Merge pull request #14653 from vojtapolasek/update_stig_rhel9_vr27_to_v2r8

Update RHEL 9 STIG to v2r8

Author: Mab879

linux_os/guide/services/fapolicyd/fapolicy_default_deny/oval/shared.xml

@@ -24,7 +24,7 @@
     <ind:textfilecontent54_object id="object_fapolicy_default_deny_policy_compiled_rules"
         version="1">
         <ind:filepath>/etc/fapolicyd/compiled.rules</ind:filepath>
-        <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
+        <ind:pattern operation="pattern match">^\s*deny(_log|_audit)?\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
         <ind:instance datatype="int">1</ind:instance>
     </ind:textfilecontent54_object>
 
@@ -37,7 +37,7 @@
     <ind:textfilecontent54_object id="object_fapolicy_default_deny_policy_fapolicyd_rules"
         version="2">
         <ind:filepath>/etc/fapolicyd/fapolicyd.rules</ind:filepath>
-        <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
+        <ind:pattern operation="pattern match">^\s*deny(_log|_audit)?\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
         <ind:instance datatype="int">1</ind:instance>
     </ind:textfilecontent54_object>
 

linux_os/guide/services/fapolicyd/fapolicy_default_deny/rule.yml

@@ -1,18 +1,25 @@
 documentation_complete: true
 
 
-title: 'Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.'
+title: "Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the
+     Execution of Authorized Software Programs."
 
 description: |-
-    The Fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and to prevent unauthorized software from running.
+    The Fapolicy module must be configured to employ a deny-all, permit-by-exception policy to
+    allow the execution of authorized software programs and to prevent unauthorized software from
+    running.
 
 rationale: |-
-    Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software.
-    Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of whitelisted software occurs prior to execution or at system startup.
+    Utilizing a whitelist provides a configuration management method for allowing the execution of
+    only authorized software.
+    Using only authorized software decreases risk by limiting the number of potential
+    vulnerabilities.
+    Verification of whitelisted software occurs prior to execution or at system startup.
 
     Proceed with caution with enforcing the use of this daemon.
     Improper configuration may render the system non-functional.
-    The "fapolicyd" API is not namespace aware and can cause issues when launching or running containers.
+    The "fapolicyd" API is not namespace aware and can cause issues when launching or running
+    containers.
 
 severity: medium
 
@@ -22,11 +29,12 @@ identifiers:
     cce@rhel10: CCE-90343-5
 
 references:
-  nist: CM-7 (2),CM-7 (5) (b),CM-6 b
-  srg: SRG-OS-000368-GPOS-00154,SRG-OS-000370-GPOS-00155,SRG-OS-000480-GPOS-00232
-  stigid@ol8: OL08-00-040137
+    nist: CM-7 (2),CM-7 (5) (b),CM-6 b
+    srg: SRG-OS-000368-GPOS-00154,SRG-OS-000370-GPOS-00155,SRG-OS-000480-GPOS-00232
+    stigid@ol8: OL08-00-040137
 
-ocil_clause: 'fapolicyd is not running in enforcement mode with a deny-all, permit-by-exception policy'
+ocil_clause: "fapolicyd is not running in enforcement mode with a deny-all, permit-by-exception
+    policy"
 
 ocil: |-
     Verify the {{{ full_name }}} "fapolicyd" employs a deny-all, permit-by-exception policy.
@@ -52,23 +60,33 @@ ocil: |-
     deny_audit perm=any pattern=ld_so : all
     deny perm=any all : all
 
+    Note: The "deny_log" and "deny_audit" actions also meet the security requirements as they deny
+    execution while additionally providing logging.
+
 fixtext: |-
-    Configure {{{ full_name }}} to employ a deny-all, permit-by-exception application whitelisting policy with "fapolicyd".
+    Configure {{{ full_name }}} to employ a deny-all, permit-by-exception application whitelisting
+    policy with "fapolicyd".
 
