diff --git a/SOURCES/scap-security-guide-0.1.51-add-zipl-and-grub2-cpes_PR_5905.patch b/SOURCES/scap-security-guide-0.1.51-add-zipl-and-grub2-cpes_PR_5905.patch new file mode 100644 index 0000000..d7fab70 --- /dev/null +++ b/SOURCES/scap-security-guide-0.1.51-add-zipl-and-grub2-cpes_PR_5905.patch @@ -0,0 +1,737 @@ +From 3aae2f86f3d75b8bd931922152b9a6175ed18a6b Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 23 Jun 2020 22:27:47 +0200 +Subject: [PATCH 1/5] Add check for zipl installed + +Based and valid in RHEL, where zipl is part of s390utils-base. +--- + rhel8/cpe/rhel8-cpe-dictionary.xml | 4 ++ + .../oval/installed_env_has_zipl_package.xml | 37 +++++++++++++++++++ + ssg/constants.py | 1 + + 3 files changed, 42 insertions(+) + create mode 100644 shared/checks/oval/installed_env_has_zipl_package.xml + +diff --git a/rhel8/cpe/rhel8-cpe-dictionary.xml b/rhel8/cpe/rhel8-cpe-dictionary.xml +index 694cbb5a4e..cccb3c5791 100644 +--- a/rhel8/cpe/rhel8-cpe-dictionary.xml ++++ b/rhel8/cpe/rhel8-cpe-dictionary.xml +@@ -67,4 +67,8 @@ + + installed_env_has_yum_package + ++ ++ System uses zipl ++ installed_env_has_zipl_package ++ + +diff --git a/shared/checks/oval/installed_env_has_zipl_package.xml b/shared/checks/oval/installed_env_has_zipl_package.xml +new file mode 100644 +index 0000000000..ab6545669d +--- /dev/null ++++ b/shared/checks/oval/installed_env_has_zipl_package.xml +@@ -0,0 +1,37 @@ ++ ++ ++ ++ System uses zIPL ++ ++ multi_platform_all ++ ++ Checks if system uses zIPL bootloader. ++ ++ ++ ++ ++ ++ ++ ++{{% if pkg_system == "rpm" %}} ++ ++ ++ ++ ++ s390utils-base ++ ++{{% elif pkg_system == "dpkg" %}} ++ ++ ++ ++ ++ s390utils-base ++ ++{{% endif %}} ++ ++ +diff --git a/ssg/constants.py b/ssg/constants.py +index fb20fe8107..f03aa87f09 100644 +--- a/ssg/constants.py ++++ b/ssg/constants.py +@@ -506,6 +506,7 @@ + "sssd": "cpe:/a:sssd", + "systemd": "cpe:/a:systemd", + "yum": "cpe:/a:yum", ++ "zipl": "cpe:/a:zipl", + } + + # _version_name_map = { + +From c70bdc89bf193f2fdf59cb8c3f06672fc43a0505 Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 23 Jun 2020 22:33:07 +0200 +Subject: [PATCH 2/5] Set zipl and machine platforms for zipl content + +Add zipl platform to bootloader-zipl and machine platform to all zipl +rules. +Final applicability of zipl rules is equivalent to "machine and zipl" +CPE platform. +--- + linux_os/guide/system/bootloader-zipl/group.yml | 2 +- + .../guide/system/bootloader-zipl/zipl_audit_argument/rule.yml | 2 ++ + .../bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml | 2 ++ + .../guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml | 2 ++ + .../system/bootloader-zipl/zipl_page_poison_argument/rule.yml | 2 ++ + .../guide/system/bootloader-zipl/zipl_pti_argument/rule.yml | 2 ++ + .../system/bootloader-zipl/zipl_slub_debug_argument/rule.yml | 2 ++ + .../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml | 2 ++ + 8 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/linux_os/guide/system/bootloader-zipl/group.yml b/linux_os/guide/system/bootloader-zipl/group.yml +index 36da84530c..64c6c8dffb 100644 +--- a/linux_os/guide/system/bootloader-zipl/group.yml ++++ b/linux_os/guide/system/bootloader-zipl/group.yml +@@ -8,4 +8,4 @@ description: |- + options to it. + The default {{{ full_name }}} boot loader for s390x systems is called zIPL. + +-platform: machine ++platform: zipl +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml +index 16c0b3f89a..2d31ef8ee7 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml +@@ -38,3 +38,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml +index 47a532d50f..40db232257 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml +@@ -39,3 +39,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml +index 5aa91c16aa..8d28d5495f 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml +@@ -35,3 +35,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml +index 8546325752..0a8e9a41e2 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml +@@ -39,3 +39,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml +index eaef25ce40..20c1448cc8 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml +@@ -38,3 +38,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml +index 68e91a92d6..54ac688ea0 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml +@@ -39,3 +39,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml +index 9624b43349..c5979a2016 100644 +--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml ++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml +@@ -36,3 +36,5 @@ ocil: |- + and /etc/zipl.conf: + 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
+ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. ++ ++platform: machine + +From 02f961ecbe8bcafab72f544c2bc0f9141b9fa8fa Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 23 Jun 2020 23:02:44 +0200 +Subject: [PATCH 3/5] Add check for grub2 installed + +Apply new CPE grub2 to bootloader-grub2 group. +--- + .../file_groupowner_efi_grub2_cfg/rule.yml | 2 + + .../file_groupowner_grub2_cfg/rule.yml | 2 + + .../file_owner_efi_grub2_cfg/rule.yml | 2 + + .../file_owner_grub2_cfg/rule.yml | 2 + + .../guide/system/bootloader-grub2/group.yml | 2 +- + .../grub2_admin_username/rule.yml | 2 + + .../grub2_enable_iommu_force/rule.yml | 2 + + .../grub2_no_removeable_media/rule.yml | 2 + + .../bootloader-grub2/grub2_password/rule.yml | 2 + + .../grub2_uefi_admin_username/rule.yml | 2 + + .../grub2_uefi_password/rule.yml | 2 + + .../uefi_no_removeable_media/rule.yml | 2 + + .../oval/installed_env_has_grub2_package.xml | 37 +++++++++++++++++++ + ssg/constants.py | 1 + + 14 files changed, 61 insertions(+), 1 deletion(-) + create mode 100644 shared/checks/oval/installed_env_has_grub2_package.xml + +diff --git a/linux_os/guide/system/bootloader-grub2/file_groupowner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/file_groupowner_efi_grub2_cfg/rule.yml +index b5b583bd28..a6ac6f7b6b 100644 +--- a/linux_os/guide/system/bootloader-grub2/file_groupowner_efi_grub2_cfg/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/file_groupowner_efi_grub2_cfg/rule.yml +@@ -51,6 +51,8 @@ ocil: |- + {{{ ocil_file_group_owner(file="/boot/efi/EFI/redhat/grub.cfg", group="root") }}} + {{%- endif %}} + ++platform: machine ++ + template: + name: file_groupowner + vars: +diff --git a/linux_os/guide/system/bootloader-grub2/file_groupowner_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/file_groupowner_grub2_cfg/rule.yml +index 9d89ff5755..93dbf5222d 100644 +--- a/linux_os/guide/system/bootloader-grub2/file_groupowner_grub2_cfg/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/file_groupowner_grub2_cfg/rule.yml +@@ -39,6 +39,8 @@ ocil_clause: '{{{ ocil_clause_file_group_owner(file="/boot/grub2/grub.cfg", grou + + ocil: '{{{ ocil_file_group_owner(file="/boot/grub2/grub.cfg", group="root") }}}' + ++platform: machine ++ + template: + name: file_groupowner + vars: +diff --git a/linux_os/guide/system/bootloader-grub2/file_owner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/file_owner_efi_grub2_cfg/rule.yml +index ed17987478..e2c118cf0a 100644 +--- a/linux_os/guide/system/bootloader-grub2/file_owner_efi_grub2_cfg/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/file_owner_efi_grub2_cfg/rule.yml +@@ -49,6 +49,8 @@ ocil: |- + {{{ ocil_file_owner(file="/boot/efi/EFI/redhat/grub.cfg", owner="root") }}} + {{%- endif %}} + ++platform: machine ++ + template: + name: file_owner + vars: +diff --git a/linux_os/guide/system/bootloader-grub2/file_owner_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/file_owner_grub2_cfg/rule.yml +index 9ce4c3d60b..5086553921 100644 +--- a/linux_os/guide/system/bootloader-grub2/file_owner_grub2_cfg/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/file_owner_grub2_cfg/rule.yml +@@ -37,6 +37,8 @@ ocil_clause: '{{{ ocil_clause_file_owner(file="/boot/grub2/grub.cfg", owner="roo + + ocil: '{{{ ocil_file_owner(file="/boot/grub2/grub.cfg", owner="root") }}}' + ++platform: machine ++ + template: + name: file_owner + vars: +diff --git a/linux_os/guide/system/bootloader-grub2/group.yml b/linux_os/guide/system/bootloader-grub2/group.yml +index 69489bc0c2..4ffb40c0e8 100644 +--- a/linux_os/guide/system/bootloader-grub2/group.yml ++++ b/linux_os/guide/system/bootloader-grub2/group.yml +@@ -15,4 +15,4 @@ description: |- + with a password and ensure its configuration file's permissions + are set properly. + +-platform: machine ++platform: grub2 +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_admin_username/rule.yml +index 63a6a7a83c..15db01a75f 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_admin_username/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_admin_username/rule.yml +@@ -68,3 +68,5 @@ warnings: + + Also, do NOT manually add the superuser account and password to the + grub.cfg file as the grub2-mkconfig command overwrites this file. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml +index baade9c13e..d4f455e66a 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml +@@ -17,3 +17,5 @@ identifiers: + + references: + anssi: NT28(R11) ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_no_removeable_media/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_no_removeable_media/rule.yml +index 113726d34f..c8956c2f34 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_no_removeable_media/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_no_removeable_media/rule.yml +@@ -37,3 +37,5 @@ ocil: |- + usb0, cd, fd0, etc. are some examples of removeable + media which should not exist in the line: + 
set root='hd0,msdos1'
++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_password/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_password/rule.yml +index 985b8727d7..b6e9774608 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_password/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_password/rule.yml +@@ -72,3 +72,5 @@ warnings: + + Also, do NOT manually add the superuser account and password to the + grub.cfg file as the grub2-mkconfig command overwrites this file. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_uefi_admin_username/rule.yml +index 1926837db7..5abd86b9d9 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_uefi_admin_username/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_uefi_admin_username/rule.yml +@@ -75,3 +75,5 @@ warnings: + + Also, do NOT manually add the superuser account and password to the + grub.cfg file as the grub2-mkconfig command overwrites this file. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml +index 3ce5a2df13..3114d2d27c 100644 +--- a/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml +@@ -73,3 +73,5 @@ warnings: + + Also, do NOT manually add the superuser account and password to the + grub.cfg file as the grub2-mkconfig command overwrites this file. ++ ++platform: machine +diff --git a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/rule.yml +index c94185f3f4..5de05c057a 100644 +--- a/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/rule.yml ++++ b/linux_os/guide/system/bootloader-grub2/uefi_no_removeable_media/rule.yml +@@ -35,3 +35,5 @@ ocil: |- + usb0, cd, fd0, etc. are some examples of removeable + media which should not exist in the line: + 
set root='hd0,msdos1'
++ ++platform: machine +diff --git a/shared/checks/oval/installed_env_has_grub2_package.xml b/shared/checks/oval/installed_env_has_grub2_package.xml +new file mode 100644 +index 0000000000..e83f45bc3b +--- /dev/null ++++ b/shared/checks/oval/installed_env_has_grub2_package.xml +@@ -0,0 +1,37 @@ ++ ++ ++ ++ Package grub2 is installed ++ ++ multi_platform_all ++ ++ Checks if package grub2-pc is installed. ++ ++ ++ ++ ++ ++ ++ ++{{% if pkg_system == "rpm" %}} ++ ++ ++ ++ ++ grub2-pc ++ ++{{% elif pkg_system == "dpkg" %}} ++ ++ ++ ++ ++ grub2-pc ++ ++{{% endif %}} ++ ++ +diff --git a/ssg/constants.py b/ssg/constants.py +index f03aa87f09..318763b219 100644 +--- a/ssg/constants.py ++++ b/ssg/constants.py +@@ -498,6 +498,7 @@ + "container": "cpe:/a:container", + "chrony": "cpe:/a:chrony", + "gdm": "cpe:/a:gdm", ++ "grub2": "cpe:/a:grub2", + "libuser": "cpe:/a:libuser", + "nss-pam-ldapd": "cpe:/a:nss-pam-ldapd", + "ntp": "cpe:/a:ntp", + +From 8bb44ebe9c32b7916a7291b1fa5735b381494cfb Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Thu, 2 Jul 2020 16:58:14 +0200 +Subject: [PATCH 4/5] Move grub2_disable_interactive_boot to grub2 platform + +It should have both platforms machine and grub2. +But as the parent group is very broad, I cannot put parent group as +machine. + +As a side effect this change makes this rules applicable in containers. +--- + .../accounts-physical/grub2_disable_interactive_boot/rule.yml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml b/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml +index 3080470aa8..44ea1aa49a 100644 +--- a/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml +@@ -48,4 +48,4 @@ ocil: |- + Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates + that interactive boot is enabled at boot time. + +-platform: machine ++platform: grub2 + +From 17ba5bc9ecc955911b7a3ab30bcd221283472b3f Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 23 Jun 2020 23:20:18 +0200 +Subject: [PATCH 5/5] Update CPE Dictionaries + +Again, whenever a package CPE is added, all CPE dictionaries need to be +updated. +Because the project doesn't share CPEs among the products. +--- + debian10/cpe/debian10-cpe-dictionary.xml | 5 +++++ + debian8/cpe/debian8-cpe-dictionary.xml | 5 +++++ + debian9/cpe/debian9-cpe-dictionary.xml | 5 +++++ + fedora/cpe/fedora-cpe-dictionary.xml | 5 +++++ + ol7/cpe/ol7-cpe-dictionary.xml | 5 +++++ + ol8/cpe/ol8-cpe-dictionary.xml | 5 +++++ + opensuse/cpe/opensuse-cpe-dictionary.xml | 5 +++++ + rhel7/cpe/rhel7-cpe-dictionary.xml | 5 +++++ + rhel8/cpe/rhel8-cpe-dictionary.xml | 5 +++++ + rhv4/cpe/rhv4-cpe-dictionary.xml | 5 +++++ + sle11/cpe/sle11-cpe-dictionary.xml | 5 +++++ + sle12/cpe/sle12-cpe-dictionary.xml | 5 +++++ + sle15/cpe/sle15-cpe-dictionary.xml | 5 +++++ + ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml | 5 +++++ + ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml | 5 +++++ + ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml | 5 +++++ + wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml | 5 +++++ + wrlinux8/cpe/wrlinux8-cpe-dictionary.xml | 5 +++++ + 18 files changed, 90 insertions(+) + +diff --git a/debian10/cpe/debian10-cpe-dictionary.xml b/debian10/cpe/debian10-cpe-dictionary.xml +index 5cc27ceb79..f2dbd09cfc 100644 +--- a/debian10/cpe/debian10-cpe-dictionary.xml ++++ b/debian10/cpe/debian10-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/debian8/cpe/debian8-cpe-dictionary.xml b/debian8/cpe/debian8-cpe-dictionary.xml +index 38d490138a..f385709052 100644 +--- a/debian8/cpe/debian8-cpe-dictionary.xml ++++ b/debian8/cpe/debian8-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/debian9/cpe/debian9-cpe-dictionary.xml b/debian9/cpe/debian9-cpe-dictionary.xml +index f01770b044..bc90a12bae 100644 +--- a/debian9/cpe/debian9-cpe-dictionary.xml ++++ b/debian9/cpe/debian9-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/fedora/cpe/fedora-cpe-dictionary.xml b/fedora/cpe/fedora-cpe-dictionary.xml +index 2964e320c2..ff7cebc322 100644 +--- a/fedora/cpe/fedora-cpe-dictionary.xml ++++ b/fedora/cpe/fedora-cpe-dictionary.xml +@@ -62,6 +62,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/ol7/cpe/ol7-cpe-dictionary.xml b/ol7/cpe/ol7-cpe-dictionary.xml +index c153272121..613f853a6d 100644 +--- a/ol7/cpe/ol7-cpe-dictionary.xml ++++ b/ol7/cpe/ol7-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/ol8/cpe/ol8-cpe-dictionary.xml b/ol8/cpe/ol8-cpe-dictionary.xml +index 3fd74e53ca..912fe01346 100644 +--- a/ol8/cpe/ol8-cpe-dictionary.xml ++++ b/ol8/cpe/ol8-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/opensuse/cpe/opensuse-cpe-dictionary.xml b/opensuse/cpe/opensuse-cpe-dictionary.xml +index 1ab4e85ea8..7f485b800e 100644 +--- a/opensuse/cpe/opensuse-cpe-dictionary.xml ++++ b/opensuse/cpe/opensuse-cpe-dictionary.xml +@@ -42,6 +42,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/rhel7/cpe/rhel7-cpe-dictionary.xml b/rhel7/cpe/rhel7-cpe-dictionary.xml +index a5214e36f0..f232b7ed29 100644 +--- a/rhel7/cpe/rhel7-cpe-dictionary.xml ++++ b/rhel7/cpe/rhel7-cpe-dictionary.xml +@@ -57,6 +57,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/rhel8/cpe/rhel8-cpe-dictionary.xml b/rhel8/cpe/rhel8-cpe-dictionary.xml +index cccb3c5791..eab827291f 100644 +--- a/rhel8/cpe/rhel8-cpe-dictionary.xml ++++ b/rhel8/cpe/rhel8-cpe-dictionary.xml +@@ -32,6 +32,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/rhv4/cpe/rhv4-cpe-dictionary.xml b/rhv4/cpe/rhv4-cpe-dictionary.xml +index ce9b06dcae..db1b4b239b 100644 +--- a/rhv4/cpe/rhv4-cpe-dictionary.xml ++++ b/rhv4/cpe/rhv4-cpe-dictionary.xml +@@ -32,6 +32,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/sle11/cpe/sle11-cpe-dictionary.xml b/sle11/cpe/sle11-cpe-dictionary.xml +index c732ecb48a..1b6b3e2518 100644 +--- a/sle11/cpe/sle11-cpe-dictionary.xml ++++ b/sle11/cpe/sle11-cpe-dictionary.xml +@@ -32,6 +32,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/sle12/cpe/sle12-cpe-dictionary.xml b/sle12/cpe/sle12-cpe-dictionary.xml +index 79daa31412..b1b66e1294 100644 +--- a/sle12/cpe/sle12-cpe-dictionary.xml ++++ b/sle12/cpe/sle12-cpe-dictionary.xml +@@ -32,6 +32,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/sle15/cpe/sle15-cpe-dictionary.xml b/sle15/cpe/sle15-cpe-dictionary.xml +index 91d3d78b19..0ee5a1b817 100644 +--- a/sle15/cpe/sle15-cpe-dictionary.xml ++++ b/sle15/cpe/sle15-cpe-dictionary.xml +@@ -32,6 +32,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml b/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml +index df5abff723..7f3ce4271b 100644 +--- a/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml ++++ b/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml b/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml +index 6269344376..83f0c8c516 100644 +--- a/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml ++++ b/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml b/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml +index ccb285768e..77b78d74ec 100644 +--- a/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml ++++ b/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml +@@ -27,6 +27,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml +index 73e419c9ab..cc4e806a4d 100644 +--- a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml ++++ b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml +@@ -26,6 +26,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + +diff --git a/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml b/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml +index 8449ea1416..824c575a6a 100644 +--- a/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml ++++ b/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml +@@ -26,6 +26,11 @@ + + installed_env_has_gdm_package + ++ ++ Package grub2 is installed ++ ++ installed_env_has_grub2_package ++ + + Package libuser is installed + diff --git a/SOURCES/scap-security-guide-0.1.51-add-zipl-rules_PR_5784.patch b/SOURCES/scap-security-guide-0.1.51-add-zipl-rules_PR_5784.patch new file mode 100644 index 0000000..084c528 --- /dev/null +++ b/SOURCES/scap-security-guide-0.1.51-add-zipl-rules_PR_5784.patch @@ -0,0 +1,595 @@ +From 2c354a6bfbcedee3f92fd8cbdd42ce0f0861fcaf Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Mon, 25 May 2020 14:33:06 +0200 +Subject: [PATCH 1/5] Add zIPL bootloader group + +--- + linux_os/guide/system/bootloader-zipl/group.yml | 11 +++++++++++ + 1 file changed, 11 insertions(+) + create mode 100644 linux_os/guide/system/bootloader-zipl/group.yml + +diff --git a/linux_os/guide/system/bootloader-zipl/group.yml b/linux_os/guide/system/bootloader-zipl/group.yml +new file mode 100644 +index 0000000000..36da84530c +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/group.yml +@@ -0,0 +1,11 @@ ++documentation_complete: true ++ ++title: 'zIPL bootloader configuration' ++ ++description: |- ++ During the boot process, the bootloader is ++ responsible for starting the execution of the kernel and passing ++ options to it. ++ The default {{{ full_name }}} boot loader for s390x systems is called zIPL. ++ ++platform: machine + +From 13c11b539e5c8cc929a5ccbc4b117a98bb35d915 Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Mon, 25 May 2020 15:26:19 +0200 +Subject: [PATCH 2/5] Add zIPL rule for early audit capability + +--- + .../zipl_audit_argument/rule.yml | 40 +++++++++++++++++++ + 1 file changed, 40 insertions(+) + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml + +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml +new file mode 100644 +index 0000000000..ce2bd60c59 +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml +@@ -0,0 +1,40 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Enable Auditing to Start Prior to the Audit Daemon in zIPL' ++ ++description: |- ++ To ensure all processes can be audited, even those which start prior to the audit daemon, ++ check that all boot entries in /boot/loader/entries/*.conf have audit=1 ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to enable audit, ++ add 
audit=1
to /etc/kernel/cmdline. ++ ++rationale: |- ++ Each process on the system carries an "auditable" flag which indicates whether ++ its activities can be audited. Although auditd takes care of enabling ++ this for all processes which launch after it does, adding the kernel argument ++ ensures it is set for every process during boot. ++ ++severity: medium ++ ++ocil_clause: 'auditing is not enabled at boot time' ++ ++ocil: |- ++ To check that audit is enabled at boot time, check all boot entries with following command: ++ 
sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that doesn't enable audit. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. + +From 221979b3aebfe6dda39e1a446140454138e231bf Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 26 May 2020 15:06:12 +0200 +Subject: [PATCH 3/5] Add few more zIPL kernel option rules + +Add rules for following options: +- audit_backlog_limit +- selinux +- audit_backlog_limit +- enable_selinux +- page_poison +- pti +- slub_debug +- vsyscall +--- + .../rule.yml | 41 +++++++++++++++++++ + .../zipl_enable_selinux/rule.yml | 37 +++++++++++++++++ + .../zipl_page_poison_argument/rule.yml | 41 +++++++++++++++++++ + .../zipl_pti_argument/rule.yml | 40 ++++++++++++++++++ + .../zipl_slub_debug_argument/rule.yml | 41 +++++++++++++++++++ + .../zipl_vsyscall_argument/rule.yml | 41 +++++++++++++++++++ + 6 files changed, 241 insertions(+) + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml + create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml + +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml +new file mode 100644 +index 0000000000..08c5b53207 +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml +@@ -0,0 +1,41 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Extend Audit Backlog Limit for the Audit Daemon in zIPL' ++ ++description: |- ++ To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, ++ check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192 ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to extend the audit log events queue, ++ add 
audit_backlog_limit=8192
to /etc/kernel/cmdline. ++ ++rationale: |- ++ audit_backlog_limit sets the queue length for audit events awaiting transfer ++ to the audit daemon. Until the audit daemon is up and running, all log messages ++ are stored in this queue. If the queue is overrun during boot process, the action ++ defined by audit failure flag is taken. ++ ++severity: medium ++ ++ocil_clause: 'audit backlog limit is not configured' ++ ++ocil: |- ++ To check that all boot entries extend the backlog limit; ++ Check that all boot entries extend the log events queue: ++ 
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that does not extend the log events queue. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml +new file mode 100644 +index 0000000000..e7a455b90c +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml +@@ -0,0 +1,37 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Ensure SELinux Not Disabled in zIPL' ++ ++description: |- ++ To ensure SELinux is not disabled at boot time, ++ check that no boot entry in /boot/loader/entries/*.conf has selinux=0 ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++rationale: |- ++ Disabling a major host protection feature, such as SELinux, at boot time prevents ++ it from confining system services at boot time. Further, it increases ++ the chances that it will remain off during system operation. ++ ++severity: medium ++ ++ocil_clause: 'SELinux is disabled at boot time' ++ ++ocil: |- ++ To check that selinux is not disabled at boot time; ++ Check that no boot entry disables selinux: ++ 
sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that disables SELinux. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml +new file mode 100644 +index 0000000000..b8a2eecee6 +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml +@@ -0,0 +1,41 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Enable page allocator poisoning in zIPL' ++ ++description: |- ++ To enable poisoning of free pages, ++ check that all boot entries in /boot/loader/entries/*.conf have page_poison=1 ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to enable page poisoning, ++ add 
page_poison=1
to /etc/kernel/cmdline. ++ ++rationale: |- ++ Poisoning writes an arbitrary value to freed pages, so any modification or ++ reference to that page after being freed or before being initialized will be ++ detected and prevented. ++ This prevents many types of use-after-free vulnerabilities at little performance cost. ++ Also prevents leak of data and detection of corrupted memory. ++ ++severity: medium ++ ++ocil_clause: 'page allocator poisoning is not enabled' ++ ++ocil: |- ++ To check that page poisoning is enabled at boot time, check all boot entries with following command: ++ 
sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that doesn't enable page poisoning. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml +new file mode 100644 +index 0000000000..4757871a5f +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml +@@ -0,0 +1,40 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Enable Kernel Page-Table Isolation (KPTI) in zIPL' ++ ++description: |- ++ To enable Kernel page-table isolation, ++ check that all boot entries in /boot/loader/entries/*.conf have pti=on ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to enable page-table isolation, ++ add 
pti=on
to /etc/kernel/cmdline. ++ ++rationale: |- ++ Kernel page-table isolation is a kernel feature that mitigates ++ the Meltdown security vulnerability and hardens the kernel ++ against attempts to bypass kernel address space layout ++ randomization (KASLR). ++ ++severity: medium ++ ++ocil_clause: 'Kernel page-table isolation is not enabled' ++ ++ocil: |- ++ To check that page-table isolation is enabled at boot time, check all boot entries with following command: ++ 
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation . ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml +new file mode 100644 +index 0000000000..166dd41afd +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml +@@ -0,0 +1,41 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Enable SLUB/SLAB allocator poisoning in zIPL' ++ ++description: |- ++ To enable poisoning of SLUB/SLAB objects, ++ check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to extend the audit log events queue, ++ add 
slub_debug=P
to /etc/kernel/cmdline. ++ ++rationale: |- ++ Poisoning writes an arbitrary value to freed objects, so any modification or ++ reference to that object after being freed or before being initialized will be ++ detected and prevented. ++ This prevents many types of use-after-free vulnerabilities at little performance cost. ++ Also prevents leak of data and detection of corrupted memory. ++ ++severity: medium ++ ++ocil_clause: 'SLUB/SLAB poisoning is not enabled' ++ ++ocil: |- ++ To check that SLUB/SLAB poisoning is enabled, check all boot entries with following command; ++ 
sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that does not enable poisoning. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. +diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml +new file mode 100644 +index 0000000000..6b95d16fb8 +--- /dev/null ++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml +@@ -0,0 +1,41 @@ ++documentation_complete: true ++ ++prodtype: rhel8 ++ ++title: 'Disable vsyscalls in zIPL' ++ ++description: |- ++ To disable use of virtual syscalls, ++ check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none ++ included in its options. ++ Make sure /etc/zipl.conf doesn't contain 
image =
setting, ++ as {{{ full_name }}} adheres to Boot Loader Specification (BLS). ++ And run 
zipl
command so that /boot/bootmap is updated. ++ ++ To ensure that new kernels and boot entries continue to disable virtual syscalls, ++ add 
vsyscall=none
to /etc/kernel/cmdline. ++ ++rationale: |- ++ Poisoning writes an arbitrary value to freed pages, so any modification or ++ reference to that page after being freed or before being initialized will be ++ detected and prevented. ++ This prevents many types of use-after-free vulnerabilities at little performance cost. ++ Also prevents leak of data and detection of corrupted memory. ++ ++severity: medium ++ ++ocil_clause: 'vsyscalls are enabled' ++ ++ocil: |- ++ To check that virtual syscalls are disabled at boot time, check all boot entries with following command: ++ 
sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf
++ No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls. ++ ++ Check that no image file is specified in /etc/zipl.conf: ++ 
grep -R "^image\s*=" /etc/zipl.conf
++ No line should be returned, if a line is returned zipl may load a different kernel than intended. ++ ++ And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf ++ and /etc/zipl.conf: ++ 
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap
++ No line should be returned, if a line is returned /boot/bootmap needs to be regenerated. + +From a45ba0eaa12de63abb43449c6caee4776100005c Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Tue, 2 Jun 2020 13:29:39 +0200 +Subject: [PATCH 4/5] Fix formatting of zIPL rules + +
 is renderend in a separate line, while  is rendered inline.
+Add line breaks for better readability.
+---
+ .../bootloader-zipl/zipl_audit_argument/rule.yml       | 10 +++++-----
+ .../zipl_audit_backlog_limit_argument/rule.yml         | 10 +++++-----
+ .../bootloader-zipl/zipl_enable_selinux/rule.yml       |  8 ++++----
+ .../bootloader-zipl/zipl_page_poison_argument/rule.yml | 10 +++++-----
+ .../system/bootloader-zipl/zipl_pti_argument/rule.yml  | 10 +++++-----
+ .../bootloader-zipl/zipl_slub_debug_argument/rule.yml  | 10 +++++-----
+ .../bootloader-zipl/zipl_vsyscall_argument/rule.yml    | 10 +++++-----
+ 7 files changed, 34 insertions(+), 34 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+index ce2bd60c59..16c0b3f89a 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Enable Auditing to Start Prior to the Audit Daemon in zIPL'
+ description: |-
+     To ensure all processes can be audited, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit=1
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to enable audit,
+-    add 
audit=1
 to /etc/kernel/cmdline.
++    add audit=1 to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     Each process on the system carries an "auditable" flag which indicates whether
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index 08c5b53207..47a532d50f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Extend Audit Backlog Limit for the Audit Daemon in zIPL'
+ description: |-
+     To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+-    add 
audit_backlog_limit=8192
 to /etc/kernel/cmdline.
++    add audit_backlog_limit=8192 to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     audit_backlog_limit sets the queue length for audit events awaiting transfer
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+index e7a455b90c..5aa91c16aa 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+@@ -7,10 +7,10 @@ title: 'Ensure SELinux Not Disabled in zIPL'
+ description: |-
+     To ensure SELinux is not disabled at boot time,
+     check that no boot entry in /boot/loader/entries/*.conf has selinux=0
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+ rationale: |-
+     Disabling a major host protection feature, such as SELinux, at boot time prevents
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+index b8a2eecee6..8546325752 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Enable page allocator poisoning in zIPL'
+ description: |-
+     To enable poisoning of free pages,
+     check that all boot entries in /boot/loader/entries/*.conf have page_poison=1
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.

