From f04235cd7394f6e40142788e24397ae7a2470e80 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Nov 03 2016 06:14:52 +0000
Subject: import scap-security-guide-0.1.30-3.el7


---

diff --git a/.gitignore b/.gitignore
index 20df2b2..ea97346 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/scap-security-guide-0.1.25.tar.gz
+SOURCES/scap-security-guide-0.1.30.tar.gz
diff --git a/.scap-security-guide.metadata b/.scap-security-guide.metadata
index 7038a45..2d6f46b 100644
--- a/.scap-security-guide.metadata
+++ b/.scap-security-guide.metadata
@@ -1 +1 @@
-1dc2e85ad80098968485bc75050697abc40143d4 SOURCES/scap-security-guide-0.1.25.tar.gz
+6630e157fce94380bc4610538b1fb8cccfaf5f57 SOURCES/scap-security-guide-0.1.30.tar.gz
diff --git a/SOURCES/scap-security-guide-0.1.19-rhel7-drop-cpuspeed-rule-since-obsolete.patch b/SOURCES/scap-security-guide-0.1.19-rhel7-drop-cpuspeed-rule-since-obsolete.patch
deleted file mode 100644
index fac759b..0000000
--- a/SOURCES/scap-security-guide-0.1.19-rhel7-drop-cpuspeed-rule-since-obsolete.patch
+++ /dev/null
@@ -1,26 +0,0 @@
---- scap-security-guide-0.1.19/RHEL/7/input/services/base.xml.orig	2014-09-29 07:29:50.979356661 -0400
-+++ scap-security-guide-0.1.19/RHEL/7/input/services/base.xml	2014-09-29 07:30:23.749395788 -0400
-@@ -91,23 +91,6 @@ service is not necessary.
- <ref nist="CM-7" />
- </Rule>
- 
--<Rule id="service_cpuspeed_disabled">
--<title>Disable CPU Speed (cpuspeed)</title>
--<description>The <tt>cpuspeed</tt> service can adjust the clock speed of supported CPUs based upon
--the current processing load thereby conserving power and reducing heat.
--<service-disable-macro service="cpuspeed" />
--</description>
--<ocil><service-disable-check-macro service="cpuspeed" /></ocil>
--<rationale>The <tt>cpuspeed</tt> service is only necessary if adjusting the CPU clock speed
--provides benefit. Traditionally this has included laptops (to enhance battery life),
--but may also apply to server or desktop environments where conserving power is
--highly desirable or necessary.
--</rationale>
--<ident cce="RHEL7-CCE-TBD" />
--<oval id="service_cpuspeed_disabled" />
--<ref nist="CM-7" />
--</Rule>
--
- <Rule id="service_irqbalance_enabled">
- <title>Enable IRQ Balance (irqbalance)</title>
- <description>The <tt>irqbalance</tt> service optimizes the balance between
diff --git a/SOURCES/scap-security-guide-0.1.25-add-adjtimex-settimeofday-stime-rhel7-remediation.patch b/SOURCES/scap-security-guide-0.1.25-add-adjtimex-settimeofday-stime-rhel7-remediation.patch
deleted file mode 100644
index b0b28d6..0000000
--- a/SOURCES/scap-security-guide-0.1.25-add-adjtimex-settimeofday-stime-rhel7-remediation.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From bb68e10170f532fed47277d76eb74f4fad498039 Mon Sep 17 00:00:00 2001
-From: Jan Lieskovsky <jlieskov@redhat.com>
-Date: Fri, 24 Jul 2015 16:21:04 +0200
-Subject: [PATCH] [Enhancement] [RHEL/7] New RHEL-7 audit time remediations for
- following rules: * audit_rules_time_adjtimex, *
- audit_rules_time_settimeofday, and * audit_rules_time_stime
-
-Testing report:
---------------
-Verified manually on RHEL-7 host the changes are working fine (in both
-scenarios, expected rule not at all present in audit.rules configuration,
-or expected rule partially present in audit.rules configuration)
----
- .../input/fixes/bash/audit_rules_time_adjtimex.sh  | 32 ++++++++++++++++++++++
- .../fixes/bash/audit_rules_time_settimeofday.sh    | 32 ++++++++++++++++++++++
- RHEL/7/input/fixes/bash/audit_rules_time_stime.sh  | 32 ++++++++++++++++++++++
- 3 files changed, 96 insertions(+)
- create mode 100644 RHEL/7/input/fixes/bash/audit_rules_time_adjtimex.sh
- create mode 100644 RHEL/7/input/fixes/bash/audit_rules_time_settimeofday.sh
- create mode 100644 RHEL/7/input/fixes/bash/audit_rules_time_stime.sh
-
-diff --git a/RHEL/7/input/fixes/bash/audit_rules_time_adjtimex.sh b/RHEL/7/input/fixes/bash/audit_rules_time_adjtimex.sh
-new file mode 100644
-index 0000000..43fdfbb
---- /dev/null
-+++ b/RHEL/7/input/fixes/bash/audit_rules_time_adjtimex.sh
-@@ -0,0 +1,32 @@
-+
-+# Include source function library.
-+. /usr/share/scap-security-guide/remediation_functions
-+
-+# Perform the remediation for the syscall rule
-+# Retrieve hardware architecture of the underlying system
-+[ $(getconf LONG_BIT) = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
-+
-+for ARCH in "${RULE_ARCHS[@]}"
-+do
-+
-+	PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
-+
-+	# Create expected audit group and audit rule form for particular system call & architecture
-+	if [ ${ARCH} = "b32" ]
-+	then
-+		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
-+		# so append it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\|stime\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
-+	elif [ ${ARCH} = "b64" ]
-+	then
-+		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
-+		# therefore don't add it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
-+	fi
-+
-+	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
-+	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+done
-diff --git a/RHEL/7/input/fixes/bash/audit_rules_time_settimeofday.sh b/RHEL/7/input/fixes/bash/audit_rules_time_settimeofday.sh
-new file mode 100644
-index 0000000..43fdfbb
---- /dev/null
-+++ b/RHEL/7/input/fixes/bash/audit_rules_time_settimeofday.sh
-@@ -0,0 +1,32 @@
-+
-+# Include source function library.
-+. /usr/share/scap-security-guide/remediation_functions
-+
-+# Perform the remediation for the syscall rule
-+# Retrieve hardware architecture of the underlying system
-+[ $(getconf LONG_BIT) = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
-+
-+for ARCH in "${RULE_ARCHS[@]}"
-+do
-+
-+	PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
-+
-+	# Create expected audit group and audit rule form for particular system call & architecture
-+	if [ ${ARCH} = "b32" ]
-+	then
-+		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
-+		# so append it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\|stime\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
-+	elif [ ${ARCH} = "b64" ]
-+	then
-+		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
-+		# therefore don't add it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
-+	fi
-+
-+	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
-+	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+done
-diff --git a/RHEL/7/input/fixes/bash/audit_rules_time_stime.sh b/RHEL/7/input/fixes/bash/audit_rules_time_stime.sh
-new file mode 100644
-index 0000000..43fdfbb
---- /dev/null
-+++ b/RHEL/7/input/fixes/bash/audit_rules_time_stime.sh
-@@ -0,0 +1,32 @@
-+
-+# Include source function library.
