Repository navigation
Conversation
|
Skipping CI for Draft Pull Request. |
macko1
force-pushed
the
rhel10_stig_v1r2_to_v1r3
branch
from
October 20, 2026 21:57
b021e31 to
53eaae7
Compare
macko1
commented
Oct 20, 2026
Contributor
|
This datastream diff is auto generated by the check Click here to see the trimmed diffOCIL for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
+++ ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
@@ -1,6 +1,7 @@
To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
/etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
.include /etc/crypto-policies/back-ends/opensslcnf.config directive:
+
$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
Is it the case that the OpenSSL config file doesn't contain the whole section,
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -6,7 +6,9 @@
OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
+
OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
+
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories' differs.
--- xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories
+++ xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories
@@ -24,6 +24,8 @@
option: gpgcheck
value: '1'
no_extra_spaces: true
+ owner: root
+ mode: u=rw,g=r,o=r
loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
if repo_grep_results is not skipped else [] }}'
when: repo_grep_results is not skipped
New content has different text for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction'.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -11,7 +11,9 @@
To configure the system to ignore the CtrlAltDelBurstAction
-setting, add or modify the following to /etc/systemd/system.conf:
+setting, create the /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+file with the following content:
+[Manager]
CtrlAltDelBurstAction=none
[warning]:
OCIL for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1
+++ ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1
@@ -1,7 +1,9 @@
+
To ensure the system is configured to ignore the Ctrl-Alt-Del setting,
enter the following command:
-$ sudo grep -i ctrlaltdelburstaction /etc/systemd/system.conf
+$ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system.conf /etc/systemd/system.conf.d/*.conf
The output should return:
-CtrlAltDelBurstAction=none
+/etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf:CtrlAltDelBurstAction=none
+Verify that the setting occurs in a [Manager] section.
Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.?
bash remediation for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -1,27 +1,12 @@
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-core && { rpm --quiet -q systemd; }; then
-# Strip any search characters in the key arg so that the key can be replaced without
-# adding any search characters to the config file.
-stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^CtrlAltDelBurstAction=")
-
-# shellcheck disable=SC2059
-printf -v formatted_output "%s=%s" "$stripped_key" "none"
-
-# If the key exists, change it. Otherwise, add it to the config_file.
-# We search for the key string followed by a word boundary (matched by \>),
-# so if we search for 'setting', 'setting2' won't match.
-if LC_ALL=C grep -q -m 1 -i -e "^CtrlAltDelBurstAction=\\>" "/etc/systemd/system.conf"; then
- escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
- LC_ALL=C sed -i --follow-symlinks "s/^CtrlAltDelBurstAction=\\>.*/$escaped_formatted_output/gi" "/etc/systemd/system.conf"
-else
- if [[ -s "/etc/systemd/system.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/system.conf" || true)" ]]; then
- LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/system.conf"
- fi
- cce="CCE-80784-2"
- printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/system.conf" >> "/etc/systemd/system.conf"
- printf '%s\n' "$formatted_output" >> "/etc/systemd/system.conf"
-fi
+mkdir -p /etc/systemd/system.conf.d
+cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+[Manager]
+CtrlAltDelBurstAction=none
+EOF
+systemctl daemon-reload
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -14,14 +14,12 @@
- low_disruption
- no_reboot_needed
-- name: Disable Ctrl-Alt-Del Burst Action
- ansible.builtin.lineinfile:
- dest: /etc/systemd/system.conf
- state: present
- regexp: ^CtrlAltDelBurstAction
- line: CtrlAltDelBurstAction=none
- create: true
- mode: 420
+- name: Create the systemd configuration drop-in directory
+ ansible.builtin.file:
+ path: /etc/systemd/system.conf.d
+ state: directory
+ owner: root
+ mode: u=rwx,g=rx,o=rx
when:
- '"kernel-core" in ansible_facts.packages'
- '"systemd" in ansible_facts.packages'
@@ -37,3 +35,46 @@
- low_complexity
- low_disruption
- no_reboot_needed
+
+- name: Disable Ctrl-Alt-Del Burst Action
+ ansible.builtin.copy:
+ dest: /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+ content: |
+ [Manager]
+ CtrlAltDelBurstAction=none
+ owner: root
+ mode: u=rw,g=r,o=r
+ when:
+ - '"kernel-core" in ansible_facts.packages'
+ - '"systemd" in ansible_facts.packages'
+ tags:
+ - CCE-80784-2
+ - DISA-STIG-RHEL-08-040172
+ - NIST-800-53-AC-6(1)
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-6(a)
+ - disable_ctrlaltdel_burstaction
+ - disable_strategy
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+
+- name: Reload systemd configuration
+ ansible.builtin.systemd:
+ daemon_reload: true
+ when:
+ - '"kernel-core" in ansible_facts.packages'
+ - '"systemd" in ansible_facts.packages'
+ tags:
+ - CCE-80784-2
+ - DISA-STIG-RHEL-08-040172
+ - NIST-800-53-AC-6(1)
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-6(a)
+ - disable_ctrlaltdel_burstaction
+ - disable_strategy
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
New content has different text for rule 'xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts'.
--- xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
+++ xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
@@ -14,6 +14,7 @@
/etc/passwd. System accounts are those user accounts with a user ID less than
1000. The user ID is stored in the third field. If any system account
other than root has a login shell, disable it with the command:
+
$ sudo usermod -s /sbin/nologin account
[warning]:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts' differs.
--- xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
+++ xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
@@ -5,8 +5,11 @@
&& $7 != "\/sbin\/shutdown" && $7 != "\/sbin\/halt" && $7 != "\/bin\/sync") \
{ print $1 }' /etc/passwd)
+
for systemaccount in "${systemaccounts[@]}"; do
+
usermod -s /sbin/nologin "$systemaccount"
+
done
else
OCIL for rule 'xccdf_org.ssgproject.content_rule_grub2_password' differs.
--- ocil:ssg-grub2_password_ocil:questionnaire:1
+++ ocil:ssg-grub2_password_ocil:questionnaire:1
@@ -1,3 +1,4 @@
+
First, check whether the password is defined in either /boot/grub2/user.cfg or
/boot/grub2/grub.cfg.
Run the following commands:
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d
@@ -15,7 +15,7 @@
rule for /etc/cron.d/ already exists in /etc/audit/rules.d/
ansible.builtin.find:
paths: /etc/audit/rules.d
- contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
+ contains: ^(?=.*(?:-k\s+|-F\s+key=)cronjobs(?:\s|$))\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
patterns: '*.rules'
register: find_existing_watch_rules_d
when:
@@ -119,7 +119,7 @@
rule for /etc/cron.d/ already exists in /etc/audit/audit.rules
ansible.builtin.find:
paths: /etc/audit/
- contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
+ contains: ^(?=.*(?:-k\s+|-F\s+key=)cronjobs(?:\s|$))\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
patterns: audit.rules
register: find_existing_watch_audit_rules
when:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -293,7 +355,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
@@ -23,11 +23,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+ readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
@@ -72,7 +83,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
- grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ if [[ ${#syscall_a[@]} -ge 1 ]]
+ then
+ # The required rule contains '-S' syscall specifications, so existing '-S' fields
