Blame SPECS/scap-security-guide.spec

9c64d1
# Somehow, _pkgdocdir is already defined and points to unversioned docs dir
9c64d1
# RHEL 7.X uses versioned docs dir, hence the definition below
9c64d1
%global _pkgdocdir %{_docdir}/%{name}-%{version}
2b7b16
2b7b16
Name:		scap-security-guide
44eea6
Version:	0.1.46
44eea6
Release:	11%{?dist}
2b7b16
Summary:	Security guidance and baselines in SCAP formats
2b7b16
2b7b16
Group:		System Environment/Base
7629ac
License:	BSD-3-Clause
0d5c10
URL:		https://github.com/ComplianceAsCode/content
9c64d1
Source0:	%{name}-%{version}.tar.bz2
44eea6
Patch1:	scap-security-guide-0.1.47-compare_suid_files_with_rpm.patch
44eea6
Patch2:	scap-security-guide-0.1.47-improve_bash_based_on_shellcheck.patch
44eea6
Patch3:	scap-security-guide-0.1.47-add_-t_parameter_to_fix_audit_syscall_rule.patch
44eea6
Patch4:	scap-security-guide-0.1.47-remove_slash_from_audit_rules_login_faillock.patch
44eea6
Patch5:	scap-security-guide-0.1.47-update_arufm_to_match_multiple_-S_args.patch
44eea6
Patch6:	scap-security-guide-0.1.47-first_occurence_mtab.patch
44eea6
Patch7:	scap-security-guide-0.1.48-fix_grub2_enable_fips_mode.patch
44eea6
Patch8:	scap-security-guide-0.1.47-remove_shell_module_from_playbooks.patch
44eea6
Patch9:	scap-security-guide-0.1.47-remove_directory_access_var_log_audit_from_ospp.patch
44eea6
Patch10:	scap-security-guide-0.1.48-fix_ansible_tasks_in_check_mode.patch
44eea6
Patch11:	scap-security-guide-0.1.47-e8.patch
44eea6
Patch12:	scap-security-guide-0.1.48-fix_sshd_use_strong.patch
44eea6
Patch13:	scap-security-guide-0.1.47-fix_missing_cce.patch
44eea6
Patch14:	scap-security-guide-0.1.48-add_e8_profile_kickstart.patch
44eea6
Patch15:	scap-security-guide-0.1.48-fix_aide_periodic_crontab_check.patch
44eea6
Patch16:	scap-security-guide-0.1.47-add_missing_cce_sudo_require_authentication.patch
44eea6
Patch17:	disable-not-in-good-shape-profiles.patch
350763
Patch999:       centos-debranding.patch
2b7b16
BuildArch:	noarch
2b7b16
7629ac
BuildRequires:	libxslt, expat, python, openscap-scanner >= 1.2.16, python-jinja2, cmake >= 2.8, PyYAML
fa25b6
Requires:	xml-common, openscap-scanner >= 1.2.5
2b7b16
2b7b16
%description
2b7b16
The scap-security-guide project provides a guide for configuration of the
2b7b16
system from the final system's security point of view. The guidance is
2b7b16
specified in the Security Content Automation Protocol (SCAP) format and
2b7b16
constitutes a catalog of practical hardening advice, linked to government
2b7b16
requirements where applicable. The project bridges the gap between generalized
2b7b16
policy requirements and specific implementation guidelines. The Red Hat
2b7b16
Enterprise Linux 7 system administrator can use the oscap command-line tool
2b7b16
from the openscap-utils package to verify that the system conforms to provided
2b7b16
guideline. Refer to scap-security-guide(8) manual page for further information.
2b7b16
fa25b6
%package	doc
fa25b6
Summary:	HTML formatted documents containing security guides generated from XCCDF benchmarks.
fa25b6
Group:		System Environment/Base
fa25b6
Requires:	%{name} = %{version}-%{release}
fa25b6
fa25b6
%description	doc
fa25b6
The %{name}-doc package contains HTML formatted documents containing security guides that have
fa25b6
been generated from XCCDF benchmarks present in %{name} package.
fa25b6
2b7b16
%prep
2b7b16
%setup -q -n %{name}-%{version}
0d5c10
%patch1 -p1
0d5c10
%patch2 -p1
0d5c10
%patch3 -p1
0d5c10
%patch4 -p1
7629ac
%patch5 -p1
7629ac
%patch6 -p1
7629ac
%patch7 -p1
7629ac
%patch8 -p1
7629ac
%patch9 -p1
7629ac
%patch10 -p1
7629ac
%patch11 -p1
7629ac
%patch12 -p1
7629ac
%patch13 -p1
7629ac
%patch14 -p1
7629ac
%patch15 -p1
7629ac
%patch16 -p1
7629ac
%patch17 -p1
350763
%patch999 -p1
44eea6
# Workaround to remove Python byte cache files from the upstream sources
44eea6
# See https://github.com/ComplianceAsCode/content/issues/4042
44eea6
find . -name '*.pyc' -exec rm -f {} ';'
44eea6
mkdir build
ee8600
2b7b16
%build
7629ac
mkdir -p build && cd build
9c64d1
%cmake -D CMAKE_INSTALL_DOCDIR=%{_pkgdocdir} \
44eea6
-DSSG_PRODUCT_DEFAULT:BOOL=OFF \
0d5c10
-DSSG_PRODUCT_FIREFOX:BOOL=ON \
44eea6
-DSSG_PRODUCT_JRE:BOOL=ON \
0d5c10
-DSSG_PRODUCT_RHEL6:BOOL=ON \
0d5c10
-DSSG_PRODUCT_RHEL7:BOOL=ON \
44eea6
-DSSG_PRODUCT_RHEL8:BOOL=ON \
350763
-DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON \
7629ac
-DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF \
7629ac
../
9c64d1
make %{?_smp_mflags}
2b7b16
2b7b16
%install
0950b5
cd build
7a1abb
%make_install
8ecd84
2b7b16
%files
2b7b16
%defattr(-,root,root,-)
2b7b16
%{_datadir}/xml/scap
fa25b6
%{_datadir}/%{name}
9c64d1
%lang(en) %{_mandir}/man8/scap-security-guide.8.gz
9c64d1
%doc LICENSE
9c64d1
%doc Contributors.md
9c64d1
%doc README.md
0950b5
%doc DISCLAIMER
0950b5
# All files installed by cmake are automatically include in main package
0950b5
# We exclude the guides to here add them in doc package
0950b5
%exclude %{_pkgdocdir}/guides/
fa25b6
fa25b6
%files doc
fa25b6
%defattr(-,root,root,-)
0950b5
%doc build/guides/ssg-*-guide-*.html
2b7b16
2b7b16
%changelog
44eea6
* Thu Nov 28 2019 Jan Černý <jcerny@redhat.com> - 0.1.46-11
44eea6
- Ship RHEL 8 content (RHBZ#1777862)
44eea6
44eea6
* Wed Nov 20 2019 Vojtech Polasek <vpolasek@redhat.com> - 0.1.46-10
44eea6
- Added missing CCE for rule sudo_require_authentication. (RHBZ#1755192)
44eea6
- fix check and remediation for rule aide_periodic_cron_checking (RHBZ#1658036)
44eea6
44eea6
* Mon Nov 18 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.46-9
44eea6
- Fixed missing CCE for OSPP, E8 and STIG profiles. (RHBZ#1726698)
44eea6
- Added kickstart file for the Essential Eight (e8) profile. (RHBZ#1755192)
44eea6
44eea6
* Fri Nov 15 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.46-8
44eea6
- Fix an omission on backporting the patch which fixes krb_sec rule. (RHBZ#1726698)
44eea6
44eea6
* Fri Nov 15 2019 Matěj Týč <matyc@redhat.com> - 0.1.46-7
44eea6
- Added support for the Essential Eight (e8) profile. (RHBZ#1755192)
44eea6
- Fixed issues with sshd rules used in the e8 profile. (RHBZ#1755192)
44eea6
44eea6
* Wed Nov 13 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.46-6
44eea6
- Updated ansible playbooks to use modules in favor of shell. (RHBZ#1726698)
44eea6
- Removed rule directory_access_var_log_audit from OSPP profile. (RHBZ#1726698)
44eea6
- Fixed ansible playbooks failing when running in --check mode. (RHBZ#1726698)
44eea6
44eea6
* Mon Nov 11 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.46-5
44eea6
- Fixed grub2_enable_fips_mode rule when installing RHEL on machines with AES-enabled processors. (RHBZ#1754532)
44eea6
44eea6
* Wed Nov 06 2019 Jan Černý <jcerny@redhat.com> - 0.1.46-4
44eea6
- Fix evaluation and remediation of audit rules in PCI-DSS profile (RHBZ#1754550)
44eea6
- Fixed mtab handling of remediation of /dev/shm/noexec (RHBZ#1754553)
44eea6
44eea6
* Tue Nov 05 2019 Matěj Týč <matyc@redhat.com> - 0.1.46-3
