ComplianceAsCode/content v0.1.75

Content 0.1.75

on GitHub

Important Highlights

• Add new product kylinserver10 (#12393)
• Create OL10 product (#12290)
• Update PCI-DSS control file for version 4.0.1 (#12435)

New Rules and Profiles

• [New Rule] Package kea removed (#12464)
• Add Ism profile for ol8 (#12493)
• Add Ism profile to OL9 (#12346)
• Create CIS rules for login banners (#12472)
• New rule tftp_uses_secure_mode_systemd (#12436)
• Update chrony rules for RHEL 10 (#12415)
• Update RHEL 9 STIG to V2R2 (#12551)

Updated Rules and Profiles

• Add to slmicro5 STIG pam pwhistory remember rule (#12255)
• Add CCI to package_postfix_installed (#12446)
• Add hipaa reference to sshd_use_directory_configuration (#12437)
• Add Ism profile for ol8 (#12493)
• Add Missing CPEs for RHEL10 (#12411)
• Add OL into jinja conditionals (#12461)
• Add package_rng-tools_installed to Fedora OSPP profile (#12244)
• Add RHEL 10 to Jinja if statements in firewalld_sshd_port_enabled (#12504)
• Add rule accounts_tmout to SLE Micro 5 STIG profile (#12524)
• Add rule chronyd_or_ntpd_set_maxpoll to SLE Micro 5 STIG profile (#12499)
• Add rule security_patches_up_to_date to SLE Micro 5 STIG profile (#12506)
• Add rules removed from RHEL8/RHEL9 profiles back to datastream (#12572)
• Add STIG rules for slmicro5 covering lib dirs root ownership (#12252)
• Add support for XCCDF variables into sshd_lineinfile template (#12251)
• Adjust FIPS enable_fips_mode for RHEL 10 (#12414)
• Adjust zipl_bls_entries_option template remedation to allow RHEL 10 (#12410)
• Change directory_permissions_etc_iptables to 700 (#12384)
• Change platform for rules related to partitions (#12562)
• Change platform in xwindows_runlevel_target (#12563)
• Consolidate ASCS RHEL profiles lastlog via sshd (#12249)
• convert more rules to sshd_lineinfile template (#12301)
• Create CIS rules for login banners (#12472)
• Fix a typo (#12275)
• Fix Audit related rules in RHEL 10 (#12359)
• Fix chronyd remote server filepath dir regex (#12312)
• fix for issue 11909 (#12318)
• Fix rules from the net-snmp component (#12391)
• grub2_vsyscall_argument should only be applicable to x86_64 (#12408)
• Hide CJIS profile for OL8 (#12357)
• Move daemon.* to /var/log/messages (#12433)
• Move package_rear_installed to related rules in e8 (#12456)
• Move RPM verify rules to use --restore (#12413)
• OCP4: Optimize ingress trusted ca remediation (#12268)
• Remove sshd_enable_warning_banner_net from HIPAA control file (#12534)
• Remove Outdated GNOME Rules in RHEL 10 (#12460)
• Remove package_talk-server_removed from RHEL 10 ANSSI (#12457)
• Remove rng-tools package rules from RHEL 10 (#12455)
• Remove sendmail from RHEL 10 profiles (#12452)
• Remove sshd_allow_only_protocol2 from RHEL 10 (#12390)
• Remove ypbind rules from RHEL10 (#12450)
• Remove ypserv from RHEL 10 profiles (#12451)
• Rename cron package to cronie for RHEL10 product (#12463)
• Review PCI-DSS requirements and rules for RHEL 10 (#12347)
• Review sshd_set_maxstartups rule (#12419)
• RHEL 10 HIPAA Profile Updates (#12345)
• RHEL 10 ISM_O: add back enable_fips_mode rule (#12449)
• RHEL 10 STIG Update (#12348)
• RHEL 10 tmux changes (#12383)
• RHEL 9 STIG: change remediated Networkmanager DNS mode (#12448)
• Slmicro5 stig add accounts and amount rules support (#12353)
• Slmicro5 stig add accounts and software rules support (#12364)
• Slmicro5 stig add rules selinux ssh and audit (#12316)
• Slmicro5 stig add services and software rules support (#12395)
• Stabilization: update audit_ospp_general with the latest content (#12592)
• Two CIS RHEL 9 enhancements (#12453)
• Ubuntu 22.04 STIG V2R1 changes (#12298)
• Update ANSSI BP28 profiles in rhel10 product (#12351)
• Update CCI Numbers due to new STIG/SRG GPOS (#12374)
• Update chrony rules for RHEL 10 (#12415)
• Update e8 profile for RHEL 10 (#12402)
• Update file_permissions_etc_chrony_keys (#12521)
• Update file_permissions_etc_chrony_keys to 640 (#12577)
• Update install_smartcard_packages for RHEL10 (#12459)
• update ism_o profiles for RHEL 10 (#12418)
• Update Jinja for package_rsync_removed for RHEL 10 (#12480)
• Update networkmanager_dns_mode for bootable containers (#12574)
• Update of the rule encrypt_partitions to support SLEM (#12343)
• Update ol7 stig (#12544)
• Update ol8 stig (#12545)
• Update OSPP control file (#12369)
• Update PCI-DSS control file for version 4.0.1 (#12435)
• update pwd length requirements for ism_o profile (#12431)
• Update RHEL 10 STIG Selections (#12376)
• Update RHEL 8 STIG due to rule removal (#12559)
• Update RHEL 8 STIG to V2R1 (#12550)
• Update RHEL 9 STIG to V2R1 (#12373)
• Update RHEL 9 STIG to V2R2 (#12551)
• Update rsyslog_cron_logging for bootable containers (#12575)
• Update service_rngd_enabled for RHEL 10 (#12243)
• Update SLE12 STIG version to V3R1 (#12580)
• Update SLE15 STIG version to V2R2 (#12570)
• Update various openshift assertions (#12443)
• Updated 6 rules 2 for sle micro (#12331)
• Updated packages related to openssh to support slem (#12338)
• Updated rules based on template service_disabled to support slem (#12337)
• Updates for Debian 12.6 (#12432)
• Updates related to the rule permissions_local_var_log_audit (#12356)
• Various Bug Fixes for Debian (#12084)