+ 
+     To ensure that new kernels and boot entries continue to enable page poisoning,
+-    add 
page_poison=1
 to /etc/kernel/cmdline.
++    add page_poison=1 to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     Poisoning writes an arbitrary value to freed pages, so any modification or
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+index 4757871a5f..eaef25ce40 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Enable Kernel Page-Table Isolation (KPTI) in zIPL'
+ description: |-
+     To enable Kernel page-table isolation,
+     check that all boot entries in /boot/loader/entries/*.conf have pti=on
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to enable page-table isolation,
+-    add 
pti=on
 to /etc/kernel/cmdline.
++    add pti=on to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     Kernel page-table isolation is a kernel feature that mitigates
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index 166dd41afd..68e91a92d6 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Enable SLUB/SLAB allocator poisoning in zIPL'
+ description: |-
+     To enable poisoning of SLUB/SLAB objects,
+     check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+-    add 
slub_debug=P
 to /etc/kernel/cmdline.
++    add slub_debug=P to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     Poisoning writes an arbitrary value to freed objects, so any modification or
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index 6b95d16fb8..8d39337f9e 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -7,13 +7,13 @@ title: 'Disable vsyscalls in zIPL'
+ description: |-
+     To disable use of virtual syscalls,
+     check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none
+-    included in its options.
+-    Make sure /etc/zipl.conf doesn't contain 
image = 
 setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).
+-    And run 
zipl
 command so that /boot/bootmap is updated.
++    included in its options.

++    Make sure /etc/zipl.conf doesn't contain image =  setting,
++    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

++    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to disable virtual syscalls,
+-    add 
vsyscall=none
 to /etc/kernel/cmdline.
++    add vsyscall=none to /etc/kernel/cmdline.
+ 
+ rationale: |-
+     Poisoning writes an arbitrary value to freed pages, so any modification or
+
+From ae8f9252c3c5c1d1ac1bed201e0981c0d50168aa Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 3 Jun 2020 13:08:07 +0200
+Subject: [PATCH 5/5] zipl_vsyscall_argument: Fix rationale
+
+copy-pasta error
+---
+ .../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index 8d39337f9e..9624b43349 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -16,11 +16,8 @@ description: |-
+     add vsyscall=none to /etc/kernel/cmdline.
+ 
+ rationale: |-
+-    Poisoning writes an arbitrary value to freed pages, so any modification or
+-    reference to that page after being freed or before being initialized will be
+-    detected and prevented.
+-    This prevents many types of use-after-free vulnerabilities at little performance cost.
+-    Also prevents leak of data and detection of corrupted memory.
++    Virtual Syscalls provide an opportunity of attack for a user who has control
++    of the return instruction pointer.
+ 
+ severity: medium
+ 
diff --git a/SOURCES/scap-security-guide-0.1.51-fix-rhel6-cpe-dictionary_PR_5928.patch b/SOURCES/scap-security-guide-0.1.51-fix-rhel6-cpe-dictionary_PR_5928.patch
new file mode 100644
index 0000000..58339fa
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.51-fix-rhel6-cpe-dictionary_PR_5928.patch
@@ -0,0 +1,29 @@
+From c7d49a79cffdbfb2e1231077f665cbb940b50a98 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= 
+Date: Mon, 13 Jul 2020 17:52:35 +0200
+Subject: [PATCH] Fix SCAPVAL error SRC-15
+
+The CPE `cpe:/a:grub2` is used in `xccdf-1.2:platform` element
+in group `bootloader-grub2`, but this CPE isn't defined in the
+RHEL 6 CPE dictionary. All used CPEs should be defined in the
+dictionary.
+---
+ rhel6/cpe/rhel6-cpe-dictionary.xml | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/rhel6/cpe/rhel6-cpe-dictionary.xml b/rhel6/cpe/rhel6-cpe-dictionary.xml
+index bca8986f7a..1b696b88d3 100644
+--- a/rhel6/cpe/rhel6-cpe-dictionary.xml
++++ b/rhel6/cpe/rhel6-cpe-dictionary.xml
+@@ -47,6 +47,11 @@
+             
+             installed_env_has_gdm_package
+       
++      
++            Package grub2 is installed
++            
++            installed_env_has_grub2_package
++      
+       
+             Package libuser is installed
+             
diff --git a/SOURCES/scap-security-guide-0.1.51-fix-zipl-cpe-dictionary_PR_5912.patch b/SOURCES/scap-security-guide-0.1.51-fix-zipl-cpe-dictionary_PR_5912.patch
new file mode 100644
index 0000000..1f77753
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.51-fix-zipl-cpe-dictionary_PR_5912.patch
@@ -0,0 +1,250 @@
+From d1b9040748605416220e09feb56fc5a6b6402f1e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= 
+Date: Tue, 7 Jul 2020 16:37:30 +0200
+Subject: [PATCH] Add zipl to CPE dictionaries in all Linux products
+
+The CPE platform `cpe:/a:zipl` has been set as a platform for XCCDF
+group `bootloader-zipl` but the definition of the CPE was missing from
+the CPE dictionary in some datastreams, for example fedora datastream.
+This triggered error SRC-15 in NIST scapval tool.
+---
+ debian10/cpe/debian10-cpe-dictionary.xml       | 4 ++++
+ debian8/cpe/debian8-cpe-dictionary.xml         | 4 ++++
+ debian9/cpe/debian9-cpe-dictionary.xml         | 4 ++++
+ fedora/cpe/fedora-cpe-dictionary.xml           | 4 ++++
+ ol7/cpe/ol7-cpe-dictionary.xml                 | 4 ++++
+ ol8/cpe/ol8-cpe-dictionary.xml                 | 4 ++++
+ opensuse/cpe/opensuse-cpe-dictionary.xml       | 4 ++++
+ rhel6/cpe/rhel6-cpe-dictionary.xml             | 4 ++++
+ rhel7/cpe/rhel7-cpe-dictionary.xml             | 4 ++++
+ rhv4/cpe/rhv4-cpe-dictionary.xml               | 4 ++++
+ sle11/cpe/sle11-cpe-dictionary.xml             | 4 ++++
+ sle12/cpe/sle12-cpe-dictionary.xml             | 4 ++++
+ ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml   | 4 ++++
+ ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml   | 4 ++++
+ ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml   | 4 ++++
+ wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml | 4 ++++
+ wrlinux8/cpe/wrlinux8-cpe-dictionary.xml       | 4 ++++
+ 19 files changed, 76 insertions(+)
+
+diff --git a/debian10/cpe/debian10-cpe-dictionary.xml b/debian10/cpe/debian10-cpe-dictionary.xml
+index f2dbd09cfc..ddb68c34bd 100644
+--- a/debian10/cpe/debian10-cpe-dictionary.xml
++++ b/debian10/cpe/debian10-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/debian8/cpe/debian8-cpe-dictionary.xml b/debian8/cpe/debian8-cpe-dictionary.xml
+index f385709052..24bbca69cd 100644
+--- a/debian8/cpe/debian8-cpe-dictionary.xml
++++ b/debian8/cpe/debian8-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/debian9/cpe/debian9-cpe-dictionary.xml b/debian9/cpe/debian9-cpe-dictionary.xml
+index bc90a12bae..d5595fd594 100644
+--- a/debian9/cpe/debian9-cpe-dictionary.xml
++++ b/debian9/cpe/debian9-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/fedora/cpe/fedora-cpe-dictionary.xml b/fedora/cpe/fedora-cpe-dictionary.xml
+index ff7cebc322..bef1337fc9 100644
+--- a/fedora/cpe/fedora-cpe-dictionary.xml
++++ b/fedora/cpe/fedora-cpe-dictionary.xml
+@@ -107,4 +107,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/ol7/cpe/ol7-cpe-dictionary.xml b/ol7/cpe/ol7-cpe-dictionary.xml
+index 613f853a6d..5d4691aaf6 100644
+--- a/ol7/cpe/ol7-cpe-dictionary.xml
++++ b/ol7/cpe/ol7-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/ol8/cpe/ol8-cpe-dictionary.xml b/ol8/cpe/ol8-cpe-dictionary.xml
+index 912fe01346..35167b1f70 100644
+--- a/ol8/cpe/ol8-cpe-dictionary.xml
++++ b/ol8/cpe/ol8-cpe-dictionary.xml
+@@ -67,4 +67,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/opensuse/cpe/opensuse-cpe-dictionary.xml b/opensuse/cpe/opensuse-cpe-dictionary.xml
+index 7f485b800e..6b95e46d3f 100644
+--- a/opensuse/cpe/opensuse-cpe-dictionary.xml
++++ b/opensuse/cpe/opensuse-cpe-dictionary.xml
+@@ -87,4 +87,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/rhel6/cpe/rhel6-cpe-dictionary.xml b/rhel6/cpe/rhel6-cpe-dictionary.xml
+index 2c8a82ebc5..bca8986f7a 100644
+--- a/rhel6/cpe/rhel6-cpe-dictionary.xml
++++ b/rhel6/cpe/rhel6-cpe-dictionary.xml
+@@ -87,4 +87,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/rhel7/cpe/rhel7-cpe-dictionary.xml b/rhel7/cpe/rhel7-cpe-dictionary.xml
+index f232b7ed29..bc2aa869e8 100644
+--- a/rhel7/cpe/rhel7-cpe-dictionary.xml
++++ b/rhel7/cpe/rhel7-cpe-dictionary.xml
+@@ -102,4 +102,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/rhv4/cpe/rhv4-cpe-dictionary.xml b/rhv4/cpe/rhv4-cpe-dictionary.xml
+index db1b4b239b..02450d6efc 100644
+--- a/rhv4/cpe/rhv4-cpe-dictionary.xml
++++ b/rhv4/cpe/rhv4-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/sle11/cpe/sle11-cpe-dictionary.xml b/sle11/cpe/sle11-cpe-dictionary.xml
+index 1b6b3e2518..b7cb4e1fd5 100644
+--- a/sle11/cpe/sle11-cpe-dictionary.xml
++++ b/sle11/cpe/sle11-cpe-dictionary.xml
+@@ -77,4 +77,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/sle12/cpe/sle12-cpe-dictionary.xml b/sle12/cpe/sle12-cpe-dictionary.xml
+index b1b66e1294..73cddd7740 100644
+--- a/sle12/cpe/sle12-cpe-dictionary.xml
++++ b/sle12/cpe/sle12-cpe-dictionary.xml
+@@ -77,4 +77,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml b/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml
+index 7f3ce4271b..3f5447741b 100644
+--- a/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml
++++ b/ubuntu1404/cpe/ubuntu1404-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml b/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml
+index 83f0c8c516..e3e842842b 100644
+--- a/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml
++++ b/ubuntu1604/cpe/ubuntu1604-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml b/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml
+index 77b78d74ec..897673c6f5 100644
+--- a/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml
++++ b/ubuntu1804/cpe/ubuntu1804-cpe-dictionary.xml
+@@ -72,4 +72,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml
+index cc4e806a4d..ef7e803505 100644
+--- a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml
++++ b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml
+@@ -71,4 +71,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
+diff --git a/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml b/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml
+index 824c575a6a..7184ebfd0b 100644
+--- a/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml
++++ b/wrlinux8/cpe/wrlinux8-cpe-dictionary.xml
+@@ -71,4 +71,8 @@
+             
+             installed_env_has_yum_package
+       
++      
++            System uses zipl
++            installed_env_has_zipl_package
++      
+ 
diff --git a/SOURCES/scap-security-guide-0.1.52-add-grub2-platform-to-more-rules_PR_5952.patch b/SOURCES/scap-security-guide-0.1.52-add-grub2-platform-to-more-rules_PR_5952.patch
new file mode 100644
index 0000000..398abcc
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.52-add-grub2-platform-to-more-rules_PR_5952.patch
@@ -0,0 +1,88 @@
+From d455dc468ef51dd595ce6184f1d31ebf4c20ab9c Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 22 Jul 2020 09:52:50 +0200
+Subject: [PATCH] Add grub2 platform to grub2 kernel option rules
+
+This will make sure these rules are applicable only when grub2
+(grub2-pc) is installed.
+---
+ linux_os/guide/system/auditing/grub2_audit_argument/rule.yml    | 2 ++
+ .../system/auditing/grub2_audit_backlog_limit_argument/rule.yml | 2 +-
+ .../system/permissions/mounting/grub2_nousb_argument/rule.yml   | 2 ++
+ .../guide/system/permissions/restrictions/poisoning/group.yml   | 2 ++
+ .../restrictions/poisoning/grub2_page_poison_argument/rule.yml  | 2 +-
+ .../restrictions/poisoning/grub2_slub_debug_argument/rule.yml   | 2 +-
+ 7 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
+index 00cb7f9b6c..5f3a47a776 100644
+--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
++++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
+@@ -102,6 +102,8 @@ warnings:
+ {{% endif %}}
+         
+ 
++platform: grub2
++
+ template:
+     name: grub2_bootloader_argument
+     vars:
+diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+index 6cab6f7bfe..aa95957b58 100644
+--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+@@ -60,7 +60,7 @@ warnings:
+ {{% endif %}}
+         
+ 
+-platform: machine
++platform: grub2
+ 
+ template:
+     name: grub2_bootloader_argument
+diff --git a/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml b/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml
+index a3c1f48231..407ba2c069 100644
+--- a/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml
++++ b/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml
+@@ -37,3 +37,5 @@ warnings:
+         Disabling all kernel support for USB will cause problems for systems
+         with USB-based keyboards, mice, or printers. This configuration is
+         infeasible for systems which require USB devices, which is common.
++
++platform: grub2
+diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/group.yml b/linux_os/guide/system/permissions/restrictions/poisoning/group.yml
+index 6a7a370f2b..030a3e9918 100644
+--- a/linux_os/guide/system/permissions/restrictions/poisoning/group.yml
++++ b/linux_os/guide/system/permissions/restrictions/poisoning/group.yml
+@@ -6,3 +6,5 @@ description: |-
+     Memory Poisoning consists of writing a special value to uninitialized or freed memory.
+     Poisoning can be used as a mechanism to prevent leak of information and detection of
+     corrupted memory.
++
++platform: machine
+diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
+index e3047ef223..2d97ec75ea 100644
+--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml
+@@ -60,7 +60,7 @@ warnings:
+ {{% endif %}}
+         
+ 
+-platform: machine
++platform: grub2
+ 
+ template:
+     name: grub2_bootloader_argument
+diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
+index 024c93f18b..39ca33b77a 100644
+--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml
+@@ -60,7 +60,7 @@ warnings:
+ {{% endif %}}
+         
+ 
+-platform: machine
++platform: grub2
+ 
+ template:
+     name: grub2_bootloader_argument
diff --git a/SOURCES/scap-security-guide-0.1.52-add-zipl-boot-options-template_PR_5908.patch b/SOURCES/scap-security-guide-0.1.52-add-zipl-boot-options-template_PR_5908.patch
new file mode 100644
index 0000000..3e89401
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.52-add-zipl-boot-options-template_PR_5908.patch
@@ -0,0 +1,954 @@
+From f37e40e3de5ff493c60c61a054026dabf7b79032 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 1 Jul 2020 16:12:35 +0200
+Subject: [PATCH 01/18] Kickstart zipl_bls_entries_option template
+
+Create initial version of zIPL specific BLS entries
+template by copying bls_entries_option template.
+---
+ .../template_OVAL_zipl_bls_entries_option     | 32 +++++++++++++++++++
+ ssg/templates.py                              |  5 +++
+ 2 files changed, 37 insertions(+)
+ create mode 100644 shared/templates/template_OVAL_zipl_bls_entries_option
+
+diff --git a/shared/templates/template_OVAL_zipl_bls_entries_option b/shared/templates/template_OVAL_zipl_bls_entries_option
+new file mode 100644
+index 0000000000..a19bd5a89c
+--- /dev/null
++++ b/shared/templates/template_OVAL_zipl_bls_entries_option
+@@ -0,0 +1,32 @@
++
++  
++    
++      Ensure that BLS-compatible boot loader is configured to run Linux operating system with argument {{{ ARG_NAME_VALUE }}}
++      {{{- oval_affected(products) }}}
++      Ensure {{{ ARG_NAME_VALUE }}} option is configured in the 'options' line in /boot/loader/entries/*.conf.
++    
++    
++        
++    
++  
++
++  
++    
++    
++  
++
++  
++    ^/boot/loader/entries/.*\.conf$
++    ^options (.*)$
++    1
++  
++
++  
++    ^(?:.*\s)?{{{ ESCAPED_ARG_NAME_VALUE }}}(?:\s.*)?$
++  
++
+diff --git a/ssg/templates.py b/ssg/templates.py
+index 2795267abd..fc09416abe 100644
+--- a/ssg/templates.py
++++ b/ssg/templates.py
+@@ -340,6 +340,22 @@ def bls_entries_option(data, lang):
+     return data
+ 
+ 
++@template(["oval"])
++def bls_entries_option(data, lang):
++    data["arg_name_value"] = data["arg_name"] + "=" + data["arg_value"]
++    if lang == "oval":
++        # escape dot, this is used in oval regex
++        data["escaped_arg_name_value"] = data["arg_name_value"].replace(".", "\\.")
++        # replace . with _, this is used in test / object / state ids
++        data["sanitized_arg_name"] = data["arg_name"].replace(".", "_")
++    return data
++
++
++@template(["oval"])
++def zipl_bls_entries_option(data, lang):
++    return bls_entries_option(data, lang)
++
++
+ class Builder(object):
+     """
+     Class for building all templated content for a given product.
+
+From f54c3c974b6a3ce6d40533a51f867d2e8985b688 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 14:11:04 +0200
+Subject: [PATCH 02/18] zipl_bls_entries_option: check opts after install
+
+Extend zipl_bls_entries_option template to check that the kernel option
+is also configure in /etc/kernel/cmdline.
+The presence of the argument in /etc/kernel/cmdline ensures that newly
+installed kernels will be configure if the option.
+---
+ .../template_OVAL_zipl_bls_entries_option     | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/shared/templates/template_OVAL_zipl_bls_entries_option b/shared/templates/template_OVAL_zipl_bls_entries_option
+index a19bd5a89c..9af1bcfbee 100644
+--- a/shared/templates/template_OVAL_zipl_bls_entries_option
++++ b/shared/templates/template_OVAL_zipl_bls_entries_option
+@@ -6,8 +6,10 @@
+       Ensure {{{ ARG_NAME_VALUE }}} option is configured in the 'options' line in /boot/loader/entries/*.conf.
+     
+     
+-        
++      
++      
+     
+   
+ 
+@@ -25,6 +27,19 @@
+     1
+   
+ 
++  
++    
++    
++  
++  
++    /etc/kernel/cmdline
++    ^(.*)$
++    1
++  
++
+   
+     ^(?:.*\s)?{{{ ESCAPED_ARG_NAME_VALUE }}}(?:\s.*)?$
+
+From 5b66eff84794b99a4ba7a626c46f1970715b1bcd Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 14:12:32 +0200
+Subject: [PATCH 03/18] zipl_bls_entries_option: Add Ansible and Bash
+
+---
+ .../template_ANSIBLE_zipl_bls_entries_option  | 48 +++++++++++++++++++
+ .../template_BASH_zipl_bls_entries_option     | 12 +++++
+ ssg/templates.py                              |  2 +-
+ 3 files changed, 61 insertions(+), 1 deletion(-)
+ create mode 100644 shared/templates/template_ANSIBLE_zipl_bls_entries_option
+ create mode 100644 shared/templates/template_BASH_zipl_bls_entries_option
+
+diff --git a/shared/templates/template_ANSIBLE_zipl_bls_entries_option b/shared/templates/template_ANSIBLE_zipl_bls_entries_option
+new file mode 100644
+index 0000000000..c0cb131b82
+--- /dev/null
++++ b/shared/templates/template_ANSIBLE_zipl_bls_entries_option
+@@ -0,0 +1,48 @@
++# platform = Red Hat Enterprise Linux 8
++# reboot = true
++# strategy = configure
++# complexity = medium
++# disruption = low
++
++- name: "Ensure BLS boot entries options contain {{{ ARG_NAME_VALUE }}}"
++  block:
++    - name: "Check if any boot entry misses {{{ ARG_NAME_VALUE }}}"
++      find:
++        paths: "/boot/loader/entries/"
++        contains: "^options .*{{{ ARG_NAME_VALUE }}}.*$"
++        patterns: "*.conf"
++      register: entries_options
++
++    - name: "Update boot entries options"
++      command: grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
++      when: entries_options is defined and entries_options.examined != entries_options.matched
++      # The conditional above assumes that only *.conf files are present in /boot/loader/entries
++      # Then, the number of conf files is the same as examined files
++
++    - name: "Check if /etc/kernel/cmdline exists"
++      stat:
++        path: /etc/kernel/cmdline
++      register: cmdline_stat
++
++    - name: "Check if /etc/kernel/cmdline contains {{{ ARG_NAME_VALUE }}}"
++      find:
++        paths: "/etc/kernel/"
++        patterns: "cmdline"
++        contains: "^.*{{{ ARG_NAME_VALUE }}}.*$"
++      register: cmdline_find
++
++    - name: "Add /etc/kernel/cmdline contains {{{ ARG_NAME_VALUE }}}"
++      lineinfile:
++        create: yes
++        path: "/etc/kernel/cmdline"
++        line: '{{{ ARG_NAME_VALUE }}}'
++      when: cmdline_stat is defined and not cmdline_stat.stat.exists
++
++    - name: "Append /etc/kernel/cmdline contains {{{ ARG_NAME_VALUE }}}"
++      lineinfile:
++        path: "/etc/kernel/cmdline"
++        backrefs: yes
++        regexp: "^(.*)$"
++        line: '\1 {{{ ARG_NAME_VALUE }}}'
++      when: cmdline_stat is defined and cmdline_stat.stat.exists and cmdline_find is defined and cmdline_find.matched == 0
++
+diff --git a/shared/templates/template_BASH_zipl_bls_entries_option b/shared/templates/template_BASH_zipl_bls_entries_option
+new file mode 100644
+index 0000000000..9fc8865486
+--- /dev/null
++++ b/shared/templates/template_BASH_zipl_bls_entries_option
+@@ -0,0 +1,12 @@
++# platform = Red Hat Enterprise Linux 8
++
++# Correct BLS option using grubby, which is a thin wrapper around BLS operations
++grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
++
++# Ensure new kernels and boot entries retain the boot option
++if [ ! -f /etc/kernel/cmdline ]; then
++    echo "{{{ ARG_NAME_VALUE }}}" >> /etc/kernel/cmdline
++elif ! grep -q '^(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$' /etc/kernel/cmdline; then
++    echo " audit=1" >> /etc/kernel/cmdline
++    sed -Ei 's/^(.*)$/\1 audit=1/' /etc/kernel/cmdline
++fi
+diff --git a/ssg/templates.py b/ssg/templates.py
+index fc09416abe..a27fbb6cb6 100644
+--- a/ssg/templates.py
++++ b/ssg/templates.py
+@@ -340,7 +340,7 @@ def bls_entries_option(data, lang):
+     return data
+ 
+ 
+-@template(["oval"])
++@template(["ansible", "bash", "oval"])
+ def zipl_bls_entries_option(data, lang):
+     return bls_entries_option(data, lang)
+ 
+
+From fd2d807f60a4a36ad96f5ac37df9b4651fe3480e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 3 Jul 2020 15:50:56 +0200
+Subject: [PATCH 04/18] Enable zIPL in argument rules
+
+---
+ .../system/bootloader-zipl/zipl_audit_argument/rule.yml     | 6 ++++++
+ .../zipl_audit_backlog_limit_argument/rule.yml              | 6 ++++++
+ .../bootloader-zipl/zipl_page_poison_argument/rule.yml      | 6 ++++++
+ .../guide/system/bootloader-zipl/zipl_pti_argument/rule.yml | 6 ++++++
+ .../bootloader-zipl/zipl_slub_debug_argument/rule.yml       | 6 ++++++
+ .../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml  | 6 ++++++
+ 6 files changed, 36 insertions(+)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+index 624b4e7041..894bf7995f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+@@ -28,3 +28,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that doesn't enable audit.
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: audit
++    arg_value: '1'
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index faf114591a..12334c9905 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -28,3 +28,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that does not extend the log events queue.
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: audit_backlog_limit
++    arg_value: '8192'
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+index 866664c01b..f5a36ee1b3 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+@@ -28,3 +28,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that doesn't enable page poisoning.
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: page_poison
++    arg_value: '1'
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+index 2f02d9668c..168dae46a1 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+@@ -27,3 +27,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: pti
++    arg_value: 'on'
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index 0cb10d3cd8..84a374e36f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -28,3 +28,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that does not enable poisoning.
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: slub_debug
++    arg_value: 'P'
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index f79adeb083..c37e8bbefd 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -25,3 +25,9 @@ ocil: |-
+   No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls.
+ 
+ platform: machine
++
++template:
++  name: zipl_bls_entries_option
++  vars:
++    arg_name: vsyscall
++    arg_value: 'none'
+
+From 08db1a1d4bb3362195c34e266feb9bac31ba4be8 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Sat, 4 Jul 2020 01:15:49 +0200
+Subject: [PATCH 05/18] zipl_audit_backlog_limit_argument: Fix OCIL typo
+
+Fix typo
+---
+ .../bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml  | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index 12334c9905..15729dc6b6 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -24,7 +24,7 @@ ocil_clause: 'audit backlog limit is not configured'
+ ocil: |-
+   To check that all boot entries extend the backlog limit;
+   Check that all boot entries extend the log events queue:
+-  
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf

++  
sudo grep -L "^options\s+.*\baudit_backlog_limit=8192\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that does not extend the log events queue.
+ 
+ platform: machine
+
+From 779506348675557e204e1d88f214833b313c0f20 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 12:00:10 +0200
+Subject: [PATCH 06/18] zipl_slub_debug_argument: Fix description
+
+Description about how to ensure that new boot entries continue compliant
+was incorrect due to copy-pasta mistake.
+---
+ .../system/bootloader-zipl/zipl_slub_debug_argument/rule.yml    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index 84a374e36f..83e043179d 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -8,7 +8,7 @@ description: |-
+     To enable poisoning of SLUB/SLAB objects,
+     check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P
+     included in its options.

+-    To ensure that new kernels and boot entries continue to extend the audit log events queue,
++    To ensure that new kernels and boot entries continue to enable poisoning of SLUB/SLAB objects,
+     add slub_debug=P to /etc/kernel/cmdline.
+ 
+ rationale: |-
+
+From 6a3f2f6bdc13188e780f0f3e4f829f6fa79351b2 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 12:06:56 +0200
+Subject: [PATCH 07/18] Add CCEs to zIPL argument rules
+
+---
+ .../system/bootloader-zipl/zipl_audit_argument/rule.yml     | 3 +++
+ .../zipl_audit_backlog_limit_argument/rule.yml              | 3 +++
+ .../bootloader-zipl/zipl_page_poison_argument/rule.yml      | 3 +++
+ .../guide/system/bootloader-zipl/zipl_pti_argument/rule.yml | 3 +++
+ .../bootloader-zipl/zipl_slub_debug_argument/rule.yml       | 3 +++
+ .../system/bootloader-zipl/zipl_vsyscall_argument/rule.yml  | 3 +++
+ 7 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+index 894bf7995f..b1307ef3f2 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+@@ -20,6 +20,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83321-0
++
+ ocil_clause: 'auditing is not enabled at boot time'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index 15729dc6b6..18391bee6c 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -19,6 +19,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83341-8
++
+ ocil_clause: 'audit backlog limit is not configured'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+index f5a36ee1b3..7ffea8ce6a 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+@@ -20,6 +20,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83351-7
++
+ ocil_clause: 'page allocator poisoning is not enabled'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+index 168dae46a1..6fd1082292 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+@@ -19,6 +19,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83361-6
++
+ ocil_clause: 'Kernel page-table isolation is not enabled'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index 83e043179d..c499140c35 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -20,6 +20,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83371-5
++
+ ocil_clause: 'SLUB/SLAB poisoning is not enabled'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index c37e8bbefd..7edd43074f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -17,6 +17,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83381-4
++
+ ocil_clause: 'vsyscalls are enabled'
+ 
+ ocil: |-
+
+From a7c33132a8d5f8cdf9c0d5f38b4910376ff1330b Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 14:36:28 +0200
+Subject: [PATCH 08/18] Select zipl BLS option rules in OSPP Profile
+
+These rules check and ensure configuration of BLS boot options used by
+zIPL.
+---
+ rhel8/profiles/ospp.profile | 8 ++++++++
+ rhel8/profiles/stig.profile | 6 ++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
+index 80e4b71fff..d3732fa805 100644
+--- a/rhel8/profiles/ospp.profile
++++ b/rhel8/profiles/ospp.profile
+@@ -419,3 +419,11 @@ selections:
+     # zIPl specific rules
+     - zipl_bls_entries_only
+     - zipl_bootmap_is_up_to_date
++    - zipl_audit_argument
++    - zipl_audit_backlog_limit_argument
++    - zipl_slub_debug_argument
++    - zipl_page_poison_argument
++    - zipl_vsyscall_argument
++    - zipl_vsyscall_argument.role=unscored
++    - zipl_vsyscall_argument.severity=info
++    - zipl_pti_argument
+diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
+index cfc2160be1..69d5222a32 100644
+--- a/rhel8/profiles/stig.profile
++++ b/rhel8/profiles/stig.profile
+@@ -49,3 +49,9 @@ selections:
+     # Unselect zIPL rules from OSPP
+     - "!zipl_bls_entries_only"
+     - "!zipl_bootmap_is_up_to_date"
++    - "!zipl_audit_argument"
++    - "!zipl_audit_backlog_limit_argument"
++    - "!zipl_page_poison_argument"
++    - "!zipl_pti_argument"
++    - "!zipl_slub_debug_argument"
++    - "!zipl_vsyscall_argument"
+
+From be070d56abed9efc9244b6c989d0a0df1f78b5ff Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 22:30:25 +0200
+Subject: [PATCH 09/18] Extend Profile resolution to undo rule refinements
+
+Just like rule selection, allows rule refinements to be unselected, or "undone".
+---
+ build-scripts/compile_profiles.py | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/build-scripts/compile_profiles.py b/build-scripts/compile_profiles.py
+index 0967252348..d1ce8984b2 100644
+--- a/build-scripts/compile_profiles.py
++++ b/build-scripts/compile_profiles.py
+@@ -3,6 +3,7 @@
+ import argparse
+ import sys
+ import os.path
++from copy import deepcopy
+ from glob import glob
+ 
+ import ssg.build_yaml
+@@ -36,7 +37,8 @@ def resolve(self, all_profiles):
+             updated_variables.update(self.variables)
+             self.variables = updated_variables
+ 
+-            updated_refinements = dict(extended_profile.refine_rules)
++            extended_refinements = deepcopy(extended_profile.refine_rules)
++            updated_refinements = self._subtract_refinements(extended_refinements)
+             updated_refinements.update(self.refine_rules)
+             self.refine_rules = updated_refinements
+ 
+@@ -50,6 +52,18 @@ def resolve(self, all_profiles):
+ 
+         self.resolved = True
+ 
++    def _subtract_refinements(self, extended_refinements):
++        """
++        Given a dict of rule refinements from the extended profile,
++        "undo" every refinement prefixed with '!' in this profile.
++        """
++        for rule, refinements in list(self.refine_rules.items()):
++            if rule.startswith("!"):
++                for prop, val in refinements:
++                    extended_refinements[rule[1:]].remove((prop, val))
++                del self.refine_rules[rule]
++        return extended_refinements
++
+ 
+ def create_parser():
+     parser = argparse.ArgumentParser()
+
+From 2ea270b1796139f42a1d56cbb31351b3f6ad3a6e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 9 Jul 2020 22:32:32 +0200
+Subject: [PATCH 10/18] Undo rule refinements done to zIPL rules
+
+Remove the zIPl rule refinementes from STIG profile
+---
+ rhel8/profiles/stig.profile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
+index 69d5222a32..53647475aa 100644
+--- a/rhel8/profiles/stig.profile
++++ b/rhel8/profiles/stig.profile
+@@ -55,3 +55,5 @@ selections:
+     - "!zipl_pti_argument"
+     - "!zipl_slub_debug_argument"
+     - "!zipl_vsyscall_argument"
++    - "!zipl_vsyscall_argument.role=unscored"
++    - "!zipl_vsyscall_argument.severity=info"
+
+From 90d62ba0cd088eb95aa151fe08a9c3c9fd959a00 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 09:38:57 +0200
+Subject: [PATCH 11/18] Update stable test for OSPP Profile
+
+I just copied the resolved profile to profile_stability directory.
+---
+ tests/data/profile_stability/rhel8/ospp.profile | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
+index 08dcccf24c..5aa3592496 100644
+--- a/tests/data/profile_stability/rhel8/ospp.profile
++++ b/tests/data/profile_stability/rhel8/ospp.profile
+@@ -168,6 +168,7 @@ selections:
+ - service_rngd_enabled
+ - service_systemd-coredump_disabled
+ - service_usbguard_enabled
++- ssh_client_rekey_limit
+ - sshd_disable_empty_passwords
+ - sshd_disable_gssapi_auth
+ - sshd_disable_kerb_auth
+@@ -213,8 +214,14 @@ selections:
+ - sysctl_user_max_user_namespaces
+ - timer_dnf-automatic_enabled
+ - usbguard_allow_hid_and_hub
++- zipl_audit_argument
++- zipl_audit_backlog_limit_argument
+ - zipl_bls_entries_only
+ - zipl_bootmap_is_up_to_date
++- zipl_page_poison_argument
++- zipl_pti_argument
++- zipl_slub_debug_argument
++- zipl_vsyscall_argument
+ - var_sshd_set_keepalive=0
+ - var_rekey_limit_size=1G
+ - var_rekey_limit_time=1hour
+@@ -238,11 +245,12 @@ selections:
+ - var_accounts_passwords_pam_faillock_deny=3
+ - var_accounts_passwords_pam_faillock_fail_interval=900
+ - var_accounts_passwords_pam_faillock_unlock_time=never
++- var_ssh_client_rekey_limit_size=1G
++- var_ssh_client_rekey_limit_time=1hour
+ - grub2_vsyscall_argument.role=unscored
+ - grub2_vsyscall_argument.severity=info
+ - sysctl_user_max_user_namespaces.role=unscored
+ - sysctl_user_max_user_namespaces.severity=info
+-- ssh_client_rekey_limit
+-- var_ssh_client_rekey_limit_size=1G
+-- var_ssh_client_rekey_limit_time=1hour
++- zipl_vsyscall_argument.role=unscored
++- zipl_vsyscall_argument.severity=info
+ title: Protection Profile for General Purpose Operating Systems
+
+From b5d5b0f1d4319663aba9f051fc01f5209234da6f Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 15:15:25 +0200
+Subject: [PATCH 12/18] zipl_bls_entries_option: Add test scenarios
+
+---
+ .../tests/correct_option.pass.sh                 | 16 ++++++++++++++++
+ .../tests/missing_in_cmdline.fail.sh             | 14 ++++++++++++++
+ .../tests/missing_in_entry.fail.sh               | 14 ++++++++++++++
+ 3 files changed, 44 insertions(+)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+new file mode 100644
+index 0000000000..a9bd49dd0b
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+@@ -0,0 +1,16 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++# Make sure boot loader entries contain audit=1
++for file in /boot/loader/entries/*.conf
++do
++    if ! grep -q '^options.*audit=1.*$' "$file" ; then
++        sed -i '/^options / s/$/audit=1/' "$file"
++    fi
++done
++
++# Make sure /etc/kernel/cmdline contains audit=1
++if ! grep -q '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
++    echo "audit=1" >> /etc/kernel/cmdline
++fi
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+new file mode 100644
+index 0000000000..d4d1d978c8
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++# Make sure boot loader entries contain audit=1
++for file in /boot/loader/entries/*.conf
++do
++    if ! grep -q '^options.*audit=1.*$' "$file" ; then
++        sed -i '/^options / s/$/audit=1/' "$file"
++    fi
++done
++
++# Make sure /etc/kernel/cmdline doesn't contain audit=1
++sed -Ei 's/(^.*)audit=1(.*?)$/\1\2/' /etc/kernel/cmdline || true
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+new file mode 100644
+index 0000000000..3e412c0542
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+@@ -0,0 +1,14 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++# Remove audit=1 from all boot entries
++sed -Ei 's/(^options.*\s)audit=1(.*?)$/\1\2/' /boot/loader/entries/*
++# But make sure one boot loader entry contains audit=1
++sed -i '/^options / s/$/audit=1/' /boot/loader/entries/*rescue.conf
++sed -Ei 's/(^options.*\s)\$kernelopts(.*?)$/\1\2/' /boot/loader/entries/*rescue.conf
++
++# Make sure /etc/kernel/cmdline contains audit=1
++if ! grep -q '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
++    echo "audit=1" >> /etc/kernel/cmdline
++fi
+
+From 3b52ab44e043adb289ef0a96798cffaf3e1f35a1 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 15:34:52 +0200
+Subject: [PATCH 13/18] zipl_bls_entries_option: Remove hardcoded values
+
+The template shouldn't have any hardcoded values.
+---
+ shared/templates/template_BASH_zipl_bls_entries_option | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/shared/templates/template_BASH_zipl_bls_entries_option b/shared/templates/template_BASH_zipl_bls_entries_option
+index 9fc8865486..dde8c948f7 100644
+--- a/shared/templates/template_BASH_zipl_bls_entries_option
++++ b/shared/templates/template_BASH_zipl_bls_entries_option
+@@ -7,6 +7,5 @@ grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
+ if [ ! -f /etc/kernel/cmdline ]; then
+     echo "{{{ ARG_NAME_VALUE }}}" >> /etc/kernel/cmdline
+ elif ! grep -q '^(.*\s)?{{{ ARG_NAME_VALUE }}}(\s.*)?$' /etc/kernel/cmdline; then
+-    echo " audit=1" >> /etc/kernel/cmdline
+-    sed -Ei 's/^(.*)$/\1 audit=1/' /etc/kernel/cmdline
++    sed -Ei 's/^(.*)$/\1 {{{ ARG_NAME_VALUE }}}/' /etc/kernel/cmdline
+ fi
+
+From 68bff71c7f60a7c68cf0bd9aa153f8a78ec02b7d Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 16:08:26 +0200
+Subject: [PATCH 14/18] Improve conditional check for the grubby command
+
+Let's not trust that /boot/loader/entries/ only contains *.conf files.
+Count the number of conf files and how many set the propper options.
+---
+ .../template_ANSIBLE_zipl_bls_entries_option       | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/shared/templates/template_ANSIBLE_zipl_bls_entries_option b/shared/templates/template_ANSIBLE_zipl_bls_entries_option
+index c0cb131b82..bccad2267c 100644
+--- a/shared/templates/template_ANSIBLE_zipl_bls_entries_option
++++ b/shared/templates/template_ANSIBLE_zipl_bls_entries_option
+@@ -6,18 +6,22 @@
+ 
+ - name: "Ensure BLS boot entries options contain {{{ ARG_NAME_VALUE }}}"
+   block:
+-    - name: "Check if any boot entry misses {{{ ARG_NAME_VALUE }}}"
++    - name: "Check how many boot entries exist "
++      find:
++        paths: "/boot/loader/entries/"
++        patterns: "*.conf"
++      register: n_entries
++
++    - name: "Check how many boot entries set {{{ ARG_NAME_VALUE }}}"
+       find:
+         paths: "/boot/loader/entries/"
+         contains: "^options .*{{{ ARG_NAME_VALUE }}}.*$"
+         patterns: "*.conf"
+-      register: entries_options
++      register: n_entries_options
+ 
+     - name: "Update boot entries options"
+       command: grubby --update-kernel=ALL --args="{{{ ARG_NAME_VALUE }}}"
+-      when: entries_options is defined and entries_options.examined != entries_options.matched
+-      # The conditional above assumes that only *.conf files are present in /boot/loader/entries
+-      # Then, the number of conf files is the same as examined files
++      when: n_entries is defined and n_entries_options is defined and n_entries.matched != n_entries_options.matched
+ 
+     - name: "Check if /etc/kernel/cmdline exists"
+       stat:
+
+From 79c60bb40288c17381bf1e4a84e6cfd300bd8446 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 16:17:27 +0200
+Subject: [PATCH 15/18] zipl_bls_entries_option: Fix sed in test scenario
+
+Append "audit=1" space from last option.
+---
+ .../zipl_audit_argument/tests/correct_option.pass.sh            | 2 +-
+ .../zipl_audit_argument/tests/missing_in_cmdline.fail.sh        | 2 +-
+ .../zipl_audit_argument/tests/missing_in_entry.fail.sh          | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+index a9bd49dd0b..5fcbcc5667 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+@@ -6,7 +6,7 @@
+ for file in /boot/loader/entries/*.conf
+ do
+     if ! grep -q '^options.*audit=1.*$' "$file" ; then
+-        sed -i '/^options / s/$/audit=1/' "$file"
++        sed -i '/^options / s/$/ audit=1/' "$file"
+     fi
+ done
+ 
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+index d4d1d978c8..b75165f904 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+@@ -6,7 +6,7 @@
+ for file in /boot/loader/entries/*.conf
+ do
+     if ! grep -q '^options.*audit=1.*$' "$file" ; then
+-        sed -i '/^options / s/$/audit=1/' "$file"
++        sed -i '/^options / s/$/ audit=1/' "$file"
+     fi
+ done
+ 
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+index 3e412c0542..e3d342d533 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+@@ -5,7 +5,7 @@
+ # Remove audit=1 from all boot entries
+ sed -Ei 's/(^options.*\s)audit=1(.*?)$/\1\2/' /boot/loader/entries/*
+ # But make sure one boot loader entry contains audit=1
+-sed -i '/^options / s/$/audit=1/' /boot/loader/entries/*rescue.conf
++sed -i '/^options / s/$/ audit=1/' /boot/loader/entries/*rescue.conf
+ sed -Ei 's/(^options.*\s)\$kernelopts(.*?)$/\1\2/' /boot/loader/entries/*rescue.conf
+ 
+ # Make sure /etc/kernel/cmdline contains audit=1
+
+From d513177d2cea39db364a0ff39a599ded36a25395 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 16:29:06 +0200
+Subject: [PATCH 16/18] Extend scenarios platform and allow remediation
+
+These test scenarios can be run on any OS that supports BLS and provides
+grubby.
+But it will evaluate to not applicable if the OS doesn't use zIPL (i.e.:
+has s390utils-base installed).
+---
+ .../zipl_audit_argument/tests/correct_option.pass.sh           | 3 +--
+ .../zipl_audit_argument/tests/missing_in_cmdline.fail.sh       | 3 +--
+ .../zipl_audit_argument/tests/missing_in_entry.fail.sh         | 3 +--
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+index 5fcbcc5667..73ed0eae0f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+@@ -1,6 +1,5 @@
+ #!/bin/bash
+-# platform = Red Hat Enterprise Linux 8
+-# remediation = none
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+ 
+ # Make sure boot loader entries contain audit=1
+ for file in /boot/loader/entries/*.conf
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+index b75165f904..3af83d30d8 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_cmdline.fail.sh
+@@ -1,6 +1,5 @@
+ #!/bin/bash
+-# platform = Red Hat Enterprise Linux 8
+-# remediation = none
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+ 
+ # Make sure boot loader entries contain audit=1
+ for file in /boot/loader/entries/*.conf
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+index e3d342d533..142f75ba60 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+@@ -1,6 +1,5 @@
+ #!/bin/bash
+-# platform = Red Hat Enterprise Linux 8
+-# remediation = none
++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8
+ 
+ # Remove audit=1 from all boot entries
+ sed -Ei 's/(^options.*\s)audit=1(.*?)$/\1\2/' /boot/loader/entries/*
+
+From 2e841722d30551c86f14558ff39bdaa5dda55711 Mon Sep 17 00:00:00 2001
+From: Watson Yuuma Sato 
+Date: Fri, 10 Jul 2020 16:35:55 +0200
+Subject: [PATCH 17/18] Update comment in OVAL zipl_bls_entries_option
+
+Co-authored-by: vojtapolasek 
+---
+ shared/templates/template_OVAL_zipl_bls_entries_option | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/shared/templates/template_OVAL_zipl_bls_entries_option b/shared/templates/template_OVAL_zipl_bls_entries_option
+index 9af1bcfbee..502d5e7d9a 100644
+--- a/shared/templates/template_OVAL_zipl_bls_entries_option
++++ b/shared/templates/template_OVAL_zipl_bls_entries_option
+@@ -7,7 +7,7 @@
+     
+     
+       
++      comment="Check if {{{ ARG_NAME_VALUE }}} is present in the 'options' line in /boot/loader/entries/*.conf" />
+       
+     
+
+From 9bd0afbde47ef368444ba1785da593980e6e00aa Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 10 Jul 2020 17:15:46 +0200
+Subject: [PATCH 18/18] zipl_bls_entries_option: Supress grep error messages
+
+/etc/kernel/cmdline is not always present. Lest suppress any error
+message about absent file in the test scenarios.
+---
+ .../zipl_audit_argument/tests/correct_option.pass.sh            | 2 +-
+ .../zipl_audit_argument/tests/missing_in_entry.fail.sh          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+index 73ed0eae0f..7a828837fe 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh
+@@ -10,6 +10,6 @@ do
+ done
+ 
+ # Make sure /etc/kernel/cmdline contains audit=1
+-if ! grep -q '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
++if ! grep -qs '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
+     echo "audit=1" >> /etc/kernel/cmdline
+ fi
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+index 142f75ba60..5650cc0a74 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/missing_in_entry.fail.sh
+@@ -8,6 +8,6 @@ sed -i '/^options / s/$/ audit=1/' /boot/loader/entries/*rescue.conf
+ sed -Ei 's/(^options.*\s)\$kernelopts(.*?)$/\1\2/' /boot/loader/entries/*rescue.conf
+ 
+ # Make sure /etc/kernel/cmdline contains audit=1
+-if ! grep -q '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
++if ! grep -qs '^(.*\s)?audit=1(\s.*)?$' /etc/kernel/cmdline ; then
+     echo "audit=1" >> /etc/kernel/cmdline
+ fi
diff --git a/SOURCES/scap-security-guide-0.1.52-reorganize-zipl-rules_PR_5888.patch b/SOURCES/scap-security-guide-0.1.52-reorganize-zipl-rules_PR_5888.patch
new file mode 100644
index 0000000..81d85cc
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.52-reorganize-zipl-rules_PR_5888.patch
@@ -0,0 +1,884 @@
+From 8cbec60a51b54df386bad72cdd82b83fbf9482fa Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 25 Jun 2020 18:29:31 +0200
+Subject: [PATCH 01/14] Add rule to check for zIPL conformance to BLS
+
+Instead of having each zIPL argument rule check for BLS compliance,
+let's split into its own rule.
+---
+ .../zipl_audit_argument/rule.yml              |  6 -----
+ .../rule.yml                                  |  6 -----
+ .../zipl_bls_entries_only/rule.yml            | 24 +++++++++++++++++++
+ .../zipl_enable_selinux/rule.yml              |  6 -----
+ .../zipl_page_poison_argument/rule.yml        |  6 -----
+ .../zipl_pti_argument/rule.yml                |  6 -----
+ .../zipl_slub_debug_argument/rule.yml         |  6 -----
+ .../zipl_vsyscall_argument/rule.yml           |  6 -----
+ 8 files changed, 24 insertions(+), 42 deletions(-)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+index 2d31ef8ee7..1211a53295 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To ensure all processes can be audited, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit=1
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to enable audit,
+@@ -30,10 +28,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable audit.
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index 40db232257..7d88e38686 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+@@ -31,10 +29,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that does not extend the log events queue.
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+new file mode 100644
+index 0000000000..b6ccbb5343
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+@@ -0,0 +1,24 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'Ensure all zIPL boot entries are BLS compliant'
++
++description: |-
++    Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS)
++    by checking that /etc/zipl.conf doesn't contain image = .
++
++rationale: |-
++    {{{ full_name }}} adheres to Boot Loader Specification (BLS) and is the prefered method of
++    configuration.
++
++severity: medium
++
++ocil_clause: 'a non BLS boot entry is configured'
++
++ocil: |-
++  Check that no boot image file is specified in /etc/zipl.conf:
++  
grep -R "^image\s*=" /etc/zipl.conf

++  No line should be returned, if a line is returned non BLS compliant boot entries are configured for zIPL.
++
++platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+index 8d28d5495f..1c3bfeb246 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To ensure SELinux is not disabled at boot time,
+     check that no boot entry in /boot/loader/entries/*.conf has selinux=0
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+ rationale: |-
+@@ -27,10 +25,6 @@ ocil: |-
+     
sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf

+     No line should be returned, each line returned is a boot entry that disables SELinux.
+ 
+-    Check that no image file is specified in /etc/zipl.conf:
+-    
grep -R "^image\s*=" /etc/zipl.conf

+-    No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+     And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+     and /etc/zipl.conf:
+     
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+index 0a8e9a41e2..6dbfd501b7 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable poisoning of free pages,
+     check that all boot entries in /boot/loader/entries/*.conf have page_poison=1
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.

+ 
+     To ensure that new kernels and boot entries continue to enable page poisoning,
+@@ -31,10 +29,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable page poisoning.
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+index 20c1448cc8..555fdf2b66 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable Kernel page-table isolation,
+     check that all boot entries in /boot/loader/entries/*.conf have pti=on
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to enable page-table isolation,
+@@ -30,10 +28,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index 54ac688ea0..dd7865bf81 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable poisoning of SLUB/SLAB objects,
+     check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+@@ -31,10 +29,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that does not enable poisoning.
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index c5979a2016..18b7ade460 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To disable use of virtual syscalls,
+     check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none
+     included in its options.

+-    Make sure /etc/zipl.conf doesn't contain image =  setting,
+-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

+     And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to disable virtual syscalls,
+@@ -28,10 +26,6 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls.
+ 
+-  Check that no image file is specified in /etc/zipl.conf:
+-  
grep -R "^image\s*=" /etc/zipl.conf

+-  No line should be returned, if a line is returned zipl may load a different kernel than intended.
+-
+   And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+   and /etc/zipl.conf:
+   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+
+From 5e3b19077d781d0441595019429c653efafede8e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 2 Jul 2020 09:52:39 +0200
+Subject: [PATCH 02/14] zipl_bls_entries_only: Add OVAL and tests
+
+---
+ .../zipl_bls_entries_only/oval/shared.xml     | 27 +++++++++++++++++++
+ .../tests/image_configured.fail.sh            |  6 +++++
+ .../tests/no_image.pass.sh                    |  7 +++++
+ 3 files changed, 40 insertions(+)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+new file mode 100644
+index 0000000000..41e9773814
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+@@ -0,0 +1,27 @@
++
++  
++    
++      Ensure zIPL entries are BLS compliant
++      {{{- oval_affected(products) }}}
++      Check if /etc/zipl.conf configures any boot entry
++    
++    
++      
++    
++  
++
++  
++    
++  
++
++  
++    ^/etc/zipl.conf$
++    ^image\s*=.*$
++    1
++  
++
++
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh
+new file mode 100644
+index 0000000000..e3adb99638
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh
+@@ -0,0 +1,6 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++# Make sure no image configured in zipl config file
++echo 'image = /boot/image' >> /etc/zipl.conf
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh
+new file mode 100644
+index 0000000000..47626442f6
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++# Make sure no image configured in zipl config file
++sed -Ei '/^image\s*=/d' /etc/zipl.conf
++true
+
+From 05e5b05b41080b7fbfaf42469cbb366eeffe35ec Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 2 Jul 2020 11:09:08 +0200
+Subject: [PATCH 03/14] zipl_bls_entries_only: Add no-remediation warning
+
+Automated remediation to remove non-BLS boot entries from /etc/zipl.conf
+is tricky and can lead to broken entries or removal of all of them.
+---
+ .../system/bootloader-zipl/zipl_bls_entries_only/rule.yml    | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+index b6ccbb5343..f792c5257f 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+@@ -22,3 +22,8 @@ ocil: |-
+   No line should be returned, if a line is returned non BLS compliant boot entries are configured for zIPL.
+ 
+ platform: machine
++
++warnings:
++  - general: |-
++      To prevent breakage or removal of all boot entries oconfigured in /etc/zipl.conf
++      automated remediation for this rule is not available.
+
+From 53d811ed09cd63d4472a2133f3d9dc465dbd2962 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 25 Jun 2020 18:51:04 +0200
+Subject: [PATCH 04/14] Add rule to check hotness of zIPL bootmap
+
+Instead of having each zIPL argument rule check if zIPL bootmap is up to
+date, let's split it into its own rule.
+---
+ .../zipl_audit_argument/rule.yml              |  6 -----
+ .../rule.yml                                  |  7 -----
+ .../zipl_bootmap_is_up_to_date/rule.yml       | 27 +++++++++++++++++++
+ .../zipl_enable_selinux/rule.yml              |  6 -----
+ .../zipl_page_poison_argument/rule.yml        |  7 -----
+ .../zipl_pti_argument/rule.yml                |  7 -----
+ .../zipl_slub_debug_argument/rule.yml         |  7 -----
+ .../zipl_vsyscall_argument/rule.yml           |  7 -----
+ 8 files changed, 27 insertions(+), 47 deletions(-)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+index 1211a53295..624b4e7041 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml
+@@ -8,7 +8,6 @@ description: |-
+     To ensure all processes can be audited, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit=1
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+ 
+     To ensure that new kernels and boot entries continue to enable audit,
+     add audit=1 to /etc/kernel/cmdline.
+@@ -28,9 +27,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable audit.
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+index 7d88e38686..faf114591a 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,
+     check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+-
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+     add audit_backlog_limit=8192 to /etc/kernel/cmdline.
+ 
+@@ -29,9 +27,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that does not extend the log events queue.
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
+new file mode 100644
+index 0000000000..082562d11e
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
+@@ -0,0 +1,27 @@
++documentation_complete: true
++
++prodtype: rhel8
++
++title: 'Ensure zIPL bootmap is up to date'
++
++description: |-
++    Make sure that /boot/bootmap is up to date.

++    Every time a boot entry or zIPL configuration is changed /boot/bootmap needs to
++    be updated to reflect the changes.

++    Run zipl command to generate an updated /boot/bootmap.
++
++rationale: |-
++    The file /boot/bootmap contains all boot data, keeping it up to date is crucial to
++    boot correct kernel and options.
++
++severity: medium
++
++ocil_clause: 'the bootmap is outdated'
++
++ocil: |-
++  Make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
++  and /etc/zipl.conf:
++  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

++  No line should be returned, if a line is returned /boot/bootmap is outdated and needs to be regenerated.
++
++platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+index 1c3bfeb246..b0bc0fc374 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml
+@@ -8,7 +8,6 @@ description: |-
+     To ensure SELinux is not disabled at boot time,
+     check that no boot entry in /boot/loader/entries/*.conf has selinux=0
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+ 
+ rationale: |-
+     Disabling a major host protection feature, such as SELinux, at boot time prevents
+@@ -25,9 +24,4 @@ ocil: |-
+     
sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf

+     No line should be returned, each line returned is a boot entry that disables SELinux.
+ 
+-    And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-    and /etc/zipl.conf:
+-    
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-    No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+index 6dbfd501b7..866664c01b 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable poisoning of free pages,
+     check that all boot entries in /boot/loader/entries/*.conf have page_poison=1
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.

+-
+     To ensure that new kernels and boot entries continue to enable page poisoning,
+     add page_poison=1 to /etc/kernel/cmdline.
+ 
+@@ -29,9 +27,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable page poisoning.
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+index 555fdf2b66..2f02d9668c 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable Kernel page-table isolation,
+     check that all boot entries in /boot/loader/entries/*.conf have pti=on
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+-
+     To ensure that new kernels and boot entries continue to enable page-table isolation,
+     add pti=on to /etc/kernel/cmdline.
+ 
+@@ -28,9 +26,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+index dd7865bf81..0cb10d3cd8 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To enable poisoning of SLUB/SLAB objects,
+     check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+-
+     To ensure that new kernels and boot entries continue to extend the audit log events queue,
+     add slub_debug=P to /etc/kernel/cmdline.
+ 
+@@ -29,9 +27,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that does not enable poisoning.
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+index 18b7ade460..f79adeb083 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml
+@@ -8,8 +8,6 @@ description: |-
+     To disable use of virtual syscalls,
+     check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none
+     included in its options.

+-    And run zipl command so that /boot/bootmap is updated.


+-
+     To ensure that new kernels and boot entries continue to disable virtual syscalls,
+     add vsyscall=none to /etc/kernel/cmdline.
+ 
+@@ -26,9 +24,4 @@ ocil: |-
+   
sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf

+   No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls.
+ 
+-  And make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf
+-  and /etc/zipl.conf:
+-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+-  No line should be returned, if a line is returned /boot/bootmap needs to be regenerated.
+-
+ platform: machine
+
+From b9f27383a09afbc6cef61bbbaad0f18f9ebec075 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 2 Jul 2020 15:59:31 +0200
+Subject: [PATCH 05/14] zipl_bootmap_is_up_to_date: Add OVAL check
+
+---
+ .../oval/shared.xml                           | 46 +++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml
+new file mode 100644
+index 0000000000..6c446cbe59
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml
+@@ -0,0 +1,46 @@
++
++  
++    
++      Ensure zIPL bootmap is up to date
++      {{{- oval_affected(products) }}}
++      Check if /boot/bootmap is up to date
++    
++    
++      
++    
++  
++
++  
++    
++    
++    
++  
++
++  
++    /boot/bootmap
++  
++
++  
++  
++    
++  
++  
++    
++  
++  
++    /etc/zipl.conf
++  
++
++  
++    
++  
++  
++    
++  
++  
++    ^/boot/loader/entries/.*\.conf$
++  
++
+
+From 97aff87a403f9b319e87967561c43dc99e8a672e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 2 Jul 2020 16:15:35 +0200
+Subject: [PATCH 06/14] zipl_bootmap_is_up_to_date: Add mock tests
+
+These tests mock existence of zIPL files.
+---
+ .../tests/newer_boot_entry.fail.sh                     | 10 ++++++++++
+ .../tests/newer_zipl_conf.fail.sh                      | 10 ++++++++++
+ .../tests/up_to_date.pass.sh                           |  9 +++++++++
+ 3 files changed, 29 insertions(+)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh
+new file mode 100644
+index 0000000000..728c6b7bdb
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh
+@@ -0,0 +1,10 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++touch /etc/zipl.conf
++touch /boot/loader/entries/*.conf # Update current existing entries
++touch /boot/loader/entries/zipl-entry-1.conf
++touch /boot/bootmap
++sleep 2
++touch /boot/loader/entries/zipl-entry-2.conf
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh
+new file mode 100644
+index 0000000000..1ae4d631ee
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh
+@@ -0,0 +1,10 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++touch /boot/loader/entries/*.conf # Update current existing entries
++touch /boot/loader/entries/zipl-entry-1.conf
++touch /boot/loader/entries/zipl-entry-2.conf
++touch /boot/bootmap
++sleep 2
++touch /etc/zipl.conf
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh
+new file mode 100644
+index 0000000000..7981ba8c5c
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh
+@@ -0,0 +1,9 @@
++#!/bin/bash
++# platform = Red Hat Enterprise Linux 8
++# remediation = none
++
++touch /etc/zipl.conf
++touch /boot/loader/entries/*.conf # Update current existing entries
++touch /boot/loader/entries/zipl-entry-1.conf
++touch /boot/loader/entries/zipl-entry-2.conf
++touch /boot/bootmap
+
+From 180e57bd23154c1ed8dc2575fbf9660c2f83a803 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 3 Jul 2020 18:35:06 +0200
+Subject: [PATCH 07/14] zipl_bootmap_is_up_to_date: Add remediations
+
+---
+ .../ansible/shared.yml                        | 24 +++++++++++++++++++
+ .../zipl_bootmap_is_up_to_date/bash/shared.sh |  3 +++
+ 2 files changed, 27 insertions(+)
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml
+ create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml
+new file mode 100644
+index 0000000000..e545eacc13
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml
+@@ -0,0 +1,24 @@
++# platform = Red Hat Enterprise Linux 8
++# reboot = false
++# strategy = configure
++# complexity = low
++# disruption = low
++
++- name: "Ensure zIPL bootmap is up to date"
++  block:
++    - name: "Obtain stats of /boot/bootmap"
++      stat:
++        path: /boot/bootmap
++      register: boot_bootmap
++
++    - name: "Obtain stats of /etc/zipl.conf"
++      stat:
++        path: /etc/zipl.conf
++      register: zipl_conf
++
++    # TODO: handle /boot/loader/entries/*.conf
++
++    - name: "Update zIPL bootmap"
++      command: /usr/sbin/zipl
++      changed_when: True
++      when: boot_bootmap.stat.mtime < zipl_conf.stat.mtime
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
+new file mode 100644
+index 0000000000..2cf7e388f0
+--- /dev/null
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
+@@ -0,0 +1,3 @@
++# platform = Red Hat Enterprise Linux 8
++
++/usr/bin/zipl
+
+From 93703727b12a34edb26de25410bf23ff72fead2a Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 1 Jul 2020 17:16:41 +0200
+Subject: [PATCH 08/14] Select zIPL specific rules in OSPP profile
+
+---
+ rhel8/profiles/ospp.profile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
+index 07d32b814d..80e4b71fff 100644
+--- a/rhel8/profiles/ospp.profile
++++ b/rhel8/profiles/ospp.profile
+@@ -415,3 +415,7 @@ selections:
+     - ssh_client_rekey_limit
+     - var_ssh_client_rekey_limit_size=1G
+     - var_ssh_client_rekey_limit_time=1hour
++
++    # zIPl specific rules
++    - zipl_bls_entries_only
++    - zipl_bootmap_is_up_to_date
+
+From 260891e9b2f38d50fadf9eaacd9ee9ca98c977ee Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 14:03:21 +0200
+Subject: [PATCH 09/14] Fix path to zipl binary in Bash remediation
+
+---
+ .../bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh   | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
+index 2cf7e388f0..2310ca060d 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh
+@@ -1,3 +1,3 @@
+ # platform = Red Hat Enterprise Linux 8
+ 
+-/usr/bin/zipl
++/usr/sbin/zipl
+
+From 46d2b1584cf769ae8dbaaa2657541bd0db056a9c Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 14:06:22 +0200
+Subject: [PATCH 10/14] zipl_bls_entries_only: there can be leading spaces
+
+There can be leading spaces before 'image'.
+---
+ .../bootloader-zipl/zipl_bls_entries_only/oval/shared.xml       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+index 41e9773814..f68d91c128 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+@@ -20,7 +20,7 @@
+   
+     ^/etc/zipl.conf$
+-    ^image\s*=.*$
++    ^\s*image\s*=.*$
+     1
+   
+ 
+
+From 0a89ed181803c15e3b73cfb2e13f0ec1cb7689ad Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 14:10:22 +0200
+Subject: [PATCH 11/14] zipl_bls_entries_only: check file /etc/zipl.conf
+
+There is no need to perform pattern match, the check just needs to
+examine /etc/zipl.conf file.
+---
+ .../bootloader-zipl/zipl_bls_entries_only/oval/shared.xml       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+index f68d91c128..1ebf03ee37 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml
+@@ -19,7 +19,7 @@
+ 
+   
+-    ^/etc/zipl.conf$
++    /etc/zipl.conf
+     ^\s*image\s*=.*$
+     1
+   
+
+From 699d5f5bd3075e019387e6fb6b3af81182987c43 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 14:13:26 +0200
+Subject: [PATCH 12/14] Add CCE identifiers to bootmap and bls only rules
+
+Add RHEL-8 CCE identifiers for:
+- zipl_bls_entries_only
+- zipl_bootmap_is_up_to_date
+---
+ .../system/bootloader-zipl/zipl_bls_entries_only/rule.yml      | 3 +++
+ .../system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml | 3 +++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+index f792c5257f..67cc061ce3 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml
+@@ -14,6 +14,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83485-3
++
+ ocil_clause: 'a non BLS boot entry is configured'
+ 
+ ocil: |-
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
+index 082562d11e..da9411d00b 100644
+--- a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
++++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml
+@@ -16,6 +16,9 @@ rationale: |-
+ 
+ severity: medium
+ 
++identifiers:
++    cce@rhel8: 83486-1
++
+ ocil_clause: 'the bootmap is outdated'
+ 
+ ocil: |-
+
+From 2ebc3d188e4c243d8e60a9e669d5b661b77f2301 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 14:16:58 +0200
+Subject: [PATCH 13/14] Incorporate OSPP selection changes to profile test
+
+Update the profile reference file.
+---
+ tests/data/profile_stability/rhel8/ospp.profile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
+index b0d7672c36..08dcccf24c 100644
+--- a/tests/data/profile_stability/rhel8/ospp.profile
++++ b/tests/data/profile_stability/rhel8/ospp.profile
+@@ -213,6 +213,8 @@ selections:
+ - sysctl_user_max_user_namespaces
+ - timer_dnf-automatic_enabled
+ - usbguard_allow_hid_and_hub
++- zipl_bls_entries_only
++- zipl_bootmap_is_up_to_date
+ - var_sshd_set_keepalive=0
+ - var_rekey_limit_size=1G
+ - var_rekey_limit_time=1hour
+
+From 33bae25bd543880315433925214868917ec8e399 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Wed, 8 Jul 2020 15:28:09 +0200
+Subject: [PATCH 14/14] Unselect zIPL rules from STIG Profile
+
+The zIPL rules are inherited from OSPP profile
+---
+ rhel8/profiles/stig.profile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
+index 8f12852e26..cfc2160be1 100644
+--- a/rhel8/profiles/stig.profile
++++ b/rhel8/profiles/stig.profile
+@@ -45,3 +45,7 @@ selections:
+     - rsyslog_remote_tls
+     - rsyslog_remote_tls_cacert
+     - "!ssh_client_rekey_limit"
++
++    # Unselect zIPL rules from OSPP
++    - "!zipl_bls_entries_only"
++    - "!zipl_bootmap_is_up_to_date"
diff --git a/SOURCES/scap-security-guide-0.1.53-add-ansible-platform_PR_6025.patch b/SOURCES/scap-security-guide-0.1.53-add-ansible-platform_PR_6025.patch
new file mode 100644
index 0000000..9154e40
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-add-ansible-platform_PR_6025.patch
@@ -0,0 +1,280 @@
+From 844be904d8de624abe9bbe620d7a06417dfff842 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 27 Aug 2020 13:19:01 +0200
+Subject: [PATCH 1/5] Align Ansible task applicability with CPE platform
+
+Adds a when clause to Ansible snippets of rules with Package CPE platform.
+
+If the when clause is added, a fact_packages Task needs to added as
+well.
+---
+ ssg/build_remediations.py | 52 ++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 49 insertions(+), 3 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index a9ef3014ac..597aed5889 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -6,8 +6,7 @@
+ import os.path
+ import re
+ import codecs
+-from collections import defaultdict, namedtuple
+-
++from collections import defaultdict, namedtuple, OrderedDict
+ 
+ import ssg.yaml
+ from . import build_yaml
+@@ -343,11 +342,46 @@ def _get_rule_reference(self, ref_class):
+         else:
+             return []
+ 
++    def inject_package_facts_task(self, parsed_snippet):
++        """ Injects a package_facts task only if
++            the snippet has a task with a when clause with ansible_facts.packages,
++            and the snippet doesn't already have an package_facts task
++        """
++        has_package_facts_task = False
++        has_ansible_facts_packages_clause = False
++
++        for p_task in parsed_snippet:
++            # We are only interested in the OrderedDicts, which represent Ansible tasks
++            if not isinstance(p_task, dict):
++                continue
++
++            if "package_facts" in p_task:
++                has_package_facts_task = True
++
++            if "ansible_facts.packages" in p_task.get("when", ""):
++                has_ansible_facts_packages_clause = True
++
++        if has_ansible_facts_packages_clause and not has_package_facts_task:
++            facts_task = OrderedDict({'name': 'Gather the package facts',
++                                      'package_facts': {'manager': 'auto'}})
++            parsed_snippet.insert(0, facts_task)
++
+     def update_when_from_rule(self, to_update):
+         additional_when = ""
+-        if self.associated_rule.platform == "machine":
+-            additional_when = ('ansible_virtualization_role != "guest" '
+-                               'or ansible_virtualization_type != "docker"')
++        rule_platform = self.associated_rule.platform
++        if rule_platform == "machine":
++            additional_when = 'ansible_virtualization_type not in ["docker", "lxc", "openvz"]'
++        elif rule_platform is not None:
++            # Assume any other platform is a Package CPE
++
++            # It doesn't make sense to add a conditional on the task that
++            # gathers data for the conditional
++            if "package_facts" in to_update:
++                return
++
++            additional_when = '"' + rule_platform + '" in ansible_facts.packages'
++            # After adding the conditional, we need to make sure package_facts are collected.
++            # This is done via inject_package_facts_task()
+         to_update.setdefault("when", "")
+         new_when = ssg.yaml.update_yaml_list_or_string(to_update["when"], additional_when)
+         if not new_when:
+@@ -355,10 +390,21 @@ def update_when_from_rule(self, to_update):
+             to_update["when"] = new_when
+ 
+     def update(self, parsed, config):
++        # We split the remediation update in three steps
++
++        # 1. Update the when clause
+         for p in parsed:
+             if not isinstance(p, dict):
+                 continue
+             self.update_when_from_rule(p)
++
++        # 2. Inject any extra task necessary
++        self.inject_package_facts_task(parsed)
++
++        # 3. Add tags to all tasks, including the ones we have injected
++        for p in parsed:
++            if not isinstance(p, dict):
++                continue
+             self.update_tags_from_config(p, config)
+             self.update_tags_from_rule(p)
+ 
+
+From 60e5723e0e35ec8d79bafdd113f04691e61738e7 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 27 Aug 2020 17:09:06 +0200
+Subject: [PATCH 2/5] Add inherited_platform to Rule
+
+This field is exported to the rule when it is resolved.
+---
+ ssg/build_yaml.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/ssg/build_yaml.py b/ssg/build_yaml.py
+index 4ba114eee4..fe290ffc05 100644
+--- a/ssg/build_yaml.py
++++ b/ssg/build_yaml.py
+@@ -832,6 +832,7 @@ class Rule(object):
+         "conflicts": lambda: list(),
+         "requires": lambda: list(),
+         "platform": lambda: None,
++        "inherited_platforms": lambda: list(),
+         "template": lambda: None,
+     }
+ 
+@@ -851,6 +852,7 @@ def __init__(self, id_):
+         self.requires = []
+         self.conflicts = []
+         self.platform = None
++        self.inherited_platforms = [] # platforms inherited from the group
+         self.template = None
+ 
+     @classmethod
+@@ -1293,6 +1295,9 @@ def _process_rules(self):
+                 continue
+             self.all_rules.add(rule)
+             self.loaded_group.add_rule(rule)
++
++            rule.inherited_platforms.append(self.loaded_group.platform)
++
+             if self.resolved_rules_dir:
+                 output_for_rule = os.path.join(
+                     self.resolved_rules_dir, "{id_}.yml".format(id_=rule.id_))
+
+From 3a0bb0d2981670e90a8eaca53b28e1a6f7cc29d6 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 27 Aug 2020 17:21:35 +0200
+Subject: [PATCH 3/5] Add when clauses for inherited platforms too
+
+Consider the Rule's Group platform while including 'when' clauses to
+Ansible snippets.
+
+Some rules have two platforms, a machine platform and a package
+platform. One of them is represented of the Rule, and the other is
+represented in the Rule's Group.
+
+The platforms are organized like this to due limiation in XCCDF,
+multiple platforms in a Rule are ORed, not ANDed.
+---
+ ssg/build_remediations.py | 44 ++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 17 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 597aed5889..a2a996d0af 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -358,8 +358,13 @@ def inject_package_facts_task(self, parsed_snippet):
+             if "package_facts" in p_task:
+                 has_package_facts_task = True
+ 
+-            if "ansible_facts.packages" in p_task.get("when", ""):
+-                has_ansible_facts_packages_clause = True
++            # When clause of the task can be string or a list, lets normalize to list
++            task_when = p_task.get("when", "")
++            if type(task_when) is str:
++                task_when = [ task_when ]
++            for when in task_when:
++                if "ansible_facts.packages" in when:
++                    has_ansible_facts_packages_clause = True
+ 
+         if has_ansible_facts_packages_clause and not has_package_facts_task:
+             facts_task = OrderedDict({'name': 'Gather the package facts',
+@@ -367,21 +372,26 @@ def inject_package_facts_task(self, parsed_snippet):
+             parsed_snippet.insert(0, facts_task)
+ 
+     def update_when_from_rule(self, to_update):
+-        additional_when = ""
+-        rule_platform = self.associated_rule.platform
+-        if rule_platform == "machine":
+-            additional_when = 'ansible_virtualization_type not in ["docker", "lxc", "openvz"]'
+-        elif rule_platform is not None:
+-            # Assume any other platform is a Package CPE
+-
+-            # It doesn't make sense to add a conditional on the task that
+-            # gathers data for the conditional
+-            if "package_facts" in to_update:
+-                return
+-
+-            additional_when = '"' + rule_platform + '" in ansible_facts.packages'
+-            # After adding the conditional, we need to make sure package_facts are collected.
+-            # This is done via inject_package_facts_task()
++        additional_when = []
++
++        rule_platforms = set([self.associated_rule.platform] +
++                              self.associated_rule.inherited_platforms)
++
++        for platform in rule_platforms:
++            if platform == "machine":
++                additional_when.append('ansible_virtualization_type not in ["docker", "lxc", "openvz"]')
++            elif platform is not None:
++                # Assume any other platform is a Package CPE
++
++                # It doesn't make sense to add a conditional on the task that
++                # gathers data for the conditional
++                if "package_facts" in to_update:
++                    continue
++
++                additional_when.append('"' + platform + '" in ansible_facts.packages')
++                # After adding the conditional, we need to make sure package_facts are collected.
++                # This is done via inject_package_facts_task()
++
+         to_update.setdefault("when", "")
+         new_when = ssg.yaml.update_yaml_list_or_string(to_update["when"], additional_when)
+         if not new_when:
+
+From 99c92e39bccc3fcfadca41096e66ca146137b207 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Mon, 31 Aug 2020 16:06:14 +0200
+Subject: [PATCH 4/5] Improve inherihted and rule's platforms handling
+
+Add a quick comment too.
+---
+ ssg/build_remediations.py | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index a2a996d0af..9e622ef740 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -374,8 +374,9 @@ def inject_package_facts_task(self, parsed_snippet):
+     def update_when_from_rule(self, to_update):
+         additional_when = []
+ 
+-        rule_platforms = set([self.associated_rule.platform] +
+-                              self.associated_rule.inherited_platforms)
++        # There can be repeated inherited platforms and rule platforms
++        rule_platforms = set(self.associated_rule.inherited_platforms)
++        rule_platforms.add(self.associated_rule.platform)
+ 
+         for platform in rule_platforms:
+             if platform == "machine":
+
+From 596da9993edfbd244cbaa6d797abbd68b2e82185 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Mon, 31 Aug 2020 16:10:53 +0200
+Subject: [PATCH 5/5] Code style and grammar changes
+
+---
+ ssg/build_remediations.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 9e622ef740..866450dd8c 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -345,7 +345,7 @@ def _get_rule_reference(self, ref_class):
+     def inject_package_facts_task(self, parsed_snippet):
+         """ Injects a package_facts task only if
+             the snippet has a task with a when clause with ansible_facts.packages,
+-            and the snippet doesn't already have an package_facts task
++            and the snippet doesn't already have a package_facts task
+         """
+         has_package_facts_task = False
+         has_ansible_facts_packages_clause = False
+@@ -361,7 +361,7 @@ def inject_package_facts_task(self, parsed_snippet):
+             # When clause of the task can be string or a list, lets normalize to list
+             task_when = p_task.get("when", "")
+             if type(task_when) is str:
+-                task_when = [ task_when ]
++                task_when = [task_when]
+             for when in task_when:
+                 if "ansible_facts.packages" in when:
+                     has_ansible_facts_packages_clause = True
diff --git a/SOURCES/scap-security-guide-0.1.53-add-bash-platform_PR_6061.patch b/SOURCES/scap-security-guide-0.1.53-add-bash-platform_PR_6061.patch
new file mode 100644
index 0000000..f1510d8
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-add-bash-platform_PR_6061.patch
@@ -0,0 +1,241 @@
+From c05cce1a4a5eb95be857b07948fda0c95cdaa106 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 8 Sep 2020 14:36:07 +0200
+Subject: [PATCH 1/5] Align Bash applicability with CPE platform
+
+Wraps the remediation of rules with Packager CPE Platform
+with an if condition that checks for the respective
+platforms's package.
+---
+ ssg/build_remediations.py | 45 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index ccbdf9fc1f..2d4a805e78 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -27,6 +27,13 @@
+     'kubernetes': '.yml'
+ }
+ 
++PKG_MANAGER_TO_PACKAGE_CHECK_COMMAND = {
++    'apt_get': 'dpkg-query -s {} &>/dev/null',
++    'dnf': 'rpm --quiet -q {}',
++    'yum': 'rpm --quiet -q {}',
++    'zypper': 'rpm --quiet -q {}',
++}
++
+ FILE_GENERATED_HASH_COMMENT = '# THIS FILE IS GENERATED'
+ 
+ REMEDIATION_CONFIG_KEYS = ['complexity', 'disruption', 'platform', 'reboot',
+@@ -262,6 +269,44 @@ class BashRemediation(Remediation):
+     def __init__(self, file_path):
+         super(BashRemediation, self).__init__(file_path, "bash")
+ 
++    def parse_from_file_with_jinja(self, env_yaml):
++        self.local_env_yaml.update(env_yaml)
++        result = super(BashRemediation, self).parse_from_file_with_jinja(self.local_env_yaml)
++
++        # There can be repeated inherited platforms and rule platforms
++        rule_platforms = set(self.associated_rule.inherited_platforms)
++        rule_platforms.add(self.associated_rule.platform)
++
++        platform_conditionals = []
++        for platform in rule_platforms:
++            if platform == "machine":
++                # Based on check installed_env_is_a_container
++                platform_conditionals.append('[ ! -f /.dockerenv -a ! -f /run/.containerenv ]')
++            elif platform is not None:
++                # Assume any other platform is a Package CPE
++
++                # Some package names are different from the platform names
++                if platform in self.local_env_yaml["platform_package_overrides"]:
++                    platform = self.local_env_yaml["platform_package_overrides"].get(platform)
++
++                # Adjust package check command according to the pkg_manager
++                pkg_manager = self.local_env_yaml["pkg_manager"]
++                pkg_check_command = PKG_MANAGER_TO_PACKAGE_CHECK_COMMAND[pkg_manager]
++                platform_conditionals.append(pkg_check_command.format(platform))
++
++        if platform_conditionals:
++            platform_fix_text = "# Remediation is applicable only in certain platforms\n"
++
++            cond = platform_conditionals.pop(0)
++            platform_fix_text += "if {}".format(cond)
++            for cond in platform_conditionals:
++                platform_fix_text += " && {}".format(cond)
++            platform_fix_text += '; then\n{}\nelse\necho "Remediation is not applicable, nothing was done"\nfi'.format(result.contents)
++
++            remediation = namedtuple('remediation', ['contents', 'config'])
++            result = remediation(contents=platform_fix_text, config=result.config)
++
++        return result
+ 
+ class AnsibleRemediation(Remediation):
+     def __init__(self, file_path):
+
+From 19e0c3b709e091159655d37b8ce5d693750f0a81 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 8 Sep 2020 14:41:01 +0200
+Subject: [PATCH 2/5] Handle Bash platform wrapping in xccdf expansion
+
+Adjust expansion of subs and variables not to remove the whole beginning
+of the fix test. This was removing the package conditional wrapping.
+---
+ ssg/build_remediations.py | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 2d4a805e78..49ec557000 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -736,14 +736,16 @@ def expand_xccdf_subs(fix, remediation_type, remediation_functions):
+         patcomp = re.compile(pattern, re.DOTALL)
+         fixparts = re.split(patcomp, fix.text)
+         if fixparts[0] is not None:
+-            # Split the portion of fix.text from fix start to first call of
+-            # remediation function, keeping only the third part:
+-            # * tail        to hold part of the fix.text after inclusion,
+-            #               but before first call of remediation function
++            # Split the portion of fix.text at the string remediation_functions,
++            # and remove preceeding comment whenever it is there.
++            # * head        holds part of the fix.text before
++            #               remediation_functions string
++            # * tail        holds part of the fix.text after the
++            #               remediation_functions string
+             try:
+-                rfpattern = '(.*remediation_functions)(.*)'
+-                rfpatcomp = re.compile(rfpattern, re.DOTALL)
+-                _, _, tail, _ = re.split(rfpatcomp, fixparts[0], maxsplit=2)
++                rfpattern = r'((?:# Include source function library\.\n)?.*remediation_functions)'
++                rfpatcomp = re.compile(rfpattern)
++                head, _, tail = re.split(rfpatcomp, fixparts[0], maxsplit=1)
+             except ValueError:
+                 sys.stderr.write("Processing fix.text for: %s rule\n"
+                                  % fix.get('rule'))
+@@ -751,9 +753,10 @@ def expand_xccdf_subs(fix, remediation_type, remediation_functions):
+                                  "after inclusion of remediation functions."
+                                  " Aborting..\n")
+                 sys.exit(1)
+-            # If the 'tail' is not empty, make it new fix.text.
++            # If the 'head' is not empty, make it new fix.text.
+             # Otherwise use ''
+-            fix.text = tail if tail is not None else ''
++            fix.text = head if head is not None else ''
++            fix.text += tail if tail is not None else ''
+             # Drop the first element of 'fixparts' since it has been processed
+             fixparts.pop(0)
+             # Perform sanity check on new 'fixparts' list content (to continue
+
+From 1292b93dc35a9a308464f1effb7f10f8de6db457 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 8 Sep 2020 20:56:17 +0200
+Subject: [PATCH 3/5] Check if remediation has associated rule before use
+
+---
+ ssg/build_remediations.py | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 49ec557000..85f7139d8f 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -273,9 +273,11 @@ def parse_from_file_with_jinja(self, env_yaml):
+         self.local_env_yaml.update(env_yaml)
+         result = super(BashRemediation, self).parse_from_file_with_jinja(self.local_env_yaml)
+ 
+-        # There can be repeated inherited platforms and rule platforms
+-        rule_platforms = set(self.associated_rule.inherited_platforms)
+-        rule_platforms.add(self.associated_rule.platform)
++        rule_platforms = set()
++        if self.associated_rule:
++            # There can be repeated inherited platforms and rule platforms
++            rule_platforms.update(self.associated_rule.inherited_platforms)
++            rule_platforms.add(self.associated_rule.platform)
+ 
+         platform_conditionals = []
+         for platform in rule_platforms:
+
+From 7953a02e61bb56b501c56f46972247751292dcbb Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 10 Sep 2020 10:59:43 +0200
+Subject: [PATCH 4/5] Fix python2 compat and improve code readability
+
+---
+ ssg/build_remediations.py | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 85f7139d8f..673d6d0cc6 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -28,10 +28,10 @@
+ }
+ 
+ PKG_MANAGER_TO_PACKAGE_CHECK_COMMAND = {
+-    'apt_get': 'dpkg-query -s {} &>/dev/null',
+-    'dnf': 'rpm --quiet -q {}',
+-    'yum': 'rpm --quiet -q {}',
+-    'zypper': 'rpm --quiet -q {}',
++    'apt_get': 'dpkg-query -s {0} &>/dev/null',
++    'dnf': 'rpm --quiet -q {0}',
++    'yum': 'rpm --quiet -q {0}',
++    'zypper': 'rpm --quiet -q {0}',
+ }
+ 
+ FILE_GENERATED_HASH_COMMENT = '# THIS FILE IS GENERATED'
+@@ -297,16 +297,23 @@ def parse_from_file_with_jinja(self, env_yaml):
+                 platform_conditionals.append(pkg_check_command.format(platform))
+ 
+         if platform_conditionals:
+-            platform_fix_text = "# Remediation is applicable only in certain platforms\n"
++            wrapped_fix_text = ["# Remediation is applicable only in certain platforms"]
+ 
+-            cond = platform_conditionals.pop(0)
+-            platform_fix_text += "if {}".format(cond)
+-            for cond in platform_conditionals:
+-                platform_fix_text += " && {}".format(cond)
+-            platform_fix_text += '; then\n{}\nelse\necho "Remediation is not applicable, nothing was done"\nfi'.format(result.contents)
++            all_conditions = " && ".join(platform_conditionals)
++            wrapped_fix_text.append("if {0}; then".format(all_conditions))
++
++            # Avoid adding extra blank line
++            if not result.contents.startswith("\n"):
++                wrapped_fix_text.append("")
++
++            wrapped_fix_text.append("{0}".format(result.contents))
++            wrapped_fix_text.append("")
++            wrapped_fix_text.append("else")
++            wrapped_fix_text.append("    >&2 echo 'Remediation is not applicable, nothing was done'")
++            wrapped_fix_text.append("fi")
+ 
+             remediation = namedtuple('remediation', ['contents', 'config'])
+-            result = remediation(contents=platform_fix_text, config=result.config)
++            result = remediation(contents="\n".join(wrapped_fix_text), config=result.config)
+ 
+         return result
+ 
+
+From 0bd3912651367c64789bb3d67b44c3b8848708c0 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Thu, 10 Sep 2020 17:25:27 +0200
+Subject: [PATCH 5/5] Document the perils of indenting wrapped Bash fixes
+
+---
+ ssg/build_remediations.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 673d6d0cc6..f269d4d2d6 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -306,6 +306,9 @@ def parse_from_file_with_jinja(self, env_yaml):
+             if not result.contents.startswith("\n"):
+                 wrapped_fix_text.append("")
+ 
++            # It is possible to indent the original body of the remediation with textwrap.indent(),
++            # however, it is not supported by python2, and there is a risk of breaking remediations
++            # For example, remediations with a here-doc block could be affected.
+             wrapped_fix_text.append("{0}".format(result.contents))
+             wrapped_fix_text.append("")
+             wrapped_fix_text.append("else")
diff --git a/SOURCES/scap-security-guide-0.1.53-add-platform-to-package-mapping_PR_6047.patch b/SOURCES/scap-security-guide-0.1.53-add-platform-to-package-mapping_PR_6047.patch
new file mode 100644
index 0000000..d8fc95c
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-add-platform-to-package-mapping_PR_6047.patch
@@ -0,0 +1,203 @@
+From 7c0b04c157374e9251360d1d5e12a9e00dd4375e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 4 Sep 2020 09:50:54 +0200
+Subject: [PATCH 1/3] Introduce platform_package_overrides
+
+Introduce a mapping of CPE package platform name to a package name.
+
+Each linux distro or version may have its specific name for a package,
+this mapping allows a product to override the package name of a
+platorm.
+
+By default, it assumes that the package name will be the same as the
+platform name.
+---
+ rhel8/product.yml         | 7 +++++++
+ ssg/build_remediations.py | 3 +++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/rhel8/product.yml b/rhel8/product.yml
+index 6cdc51919e..6b5b4e2748 100644
+--- a/rhel8/product.yml
++++ b/rhel8/product.yml
+@@ -18,3 +18,10 @@ aux_pkg_version: "d4082792"
+ 
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792"
++
++# Mapping of CPE platform to package
++platform_package_overrides:
++  grub2: "grub2-pc"
++  login_defs: "shadow-utils"
++  sssd: "sssd-common"
++  zipl: "s390x-utils"
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index 866450dd8c..ccbdf9fc1f 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -389,6 +389,9 @@ def update_when_from_rule(self, to_update):
+                 if "package_facts" in to_update:
+                     continue
+ 
++                if platform in self.local_env_yaml["platform_package_overrides"]:
++                    platform = self.local_env_yaml["platform_package_overrides"].get(platform)
++
+                 additional_when.append('"' + platform + '" in ansible_facts.packages')
+                 # After adding the conditional, we need to make sure package_facts are collected.
+                 # This is done via inject_package_facts_task()
+
+From 10dc62084cf8e38be9189b527c3b99b545826091 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 4 Sep 2020 14:42:57 +0200
+Subject: [PATCH 2/3] Move platform to cpe mappings to ssg/constants
+
+---
+ rhel8/product.yml | 6 ------
+ ssg/constants.py  | 8 ++++++++
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/rhel8/product.yml b/rhel8/product.yml
+index 6b5b4e2748..d839b23231 100644
+--- a/rhel8/product.yml
++++ b/rhel8/product.yml
+@@ -19,9 +19,3 @@ aux_pkg_version: "d4082792"
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792"
+ 
+-# Mapping of CPE platform to package
+-platform_package_overrides:
+-  grub2: "grub2-pc"
+-  login_defs: "shadow-utils"
+-  sssd: "sssd-common"
+-  zipl: "s390x-utils"
+diff --git a/ssg/constants.py b/ssg/constants.py
+index 3f9d7d37ce..7e9678241c 100644
+--- a/ssg/constants.py
++++ b/ssg/constants.py
+@@ -501,6 +501,14 @@
+     "zipl": "cpe:/a:zipl",
+ }
+ 
++# Default platform to package mapping
++XCCDF_PLATFORM_TO_PACKAGE = {
++  "grub2": "grub2-pc",
++  "login_defs": "login",
++  "sssd": "sssd-common",
++  "zipl": "s390x-utils",
++}
++
+ # _version_name_map = {
+ MAKEFILE_ID_TO_PRODUCT_MAP = {
+     'chromium': 'Google Chromium Browser',
+
+From feb012f06adae989138be15431020f2c174becc4 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 4 Sep 2020 14:47:29 +0200
+Subject: [PATCH 3/3] Allow override of default platform package mapping
+
+With default platform to package mappings defined, we need to allow a
+product to override it if needed.
+---
+ rhel6/product.yml   | 4 ++++
+ rhel7/product.yml   | 4 ++++
+ rhel8/product.yml   | 3 +++
+ rhosp10/product.yml | 3 +++
+ rhosp13/product.yml | 4 ++++
+ rhv4/product.yml    | 4 ++++
+ ssg/yaml.py         | 6 +++++-
+ 8 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/rhel6/product.yml b/rhel6/product.yml
+index cc8fa4f8ed..eab9b80c47 100644
+--- a/rhel6/product.yml
++++ b/rhel6/product.yml
+@@ -20,3 +20,7 @@ aux_pkg_version: "2fa658e0"
+ 
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "43A6E49C4A38F4BE9ABF2A5345689C882FA658E0"
++
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/rhel7/product.yml b/rhel7/product.yml
+index f03c928b8f..3ff996b8cc 100644
+--- a/rhel7/product.yml
++++ b/rhel7/product.yml
+@@ -18,3 +18,7 @@ aux_pkg_version: "2fa658e0"
+ 
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "43A6E49C4A38F4BE9ABF2A5345689C882FA658E0"
++
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/rhel8/product.yml b/rhel8/product.yml
+index d839b23231..f3aa59faec 100644
+--- a/rhel8/product.yml
++++ b/rhel8/product.yml
+@@ -19,3 +19,6 @@ aux_pkg_version: "d4082792"
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792"
+ 
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/rhosp10/product.yml b/rhosp10/product.yml
+index 51d0a932a5..af42ca998d 100644
+--- a/rhosp10/product.yml
++++ b/rhosp10/product.yml
+@@ -10,3 +10,6 @@ pkg_manager: "yum"
+ 
+ init_system: "systemd"
+ 
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/rhosp13/product.yml b/rhosp13/product.yml
+index 5e849ff609..ba42a31cd7 100644
+--- a/rhosp13/product.yml
++++ b/rhosp13/product.yml
+@@ -9,3 +9,7 @@ profiles_root: "./profiles"
+ pkg_manager: "yum"
+ 
+ init_system: "systemd"
++
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/rhv4/product.yml b/rhv4/product.yml
+index 10a2eda079..a61bf1588d 100644
+--- a/rhv4/product.yml
++++ b/rhv4/product.yml
+@@ -18,3 +18,7 @@ aux_pkg_version: "d4082792"
+ 
+ release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
+ auxiliary_key_fingerprint: "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792"
++
++# Mapping of CPE platform to package
++platform_package_overrides:
++  login_defs: "shadow-utils"
+diff --git a/ssg/yaml.py b/ssg/yaml.py
+index cefbba374c..22cf5bad66 100644
+--- a/ssg/yaml.py
++++ b/ssg/yaml.py
+@@ -10,7 +10,8 @@
+ 
+ from .jinja import load_macros, process_file
+ from .constants import (PKG_MANAGER_TO_SYSTEM,
+-                        PKG_MANAGER_TO_CONFIG_FILE)
++                        PKG_MANAGER_TO_CONFIG_FILE,
++                        XCCDF_PLATFORM_TO_PACKAGE)
+ from .constants import DEFAULT_UID_MIN
+ 
+ try:
+@@ -138,6 +139,9 @@ def open_raw(yaml_file):
+ 
+ def open_environment(build_config_yaml, product_yaml):
+     contents = open_raw(build_config_yaml)
++    # Load common platform package mappings,
++    # any specific mapping in product_yaml will override the default
++    contents["platform_package_overrides"] = XCCDF_PLATFORM_TO_PACKAGE
+     contents.update(open_raw(product_yaml))
+     contents.update(_get_implied_properties(contents))
+     return contents
diff --git a/SOURCES/scap-security-guide-0.1.53-drop-zipl-pti-rule_PR_6065.patch b/SOURCES/scap-security-guide-0.1.53-drop-zipl-pti-rule_PR_6065.patch
new file mode 100644
index 0000000..2023459
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-drop-zipl-pti-rule_PR_6065.patch
@@ -0,0 +1,92 @@
+From fbcd3e42106b95efd8a63914a558c04c76487783 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Mon, 21 Sep 2020 10:26:53 +0200
+Subject: [PATCH] Remove zIPL rule for PTI bootloader option
+
+This setting is to mitigate a problem specific for intel archs.
+Also returns the CCE to the pool.
+---
+ .../zipl_pti_argument/rule.yml                | 38 -------------------
+ rhel8/profiles/ospp.profile                   |  1 -
+ rhel8/profiles/stig.profile                   |  1 -
+ .../data/profile_stability/rhel8/ospp.profile |  1 -
+ 4 files changed, 41 deletions(-)
+ delete mode 100644 linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+
+diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
+deleted file mode 100644
+index 96170e6d85..0000000000
+--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
++++ /dev/null
+@@ -1,38 +0,0 @@
+-documentation_complete: true
+-
+-prodtype: rhel8
+-
+-title: 'Enable Kernel Page-Table Isolation (KPTI) in zIPL'
+-
+-description: |-
+-    To enable Kernel page-table isolation,
+-    check that all boot entries in /boot/loader/entries/*.conf have pti=on
+-    included in its options.