44eea6
- Made the cmake product selection future-proof. (RHBZ#1726698)
44eea6
44eea6
* Tue Nov 05 2019 Jan Černý <jcerny@redhat.com> - 0.1.46-2
44eea6
- Fix rules file_permissions_unauthorized_suid and sgid (RHBZ#1693026)
44eea6
44eea6
* Mon Sep 02 2019 Watson Sato <wsato@redhat.com> - 0.1.46-1
44eea6
- Update to the latest upstream release 0.1.46 (RHBZ#1726698)
44eea6
44eea6
* Fri Aug 09 2019 Matěj Týč <matyc@redhat.com> - 0.1.45-2
44eea6
- Added a patch not to build SCAP 1.2 datastreams, only SCAP 1.3 (RHBZ#1726698)
44eea6
44eea6
* Tue Aug 06 2019 Watson Sato <wsato@redhat.com> - 0.1.45-1
44eea6
- Update to the latest upstream release (RHBZ#1726698)
44eea6
0d5c10
* Wed Jun 12 2019 Matěj Týč <matyc@redhat.com> - 0.1.43-13
0d5c10
- Fixed the shared dconf bash remediation (RHBZ#1631378)
0d5c10
0d5c10
* Mon Jun 03 2019 Jan Černý <jcerny@redhat.com> - 0.1.43-12
0d5c10
- Make aide and smart card rules not applicable to containers (RHBZ#1711893)
0d5c10
- Added rule dconf_db_up_to_date to ensure dconf databases are up-to-date (RHBZ#1631378)
0d5c10
0d5c10
* Fri May 24 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-11
0d5c10
- Remove faulty dconf_use_text_backend rule from all profiles (Reverts RHBZ#1631378)
0d5c10
0d5c10
* Thu May 23 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-10
0d5c10
- Fixed Ansible remediation for sssd_ssh_known_hosts_timeout (RHBZ#1599179)
0d5c10
0d5c10
* Mon May 20 2019 Jan Černý <jcerny@redhat.com> - 0.1.43-9
0d5c10
- Fixed missing Ansible tags and platform checks (RHBZ#1685950)
0d5c10
0d5c10
* Fri May 17 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-8
0d5c10
- Fixed OVAL check for sssd_ssh_known_hosts_timeout and added bash remediation (RHBZ#1599179)
0d5c10
0d5c10
* Fri May 10 2019 Watson Yuuma Sato <wsato@redhat.com> - 0.1.43-7
0d5c10
- Fix handling of package CPE during generation of Ansible playbooks (RHBZ#1647189)
0d5c10
0d5c10
* Fri May 10 2019 Watson Yuuma Sato <wsato@redhat.com> - 0.1.43-6
0d5c10
- Deduplicated more CCEs assigned to rules (RHBZ#1703092)
0d5c10
0d5c10
* Thu Apr 25 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-5
0d5c10
- Remove ensure_gpgcheck_repo_metadata rule from profiles (RHBZ#1703010)
0d5c10
- Deduplicate CCE assigned to rules (RHBZ#1703092)
0d5c10
0d5c10
* Tue Apr 23 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-4
0d5c10
- Mark SELinux rules as machine only (RHBZ#1630739)
0d5c10
- Mark service disabled rules as machine only (RHBZ#1630739)
0d5c10
0d5c10
* Mon Apr 08 2019 Gabriel Becker <ggasparb@redhat.com> - 0.1.43-3
0d5c10
- Mark rules which were not applicable for containers as machine only (RHBZ#1630739)
0d5c10
- Fix content support for UBI-Minimal (RHBZ#1695213)
0d5c10
0d5c10
* Mon Mar 25 2019 Watson Yuuma Sato <wsato@redhat.com> - 0.1.43-2
0d5c10
- Fixes for smooth Ansible playbooks run (RHBZ#1647189)
0d5c10
- Fix Ansible template for file permissions (RHBZ#1686007)
0d5c10
- Fix remediation of rule rpm_verify_permissions (RHBZ#1686005)
0d5c10
- Fix remediation of audit rules for privileged commands (RHBZ#1687826)
877cb5
0d5c10
* Fri Mar 01 2019 Jan Černý <jcerny@redhat.com> - 0.1.43-1
0d5c10
- Update to the latest upstream release (RHBZ#1684545)
94594a
7629ac
* Tue Sep 25 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.40-12
7629ac
- Fix malformed patch for removal of abrt and sendmail (RHBZ#1619689)
7629ac
7629ac
* Tue Sep 25 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-11
7629ac
- Fixes for RHBZ#1619689:
7629ac
- Added support for kernel parameters yama.ptrace_scope, kptr_restrict, dmesg_restrict and kexec_load_disabled.