-+. /usr/share/scap-security-guide/remediation_functions
-+
-+# Perform the remediation for the syscall rule
-+# Retrieve hardware architecture of the underlying system
-+[ $(getconf LONG_BIT) = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
-+
-+for ARCH in "${RULE_ARCHS[@]}"
-+do
-+
-+	PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
-+
-+	# Create expected audit group and audit rule form for particular system call & architecture
-+	if [ ${ARCH} = "b32" ]
-+	then
-+		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
-+		# so append it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\|stime\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
-+	elif [ ${ARCH} = "b64" ]
-+	then
-+		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
-+		# therefore don't add it to the list of time group system calls to be audited
-+		GROUP="\(adjtimex\|settimeofday\)"
-+		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
-+	fi
-+
-+	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
-+	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
-+done
diff --git a/SOURCES/scap-security-guide-0.1.25-centos-menu-branding.patch b/SOURCES/scap-security-guide-0.1.25-centos-menu-branding.patch
deleted file mode 100644
index f4b2d39..0000000
--- a/SOURCES/scap-security-guide-0.1.25-centos-menu-branding.patch
+++ /dev/null
@@ -1,249 +0,0 @@
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml	2015-12-08 07:06:53.929233818 -0600
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml	2015-12-08 07:30:17.747857532 -0600
-@@ -1,5 +1,5 @@
- <Profile id="pci-dss" xmlns="http://checklists.nist.gov/xccdf/1.1">
--<title>Draft PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7</title>
-+<title>Draft PCI-DSS v3 Control Baseline for CentOS Linux 7</title>
- <description>This is a *draft* profile for PCI-DSS v3</description>
- 
- <refine-value idref="var_password_pam_unix_remember" selector="4" />
-@@ -54,20 +54,20 @@
- <select idref="audit_rules_kernel_module_loading" selected="true"/>
- <!-- <select idref="audit_rules_immutable" selected="true"/> reason: Missing remediation -->
- <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
--<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
--<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
- <select idref="rpm_verify_hashes" selected="true"/>
--<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
-+<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
- <select idref="ensure_logrotate_activated" selected="true"/>
- <select idref="package_aide_installed" selected="true"/>
- <select idref="disable_prelink" selected="true"/>
--<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="aide_periodic_cron_checking" selected="true"/>
--<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="accounts_password_all_shadowed" selected="true"/>
- <select idref="no_empty_passwords" selected="true"/>
- <select idref="display_login_attempts" selected="true"/>
-@@ -77,19 +77,19 @@
- <!-- <select idref="dconf_gnome_screensaver_idle_delay" selected="true"/> reason: Missing remediation -->
- <!-- <select idref="dconf_gnome_screensaver_idle_activation_enabled" selected="true"/> reason: Missing remediation -->
- <!-- <select idref="dconf_gnome_screensaver_lock_enabled" selected="true"/> reason: Missing remediation -->
--<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for RHEL-7 -->
-+<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for CentOS-7 -->
- <select idref="sshd_set_idle_timeout" selected="true"/>
- <select idref="accounts_password_pam_minlen" selected="true"/>
- <select idref="accounts_password_pam_dcredit" selected="true"/>
- <select idref="accounts_password_pam_ucredit" selected="true"/>
- <select idref="accounts_password_pam_lcredit" selected="true"/>
--<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="accounts_maximum_age_login_defs" selected="true"/>
- <select idref="ensure_redhat_gpgkey_installed" selected="true"/>
- <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
- <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
- <select idref="security_patches_up_to_date" selected="true"/>
--<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
- <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
- <select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_downstream_disabled scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_downstream_disabled
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_downstream_disabled	2015-08-19 10:54:02.000000000 -0500
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_downstream_disabled	2015-12-08 07:31:08.882743495 -0600
-@@ -1,5 +1,5 @@
- <Profile id="pci-dss" xmlns="http://checklists.nist.gov/xccdf/1.1">
--<title>Draft PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7</title>
-+<title>Draft PCI-DSS v3 Control Baseline for CentOS Linux 7</title>
- <description>This is a *draft* profile for PCI-DSS v3</description>
- 
- <refine-value idref="var_password_pam_unix_remember" selector="4" />
-@@ -54,21 +54,21 @@
- <select idref="audit_rules_kernel_module_loading" selected="true"/>
- <select idref="audit_rules_immutable" selected="true"/>
- <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
--<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
--<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
- <select idref="rpm_verify_permissions" selected="true"/>
- <select idref="rpm_verify_hashes" selected="true"/>
--<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
-+<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
- <select idref="ensure_logrotate_activated" selected="true"/>
- <select idref="package_aide_installed" selected="true"/>
- <select idref="disable_prelink" selected="true"/>
--<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="aide_periodic_cron_checking" selected="true"/>
--<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="accounts_password_all_shadowed" selected="true"/>
- <select idref="no_empty_passwords" selected="true"/>
- <select idref="display_login_attempts" selected="true"/>
-@@ -78,19 +78,19 @@
- <select idref="dconf_gnome_screensaver_idle_delay" selected="true"/>
- <select idref="dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
- <select idref="dconf_gnome_screensaver_lock_enabled" selected="true"/>
--<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for RHEL-7 -->
-+<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for CentOS-7 -->
- <select idref="sshd_set_idle_timeout" selected="true"/>
- <select idref="accounts_password_pam_minlen" selected="true"/>
- <select idref="accounts_password_pam_dcredit" selected="true"/>
- <select idref="accounts_password_pam_ucredit" selected="true"/>
- <select idref="accounts_password_pam_lcredit" selected="true"/>
--<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="accounts_maximum_age_login_defs" selected="true"/>
- <select idref="ensure_redhat_gpgkey_installed" selected="true"/>
- <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
- <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
- <select idref="security_patches_up_to_date" selected="true"/>
--<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
- <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
- <select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_drop_rpm_verify_permissions_rule scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_drop_rpm_verify_permissions_rule
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_drop_rpm_verify_permissions_rule	2015-12-08 07:06:53.928233822 -0600
