diff --git a/CMakeLists.txt b/CMakeLists.txt
index 95539eb0d96..7297d01e65b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -99,6 +99,7 @@ option(SSG_PRODUCT_OCP4 "If enabled, the OCP4 SCAP content will be built" ${SSG_
option(SSG_PRODUCT_OL7 "If enabled, the Oracle Linux 7 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_OL8 "If enabled, the Oracle Linux 8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_OL9 "If enabled, the Oracle Linux 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -327,6 +328,7 @@ message(STATUS "RHCOS4: ${SSG_PRODUCT_RHCOS4}")
message(STATUS "Oracle Linux 7: ${SSG_PRODUCT_OL7}")
message(STATUS "Oracle Linux 8: ${SSG_PRODUCT_OL8}")
message(STATUS "Oracle Linux 9: ${SSG_PRODUCT_OL9}")
+message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}")
message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}")
message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}")
message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}")
@@ -421,6 +423,9 @@ endif()
if(SSG_PRODUCT_OL9)
add_subdirectory("products/ol9" "ol9")
endif()
+if(SSG_PRODUCT_OL10)
+ add_subdirectory("products/ol10" "ol10")
+endif()
if(SSG_PRODUCT_OPENEULER2203)
add_subdirectory("products/openeuler2203" "openeuler2203")
endif()
diff --git a/build_product b/build_product
index b32cc48b163..e3bc15ce8e0 100755
--- a/build_product
+++ b/build_product
@@ -365,6 +365,7 @@ all_cmake_products=(
OL7
OL8
OL9
+ OL10
OPENSUSE
RHEL8
RHEL9
diff --git a/products/ol10/CMakeLists.txt b/products/ol10/CMakeLists.txt
new file mode 100644
index 00000000000..53182682b1e
--- /dev/null
+++ b/products/ol10/CMakeLists.txt
@@ -0,0 +1,13 @@
+# Sometimes our users will try to do: "cd ol9; cmake ." That needs to error in a nice way.
+if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
+ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
+endif()
+
+set(PRODUCT "ol10")
+
+ssg_build_product(${PRODUCT})
+
+#ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-stig" "${PRODUCT}" "stig" "nist")
+
+#ssg_build_html_stig_tables(${PRODUCT})
+#ssg_build_html_stig_tables_per_profile(${PRODUCT} "stig")
diff --git a/products/ol10/product.yml b/products/ol10/product.yml
new file mode 100644
index 00000000000..c6122049a91
--- /dev/null
+++ b/products/ol10/product.yml
@@ -0,0 +1,48 @@
+product: ol10
+full_name: Oracle Linux 10
+type: platform
+
+families:
+ - ol
+
+major_version_ordinal: 10
+
+benchmark_id: OL-10
+benchmark_root: "../../linux_os/guide"
+
+profiles_root: "./profiles"
+
+pkg_manager: "dnf"
+
+init_system: "systemd"
+
+dconf_gdm_dir: "local.d"
+
+faillock_path: "/var/log/faillock"
+pkg_release: ""
+pkg_version: ""
+
+aux_pkg_release: ""
+aux_pkg_version: ""
+
+# OL fingerprints below retrieved from: https://linux.oracle.com/security/gpg/#gpg
+release_key_fingerprint: ""
+auxiliary_key_fingerprint: ""
+
+groups:
+ dedicated_ssh_keyowner:
+ name: ssh_keys
+
+cpes_root: "../../shared/applicability"
+cpes:
+ - ol10:
+ name: "cpe:/o:oracle:linux:10"
+ title: "Oracle Linux 10"
+ check_id: installed_OS_is_ol10
+
+# Mapping of CPE platform to package
+platform_package_overrides:
+ login_defs: "shadow-utils"
+
+reference_uris:
+ cis: ''
diff --git a/products/ol10/profiles/anssi_bp28_enhanced.profile b/products/ol10/profiles/anssi_bp28_enhanced.profile
new file mode 100644
index 00000000000..a4d866b3dd6
--- /dev/null
+++ b/products/ol10/profiles/anssi_bp28_enhanced.profile
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+title: 'ANSSI-BP-028 (enhanced)'
+
+description: |-
+ This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening
+ level. ANSSI is the French National Information Security Agency, and stands for Agence
+ nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration
+ recommendation for GNU/Linux systems.