7629ac
- Added support for boot parameters audit_backlog_limit=8192, slub_debug=P, page_poison=1 and vsyscall=none.
7629ac
- Added support for proper /dev/shm handling (noexec,nosuid,nodev,mode=1777)
7629ac
- Added support for checking that sendmail and abrt are not installed.
7629ac
- Introduced OSPP to the OSPP profile title.
7629ac
- Disabled linkcheck tests during the build.
7629ac
7629ac
* Sun Sep 23 2018 Marek Haičman <mhaicman@redhat.com> - 0.1.40-10
7629ac
- Fix regression in file ownership and group OVAL. (RHBZ#1570802)
7629ac
7629ac
* Fri Sep 21 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.40-9
7629ac
- Fix malformed patch for Audit Rules (RHBZ#1619689)
7629ac
7629ac
* Fri Sep 21 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.40-8
7629ac
- Add Bash remediation for rule grub2_audit_arguments (RHBZ#1619689)
7629ac
- Allow remediation for rule dconf_gnome_screensaver_lock_delay to fix commented settings (RHBZ#1609122)
7629ac
- Select missing audit rules for privileged commands for OSPP4.2 Profile (RHBZ#1619689)
7629ac
7629ac
* Wed Sep 19 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-7
7629ac
- Fixed previously applied patches for OSPP 4.2 (RHBZ#1619689)
7629ac
7629ac
* Mon Sep 17 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-6
7629ac
- Applied a batch of patches that improve OSPP 4.2 profile support for RHEL7 (RHBZ#1619689)
7629ac
- Fixed the xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled check (RHBZ#1609122)
7629ac
7629ac
* Fri Sep 14 2018 Marek Haičman <mhaicman@redhat.com> - 0.1.40-5
7629ac
- Re-fix FIPS patch. (RHBZ#1587911)
7629ac
7629ac
* Wed Sep 12 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-4
7629ac
- Applied a batch of patches that improve OSPP 4.2 profile support for RHEL7 (RHBZ#1619689)
7629ac
7629ac
* Tue Sep 11 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-3
7629ac
- Don't generate remediations for Anaconda for /dev/cdrom mount point (RHBZ#1618840)
7629ac
- Install dracut-fips when fips mode is enabled in the profile (RHBZ#1587911)
7629ac
7629ac
* Wed Aug 01 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.40-2
7629ac
- Don't generate remediations for Anaconda for /dev/shm mount point (RHBZ#1570956)
7629ac
7629ac
* Wed Jul 25 2018 Matěj Týč <matyc@redhat.com> - 0.1.40-1
7629ac
- Update to upstream release 0.1.40
7629ac
- Underlying code has been deduplicated and unified, which fixes countless subtle bugs.
7629ac
- Updated Ansible playbooks, so they don't use deprecated constructs.
7629ac
- Service disable family of rules take the corresponding socket deactivation into account if applicable in check and in remediations.
7629ac
7629ac
* Thu Jul 19 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.39-2
7629ac
- Fix configuration to not build new products introduced in upstream
7629ac
- Test package with ctest
7629ac
7629ac
* Fri Jul 13 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.39-1
7629ac
- Update to upstream release 0.1.39
7629ac
- Profile IDs simplified
7629ac
- Common Profile removed in favor of Standard Profile
7629ac
- RHEL7 STIG reference updated to V1R4
7629ac
- RHEL6 STIG reference updated to V1R18
7629ac
- New License - BSD-3 Clause
7629ac
- Several remediation fixes
7629ac
- Better content support for DISA STIG Viewer (#2418)
1c7659
0950b5
* Mon Jan 08 2018 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-7
0950b5
- Fix sshd_required unset (RHBZ#1522956)
0950b5
- Fix missing bash remediation functions include (RHBZ#1524738)
0950b5
- Fix empty columns in SRG HTML Table (RHBZ#1531105)
0950b5
- Fix reference to oudated PAM config manual (RHBZ#1447760)
0950b5
0950b5
* Tue Dec 12 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-6
0950b5
- Rebuild with OpenSCAP 1.2.16
0950b5
0950b5
* Mon Dec 11 2017 Matěj Týč <matyc@redhat.com> - 0.1.36-5
0950b5
- Patched not to check library ownership in libexec.
0950b5
- Patched to fix title of DISA STIG profile.
0950b5
- Patched to deprecate RhostsRSAAuthentication.
