Skip to content

Commit 89aeaa7

Browse files
authored
Merge pull request #22 from atomicturtle/spec
Init base 0.1.54 package
2 parents 3d1294d + bfee754 commit 89aeaa7

30 files changed

Lines changed: 52857 additions & 0 deletions

File tree

package/0.1.54/SOURCES/0001-Add-Rocky-Linux-content.patch

Lines changed: 27087 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
From 48e959ebf2b892fefa642f19bc8cc1d2d639fb29 Mon Sep 17 00:00:00 2001
2+
From: Watson Sato <wsato@redhat.com>
3+
Date: Thu, 3 Dec 2020 14:35:47 +0100
4+
Subject: [PATCH] Disable profiles that are not in good shape for RHEL8
5+
6+
---
7+
rhel8/CMakeLists.txt | 6 ------
8+
rhel8/profiles/anssi_bp28_high.profile | 2 +-
9+
rhel8/profiles/cjis.profile | 2 +-
10+
rhel8/profiles/ism_o.profile | 2 +-
11+
rhel8/profiles/rhelh-stig.profile | 2 +-
12+
rhel8/profiles/rhelh-vpp.profile | 2 +-
13+
rhel8/profiles/rht-ccp.profile | 2 +-
14+
rhel8/profiles/standard.profile | 2 +-
15+
11 files changed, 10 insertions(+), 16 deletions(-)
16+
17+
diff --git a/rhel8/CMakeLists.txt b/rhel8/CMakeLists.txt
18+
index d61689c97..5e444a101 100644
19+
--- a/rhel8/CMakeLists.txt
20+
+++ b/rhel8/CMakeLists.txt
21+
@@ -14,15 +14,9 @@ ssg_build_html_table_by_ref(${PRODUCT} "cis")
22+
ssg_build_html_table_by_ref(${PRODUCT} "pcidss")
23+
ssg_build_html_table_by_ref(${PRODUCT} "anssi")
24+
25+
-ssg_build_html_nistrefs_table(${PRODUCT} "standard")
26+
ssg_build_html_nistrefs_table(${PRODUCT} "ospp")
27+
ssg_build_html_nistrefs_table(${PRODUCT} "stig")
28+
29+
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_minimal")
30+
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_intermediary")
31+
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_enhanced")
32+
-ssg_build_html_anssirefs_table(${PRODUCT} "bp28_high")
33+
-
34+
ssg_build_html_cce_table(${PRODUCT})
35+
36+
ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE})
37+
diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile
38+
index ccad93d67..6a854378c 100644
39+
--- a/rhel8/profiles/anssi_bp28_high.profile
40+
+++ b/rhel8/profiles/anssi_bp28_high.profile
41+
@@ -1,4 +1,4 @@
42+
-documentation_complete: true
43+
+documentation_complete: false
44+
45+
title: 'ANSSI BP-028 (high)'
46+
47+
diff --git a/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile
48+
index 035d2705b..c6475f33e 100644
49+
--- a/rhel8/profiles/cjis.profile
50+
+++ b/rhel8/profiles/cjis.profile
51+
@@ -1,4 +1,4 @@
52+
-documentation_complete: true
53+
+documentation_complete: false
54+
55+
metadata:
56+
version: 5.4
57+
diff --git a/rhel8/profiles/ism_o.profile b/rhel8/profiles/ism_o.profile
58+
index a3c427c01..4605dea3b 100644
59+
--- a/rhel8/profiles/ism_o.profile
60+
+++ b/rhel8/profiles/ism_o.profile
61+
@@ -1,4 +1,4 @@
62+
-documentation_complete: true
63+
+documentation_complete: false
64+
65+
metadata:
66+
SMEs:
67+
diff --git a/rhel8/profiles/rhelh-stig.profile b/rhel8/profiles/rhelh-stig.profile
68+
index 1efca5f44..c3d0b0964 100644
69+
--- a/rhel8/profiles/rhelh-stig.profile
70+
+++ b/rhel8/profiles/rhelh-stig.profile
71+
@@ -1,4 +1,4 @@
72+
-documentation_complete: true
73+
+documentation_complete: false
74+
75+
title: '[DRAFT] DISA STIG for Red Hat Enterprise Linux Virtualization Host (RHELH)'
76+
77+
diff --git a/rhel8/profiles/rhelh-vpp.profile b/rhel8/profiles/rhelh-vpp.profile
78+
index 2baee6d66..8592d7aaf 100644
79+
--- a/rhel8/profiles/rhelh-vpp.profile
80+
+++ b/rhel8/profiles/rhelh-vpp.profile
81+
@@ -1,4 +1,4 @@
82+
-documentation_complete: true
83+
+documentation_complete: false
84+
85+
title: 'VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Enterprise Linux Hypervisor (RHELH)'
86+
87+
diff --git a/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile
88+
index c84579592..164ec98c4 100644
89+
--- a/rhel8/profiles/rht-ccp.profile
90+
+++ b/rhel8/profiles/rht-ccp.profile
91+
@@ -1,4 +1,4 @@
92+
-documentation_complete: true
93+
+documentation_complete: false
94+
95+
title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)'
96+
97+
diff --git a/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile
98+
index a63ae2cf3..da669bb84 100644
99+
--- a/rhel8/profiles/standard.profile
100+
+++ b/rhel8/profiles/standard.profile
101+
@@ -1,4 +1,4 @@
102+
-documentation_complete: true
103+
+documentation_complete: false
104+
105+
