|
 |
b5e178 |
From eea787e1453b19aa949903c39189479538fbbab9 Mon Sep 17 00:00:00 2001
|
|
|
b5e178 |
From: Vojtech Polasek <vpolasek@redhat.com>
|
|
|
b5e178 |
Date: Fri, 12 Feb 2021 10:36:10 +0100
|
|
|
b5e178 |
Subject: [PATCH] remove mrules disabling vfat file systems from cis profiles
|
|
|
b5e178 |
|
|
|
b5e178 |
---
|
|
|
b5e178 |
rhcos4/profiles/moderate.profile | 1 -
|
|
|
b5e178 |
rhel7/profiles/cis.profile | 3 +--
|
|
|
b5e178 |
rhel8/profiles/cis.profile | 4 ++--
|
|
|
b5e178 |
sle15/profiles/cis.profile | 1 -
|
|
|
b5e178 |
4 files changed, 3 insertions(+), 6 deletions(-)
|
|
|
b5e178 |
|
|
|
b5e178 |
diff --git a/rhcos4/profiles/moderate.profile b/rhcos4/profiles/moderate.profile
|
|
|
b5e178 |
index 4e715cae9a..966e092c97 100644
|
|
|
b5e178 |
--- a/rhcos4/profiles/moderate.profile
|
|
|
b5e178 |
+++ b/rhcos4/profiles/moderate.profile
|
|
|
b5e178 |
@@ -627,4 +627,3 @@ selections:
|
|
|
b5e178 |
- kernel_module_squashfs_disabled
|
|
|
b5e178 |
- kernel_module_udf_disabled
|
|
|
b5e178 |
- kernel_module_usb-storage_disabled
|
|
|
b5e178 |
- - kernel_module_vfat_disabled
|
|
|
b5e178 |
diff --git a/rhel7/profiles/cis.profile b/rhel7/profiles/cis.profile
|
|
|
b5e178 |
index 22d5117546..093d2b5759 100644
|
|
|
b5e178 |
--- a/rhel7/profiles/cis.profile
|
|
|
b5e178 |
+++ b/rhel7/profiles/cis.profile
|
|
|
b5e178 |
@@ -46,8 +46,7 @@ selections:
|
|
|
b5e178 |
#### 1.1.1.7 Ensure mounting of udf filesystems is disabled (Scored)
|
|
|
b5e178 |
- kernel_module_udf_disabled
|
|
|
b5e178 |
|
|
|
b5e178 |
- #### 1.1.1.8 Ensure mounting of FAT filesystems is disabled (Scored)
|
|
|
b5e178 |
- - kernel_module_vfat_disabled
|
|
|
b5e178 |
+ #### 1.1.1.8 Ensure mounting of FAT filesystems is disabled (Manual)
|
|
|
b5e178 |
|
|
|
b5e178 |
### 1.1.2 Ensure separate partition exists for /tmp (Scored)
|
|
|
b5e178 |
- partition_for_tmp
|
|
|
b5e178 |
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
|
|
|
b5e178 |
index 9ceeb74f9a..e96d2fbb9d 100644
|
|
|
b5e178 |
--- a/rhel8/profiles/cis.profile
|
|
|
b5e178 |
+++ b/rhel8/profiles/cis.profile
|
|
|
b5e178 |
@@ -31,8 +31,8 @@ selections:
|
|
|
b5e178 |
#### 1.1.1.1 Ensure mounting cramfs filesystems is disabled (Scored)
|
|
|
b5e178 |
- kernel_module_cramfs_disabled
|
|
|
b5e178 |
|
|
|
b5e178 |
- #### 1.1.1.2 Ensure mounting of vFAT flesystems is limited (Not Scored)
|
|
|
b5e178 |
- - kernel_module_vfat_disabled
|
|
|
b5e178 |
+ #### 1.1.1.2 Ensure mounting of vFAT filesystems is limited (Not Scored)
|
|
|
b5e178 |
+
|
|
|
b5e178 |
|
|
|
b5e178 |
#### 1.1.1.3 Ensure mounting of squashfs filesystems is disabled (Scored)
|
|
|
b5e178 |
- kernel_module_squashfs_disabled
|
|
|
b5e178 |
diff --git a/sle15/profiles/cis.profile b/sle15/profiles/cis.profile
|
|
|
b5e178 |
index 9a0efedbdd..fa9ff3b775 100644
|
|
|
b5e178 |
--- a/sle15/profiles/cis.profile
|
|
|
b5e178 |
+++ b/sle15/profiles/cis.profile
|
|
|
b5e178 |
@@ -25,7 +25,6 @@ selections:
|
|
|
b5e178 |
- kernel_module_udf_disabled
|
|
|
b5e178 |
|
|
|
b5e178 |
#### 1.1.1.4 Ensure mounting of vFAT flesystems is limited (Not Scored)
|
|
|
b5e178 |
- - kernel_module_vfat_disabled
|
|
|
b5e178 |
|
|
|
b5e178 |
### 1.1.2 Ensure /tmp is configured (Scored)
|
|
|
b5e178 |
- partition_for_tmp
|