v0.31.0

essentials revision 4: a new control, ES-25 (read this if you waive essentials controls)

The essentials profile has a 25th control, ES-25 "Mandatory access control is on": it passes when SELinux is set to enforcing in /etc/selinux/config, or the apparmor package is installed and its unit is enabled (Ubuntu and Debian do this by default). permissive, disabled and no mandatory access control at all fail. A stock Amazon Linux 2023 ships SELinux in permissive mode, so it fails ES-25. The check reads what the next boot does, not the running kernel (a kernel started without the module, or setenforce 0 since boot, is not seen), and it does not apply to container images.

What you have to do: a waiver of a control of essentials names the revision it was written for, so after this release those waivers stop applying until you write them again for revision: 4 (the scan lists them and says so). Waivers of single checks, and everything under kisa-2026, are not affected. A host that confines its services another way gets a FAIL for ES-25: waive it with a reason.

Also in this release: the Korean wording in the dashboard and the Korean documentation says 점검 항목 where it said 컨트롤 (KISA's own term); English text and command output are unchanged.

Changelog

Features

• 0ffc46a feat: essentials revision 4: ES-25, mandatory access control is on (#244)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.31.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.