From ca2288e312d232d058d6985d541353719a1800e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 08:47:50 +0100
Subject: [PATCH 1/6] Rename SELinux Boolean docker_connect_any
The SELinux Boolean docker_connect_any has been renamed to
container_connect_any in both RHEL7 and RHEL8.
---
.../sebool_container_connect_any/rule.yml | 16 ++++++++++++++++
.../sebool_docker_connect_any/rule.yml | 16 ----------------
...ect_any.var => var_container_connect_any.var} | 2 +-
rhel7/templates/csv/selinux_booleans.csv | 2 +-
rhv4/templates/csv/selinux_booleans.csv | 2 +-
5 files changed, 19 insertions(+), 19 deletions(-)
create mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml
rename linux_os/guide/system/selinux/selinux-booleans/{var_docker_connect_any.var => var_container_connect_any.var} (86%)
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml
new file mode 100644
index 0000000000..cb715fa66e
--- /dev/null
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+prodtype: rhel7,rhel8
+
+title: 'Disable the container_connect_any SELinux Boolean'
+
+description: |-
+ By default, the SELinux boolean <tt>container_connect_any</tt> is disabled.
+ If this setting is enabled, it should be disabled.
+ {{{ describe_sebool_disable(sebool="container_connect_any") }}}
+
+rationale: ""
+
+severity: medium
+
+{{{ complete_ocil_entry_sebool_disabled(sebool="container_connect_any") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml
deleted file mode 100644
index 7c2a65d076..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the docker_connect_any SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>docker_connect_any</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="docker_connect_any") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="docker_connect_any") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var b/linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var
similarity index 86%
rename from linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var
rename to linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var
index 24af7183da..baad46a636 100644
--- a/linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var
+++ b/linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var
@@ -1,6 +1,6 @@
documentation_complete: true
-title: 'docker_connect_any SELinux Boolean'
+title: 'container_connect_any SELinux Boolean'
description: |-
default - Default SELinux boolean setting.
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index af220ed80a..fb0fc958c5 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -38,7 +38,7 @@ deny_execmem,use_var
deny_ptrace,use_var
dhcpc_exec_iptables,use_var
dhcpd_use_ldap,use_var
-docker_connect_any,use_var
+container_connect_any,use_var
docker_transition_unconfined,use_var
domain_fd_use,use_var
domain_kernel_load_modules,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index af220ed80a..fb0fc958c5 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -38,7 +38,7 @@ deny_execmem,use_var
deny_ptrace,use_var
dhcpc_exec_iptables,use_var
dhcpd_use_ldap,use_var
-docker_connect_any,use_var
+container_connect_any,use_var
docker_transition_unconfined,use_var
domain_fd_use,use_var
domain_kernel_load_modules,use_var
From 8707ae7560c1a786b702281592968df28a743a01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 08:57:23 +0100
Subject: [PATCH 2/6] Remove SELinux boolean docker_transition_unconfined
The SELinux boolean docker_transition_unconfined has been
completely removed from SELinux without any replacement.
---
.../rule.yml | 16 ----------------
.../var_docker_transition_unconfined.var | 19 -------------------
rhel7/templates/csv/selinux_booleans.csv | 1 -
rhv4/templates/csv/selinux_booleans.csv | 1 -
4 files changed, 37 deletions(-)
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml
deleted file mode 100644
index 16792a395b..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Enable the docker_transition_unconfined SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>docker_transition_unconfined</tt> is enabled.
- If this setting is disabled, it should be enabled.
- {{{ describe_sebool_enable(sebool="docker_transition_unconfined") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_enabled(sebool="docker_transition_unconfined") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var b/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var
deleted file mode 100644
index cf66e5e915..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'docker_transition_unconfined SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: true
- off: false
- on: true
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index fb0fc958c5..8a5d34cffa 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -39,7 +39,6 @@ deny_ptrace,use_var
dhcpc_exec_iptables,use_var
dhcpd_use_ldap,use_var
container_connect_any,use_var
-docker_transition_unconfined,use_var
domain_fd_use,use_var
domain_kernel_load_modules,use_var
entropyd_use_audio,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index fb0fc958c5..8a5d34cffa 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -39,7 +39,6 @@ deny_ptrace,use_var
dhcpc_exec_iptables,use_var
dhcpd_use_ldap,use_var
container_connect_any,use_var
-docker_transition_unconfined,use_var
domain_fd_use,use_var
domain_kernel_load_modules,use_var
entropyd_use_audio,use_var
From a794b4a365001fbe6b5aed4bf9b8169a6a9dea53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 09:02:59 +0100
Subject: [PATCH 3/6] Remove SELinux boolean ftp_home_dir
The SELinux boolean ftp_home_dir has been
completely removed from SELinux without any replacement.
