scap-security-guide

scap-security-guide@lists.fedorahosted.org

2359 discussions

ComplianceAsCode/content v0.1.77
by Matthew Burket 02 Jun '25

02 Jun '25

Hello all, ComplianceAsCode/Content v0.1.77 is out. Some of the highlights of this release are: - Introduce Architecture Decisions Records (#13019) - Move stabilization to the third Monday of the second month (#13119) - Remove CCI References (#13397) - Remove macOS content (https://github.com/ComplianceAsCode/content/pull/13158) Welcome to the new contributors: * am-tux <andrew.miller11(a)gmail.com> * Anna-Koudelkova <akoudelk(a)redhat.com> * Sinong Chen <costinchen(a)tencent.com> * Benjamin Deering <ben_deering(a)jeepingben.net> * ericeberry <ericeberry(a)gmail.com> * Evelyn <evansvevelyn(a)gmail.com> * Jan Fader <jan.fader(a)web.de> * Sun, Haoxiang <haoxiang.sun(a)intel.com> * Andrew Lukoshko <andrew.lukoshko(a)gmail.com> * Daniel Ruf <daniel(a)daniel-ruf.de> * Xiaojie Yuan <xiyuan(a)redhat.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.77 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.77/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.77/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.77/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.77/scap-… Thank you to everyone who contributed! Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

2 1

Stabilization of 0.1.77
by Vojtech Polasek 21 May '25

21 May '25

Hello all, The release of Content version 0.1.77 is scheduled for May 30, 2025. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.78 milestone. Any bug fixes you would like to include in release 0.1.77 should be proposed for the *stabilization-v0.1.77* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.78, is scheduled to be released on August 29, 2025, with the stabilization phase starting on August 18, 2025. Regards, -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

ComplianceAsCode/content v0.1.76
by Vojtech Polasek 24 Feb '25

24 Feb '25

Hello all, ComplianceAsCode/Content v0.1.76 is out. Some of the highlights of this release are: - Add new product for Ubuntu 24.04 and draft CIS profiles (#12611) - Add pyproject.toml for the ssg package (#12604) - AlmaLinux OS 9 as a new product (#12810) - Documentation for ssg library (#12606) - Extend SSG library to more easily collect profile selections (#12797) - Extend SSG with functions to manage variables (#12717) Welcome to the new contributors: * Simon John <sjohn(a)tuxcare.com> * Alan Moore <alan.moore(a)canonical.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.76/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.76/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.76/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.76/scap-… Thank you to everyone who contributed! Regards, -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

stabilization of v0.1.76
by Vojtech Polasek 05 Feb '25

05 Feb '25

Hello all, The release of Content version 0.1.76 is scheduled for February 17, 2025. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.77 milestone. Any bug fixes you would like to include in release 0.1.76 should be proposed for the *stabilization-v0.1.76* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.77, is scheduled to be released on May 19, 2025, with the stabilization phase starting on May 5, 2025. Regards, -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

2 3

Mapping auditd rules to compliance requirements
by Jeff Walzer 07 Jan '25

07 Jan '25

I am reviewing the auditd rules here <https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v4…>, and for example the rules block below lists the rules for Group add delete modify: ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify I was looking to see if there was a doc that lists the individual auditd rules and the compliance requirement it would validate. So taking those rules above and dumping them into a spreadsheet as follows: User and Group Management Events Compliance Requirement Rules Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Basically a mapping of compliance requirements and the rules associated that would be used to validate the compliance requirement. Thx

3 6

ComplianceAsCode/content v0.1.75
by Matthew Burket 14 Nov '24

14 Nov '24

Hello all, ComplianceAsCode/Content v0.1.75 is out. Some of the highlights of this release are: - Add new product kylinserver10 (#12393) - Create OL10 product (#12290) - Update PCI-DSS control file for version 4.0.1 (#12435) Welcome to the new contributors: * Eric Berry <eric.berry(a)canonical.com> * lichtblaugue <guenther.lichtblau(a)eviden.com> * Dmitry Makovey <dmakovey(a)yahoo.com> * Nicolas SAID <nicolas.said(a)atos.net> * yunimoo <yunimoo(a)nekocake.cafe> * zhaoyun <zhaoyun(a)kylinos.cn> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… Thank you to everyone who contributed! Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

Stabilization of v0.1.75
by Matthew Burket 06 Nov '24

06 Nov '24

Hello all, The release of Content version 0.1.75 is scheduled for November 07, 2025. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.76 milestone. Any bug fixes you would like to include in release 0.1.75 should be proposed for the *stabilization-v0.1.75* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.76, is scheduled to be released on February 09, 2025, with the stabilization phase starting on January 29, 2025. Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

ComplianceAsCode/content v0.1.74
by Matthew Burket 09 Aug '24

09 Aug '24

Hello all, ComplianceAsCode/Content v0.1.74 is out. Some of the highlights of this release are: - Add Amazon Linux 2023 product (#12006) - Introduce new remediation type Kickstart (#12144) - Make PAM macros more flexible to variables (#12133) - Remove Debian 10 Product (#12205) - Remove Red Hat Enterprise Linux 7 product (#12093) - Update CIS RHEL9 control file to v2.0.0 (#12067) Welcome to the new contributors: * Armando Acosta <armando.acosta(a)oracle.com> * CoreyCook8 <129206271+CoreyCook8(a)users.noreply.github.com> * Marco Fortina <marco_fortina(a)hotmail.it> * hipponix <mirco.santori(a)gmail.com> * Donald Hunter <donald.hunter(a)gmail.com> * Nathan Moyer <nmoyer(a)spectric.com> * namoyer10 <48189779+namoyer10(a)users.noreply.github.com> * Mirco Santori <mirco.santori(a)roche.com> * wqian <alan.moore(a)canonical.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

Stabilization of v0.1.74
by Matthew Burket 29 Jul '24

29 Jul '24

Hello all, The release of Content version 0.1.74 is scheduled for August 9, 2024. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.75 milestone. Any bug fixes you would like to include in release 0.1.74 should be proposed for the *stabilization-v0.1.74* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.75, is scheduled to be released on November 8, 2024, with the stabilization phase starting on October 28, 2024. Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

ComplianceAsCode/content v0.1.73
by Matthew Burket 16 May '24

16 May '24

Hello all, ComplianceAsCode/Content v0.1.73 is out. Some of the highlights of this release are: - CMP 2417: Implement PCI-DSS v4.0 outline for OpenShift (#11651) - Disable RHEL 10 content for 0.1.73 release (#11989) - Generate rule references from control files (#11540) - Initial implementation of STIG V1R1 profile for Ubuntu 22.04 LTS (#11820) Welcome to the new contributors: * Paul Bastide <pbastide(a)redhat.com> * BenGui <benoit.guillon1(a)etu.unilim.fr> * Ross Murphy <RossMurphy(a)ibm.com> * steven.y.gui <steven_ygui(a)163.com> * Yuqing Yang <yyq01323329(a)alibaba-inc.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… Thank you to everyone who contributed! Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide