ComplianceAsCode · teacup-on-rockingchair · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -110,6 +110,7 @@ option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be bu
 option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_OPENSUSE16 "If enabled, the openSUSE Leap 16 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHCOS4 "If enabled, the RHCOS4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHEL8 "If enabled, the RHEL8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHEL9 "If enabled, the RHEL9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -349,6 +350,7 @@ message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}")
 message(STATUS "OpenEmbedded: ${SSG_PRODUCT_OPENEMBEDDED}")
 message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}")
 message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}")
+message(STATUS "openSUSE Leap 16: ${SSG_PRODUCT_OPENSUSE16}")
 message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}")
 message(STATUS "RHEL 9: ${SSG_PRODUCT_RHEL9}")
 message(STATUS "RHEL 10: ${SSG_PRODUCT_RHEL10}")
@@ -464,6 +466,9 @@ endif()
 if(SSG_PRODUCT_OPENSUSE)
     add_subdirectory("products/opensuse" "opensuse")
 endif()
+if(SSG_PRODUCT_OPENSUSE16)
+    add_subdirectory("products/opensuse16" "opensuse16")
+endif()
 if(SSG_PRODUCT_RHEL8)
     add_subdirectory("products/rhel8" "rhel8")
 endif()

diff --git a/Dockerfiles/test_suite-opensuse16 b/Dockerfiles/test_suite-opensuse16
@@ -0,0 +1,22 @@
+FROM registry.opensuse.org/opensuse/leap:16
+
+ENV AUTH_KEYS=/root/.ssh/authorized_keys
+
+ARG CLIENT_PUBLIC_KEY
+ARG ADDITIONAL_PACKAGES
+
+RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/16.0/repo/oss/ leap-oss
+RUN zypper refresh
+
+RUN true \
+        && zypper --non-interactive install openssh-clients openssh-server openscap-utils \
+        python313 python313-rpm python313-pip tar gawk ansible \
+        $ADDITIONAL_PACKAGES \
+&& true
+
+RUN true \
+        && for key_type in rsa ecdsa; do ssh-keygen -N '' -t $key_type -f /etc/ssh/ssh_host_${key_type}_key; done \
+        && mkdir -p /root/.ssh \
+        && printf "%s\n" "$CLIENT_PUBLIC_KEY" >> "$AUTH_KEYS" \
+        && chmod og-rw /root/.ssh "$AUTH_KEYS" \
+&& true
diff --git a/build_product b/build_product
@@ -373,6 +373,7 @@ all_cmake_products=(
 	OPENEMBEDDED
 	OPENEULER2203
 	OPENSUSE
+	OPENSUSE16
 	RHCOS4
 	RHEL8
 	RHEL9

diff --git a/product_properties/10-aide-audit.yml b/product_properties/10-aide-audit.yml
@@ -4,7 +4,7 @@ default:
     - "auditd"
     - "ausearch"
     - "aureport"
-    {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}}
+    {{% if product not in ['rhel10', 'ol10', 'fedora', 'opensuse16', 'sle16'] %}}
     - "autrace"
     {{% endif %}}
     {{% if 'rhel' not in product and 'ol' not in families and 'debian' not in families and 'ubuntu' not in families and 'almalinux' not in product %}}
@@ -14,3 +14,10 @@ default:
     - "rsyslogd"
     {{% endif %}}
     - "augenrules"
+    {{% if 'suse' in families and product != 'sle12' %}}
+    - "audisp-syslog"
+    {{% endif %}}
+    {{% if product in ['opensuse16', 'sle16'] %}}
+    - audisp-remote
+    - audispd-zos-remote
+    {{% endif %}}
diff --git a/product_properties/10-audit-binaries.yml b/product_properties/10-audit-binaries.yml
@@ -29,3 +29,14 @@ overrides:
     - /usr/sbin/augenrules
     - /usr/sbin/audisp-syslog
 {{% endif %}}
+{{% if product in ['opensuse16', 'sle16'] %}}
+  audit_binaries:
+    - /usr/sbin/auditctl
+    - /usr/sbin/aureport
+    - /usr/sbin/ausearch
+    - /usr/sbin/auditd
+    - /usr/sbin/augenrules
+    - /usr/sbin/audisp-syslog
+    - /usr/sbin/audisp-remote
+    - /usr/sbin/audispd-zos-remote
+{{% endif %}}
diff --git a/product_properties/10-pwhistory-conf.yml b/product_properties/10-pwhistory-conf.yml
@@ -2,6 +2,6 @@ default:
   pwhistory_path: "/etc/security/pwhistory.conf"
 
 overrides:
-{{% if product == 'sle16' %}}
+{{% if product in ['opensuse16', 'sle16'] %}}
   pwhistory_path: "/usr/etc/security/pwhistory.conf"
 {{% endif %}}
diff --git a/products/opensuse/product.yml b/products/opensuse/product.yml
@@ -17,10 +17,6 @@ cpes:
       name: "cpe:/o:opensuse:leap:15"
       title: "openSUSE Leap 15"
       check_id: installed_OS_is_opensuse_leap15
-  - opensuse-16:
-      name: "cpe:/o:opensuse:leap:16"
-      title: "openSUSE Leap 16"
-      check_id: installed_OS_is_opensuse_leap16
   - opensuse-tumbleweed:
       name: "cpe:/o:opensuse:tumbleweed"
       title: "openSUSE Tumbleweed"

diff --git a/products/opensuse16/CMakeLists.txt b/products/opensuse16/CMakeLists.txt
@@ -0,0 +1,6 @@
+# Sometimes our users will try to do: "cd opensuse16; cmake ." That needs to error in a nice way.
+if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
+    message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
+endif()
+
+ssg_build_product("opensuse16")
diff --git a/products/opensuse16/product.yml b/products/opensuse16/product.yml
@@ -0,0 +1,42 @@
+product: opensuse16
+full_name: openSUSE 16
+type: platform
+
+major_version_ordinal: 16
+families:
+  - suse
+
+benchmark_id: OPENSUSE-16
+benchmark_root: "../../linux_os/guide"
+
+profiles_root: "./profiles"
+
+pkg_manager: "zypper"
+pkg_manager_config_file: "/etc/zypp/zypp.conf"
+
+init_system: "systemd"
+sshd_distributed_config: "true"
+aide_bin_path: "/usr/bin/aide"
+audisp_conf_path: "/etc/audit"
+
+cpes_root: "../../shared/applicability"
+cpes:
+  - opensuse16:
+      name: "cpe:/o:opensuse:leap:16"
+      title: "openSUSE Leap 16"
+      check_id: installed_OS_is_opensuse_leap16
+
+platform_package_overrides:
+  login_defs: "shadow"
+  grub2: "grub2"
+  sssd: "sssd"
+  crontabs: "cronie"
+  passwd: "shadow"
+  dhcp-client: "dhcpcd"
+
+dconf_gdm_dir: "gdm.d"
+
+sysctl_remediate_drop_in_file: "true"
+journald_conf_dir_path: /etc/systemd/journald.conf.d
+xwindows_packages:
+  - xwayland
diff --git a/products/opensuse16/profiles/stig.profile b/products/opensuse16/profiles/stig.profile
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+reference: https://www.cyber.mil/stigs/downloads/
+
+title: 'General Purpose Operating System Security Profile for openSUSE Leap 16'
+
+description: |-
+    General Purpose Operating System Security Profile for openSUSE Leap 16
+
+selections:
+    - srg_gpos:all
+    - package_audit-audispd-plugins_installed
+    - '!aide_periodic_cron_checking'
+    - '!aide_verify_ext_attributes'
+    - '!enable_fips_mode'
+    - '!package_subscription-manager_installed'
diff --git a/shared/applicability/oval/system_with_kernel.xml b/shared/applicability/oval/system_with_kernel.xml
@@ -6,15 +6,15 @@
       {{% if "ol" in families %}}
       <criterion comment="kernel-uek is installed" test_ref="inventory_test_kernel_uek_installed" />
       {{% endif %}}
-      {{% if 'sle' in product or 'slmicro' in product %}}
+      {{% if 'suse' in families %}}
       <criterion comment="kernel-default-base is installed" test_ref="inventory_test_kernel_default_base_installed" />
       <criterion comment="kernel-azure is installed" test_ref="inventory_test_kernel_azure_installed" />
       {{% endif %}}
     </criteria>
   </definition>
 {{% if 'debian' in product or 'ubuntu' in product %}}
 {{{ oval_test_package_installed(package="linux-base", test_id="inventory_test_kernel_installed") }}}
-{{% elif 'sle' in product or 'slmicro' in product %}}
+{{% elif 'suse' in families %}}
 {{{ oval_test_package_installed(package="kernel-default", test_id="inventory_test_kernel_installed") }}}
 {{{ oval_test_package_installed(package="kernel-default-base", test_id="inventory_test_kernel_default_base_installed") }}}
 {{{ oval_test_package_installed(package="kernel-azure", test_id="inventory_test_kernel_azure_installed") }}}

diff --git a/shared/applicability/package.yml b/shared/applicability/package.yml
@@ -51,15 +51,19 @@ args:
   iptables:
     pkgname: iptables
   krb5-libs:
+    {{% if 'suse' in families %}}
+    pkgname: krb5
+    {{% else %}}
     pkgname: krb5-libs
+    {{% endif %}}
   libpwquality:
-    {{% if 'debian' in product or 'sle' in product or 'slmicro' in product or 'ubuntu' in product %}}
+    {{% if 'debian' in product or 'suse' in families or 'ubuntu' in product %}}
     pkgname: libpwquality1
     {{% else %}}
     pkgname: libpwquality
     {{% endif %}}
   libreswan:
-    {{% if product in  ["sle15", "sle16"] %}}
+    {{% if product in  ["opensuse16", "sle15", "sle16"] %}}
     pkgname: strongswan-ipsec
     {{% else %}}
     pkgname: libreswan
@@ -123,7 +127,7 @@ args:
     pkgname: rsh-server
   shadow-utils:
     {{% if pkg_system == "rpm" %}}
-    {{% if 'sle' in product or 'slmicro' in product or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}}
+    {{% if 'suse' in families or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}}
       pkgname: shadow
     {{% elif product in ["openembedded"] %}}
       pkgname: shadow-base

diff --git a/shared/applicability/system_with_kernel.yml b/shared/applicability/system_with_kernel.yml
@@ -16,7 +16,7 @@ title: Bare-metal systems, virtual machines, bootc container images, running boo
 # was set in past.
 check_id: system_with_kernel
 {{% if pkg_system == "rpm" %}}
-{{% if "sle" in product or "slmicro" in product %}}
+{{% if 'suse' in families %}}
 bash_conditional: >-
     rpm --quiet -q kernel-default ||
     rpm --quiet -q kernel-default-base ||
@@ -41,7 +41,7 @@ bash_conditional: >-
 {{% endif %}}
 {{% if "debian" in product or "ubuntu" in product %}}
 ansible_conditional: '"linux-base" in ansible_facts.packages'
-{{% elif "sle" in product or "slmicro" in product %}}
+{{% elif 'suse' in families %}}
 ansible_conditional: >-
     "kernel-default" in ansible_facts.packages or
     "kernel-default-base" in ansible_facts.packages or

diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
@@ -2863,7 +2863,7 @@ This macro creates a Bash conditional which checks the system architecture in /p
 #}}
 {{% macro bash_copy_distro_defaults(source, destination) -%}}
 
-{{% if product in ["sle16", "slmicro6"] %}}
+{{% if product in ["opensuse16", "sle16", "slmicro6"] %}}
 if ! [ -e "{{{ destination }}}" ] ; then
     cp -p "{{{ source }}}" "{{{ destination }}}"
 fi
@@ -2887,7 +2887,7 @@ fi
 {{%- set line_regex_replace = "^" + parameter -%}}
 {{%- set login_defs_d_config_dir = "/".join(login_defs_drop_in_path.split("/")[:-1]) -%}}
 
-{{% if product in [ 'slmicro6', 'sle16' ] %}}
+{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
 {{{ bash_copy_distro_defaults(login_defs_defaults_path, login_defs_path) }}}
 {{% endif %}}
 

diff --git a/shared/templates/package_installed/bash.template b/shared/templates/package_installed/bash.template
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro,multi_platform_debian,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
 # reboot = false
 # strategy = enable
 # complexity = low

diff --git a/shared/templates/service_disabled/bash.template b/shared/templates/service_disabled/bash.template
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_debian
+# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
 # reboot = false
 # strategy = disable
 # complexity = low

diff --git a/shared/templates/service_enabled/bash.template b/shared/templates/service_enabled/bash.template
@@ -1,4 +1,4 @@
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_debian
+# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
 # reboot = false
 # strategy = enable
 # complexity = low

diff --git a/shared/templates/sshd_lineinfile/ansible.template b/shared/templates/sshd_lineinfile/ansible.template
@@ -4,7 +4,7 @@
 # complexity = low
 # disruption = low
 
-{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
 {{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
 - name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
   ansible.builtin.stat:

diff --git a/shared/templates/sshd_lineinfile/bash.template b/shared/templates/sshd_lineinfile/bash.template
@@ -4,7 +4,7 @@
 # complexity = low
 # disruption = low
 
-{{% if product in ['sle16', 'slmicro6'] %}}
+{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
     {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
     {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
 {{% endif %}}

diff --git a/shared/templates/sudo_defaults_option/ansible.template b/shared/templates/sudo_defaults_option/ansible.template
@@ -4,7 +4,7 @@
 # complexity = low
 # disruption = low
 
-{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
 {{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}}
 {{{
     ansible_lineinfile(

diff --git a/shared/templates/sudo_defaults_option/bash.template b/shared/templates/sudo_defaults_option/bash.template
@@ -8,7 +8,7 @@
 {{{ bash_instantiate_variables(VARIABLE_NAME) }}}
 {{% endif %}}
 
-{{% if product in [ 'sle16', 'slmicro6' ] %}}
+{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
 {{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}}
 {{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}}
 {{% endif %}}

diff --git a/shared/templates/sudo_defaults_option/oval.template b/shared/templates/sudo_defaults_option/oval.template
@@ -2,7 +2,7 @@
     <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Checks sudoers Defaults " + OPTION + " configuration", rule_title=rule_title) }}}
     <criteria operator="AND">
-        {{% if product in [ 'sle16', 'slmicro6' ] %}}
+        {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
         <criterion
             comment="test if configuration file /etc/sudoers exists for {{{ rule_id }}}"
             test_ref="test_{{{ rule_id }}}_config_file_exists"/>
@@ -29,7 +29,7 @@
 
   <external_variable comment="Variable value for sudo {{{ OPTION }}} " datatype="string" id="{{{ VARIABLE_NAME }}}" version="1" />
 {{% endif %}}
-   {{% if product in [ 'sle16', 'slmicro6' ] %}}
+   {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}}
    {{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}}
    {{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}}
    {{% endif %}}

diff --git a/shared/templates/sysctl/ansible.template b/shared/templates/sysctl/ansible.template
@@ -10,7 +10,7 @@
 
 - name: {{{ rule_title }}} - Set fact for sysctl paths
   ansible.builtin.set_fact:
-{{% if 'sle' in product or 'slmicro' in product %}}
+{{% if 'suse' in families %}}
     sysctl_paths:
       - "/run/sysctl.d/"
       - "/etc/sysctl.d/"

diff --git a/shared/templates/sysctl/bash.template b/shared/templates/sysctl/bash.template
@@ -1,11 +1,11 @@
-# platform = multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
+# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
 # reboot = true
 # strategy = disable
 # complexity = low
 # disruption = medium
 
 # Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.d/*.conf files
-{{% if product in [ "sle12", "sle15", "slmicro5", "slmicro6"] %}}
+{{% if 'suse' in families %}}
 for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf; do
 {{% elif product in [ "ubuntu2204", "ubuntu2404"] %}}
 for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /etc/ufw/sysctl.conf; do

@@ -55,7 +55,7 @@
     'rhcos4',
     'ol7', 'ol8', 'ol9', 'ol10',
     'openeuler2203',
-    'opensuse',
+    'opensuse', 'opensuse16',
     'openembedded',
     'rhel8', 'rhel9', 'rhel10',
     'rhv4',
@@ -235,6 +235,7 @@
     "Oracle Linux 10": "ol10",
     "openEuler 2203": "openeuler2203",
     "openSUSE": "opensuse",
+    "openSUSE 16": "opensuse16",
     "Red Hat Enterprise Linux 8": "rhel8",
     "Red Hat Enterprise Linux 9": "rhel9",
     "Red Hat Enterprise Linux 10": "rhel10",
@@ -313,7 +314,7 @@
     "multi_platform_kylinserver": ["kylinserver10"],
     "multi_platform_kylinsecserver": ["kylinsecserver6"],
     "multi_platform_openeuler": ["openeuler2203"],
-    "multi_platform_opensuse": ["opensuse"],
+    "multi_platform_opensuse": ["opensuse", "opensuse16"],
     "multi_platform_ol": ["ol7", "ol8", "ol9", "ol10"],
     "multi_platform_ocp": ["ocp4"],
     "multi_platform_rhcos": ["rhcos4"],

@@ -30,10 +30,6 @@ cpes:
       check_id: installed_OS_is_opensuse_leap15
       name: cpe:/o:opensuse:leap:15
       title: openSUSE Leap 15
-  - opensuse-16:
-      check_id: installed_OS_is_opensuse_leap16
-      name: cpe:/o:opensuse:leap:16
-      title: openSUSE Leap 16
   - opensuse-tumbleweed:
       check_id: installed_OS_is_opensuse
       name: cpe:/o:opensuse:tumbleweed