+ # are stripped here and their content is validated by the syscall check below
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ else
+ # The required rule contains no '-S' syscall specification, so any '-S' field
+ # in an existing rule makes it more specific than the required scope
+ if [[ $auid_filter ]]; then
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+ else
+ extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+ fi
+ grep -qE -- "-F|-S" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+ fi
done
if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
done
fi
other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
- auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+ auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
echo "$full_rule" >> "$default_file"
chmod 0600 ${default_file}
@@ -182,11 +215,18 @@
unset rule_syscalls_to_edit
unset other_string
unset auid_string
+unset auid_filter
unset full_rule
+unset key_regex
# Load macro arguments into arrays
read -a syscall_a <<< $SYSCALL
read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=\w+|-k \w+"
+
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
@@ -218,7 +258,11 @@
# * the action, list and arch, (2-nd argument)
# * the other filters, (3-rd argument)
# * the auid filters, (4-rd argument)
- readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+ if [[ $auid_filter ]]; then
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+ else
+ readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+ fi
candidate_rules=()
# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -226,8 +270,26 @@
do
# Strip all the options and fields we know of,
# than check if there was any field left over
- extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILT
... The diff is trimmed here ... |
macko1
force-pushed
the
rhel10_stig_v1r2_to_v1r3
branch
8 times, most recently
from
October 22, 2026 12:07
8596888 to
ec2c2e7
Compare
macko1
commented
Oct 22, 2026
macko1
commented
Oct 22, 2026
macko1
commented
Oct 22, 2026
macko1
commented
Oct 22, 2026
macko1
force-pushed
the
rhel10_stig_v1r2_to_v1r3
branch
3 times, most recently
from
October 23, 2026 08:56
8d29aa8 to
3a9089f
Compare
Replace the RHEL 10 DISA STIG manual reference file with the V1R3 content.
Set the control file version and the stig and stig_gui profile metadata and descriptions to V1R3. Metadata only, no rules are affected.
…ementation is not needed
Rules affected:
RHEL-10-200090: package_vsftpd_removed
- The policy file fixtext and checktext use the package name vsftpd;
the V1R2 text named the nonexistent vsftp package
- The package_removed template, OVAL package check, and Bash and
Ansible remediations already enforce vsftpd
RHEL-10-200640: package_rsyslog_installed
- The policy file fixtext and checktext use the package name rsyslog;
the V1R2 text named the daemon rsyslogd
- The package_installed template already checks and installs rsyslog
RHEL-10-300090: crypto_policy_not_overridden
- The policy file checktext removes the obsolete nss.config symlink
note
- The existing SCE check and crypto-policy remediation already
cover the requirement
RHEL-10-500105: auditd_data_retention_admin_space_left_percentage
- The policy file checktext finding line names admin_space_left
instead of space_left
- The rule variable, OVAL check, and Bash and Ansible remediations
already use admin_space_left with
var_auditd_admin_space_left_percentage=5pc
RHEL-10-500720: audit_rules_usergroup_modification_opasswd
- The title now names /etc/security/opasswd, where the password
history file actually lives and which the rule already watches;
the V1R2 title named /etc/opasswd, a path that does not exist
RHEL-10-600740: set_password_hashing_algorithm_logindefs
- The policy file vulnerability discussion adds the RHEL 10 default
yescrypt and explains that it is not NIST CMVP validated
- The control already selects var_password_hashing_algorithm=SHA512
and the rule enforces it as the ENCRYPT_METHOD in /etc/login.defs
RHEL-10-700920: accounts_tmout
- The title now requires 10 minutes, matching the already selected