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml.rhel7_pcidss_drop_rpm_verify_permissions_rule	2015-12-08 07:31:31.811691561 -0600
-@@ -1,5 +1,5 @@
- <Profile id="pci-dss" xmlns="http://checklists.nist.gov/xccdf/1.1">
--<title>Draft PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7</title>
-+<title>Draft PCI-DSS v3 Control Baseline for CentOS Linux 7</title>
- <description>This is a *draft* profile for PCI-DSS v3</description>
- 
- <refine-value idref="var_password_pam_unix_remember" selector="4" />
-@@ -54,21 +54,21 @@
- <select idref="audit_rules_kernel_module_loading" selected="true"/>
- <!-- <select idref="audit_rules_immutable" selected="true"/> reason: Missing remediation -->
- <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
--<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
--<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
-+<!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for CentOS-7 for chronyd service -->
- <select idref="rpm_verify_permissions" selected="true"/>
- <select idref="rpm_verify_hashes" selected="true"/>
--<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
--<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for RHEL-7 -->
-+<!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="userowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
-+<!-- <select idref="groupowner_rsyslog_files" selected="true"/> reason: needs to be implemented for CentOS-7 -->
- <select idref="ensure_logrotate_activated" selected="true"/>
- <select idref="package_aide_installed" selected="true"/>
- <select idref="disable_prelink" selected="true"/>
--<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="aide_build_database" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="aide_periodic_cron_checking" selected="true"/>
--<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
--<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
-+<!-- <select idref="account_unique_name" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
-+<!-- <select idref="gid_passwd_group_same" selected="true"/> reason: needs to be implemented for both CentOS-6 & CentOS-7 -->
- <select idref="accounts_password_all_shadowed" selected="true"/>
- <select idref="no_empty_passwords" selected="true"/>
- <select idref="display_login_attempts" selected="true"/>
-@@ -78,19 +78,19 @@
- <!-- <select idref="dconf_gnome_screensaver_idle_delay" selected="true"/> reason: Missing remediation -->
- <!-- <select idref="dconf_gnome_screensaver_idle_activation_enabled" selected="true"/> reason: Missing remediation -->
- <!-- <select idref="dconf_gnome_screensaver_lock_enabled" selected="true"/> reason: Missing remediation -->
--<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for RHEL-7 -->
-+<!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for CentOS-7 -->
- <select idref="sshd_set_idle_timeout" selected="true"/>
- <select idref="accounts_password_pam_minlen" selected="true"/>
- <select idref="accounts_password_pam_dcredit" selected="true"/>
- <select idref="accounts_password_pam_ucredit" selected="true"/>
- <select idref="accounts_password_pam_lcredit" selected="true"/>
--<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="accounts_password_pam_unix_remember" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="accounts_maximum_age_login_defs" selected="true"/>
- <select idref="ensure_redhat_gpgkey_installed" selected="true"/>
- <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
- <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
- <select idref="security_patches_up_to_date" selected="true"/>
--<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to RHEL-7 -->
-+<!-- <select idref="smartcard_auth" selected="true"/> reason: needs to be ported to CentOS-7 -->
- <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
- <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
- <select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/rht-ccp.xml scap-security-guide-0.1.25/RHEL/7/input/profiles/rht-ccp.xml
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/rht-ccp.xml	2015-08-19 10:54:02.000000000 -0500
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/rht-ccp.xml	2015-12-08 07:33:09.162465695 -0600
-@@ -1,6 +1,6 @@
- <Profile id="rht-ccp" xmlns="http://checklists.nist.gov/xccdf/1.1">
--<title>Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)</title>
--<description>This is a *draft* SCAP profile for Red Hat Certified Cloud Providers</description>
-+<title>CentOS Profile for Cloud Providers (CPCP)</title>
-+<description>This is a *draft* SCAP profile for CentOS Cloud Providers</description>
- <!-- CONFIGURATION OPTIONS -->
- <refine-value idref="var_selinux_state" selector="enforcing"/>
- <refine-value idref="var_selinux_policy_name" selector="targeted"/>
-@@ -98,11 +98,11 @@
- <select idref="kernel_module_ipv6_option_disabled" selected="true"/>
- <select idref="service_ip6tables_enabled" selected="true"/>
- 
--This requirement does not apply against Red Hat Enterprise Linux 7:
-+This requirement does not apply against CentOS Linux 7:
- see: https://github.com/OpenSCAP/scap-security-guide/issues/66 for details.
- <select idref="kernel_module_rds_disabled" selected="true"/>
- 
--This requirement does not apply against Red Hat Enterprise Linux 7:
-+This requirement does not apply against CentOS Linux 7:
- see: https://github.com/OpenSCAP/scap-security-guide/issues/67 for details.
- <select idref="kernel_module_tipc_disabled" selected="true"/>
- 
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/standard.xml scap-security-guide-0.1.25/RHEL/7/input/profiles/standard.xml
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/standard.xml	2015-08-19 10:54:02.000000000 -0500
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/standard.xml	2015-12-08 07:27:34.453179300 -0600
-@@ -1,6 +1,6 @@
- <Profile id="standard">
- <title>Standard System Security Profile</title>
--<description>This profile contains rules to ensure standard security base of Red Hat Enterprise Linux 7 system.</description>
-+<description>This profile contains rules to ensure standard security base of CentOS Linux 7 system.</description>
- 
- <!-- STANDARD SYSTEM SECURITY CHECKS -->
- <select idref="security_patches_up_to_date" selected="true"/>
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml scap-security-guide-0.1.25/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml	2015-08-19 10:54:02.000000000 -0500
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml	2015-12-08 07:33:44.930380583 -0600
-@@ -1,5 +1,5 @@
- <Profile id="stig-rhel7-server-upstream" extends="common">
--<title override="true">Pre-release Draft STIG for Red Hat Enterprise Linux 7 Server</title>
-+<title override="true">Pre-release Draft STIG for CentOS Linux 7 Server</title>
- <description override="true">This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO.</description>
- 
- <!-- STIG refinement values. Note these are set by DISA FSO,
-diff -uNrp scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/usgcb-rhel7-server.xml scap-security-guide-0.1.25/RHEL/7/input/profiles/usgcb-rhel7-server.xml
---- scap-security-guide-0.1.25.orig/RHEL/7/input/profiles/usgcb-rhel7-server.xml	2015-08-19 10:54:02.000000000 -0500
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/usgcb-rhel7-server.xml	2015-12-08 07:34:34.081261816 -0600
-@@ -1,6 +1,6 @@
- <Profile id="usgcb-rhel7-server">
- <title>United States Government Configuration Baseline (USGCB)</title>
--<description>This profile is a working draft for a USGCB submission against RHEL7 Server.</description>
