Skip to content

Add rsyslog_filecreatemode to ANSSI and CIS for RHEL 9 and 10 #14713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Mab879 wants to merge 1 commit into from
Closed

Add rsyslog_filecreatemode to ANSSI and CIS for RHEL 9 and 10 #14713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions controls/anssi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@
# From ANSSI DAT-24
# R11 Password protect the BIOS
# R12 Deactivate peripherals not needed
# R13 The boot order list should give highest preference to component on which final OS is installed

Check failure on line 66 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

66:100 [line-length] line too long (104 > 99 characters)
# R14 Enable NX/XD bit
# - bios_enable_execution_restrictions # Doesn't have check
# R15 Disable VT-x/AMD-V functionality
Expand All @@ -79,7 +79,7 @@
Enabling Secure Boot can't be accomplished from the operating system.
Also, OVAL doesn't provide any reliable ways to detect the Secure Boot status.
Therefore, we will not provide any rules to automate this requirement.
We recommend checking the Secure Boot status using the `mokutil --sb-state` or `bootctl status`

Check failure on line 82 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

82:100 [line-length] line too long (105 > 99 characters)
commands.
status: manual

Expand Down Expand Up @@ -120,9 +120,9 @@
It is recommended that UEFI Secure Boot is used to protect the Linux Kernel
command line parameters during boot.
notes: >-
To protect the Linux Kernel command line one needs to create an Unified Kernel Image and use

Check failure on line 123 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

123:100 [line-length] line too long (102 > 99 characters)
it with the UEFI Secure Boot mechanism.
To check if the Kernel image contains the kernel command one needs to inspect the binary, on

Check failure on line 125 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

125:100 [line-length] line too long (102 > 99 characters)
the command line one can use the objdump command. But unfortunately OVAL is not able to
inspect kernel images.
Also, it is not trivial to automate creation of such image or configuration of the
Expand Down Expand Up @@ -152,7 +152,7 @@
- grub2_l1tf_argument
- var_l1tf_options=full_force

# page_poison=on: activate the poisoning of the pages of the page allocator (buddy allocator)

Check failure on line 155 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

155:100 [line-length] line too long (103 > 99 characters)
- grub2_page_poison_argument

# pti=on: force the use of Page Table Isolation (PTI) including on processors claiming
Expand All @@ -163,16 +163,16 @@
# slab caches (dynamic memory allocations) of identical size.
- grub2_slab_nomerge_argument

# slub_debug=F,Z,P: activate certain options for checking slabs caches (dynamic memory allocation)

Check failure on line 166 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

166:100 [line-length] line too long (108 > 99 characters)
- grub2_slub_debug_argument
- var_slub_debug_options=FZP

# spec_store_bypass_disable=seccomp: force the system to use the default countermeasure
# (on an x86 system supporting seccomp) for the Specter v4 (Speculative Store Bypass) vulnerability

Check failure on line 171 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

171:100 [line-length] line too long (109 > 99 characters)
- grub2_spec_store_bypass_disable_argument
- var_spec_store_bypass_disable_options=seccomp

# spectre_v2=on: force the system to use a countermeasure for the Specter v2 (Branch Target Injection) vulnerability.

Check failure on line 175 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

175:100 [line-length] line too long (127 > 99 characters)
- grub2_spectre_v2_argument

# mds=full,nosmt: force the system to use Microarchitectural Data Sampling (MDS) to
Expand Down Expand Up @@ -574,7 +574,7 @@
levels:
- high
notes: >-
If the system can function without support for kernel modules, module support should be disabled

Check failure on line 577 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

577:100 [line-length] line too long (106 > 99 characters)
by setting CONFIG_MODULES=n.
status: automated
rules:
Expand Down Expand Up @@ -658,7 +658,7 @@
- mount_option_tmp_nosuid
- mount_option_tmp_noexec

# /srv nosuid, nodev (noexec, optional ro) Contains files served by a service type web, ftp, etc

Check failure on line 661 in controls/anssi.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

661:100 [line-length] line too long (106 > 99 characters)
- partition_for_srv
- mount_option_srv_nosuid

Expand Down Expand Up @@ -1479,6 +1479,7 @@
- ensure_logrotate_activated

# Based on DAT-PA-012 R26, R27
- rsyslog_filecreatemode
- rsyslog_files_ownership
- rsyslog_files_groupownership
- rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/system/logging/rsyslog_filecreatemode/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ severity: medium
identifiers:
cce@rhel8: CCE-88321-5
cce@rhel9: CCE-88322-3
cce@rhel10: CCE-88611-9
cce@sle15: CCE-92599-0

ocil_clause: '$FileCreateMode is not set or is more permissive than 0640'
Expand Down
4 changes: 2 additions & 2 deletions products/rhel10/controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2494,8 +2494,8 @@ controls:
levels:
- l1_server
- l1_workstation
status: supported
related_rules:
status: automated
rules:
- rsyslog_filecreatemode

- id: 6.2.3.5
Expand Down
1 change: 1 addition & 0 deletions products/rhel10/controls/nist_800_53/ac.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,7 @@ controls:
- package_libselinux_installed
- package_mcstrans_removed
- package_setroubleshoot_removed
- rsyslog_filecreatemode
- rsyslog_files_groupownership
- rsyslog_files_ownership
- rsyslog_files_permissions
Expand Down
4 changes: 2 additions & 2 deletions products/rhel9/controls/cis_rhel9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2428,8 +2428,8 @@ controls:
levels:
- l1_server
- l1_workstation
status: supported
related_rules:
status: automated
rules:
- rsyslog_filecreatemode

- id: 6.2.3.5
Expand Down
1 change: 0 additions & 1 deletion shared/references/cce-redhat-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1078,7 +1078,6 @@ CCE-88607-7
CCE-88608-5
CCE-88609-3
CCE-88610-1
CCE-88611-9
CCE-88612-7
CCE-88614-3
CCE-88615-0
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/anssi_bp28_enhanced.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,7 @@ partition_for_var_log_audit
partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/anssi_bp28_high.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,7 @@ partition_for_var_log_audit
partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,6 +360,7 @@ partition_for_var_log_audit
partition_for_var_tmp
postfix_network_listening_disabled
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,7 @@ partition_for_dev_shm
partition_for_tmp
postfix_network_listening_disabled
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,7 @@ partition_for_dev_shm
partition_for_tmp
postfix_network_listening_disabled
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,6 +357,7 @@ partition_for_var_log_audit
partition_for_var_tmp
postfix_network_listening_disabled
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/anssi_bp28_enhanced.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,6 +239,7 @@ partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
prefer_64bit_os
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/anssi_bp28_high.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,7 @@ partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
prefer_64bit_os
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/anssi_bp28_enhanced.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,7 @@ partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
prefer_64bit_os
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/anssi_bp28_high.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,7 @@ partition_for_var_tmp
postfix_client_configure_mail_alias
postfix_network_listening_disabled
prefer_64bit_os
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,7 @@ partition_for_var_tmp
postfix_network_listening_disabled
root_path_all_dirs
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,7 @@ partition_for_tmp
postfix_network_listening_disabled
root_path_all_dirs
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,7 @@ partition_for_tmp
postfix_network_listening_disabled
root_path_all_dirs
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,6 +326,7 @@ partition_for_var_tmp
postfix_network_listening_disabled
root_path_all_dirs
root_path_no_dot
rsyslog_filecreatemode
rsyslog_files_groupownership
rsyslog_files_ownership
rsyslog_files_permissions
Expand Down
Loading