Removed Products

• Remove uos20 (#12248)

Changes in Remediations

• Add ansible remediation configure_bind_crypto_policy (#12325)
• Add ansible remediation to ensure_oracle_gpgkey_installed rule (#12323)
• Add ansible remediation to mount_option_home template (#12546)
• Add ansible remediaton for rsyslog_cron_logging rule (#12326)
• Add insensitive option to ansible_lineinfile macro (#12314)
• Add rule accounts_tmout to SLE Micro 5 STIG profile (#12524)
• Add rule security_patches_up_to_date to SLE Micro 5 STIG profile (#12506)
• Add rules to support remote offload of journal logs (#12479)
• Add support for XCCDF variables into sshd_lineinfile template (#12251)
• Added remediation and tests for the rule permissions_local_var_log_audit (#12360)
• Avoid tmpfiles override (#12218)
• Bring bash version in-sync with Ansible (#12398)
• Change flags cleanup (#12397)
• Create CIS rules for login banners (#12472)
• Don't autoremove packages on dnf package uninstall (#12389)
• Fix "unknown predicate -L" (#12305)
• Fix ansible remediation for audispd plugin UBTU-20-010216 (#12293)
• Skip users with ID above UID MAX on accounts_user_interactive_home_directory_defined (#12527)
• SLE15 related fixes in ntp and aide rules (#12548)
• Slmicro5 stig add accounts and software rules support (#12364)
• Update ansible remediation to harden_sshd_ciphers_openssh_conf_crypto_policy rule (#12324)
• Update bash remediation to fix bug into account_disable_inactivity* (#12134)
• Update remedation for firewalld_sshd_port_enabled (#12522)
• Update select rules for RHEL not to modify systemd units in /usr (#12486)
• Update SLE12 STIG version to V3R1 (#12580)
• Update SLE15 STIG version to V2R2 (#12570)