-+<description>This profile is a working draft for a USGCB submission against CentOS-7 Server.</description>
- 
- <refine-value idref="var_password_pam_unix_remember" selector="5" />
- <refine-value idref="var_accounts_maximum_age_login_defs" selector="60" />
diff --git a/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-disable-selected-rules.patch b/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-disable-selected-rules.patch
deleted file mode 100644
index 40bc76a..0000000
--- a/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-disable-selected-rules.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- scap-security-guide-0.1.24/RHEL/7/input/profiles/pci-dss.xml.orig	2015-08-03 21:07:57.312866056 +0200
-+++ scap-security-guide-0.1.24/RHEL/7/input/profiles/pci-dss.xml	2015-08-03 21:14:25.502325114 +0200
-@@ -46,15 +46,15 @@
- <select idref="audit_rules_dac_modification_lsetxattr" selected="true"/>
- <select idref="audit_rules_dac_modification_removexattr" selected="true"/>
- <select idref="audit_rules_dac_modification_setxattr" selected="true"/>
--<select idref="audit_rules_login_events" selected="true"/>
-+<!-- <select idref="audit_rules_login_events" selected="true"/> reason: Incorrect OVAL, see: https://github.com/OpenSCAP/scap-security-guide/issues/607 -->
- <select idref="audit_rules_session_events" selected="true"/>
- <select idref="audit_rules_unsuccessful_file_modification" selected="true"/>
--<select idref="audit_rules_privileged_commands" selected="true"/>
-+<!-- <select idref="audit_rules_privileged_commands" selected="true"/> reason: Missing remediation -->
- <select idref="audit_rules_media_export" selected="true"/>
- <select idref="audit_rules_file_deletion_events" selected="true"/>
- <select idref="audit_rules_sysadmin_actions" selected="true"/>
- <select idref="audit_rules_kernel_module_loading" selected="true"/>
--<select idref="audit_rules_immutable" selected="true"/>
-+<!-- <select idref="audit_rules_immutable" selected="true"/> reason: Missing remediation -->
- <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
- <!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
- <!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
-@@ -77,9 +77,9 @@
- <select idref="account_disable_post_pw_expiration" selected="true"/>
- <select idref="accounts_passwords_pam_faillock_deny" selected="true"/>
- <select idref="accounts_passwords_pam_faillock_unlock_time" selected="true"/>
--<select idref="dconf_gnome_screensaver_idle_delay" selected="true"/>
--<select idref="dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
--<select idref="dconf_gnome_screensaver_lock_enabled" selected="true"/>
-+<!-- <select idref="dconf_gnome_screensaver_idle_delay" selected="true"/> reason: Missing remediation -->
-+<!-- <select idref="dconf_gnome_screensaver_idle_activation_enabled" selected="true"/> reason: Missing remediation -->
-+<!-- <select idref="dconf_gnome_screensaver_lock_enabled" selected="true"/> reason: Missing remediation -->
- <!-- <select idref="dconf_gnome_screensaver_mode_blank" selected="true"/> reason: needs to be created for RHEL-7 -->
- <select idref="sshd_set_idle_timeout" selected="true"/>
- <select idref="accounts_password_pam_minlen" selected="true"/>
diff --git a/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch b/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
deleted file mode 100644
index 5a1c0f9..0000000
--- a/SOURCES/scap-security-guide-0.1.25-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml.orig	2015-10-02 10:52:46.420297787 +0200
-+++ scap-security-guide-0.1.25/RHEL/7/input/profiles/pci-dss.xml	2015-10-02 10:54:06.309879851 +0200
-@@ -56,7 +56,6 @@
- <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
- <!-- <select idref="chronyd_specify_remote_server" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
- <!-- <select idref="chronyd_specify_multiple_servers" selected="true"/> reason: needs to be implemented for RHEL-7 for chronyd service -->
--<select idref="rpm_verify_permissions" selected="true"/>
- <select idref="rpm_verify_hashes" selected="true"/>
- <!-- <select idref="install_hids" selected="true"/> reason: needs to be implemented for both RHEL-6 & RHEL-7 -->
- <!-- <select idref="rsyslog_file_permissions" selected="true"/> reason: needs to be implemented for RHEL-7 -->
diff --git a/SOURCES/scap-security-guide-0.1.30-downstream-rhbz#1357019.patch b/SOURCES/scap-security-guide-0.1.30-downstream-rhbz#1357019.patch
new file mode 100644
index 0000000..a3129fa
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.30-downstream-rhbz#1357019.patch
@@ -0,0 +1,108 @@
+From bfaac3332c7e06b4252746f6da514fd44e74b0e6 Mon Sep 17 00:00:00 2001
+From: Jan Lieskovsky <jlieskov@redhat.com>
+Date: Wed, 10 Aug 2016 15:47:58 +0200
+Subject: [PATCH] [BugFix] [RHEL/7] Rewrite RHEL-7 remediation for
+ 'smartcard_auth' rule since per downstream bug:  
+ https://bugzilla.redhat.com/show_bug.cgi?id=1357019
+
+we can't use 'authconfig' binary direct call, because it will
+discard the changes as performed and required by other remediation
+scripts also touching /etc/pam.d/system-auth{,-ac} file
+
+Therefore return to previous version updating necessary files
+directly via 'sed' tool (rather than using 'authconfig' binary)
+
+Note: While on the rule also update XCCDF link providing further
+info how to setup smartcard auth (since the current one returns
+HTTP 404 Not Found)
+---
+ RHEL/7/input/xccdf/system/accounts/physical.xml |  2 +-
+ RHEL/7/input/remediations/bash/smartcard_auth.sh  | 61 +++++++++++++++++++++++--
+ 2 files changed, 58 insertions(+), 5 deletions(-)
+
+diff --git a/RHEL/7/input/xccdf/system/accounts/physical.xml b/RHEL/7/input/xccdf/system/accounts/physical.xml
+index b3ac250..d229469 100644
+--- a/RHEL/7/input/xccdf/system/accounts/physical.xml
++++ b/RHEL/7/input/xccdf/system/accounts/physical.xml
+@@ -375,7 +375,7 @@ is not enabled by default and must be enabled in the system settings.
+ <description>
+ To enable smart card authentication, consult the documentation at:
+ <ul>
+-<li><b>https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7-Beta/html/System-Level_Authentication_Guide/authconfig-addl-auth.html#authconfig-smartcard</b></li>
++<li><b>https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards</b></li>
+ </ul>
+ For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
+ <ul>
+diff --git a/RHEL/7/input/remediations/bash/smartcard_auth.sh b/RHEL/7/input/remediations/bash/smartcard_auth.sh
+index 6292515..2fe5cc8 100644
+--- a/RHEL/7/input/remediations/bash/smartcard_auth.sh
++++ b/RHEL/7/input/remediations/bash/smartcard_auth.sh
+@@ -8,11 +8,64 @@ package_command install pam_pkcs11
+ # Enable pcscd.socket systemd activation socket
+ service_command enable pcscd.socket
+ 
+-# Enable smartcard authentication (but allow also other ways
+-# to login not to possibly cut off the system in question)
+-/usr/sbin/authconfig --enablesmartcard --updateall
++# Configure the expected /etc/pam.d/system-auth{,-ac} settings directly
++#
++# The code below will configure system authentication in the way smart card
++# logins will be enabled, but also user login(s) via other method to be allowed
++#
++# NOTE: It is not possible to use the 'authconfig' command to perform the
++#       remediation for us, because call of 'authconfig' would discard changes
++#       for other remediations (see RH BZ#1357019 for details)
++#
++#	Therefore we need to configure the necessary settings directly.
