Blame SOURCES/scap-security-guide-0.1.51-cis_hipaa_ansible_fixes_PR_5777.patch

c862b5
From 31b216f0dbe9e7531f273fbbd618ff8905358497 Mon Sep 17 00:00:00 2001
c862b5
From: Vojtech Polasek <vpolasek@redhat.com>
c862b5
Date: Thu, 21 May 2020 13:30:24 +0200
c862b5
Subject: [PATCH 1/3] simplify ansible remediation of no_direct_root_logins
c862b5
c862b5
---
c862b5
 .../root_logins/no_direct_root_logins/ansible/shared.yml    | 6 +-----
c862b5
 1 file changed, 1 insertion(+), 5 deletions(-)
c862b5
c862b5
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
c862b5
index e9a29a24d5..6fbb7c72a5 100644
c862b5
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
c862b5
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
c862b5
@@ -3,13 +3,9 @@
c862b5
 # strategy = restrict
c862b5
 # complexity = low
c862b5
 # disruption = low
c862b5
-- name: Test for existence of /etc/securetty
c862b5
-  stat:
c862b5
-    path: /etc/securetty
c862b5
-  register: securetty_empty
c862b5
+
c862b5
 
c862b5
 - name: "Direct root Logins Not Allowed"
c862b5
   copy:
c862b5
     dest: /etc/securetty
c862b5
     content: ""
c862b5
-  when: securetty_empty.stat.size > 1
c862b5
c862b5
From d12bcac36bac2a84ddf6162946b631c99fa86071 Mon Sep 17 00:00:00 2001
c862b5
From: Vojtech Polasek <vpolasek@redhat.com>
c862b5
Date: Thu, 21 May 2020 14:21:38 +0200
c862b5
Subject: [PATCH 2/3] change name of libsemanage python bindings for rhel8
c862b5
c862b5
---
c862b5
 shared/templates/template_ANSIBLE_sebool | 8 +++++++-
c862b5
 1 file changed, 7 insertions(+), 1 deletion(-)
c862b5
c862b5
diff --git a/shared/templates/template_ANSIBLE_sebool b/shared/templates/template_ANSIBLE_sebool
c862b5
index 29f37081be..38d7c7c350 100644
c862b5
--- a/shared/templates/template_ANSIBLE_sebool
c862b5
+++ b/shared/templates/template_ANSIBLE_sebool
c862b5
@@ -13,11 +13,17 @@
c862b5
 {{% else %}}
c862b5
 - (xccdf-var var_{{{ SEBOOLID }}})
c862b5
 
c862b5
+{{% if product == "rhel8" %}}
c862b5
+- name: Ensure python3-libsemanage installed
c862b5
+  package:
c862b5
+    name: python3-libsemanage
c862b5
+    state: present
c862b5
+{{% else %}}
c862b5
 - name: Ensure libsemanage-python installed
c862b5
   package:
c862b5
     name: libsemanage-python
c862b5
     state: present
c862b5
-
c862b5
+{{% endif %}}
c862b5
 - name: Set SELinux boolean {{{ SEBOOLID }}} accordingly
c862b5
   seboolean:
c862b5
     name: {{{ SEBOOLID }}}
c862b5
c862b5
From ccf902082fc4f5abd8fae702e4322c6089773012 Mon Sep 17 00:00:00 2001
c862b5
From: Vojtech Polasek <vpolasek@redhat.com>
c862b5
Date: Thu, 21 May 2020 14:57:05 +0200
c862b5
Subject: [PATCH 3/3] add tests for no_direct_root_logins
c862b5
c862b5
---
c862b5
 .../root_logins/no_direct_root_logins/tests/correct.pass.sh    | 3 +++
c862b5
 .../root_logins/no_direct_root_logins/tests/missing.fail.sh    | 3 +++
c862b5
 .../root_logins/no_direct_root_logins/tests/wrong.fail.sh      | 3 +++
c862b5
 3 files changed, 9 insertions(+)
c862b5
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/correct.pass.sh
c862b5
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/missing.fail.sh
c862b5
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/wrong.fail.sh
c862b5
c862b5
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/correct.pass.sh
c862b5
new file mode 100644
c862b5
index 0000000000..17251f6a98
c862b5
--- /dev/null
c862b5
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/correct.pass.sh
c862b5
@@ -0,0 +1,3 @@
c862b5
+#!/bin/bash
c862b5
+
c862b5
+echo > /etc/securetty
c862b5
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/missing.fail.sh
c862b5
new file mode 100644
c862b5
index 0000000000..c764814b26
c862b5
--- /dev/null
c862b5
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/missing.fail.sh
c862b5
@@ -0,0 +1,3 @@
c862b5
+#!/bin/bash
c862b5
+
c862b5
+rm -f /etc/securetty
c862b5
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/wrong.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/wrong.fail.sh
c862b5
new file mode 100644
c862b5
index 0000000000..43ac341e87
c862b5
--- /dev/null
c862b5
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/tests/wrong.fail.sh
c862b5
@@ -0,0 +1,3 @@
c862b5
+#!/bin/bash
c862b5
+
c862b5
+echo "something" > /etc/securetty