|
 |
f386a0 |
From f802557b2a84b830a8a8742b535a5602925e438d Mon Sep 17 00:00:00 2001
|
|
|
f386a0 |
From: Watson Yuuma Sato <wsato@redhat.com>
|
|
|
f386a0 |
Date: Mon, 8 Aug 2022 15:28:37 +0200
|
|
|
f386a0 |
Subject: [PATCH 09/10] Merge pull request #9298 from vojtapolasek/rhbz2114979
|
|
|
f386a0 |
|
|
|
f386a0 |
Patch-name: scap-security-guide-0.1.64-authselect_minimal_in_ospp-PR_9298.patch
|
|
|
f386a0 |
Patch-status: Make OSPP profiles use minimal Authselect profile
|
|
|
f386a0 |
---
|
|
|
f386a0 |
linux_os/guide/system/accounts/enable_authselect/rule.yml | 1 +
|
|
|
f386a0 |
products/rhel8/profiles/ospp.profile | 2 +-
|
|
|
f386a0 |
products/rhel9/profiles/ospp.profile | 2 +-
|
|
|
f386a0 |
tests/data/profile_stability/rhel8/ospp.profile | 2 +-
|
|
|
f386a0 |
4 files changed, 4 insertions(+), 3 deletions(-)
|
|
|
f386a0 |
|
|
|
f386a0 |
diff --git a/linux_os/guide/system/accounts/enable_authselect/rule.yml b/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
|
|
f386a0 |
index 8d1758e8c9..3edb3642df 100644
|
|
|
f386a0 |
--- a/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
|
|
f386a0 |
+++ b/linux_os/guide/system/accounts/enable_authselect/rule.yml
|
|
|
f386a0 |
@@ -34,6 +34,7 @@ references:
|
|
|
f386a0 |
disa: CCI-000213
|
|
|
f386a0 |
hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii) # taken from require_singleuser_auth
|
|
|
f386a0 |
nist: AC-3
|
|
|
f386a0 |
+ ospp: FIA_UAU.1,FIA_AFL.1
|
|
|
f386a0 |
srg: SRG-OS-000480-GPOS-00227
|
|
|
f386a0 |
|
|
|
f386a0 |
ocil: |-
|
|
|
f386a0 |
diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile
|
|
|
f386a0 |
index 39ad1797c7..ebec8a3a6f 100644
|
|
|
f386a0 |
--- a/products/rhel8/profiles/ospp.profile
|
|
|
f386a0 |
+++ b/products/rhel8/profiles/ospp.profile
|
|
|
f386a0 |
@@ -220,7 +220,7 @@ selections:
|
|
|
f386a0 |
- var_accounts_max_concurrent_login_sessions=10
|
|
|
f386a0 |
- accounts_max_concurrent_login_sessions
|
|
|
f386a0 |
- securetty_root_login_console_only
|
|
|
f386a0 |
- - var_authselect_profile=sssd
|
|
|
f386a0 |
+ - var_authselect_profile=minimal
|
|
|
f386a0 |
- enable_authselect
|
|
|
f386a0 |
- var_password_pam_unix_remember=5
|
|
|
f386a0 |
- accounts_password_pam_unix_remember
|
|
|
f386a0 |
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
|
|
|
f386a0 |
index f27f961a7a..b21ddcee6d 100644
|
|
|
f386a0 |
--- a/products/rhel9/profiles/ospp.profile
|
|
|
f386a0 |
+++ b/products/rhel9/profiles/ospp.profile
|
|
|
f386a0 |
@@ -115,7 +115,7 @@ selections:
|
|
|
f386a0 |
- coredump_disable_storage
|
|
|
f386a0 |
- coredump_disable_backtraces
|
|
|
f386a0 |
- service_systemd-coredump_disabled
|
|
|
f386a0 |
- - var_authselect_profile=sssd
|
|
|
f386a0 |
+ - var_authselect_profile=minimal
|
|
|
f386a0 |
- enable_authselect
|
|
|
f386a0 |
- use_pam_wheel_for_su
|
|
|
f386a0 |
|
|
|
f386a0 |
diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
f386a0 |
index 5d73a8c6fe..21e93e310d 100644
|
|
|
f386a0 |
--- a/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
f386a0 |
+++ b/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
f386a0 |
@@ -242,7 +242,7 @@ selections:
|
|
|
f386a0 |
- var_slub_debug_options=P
|
|
|
f386a0 |
- var_auditd_flush=incremental_async
|
|
|
f386a0 |
- var_accounts_max_concurrent_login_sessions=10
|
|
|
f386a0 |
-- var_authselect_profile=sssd
|
|
|
f386a0 |
+- var_authselect_profile=minimal
|
|
|
f386a0 |
- var_password_pam_unix_remember=5
|
|
|
f386a0 |
- var_selinux_state=enforcing
|
|
|
f386a0 |
- var_selinux_policy_name=targeted
|
|
|
f386a0 |
--
|
|
|
f386a0 |
2.37.1
|
|
|
f386a0 |
|