++#
+ 
+-# Define constants to be reused below
++# Define system-auth config location
++SYSTEM_AUTH_CONF="/etc/pam.d/system-auth"
++# Define expected 'pam_env.so' row in $SYSTEM_AUTH_CONF
++PAM_ENV_SO="auth.*required.*pam_env.so"
++
++# Define 'pam_succeed_if.so' row to be appended past $PAM_ENV_SO row into $SYSTEM_AUTH_CONF
++SYSTEM_AUTH_PAM_SUCCEED="\
++auth        \[success=1 default=ignore\] pam_succeed_if.so service notin \
++login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid"
++# Define 'pam_pkcs11.so' row to be appended past $SYSTEM_AUTH_PAM_SUCCEED
++# row into SYSTEM_AUTH_CONF file
++SYSTEM_AUTH_PAM_PKCS11="\
++auth        \[success=done authinfo_unavail=ignore ignore=ignore default=die\] \
++pam_pkcs11.so nodebug"
++
++# Define smartcard-auth config location
++SMARTCARD_AUTH_CONF="/etc/pam.d/smartcard-auth"
++# Define 'pam_pkcs11.so' auth section to be appended past $PAM_ENV_SO into $SMARTCARD_AUTH_CONF
++SMARTCARD_AUTH_SECTION="\
++auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only"
++# Define expected 'pam_permit.so' row in $SMARTCARD_AUTH_CONF
++PAM_PERMIT_SO="account.*required.*pam_permit.so"
++# Define 'pam_pkcs11.so' password section
++SMARTCARD_PASSWORD_SECTION="\
++password    required      pam_pkcs11.so"
++
++# First Correct the SYSTEM_AUTH_CONF configuration
++if ! grep -q 'pam_pkcs11.so' "$SYSTEM_AUTH_CONF"
++then
++	# Append (expected) pam_succeed_if.so row past the pam_env.so into SYSTEM_AUTH_CONF file
++	sed -i --follow-symlinks -e '/^'"$PAM_ENV_SO"'/a '"$SYSTEM_AUTH_PAM_SUCCEED" "$SYSTEM_AUTH_CONF"
++	# Append (expected) pam_pkcs11.so row past the pam_succeed_if.so into SYSTEM_AUTH_CONF file
++	sed -i --follow-symlinks -e '/^'"$SYSTEM_AUTH_PAM_SUCCEED"'/a '"$SYSTEM_AUTH_PAM_PKCS11" "$SYSTEM_AUTH_CONF"
++fi
++
++# Then also correct the SMARTCARD_AUTH_CONF
++if ! grep -q 'pam_pkcs11.so' "$SMARTCARD_AUTH_CONF"
++then
++	# Append (expected) SMARTCARD_AUTH_SECTION row past the pam_env.so into SMARTCARD_AUTH_CONF file
++	sed -i --follow-symlinks -e '/^'"$PAM_ENV_SO"'/a '"$SMARTCARD_AUTH_SECTION" "$SMARTCARD_AUTH_CONF"
++	# Append (expected) SMARTCARD_PASSWORD_SECTION row past the pam_permit.so into SMARTCARD_AUTH_CONF file
++	sed -i --follow-symlinks -e '/^'"$PAM_PERMIT_SO"'/a '"$SMARTCARD_PASSWORD_SECTION" "$SMARTCARD_AUTH_CONF"
++fi
++
++# Perform /etc/pam_pkcs11/pam_pkcs11.conf settings below
++# Define selected constants for later reuse
+ SP="[:space:]"
+ PAM_PKCS11_CONF="/etc/pam_pkcs11/pam_pkcs11.conf"
+ 
diff --git a/SOURCES/scap-security-guide-0.1.30-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch b/SOURCES/scap-security-guide-0.1.30-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
new file mode 100644
index 0000000..0fc79df
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.30-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
@@ -0,0 +1,10 @@
+--- scap-security-guide-0.1.30/RHEL/7/input/profiles/pci-dss.xml.orig	2016-06-22 16:59:38.965107812 +0200
++++ scap-security-guide-0.1.30/RHEL/7/input/profiles/pci-dss.xml	2016-06-22 17:00:06.538687935 +0200
+@@ -57,7 +57,6 @@
+ <select idref="service_chronyd_or_ntpd_enabled" selected="true"/>
+ <select idref="chronyd_or_ntpd_specify_remote_server" selected="true"/>
+ <select idref="chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
+-<select idref="rpm_verify_permissions" selected="true"/>
+ <select idref="rpm_verify_hashes" selected="true"/>
+ <select idref="install_hids" selected="true"/>
+ <select idref="rsyslog_files_permissions" selected="true"/>
diff --git a/SOURCES/scap-security-guide-0.1.30-rhbz#1344581.patch b/SOURCES/scap-security-guide-0.1.30-rhbz#1344581.patch
new file mode 100644
index 0000000..e9d4f21
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.30-rhbz#1344581.patch
@@ -0,0 +1,96 @@
+From 2276972999ecb8c54ddea8ad40bdc15a7ea86a3a Mon Sep 17 00:00:00 2001
+From: Jan Lieskovsky <jlieskov@redhat.com>
+Date: Fri, 1 Jul 2016 15:02:12 +0200
+Subject: [PATCH] [BugFix] Enhance the OVAL checks for: *
+ accounts_passwords_pam_faillock_deny_root *
+ accounts_passwords_pam_faillock_deny
+
+rules to work properly also in case sssd package is installed
+and sssd daemon is running
+
+Fixes downstream: https://bugzilla.redhat.com/show_bug.cgi?id=1344581
+---
+ RHEL/7/input/oval/accounts_passwords_pam_faillock_deny_root.xml | 8 ++++----
+ shared/oval/accounts_passwords_pam_faillock_deny.xml            | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/RHEL/7/input/oval/accounts_passwords_pam_faillock_deny_root.xml b/RHEL/7/input/oval/accounts_passwords_pam_faillock_deny_root.xml
+index 50f2e5a..7b60d22 100644
+--- a/RHEL/7/input/oval/accounts_passwords_pam_faillock_deny_root.xml
++++ b/RHEL/7/input/oval/accounts_passwords_pam_faillock_deny_root.xml
+@@ -34,7 +34,7 @@
+     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
+          pam_unix.so module in auth section -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*[^\n]*[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -51,7 +51,7 @@
+     <ind:behaviors singleline="true" />
+     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]+[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -69,7 +69,7 @@
+     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
+          pam_unix.so module in auth section -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*[^\n]*[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -86,7 +86,7 @@
+     <ind:behaviors singleline="true" />
+     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]+[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+diff --git a/shared/oval/accounts_passwords_pam_faillock_deny.xml b/shared/oval/accounts_passwords_pam_faillock_deny.xml
+index 96b5043..0923dc9 100644
+--- a/shared/oval/accounts_passwords_pam_faillock_deny.xml
++++ b/shared/oval/accounts_passwords_pam_faillock_deny.xml
+@@ -51,7 +51,7 @@
+     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
+          pam_unix.so module in auth section -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*[^\n]*[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -69,7 +69,7 @@
+     <ind:behaviors singleline="true" />
+     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]+[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -106,7 +106,7 @@
+     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
+          pam_unix.so module in auth section -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*[^\n]*[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
+@@ -124,7 +124,7 @@
+     <ind:behaviors singleline="true" />
+     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+     <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
+-    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+sufficient[\s]+pam_unix\.so[^\n]+[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
++    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
+     <!-- Check only the first instance -->
+     <ind:instance datatype="int" operation="equals">1</ind:instance>
+   </ind:textfilecontent54_object>
diff --git a/SOURCES/scap-security-guide-0.1.30-rhbz#1351541.patch b/SOURCES/scap-security-guide-0.1.30-rhbz#1351541.patch
new file mode 100644
index 0000000..f775f47
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.30-rhbz#1351541.patch
@@ -0,0 +1,22 @@
+From e4d8a19ff626f416a4972344b529ff9fd5bc1c6f Mon Sep 17 00:00:00 2001
+From: Jan Lieskovsky <jlieskov@redhat.com>
+Date: Thu, 30 Jun 2016 14:30:52 +0200
+Subject: [PATCH] [BugFix] [RHEL/6] Make the title of the RHEL-6
+ stig-rhel6-server-gui-upstream profile consistent with its RHEL-7 equivalent
+
+Fixes #1319
+---
+ RHEL/6/input/profiles/stig-rhel6-server-gui-upstream.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/RHEL/6/input/profiles/stig-rhel6-server-gui-upstream.xml b/RHEL/6/input/profiles/stig-rhel6-server-gui-upstream.xml
+index 669ac2b..d5351d8 100644
+--- a/RHEL/6/input/profiles/stig-rhel6-server-gui-upstream.xml
++++ b/RHEL/6/input/profiles/stig-rhel6-server-gui-upstream.xml
+@@ -1,5 +1,5 @@
+ <Profile id="stig-rhel6-server-gui-upstream" extends="stig-rhel6-server-upstream">
+-<title override="true">Upstream STIG for Red Hat Enterprise Linux 6 Server</title>
++<title override="true">Upstream STIG for Red Hat Enterprise Linux 6 Server Running GUIs</title>
+ <description override="true">This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process,
+ serving as the upstream development environment for the Red Hat Enterprise Linux 6 Server STIG.
