diff --git a/SOURCES/centos-debranding.patch b/SOURCES/centos-debranding.patch new file mode 100644 index 0000000..eacd278 --- /dev/null +++ b/SOURCES/centos-debranding.patch @@ -0,0 +1,216 @@ +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/C2S.profile scap-security-guide-0.1.46/rhel7/profiles/C2S.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/C2S.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/C2S.profile 2020-04-02 00:13:14.710523405 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'C2S for Red Hat Enterprise Linux 7' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile demonstrates compliance against the + U.S. Government Commercial Cloud Services (C2S) baseline. + +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/cjis.profile scap-security-guide-0.1.46/rhel7/profiles/cjis.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/cjis.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/cjis.profile 2020-04-02 00:14:09.815642451 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'Criminal Justice Information Services (CJIS) Security Policy' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile is derived from FBI's CJIS v5.4 + Security Policy. A copy of this policy can be found at the CJIS Security + Policy Resource Center: +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/cui.profile scap-security-guide-0.1.46/rhel7/profiles/cui.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/cui.profile 2019-08-28 12:35:00.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/cui.profile 2020-04-02 00:14:39.735707092 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + From NIST 800-171, Section 2.2: + Security requirements for protecting the confidentiality of CUI in non-federal + information systems and organizations have a well-defined structure that +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/e8.profile scap-security-guide-0.1.46/rhel7/profiles/e8.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/e8.profile 2020-04-02 00:07:38.530797155 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/e8.profile 2020-04-02 00:15:34.521825440 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'Australian Cyber Security Centre (ACSC) Essential Eight' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configuration checks for Red Hat Enterprise Linux 7 + that align to the Australian Cyber Security Centre (ACSC) Essential Eight. + +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/hipaa.profile scap-security-guide-0.1.46/rhel7/profiles/hipaa.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/hipaa.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/hipaa.profile 2020-04-02 00:16:12.605907713 +0000 +@@ -3,6 +3,8 @@ documentation_complete: True + title: 'Health Insurance Portability and Accountability Act (HIPAA)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + The HIPAA Security Rule establishes U.S. national standards to protect individuals’ + electronic personal health information that is created, received, used, or + maintained by a covered entity. The Security Rule requires appropriate +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/ncp.profile scap-security-guide-0.1.46/rhel7/profiles/ncp.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/ncp.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/ncp.profile 2020-04-02 00:19:00.198269763 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'NIST National Checklist Program Security Guide' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This compliance profile reflects the core set of security + related configuration settings for deployment of Red Hat Enterprise + Linux 7.x into U.S. Defense, Intelligence, and Civilian agencies. +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/ospp.profile scap-security-guide-0.1.46/rhel7/profiles/ospp.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/ospp.profile 2020-04-02 00:07:38.523797140 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/ospp.profile 2020-04-02 00:18:53.448255187 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'OSPP - Protection Profile for General Purpose Operating Systems v4.2.1' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile reflects mandatory configuration controls identified in the + NIAP Configuration Annex to the Protection Profile for General Purpose + Operating Systems (Protection Profile Version 4.2.1). +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/pci-dss.profile scap-security-guide-0.1.46/rhel7/profiles/pci-dss.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/pci-dss.profile 2019-08-28 12:35:00.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/pci-dss.profile 2020-04-02 00:19:22.109317098 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + Ensures PCI-DSS v3.2.1 security configuration settings are applied. + + selections: +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/rhelh-stig.profile scap-security-guide-0.1.46/rhel7/profiles/rhelh-stig.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/rhelh-stig.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/rhelh-stig.profile 2020-04-02 00:20:04.168407959 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: '[DRAFT] DISA STIG for Red Hat Enterprise Linux Virtualization Host (RHELH)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This *draft* profile contains configuration checks that align to the + DISA STIG for Red Hat Enterprise Linux Virtualization Host (RHELH). + +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/rhelh-vpp.profile scap-security-guide-0.1.46/rhel7/profiles/rhelh-vpp.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/rhelh-vpp.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/rhelh-vpp.profile 2020-04-02 00:18:01.448142852 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Enterprise Linux Hypervisor (RHELH)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This compliance profile reflects the core set of security + related configuration settings for deployment of Red Hat Enterprise + Linux Hypervisor (RHELH) 7.x into U.S. Defense, Intelligence, and Civilian agencies. +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/rht-ccp.profile scap-security-guide-0.1.46/rhel7/profiles/rht-ccp.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/rht-ccp.profile 2019-08-28 13:46:33.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/rht-ccp.profile 2020-04-02 00:20:25.205453406 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains the minimum security relevant + configuration settings recommended by Red Hat, Inc for + Red Hat Enterprise Linux 7 instances deployed by Red Hat Certified +diff -uNrp scap-security-guide-0.1.46.orig/rhel7/profiles/standard.profile scap-security-guide-0.1.46/rhel7/profiles/standard.profile +--- scap-security-guide-0.1.46.orig/rhel7/profiles/standard.profile 2019-08-28 12:35:00.000000000 +0000 ++++ scap-security-guide-0.1.46/rhel7/profiles/standard.profile 2020-04-02 00:21:05.637540751 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'Standard System Security Profile for Red Hat Enterprise Linux 7' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains rules to ensure standard security baseline + of a Red Hat Enterprise Linux 7 system. Regardless of your system's workload + all of these checks should pass. +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_enhanced.profile scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_enhanced.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_enhanced.profile 2021-04-27 16:26:32.968036292 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_enhanced.profile 2021-04-27 16:32:59.501871327 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'ANSSI-BP-028 (enhanced)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level. + + ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_high.profile scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_high.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_high.profile 2021-04-27 16:26:32.968036292 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_high.profile 2021-04-27 16:33:22.015919959 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'DRAFT - ANSSI-BP-028 (high)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configurations that align to ANSSI-BP-028 at the high hardening level. + + ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_intermediary.profile scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_intermediary.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_intermediary.profile 2021-04-27 16:26:32.968036292 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_intermediary.profile 2021-04-27 16:33:46.957973842 +0000 +@@ -4,6 +4,8 @@ documentation_complete: true + title: 'ANSSI-BP-028 (intermediary)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level. + + ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_minimal.profile scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_minimal.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/anssi_nt28_minimal.profile 2021-04-27 16:26:32.968036292 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/anssi_nt28_minimal.profile 2021-04-27 16:34:23.703053225 +0000 +@@ -3,6 +3,8 @@ documentation_complete: true + title: 'ANSSI-BP-028 (minimal)' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level. + + ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/cis.profile scap-security-guide-0.1.54/rhel7/profiles/cis.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/cis.profile 2021-02-03 10:54:10.000000000 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/cis.profile 2021-04-27 16:34:49.526109008 +0000 +@@ -12,6 +12,8 @@ reference: https://www.cisecurity.org/ci + title: 'CIS Red Hat Enterprise Linux 7 Benchmark' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile defines a baseline that aligns to the Center for Internet Security® + Red Hat Enterprise Linux 7 Benchmark™, v2.2.0, released 12-27-2017. + +diff -uNrp scap-security-guide-0.1.54.orig/rhel7/profiles/stig.profile scap-security-guide-0.1.54/rhel7/profiles/stig.profile +--- scap-security-guide-0.1.54.orig/rhel7/profiles/stig.profile 2021-04-27 16:26:32.906036158 +0000 ++++ scap-security-guide-0.1.54/rhel7/profiles/stig.profile 2021-04-27 16:38:56.557642673 +0000 +@@ -10,6 +10,8 @@ reference: https://public.cyber.mil/stig + title: 'DISA STIG for Red Hat Enterprise Linux 7' + + description: |- ++ **Not applicable to CentOS Linux, included for reference only** ++ + This profile contains configuration checks that align to the + DISA STIG for Red Hat Enterprise Linux V3R2. + diff --git a/SPECS/scap-security-guide.spec b/SPECS/scap-security-guide.spec index d3d8d1a..f46fac7 100644 --- a/SPECS/scap-security-guide.spec +++ b/SPECS/scap-security-guide.spec @@ -45,6 +45,8 @@ Patch21: scap-security-guide-0.1.55-update_nodev_nonroot_mount_option-PR_6606.pa Patch22: remove-ANSSI-high-ks.patch Patch23: scap-security-guide-0.1.55-fix_stigid_reference-PR_6628.patch +Patch999: centos-debranding.patch + BuildArch: noarch BuildRequires: libxslt, expat, python, openscap-scanner >= 1.2.16, python-jinja2, cmake >= 2.8, PyYAML @@ -97,6 +99,8 @@ been generated from XCCDF benchmarks present in %{name} package. %patch22 -p1 %patch23 -p1 +%patch999 -p1 + # Workaround to remove Python byte cache files from the upstream sources # See https://github.com/ComplianceAsCode/content/issues/4042 find . -name '*.pyc' -exec rm -f {} ';'