|
 |
ff1465 |
commit 8fe724cfa0f4cea726ddd7adb44cfbba0931b865
|
|
|
ff1465 |
Author: Watson Sato <wsato@redhat.com>
|
|
|
ff1465 |
Date: Mon Feb 28 10:38:13 2022 +0100
|
|
|
ff1465 |
|
|
|
ff1465 |
Manual edited patch scap-security-guide-0.1.61-update_RHEL_08_040320-PR_8170.patch.
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
|
|
ff1465 |
index 5b3afb3..67d6836 100644
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml
|
|
|
ff1465 |
@@ -14,12 +14,3 @@
|
|
|
ff1465 |
- xorg-x11-server-Xwayland
|
|
|
ff1465 |
{{% endif %}}
|
|
|
ff1465 |
state: absent
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-- name: Switch to multi-user runlevel
|
|
|
ff1465 |
- file:
|
|
|
ff1465 |
- src: /usr/lib/systemd/system/multi-user.target
|
|
|
ff1465 |
- dest: /etc/systemd/system/default.target
|
|
|
ff1465 |
- state: link
|
|
|
ff1465 |
- force: yes
|
|
|
ff1465 |
-
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
|
|
ff1465 |
index dbabe57..496dc74 100644
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh
|
|
|
ff1465 |
@@ -12,6 +12,3 @@
|
|
|
ff1465 |
{{% if product not in ["rhel7", "ol7"] %}}
|
|
|
ff1465 |
{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
|
|
ff1465 |
{{% endif %}}
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-# configure run level
|
|
|
ff1465 |
-systemctl set-default multi-user.target
|
|
|
ff1465 |
\ No newline at end of file
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
|
|
ff1465 |
index 0710efe..0868ec6 100644
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml
|
|
|
ff1465 |
@@ -2,10 +2,6 @@
|
|
|
ff1465 |
<definition class="compliance" id="xwindows_remove_packages" version="1">
|
|
|
ff1465 |
{{{ oval_metadata("Ensure that the default runlevel target is set to multi-user.target.") }}}
|
|
|
ff1465 |
<criteria>
|
|
|
ff1465 |
- {{%- if init_system == "systemd" and target_oval_version != [5, 10] %}}
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- definition_ref="xwindows_runlevel_target" />
|
|
|
ff1465 |
- {{%- endif %}}
|
|
|
ff1465 |
|
|
|
ff1465 |
test_ref="package_xorg-x11-server-Xorg_removed" />
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
|
|
ff1465 |
index 935766d..00ef7d8 100644
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml
|
|
|
ff1465 |
@@ -66,5 +66,7 @@ warnings:
|
|
|
ff1465 |
The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
|
|
|
ff1465 |
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
|
|
|
ff1465 |
which might bring your system to an inconsistent state requiring additional configuration to access the system
|
|
|
ff1465 |
- again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
|
|
|
ff1465 |
+ again.
|
|
|
ff1465 |
+ The rule <tt>xwindows_runlevel_target</tt> can be used to configure the system to boot into the multi-user.target.
|
|
|
ff1465 |
+ If a GUI is an operational requirement, a tailored profile that removes this rule should used before
|
|
|
ff1465 |
continuing installation.
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index 9bf62a4..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-systemctl set-default multi-user.target
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index 4eeb697..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh
|
|
|
ff1465 |
new file mode 100644
|
|
|
ff1465 |
index 0000000..b3908cf
|
|
|
ff1465 |
--- /dev/null
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh
|
|
|
ff1465 |
@@ -0,0 +1,8 @@
|
|
|
ff1465 |
+#!/bin/bash
|
|
|
ff1465 |
+
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-Xorg") }}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-utils") }}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-common") }}}
|
|
|
ff1465 |
+{{% if product not in ["rhel7", "ol7"] %}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-Xwayland") }}}
|
|
|
ff1465 |
+{{% endif %}}
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh
|
|
|
ff1465 |
new file mode 100644
|
|
|
ff1465 |
index 0000000..abafdbd
|
|
|
ff1465 |
--- /dev/null
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh
|
|
|
ff1465 |
@@ -0,0 +1,16 @@
|
|
|
ff1465 |
+#!/bin/bash
|
|
|
ff1465 |
+# based on shared/templates/package_removed/tests/package-installed-removed.pass.sh
|
|
|
ff1465 |
+
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-Xorg") }}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-utils") }}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-common") }}}
|
|
|
ff1465 |
+{{% if product not in ["rhel7", "ol7"] %}}
|
|
|
ff1465 |
+{{{ bash_package_install("xorg-x11-server-Xwayland") }}}
|
|
|
ff1465 |
+{{% endif %}}
|
|
|
ff1465 |
+
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-Xorg") }}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-utils") }}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-common") }}}
|
|
|
ff1465 |
+{{% if product not in ["rhel7", "ol7"] %}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
|
|
ff1465 |
+{{% endif %}}
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh
|
|
|
ff1465 |
new file mode 100644
|
|
|
ff1465 |
index 0000000..a403e10
|
|
|
ff1465 |
--- /dev/null
|
|
|
ff1465 |
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh
|
|
|
ff1465 |
@@ -0,0 +1,8 @@
|
|
|
ff1465 |
+#!/bin/bash
|
|
|
ff1465 |
+
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-Xorg") }}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-utils") }}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-common") }}}
|
|
|
ff1465 |
+{{% if product not in ["rhel7", "ol7"] %}}
|
|
|
ff1465 |
+{{{ bash_package_remove("xorg-x11-server-Xwayland") }}}
|
|
|
ff1465 |
+{{% endif %}}
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index ff7d0ef..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,4 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-# platform = Red Hat Enterprise Linux 7
|
|
|
ff1465 |
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils
|
|
|
ff1465 |
-
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index d8ecd8c..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-# platform = Red Hat Enterprise Linux 7
|
|
|
ff1465 |
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-systemctl set-default graphical.target
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index 14f1a97..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,4 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-# platform = Red Hat Enterprise Linux 8
|
|
|
ff1465 |
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index c678ef7..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-# platform = Red Hat Enterprise Linux 8
|
|
|
ff1465 |
-# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-systemctl set-default graphical.target
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index bf8a615..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-systemctl set-default graphical.target
|
|
|
ff1465 |
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh
|
|
|
ff1465 |
deleted file mode 100644
|
|
|
ff1465 |
index 652088b..0000000
|
|
|
ff1465 |
--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh
|
|
|
ff1465 |
+++ /dev/null
|
|
|
ff1465 |
@@ -1,5 +0,0 @@
|
|
|
ff1465 |
-#!/bin/bash
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
|
|
|
ff1465 |
-
|
|
|
ff1465 |
-ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target
|