-    With the "fapolicyd" installed and enabled, configure the daemon to function in permissive mode until the whitelist is built correctly to avoid system lockout. Do this by editing the "/etc/fapolicyd/fapolicyd.conf" file with the following line:
+    With the "fapolicyd" installed and enabled, configure the daemon to function in permissive mode
+    until the whitelist is built correctly to avoid system lockout.
+    Do this by editing the "/etc/fapolicyd/fapolicyd.conf" file with the following line:
 
     permissive = 1
 
     {{%- if product in ["ol8", "rhel8"] %}}
     For {{{ product_short_name }}} 8.5 systems and older:
-    Build the whitelist in the "/etc/fapolicyd/fapolicyd.rules" file ensuring the last rule is "deny perm=any all : all".
+    Build the whitelist in the "/etc/fapolicyd/fapolicyd.rules" file ensuring
+    the last rule is "deny perm=any all : all".
 
     For {{{ product_short_name }}} 8.6 systems and newer:
     {{%- endif %}}
-    Build the whitelist in a file within the "/etc/fapolicyd/rules.d" directory ensuring the last rule is "deny perm=any all : all".
+    Build the whitelist in a file within the "/etc/fapolicyd/rules.d" directory ensuring
+    the last rule implements a deny-all policy, such as "deny perm=any all : all".
 
-    Once it is determined the whitelist is built correctly, set the fapolicyd to enforcing mode by editing the "permissive" line in the /etc/fapolicyd/fapolicyd.conf file.
+    Once it is determined the whitelist is built correctly, set the fapolicyd to enforcing mode by
+    editing the "permissive" line in the /etc/fapolicyd/fapolicyd.conf file.
 
     permissive = 0
 
-srg_requirement: 'The {{{ full_name }}} fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.'
+srg_requirement: "The {{{ full_name }}} fapolicy module must be configured to employ a deny-all,
+    permit-by-exception policy to allow the execution of authorized software programs."

linux_os/guide/services/fapolicyd/fapolicy_default_deny/tests/deny_audit_policy.pass.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# packages = fapolicyd
+
+if [ -f /etc/fapolicyd/compiled.rules ]; then
+    active_rules_file="/etc/fapolicyd/compiled.rules"
+else
+    active_rules_file="/etc/fapolicyd/fapolicyd.rules"
+fi
+
+truncate -s 0 $active_rules_file
+echo "allow exe=/usr/bin/python3.7 : ftype=text/x-python" >> $active_rules_file
+echo "deny_audit perm=any all : all" >> $active_rules_file
+
+{{{ set_config_file(path="/etc/fapolicyd/fapolicyd.conf",
+                    parameter="permissive",
+                    value="0",
+                    create=true,
+                    insensitive=true,
+                    separator=" = ",
+                    separator_regex="\s*=\s*",
+                    prefix_regex="^\s*", rule_id=rule_id) }}}

linux_os/guide/services/fapolicyd/fapolicy_default_deny/tests/deny_log_policy.pass.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# packages = fapolicyd
+
+if [ -f /etc/fapolicyd/compiled.rules ]; then
+    active_rules_file="/etc/fapolicyd/compiled.rules"
+else
+    active_rules_file="/etc/fapolicyd/fapolicyd.rules"
+fi
+
+truncate -s 0 $active_rules_file
+echo "allow exe=/usr/bin/python3.7 : ftype=text/x-python" >> $active_rules_file
+echo "deny_log perm=any all : all" >> $active_rules_file
+
+{{{ set_config_file(path="/etc/fapolicyd/fapolicyd.conf",
+                    parameter="permissive",
+                    value="0",
+                    create=true,
+                    insensitive=true,
+                    separator=" = ",
+                    separator_regex="\s*=\s*",
+                    prefix_regex="^\s*", rule_id=rule_id) }}}

linux_os/guide/system/permissions/partitions/mount_option_boot_efi_nosuid/policy/stig/shared.yml

@@ -1,11 +1,20 @@
-srg_requirement: |-
-    {{{ full_name }}} must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
-
-vuldiscussion: |-
-    The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
-
-
-
+srg_requirement: >-
+    {{{ full_name }}} must prevent files with the
+    setuid and setgid bit set from being executed
+    on the /boot/efi directory.
+
+vuldiscussion: >-
+    The "nosuid" mount option causes the system
+    not to execute "setuid" and "setgid" files
+    with owner privileges. This option must be
+    used for mounting any file system not
+    containing approved "setuid" and "setguid"
+    files. Executing files from untrusted file
+    systems increases the opportunity for
+    nonprivileged users to attain unauthorized
+    administrative access.
+
+# yamllint disable rule:line-length
 checktext: |-
     Note: For systems that use BIOS, this requirement is not applicable.
 
@@ -17,7 +26,6 @@ checktext: |-
 
     If the /boot/efi file system does not have the "nosuid" option set, this is a finding.
 
+# yamllint enable rule:line-length
 fixtext: |-
     Modify "/etc/fstab" to use the "nosuid" option on the "/boot/efi" directory.
-
-

linux_os/guide/system/permissions/partitions/mount_option_boot_efi_nosuid/tests/vfat_with_nosuid.pass.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 # This test verifies that the rule passes when /boot/efi is mounted with vfat filesystem
+# with the nosuid option set
 
 # packages = dosfstools
 

linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml

@@ -31,7 +31,6 @@
       - lustre
       - davfs
       - fuse.sshfs
-      - vfat
 
 - name: "{{{ rule_title }}}: Ensure non-root local partitions are mounted with nodev option"
   ansible.posix.mount:
@@ -46,13 +45,19 @@
     - "item.options is not search('nodev')"
     - "item.fstype not in excluded_fstypes"
     # Attempting to change polyinstantiated mounts for /tmp and /var/tmp, if present, will fail
-    - "(not accounts_polyinstantiated_var_tmp | default(false)) or item.mount != '/var/tmp/tmp-inst'"
+    - >-
+      (not accounts_polyinstantiated_var_tmp |
+      default(false)) or item.mount !=
+      '/var/tmp/tmp-inst'
     - "(not accounts_polyinstantiated_tmp | default(false)) or item.mount != '/tmp/tmp-inst'"
   with_items:
     - "{{ ansible_facts.mounts }}"
 
-- name: "{{{ rule_title }}}: Ensure non-root local partitions are present with nodev option in /etc/fstab"
+- name: >-
+    {{{ rule_title }}}: Ensure nodev option in
+    /etc/fstab for non-root local partitions
   ansible.builtin.replace:
     path: /etc/fstab
-    regexp: '^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/(?!boot|efi)\w\S*)\s+(?!vfat\s)(\S+)\s+(?!.*\bnodev\b)(\S+)(.*)$'
+    # yamllint disable-line rule:line-length
+    regexp: '^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/(?!boot|efi)\w\S*)\s+(\S+)\s+(?!.*\bnodev\b)(\S+)(.*)$'
     replace: '\1 \2 \3 \4,nodev \5'

linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh

@@ -30,7 +30,6 @@ excluded_fstypes=(
     lustre
     davfs
     fuse.sshfs
-    vfat
 )
 
 for partition_record in "${partitions_records[@]}"; do
@@ -65,5 +64,5 @@ for partition_record in "${partitions_records[@]}"; do
     {{{ bash_ensure_partition_is_mounted("$mount_point")     | indent(4) }}}
 done
 
-# Remediate unmounted /etc/fstab entries, excluding /boot, /efi, and vfat partitions
-sed -i -E '/nodev/! { /^\s*(\/dev\/\S+|UUID=\S+)\s+\/(boot|efi)/! { /^\s*(\/dev\/\S+|UUID=\S+)\s+\/\w\S*\s+vfat\s/! s;^\s*(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(\S+)(.*)$;\1 \2 \3 \4,nodev \5; } }' /etc/fstab
+# Remediate unmounted /etc/fstab entries, excluding /boot and /efi partitions
+sed -i -E '/nodev/! { /^\s*(\/dev\/\S+|UUID=\S+)\s+\/(boot|efi)/! s;^\s*(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(\S+)(.*)$;\1 \2 \3 \4,nodev \5; }' /etc/fstab

linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/oval/shared.xml

@@ -33,7 +33,7 @@
   <linux:partition_state id="state_local_nodev" version="1">
     <!-- this check defines a local partition as one which has a device node in /dev -->
     <linux:device operation="pattern match">^/dev/.*$</linux:device>
-    <linux:fs_type operation="pattern match">^(?!afs$|autofs$|ceph$|cifs$|smb3$|smbfs$|sshfs$|ncpfs$|ncp$|nfs$|nfs4$|gfs$|gfs2$|glusterfs$|gpfs$|pvfs2$|ocfs2$|lustre$|davfs$|fuse\.sshfs$|vfat$).+</linux:fs_type>
+    <linux:fs_type operation="pattern match">^(?!afs$|autofs$|ceph$|cifs$|smb3$|smbfs$|sshfs$|ncpfs$|ncp$|nfs$|nfs4$|gfs$|gfs2$|glusterfs$|gpfs$|pvfs2$|ocfs2$|lustre$|davfs$|fuse\.sshfs$).+</linux:fs_type>
     <linux:mount_options datatype="string" entity_check="all"
     operation="not equal">nodev</linux:mount_options>
   </linux:partition_state>
@@ -46,7 +46,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object version="1" id="object_non_root_partitions_in_fstab">
     <ind:filepath>/etc/fstab</ind:filepath>
-    <ind:pattern operation="pattern match">^\s*(?!#)(?:/dev/\S+|UUID=\S+)\s+/(?!boot|efi)\w\S*\s+(?!vfat\s)\S+\s+(\S+)</ind:pattern>
+    <ind:pattern operation="pattern match">^\s*(?!#)(?:/dev/\S+|UUID=\S+)\s+/(?!boot|efi)\w\S*\s+\S+\s+(\S+)</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_state version="1"

linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml

@@ -18,9 +18,11 @@ rationale: |-
     to set <tt>nodev</tt> on these filesystems.
 
 ocil: |
-    To verify the <tt>nodev</tt> option is configured for non-root local partitions, run the following command:
+    To verify the <tt>nodev</tt> option is configured for non-root local partitions,
+    run the following command:
     <pre>$ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev'</pre>
-    The output shows local non-root partitions mounted without the <tt>nodev</tt> option, and there should be no output at all.
+    The output shows local non-root partitions mounted without the <tt>nodev</tt> option,
+    and there should be no output at all.
 
 ocil_clause: "some mounts appear among output lines"
 
@@ -38,10 +40,17 @@ identifiers:
 references:
     cis-csc: 11,14,3,9
     cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.02,DSS05.05,DSS06.06
-    isa-62443-2009: 4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3
-    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6'
+    isa-62443-2009: "4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,\
+        4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,\
+        4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,\
+        4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3"
+    isa-62443-2013: "SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,\
+        SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,\
+        SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6"
     iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2
-    nerc-cip: CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2
+    nerc-cip: "CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.3,\
+        CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,\
+        CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2"
     nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7
     nist-csf: PR.IP-1,PR.PT-3
     srg: SRG-OS-000368-GPOS-00154,SRG-OS-000480-GPOS-00227
@@ -61,7 +70,4 @@ warnings:
         device nodes. The <tt>/boot</tt> and <tt>/efi</tt> partitions are
         excluded because they are special partitions usually handled by a
         systemd mount unit, and enforcing <tt>nodev</tt> on them during
-        operating system installation causes issues. Partitions with the
-        <tt>vfat</tt> file system type are excluded because vfat does not
-        support Unix device special files, so <tt>nodev</tt> enforcement on
-        them is not meaningful.
+        operating system installation causes issues.