+ 
diff --git a/SOURCES/scap-security-guide-0.1.30-rhbz#1351751.patch b/SOURCES/scap-security-guide-0.1.30-rhbz#1351751.patch
new file mode 100644
index 0000000..862fd9d
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.30-rhbz#1351751.patch
@@ -0,0 +1,144 @@
+From 989cb130cb7d03f27294313c3ee2f1f4d61568db Mon Sep 17 00:00:00 2001
+From: Jan Lieskovsky <jlieskov@redhat.com>
+Date: Tue, 28 Jun 2016 13:04:24 +0200
+Subject: [PATCH 1/2] [Enhancement] [RHEL/6] [RHEL/7] Include the generated
+ HTML tables for RHEL-6 and RHEL-7 products into the produced RPM package
+
+Part of #1297
+---
+ RHEL/6/Makefile             |  5 +++--
+ RHEL/7/Makefile             |  2 ++
+ scap-security-guide.spec.in | 36 +++++++++++++++++++++++-------------
+ 3 files changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/RHEL/6/Makefile b/RHEL/6/Makefile
+index 782d0f7..ac7d74e 100644
+--- a/RHEL/6/Makefile
++++ b/RHEL/6/Makefile
+@@ -69,8 +69,7 @@ table-stigs: $(OUT)/xccdf-unlinked-final.xml table-srgmap checks
+ 		$(TRANS)/xccdf-apply-overlay-stig.xslt $<
+ 	xsltproc -o $(OUT)/table-$(PROD)-stig.html $(TRANS)/xccdf2table-stig.xslt $(OUT)/unlinked-stig-$(PROD)-xccdf.xml
+ 
+-tables: table-refs table-idents table-stigs
+-#tables: table-refs table-idents table-srgmap table-stigs
++tables: table-refs table-idents table-srgmap table-stigs
+ 
+ content: $(OUT)/xccdf-unlinked-final.xml checks
+ 	cp $< $(OUT)/unlinked-$(PROD)-xccdf.xml
+@@ -180,6 +179,8 @@ dist: tables guide content
+ 	cp $(OUT)/$(ID)-$(PROD)-cpe-dictionary.xml $(DIST)/content
+ 	cp $(OUT)/$(ID)-$(PROD)-cpe-oval.xml $(DIST)/content
+ 	cp $(OUT)/$(ID)-$(PROD)-ds.xml $(DIST)/content
++	mkdir -p $(DIST)/tables
++	cp $(OUT)/table-*.{x,}html $(DIST)/tables
+ 	mkdir -p $(DIST)/guide
+ 	cp $(OUT)/*-guide-*.html $(DIST)/guide
+ 	cp $(OUT)/$(ID)-centos6-xccdf.xml $(DIST)/content
+diff --git a/RHEL/7/Makefile b/RHEL/7/Makefile
+index fc9f284..0cafa7c 100644
+--- a/RHEL/7/Makefile
++++ b/RHEL/7/Makefile
+@@ -183,6 +183,8 @@ dist: tables guide content
+ 	cp $(OUT)/$(ID)-$(PROD)-cpe-dictionary.xml $(DIST)/content
+ 	cp $(OUT)/$(ID)-$(PROD)-cpe-oval.xml $(DIST)/content
+ 	cp $(OUT)/$(ID)-$(PROD)-ds.xml $(DIST)/content
++	mkdir -p $(DIST)/tables
++	cp $(OUT)/table-*.{x,}html $(DIST)/tables
+ 	mkdir -p $(DIST)/guide
+ 	cp $(OUT)/*-guide-*.html $(DIST)/guide
+ 	cp $(OUT)/$(ID)-centos7-xccdf.xml $(DIST)/content
+diff --git a/scap-security-guide.spec.in b/scap-security-guide.spec.in
+index ae3cc05..6fbb800 100644
+--- a/scap-security-guide.spec.in
++++ b/scap-security-guide.spec.in
+@@ -82,30 +82,40 @@ rm %{buildroot}%{_datadir}/xml/scap/ssg/content/*-cpe-dictionary.xml
+ # We do this after the filtering on Fedora because we don't ship JBossEAP5 datastreams
+ cp -a JBossEAP5/eap5-* %{buildroot}%{_datadir}/xml/scap/ssg/content/
+ 
+-# Docs
+-mkdir -p %{buildroot}/%{_docdir}/%{name}/guides
+-cp -a RHEL/6/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
+-cp -a RHEL/7/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
+-cp -a Firefox/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
+-cp -a JRE/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
++# Add in HTML tables for selected products
++mkdir -p %{buildroot}/%{_docdir}/%{name}-%{version}/tables
++cp -a RHEL/6/dist/tables/* %{buildroot}/%{_docdir}/%{name}-%{version}/tables
++cp -a RHEL/7/dist/tables/* %{buildroot}/%{_docdir}/%{name}-%{version}/tables
++
++# Add in LICENSE and README.md
++cp -a LICENSE README.md %{buildroot}/%{_docdir}/%{name}-%{version}
++
++# scap-security-guide-doc subpackage contains just HTML guides for supported products
++mkdir -p %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++cp -a RHEL/6/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++cp -a RHEL/7/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++cp -a Firefox/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++cp -a JRE/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
+ # outside of the normal build system, different guide
+-cp -a JBossEAP5/docs/JBossEAP5_Guide.html %{buildroot}/%{_docdir}/%{name}/guides
++cp -a JBossEAP5/docs/JBossEAP5_Guide.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
+ 
+ %if 0%{?fedora}
+-cp -a Fedora/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