title: 'Standard System Security Profile for Red Hat Enterprise Linux 8'
106+
107+
--
108+
2.26.2
109+
Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
From 8e43a6a6432a8cbeb5742771ddbd0856669a7878 Mon Sep 17 00:00:00 2001
2+
From: Watson Sato <wsato@redhat.com>
3+
Date: Wed, 17 Feb 2021 15:36:59 +0100
4+
Subject: [PATCH] Remove kickstart for profile not shipped
5+
6+
RHEL-8 ANSSI high is not shipped at the momment
7+
---
8+
.../ssg-rhel8-anssi_bp28_high-ks.cfg | 167 ------------------
9+
1 file changed, 167 deletions(-)
10+
delete mode 100644 rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
11+
12+
diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
13+
deleted file mode 100644
14+
index b5c09253a..000000000
15+
--- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg
16+
+++ /dev/null
17+
@@ -1,167 +0,0 @@
18+
-# SCAP Security Guide ANSSI BP-028 (high) profile kickstart for Red Hat Enterprise Linux 8
19+
-# Version: 0.0.1
20+
-# Date: 2020-12-10
21+
-#
22+
-# Based on:
23+
-# https://pykickstart.readthedocs.io/en/latest/
24+
-# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg
25+
-
26+
-# Specify installation method to use for installation
27+
-# To use a different one comment out the 'url' one below, update
28+
-# the selected choice with proper options & un-comment it
29+
-#
30+
-# Install from an installation tree on a remote server via FTP or HTTP:
31+
-# --url the URL to install from
32+
-#
33+
-# Example:
34+
-#
35+
-# url --url=http://192.168.122.1/image
36+
-#
37+
-# Modify concrete URL in the above example appropriately to reflect the actual
38+
-# environment machine is to be installed in
39+
-#
40+
-# Other possible / supported installation methods:
41+
-# * install from the first CD-ROM/DVD drive on the system:
42+
-#
43+
-# cdrom
44+
-#
45+
-# * install from a directory of ISO images on a local drive:
46+
-#
47+
-# harddrive --partition=hdb2 --dir=/tmp/install-tree
48+
-#
49+
-# * install from provided NFS server:
50+
-#
51+
-# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
52+
-#
53+
-# Set language to use during installation and the default language to use on the installed system (required)
54+
-lang en_US.UTF-8
55+
-
56+
-# Set system keyboard type / layout (required)
57+
-keyboard us
58+
-
59+
-# Configure network information for target system and activate network devices in the installer environment (optional)
60+
-# --onboot enable device at a boot time
61+
-# --device device to be activated and / or configured with the network command
62+
-# --bootproto method to obtain networking configuration for device (default dhcp)
63+
-# --noipv6 disable IPv6 on this device
64+
-#
65+
-# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
66+
-# "--bootproto=static" must be used. For example:
67+
-# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
68+
-#
69+
-network --onboot yes --bootproto dhcp --noipv6
70+
-
71+
-# Set the system's root password (required)
72+
-# Plaintext password is: server
73+
-# Refer to e.g.
74+
-# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
75+
-# to see how to create encrypted password form for different plaintext password
76+
-rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220
77+
-
78+
-# The selected profile will restrict root login
79+
-# Add a user that can login and escalate privileges
80+
-# Plaintext password is: admin123
81+
-user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
82+
-
83+
-# Configure firewall settings for the system (optional)
84+
-# --enabled reject incoming connections that are not in response to outbound requests
85+
-# --ssh allow sshd service through the firewall
86+
-firewall --enabled --ssh
87+
-
88+
-# State of SELinux on the installed system (optional)
89+
-# Defaults to enforcing
90+
-selinux --enforcing
91+
-
92+
-# Set the system time zone (required)
93+
-timezone --utc America/New_York
94+
-
95+
-# Specify how the bootloader should be installed (required)
96+
-# Plaintext password is: password
97+
-# Refer to e.g.
98+
-# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw
99+
-# to see how to create encrypted password form for different plaintext password
100+
-bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0
101+
-
102+
-# Initialize (format) all disks (optional)
103+
-zerombr
104+
-
105+
