diff --git a/CMakeLists.txt b/CMakeLists.txt index 95539eb0d96..7297d01e65b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -99,6 +99,7 @@ option(SSG_PRODUCT_OCP4 "If enabled, the OCP4 SCAP content will be built" ${SSG_ option(SSG_PRODUCT_OL7 "If enabled, the Oracle Linux 7 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OL8 "If enabled, the Oracle Linux 8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OL9 "If enabled, the Oracle Linux 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) +option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) @@ -327,6 +328,7 @@ message(STATUS "RHCOS4: ${SSG_PRODUCT_RHCOS4}") message(STATUS "Oracle Linux 7: ${SSG_PRODUCT_OL7}") message(STATUS "Oracle Linux 8: ${SSG_PRODUCT_OL8}") message(STATUS "Oracle Linux 9: ${SSG_PRODUCT_OL9}") +message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}") message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}") message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}") message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}") @@ -421,6 +423,9 @@ endif() if(SSG_PRODUCT_OL9) add_subdirectory("products/ol9" "ol9") endif() +if(SSG_PRODUCT_OL10) + add_subdirectory("products/ol10" "ol10") +endif() if(SSG_PRODUCT_OPENEULER2203) add_subdirectory("products/openeuler2203" "openeuler2203") endif() diff --git a/build_product b/build_product index b32cc48b163..e3bc15ce8e0 100755 --- a/build_product +++ b/build_product @@ -365,6 +365,7 @@ all_cmake_products=( OL7 OL8 OL9 + OL10 OPENSUSE RHEL8 RHEL9 diff --git a/products/ol10/CMakeLists.txt b/products/ol10/CMakeLists.txt new file mode 100644 index 00000000000..53182682b1e --- /dev/null +++ b/products/ol10/CMakeLists.txt @@ -0,0 +1,13 @@ +# Sometimes our users will try to do: "cd ol9; cmake ." That needs to error in a nice way. +if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") + message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") +endif() + +set(PRODUCT "ol10") + +ssg_build_product(${PRODUCT}) + +#ssg_build_html_profile_table("table-${PRODUCT}-nistrefs-stig" "${PRODUCT}" "stig" "nist") + +#ssg_build_html_stig_tables(${PRODUCT}) +#ssg_build_html_stig_tables_per_profile(${PRODUCT} "stig") diff --git a/products/ol10/product.yml b/products/ol10/product.yml new file mode 100644 index 00000000000..c6122049a91 --- /dev/null +++ b/products/ol10/product.yml @@ -0,0 +1,48 @@ +product: ol10 +full_name: Oracle Linux 10 +type: platform + +families: + - ol + +major_version_ordinal: 10 + +benchmark_id: OL-10 +benchmark_root: "../../linux_os/guide" + +profiles_root: "./profiles" + +pkg_manager: "dnf" + +init_system: "systemd" + +dconf_gdm_dir: "local.d" + +faillock_path: "/var/log/faillock" +pkg_release: "" +pkg_version: "" + +aux_pkg_release: "" +aux_pkg_version: "" + +# OL fingerprints below retrieved from: https://linux.oracle.com/security/gpg/#gpg +release_key_fingerprint: "" +auxiliary_key_fingerprint: "" + +groups: + dedicated_ssh_keyowner: + name: ssh_keys + +cpes_root: "../../shared/applicability" +cpes: + - ol10: + name: "cpe:/o:oracle:linux:10" + title: "Oracle Linux 10" + check_id: installed_OS_is_ol10 + +# Mapping of CPE platform to package +platform_package_overrides: + login_defs: "shadow-utils" + +reference_uris: + cis: '' diff --git a/products/ol10/profiles/anssi_bp28_enhanced.profile b/products/ol10/profiles/anssi_bp28_enhanced.profile new file mode 100644 index 00000000000..a4d866b3dd6 --- /dev/null +++ b/products/ol10/profiles/anssi_bp28_enhanced.profile @@ -0,0 +1,42 @@ +documentation_complete: true + +title: 'ANSSI-BP-028 (enhanced)' + +description: |- + This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening + level. ANSSI is the French National Information Security Agency, and stands for Agence + nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration + recommendation for GNU/Linux systems. + + A copy of the ANSSI-BP-028 can be found at the ANSSI website: + https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ + +selections: + - anssi:all:enhanced + - '!partition_for_opt' + - '!package_ypserv_removed' + - '!accounts_passwords_pam_tally2_deny_root' + - '!install_PAE_kernel_on_x86-32' + - '!partition_for_boot' + - '!ensure_redhat_gpgkey_installed' + - '!sudo_add_ignore_dot' + - '!audit_rules_privileged_commands_rmmod' + - '!audit_rules_privileged_commands_modprobe' + - '!package_dracut-fips-aesni_installed' + - '!cracklib_accounts_password_pam_lcredit' + - '!partition_for_usr' + - '!cracklib_accounts_password_pam_ocredit' + - '!enable_pam_namespace' + - '!audit_rules_privileged_commands_insmod' + - '!package_ypbind_removed' + - '!service_chronyd_or_ntpd_enabled' + - '!sudo_dedicated_group' + - '!chronyd_configure_pool_and_server' + - '!accounts_passwords_pam_tally2' + - '!cracklib_accounts_password_pam_ucredit' + - '!accounts_passwords_pam_tally2_unlock_time' + - '!sudo_add_umask' + - '!sudo_add_env_reset' + - '!cracklib_accounts_password_pam_minlen' + - '!cracklib_accounts_password_pam_dcredit' + - '!package_xinetd_removed' diff --git a/products/ol10/profiles/anssi_bp28_high.profile b/products/ol10/profiles/anssi_bp28_high.profile new file mode 100644 index 00000000000..8b259582a62 --- /dev/null +++ b/products/ol10/profiles/anssi_bp28_high.profile @@ -0,0 +1,43 @@ +documentation_complete: true + +title: 'ANSSI-BP-028 (high)' + +description: |- + This profile contains configurations that align to ANSSI-BP-028 at the high hardening + level. ANSSI is the French National Information Security Agency, and stands for Agence + nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration + recommendation for GNU/Linux systems. + + A copy of the ANSSI-BP-028 can be found at the ANSSI website: + https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ + +selections: + - anssi:all:high + - '!partition_for_opt' + - '!package_ypserv_removed' + - '!accounts_passwords_pam_tally2_deny_root' + - '!install_PAE_kernel_on_x86-32' + - '!partition_for_boot' + - '!ensure_redhat_gpgkey_installed' + - '!aide_periodic_checking_systemd_timer' + - '!sudo_add_ignore_dot' + - '!audit_rules_privileged_commands_rmmod' + - '!audit_rules_privileged_commands_modprobe' + - '!partition_for_usr' + - '!package_dracut-fips-aesni_installed' + - '!cracklib_accounts_password_pam_lcredit' + - '!cracklib_accounts_password_pam_ocredit' + - '!enable_pam_namespace' + - '!audit_rules_privileged_commands_insmod' + - '!package_ypbind_removed' + - '!service_chronyd_or_ntpd_enabled' + - '!sudo_dedicated_group' + - '!chronyd_configure_pool_and_server' + - '!accounts_passwords_pam_tally2' + - '!cracklib_accounts_password_pam_ucredit' + - '!accounts_passwords_pam_tally2_unlock_time' + - '!sudo_add_umask' + - '!sudo_add_env_reset' + - '!cracklib_accounts_password_pam_minlen' + - '!cracklib_accounts_password_pam_dcredit' + - '!package_xinetd_removed' diff --git a/products/ol10/profiles/anssi_bp28_intermediary.profile b/products/ol10/profiles/anssi_bp28_intermediary.profile new file mode 100644 index 00000000000..29553954a90 --- /dev/null +++ b/products/ol10/profiles/anssi_bp28_intermediary.profile @@ -0,0 +1,34 @@ +documentation_complete: true + +title: 'ANSSI-BP-028 (intermediary)' + +description: |- + This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening + level. ANSSI is the French National Information Security Agency, and stands for Agence + nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration + recommendation for GNU/Linux systems. + + A copy of the ANSSI-BP-028 can be found at the ANSSI website: + https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ + +selections: + - anssi:all:intermediary + - '!package_ypbind_removed' + - '!partition_for_opt' + - '!cracklib_accounts_password_pam_minlen' + - '!package_ypserv_removed' + - '!accounts_passwords_pam_tally2_deny_root' + - '!accounts_passwords_pam_tally2' + - '!cracklib_accounts_password_pam_ucredit' + - '!cracklib_accounts_password_pam_dcredit' + - '!cracklib_accounts_password_pam_lcredit' + - '!partition_for_usr' + - '!partition_for_boot' + - '!cracklib_accounts_password_pam_ocredit' + - '!enable_pam_namespace' + - '!accounts_passwords_pam_tally2_unlock_time' + - '!ensure_redhat_gpgkey_installed' + - '!sudo_add_umask' + - '!sudo_add_ignore_dot' + - '!sudo_add_env_reset' + - '!package_xinetd_removed' diff --git a/products/ol10/profiles/anssi_bp28_minimal.profile b/products/ol10/profiles/anssi_bp28_minimal.profile new file mode 100644 index 00000000000..6c959b6f22c --- /dev/null +++ b/products/ol10/profiles/anssi_bp28_minimal.profile @@ -0,0 +1,27 @@ +documentation_complete: true + +title: 'ANSSI-BP-028 (minimal)' + +description: |- + This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening + level. ANSSI is the French National Information Security Agency, and stands for Agence + nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration + recommendation for GNU/Linux systems. + + A copy of the ANSSI-BP-028 can be found at the ANSSI website: + https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ + +selections: + - anssi:all:minimal + - '!package_ypbind_removed' + - '!cracklib_accounts_password_pam_minlen' + - '!package_ypserv_removed' + - '!accounts_passwords_pam_tally2_deny_root' + - '!accounts_passwords_pam_tally2' + - '!cracklib_accounts_password_pam_ucredit' + - '!cracklib_accounts_password_pam_dcredit' + - '!cracklib_accounts_password_pam_lcredit' + - '!cracklib_accounts_password_pam_ocredit' + - '!accounts_passwords_pam_tally2_unlock_time' + - '!ensure_redhat_gpgkey_installed' + - '!package_xinetd_removed' diff --git a/products/ol10/transforms/constants.xslt b/products/ol10/transforms/constants.xslt new file mode 100644 index 00000000000..69f7301f803 --- /dev/null +++ b/products/ol10/transforms/constants.xslt @@ -0,0 +1,12 @@ + + + + +Oracle Linux Linux 10 +OL 10 +OL_10_STIG +ol10 + +empty + + diff --git a/products/ol10/transforms/table-style.xslt b/products/ol10/transforms/table-style.xslt new file mode 100644 index 00000000000..8b6caeab8cd --- /dev/null +++ b/products/ol10/transforms/table-style.xslt @@ -0,0 +1,5 @@ + + + + + diff --git a/products/ol10/transforms/xccdf-apply-overlay-stig.xslt b/products/ol10/transforms/xccdf-apply-overlay-stig.xslt new file mode 100644 index 00000000000..4789419b80a --- /dev/null +++ b/products/ol10/transforms/xccdf-apply-overlay-stig.xslt @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/products/ol10/transforms/xccdf2table-cce.xslt b/products/ol10/transforms/xccdf2table-cce.xslt new file mode 100644 index 00000000000..f156a669566 --- /dev/null +++ b/products/ol10/transforms/xccdf2table-cce.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/products/ol10/transforms/xccdf2table-profileccirefs.xslt b/products/ol10/transforms/xccdf2table-profileccirefs.xslt new file mode 100644 index 00000000000..30419e92b28 --- /dev/null +++ b/products/ol10/transforms/xccdf2table-profileccirefs.xslt @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/shared/checks/oval/installed_OS_is_ol10.xml b/shared/checks/oval/installed_OS_is_ol10.xml new file mode 100644 index 00000000000..29ca709bf99 --- /dev/null +++ b/shared/checks/oval/installed_OS_is_ol10.xml @@ -0,0 +1,36 @@ + + + + Oracle Linux 10 + + multi_platform_all + + + + The operating system installed on the system is + Oracle Linux 10 + + + + + + + + + + + + + + + ^10.*$ + + + oraclelinux-release + + + diff --git a/ssg/constants.py b/ssg/constants.py index 34b7bf8b51e..24502d838b7 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -52,7 +52,7 @@ 'macos1015', 'ocp4', 'rhcos4', - 'ol7', 'ol8', 'ol9', + 'ol7', 'ol8', 'ol9', 'ol10', 'openeuler2203', 'opensuse', 'openembedded', @@ -216,6 +216,7 @@ "Oracle Linux 7": "ol7", "Oracle Linux 8": "ol8", "Oracle Linux 9": "ol9", + "Oracle Linux 10": "ol10", "openEuler 2203": "openeuler2203", "openSUSE": "opensuse", "Red Hat Enterprise Linux 8": "rhel8", @@ -294,7 +295,7 @@ "multi_platform_fedora": ["fedora"], "multi_platform_openeuler": ["openeuler2203"], "multi_platform_opensuse": ["opensuse"], - "multi_platform_ol": ["ol7", "ol8", "ol9"], + "multi_platform_ol": ["ol7", "ol8", "ol9", "ol10"], "multi_platform_ocp": ["ocp4"], "multi_platform_rhcos": ["rhcos4"], "multi_platform_rhel": ["rhel8", "rhel9", "rhel10"],