var_accounts_tmout=10_min that enforces TMOUT after 600 seconds
- The policy file srg_requirement drops from 15 to 10 minutes
- The control already selects var_accounts_tmout=10_min and the
accounts_tmout check and remediations enforce 600 seconds
RHEL-10-701210: service_autofs_disabled
- The title drops the "unless required" exception; the rule already
disables the autofs service and treats an absent autofs package
as not applicable
- The policy file srg_requirement and checktext drop the
"unless required" exception, the checktext example shows
not-found, and the vulnerability discussion is replaced with the
device identification text
- The rule already disables the autofs service; its package[autofs]
platform guard and the service_disabled template treat an absent
autofs package as not applicable
Rules affected:
RHEL-10-300085: configure_openssl_crypto_policy
- The new OpenSSL requirement is mapped to the rule; the RHEL 10
remediations and check require the equals-sign
.include = /etc/crypto-policies/back-ends/opensslcnf.config form,
with pass and fail scenarios
- The rule joins SRG-OS-000250-GPOS-00093 in controls/srg_gpos, the
SRG the requirement satisfies, so the stig-rules-srg-gpos check
covers the new profile selection; the touched control file is
reformatted to the - id: style
Rules affected:
RHEL-10-200050: package_tftp-server_removed
- The control entry and policy/stig source are removed, the rule
stays mapped to the RHEL 8 and RHEL 9 STIGs
Rules affected:
RHEL-10-600100: accounts_maximum_age_login_defs
- The control selects var_accounts_maximum_age_login_defs=180 and
the policy/stig file raises the new-user password lifetime from
60 to 180 days
- The incorrect_stig scenarios use 240 days; 120 days is within
the new limit and no longer fails the check
RHEL-10-600110: accounts_password_set_max_life_existing
- The control selects var_accounts_maximum_age_login_defs=180 and
the policy/stig file raises the existing-account password
lifetime from 60 to 180 days
Rules affected:
RHEL-10-700950: disable_ctrlaltdel_burstaction
- Requires the CtrlAltDelBurstAction=none systemd drop-in with the
[Manager] section in OVAL, remediations, and STIG policy
RHEL-09-211045 and RHEL-08-040172: disable_ctrlaltdel_burstaction
- The shared policy/stig file checktext and fixtext use the
/etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf drop-in
form, and the OVAL accepts both the drop-in and the main
/etc/systemd/system.conf setting
… RHEL-10-200000
Rules affected:
RHEL-10-001030: ensure_gpgcheck_globally_activated
- The OVAL check accepts 1, true, and yes case insensitively for
gpgcheck, with focused scenarios
RHEL-10-001040: ensure_gpgcheck_local_packages
- The OVAL check accepts 1, true, and yes case insensitively for
localpkg_gpgcheck, with focused scenarios
RHEL-10-001050: enable_gpgcheck_for_all_repositories
- The OVAL check validates gpgcheck positively on every repository
with the accepted values, replacing the negative-only check
- The ansible remediation ini_file task sets owner root and mode u=rw,g=r,o=r, fixing the ansible-lint risky-file-permissions finding
RHEL-10-200000: clean_components_post_updating
- The OVAL check accepts 1, true, and yes case insensitively for
clean_requirements_on_remove, with focused scenarios
Rules affected:
RHEL-10-600000: grub2_password
- The OVAL requires GRUB2_PASSWORD with the grub.pbkdf2.sha512
prefix in /boot/grub2/user.cfg only; the EFI fallback, the grub.cfg
password alternative, and the superuser criterion are dropped for
RHEL 10, and the control title now names single-user and
maintenance mode authentication
Rules affected:
RHEL-10-600020: no_shelllogin_for_systemaccounts
- The check accepts the reserved accounts root, halt, sync, and
shutdown and rejects interactive shells on system accounts in the
UID 1 to 999 band; the remediations use /usr/sbin/nologin
Rules affected:
RHEL-10-500720: audit_rules_usergroup_modification_opasswd
- The watch template enforces the identity audit key when requested;
RHEL 10 requires it for /etc/security/opasswd with the rules in