---
.../sebool_ftp_home_dir/rule.yml | 16 ----------------
.../selinux-booleans/var_ftp_home_dir.var | 19 -------------------
rhel7/templates/csv/selinux_booleans.csv | 1 -
rhv4/templates/csv/selinux_booleans.csv | 1 -
4 files changed, 37 deletions(-)
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml
deleted file mode 100644
index 1836bc059e..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the ftp_home_dir SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>ftp_home_dir</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="ftp_home_dir") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="ftp_home_dir") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var b/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var
deleted file mode 100644
index 5da7175f65..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'ftp_home_dir SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index 8a5d34cffa..17a1f51403 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -57,7 +57,6 @@ ftpd_use_cifs,use_var
ftpd_use_fusefs,use_var
ftpd_use_nfs,use_var
ftpd_use_passive_mode,use_var
-ftp_home_dir,use_var
git_cgi_enable_homedirs,use_var
git_cgi_use_cifs,use_var
git_cgi_use_nfs,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index 8a5d34cffa..17a1f51403 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -57,7 +57,6 @@ ftpd_use_cifs,use_var
ftpd_use_fusefs,use_var
ftpd_use_nfs,use_var
ftpd_use_passive_mode,use_var
-ftp_home_dir,use_var
git_cgi_enable_homedirs,use_var
git_cgi_use_cifs,use_var
git_cgi_use_nfs,use_var
From f71a5f81abad89505ac4e4404249cebc5cf39c89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 09:19:03 +0100
Subject: [PATCH 4/6] Remove SELinux boolean virt_sandbox_use_nfs
The SELinux boolean virt_sandbox_use_nfs has been removed and
is superseded by virt_use_nfs which we already have in other
rule.
---
.../sebool_virt_sandbox_use_nfs/rule.yml | 16 ----------------
.../var_virt_sandbox_use_nfs.var | 19 -------------------
rhel7/templates/csv/selinux_booleans.csv | 1 -
rhv4/templates/csv/selinux_booleans.csv | 1 -
4 files changed, 37 deletions(-)
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml
deleted file mode 100644
index 7d553a85de..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the virt_sandbox_use_nfs SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>virt_sandbox_use_nfs</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="virt_sandbox_use_nfs") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="virt_sandbox_use_nfs") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var b/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var
deleted file mode 100644
index f7a0cd0679..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'virt_sandbox_use_nfs SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index 17a1f51403..aaf2e1a34f 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var
virt_sandbox_use_audit,use_var
virt_sandbox_use_mknod,use_var
virt_sandbox_use_netlink,use_var
-virt_sandbox_use_nfs,use_var
virt_sandbox_use_samba,use_var
virt_sandbox_use_sys_admin,use_var
virt_transition_userdomain,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index 17a1f51403..aaf2e1a34f 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var
virt_sandbox_use_audit,use_var
virt_sandbox_use_mknod,use_var
virt_sandbox_use_netlink,use_var
-virt_sandbox_use_nfs,use_var
virt_sandbox_use_samba,use_var
virt_sandbox_use_sys_admin,use_var
virt_transition_userdomain,use_var
From 7afaf886cd99437a09b6aedd9e375ee1162155c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 09:27:35 +0100
Subject: [PATCH 5/6] Remove SELinux boolean virt_sandbox_use_samba
The SELinux boolean virt_sandbox_use_samba has been removed and
is superseded by virt_use_samba which we already have in other
rule.
---
.../sebool_virt_sandbox_use_samba/rule.yml | 16 ----------------
.../var_virt_sandbox_use_samba.var | 19 -------------------
rhel7/templates/csv/selinux_booleans.csv | 1 -
rhv4/templates/csv/selinux_booleans.csv | 1 -
4 files changed, 37 deletions(-)
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml
deleted file mode 100644
index b3ce5feb9e..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the virt_sandbox_use_samba SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>virt_sandbox_use_samba</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="virt_sandbox_use_samba") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="virt_sandbox_use_samba") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var b/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var
deleted file mode 100644
index de370465dd..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'virt_sandbox_use_samba SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index aaf2e1a34f..19a27493db 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var
virt_sandbox_use_audit,use_var
virt_sandbox_use_mknod,use_var
virt_sandbox_use_netlink,use_var
-virt_sandbox_use_samba,use_var
virt_sandbox_use_sys_admin,use_var
virt_transition_userdomain,use_var
virt_use_comm,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index aaf2e1a34f..19a27493db 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var
virt_sandbox_use_audit,use_var
virt_sandbox_use_mknod,use_var
virt_sandbox_use_netlink,use_var
-virt_sandbox_use_samba,use_var
virt_sandbox_use_sys_admin,use_var
virt_transition_userdomain,use_var
virt_use_comm,use_var
From e0287da5af28c3357fa920a16d538ab424bd5392 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 12 Mar 2019 10:13:10 +0100
Subject: [PATCH 6/6] Remove sftpd_.* SELinux booleans
SELinux booleans sftpd_anon_write, sftpd_enable_homedirs,
sftpd_full_access, sftpd_write_ssh_home have been removed from SELinux
because they were useless because openssh doesn't use sftpd_t type
anymore and it uses user's type for sftpd sessions. They haven't been
superseded by anything else.
