From ca2288e312d232d058d6985d541353719a1800e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 08:47:50 +0100 Subject: [PATCH 1/6] Rename SELinux Boolean docker_connect_any The SELinux Boolean docker_connect_any has been renamed to container_connect_any in both RHEL7 and RHEL8. --- .../sebool_container_connect_any/rule.yml | 16 ++++++++++++++++ .../sebool_docker_connect_any/rule.yml | 16 ---------------- ...ect_any.var => var_container_connect_any.var} | 2 +- rhel7/templates/csv/selinux_booleans.csv | 2 +- rhv4/templates/csv/selinux_booleans.csv | 2 +- 5 files changed, 19 insertions(+), 19 deletions(-) create mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml rename linux_os/guide/system/selinux/selinux-booleans/{var_docker_connect_any.var => var_container_connect_any.var} (86%) diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml new file mode 100644 index 0000000000..cb715fa66e --- /dev/null +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml @@ -0,0 +1,16 @@ +documentation_complete: true + +prodtype: rhel7,rhel8 + +title: 'Disable the container_connect_any SELinux Boolean' + +description: |- + By default, the SELinux boolean container_connect_any is disabled. + If this setting is enabled, it should be disabled. + {{{ describe_sebool_disable(sebool="container_connect_any") }}} + +rationale: "" + +severity: medium + +{{{ complete_ocil_entry_sebool_disabled(sebool="container_connect_any") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml deleted file mode 100644 index 7c2a65d076..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_connect_any/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the docker_connect_any SELinux Boolean' - -description: |- - By default, the SELinux boolean docker_connect_any is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="docker_connect_any") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="docker_connect_any") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var b/linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var similarity index 86% rename from linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var rename to linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var index 24af7183da..baad46a636 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/var_docker_connect_any.var +++ b/linux_os/guide/system/selinux/selinux-booleans/var_container_connect_any.var @@ -1,6 +1,6 @@ documentation_complete: true -title: 'docker_connect_any SELinux Boolean' +title: 'container_connect_any SELinux Boolean' description: |- default - Default SELinux boolean setting. diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index af220ed80a..fb0fc958c5 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -38,7 +38,7 @@ deny_execmem,use_var deny_ptrace,use_var dhcpc_exec_iptables,use_var dhcpd_use_ldap,use_var -docker_connect_any,use_var +container_connect_any,use_var docker_transition_unconfined,use_var domain_fd_use,use_var domain_kernel_load_modules,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index af220ed80a..fb0fc958c5 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -38,7 +38,7 @@ deny_execmem,use_var deny_ptrace,use_var dhcpc_exec_iptables,use_var dhcpd_use_ldap,use_var -docker_connect_any,use_var +container_connect_any,use_var docker_transition_unconfined,use_var domain_fd_use,use_var domain_kernel_load_modules,use_var From 8707ae7560c1a786b702281592968df28a743a01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 08:57:23 +0100 Subject: [PATCH 2/6] Remove SELinux boolean docker_transition_unconfined The SELinux boolean docker_transition_unconfined has been completely removed from SELinux without any replacement. --- .../rule.yml | 16 ---------------- .../var_docker_transition_unconfined.var | 19 ------------------- rhel7/templates/csv/selinux_booleans.csv | 1 - rhv4/templates/csv/selinux_booleans.csv | 1 - 4 files changed, 37 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml deleted file mode 100644 index 16792a395b..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_docker_transition_unconfined/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Enable the docker_transition_unconfined SELinux Boolean' - -description: |- - By default, the SELinux boolean docker_transition_unconfined is enabled. - If this setting is disabled, it should be enabled. - {{{ describe_sebool_enable(sebool="docker_transition_unconfined") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_enabled(sebool="docker_transition_unconfined") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var b/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var deleted file mode 100644 index cf66e5e915..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_docker_transition_unconfined.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'docker_transition_unconfined SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: true - off: false - on: true diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index fb0fc958c5..8a5d34cffa 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -39,7 +39,6 @@ deny_ptrace,use_var dhcpc_exec_iptables,use_var dhcpd_use_ldap,use_var container_connect_any,use_var -docker_transition_unconfined,use_var domain_fd_use,use_var domain_kernel_load_modules,use_var entropyd_use_audio,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index fb0fc958c5..8a5d34cffa 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -39,7 +39,6 @@ deny_ptrace,use_var dhcpc_exec_iptables,use_var dhcpd_use_ldap,use_var container_connect_any,use_var -docker_transition_unconfined,use_var domain_fd_use,use_var domain_kernel_load_modules,use_var entropyd_use_audio,use_var From a794b4a365001fbe6b5aed4bf9b8169a6a9dea53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 09:02:59 +0100 Subject: [PATCH 3/6] Remove SELinux boolean ftp_home_dir The SELinux boolean ftp_home_dir has been completely removed from SELinux without any replacement. --- .../sebool_ftp_home_dir/rule.yml | 16 ---------------- .../selinux-booleans/var_ftp_home_dir.var | 19 ------------------- rhel7/templates/csv/selinux_booleans.csv | 1 - rhv4/templates/csv/selinux_booleans.csv | 1 - 4 files changed, 37 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml deleted file mode 100644 index 1836bc059e..