diff --git a/CMakeLists.txt b/CMakeLists.txt index c58ed4c74078..466949ce0a03 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -110,6 +110,7 @@ option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be bu option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) +option(SSG_PRODUCT_OPENSUSE16 "If enabled, the openSUSE Leap 16 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHCOS4 "If enabled, the RHCOS4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHEL8 "If enabled, the RHEL8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHEL9 "If enabled, the RHEL9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) @@ -349,6 +350,7 @@ message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}") message(STATUS "OpenEmbedded: ${SSG_PRODUCT_OPENEMBEDDED}") message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}") message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}") +message(STATUS "openSUSE Leap 16: ${SSG_PRODUCT_OPENSUSE16}") message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}") message(STATUS "RHEL 9: ${SSG_PRODUCT_RHEL9}") message(STATUS "RHEL 10: ${SSG_PRODUCT_RHEL10}") @@ -464,6 +466,9 @@ endif() if(SSG_PRODUCT_OPENSUSE) add_subdirectory("products/opensuse" "opensuse") endif() +if(SSG_PRODUCT_OPENSUSE16) + add_subdirectory("products/opensuse16" "opensuse16") +endif() if(SSG_PRODUCT_RHEL8) add_subdirectory("products/rhel8" "rhel8") endif() diff --git a/Dockerfiles/test_suite-opensuse16 b/Dockerfiles/test_suite-opensuse16 new file mode 100644 index 000000000000..98ea7bd18306 --- /dev/null +++ b/Dockerfiles/test_suite-opensuse16 @@ -0,0 +1,22 @@ +FROM registry.opensuse.org/opensuse/leap:16 + +ENV AUTH_KEYS=/root/.ssh/authorized_keys + +ARG CLIENT_PUBLIC_KEY +ARG ADDITIONAL_PACKAGES + +RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/16.0/repo/oss/ leap-oss +RUN zypper refresh + +RUN true \ + && zypper --non-interactive install openssh-clients openssh-server openscap-utils \ + python313 python313-rpm python313-pip tar gawk ansible \ + $ADDITIONAL_PACKAGES \ +&& true + +RUN true \ + && for key_type in rsa ecdsa; do ssh-keygen -N '' -t $key_type -f /etc/ssh/ssh_host_${key_type}_key; done \ + && mkdir -p /root/.ssh \ + && printf "%s\n" "$CLIENT_PUBLIC_KEY" >> "$AUTH_KEYS" \ + && chmod og-rw /root/.ssh "$AUTH_KEYS" \ +&& true diff --git a/build_product b/build_product index b2d0434b195e..59b004574f25 100755 --- a/build_product +++ b/build_product @@ -373,6 +373,7 @@ all_cmake_products=( OPENEMBEDDED OPENEULER2203 OPENSUSE + OPENSUSE16 RHCOS4 RHEL8 RHEL9 diff --git a/product_properties/10-aide-audit.yml b/product_properties/10-aide-audit.yml index 086678a1c9fe..45626c89ae98 100644 --- a/product_properties/10-aide-audit.yml +++ b/product_properties/10-aide-audit.yml @@ -4,7 +4,7 @@ default: - "auditd" - "ausearch" - "aureport" - {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}} + {{% if product not in ['rhel10', 'ol10', 'fedora', 'opensuse16', 'sle16'] %}} - "autrace" {{% endif %}} {{% if 'rhel' not in product and 'ol' not in families and 'debian' not in families and 'ubuntu' not in families and 'almalinux' not in product %}} @@ -14,3 +14,10 @@ default: - "rsyslogd" {{% endif %}} - "augenrules" + {{% if 'suse' in families and product != 'sle12' %}} + - "audisp-syslog" + {{% endif %}} + {{% if product in ['opensuse16', 'sle16'] %}} + - audisp-remote + - audispd-zos-remote + {{% endif %}} diff --git a/product_properties/10-audit-binaries.yml b/product_properties/10-audit-binaries.yml index f58139679ce5..d98512ac07cf 100644 --- a/product_properties/10-audit-binaries.yml +++ b/product_properties/10-audit-binaries.yml @@ -29,3 +29,14 @@ overrides: - /usr/sbin/augenrules - /usr/sbin/audisp-syslog {{% endif %}} +{{% if product in ['opensuse16', 'sle16'] %}} + audit_binaries: + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote +{{% endif %}} diff --git a/product_properties/10-pwhistory-conf.yml b/product_properties/10-pwhistory-conf.yml index b94e4c5461e8..47af3c534be2 100644 --- a/product_properties/10-pwhistory-conf.yml +++ b/product_properties/10-pwhistory-conf.yml @@ -2,6 +2,6 @@ default: pwhistory_path: "/etc/security/pwhistory.conf" overrides: -{{% if product == 'sle16' %}} +{{% if product in ['opensuse16', 'sle16'] %}} pwhistory_path: "/usr/etc/security/pwhistory.conf" {{% endif %}} diff --git a/products/opensuse/product.yml b/products/opensuse/product.yml index bb8e0cf22627..4ee936c0f9f6 100644 --- a/products/opensuse/product.yml +++ b/products/opensuse/product.yml @@ -17,10 +17,6 @@ cpes: name: "cpe:/o:opensuse:leap:15" title: "openSUSE Leap 15" check_id: installed_OS_is_opensuse_leap15 - - opensuse-16: - name: "cpe:/o:opensuse:leap:16" - title: "openSUSE Leap 16" - check_id: installed_OS_is_opensuse_leap16 - opensuse-tumbleweed: name: "cpe:/o:opensuse:tumbleweed" title: "openSUSE Tumbleweed" diff --git a/products/opensuse16/CMakeLists.txt b/products/opensuse16/CMakeLists.txt new file mode 100644 index 000000000000..48fbdbf2bae1 --- /dev/null +++ b/products/opensuse16/CMakeLists.txt @@ -0,0 +1,6 @@ +# Sometimes our users will try to do: "cd opensuse16; cmake ." That needs to error in a nice way. +if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") + message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") +endif() + +ssg_build_product("opensuse16") diff --git a/products/opensuse16/product.yml b/products/opensuse16/product.yml new file mode 100644 index 000000000000..f9b2fdd48460 --- /dev/null +++ b/products/opensuse16/product.yml @@ -0,0 +1,42 @@ +product: opensuse16 +full_name: openSUSE 16 +type: platform + +major_version_ordinal: 16 +families: + - suse + +benchmark_id: OPENSUSE-16 +benchmark_root: "../../linux_os/guide" + +profiles_root: "./profiles" + +pkg_manager: "zypper" +pkg_manager_config_file: "/etc/zypp/zypp.conf" + +init_system: "systemd" +sshd_distributed_config: "true" +aide_bin_path: "/usr/bin/aide" +audisp_conf_path: "/etc/audit" + +cpes_root: "../../shared/applicability" +cpes: + - opensuse16: + name: "cpe:/o:opensuse:leap:16" + title: "openSUSE Leap 16" + check_id: installed_OS_is_opensuse_leap16 + +platform_package_overrides: + login_defs: "shadow" + grub2: "grub2" + sssd: "sssd" + crontabs: "cronie" + passwd: "shadow" + dhcp-client: "dhcpcd" + +dconf_gdm_dir: "gdm.d" + +sysctl_remediate_drop_in_file: "true" +journald_conf_dir_path: /etc/systemd/journald.conf.d +xwindows_packages: + - xwayland diff --git a/products/opensuse16/profiles/stig.profile b/products/opensuse16/profiles/stig.profile new file mode 100644 index 000000000000..ed3ccc8250a8 --- /dev/null +++ b/products/opensuse16/profiles/stig.profile @@ -0,0 +1,16 @@ +documentation_complete: true + +reference: https://www.cyber.mil/stigs/downloads/ + +title: 'General Purpose Operating System Security Profile for openSUSE Leap 16' + +description: |- + General Purpose Operating System Security Profile for openSUSE Leap 16 + +selections: + - srg_gpos:all + - package_audit-audispd-plugins_installed + - '!aide_periodic_cron_checking' + - '!aide_verify_ext_attributes' + - '!enable_fips_mode' + - '!package_subscription-manager_installed' diff --git a/shared/applicability/oval/system_with_kernel.xml b/shared/applicability/oval/system_with_kernel.xml index 421715cb237c..5c4a42cf857f 100644 --- a/shared/applicability/oval/system_with_kernel.xml +++ b/shared/applicability/oval/system_with_kernel.xml @@ -6,7 +6,7 @@ {{% if "ol" in families %}} {{% endif %}} - {{% if 'sle' in product or 'slmicro' in product %}} + {{% if 'suse' in families %}} {{% endif %}} @@ -14,7 +14,7 @@ {{% if 'debian' in product or 'ubuntu' in product %}} {{{ oval_test_package_installed(package="linux-base", test_id="inventory_test_kernel_installed") }}} -{{% elif 'sle' in product or 'slmicro' in product %}} +{{% elif 'suse' in families %}} {{{ oval_test_package_installed(package="kernel-default", test_id="inventory_test_kernel_installed") }}} {{{ oval_test_package_installed(package="kernel-default-base", test_id="inventory_test_kernel_default_base_installed") }}} {{{ oval_test_package_installed(package="kernel-azure", test_id="inventory_test_kernel_azure_installed") }}} diff --git a/shared/applicability/package.yml b/shared/applicability/package.yml index 1985807da25c..ee6ec07538a8 100644 --- a/shared/applicability/package.yml +++ b/shared/applicability/package.yml @@ -51,15 +51,19 @@ args: iptables: pkgname: iptables krb5-libs: + {{% if 'suse' in families %}} + pkgname: krb5 + {{% else %}} pkgname: krb5-libs + {{% endif %}} libpwquality: - {{% if 'debian' in product or 'sle' in product or 'slmicro' in product or 'ubuntu' in product %}} + {{% if 'debian' in product or 'suse' in families or 'ubuntu' in product %}} pkgname: libpwquality1 {{% else %}} pkgname: libpwquality {{% endif %}} libreswan: - {{% if product in ["sle15", "sle16"] %}} + {{% if product in ["opensuse16", "sle15", "sle16"] %}} pkgname: strongswan-ipsec {{% else %}} pkgname: libreswan @@ -123,7 +127,7 @@ args: pkgname: rsh-server shadow-utils: {{% if pkg_system == "rpm" %}} - {{% if 'sle' in product or 'slmicro' in product or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}} + {{% if 'suse' in families or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}} pkgname: shadow {{% elif product in ["openembedded"] %}} pkgname: shadow-base diff --git a/shared/applicability/system_with_kernel.yml b/shared/applicability/system_with_kernel.yml index f41d8ad79539..c77adaaad284 100644 --- a/shared/applicability/system_with_kernel.yml +++ b/shared/applicability/system_with_kernel.yml @@ -16,7 +16,7 @@ title: Bare-metal systems, virtual machines, bootc container images, running boo # was set in past. check_id: system_with_kernel {{% if pkg_system == "rpm" %}} -{{% if "sle" in product or "slmicro" in product %}} +{{% if 'suse' in families %}} bash_conditional: >- rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base || @@ -41,7 +41,7 @@ bash_conditional: >- {{% endif %}} {{% if "debian" in product or "ubuntu" in product %}} ansible_conditional: '"linux-base" in ansible_facts.packages' -{{% elif "sle" in product or "slmicro" in product %}} +{{% elif 'suse' in families %}} ansible_conditional: >- "kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages or diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja index 116f5fc24bea..0d5023e38fde 100644 --- a/shared/macros/10-bash.jinja +++ b/shared/macros/10-bash.jinja @@ -2863,7 +2863,7 @@ This macro creates a Bash conditional which checks the system architecture in /p #}} {{% macro bash_copy_distro_defaults(source, destination) -%}} -{{% if product in ["sle16", "slmicro6"] %}} +{{% if product in ["opensuse16", "sle16", "slmicro6"] %}} if ! [ -e "{{{ destination }}}" ] ; then cp -p "{{{ source }}}" "{{{ destination }}}" fi @@ -2887,7 +2887,7 @@ fi {{%- set line_regex_replace = "^" + parameter -%}} {{%- set login_defs_d_config_dir = "/".join(login_defs_drop_in_path.split("/")[:-1]) -%}} -{{% if product in [ 'slmicro6', 'sle16' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults(login_defs_defaults_path, login_defs_path) }}} {{% endif %}} diff --git a/shared/templates/package_installed/bash.template b/shared/templates/package_installed/bash.template index dcd451ddbdef..4d62d6a48998 100644 --- a/shared/templates/package_installed/bash.template +++ b/shared/templates/package_installed/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro,multi_platform_debian,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/service_disabled/bash.template b/shared/templates/service_disabled/bash.template index 9516356e4871..5e3bbec1f51c 100644 --- a/shared/templates/service_disabled/bash.template +++ b/shared/templates/service_disabled/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_debian +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = disable # complexity = low diff --git a/shared/templates/service_enabled/bash.template b/shared/templates/service_enabled/bash.template index 4e207a79d75b..bbf1ef3d6530 100644 --- a/shared/templates/service_enabled/bash.template +++ b/shared/templates/service_enabled/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_debian +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/sshd_lineinfile/ansible.template b/shared/templates/sshd_lineinfile/ansible.template index 97d7a94a8ade..fd943342e1e0 100644 --- a/shared/templates/sshd_lineinfile/ansible.template +++ b/shared/templates/sshd_lineinfile/ansible.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} - name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists ansible.builtin.stat: diff --git a/shared/templates/sshd_lineinfile/bash.template b/shared/templates/sshd_lineinfile/bash.template index 2ec3a9ac9136..9dd4257e80b8 100644 --- a/shared/templates/sshd_lineinfile/bash.template +++ b/shared/templates/sshd_lineinfile/bash.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in ['sle16', 'slmicro6'] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sudo_defaults_option/ansible.template b/shared/templates/sudo_defaults_option/ansible.template index 3aaed64fa354..6e2fbec5ca16 100644 --- a/shared/templates/sudo_defaults_option/ansible.template +++ b/shared/templates/sudo_defaults_option/ansible.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}} {{{ ansible_lineinfile( diff --git a/shared/templates/sudo_defaults_option/bash.template b/shared/templates/sudo_defaults_option/bash.template index ae1afe7cc6aa..a0e246d2159e 100644 --- a/shared/templates/sudo_defaults_option/bash.template +++ b/shared/templates/sudo_defaults_option/bash.template @@ -8,7 +8,7 @@ {{{ bash_instantiate_variables(VARIABLE_NAME) }}} {{% endif %}} -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}} {{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sudo_defaults_option/oval.template b/shared/templates/sudo_defaults_option/oval.template index ae99a13560f0..c4b62980dde5 100644 --- a/shared/templates/sudo_defaults_option/oval.template +++ b/shared/templates/sudo_defaults_option/oval.template @@ -2,7 +2,7 @@ {{{ oval_metadata("Checks sudoers Defaults " + OPTION + " configuration", rule_title=rule_title) }}} - {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} @@ -29,7 +29,7 @@ {{% endif %}} - {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}} {{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sysctl/ansible.template b/shared/templates/sysctl/ansible.template index 76b97a10aaf0..3ab92507f468 100644 --- a/shared/templates/sysctl/ansible.template +++ b/shared/templates/sysctl/ansible.template @@ -10,7 +10,7 @@ - name: {{{ rule_title }}} - Set fact for sysctl paths ansible.builtin.set_fact: -{{% if 'sle' in product or 'slmicro' in product %}} +{{% if 'suse' in families %}} sysctl_paths: - "/run/sysctl.d/" - "/etc/sysctl.d/" diff --git a/shared/templates/sysctl/bash.template b/shared/templates/sysctl/bash.template index fe6068fb8bd1..59e8d0138382 100644 --- a/shared/templates/sysctl/bash.template +++ b/shared/templates/sysctl/bash.template @@ -1,11 +1,11 @@ -# platform = multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = true # strategy = disable # complexity = low # disruption = medium # Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.d/*.conf files -{{% if product in [ "sle12", "sle15", "slmicro5", "slmicro6"] %}} +{{% if 'suse' in families %}} for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf; do {{% elif product in [ "ubuntu2204", "ubuntu2404"] %}} for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /etc/ufw/sysctl.conf; do diff --git a/ssg/constants.py b/ssg/constants.py index 013a9ac5abcf..6bf8b7c5c8e4 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -55,7 +55,7 @@ 'rhcos4', 'ol7', 'ol8', 'ol9', 'ol10', 'openeuler2203', - 'opensuse', + 'opensuse', 'opensuse16', 'openembedded', 'rhel8', 'rhel9', 'rhel10', 'rhv4', @@ -235,6 +235,7 @@ "Oracle Linux 10": "ol10", "openEuler 2203": "openeuler2203", "openSUSE": "opensuse", + "openSUSE 16": "opensuse16", "Red Hat Enterprise Linux 8": "rhel8", "Red Hat Enterprise Linux 9": "rhel9", "Red Hat Enterprise Linux 10": "rhel10", @@ -313,7 +314,7 @@ "multi_platform_kylinserver": ["kylinserver10"], "multi_platform_kylinsecserver": ["kylinsecserver6"], "multi_platform_openeuler": ["openeuler2203"], - "multi_platform_opensuse": ["opensuse"], + "multi_platform_opensuse": ["opensuse", "opensuse16"], "multi_platform_ol": ["ol7", "ol8", "ol9", "ol10"], "multi_platform_ocp": ["ocp4"], "multi_platform_rhcos": ["rhcos4"], diff --git a/tests/data/product_stability/opensuse.yml b/tests/data/product_stability/opensuse.yml index 41f37e3fe1dc..1e4cf0216836 100644 --- a/tests/data/product_stability/opensuse.yml +++ b/tests/data/product_stability/opensuse.yml @@ -30,10 +30,6 @@ cpes: check_id: installed_OS_is_opensuse_leap15 name: cpe:/o:opensuse:leap:15 title: openSUSE Leap 15 - - opensuse-16: - check_id: installed_OS_is_opensuse_leap16 - name: cpe:/o:opensuse:leap:16 - title: openSUSE Leap 16 - opensuse-tumbleweed: check_id: installed_OS_is_opensuse name: cpe:/o:opensuse:tumbleweed diff --git a/tests/data/product_stability/opensuse16.yml b/tests/data/product_stability/opensuse16.yml new file mode 100644 index 000000000000..d20606a57acb --- /dev/null +++ b/tests/data/product_stability/opensuse16.yml @@ -0,0 +1,128 @@ +aide_bin_path: /usr/bin/aide +aide_conf_path: /etc/aide.conf +aide_audit_binaries: + - auditctl + - auditd + - ausearch + - aureport + - audispd + - augenrules + - audisp-syslog + - audisp-remote + - audispd-zos-remote +audisp_conf_path: /etc/audit +audit_binaries: + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote +audit_watches_style: legacy +auid: 1000 +basic_properties_derived: true +benchmark_id: OPENSUSE-16 +benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' +chrony_conf_path: /etc/chrony.conf +chrony_d_path: /etc/chrony.d/ +cpes: + - opensuse16: + check_id: installed_OS_is_opensuse_leap16 + name: cpe:/o:opensuse:leap:16 + title: openSUSE Leap 16 +cpes_root: ../../shared/applicability +dconf_gdm_dir: gdm.d +dynamic_uid_max: 65519 +dynamic_uid_min: 61184 +faillock_path: /var/run/faillock +families: + - suse +full_name: openSUSE 16 +gid_min: 1000 +groups: {} +grub2_boot_path: /boot/grub2 +grub2_uefi_boot_path: /boot/grub2 +grub_helper_executable: grub2-mkconfig +init_system: systemd +journald_conf_dir_path: /etc/systemd/journald.conf.d +login_defs_defaults_path: /usr/etc/login.defs +login_defs_drop_in_path: /etc/login.defs.d/oscap.login.defs +login_defs_path: /etc/login.defs +major_version_ordinal: 16 +nobody_gid: 65534 +nobody_uid: 65534 +openssh_client_crypto_policy_config_file: /etc/crypto-policies/back-ends/openssh.config +openssh_server_crypto_policy_config_file: /etc/crypto-policies/back-ends/opensshserver.config +pam_faillock_conf_path: /etc/security/faillock.conf +pkg_manager: zypper +pkg_manager_config_file: /etc/zypp/zypp.conf +pkg_system: rpm +platform_package_overrides: + aarch64_arch: null + crontabs: cronie + dhcp-client: dhcpcd + grub2: grub2 + login_defs: shadow + no_ovirt: null + non-uefi: null + not_aarch64_arch: null + not_s390x_arch: null + ovirt: null + passwd: shadow + s390x_arch: null + sssd: sssd + sssd-ldap: null + uefi: null + zipl: s390utils-base +product: opensuse16 +profiles_root: ./profiles +pwhistory_path: /usr/etc/security/pwhistory.conf +pwquality_path: /etc/security/pwquality.conf +reference_uris: + anssi: https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf + app-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=application-servers + app-srg-ctr: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security + bsi: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf + cis-csc: https://www.cisecurity.org/controls/ + cjis: https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf + cobit5: https://www.isaca.org/resources/cobit + cui: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html + dcid: not_officially_available + disa: https://www.cyber.mil/stigs/cci/ + hipaa: https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf + isa-62443-2009: https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat + isa-62443-2013: https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu + ism: https://www.cyber.gov.au/acsc/view-all-content/ism + iso27001-2013: https://www.iso.org/contents/data/standard/05/45/54534.html + nerc-cip: https://www.nerc.com/standards/reliability-standards/cip + nist: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf + nist-csf: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf + os-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os + ospp: https://www.niap-ccevs.org/Profile/PP.cfm + pcidss: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf + pcidss4: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf + stigid: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux + stigref: https://www.cyber.mil/stigs/srg-stig-tools/ + stigref_vulnerability_id: https://www.cyber.mil/stigs/srg-stig-tools#vulnerability_id +rsyslog_cafile: /etc/pki/tls/cert.pem +ssh_client_config_dir: /etc/ssh/ssh_config.d +ssh_client_main_config_file: /etc/ssh/ssh_config +sshd_config_base_dir: /etc/ssh +sshd_config_dir: /etc/ssh/sshd_config.d +sshd_distributed_config: 'true' +sshd_hardening_config_basename: 00-complianceascode-hardening.conf +sshd_main_config_file: /etc/ssh/sshd_config +sshd_runtime_check: 'false' +sshd_sysconfig_file: /etc/sysconfig/sshd +sysctl_remediate_drop_in_file: 'true' +target_oval_version: + - 5 + - 11 +target_oval_version_str: '5.11' +type: platform +uid_min: 1000 +xwindows_packages: + - xwayland diff --git a/tests/data/product_stability/sle15.yml b/tests/data/product_stability/sle15.yml index 053e4a925bc9..ced930519c08 100644 --- a/tests/data/product_stability/sle15.yml +++ b/tests/data/product_stability/sle15.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /usr/sbin/auditctl diff --git a/tests/data/product_stability/sle16.yml b/tests/data/product_stability/sle16.yml index 924e717a813e..2ea7b53cf72a 100644 --- a/tests/data/product_stability/sle16.yml +++ b/tests/data/product_stability/sle16.yml @@ -7,14 +7,19 @@ aide_audit_binaries: - aureport - audispd - augenrules + - audisp-syslog + - audisp-remote + - audispd-zos-remote audisp_conf_path: /etc/audit audit_binaries: - - /sbin/auditctl - - /sbin/aureport - - /sbin/ausearch - - /sbin/auditd - - /sbin/augenrules - - /sbin/audisp-syslog + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote audit_watches_style: legacy auid: 1000 basic_properties_derived: true diff --git a/tests/data/product_stability/slmicro5.yml b/tests/data/product_stability/slmicro5.yml index ceed5211b095..2adda1b2cad5 100644 --- a/tests/data/product_stability/slmicro5.yml +++ b/tests/data/product_stability/slmicro5.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /sbin/auditctl diff --git a/tests/data/product_stability/slmicro6.yml b/tests/data/product_stability/slmicro6.yml index 9603b7a2e30c..57f1a2a4c2ee 100644 --- a/tests/data/product_stability/slmicro6.yml +++ b/tests/data/product_stability/slmicro6.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /sbin/auditctl