Changes in Checks

• Add "is_substring" variable to grub2_bootloader_argument template (#12308)
• Add OL9 into installed_OS_is_vendor_supported (#12333)
• Add rule accounts_tmout to SLE Micro 5 STIG profile (#12524)
• Add support for XCCDF variables into sshd_lineinfile template (#12251)
• convert more rules to sshd_lineinfile template (#12301)
• Create CIS rules for login banners (#12472)
• enhance the grub2_argument template to cover more use cases (#12375)
• Fix Audit related rules in RHEL 10 (#12359)
• Fix inventory_test_kernel_installed for SLE (#12516)
• Remove redundant sshd oval macro (#12532)
• Slmicro5 stig add accounts and software rules support (#12364)
• Update SLE15 STIG version to V2R2 (#12570)

Changes in the Infrastructure

• Add ocp4 pci dss references (#12309)
• Add setuptools python package to Fedora (#12565)
• Add setuptools to ocp4 build (#12566)
• Build empty OVAL (#12262)
• Build SCE content by default in rhel9 and rhel10 products (#12488)
• Enable templated SCE checks (#12445)
• Ensure that platforms is valid in Automatus tests (#12505)
• Fix issue with ambiguity of control product (#12454)
• Fix thin data streams with SCE (#12503)
• Fix validation with OpenSCAP 1.4 (#12303)
• Fix Windows for OpenSCAP 1.4.0 release (#12304)
• Introduce bootc remediation type (#12497)
• Move data stream component references (#12557)
• Remove template option (#12341)
• Stop SCAP content validation if not necessary (#12523)
• Update Fedora in install_vm.py to F41 (#12567)

Changes in the Test Suite

• add debian12 automatus workflow (#12128)
• Add OCP and RHCOS assertion files for 4.17 (#12266)
• Add RHEL Platform to Select AIDE Tests (#12483)
• add rule sysctl_kernel_modules_disabled to unselect_rules_list (#12354)
• Fix automatus podman (#12230)
• Fix Automatus Sanity (#12188)
• Improve Benchmark detection in Automatus (#12554)
• Introduce /rpmbuild-ctest-fedora CI for all Fedora versions (#12176)
• modify test scenarios of grub2_argument template to handle variables (#12428)
• Remove missing-references ctest (#12434)
• Remove template option (#12341)
• Review and update install_vm.py script (#12254)

Documentation

• Add UOS 20 removal to docs (#12257)
• Align release date calculation with documentation (#12240)
• Bump master version to 0.1.75 (#12235)
• Clarify stabilization dates process for more predictability (#12232)
• Include a section for fixed bugs in changelog (#12239)
• Remove old and broken tldp.org link (#12284)
• Update contributors for 0.1.75 (#12576)

Fixed Bugs

• Remove installed_OS_is_FIPS_certified from sshd_use_approved_ciphers (#12242)
• firewalld_sshd_port_enabled add zone to all connections (#12256)
• Create CIS rules for login banners (#12472)
• Disable sysctl_kernel_modules_disabled Ansible remediation (#12514)
• Explicitly state FindOpenSCAP cmake so it loads before it's used. (#12538)
• Extend mount_option_nodev_nonroot_local_partitions (#12270)
• Fix crypto policy selection rhel10 (#12466)
• Fix references section in the workshop artificial rule data. (#12261)
• Fix title of var_networkmanager_dns_mode (#12258)
• Remove enable_dracut_fips_module from RHEL 10 profiles (#12467)
• Two CIS RHEL 9 enhancements (#12453)
• Update Account Home Folder Rules (#12465)
• Update audit_rules_suid_privilege_function to use ExecStart instead of ExecStartPost (#12549)
• Update Regex for sudoers_explicit_command_args (#12350)
• Update SLE15 STIG version to V2R1 (#12269)