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftp_home_dir/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the ftp_home_dir SELinux Boolean' - -description: |- - By default, the SELinux boolean ftp_home_dir is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="ftp_home_dir") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="ftp_home_dir") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var b/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var deleted file mode 100644 index 5da7175f65..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_ftp_home_dir.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'ftp_home_dir SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index 8a5d34cffa..17a1f51403 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -57,7 +57,6 @@ ftpd_use_cifs,use_var ftpd_use_fusefs,use_var ftpd_use_nfs,use_var ftpd_use_passive_mode,use_var -ftp_home_dir,use_var git_cgi_enable_homedirs,use_var git_cgi_use_cifs,use_var git_cgi_use_nfs,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index 8a5d34cffa..17a1f51403 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -57,7 +57,6 @@ ftpd_use_cifs,use_var ftpd_use_fusefs,use_var ftpd_use_nfs,use_var ftpd_use_passive_mode,use_var -ftp_home_dir,use_var git_cgi_enable_homedirs,use_var git_cgi_use_cifs,use_var git_cgi_use_nfs,use_var From f71a5f81abad89505ac4e4404249cebc5cf39c89 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 09:19:03 +0100 Subject: [PATCH 4/6] Remove SELinux boolean virt_sandbox_use_nfs The SELinux boolean virt_sandbox_use_nfs has been removed and is superseded by virt_use_nfs which we already have in other rule. --- .../sebool_virt_sandbox_use_nfs/rule.yml | 16 ---------------- .../var_virt_sandbox_use_nfs.var | 19 ------------------- rhel7/templates/csv/selinux_booleans.csv | 1 - rhv4/templates/csv/selinux_booleans.csv | 1 - 4 files changed, 37 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml deleted file mode 100644 index 7d553a85de..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_nfs/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the virt_sandbox_use_nfs SELinux Boolean' - -description: |- - By default, the SELinux boolean virt_sandbox_use_nfs is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="virt_sandbox_use_nfs") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="virt_sandbox_use_nfs") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var b/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var deleted file mode 100644 index f7a0cd0679..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_nfs.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'virt_sandbox_use_nfs SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index 17a1f51403..aaf2e1a34f 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var virt_sandbox_use_audit,use_var virt_sandbox_use_mknod,use_var virt_sandbox_use_netlink,use_var -virt_sandbox_use_nfs,use_var virt_sandbox_use_samba,use_var virt_sandbox_use_sys_admin,use_var virt_transition_userdomain,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index 17a1f51403..aaf2e1a34f 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var virt_sandbox_use_audit,use_var virt_sandbox_use_mknod,use_var virt_sandbox_use_netlink,use_var -virt_sandbox_use_nfs,use_var virt_sandbox_use_samba,use_var virt_sandbox_use_sys_admin,use_var virt_transition_userdomain,use_var From 7afaf886cd99437a09b6aedd9e375ee1162155c6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 09:27:35 +0100 Subject: [PATCH 5/6] Remove SELinux boolean virt_sandbox_use_samba The SELinux boolean virt_sandbox_use_samba has been removed and is superseded by virt_use_samba which we already have in other rule. --- .../sebool_virt_sandbox_use_samba/rule.yml | 16 ---------------- .../var_virt_sandbox_use_samba.var | 19 ------------------- rhel7/templates/csv/selinux_booleans.csv | 1 - rhv4/templates/csv/selinux_booleans.csv | 1 - 4 files changed, 37 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml deleted file mode 100644 index b3ce5feb9e..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_samba/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the virt_sandbox_use_samba SELinux Boolean' - -description: |- - By default, the SELinux boolean virt_sandbox_use_samba is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="virt_sandbox_use_samba") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="virt_sandbox_use_samba") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var b/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var deleted file mode 100644 index de370465dd..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_virt_sandbox_use_samba.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'virt_sandbox_use_samba SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index aaf2e1a34f..19a27493db 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var virt_sandbox_use_audit,use_var virt_sandbox_use_mknod,use_var virt_sandbox_use_netlink,use_var -virt_sandbox_use_samba,use_var virt_sandbox_use_sys_admin,use_var virt_transition_userdomain,use_var virt_use_comm,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index aaf2e1a34f..19a27493db 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -268,7 +268,6 @@ virt_sandbox_use_all_caps,use_var virt_sandbox_use_audit,use_var virt_sandbox_use_mknod,use_var virt_sandbox_use_netlink,use_var -virt_sandbox_use_samba,use_var virt_sandbox_use_sys_admin,use_var virt_transition_userdomain,use_var virt_use_comm,use_var From e0287da5af28c3357fa920a16d538ab424bd5392 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 12 Mar 2019 10:13:10 +0100 Subject: [PATCH 6/6] Remove sftpd_.