|
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
|
|
07cb6b |
index 98d18cde3ea..c2b5b6bf029 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_lib.fail.sh
|
|
|
07cb6b |
@@ -1,4 +1,4 @@
|
|
|
07cb6b |
-# platform = multi_platform_sle,multi_platform_ubuntu
|
|
|
07cb6b |
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
|
|
07cb6b |
DIRS="/lib /lib64"
|
|
|
07cb6b |
for dirPath in $DIRS; do
|
|
|
07cb6b |
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
|
|
07cb6b |
diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
|
|
07cb6b |
index 6df6e2f8f9b..40e6c42c829 100644
|
|
|
07cb6b |
--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
|
|
07cb6b |
+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_permissions_library_dirs/tests/world_writable_dir_on_usr_lib.fail.sh
|
|
|
07cb6b |
@@ -1,4 +1,4 @@
|
|
|
07cb6b |
-# platform = multi_platform_sle,multi_platform_ubuntu
|
|
|
07cb6b |
+# platform = multi_platform_sle,multi_platform_ubuntu,multi_platform_rhel
|
|
|
07cb6b |
DIRS="/usr/lib /usr/lib64"
|
|
|
07cb6b |
for dirPath in $DIRS; do
|
|
|
07cb6b |
mkdir -p "$dirPath/testme" && chmod 777 "$dirPath/testme"
|
|
|
07cb6b |
diff --git a/products/rhel8/profiles/cjis.profile b/products/rhel8/profiles/cjis.profile
|
|
|
07cb6b |
index decba0087e8..920a55659fd 100644
|
|
|
07cb6b |
--- a/products/rhel8/profiles/cjis.profile
|
|
|
07cb6b |
+++ b/products/rhel8/profiles/cjis.profile
|
|
|
07cb6b |
@@ -77,6 +77,7 @@ selections:
|
|
|
07cb6b |
- accounts_password_pam_difok
|
|
|
07cb6b |
- accounts_max_concurrent_login_sessions
|
|
|
07cb6b |
- set_password_hashing_algorithm_systemauth
|
|
|
07cb6b |
+ - set_password_hashing_algorithm_passwordauth
|
|
|
07cb6b |
- set_password_hashing_algorithm_logindefs
|
|
|
07cb6b |
- set_password_hashing_algorithm_libuserconf
|
|
|
07cb6b |
- file_owner_etc_shadow
|
|
|
07cb6b |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
07cb6b |
index 04f158116ee..5d98b1c894e 100644
|
|
|
07cb6b |
--- a/products/rhel8/profiles/stig.profile
|
|
|
07cb6b |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
07cb6b |
@@ -228,6 +228,9 @@ selections:
|
|
|
07cb6b |
# RHEL-08-010330
|
|
|
07cb6b |
- file_permissions_library_dirs
|
|
|
07cb6b |
|
|
|
07cb6b |
+ # RHEL-08-010331
|
|
|
07cb6b |
+ - dir_permissions_library_dirs
|
|
|
07cb6b |
+
|
|
|
07cb6b |
# RHEL-08-010340
|
|
|
07cb6b |
- file_ownership_library_dirs
|
|
|
07cb6b |
|
|
|
07cb6b |
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
|
|
07cb6b |
index 8f79b22e3e4..2614504e9cd 100644
|
|
|
07cb6b |
--- a/products/rhel9/profiles/stig.profile
|
|
|
07cb6b |
+++ b/products/rhel9/profiles/stig.profile
|
|
|
07cb6b |
@@ -229,6 +229,9 @@ selections:
|
|
|
07cb6b |
# RHEL-08-010330
|
|
|
07cb6b |
- file_permissions_library_dirs
|
|
|
07cb6b |
|
|
|
07cb6b |
+ # RHEL-08-010331
|
|
|
07cb6b |
+ - dir_permissions_library_dirs
|
|
|
07cb6b |
+
|
|
|
07cb6b |
# RHEL-08-010340
|
|
|
07cb6b |
- file_ownership_library_dirs
|
|
|
07cb6b |
|
|
|
07cb6b |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
07cb6b |
index 3f6ec5e17c4..4a926bce5de 100644
|
|
|
07cb6b |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
07cb6b |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
07cb6b |
@@ -2645,8 +2645,6 @@ CCE-88688-7
|
|
|
07cb6b |
CCE-88689-5
|
|
|
07cb6b |
CCE-88690-3
|
|
|
07cb6b |
CCE-88691-1
|
|
|
07cb6b |
-CCE-88692-9
|
|
|
07cb6b |
-CCE-88693-7
|
|
|
07cb6b |
CCE-88694-5
|
|
|
07cb6b |
CCE-88695-2
|
|
|
07cb6b |
CCE-88696-0
|
|
|
07cb6b |
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
07cb6b |
index ed739e724f4..4df5c4a2e21 100644
|
|
|
07cb6b |
--- a/tests/data/profile_stability/rhel8/stig.profile
|
|
|
07cb6b |
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
07cb6b |
@@ -25,6 +25,7 @@ extends: null
|
|
|
07cb6b |
metadata:
|
|
|
07cb6b |
version: V1R4
|
|
|
07cb6b |
SMEs:
|
|
|
07cb6b |
+ - mab879
|
|
|
07cb6b |
- ggbecker
|
|
|
07cb6b |
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
|
|
07cb6b |
selections:
|
|
|
07cb6b |
@@ -180,6 +181,7 @@ selections:
|
|
|
07cb6b |
- dconf_gnome_screensaver_idle_delay
|
|
|
07cb6b |
- dconf_gnome_screensaver_lock_enabled
|
|
|
07cb6b |
- dir_group_ownership_library_dirs
|
|
|
07cb6b |
+- dir_permissions_library_dirs
|
|
|
07cb6b |
- dir_perms_world_writable_root_owned
|
|
|
07cb6b |
- dir_perms_world_writable_sticky_bits
|
|
|
07cb6b |
- directory_group_ownership_var_log_audit
|
|
|
07cb6b |
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
07cb6b |
index 56c3fcb9f59..98746158aed 100644
|
|
|
07cb6b |
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
07cb6b |
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
07cb6b |
@@ -36,6 +36,7 @@ extends: null
|
|
|
07cb6b |
metadata:
|
|
|
07cb6b |
version: V1R4
|
|
|
07cb6b |
SMEs:
|
|
|
07cb6b |
+ - mab879
|
|
|
07cb6b |
- ggbecker
|
|
|
07cb6b |
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
|
|
07cb6b |
selections:
|
|
|
07cb6b |
@@ -191,6 +192,7 @@ selections:
|
|
|
07cb6b |
- dconf_gnome_screensaver_idle_delay
|
|
|
07cb6b |
- dconf_gnome_screensaver_lock_enabled
|
|
|
07cb6b |
- dir_group_ownership_library_dirs
|
|
|
07cb6b |
+- dir_permissions_library_dirs
|
|
|
07cb6b |
- dir_perms_world_writable_root_owned
|
|
|
07cb6b |
- dir_perms_world_writable_sticky_bits
|
|
|
07cb6b |
- directory_group_ownership_var_log_audit
|