0950b5
- Patched to fix umask_for_daemons.
0950b5
0950b5
* Thu Nov 16 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-4
0950b5
- Rebuild with OpenSCAP 1.2.16
0950b5
0950b5
* Tue Nov 14 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-3
0950b5
- Add DISA STIG Rule IDs to XCCDF Rules with STIGID
0950b5
0950b5
* Fri Nov 03 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-2
0950b5
- Fix configuration to not build new products introduced in upstream
0950b5
0950b5
* Fri Nov 03 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-1
0950b5
- Update to upstream release 0.1.36
0950b5
- Introduction of SCAP Security Guide Test Suite
0950b5
- Better alignment of RHEL6 and RHEL7 with DISA STIG
0950b5
- Remove JBoss EAP5 content due to being End-of-Life
0950b5
- New STIG Profile for JBOSS EAP 6
0950b5
- Updates in C2S Profile for RHEL 7
0950b5
- Variables can be directly tailored in Ansible roles
0950b5
- Content presents less false positives in containers
0950b5
- Changes in directory layout
0950b5
0950b5
* Wed Sep 20 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.35-2
0950b5
- Do not build content for JBOSS EAP6
0950b5
0950b5
* Wed Sep 20 2017 Watson Yuuma Sato <wsato@redhat.com> - 0.1.35-1
0950b5
- Update to upstream release 0.1.35
0950b5
- Remove Red Hat Enterprise Linux 5 content due to being End-of-Life March 31, 2017
0950b5
- Added several templates for OVAL checks
0950b5
- Many optimizations in build process
0950b5
- Different title for PCI-DSS Benchmark variants
0950b5
- Remediation roles moved to /usr/share/scap-security
0950b5
- Fix duplicated roles and guides (RHBZ#1465691)
650d98
1e6968
* Tue Sep 19 2017 Watson Sato <wsato@redhat.com> 0.1.33-6
1e6968
- Dropped remediation that makes system not accessible by SSH (RHBZ#1478414)
1e6968
9c64d1
* Wed Jun 14 2017 Watson Sato <wsato@redhat.com> 0.1.33-5
9c64d1
- Fix Anaconda Smartcard auth remediation (RHBZ#1461330)
9c64d1
9c64d1
* Fri May 19 2017 Watson Sato <wsato@redhat.com> 0.1.33-4
9c64d1
- Fix specfile to not include tables twice
9c64d1
9c64d1
* Fri May 19 2017 Watson Sato <wsato@redhat.com> 0.1.33-3
9c64d1
- Fix malformed title of profile nist-800-171-cui
9c64d1
9c64d1
* Fri May 19 2017 Watson Sato <wsato@redhat.com> 0.1.33-2
9c64d1
- Fix emtpy ospp-rhel7 table
9c64d1
- Fix Anaconda remediation templates (RHBZ#1450731)
9c64d1
9c64d1
* Mon May 01 2017 Watson Sato <wsato@redhat.com> 0.1.33-1
9c64d1
- Update to upstream version 0.1.33
9c64d1
- DISA RHEL7 STIG profile alignment improved
9c64d1
- Introduction of remediation roles
9c64d1
- RPM and DEB test packages are built by CMake with CPack
9c64d1
- Lots of remediation fixes
9c64d1
9c64d1
* Tue Mar 28 2017 Watson Sato <wsato@redhat.com> 0.1.32-1
9c64d1
- Update to upstream version 0.1.32
9c64d1
- New CMake build system
9c64d1
- Improved NIST 800-171 profile
9c64d1
- Initial RHVH profile
9c64d1
- New CPE to identify systems like machines (bare-metal and VM) and containers (image and container)
9c64d1
- Template clean up in lots of remediations
9c64d1
9c64d1
* Fri Mar 10 2017 Watson Sato <wsato@redhat.com> 0.1.30-6
9c64d1
- Ship separate OCIL definitions for Red Hat Enterprise Linux 7 (RHBZ#1428144)
721d24
7a35c8
* Tue Feb 14 2017 Watson Sato <wsato@redhat.com> 0.1.30-5
7a35c8
- Fix template remediation function used by SSHD remediation
7a35c8
- Reduce scope of patch that fixes SSHD remediation (RH BZ#1415152)
ee8600
9c64d1
* Tue Jan 31 2017 Watson Sato <wsato@redhat.com> 0.1.30-4
7a35c8
- Correct remediation for SSHD which caused it not to start (RH BZ#1415152)
ee8600
f04235
* Wed Aug 10 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-3
f04235
- Correct the remediation script for 'Enable Smart Card Login' rule
f04235
  for Red Hat Enterprise Linux 7 (RH BZ#1357019)
f04235
f04235
* Thu Jul 14 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-2
f04235
- Fix issue of two STIG profiles for Red Hat Enterprise Linux 6 benchmark
f04235
  having the identical title (RH BZ#1351541)
f04235
- Enhance the shared OVAL check for 'Set Deny For Failed Password Attempts'
f04235
  rule and also Red Hat Enterprise Linux 7 OVAL check for 'Configure the root
f04235
  Account for Failed Password Attempts' rule to report correct system status
f04235
  WRT to these requirements also in the case the SSSD daemon is used
f04235
  (RH BZ#1344581)
f04235
- Include currently available kickstart files and produced HTML tables for
f04235
  Red Hat Enterprise Linux 6 and 7 products into the produced RPM package
f04235
  (RH BZ#1351751)
f04235
f04235
* Wed Jun 22 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-1
f04235
- Update to upstream's 0.1.30 release:
f04235
  https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
f04235
  (RH BZ#1289533)
f04235
- Drop remediation functions library since starting from 0.1.30 release
f04235
  remediation scripts are part of the benchmarks directly
f04235
- Drop three patches that have been accepted upstream in the meantime
f04235
- Update drop-rpm-verify-permissions-rule patch to work properly against
f04235
  0.1.30 release
6c1a7a
fa25b6
* Fri Oct 02 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-3
fa25b6
- Drop "Verify and Correct File Permissions with RPM" rule from the PCI-DSS
fa25b6
  profile for Red Hat Enterprise Linux 7 (RH BZ#1267861)
fa25b6
fa25b6
* Wed Sep 09 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-2
fa25b6
- Update R and BR for the openscap-scanner package to 1.2.5 per RHBZ#1202762#c7
fa25b6
fa25b6
* Wed Aug 19 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-1
fa25b6
- Rebase to upstream 0.1.25 release
fa25b6
fa25b6
* Tue Aug 04 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-4
fa25b6
- Fix false-positive in OVAL check for 'accounts_passwords_pam_faillock_deny'
fa25b6
  rule
fa25b6
fa25b6
* Mon Aug 03 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-3
fa25b6
- Add remediation script for 'accounts_passwords_pam_faillock_unlock_time' rule
fa25b6
  for Red Hat Enterprise Linux 7 product
fa25b6
- Override title and description for all existing profiles for Red Hat
fa25b6
  Enterprise Linux 6 product that are extending another SCAP profile
fa25b6
  (RHBZ#1246529)
fa25b6
- Correct various issues in the included Oscap Anaconda Addon PCI-DSS profile
fa25b6
  kickstart file for Red Hat Enterprise Linux 7 product
fa25b6
- Add remediation script for 'audit_rules_time_clock_settime' rule for
fa25b6
  Red Hat Enterprise Linux 7 product
fa25b6
- Add remediation scripts for 'audit_rules_time_adjtimex',
fa25b6
  'audit_rules_time_settimeofday', and 'audit_rules_time_stime' rules for
fa25b6
  Red Hat Enterprise Linux 7 product
fa25b6
- Tag current PCI-DSS profile for Red Hat Enterprise Linux 7 product with
fa25b6
  "Draft" label
fa25b6
- Disable the following rules in the PCI-DSS profile for the Red Hat Enterprise
fa25b6
  Linux 7 product:
fa25b6
  * dconf_gnome_screensaver_idle_delay -- missing remediation script,
fa25b6
  * dconf_gnome_screensaver_idle_activation -- missing remediation script,
fa25b6
  * dconf_gnome_screensaver_lock_enabled -- missing remediation script,
fa25b6
  * audit_rules_login_events -- incorrect OVAL check (upstream issue #607),
fa25b6
  * audit_rules_privileged_commands -- missing remediation script, and
fa25b6
  * audit_rules_immutable -- missing remediation script.