+-cp -a Chromium/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}/guides
+-#cp -a Webmin/output/*-guide-*.html %{buildroot}/%{_defaultdocdir}/%{name}/guides
++cp -a Fedora/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++cp -a Chromium/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
++#cp -a Webmin/output/*-guide-*.html %{buildroot}/%{_defaultdocdir}/%{name}-%{version}/guides
+ %endif
+ 
+ %files
+ %{_datadir}/xml/scap
+ %{_datadir}/%{name}
+ %lang(en) %{_mandir}/en/man8/scap-security-guide.8.*
+-%doc LICENSE
+-%doc README.md
++%doc %{_docdir}/%{name}-%{version}/tables/*.html
++%doc %{_docdir}/%{name}-%{version}/tables/*.xhtml
++%doc %{_docdir}/%{name}-%{version}/LICENSE
++%doc %{_docdir}/%{name}-%{version}/README.md
+ 
+ %files doc
+-%doc %{_docdir}/%{name}/guides/*.html
++%doc %{_docdir}/%{name}-%{version}/guides/*.html
+ 
+ %changelog
+ * __DATE__ __REL_MANAGER__ <__REL_MANAGER_MAIL__> __VERSION__-__RELEASE__
+
+From 33ea7d73d7a53b465c15ac6289fe8833749622dc Mon Sep 17 00:00:00 2001
+From: Jan Lieskovsky <jlieskov@redhat.com>
+Date: Tue, 28 Jun 2016 18:50:17 +0200
+Subject: [PATCH 2/2] [Enhancement][RHEL/6][RHEL/7] Provide currently available
+ RHEL-6 and RHEL-7 kickstart files in the produced RPM package
+
+Fixes (together with previous commit): #1297
+---
+ scap-security-guide.spec.in | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/scap-security-guide.spec.in b/scap-security-guide.spec.in
+index 6fbb800..056e84c 100644
+--- a/scap-security-guide.spec.in
++++ b/scap-security-guide.spec.in
+@@ -90,6 +90,11 @@ cp -a RHEL/7/dist/tables/* %{buildroot}/%{_docdir}/%{name}-%{version}/tables
+ # Add in LICENSE and README.md
+ cp -a LICENSE README.md %{buildroot}/%{_docdir}/%{name}-%{version}
+ 
++# Add in kickstart files for selected products
++mkdir -p %{buildroot}%{_datadir}/%{name}/kickstart
++cp -a RHEL/6/kickstart/*-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart
++cp -a RHEL/7/kickstart/*-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart
++
+ # scap-security-guide-doc subpackage contains just HTML guides for supported products
+ mkdir -p %{buildroot}/%{_docdir}/%{name}-%{version}/guides
+ cp -a RHEL/6/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/guides
+@@ -107,7 +112,7 @@ cp -a Chromium/output/*-guide-*.html %{buildroot}/%{_docdir}/%{name}-%{version}/
+ 
+ %files
+ %{_datadir}/xml/scap
+-%{_datadir}/%{name}
++%{_datadir}/%{name}/kickstart
+ %lang(en) %{_mandir}/en/man8/scap-security-guide.8.*
+ %doc %{_docdir}/%{name}-%{version}/tables/*.html
+ %doc %{_docdir}/%{name}-%{version}/tables/*.xhtml
diff --git a/SPECS/scap-security-guide.spec b/SPECS/scap-security-guide.spec
index 38b27ba..8fa6808 100644
--- a/SPECS/scap-security-guide.spec
+++ b/SPECS/scap-security-guide.spec
@@ -1,20 +1,20 @@
-%global		redhatssgversion	25
+%global		redhatssgversion	30
 
 Name:		scap-security-guide
 Version:	0.1.%{redhatssgversion}
-Release:	3%{?dist}.0.1
+Release:	3%{?dist}
 Summary:	Security guidance and baselines in SCAP formats
 
 Group:		System Environment/Base
 License:	Public Domain
 URL:		https://github.com/OpenSCAP/scap-security-guide
 Source0:	%{name}-%{version}.tar.gz
-Patch1:		scap-security-guide-0.1.19-rhel7-drop-cpuspeed-rule-since-obsolete.patch
-Patch2:		scap-security-guide-0.1.25-update-upstream-manual-page.patch
-Patch3:		scap-security-guide-0.1.25-add-adjtimex-settimeofday-stime-rhel7-remediation.patch
-Patch4:		scap-security-guide-0.1.25-downstream-rhel7-pci-dss-disable-selected-rules.patch
-Patch5:		scap-security-guide-0.1.25-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
-Patch99:	scap-security-guide-0.1.25-centos-menu-branding.patch
+Patch1:		scap-security-guide-0.1.25-update-upstream-manual-page.patch
+Patch2:		scap-security-guide-0.1.30-downstream-rhel7-pci-dss-drop-rpm-verify-permissions-rule.patch
+Patch3:		scap-security-guide-0.1.30-rhbz#1351541.patch
+Patch4:		scap-security-guide-0.1.30-rhbz#1344581.patch
+Patch5:		scap-security-guide-0.1.30-rhbz#1351751.patch
+Patch6:		scap-security-guide-0.1.30-downstream-rhbz#1357019.patch
 BuildArch:	noarch
 
 BuildRequires:	libxslt, expat, python, openscap-scanner >= 1.2.5, python-lxml
@@ -42,28 +42,23 @@ been generated from XCCDF benchmarks present in %{name} package.
