From bb5c2983be3b11c3cd1070cf1d3daca27cb700ee Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 19 Aug 2021 08:02:55 -0500 Subject: [PATCH] Add a new rules RHEL-08-010001 and RHEL-07-020019 --- .../agent_mfetpd_running/oval/shared.xml | 16 ++++++ .../agent_mfetpd_running/rule.yml | 39 ++++++++++++++ .../group.yml | 7 +++ .../package_mcafeetp_installed/rule.yml | 51 +++++++++++++++++++ products/rhel7/profiles/stig.profile | 2 + products/rhel8/profiles/stig.profile | 4 ++ shared/references/cce-redhat-avail.txt | 4 -- .../data/profile_stability/rhel8/stig.profile | 2 + .../profile_stability/rhel8/stig_gui.profile | 2 + 9 files changed, 123 insertions(+), 4 deletions(-) create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml create mode 100644 linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml new file mode 100644 index 00000000000..9900d8bd724 --- /dev/null +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/oval/shared.xml @@ -0,0 +1,16 @@ + + + {{{ oval_metadata("Ensure that McAfee Endpoint Security for Linux (ENSL) is running.") }}} + + + + + + + + + + ^mfetpd.*$ + 0 + + diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml new file mode 100644 index 00000000000..32c934467da --- /dev/null +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml @@ -0,0 +1,39 @@ +documentation_complete: true + +prodtype: rhel7,rhel8 + +title: 'Ensure McAfee Endpoint Security for Linux (ENSL) is running' + +description: |- + Install McAfee Endpoint Security for Linux antivirus software + which is provided for DoD systems and uses signatures to search for the + presence of viruses on the filesystem. + +rationale: |- + Virus scanning software can be used to detect if a system has been compromised by + computer viruses, as well as to limit their spread to other systems. + +severity: high + +identifiers: + cce@rhel7: CCE-86262-3 + cce@rhel8: CCE-86261-5 + +references: + disa: CCI-001233 + nist: SI-2(2) + srg: SRG-OS-000191-GPOS-00080 + stigid@rhel7: RHEL-07-020019 + stigid@rhel8: RHEL-08-010001 + +ocil_clause: 'virus scanning software is not running' + +ocil: |- + To verify that McAfee Endpoint Security for Linux is + running, run the following command: + 
$ sudo ps -ef | grep -i mfetpd
+ +warnings: + - general: |- + Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software, + automated remediation is not available for this configuration check. diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml new file mode 100644 index 00000000000..f2e4e89851a --- /dev/null +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/group.yml @@ -0,0 +1,7 @@ +documentation_complete: true + +title: 'McAfee Endpoint Security for Linux (ENSL)' + +description: |- + McAfee Endpoint Security for Linux (ENSL) is a suite of software applications + used to monitor, detect, and defend computer networks and systems. diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml new file mode 100644 index 00000000000..16587792eff --- /dev/null +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml @@ -0,0 +1,51 @@ +documentation_complete: true + +prodtype: rhel7,rhel8 + +title: 'Install McAfee Endpoint Security for Linux (ENSL)' + +description: |- + Install McAfee Endpoint Security for Linux antivirus software + which is provided for DoD systems and uses signatures to search for the + presence of viruses on the filesystem. + + {{{ describe_package_install(package="mcafeetp") }}} + +rationale: |- + Virus scanning software can be used to detect if a system has been compromised by + computer viruses, as well as to limit their spread to other systems. + +severity: high + +identifiers: + cce@rhel7: CCE-86257-3 + cce@rhel8: CCE-86260-7 + +references: + disa: CCI-001233 + nist: SI-2(2) + srg: SRG-OS-000191-GPOS-00080 + stigid@rhel7: RHEL-07-020019 + stigid@rhel8: RHEL-08-010001 + +ocil_clause: 'the package is not installed' + +ocil: '{{{ ocil_package(package="mcafeetp") }}}' + +warnings: + - general: |- + Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software, + automated remediation is not available for this configuration check. + +platform: machine + +template: + name: package_installed + vars: + pkgname: mcafeetp + backends: + bash: "off" + ansible: "off" + anaconda: "off" + puppet: "off" + blueprint: "off" diff --git a/products/rhel7/profiles/stig.profile b/products/rhel7/profiles/stig.profile index f5761c891f2..9ca13600057 100644 --- a/products/rhel7/profiles/stig.profile +++ b/products/rhel7/profiles/stig.profile @@ -316,3 +316,5 @@ selections: - file_permissions_var_log_audit - sysctl_net_ipv4_conf_all_rp_filter - sysctl_net_ipv4_conf_default_rp_filter + - package_mcafeetp_installed + - agent_mfetpd_running diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile index 9dc9360e899..36f384621ae 100644 --- a/products/rhel8/profiles/stig.profile +++ b/products/rhel8/profiles/stig.profile @@ -84,6 +84,10 @@ selections: # RHEL-08-010000 - installed_OS_is_vendor_supported + # RHEL-08-010001 + - package_mcafeetp_installed + - agent_mfetpd_running + # RHEL-08-010010 - security_patches_up_to_date diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 3b24e19da06..08013e6de22 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -372,12 +372,8 @@ CCE-86253-2 CCE-86254-0 CCE-86255-7 CCE-86256-5 -CCE-86257-3 CCE-86258-1 CCE-86259-9 -CCE-86260-7 -CCE-86261-5 -CCE-86262-3 CCE-86263-1 CCE-86264-9 CCE-86265-6 diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile index e9ba0f0adbf..f3e6c4fa1a1 100644 --- a/tests/data/profile_stability/rhel8/stig.profile +++ b/tests/data/profile_stability/rhel8/stig.profile @@ -65,6 +65,7 @@ selections: - accounts_user_interactive_home_directory_defined - accounts_user_interactive_home_directory_exists - aide_check_audit_tools +- agent_mfetpd_running - aide_scan_notification - aide_verify_acls - aide_verify_ext_attributes @@ -280,6 +281,7 @@ selections: - package_gssproxy_removed - package_iprutils_removed - package_krb5-workstation_removed +- package_mcafeetp_installed - package_opensc_installed - package_openssh-server_installed - package_policycoreutils_installed diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile index c8540f9392e..b5b60349a83 100644 --- a/tests/data/profile_stability/rhel8/stig_gui.profile +++ b/tests/data/profile_stability/rhel8/stig_gui.profile @@ -76,6 +76,7 @@ selections: - accounts_user_interactive_home_directory_defined - accounts_user_interactive_home_directory_exists - aide_check_audit_tools +- agent_mfetpd_running - aide_scan_notification - aide_verify_acls - aide_verify_ext_attributes @@ -291,6 +292,7 @@ selections: - package_gssproxy_removed - package_iprutils_removed - package_krb5-workstation_removed +- package_mcafeetp_installed - package_opensc_installed - package_openssh-server_installed - package_policycoreutils_installed