+
+ A copy of the ANSSI-BP-028 can be found at the ANSSI website:
+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
+
+selections:
+ - anssi:all:enhanced
+ - '!partition_for_opt'
+ - '!package_ypserv_removed'
+ - '!accounts_passwords_pam_tally2_deny_root'
+ - '!install_PAE_kernel_on_x86-32'
+ - '!partition_for_boot'
+ - '!ensure_redhat_gpgkey_installed'
+ - '!sudo_add_ignore_dot'
+ - '!audit_rules_privileged_commands_rmmod'
+ - '!audit_rules_privileged_commands_modprobe'
+ - '!package_dracut-fips-aesni_installed'
+ - '!cracklib_accounts_password_pam_lcredit'
+ - '!partition_for_usr'
+ - '!cracklib_accounts_password_pam_ocredit'
+ - '!enable_pam_namespace'
+ - '!audit_rules_privileged_commands_insmod'
+ - '!package_ypbind_removed'
+ - '!service_chronyd_or_ntpd_enabled'
+ - '!sudo_dedicated_group'
+ - '!chronyd_configure_pool_and_server'
+ - '!accounts_passwords_pam_tally2'
+ - '!cracklib_accounts_password_pam_ucredit'
+ - '!accounts_passwords_pam_tally2_unlock_time'
+ - '!sudo_add_umask'
+ - '!sudo_add_env_reset'
+ - '!cracklib_accounts_password_pam_minlen'
+ - '!cracklib_accounts_password_pam_dcredit'
+ - '!package_xinetd_removed'
diff --git a/products/ol10/profiles/anssi_bp28_high.profile b/products/ol10/profiles/anssi_bp28_high.profile
new file mode 100644
index 00000000000..8b259582a62
--- /dev/null
+++ b/products/ol10/profiles/anssi_bp28_high.profile
@@ -0,0 +1,43 @@
+documentation_complete: true
+
+title: 'ANSSI-BP-028 (high)'
+
+description: |-
+ This profile contains configurations that align to ANSSI-BP-028 at the high hardening
+ level. ANSSI is the French National Information Security Agency, and stands for Agence
+ nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration
+ recommendation for GNU/Linux systems.
+
+ A copy of the ANSSI-BP-028 can be found at the ANSSI website:
+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
+
+selections:
+ - anssi:all:high
+ - '!partition_for_opt'
+ - '!package_ypserv_removed'
+ - '!accounts_passwords_pam_tally2_deny_root'
+ - '!install_PAE_kernel_on_x86-32'
+ - '!partition_for_boot'
+ - '!ensure_redhat_gpgkey_installed'
+ - '!aide_periodic_checking_systemd_timer'
+ - '!sudo_add_ignore_dot'
+ - '!audit_rules_privileged_commands_rmmod'
+ - '!audit_rules_privileged_commands_modprobe'
+ - '!partition_for_usr'
+ - '!package_dracut-fips-aesni_installed'
+ - '!cracklib_accounts_password_pam_lcredit'
+ - '!cracklib_accounts_password_pam_ocredit'
+ - '!enable_pam_namespace'
+ - '!audit_rules_privileged_commands_insmod'
+ - '!package_ypbind_removed'
+ - '!service_chronyd_or_ntpd_enabled'
+ - '!sudo_dedicated_group'
+ - '!chronyd_configure_pool_and_server'
+ - '!accounts_passwords_pam_tally2'
+ - '!cracklib_accounts_password_pam_ucredit'
+ - '!accounts_passwords_pam_tally2_unlock_time'
+ - '!sudo_add_umask'
+ - '!sudo_add_env_reset'
+ - '!cracklib_accounts_password_pam_minlen'
+ - '!cracklib_accounts_password_pam_dcredit'
+ - '!package_xinetd_removed'
diff --git a/products/ol10/profiles/anssi_bp28_intermediary.profile b/products/ol10/profiles/anssi_bp28_intermediary.profile
new file mode 100644
index 00000000000..29553954a90
--- /dev/null
+++ b/products/ol10/profiles/anssi_bp28_intermediary.profile
@@ -0,0 +1,34 @@
+documentation_complete: true
+
+title: 'ANSSI-BP-028 (intermediary)'
+
+description: |-
+ This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening
+ level. ANSSI is the French National Information Security Agency, and stands for Agence
+ nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration
+ recommendation for GNU/Linux systems.
+
+ A copy of the ANSSI-BP-028 can be found at the ANSSI website:
+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
+
+selections:
+ - anssi:all:intermediary
+ - '!package_ypbind_removed'
+ - '!partition_for_opt'
+ - '!cracklib_accounts_password_pam_minlen'
+ - '!package_ypserv_removed'
+ - '!accounts_passwords_pam_tally2_deny_root'
+ - '!accounts_passwords_pam_tally2'
+ - '!cracklib_accounts_password_pam_ucredit'
+ - '!cracklib_accounts_password_pam_dcredit'
+ - '!cracklib_accounts_password_pam_lcredit'
+ - '!partition_for_usr'
+ - '!partition_for_boot'
+ - '!cracklib_accounts_password_pam_ocredit'
+ - '!enable_pam_namespace'
+ - '!accounts_passwords_pam_tally2_unlock_time'
+ - '!ensure_redhat_gpgkey_installed'
+ - '!sudo_add_umask'
+ - '!sudo_add_ignore_dot'
+ - '!sudo_add_env_reset'
+ - '!package_xinetd_removed'
diff --git a/products/ol10/profiles/anssi_bp28_minimal.profile b/products/ol10/profiles/anssi_bp28_minimal.profile
new file mode 100644
index 00000000000..6c959b6f22c
--- /dev/null
+++ b/products/ol10/profiles/anssi_bp28_minimal.profile
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+title: 'ANSSI-BP-028 (minimal)'
+
+description: |-
+ This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening
+ level. ANSSI is the French National Information Security Agency, and stands for Agence
+ nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration
+ recommendation for GNU/Linux systems.