 
 %prep
 %setup -q -n %{name}-%{version}
-# Drop cpuspeed rule since obsoleted in Fedora-16 by cpupower from kernel-tools RPM
-# http://marc.info/?l=fedora-devel-list&m=131107769617369&w=2
-%patch1 -p1 -b .drop-cpuspeed
 # Update manual page to drop the part dedicated to Fedora content
-%patch2 -p1 -b .man_page_update
-# Downstream -- Add RHEL-7 remediation for 'audit_rules_time_adjtimex', 'audit_rules_time_settimeofday', and
-# 'audit_rules_time_stime' rules
-%patch3 -p1 -b .adjtimex_settimeofday_stime
-# Downstream
-# RHEL-7 PCI-DSS profile disable selected rules:
-# * dconf_gnome_screensaver_idle_delay -- missing RHEL-7 remediation
-# * dconf_gnome_screensaver_idle_activation -- missing RHEL-7 remediation
-# * dconf_gnome_screensaver_lock_enabled -- missing RHEL-7 remediation
-# * audit_rules_login_events -- incorrect OVAL, see https://github.com/OpenSCAP/scap-security-guide/issues/607
-# * audit_rules_privileged_commands -- missing RHEL-7 remediation, and
-# * audit_rules_immutable -- missing RHEL-7 remediation
-%patch4 -p1 -b .rhel7_pcidss_downstream_disabled
+%patch1 -p1 -b .man_page_update
 # Temporarily drop "Verify and Correct File Permissions with RPM"
 # rule from RHEL-7's PCI-DSS profile (RH BZ#1267861)
-%patch5 -p1 -b .rhel7_pcidss_drop_rpm_verify_permissions_rule
-
-%patch99 -p1 -b .centos
+%patch2 -p1 -b .rhel7_pcidss_drop_rpm_verify_permissions_rule
+# Fix for RHBZ#1351541
+%patch3 -p1 -b .rhbz#1351541
+# Fix for RHBZ#1344581
+%patch4 -p1 -b .rhbz#1344581
+# Fix for RHBZ#1351751
+%patch5 -p1 -b .rhbz#1351751
+# Downstream fix for RHBZ#1357019 (slightly differs from upstream
+# https://patch-diff.githubusercontent.com/raw/OpenSCAP/scap-security-guide/pull/1388.patch
+# version because 'smartcard-auth.sh' remediation in upstream got moved
+# to different location already). The rest of the change (except the path)
+# is identical with upstream form
+%patch6 -p1 -b .rhbz#1357019
 
 %build
 (cd RHEL/7 && make dist)
@@ -79,12 +74,12 @@ mkdir -p %{buildroot}%{_mandir}/en/man8/
 # Add in RHEL-7 core content (SCAP)
 cp -a RHEL/7/dist/content/ssg-rhel7-cpe-dictionary.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
 cp -a RHEL/7/dist/content/ssg-rhel7-cpe-oval.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
-cp -a RHEL/7/dist/content/ssg-centos7-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
+cp -a RHEL/7/dist/content/ssg-rhel7-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
 cp -a RHEL/7/dist/content/ssg-rhel7-oval.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
-cp -a RHEL/7/dist/content/ssg-centos7-xccdf.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
+cp -a RHEL/7/dist/content/ssg-rhel7-xccdf.xml %{buildroot}%{_datadir}/xml/scap/ssg/content/
 
 # Add in RHEL-6 datastream (SCAP)
-cp -a RHEL/6/dist/content/ssg-centos6-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content
+cp -a RHEL/6/dist/content/ssg-rhel6-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content
 
 # Add in Firefox datastream (SCAP)
 cp -a Firefox/dist/content/ssg-firefox-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content
@@ -92,16 +87,10 @@ cp -a Firefox/dist/content/ssg-firefox-ds.xml %{buildroot}%{_datadir}/xml/scap/s
 # Add in Java Runtime Environment (JRE) datastream (SCAP)
 cp -a JRE/dist/content/ssg-jre-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content
 
-# Add in library for remediations
-mkdir -p %{buildroot}%{_datadir}/%{name}
-cp -a shared/fixes/bash/templates/remediation_functions %{buildroot}%{_datadir}/%{name}/remediation_functions
-
-# Add in RHEL-6 kickstart files
+# Add in currently available kickstart files
 mkdir -p %{buildroot}%{_datadir}/%{name}/kickstart
-cp -a RHEL/6/kickstart/ssg-rhel6-stig-ks.cfg  %{buildroot}%{_datadir}/%{name}/kickstart/
-cp -a RHEL/6/kickstart/ssg-rhel6-usgcb-server-with-gui-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart/
-# Add in RHEL-7 kickstart files
-cp -a RHEL/7/kickstart/ssg-rhel7-pci-dss-server-with-gui-oaa-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart/
+cp -a RHEL/6/kickstart/*-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart
+cp -a RHEL/7/kickstart/*-ks.cfg %{buildroot}%{_datadir}/%{name}/kickstart
 
 # Add in manpage
 cp -a docs/scap-security-guide.8 %{buildroot}%{_mandir}/en/man8/scap-security-guide.8
@@ -111,16 +100,46 @@ cp -a docs/scap-security-guide.8 %{buildroot}%{_mandir}/en/man8/scap-security-gu
 %{_datadir}/xml/scap
 %{_datadir}/%{name}
 %lang(en) %{_mandir}/en/man8/scap-security-guide.8.gz
-%doc ./LICENSE RHEL/6/output/table-rhel6-cces.html RHEL/7/output/table-rhel7-cces.html RHEL/6/output/table-rhel6-nistrefs-common.html RHEL/6/output/table-rhel6-nistrefs.html RHEL/6/output/table-rhel6-srgmap-flat.html RHEL/6/output/table-rhel6-srgmap-flat.xhtml RHEL/6/output/table-rhel6-srgmap.html RHEL/6/output/table-rhel6-stig.html RHEL/6/input/auxiliary/DISCLAIMER
+%doc RHEL/6/dist/tables/*.html
+%doc RHEL/6/dist/tables/*.xhtml
+%doc RHEL/7/dist/tables/*.html
+%doc RHEL/7/dist/tables/*.xhtml
+%doc ./LICENSE
+%doc RHEL/6/input/auxiliary/DISCLAIMER
 
 %files doc
 %defattr(-,root,root,-)
-%doc RHEL/6/output/ssg-centos6-guide-*.html RHEL/7/output/ssg-centos7-guide-*.html JRE/output/ssg-jre-guide-*.html Firefox/output/ssg-firefox-guide-*.html
+%doc RHEL/6/output/ssg-rhel6-guide-*.html
+%doc RHEL/7/output/ssg-rhel7-guide-*.html
+%doc JRE/output/ssg-jre-guide-*.html
+%doc Firefox/output/ssg-firefox-guide-*.html
 
 %changelog
-* Wed Nov 25 2015 brian@bstinson.com 0.1.25-3.centos.0.1
-- Use the CentOS SCAP content 
-- scap-security-guide-0.1.25-centos-menu-branding.patch
+* Wed Aug 10 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-3
+- Correct the remediation script for 'Enable Smart Card Login' rule
+  for Red Hat Enterprise Linux 7 (RH BZ#1357019)
+
+* Thu Jul 14 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-2
+- Fix issue of two STIG profiles for Red Hat Enterprise Linux 6 benchmark
+  having the identical title (RH BZ#1351541)
+- Enhance the shared OVAL check for 'Set Deny For Failed Password Attempts'
+  rule and also Red Hat Enterprise Linux 7 OVAL check for 'Configure the root
+  Account for Failed Password Attempts' rule to report correct system status
+  WRT to these requirements also in the case the SSSD daemon is used
+  (RH BZ#1344581)
+- Include currently available kickstart files and produced HTML tables for
+  Red Hat Enterprise Linux 6 and 7 products into the produced RPM package
+  (RH BZ#1351751)
+
+* Wed Jun 22 2016 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-1
+- Update to upstream's 0.1.30 release:
+  https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
+  (RH BZ#1289533)
+- Drop remediation functions library since starting from 0.1.30 release
+  remediation scripts are part of the benchmarks directly
+- Drop three patches that have been accepted upstream in the meantime
+- Update drop-rpm-verify-permissions-rule patch to work properly against
+  0.1.30 release
 
 * Fri Oct 02 2015 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-3
 - Drop "Verify and Correct File Permissions with RPM" rule from the PCI-DSS