* SELinux booleans SELinux booleans sftpd_anon_write, sftpd_enable_homedirs, sftpd_full_access, sftpd_write_ssh_home have been removed from SELinux because they were useless because openssh doesn't use sftpd_t type anymore and it uses user's type for sftpd sessions. They haven't been superseded by anything else. --- .../sebool_sftpd_anon_write/rule.yml | 16 ---------------- .../sebool_sftpd_enable_homedirs/rule.yml | 16 ---------------- .../sebool_sftpd_full_access/rule.yml | 16 ---------------- .../sebool_sftpd_write_ssh_home/rule.yml | 16 ---------------- .../selinux-booleans/var_sftpd_anon_write.var | 19 ------------------- .../var_sftpd_enable_homedirs.var | 19 ------------------- .../var_sftpd_full_access.var | 19 ------------------- .../var_sftpd_write_ssh_home.var | 19 ------------------- rhel7/templates/csv/selinux_booleans.csv | 4 ---- rhv4/templates/csv/selinux_booleans.csv | 4 ---- 10 files changed, 148 deletions(-) delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var delete mode 100644 linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml deleted file mode 100644 index a5327110f8..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_anon_write/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the sftpd_anon_write SELinux Boolean' - -description: |- - By default, the SELinux boolean sftpd_anon_write is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="sftpd_anon_write") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_anon_write") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml deleted file mode 100644 index ac52da2773..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_enable_homedirs/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the sftpd_enable_homedirs SELinux Boolean' - -description: |- - By default, the SELinux boolean sftpd_enable_homedirs is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="sftpd_enable_homedirs") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_enable_homedirs") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml deleted file mode 100644 index fff440ff7e..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_full_access/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the sftpd_full_access SELinux Boolean' - -description: |- - By default, the SELinux boolean sftpd_full_access is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="sftpd_full_access") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_full_access") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml deleted file mode 100644 index 7b67579eb5..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sftpd_write_ssh_home/rule.yml +++ /dev/null @@ -1,16 +0,0 @@ -documentation_complete: true - -prodtype: rhel7,rhel8 - -title: 'Disable the sftpd_write_ssh_home SELinux Boolean' - -description: |- - By default, the SELinux boolean sftpd_write_ssh_home is disabled. - If this setting is enabled, it should be disabled. - {{{ describe_sebool_disable(sebool="sftpd_write_ssh_home") }}} - -rationale: "" - -severity: medium - -{{{ complete_ocil_entry_sebool_disabled(sebool="sftpd_write_ssh_home") }}} diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var deleted file mode 100644 index ec43879c93..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_anon_write.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'sftpd_anon_write SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var deleted file mode 100644 index 1ebd92f562..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_enable_homedirs.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'sftpd_enable_homedirs SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var deleted file mode 100644 index a6d1fc9efc..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_full_access.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'sftpd_full_access SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var b/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var deleted file mode 100644 index 67a3f00655..0000000000 --- a/linux_os/guide/system/selinux/selinux-booleans/var_sftpd_write_ssh_home.var +++ /dev/null @@ -1,19 +0,0 @@ -documentation_complete: true - -title: 'sftpd_write_ssh_home SELinux Boolean' - -description: |- - default - Default SELinux boolean setting. -
on - SELinux boolean is enabled. -
off - SELinux boolean is disabled. - -type: boolean - -operator: equals - -interactive: false - -options: - default: false - off: false - on: true diff --git a/rhel7/templates/csv/selinux_booleans.csv b/rhel7/templates/csv/selinux_booleans.csv index 19a27493db..1b55f6db31 100644 --- a/rhel7/templates/csv/selinux_booleans.csv +++ b/rhel7/templates/csv/selinux_booleans.csv @@ -224,10 +224,6 @@ selinuxuser_share_music,use_var selinuxuser_tcp_server,use_var selinuxuser_udp_server,use_var selinuxuser_use_ssh_chroot,use_var -sftpd_anon_write,use_var -sftpd_enable_homedirs,use_var -sftpd_full_access,use_var -sftpd_write_ssh_home,use_var sge_domain_can_network_connect,use_var sge_use_nfs,use_var smartmon_3ware,use_var diff --git a/rhv4/templates/csv/selinux_booleans.csv b/rhv4/templates/csv/selinux_booleans.csv index 19a27493db..1b55f6db31 100644 --- a/rhv4/templates/csv/selinux_booleans.csv +++ b/rhv4/templates/csv/selinux_booleans.csv @@ -224,10 +224,6 @@ selinuxuser_share_music,use_var selinuxuser_tcp_server,use_var selinuxuser_udp_server,use_var selinuxuser_use_ssh_chroot,use_var -sftpd_anon_write,use_var -sftpd_enable_homedirs,use_var -sftpd_full_access,use_var -sftpd_write_ssh_home,use_var sge_domain_can_network_connect,use_var sge_use_nfs,use_var smartmon_3ware,use_var