+
+ A copy of the ANSSI-BP-028 can be found at the ANSSI website:
+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
+
+selections:
+ - anssi:all:minimal
+ - '!package_ypbind_removed'
+ - '!cracklib_accounts_password_pam_minlen'
+ - '!package_ypserv_removed'
+ - '!accounts_passwords_pam_tally2_deny_root'
+ - '!accounts_passwords_pam_tally2'
+ - '!cracklib_accounts_password_pam_ucredit'
+ - '!cracklib_accounts_password_pam_dcredit'
+ - '!cracklib_accounts_password_pam_lcredit'
+ - '!cracklib_accounts_password_pam_ocredit'
+ - '!accounts_passwords_pam_tally2_unlock_time'
+ - '!ensure_redhat_gpgkey_installed'
+ - '!package_xinetd_removed'
diff --git a/products/ol10/transforms/constants.xslt b/products/ol10/transforms/constants.xslt
new file mode 100644
index 00000000000..69f7301f803
--- /dev/null
+++ b/products/ol10/transforms/constants.xslt
@@ -0,0 +1,12 @@
+
+
+
+
+Oracle Linux Linux 10
+OL 10
+OL_10_STIG
+ol10
+
+empty
+
+
diff --git a/products/ol10/transforms/table-style.xslt b/products/ol10/transforms/table-style.xslt
new file mode 100644
index 00000000000..8b6caeab8cd
--- /dev/null
+++ b/products/ol10/transforms/table-style.xslt
@@ -0,0 +1,5 @@
+
+
+
+
+
diff --git a/products/ol10/transforms/xccdf-apply-overlay-stig.xslt b/products/ol10/transforms/xccdf-apply-overlay-stig.xslt
new file mode 100644
index 00000000000..4789419b80a
--- /dev/null
+++ b/products/ol10/transforms/xccdf-apply-overlay-stig.xslt
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
diff --git a/products/ol10/transforms/xccdf2table-cce.xslt b/products/ol10/transforms/xccdf2table-cce.xslt
new file mode 100644
index 00000000000..f156a669566
--- /dev/null
+++ b/products/ol10/transforms/xccdf2table-cce.xslt
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/products/ol10/transforms/xccdf2table-profileccirefs.xslt b/products/ol10/transforms/xccdf2table-profileccirefs.xslt
new file mode 100644
index 00000000000..30419e92b28
--- /dev/null
+++ b/products/ol10/transforms/xccdf2table-profileccirefs.xslt
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/shared/checks/oval/installed_OS_is_ol10.xml b/shared/checks/oval/installed_OS_is_ol10.xml
new file mode 100644
index 00000000000..29ca709bf99
--- /dev/null
+++ b/shared/checks/oval/installed_OS_is_ol10.xml
@@ -0,0 +1,36 @@
+
+
+
+ Oracle Linux 10
+
+ multi_platform_all
+
+
+
+ The operating system installed on the system is
+ Oracle Linux 10
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ^10.*$
+
+
+ oraclelinux-release
+
+
+
diff --git a/ssg/constants.py b/ssg/constants.py
index 34b7bf8b51e..24502d838b7 100644
--- a/ssg/constants.py
+++ b/ssg/constants.py
@@ -52,7 +52,7 @@
'macos1015',
'ocp4',
'rhcos4',
- 'ol7', 'ol8', 'ol9',
+ 'ol7', 'ol8', 'ol9', 'ol10',
'openeuler2203',
'opensuse',
'openembedded',
@@ -216,6 +216,7 @@
"Oracle Linux 7": "ol7",
"Oracle Linux 8": "ol8",
"Oracle Linux 9": "ol9",
+ "Oracle Linux 10": "ol10",
"openEuler 2203": "openeuler2203",
"openSUSE": "opensuse",
"Red Hat Enterprise Linux 8": "rhel8",
@@ -294,7 +295,7 @@
"multi_platform_fedora": ["fedora"],
"multi_platform_openeuler": ["openeuler2203"],
"multi_platform_opensuse": ["opensuse"],
- "multi_platform_ol": ["ol7", "ol8", "ol9"],
+ "multi_platform_ol": ["ol7", "ol8", "ol9", "ol10"],
"multi_platform_ocp": ["ocp4"],
"multi_platform_rhcos": ["rhcos4"],
"multi_platform_rhel": ["rhel8", "rhel9", "rhel10"],