-# The following partition layout scheme assumes disk of size 20GB or larger
106+
-# Modify size of partitions appropriately to reflect actual machine's hardware
107+
-#
108+
-# Remove Linux partitions from the system prior to creating new ones (optional)
109+
-# --linux erase all Linux partitions
110+
-# --initlabel initialize the disk label to the default based on the underlying architecture
111+
-clearpart --linux --initlabel
112+
-
113+
-# Create primary system partitions (required for installs)
114+
-part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec"
115+
-part pv.01 --grow --size=1
116+
-
117+
-# Create a Logical Volume Management (LVM) group (optional)
118+
-volgroup VolGroup --pesize=4096 pv.01
119+
-
120+
-# Create particular logical volumes (optional)
121+
-logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow
122+
-# Ensure /usr Located On Separate Partition
123+
-logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev"
124+
-# Ensure /opt Located On Separate Partition
125+
-logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
126+
-# Ensure /srv Located On Separate Partition
127+
-logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid"
128+
-# Ensure /home Located On Separate Partition
129+
-logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev"
130+
-# Ensure /tmp Located On Separate Partition
131+
-logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
132+
-# Ensure /var/tmp Located On Separate Partition
133+
-logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
134+
-# Ensure /var Located On Separate Partition
135+
-logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev"
136+
-# Ensure /var/log Located On Separate Partition
137+
-logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"
138+
-# Ensure /var/log/audit Located On Separate Partition
139+
-logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec"
140+
-logvol swap --name=swap --vgname=VolGroup --size=2016
141+
-
142+
-# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol)
143+
-# content - security policies - on the installed system.This add-on has been enabled by default
144+
-# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this
145+
-# functionality will automatically be installed. However, by default, no policies are enforced,
146+
-# meaning that no checks are performed during or after installation unless specifically configured.
147+
-#
148+
-# Important
149+
-# Applying a security policy is not necessary on all systems. This screen should only be used
150+
-# when a specific policy is mandated by your organization rules or government regulations.
151+
-# Unlike most other commands, this add-on does not accept regular options, but uses key-value
152+
-# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic.
153+
-# Values can be optionally enclosed in single quotes (') or double quotes (").
154+
-#
155+
-# The following keys are recognized by the add-on:
156+
-# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide.
157+
-# - If the content-type is scap-security-guide, the add-on will use content provided by the
158+
-# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect.
159+
-# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location.
160+
-# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream.
161+
-# xccdf-id - ID of the benchmark you want to use.
162+
-# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive.
163+
-# profile - ID of the profile to be applied. Use default to apply the default profile.
164+
-# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url.
165+
-# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive.
166+
-#
167+
-# The following is an example %addon org_fedora_oscap section which uses content from the
168+
-# scap-security-guide on the installation media:
169+
-%addon org_fedora_oscap
170+
- content-type = scap-security-guide
171+
- profile = xccdf_org.ssgproject.content_profile_anssi_bp28_high
172+
-%end
173+
-
174+
-# Packages selection (%packages section is required)
175+
-%packages
176+
-
177+
-# Require @Base
178+
-@Base
179+
-
180+
-%end # End of %packages section
181+
-
182+
-# Reboot after the installation is complete (optional)
183+
-# --eject attempt to eject CD or DVD media before rebooting
184+
-reboot --eject
185+
--
186+
2.26.2
187+

0 commit comments

Comments
 (0)