---
.../sebool_sftpd_anon_write/rule.yml | 16 ----------------
.../sebool_sftpd_enable_homedirs/rule.yml | 16 ----------------
.../sebool_sftpd_full_access/rule.yml | 16 ----------------
.../sebool_sftpd_write_ssh_home/rule.yml | 16 ----------------
.../selinux-booleans/var_sftpd_anon_write.var | 19 -------------------
.../var_sftpd_enable_homedirs.var | 19 -------------------
.../var_sftpd_full_access.var | 19 -------------------
.../var_sftpd_write_ssh_home.var | 19 -------------------
rhel7/templates/csv/selinux_booleans.csv | 4 ----
rhv4/templates/csv/selinux_booleans.csv | 4 ----
10 files changed, 148 deletions(-)
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var
delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml
deleted file mode 100644
index a5327110f8..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the sftpd_anon_write SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>sftpd_anon_write</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="sftpd_anon_write") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_anon_write") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml
deleted file mode 100644
index ac52da2773..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the sftpd_enable_homedirs SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>sftpd_enable_homedirs</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="sftpd_enable_homedirs") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_enable_homedirs") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml
deleted file mode 100644
index fff440ff7e..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the sftpd_full_access SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>sftpd_full_access</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="sftpd_full_access") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_full_access") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml
deleted file mode 100644
index 7b67579eb5..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-documentation_complete: true
-
-prodtype: rhel7,rhel8
-
-title: 'Disable the sftpd_write_ssh_home SELinux Boolean'
-
-description: |-
- By default, the SELinux boolean <tt>sftpd_write_ssh_home</tt> is disabled.
- If this setting is enabled, it should be disabled.
- {{{ describe_sebool_disable(sebool="sftpd_write_ssh_home") }}}
-
-rationale: ""
-
-severity: medium
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_write_ssh_home") }}}
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var
deleted file mode 100644
index ec43879c93..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'sftpd_anon_write SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var
deleted file mode 100644
index 1ebd92f562..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'sftpd_enable_homedirs SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var
deleted file mode 100644
index a6d1fc9efc..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'sftpd_full_access SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var
deleted file mode 100644
index 67a3f00655..0000000000
--- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var
+++ /dev/null
@@ -1,19 +0,0 @@
-documentation_complete: true
-
-title: 'sftpd_write_ssh_home SELinux Boolean'
-
-description: |-
- default - Default SELinux boolean setting.
- <br />on - SELinux boolean is enabled.
- <br />off - SELinux boolean is disabled.
-
-type: boolean
-
-operator: equals
-
-interactive: false
-
-options:
- default: false
- off: false
- on: true
diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv
index 19a27493db..1b55f6db31 100644
--- a/rhel7/templates/csv/selinux_booleans.csv
+++ b/rhel7/templates/csv/selinux_booleans.csv
@@ -224,10 +224,6 @@ selinuxuser_share_music,use_var
selinuxuser_tcp_server,use_var
selinuxuser_udp_server,use_var
selinuxuser_use_ssh_chroot,use_var
-sftpd_anon_write,use_var
-sftpd_enable_homedirs,use_var
-sftpd_full_access,use_var
-sftpd_write_ssh_home,use_var
sge_domain_can_network_connect,use_var
sge_use_nfs,use_var
smartmon_3ware,use_var
diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv
index 19a27493db..1b55f6db31 100644
--- a/rhv4/templates/csv/selinux_booleans.csv
+++ b/rhv4/templates/csv/selinux_booleans.csv
@@ -224,10 +224,6 @@ selinuxuser_share_music,use_var
selinuxuser_tcp_server,use_var
selinuxuser_udp_server,use_var
selinuxuser_use_ssh_chroot,use_var
-sftpd_anon_write,use_var
-sftpd_enable_homedirs,use_var
-sftpd_full_access,use_var
-sftpd_write_ssh_home,use_var
sge_domain_can_network_connect,use_var
sge_use_nfs,use_var
smartmon_3ware,use_var