fa25b6
fa25b6
* Mon Aug 03 2015 Martin Preisler <mpreisle@redhat.com> 0.1.24-2
fa25b6
- Break-down firewalld rule description for Red Hat Enterprise Linux 7 product
fa25b6
  into multiple lines, prevents HTML guide UX issues
fa25b6
fa25b6
* Tue Jul 07 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-1
fa25b6
- Rebase to upstream scap-security-guide-0.1.24 version
fa25b6
- Start producing the -doc subpackage to provide the HTML formatted
fa25b6
  documents containing security guides generated from shipped XCCDF benchmarks
fa25b6
fa25b6
* Mon Jun 22 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.23-1
fa25b6
- Rebase to upstream scap-security-guide-0.1.23 version
fa25b6
- Update upstream tarball source URL to GitHub archive location
fa25b6
- Drop the following patches that have been accepted upstream:
fa25b6
  * scap-security-guide-0.1.19-rhel7-include-only-rht-ccp-profile.patch
fa25b6
  * scap-security-guide-0.1.19-rhel7-drop-restorecond-since-in-optional.patch
fa25b6
  * scap-security-guide-0.1.19-update-man-page-for-rhel7-content.patch
fa25b6
  * scap-security-guide-0.1.19-rhel7-update-pam-XCCDF-to-use-pam_pwquality.patch
fa25b6
  * scap-security-guide-0.1.20-rhel7-shared-fix-limit-password-reuse-remediation.patch
fa25b6
  * scap-security-guide-0.1.20-rhel6-rhel7-PR#280-set-deny-prerequisite-#1.patch
fa25b6
  * scap-security-guide-0.1.20-rhel6-rhel7-set-deny-prerequisite-#2.patch
fa25b6
  * scap-security-guide-0.1.20-shared-fix-set-deny-for-failed-password-attempts-remediation.patch
fa25b6
  * scap-security-guide-0.1.20-rhel7-specify-exact-profile-name-when-generating-guide.patch
fa25b6
- Include the datastream versions of Firefox and Java Runtime Environment (JRE) benchmarks
fa25b6
- Include USGCB and DISA STIG profile kickstart files for Red Hat Enterprise Linux 6
fa25b6
2b7b16
* Tue Oct 21 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.19-2
2b7b16
- Fix Limit Password Reuse remediation script error
2b7b16
- Fix Set Deny For Failed Password Attempts remediation script error
2b7b16
- Use RHT-CCP profile name when generating HTML guide
2b7b16
- Describe RHT-CCP profile in the manual page
2b7b16
2b7b16
* Mon Sep 29 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.19-1
2b7b16
- Include RHEL-7 content (RHT-CCP profile only)
2b7b16
- Drop RHEL-7 restorecond XCCDF rule since policycoreutils-restorecond in Optional channel
2b7b16
- Drop RHEL-7 cpuspeed XCCDF rule since obsoleted by cpupower from kernel-tools
2b7b16
- Update manual page to be more appropriate for RHEL-7
2b7b16
- Drop RHEL-6 C2S profile update patch since merged upstream
2b7b16
2b7b16
* Tue Sep 02 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-4
2b7b16
- Initial build for Red Hat Enterprise Linux 7
2b7b16
2b7b16
* Thu Aug 28 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-3
2b7b16
- Update C2S profile <description> per request from CIS
2b7b16
2b7b16
* Thu Jun 26 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-2
2b7b16
- Include the upstream STIG for RHEL 6 Server profile disclaimer file too
2b7b16
2b7b16
* Sun Jun 22 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-1
2b7b16
- Make new 0.1.18 release
2b7b16
2b7b16
* Wed May 14 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.17-2
2b7b16
- Drop vendor line from the spec file. Let the build system to provide it.
2b7b16
2b7b16
* Fri May 09 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.17-1
2b7b16
- Upgrade to upstream 0.1.17 version
2b7b16
2b7b16
* Mon May 05 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.16-2
2b7b16
- Initial RPM for RHEL base channels
2b7b16
2b7b16
* Mon May 05 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.16-1
2b7b16
- Change naming scheme (0.1-16 => 0.1.16-1)
2b7b16
2b7b16
* Fri Feb 21 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-16
2b7b16
- Include datastream file into RHEL6 RPM package too
2b7b16
- Bump version
2b7b16
2b7b16
* Tue Dec 24 2013 Shawn Wells <shawn@redhat.com> 0.1-16.rc2
2b7b16
+ RHEL6 stig-rhel6-server XCCDF profile renamed to stig-rhel6-server-upstream
2b7b16
2b7b16
* Mon Dec 23 2013 Shawn Wells <shawn@redhat.com> 0.1-16.rc1
2b7b16
- [bugfix] RHEL6 no_empty_passwords remediation script overwrote
2b7b16
  system-auth symlink. Added --follow-symlink to sed command.
2b7b16
2b7b16
* Fri Nov 01 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15
2b7b16
- Version bump
2b7b16
2b7b16
* Sat Oct 26 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc5
2b7b16
- Point the spec's source to proper remote tarball location
2b7b16
- Modify the main Makefile to use remote tarball when building RHEL/6's SRPM
2b7b16
2b7b16
* Sat Oct 26 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc4
2b7b16
- Don't include the table html files two times
2b7b16
- Remove makewhatis
2b7b16
2b7b16
* Fri Oct 25 2013 Shawn Wells <shawn@redhat.com> 0.1-15.rc3
2b7b16
- [bugfix] Updated rsyslog_remote_loghost to scan /etc/rsyslog.conf and /etc/rsyslog.d/*
2b7b16
- Numberous XCCDF->OVAL naming schema updates
2b7b16
- All rules now have CCE
2b7b16
2b7b16
* Fri Oct 25 2013 Shawn Wells <shawn@redhat.com> 0.1-15.rc2
2b7b16
- RHEL/6 HTML table naming bugfixes (table-rhel6-*, not table-*-rhel6)
2b7b16
2b7b16
* Fri Oct 25 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc1
2b7b16
- Apply spec file changes required by review request (RH BZ#1018905)
2b7b16
2b7b16
* Thu Oct 24 2013 Shawn Wells <shawn@redhat.com> 0.1-14
2b7b16
- Formal RPM release
2b7b16
- Inclusion of rht-ccp profile
2b7b16
- OVAL unit testing patches
2b7b16
- Bash remediation patches
2b7b16
- Bugfixes
2b7b16
2b7b16
* Mon Oct 07 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-14.rc1
2b7b16
- Change RPM versioning scheme to include release into tarball
2b7b16
2b7b16
* Sat Sep 28 2013 Shawn Wells <shawn@redhat.com> 0.1-13
2b7b16
- Updated RPM spec file to fix rpmlint warnings
2b7b16
2b7b16
* Wed Jun 26 2013 Shawn Wells <shawn@redhat.com> 0.1-12
2b7b16
- Updated RPM version to 0.1-12
2b7b16
2b7b16
* Fri Apr 26 2013 Shawn Wells <shawn@redhat.com> 0.1-11
2b7b16
- Significant amount of OVAL bugfixes
2b7b16
- Incorporation of Draft RHEL/6 STIG feedback
2b7b16
2b7b16
* Sat Feb 16 2013 Shawn Wells <shawn@redhat.com> 0.1-10
2b7b16
- `man scap-security-guide`
2b7b16
- OVAL bug fixes
2b7b16
- NIST 800-53 mappings update
2b7b16
2b7b16
* Wed Nov 28 2012 Shawn Wells <shawn@redhat.com> 0.1-9
2b7b16
- Updated BuildRequires to reflect python-lxml (thank you, Ray S.!)
2b7b16
- Reverting to noarch RPM
2b7b16
2b7b16
* Tue Nov 27 2012 Shawn Wells <shawn@redhat.com> 0.1-8
2b7b16
- Significant copy editing to XCCDF rules per community
2b7b16
  feedback on the DISA RHEL/6 STIG Initial Draft
2b7b16
2b7b16
* Thu Nov 1 2012 Shawn Wells <shawn@redhat.com> 0.1-7
2b7b16
- Corrected XCCDF content errors
2b7b16
- OpenSCAP now supports CPE dictionaries, important to
2b7b16
  utilize --cpe-dict when scanning machines with OpenSCAP,
2b7b16
  e.g.:
2b7b16
  $ oscap xccdf eval --profile stig-server \
2b7b16
   --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
2b7b16
2b7b16
* Mon Oct 22 2012 Shawn Wells <shawn@redhat.com> 0.1-6
2b7b16
- Corrected RPM versioning, we're on 0.1 release 6 (not version 1 release 6)
2b7b16
- Updated RPM includes feedback received from DoD Consensus meetings
2b7b16
2b7b16
* Fri Oct 5  2012 Jeffrey Blank <blank@eclipse.ncsc.mil> 1.0-5
2b7b16
- Adjusted installation directory to /usr/share/xml/scap.
2b7b16
2b7b16
* Tue Aug 28  2012 Spencer Shimko <sshimko@tresys.com> 1.0-4
2b7b16
- Fix BuildRequires and Requires.
2b7b16
2b7b16
* Tue Jul 3 2012 Jeffrey Blank <blank@eclipse.ncsc.mil> 1.0-3
2b7b16
- Modified install section, made description more concise.
2b7b16
2b7b16
* Thu Apr 19 2012 Spencer Shimko <sshimko@tresys.com> 1.0-2
2b7b16
- Minor updates to pass some variables in from build system.
2b7b16
2b7b16
* Mon Apr 02 2012 Shawn Wells <shawn@redhat.com> 1.0-1
2b7b16
- First attempt at SSG RPM. May ${deity} help us...