identity.rules loaded by augenrules, and the malformed b64 policy
lines are corrected
Rules affected:
RHEL-10-500450: audit_rules_privileged_commands_gpasswd
- The template generates b32 and b64 rules with the
privileged-gpasswd key and no AUID filters for RHEL 10
RHEL-10-500490: audit_rules_privileged_commands_passwd
- The template generates b32 and b64 rules with the
privileged-passwd key and no AUID filters for RHEL 10
Rules affected: - audit_rules_privileged_commands_gpasswd, audit_rules_privileged_commands_passwd: the bash_fix_audit_syscall_rule macro stripped -S syscall fields and any audit key from candidate rules, so existing rules with -S execve or a wrong key were accepted as compliant and the canonical b32 and b64 rules were never appended; the macro now rejects -S fields for syscall-less rules and enforces the exact key in the STIG arch mode - audit_rules_usergroup_modification_opasswd: the extra_permission scenarios wrote the hardcoded logins key that the require_key OVAL rejects, and the missing_identity_key scenarios could be satisfied by rules leaked from earlier scenarios; the scenarios now use the rendered identity key and clean pre-existing rules first
Rules affected:
RHEL-10-500605: audit_rules_privileged_commands_useradd
- The new control entry and the SRG-OS-000062-GPOS-00031 line select
the rule in the STIG profile, and the rule receives
cce@rhel10 CCE-86501-4
- The template vars change from path only to path, key
privileged-useradd, and require_key true; the vars are shared, so
every product building the rule enforces the privileged-useradd
key, and on RHEL 10 the generated Bash, Ansible, and OVAL output
is a single rule without an arch split:
-a always,exit -F path=/usr/sbin/useradd -F perm=x -F auid>=1000
-F auid!=unset -k privileged-useradd
- The new policy/stig/rhel10.yml carries the V1R3 fixtext with the
service auditd restart instruction and the auditctl -l | grep
useradd checktext
- The new auditctl_wrong_key.fail.sh and
augenrules_wrong_key.fail.sh scenarios fail on a wrong audit key
- The stig and stig_gui profile stability data adds the rule
The audit_rules_privileged_commands template ports the rhel9 branch's
require_key plumbing: template.py parses a require_key parameter, the
generic OVAL pattern enforces the exact key instead of any key, the
generic Bash branch passes require_key to bash_fix_audit_syscall_rule,
and a rule that sets require_key renders the generic single-rule shape
on RHEL 10 instead of the b32 and b64 arch split. The per-rule key
support, the bash_fix_audit_syscall_rule macro rework, and the RHEL 10
STIG arch mode used by gpasswd and passwd landed with the
RHEL-10-500450 and RHEL-10-500490 commits, and the existing RHEL 10
rules from this template keep their generated output.
Rules affected:
RHEL-10-200648: rsyslog_cron_logging
- The policy/stig checktext is synced to the V1R3 text: the anchored
grep -s "cron.\*", the RainerScript omfile action sample for
/var/log/cron, and the functional logger -p cron.info test with the
/var/log/cron lookup as the manual fallback
- The fixtext drops the quotes from /etc/rsyslog.d/ and uses
"The rsyslog daemon must be restarted" wording
- The seven cron_set scenarios restart rsyslog so the scenario system
state matches the written configuration
Rules affected:
RHEL-10-600750: set_password_hashing_algorithm_libuserconf
- The RHEL 10 OVAL lookup changes from any "crypt_style" line to one
anchored to the [defaults] section, so a crypt_style in another
section or a commented-out line no longer satisfies the check
- The checktext command changes from "grep crypt" to the anchored
"grep -i "^crypt_style"" and gains the note that the requirement is
not applicable when the libuser package is not installed
- The fixtext section name changes from "[default]" to "[defaults]"
- New scenarios cover the wrong section, a commented-out setting, a
crypt_style in an earlier section not shadowing the [defaults]
value, and the absent libuser package
Rules affected:
RHEL-10-200730: install_smartcard_packages
- The RHEL 10 OVAL branch changes the checked package from
openssl-pkcs11 to pkcs11-provider, matching the package already
selected by the rule metadata and remediation; the openssl-pkcs11
path used by RHEL 8 and RHEL 9 is unchanged
- The checktext and fixtext change the package name from
openssl-pkcs11 to pkcs11-provider
- The vulnerability discussion abbreviates multifactor authentication
to MFA after the first mention and retains the DOD-approved PKI
wording
- New scenarios cover the installed package, the missing package, and
another smart card package not satisfying the requirement
Rules affected:
RHEL-10-500610: audit_rules_media_export
- The RHEL 10 audit key for the mount syscall rules changes from
export to privileged-mount in the rule description, fixtext,
generated Bash and Ansible remediations, and the STIG policy
fixtext and checktext examples
- The correct_rules scenario writes the privileged-mount key on
RHEL 10
Rules affected:
RHEL-10-500680: audit_rules_sudoers
- The RHEL 10 audit key for the /etc/sudoers watch rules changes from
logins to identity in the STIG policy fixtext and checktext, the
rule description, OCIL, and fixtext, and the generated Bash and
Ansible remediations
- The RHEL 10 OVAL enforces the identity audit key, so a rule with a
different key no longer satisfies the check
- The fixtext load procedure changes from "service auditd restart"
to "augenrules --load"
- New wrong key scenarios cover the augenrules and auditctl backends
Rules affected:
RHEL-10-500690: audit_rules_sudoers_d
- The RHEL 10 watch path in the generated audit rules changes from
/etc/sudoers.d/ to /etc/sudoers.d without the trailing slash in the
rule description, OCIL, and fixtext, the generated Bash and Ansible
remediations, and the STIG policy fixtext and checktext examples;
the OVAL and remediation use the path filter instead of the
directory filter for RHEL 10
- The RHEL 10 OVAL enforces the identity audit key, so a rule with a
different key no longer satisfies the check
- New wrong key scenarios cover the augenrules and auditctl backends,
and a trailing slash path scenario verifies the path without the
slash is required
Both the stig and stig_gui stability files: - add var_accounts_maximum_age_login_defs=180 and configure_openssl_crypto_policy - remove var_accounts_maximum_age_login_defs=60 and package_tftp-server_removed
macko1
force-pushed
the
rhel10_stig_v1r2_to_v1r3
branch
from
October 23, 2026 10:10
3a9089f to
a384acc
Compare
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Mab879
requested changes
Oct 23, 2026
| - sshd_approved_ciphers=stig_rhel9 | ||
| - sshd_approved_macs=stig_rhel9 | ||
| status: automated | ||
| - id: SRG-OS-000250-GPOS-00093 |
| @@ -0,0 +1,8 @@ | |||
| #!/bin/bash | |||
Member
There was a problem hiding this comment.
What is this needed?
https://stigaview.com/products/rhel10/v1r3/RHEL-10-500300/ is the control with execve.
| name: audit_rules_privileged_commands | ||
| vars: | ||
| path: /usr/sbin/useradd | ||
| key: privileged-useradd |
| # complexity = low | ||
| # disruption = low | ||
|
|
||
| {{% if product in ["rhel8", "rhel9", "rhel10"] %}} |
| # platform = multi_platform_all | ||
|
|
||
|
|
||
| {{% if product in ["rhel8", "rhel9", "rhel10"] %}} |
|
|
||
|
|
||
| checktext: |- | ||
| {{% if product == "rhel8" or product == "rhel9" %}} |
| @@ -1,5 +1,12 @@ | |||
| #!/bin/bash | |||
|
|
|||
| {{% if product in ["rhel8", "rhel9", "rhel10"] %}} | |||
| <br /><br /> | ||
| To configure the system to ignore the <tt>CtrlAltDelBurstAction</tt> | ||
| {{% if product != "rhcos4" %}} | ||
| {{% if product in ["rhel8", "rhel9", "rhel10"] %}} |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Rationale:
Rationale here. Replace this text. Don't use the italics format!
Fixes # Issue number here (e.g. Updating sysctl XCCDF naming #26) or remove this line if no issue exists.
Review Hints:
Review hints here. Replace this text. Don't use the italics format!
Use this optional section to give any relevant information which could help the reviewer to more quickly and assertively understand and test the changes.
Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc.