Apply suggestions from wsato's code review

These fix up various CIS identifiers in RHEL 7 and RHEL 8 content. Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>
ComplianceAsCode · Apr 22, 2021 · b41263f · b41263f
1 parent bdd6a3b
commit b41263f
Show file tree

Hide file tree

Showing 27 changed files with 15 additions and 42 deletions.
diff --git a/.../system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml b/.../system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml
@@ -36,8 +36,8 @@ identifiers:
 
 references:
     stigid@ol7: OL07-00-030871
-    cis@rhel7: 5.2.5
-    cis@rhel8: 5.2.5
+    cis@rhel7: 4.1.5
+    cis@rhel8: 4.1.11
     cjis: 5.4.1.1
     cui: 3.1.7
     disa: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001683,CCI-001684,CCI-001685,CCI-001686,CCI-002130,CCI-002132

diff --git a/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml b/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml
@@ -36,8 +36,8 @@ identifiers:
 
 references:
     stigid@ol7: OL07-00-030872
-    cis@rhel7: 5.2.5
-    cis@rhel8: 5.2.5
+    cis@rhel7:  4.1.5
+    cis@rhel8: 4.1.11
     cjis: 5.4.1.1
     cui: 3.1.7
     disa: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001683,CCI-001684,CCI-001685,CCI-001686,CCI-002130,CCI-002132

diff --git a/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml b/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml
@@ -36,8 +36,8 @@ identifiers:
 
 references:
     stigid@ol7: OL07-00-030874
-    cis@rhel7: 5.2.5
-    cis@rhel8: 5.2.5
+    cis@rhel7: 4.1.5
+    cis@rhel8: 4.1.11
     cjis: 5.4.1.1
     cui: 3.1.7
     disa: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001683,CCI-001684,CCI-001685,CCI-001686,CCI-002130,CCI-002132

diff --git a/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml b/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml
@@ -36,8 +36,8 @@ identifiers:
 
 references:
     stigid@ol7: OL07-00-030870
-    cis@rhel7: 5.2.5
-    cis@rhel8: 5.2.5
+    cis@rhel7: 4.1.5
+    cis@rhel8: 4.1.11
     cjis: 5.4.1.1
     cui: 3.1.7
     disa: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001683,CCI-001684,CCI-001685,CCI-001686,CCI-002130,CCI-002132

diff --git a/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml b/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml
@@ -36,8 +36,8 @@ identifiers:
 
 references:
     stigid@ol7: OL07-00-030873
-    cis@rhel7: 5.2.5
-    cis@rhel8: 5.2.5
+    cis@rhel7: 4.1.5
+    cis@rhel8: 4.1.11
     cjis: 5.4.1.1
     cui: 3.1.7
     disa: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001683,CCI-001684,CCI-001685,CCI-001686,CCI-002130,CCI-002132

diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml
@@ -33,8 +33,6 @@ identifiers:
     cce@rhcos4: CCE-83582-7
 
 references:
-    cis@rhel7: 1.4.2
-    cis@rhel8: 1.4.2
     cui: 3.4.5
     disa: CCI-000213
     hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)

diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml
@@ -25,7 +25,7 @@ severity: medium
 
 references:
     cis@rhel7: 1.4.1
-    cis@rhel8: 1.4.1
+    cis@rhel8: 1.5.1
     cjis: 5.5.2.2
     cui: 3.4.5
     disa: CCI-000225

diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml
@@ -23,7 +23,7 @@ severity: medium
 
 references:
     cis@rhel7: 1.4.1
-    cis@rhel8: 1.4.1
+    cis@rhel8: 1.5.1
     cjis: 5.5.2.2
     cui: 3.4.5
     disa: CCI-000225

diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml
@@ -21,7 +21,7 @@ severity: medium
 
 references:
     cis@rhel7: 1.4.1
-    cis@rhel8: 1.4.1
+    cis@rhel8: 1.5.1
     cui: 3.4.5
     disa: CCI-000225
     nist: CM-6(a),AC-6(1)

diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml
@@ -40,8 +40,6 @@ identifiers:
     cce@rhcos4: CCE-83540-5
 
 references:
-    cis@rhel7: 1.4.2
-    cis@rhel8: 1.4.2
     cui: 3.4.5
     disa: CCI-000213
     hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)

diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml
@@ -53,7 +53,7 @@ identifiers:
 references:
     stigid@ol7: OL07-00-010491
     cis@rhel7: 1.4.2
-    cis@rhel8: 1.4.2
+    cis@rhel8: 1.5.2
     cui: 3.4.5
     disa: CCI-000213
     hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)

diff --git a/...uide/system/logging/rsyslog_accepting_remote_messages/package_syslogng_installed/rule.yml b/...uide/system/logging/rsyslog_accepting_remote_messages/package_syslogng_installed/rule.yml
@@ -14,8 +14,6 @@ severity: medium
 
 references:
     anssi: BP28(R46),BP28(R5)
-    cis@rhel7: 5.1.1
-    cis@rhel8: 5.1.1
     disa: CCI-001311,CCI-001312
     nist: CM-6(a)
     nist-csf: PR.PT-1

diff --git a/...tem/logging/rsyslog_accepting_remote_messages/rsyslog_accept_remote_messages_tcp/rule.yml b/...tem/logging/rsyslog_accepting_remote_messages/rsyslog_accept_remote_messages_tcp/rule.yml
@@ -21,7 +21,6 @@ identifiers:
 
 references:
     cis@rhel7: 4.2.1.5
-    cis@rhel8: 4.2.1.5
     nist: CM-6(a),AU-6(3),AU-6(4)
     isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9'
     isa-62443-2009: 4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4

diff --git a/...tem/logging/rsyslog_accepting_remote_messages/rsyslog_accept_remote_messages_udp/rule.yml b/...tem/logging/rsyslog_accepting_remote_messages/rsyslog_accept_remote_messages_udp/rule.yml
@@ -22,7 +22,6 @@ identifiers:
 
 references:
     cis@rhel7: 4.2.1.5
-    cis@rhel8: 4.2.1.5
     nist: CM-6(a),AU-6(3),AU-6(4)
     isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9'
     isa-62443-2009: 4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4

diff --git a/.../guide/system/logging/rsyslog_accepting_remote_messages/service_syslogng_enabled/rule.yml b/.../guide/system/logging/rsyslog_accepting_remote_messages/service_syslogng_enabled/rule.yml
@@ -15,8 +15,6 @@ severity: medium
 references:
     disa: CCI-001311,CCI-001312,CCI-001557,CCI-001851
     anssi: BP28(R46),BP28(R5)
-    cis@rhel7: 5.1.2
-    cis@rhel8: 5.1.2
     nist: CM-6(a),AU-4(1)
     nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.DS-4,PR.PT-1
     isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 6.1,SR 6.2,SR 7.1,SR 7.2'

diff --git a/...work/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml b/...work/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml
@@ -20,7 +20,7 @@ identifiers:
 references:
     anssi: BP28(R22)
     cis@rhel7: 3.3.2
-    cis@rhel8: 3.3.2
+    cis@rhel8: 3.2.2
     cui: 3.1.20
     disa: CCI-001551
     disa@sle15: CCI-000366

diff --git a/...system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml b/...system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml
@@ -20,8 +20,6 @@ identifiers:
     cce@rhel7: CCE-80175-3
 
 references:
-    cis@rhel7: 3.3.3
-    cis@rhel8: 3.3.3
     cui: 3.1.20
     disa: CCI-001551
     nist: CM-7(a),CM-7(b),CM-6(a)

diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml
@@ -19,8 +19,6 @@ identifiers:
 
 references:
     anssi: BP28(R23)
-    cis@rhel7: 1.6.1
-    cis@rhel8: 1.6.1
     nist: CM-6(a),AC-6(1)
     srg: SRG-OS-000324-GPOS-00125
     stigid@rhel8: RHEL-08-010374

diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml
@@ -21,8 +21,6 @@ identifiers:
 
 references:
     anssi: BP28(R23)
-    cis@rhel7: 1.6.1
-    cis@rhel8: 1.6.1
     nist: CM-6(a),AC-6(1)
     srg: SRG-OS-000324-GPOS-00125
     stigid@rhel8: RHEL-08-010373

diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml
@@ -20,7 +20,6 @@ identifiers:
 
 references:
     cis@rhel7: 1.1.1.2
-    cis@rhel8: 1.1.1.2
     cui: 3.4.6
     nist: CM-7(a),CM-7(b),CM-6(a)
     nist-csf: PR.IP-1,PR.PT-3

diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml
@@ -20,7 +20,6 @@ identifiers:
 
 references:
     cis@rhel7: 1.1.1.4
-    cis@rhel8: 1.1.1.4
     cui: 3.4.6
     nist: CM-7(a),CM-7(b),CM-6(a)
     nist-csf: PR.IP-1,PR.PT-3

diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml
@@ -20,7 +20,6 @@ identifiers:
 
 references:
     cis@rhel7: 1.1.1.5
-    cis@rhel8: 1.1.1.5
     cui: 3.4.6
     nist: CM-7(a),CM-7(b),CM-6(a)
     nist-csf: PR.IP-1,PR.PT-3

diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml
@@ -20,7 +20,6 @@ identifiers:
 
 references:
     cis@rhel7: 1.1.1.3
-    cis@rhel8: 1.1.1.3
     cui: 3.4.6
     nist: CM-7(a),CM-7(b),CM-6(a)
     nist-csf: PR.IP-1,PR.PT-3

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml
@@ -27,8 +27,6 @@ identifiers:
 references:
     stigid@ol7: OL07-00-021000
     disa: CCI-000366
-    cis@rhel7: 1.1.3
-    cis@rhel8: 1.1.3
     nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7
     nist-csf: PR.IP-1,PR.PT-2,PR.PT-3
     stigid@rhel7: RHEL-07-021000

diff --git a/.../guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml b/.../guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml
@@ -32,8 +32,6 @@ identifiers:
     cce@rhel8: CCE-82069-6
 
 references:
-    cis@rhel7: 1.1.11
-    cis@rhel8: 1.1.11
     nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7
     nist-csf: PR.IP-1,PR.PT-3
     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6'

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml
@@ -23,8 +23,6 @@ identifiers:
     cce@rhel7: CCE-80155-5
 
 references:
-    cis@rhel7: 1.1.6
-    cis@rhel8: 1.1.6
     nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7
     nist-csf: PR.IP-1,PR.PT-3
     isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6'

diff --git a/...em/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml b/...em/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml
@@ -30,7 +30,6 @@ identifiers:
 
 references:
     cis@rhel7: 1.5.2
-    cis@rhel8: 1.5.2
     cui: 3.1.7
     disa: CCI-002530
     hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3),164.308(a)(4),164.310(b),164.310(c),164.312(a),164.312(e)