+-    To ensure that new kernels and boot entries continue to enable page-table isolation,
+-    add pti=on to /etc/kernel/cmdline.
+-
+-rationale: |-
+-    Kernel page-table isolation is a kernel feature that mitigates
+-    the Meltdown security vulnerability and hardens the kernel
+-    against attempts to bypass kernel address space layout
+-    randomization (KASLR).
+-
+-severity: medium
+-
+-identifiers:
+-    cce@rhel8: 83361-6
+-
+-ocil_clause: 'Kernel page-table isolation is not enabled'
+-
+-ocil: |-
+-  To check that page-table isolation is enabled at boot time, check all boot entries with following command:
+-  
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf

+-  No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .
+-
+-platform: machine
+-
+-template:
+-  name: zipl_bls_entries_option
+-  vars:
+-    arg_name: pti
+-    arg_value: 'on'
+diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
+index 5e81e4a92a..46f00c89f1 100644
+--- a/rhel8/profiles/ospp.profile
++++ b/rhel8/profiles/ospp.profile
+@@ -426,4 +426,3 @@ selections:
+     - zipl_vsyscall_argument
+     - zipl_vsyscall_argument.role=unscored
+     - zipl_vsyscall_argument.severity=info
+-    - zipl_pti_argument
+diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
+index 53647475aa..817d5dbadd 100644
+--- a/rhel8/profiles/stig.profile
++++ b/rhel8/profiles/stig.profile
+@@ -52,7 +52,6 @@ selections:
+     - "!zipl_audit_argument"
+     - "!zipl_audit_backlog_limit_argument"
+     - "!zipl_page_poison_argument"
+-    - "!zipl_pti_argument"
+     - "!zipl_slub_debug_argument"
+     - "!zipl_vsyscall_argument"
+     - "!zipl_vsyscall_argument.role=unscored"
+diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
+index 7b7307cba8..223b1423cd 100644
+--- a/tests/data/profile_stability/rhel8/ospp.profile
++++ b/tests/data/profile_stability/rhel8/ospp.profile
+@@ -219,7 +219,6 @@ selections:
+ - zipl_bls_entries_only
+ - zipl_bootmap_is_up_to_date
+ - zipl_page_poison_argument
+-- zipl_pti_argument
+ - zipl_slub_debug_argument
+ - zipl_vsyscall_argument
+ - var_sshd_set_keepalive=0
diff --git a/SOURCES/scap-security-guide-0.1.53-fix-empty-bash-wrapping-PR_6173.patch b/SOURCES/scap-security-guide-0.1.53-fix-empty-bash-wrapping-PR_6173.patch
new file mode 100644
index 0000000..0199bf4
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-fix-empty-bash-wrapping-PR_6173.patch
@@ -0,0 +1,49 @@
+From 08d5fb8355020856282eecfcdd09e96d9850cd62 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Fri, 9 Oct 2020 09:30:35 +0200
+Subject: [PATCH] Do not platform wrap empty Bash remediation
+
+The fix text for a rule can end up empty if a Jinja macro or conditional
+doesn't render any text.
+In these cases, avoid wrapping empty lines in an if-else, as this causes
+syntax error.
+---
+ ssg/build_remediations.py | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index f269d4d2d6..572db61701 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -273,6 +273,13 @@ def parse_from_file_with_jinja(self, env_yaml):
+         self.local_env_yaml.update(env_yaml)
+         result = super(BashRemediation, self).parse_from_file_with_jinja(self.local_env_yaml)
+ 
++        # Avoid platform wrapping empty fix text
++        # Remediations can be empty when a Jinja macro or conditional
++        # renders no fix text for a product
++        stripped_fix_text = result.contents.strip()
++        if stripped_fix_text == "":
++            return result
++
+         rule_platforms = set()
+         if self.associated_rule:
+             # There can be repeated inherited platforms and rule platforms
+@@ -301,15 +308,11 @@ def parse_from_file_with_jinja(self, env_yaml):
+ 
+             all_conditions = " && ".join(platform_conditionals)
+             wrapped_fix_text.append("if {0}; then".format(all_conditions))
+-
+-            # Avoid adding extra blank line
+-            if not result.contents.startswith("\n"):
+-                wrapped_fix_text.append("")
+-
++            wrapped_fix_text.append("")
+             # It is possible to indent the original body of the remediation with textwrap.indent(),
+             # however, it is not supported by python2, and there is a risk of breaking remediations
+             # For example, remediations with a here-doc block could be affected.
+-            wrapped_fix_text.append("{0}".format(result.contents))
++            wrapped_fix_text.append("{0}".format(stripped_fix_text))
+             wrapped_fix_text.append("")
+             wrapped_fix_text.append("else")
+             wrapped_fix_text.append("    >&2 echo 'Remediation is not applicable, nothing was done'")
diff --git a/SOURCES/scap-security-guide-0.1.53-fix-grub2-applicability-in-aarch64-ppc64le-PR_6153.patch b/SOURCES/scap-security-guide-0.1.53-fix-grub2-applicability-in-aarch64-ppc64le-PR_6153.patch
new file mode 100644
index 0000000..83df4d6
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-fix-grub2-applicability-in-aarch64-ppc64le-PR_6153.patch
@@ -0,0 +1,116 @@
+From cf1d85924b5945506e57f8701be066c83a894378 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Mon, 5 Oct 2020 16:40:39 +0200
+Subject: [PATCH 1/2] Check for grub2-common instead of grub2-pc
+
+Check for grub2 intallation based on grub2-common.
+grub2-pc is a x86_64 package, but other arches use grub2 as well.
+---
+ .../checks/oval/installed_env_has_grub2_package.xml  | 12 ++++++------
+ ssg/constants.py                                     |  2 +-
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/shared/checks/oval/installed_env_has_grub2_package.xml b/shared/checks/oval/installed_env_has_grub2_package.xml
+index e83f45bc3b..2a170d668e 100644
+--- a/shared/checks/oval/installed_env_has_grub2_package.xml
++++ b/shared/checks/oval/installed_env_has_grub2_package.xml
+@@ -6,31 +6,31 @@
+       
+         multi_platform_all
+       
+-      Checks if package grub2-pc is installed.
++      Checks if package grub2-common is installed.
+       
+     
+     
+-      
++      
+     
+   
+ 
+ {{% if pkg_system == "rpm" %}}
+   
++  comment="system has package grub2-common installed">
+     
+   
+   
+-    grub2-pc
++    grub2-common
+   
+ {{% elif pkg_system == "dpkg" %}}
+   
++  comment="system has package grub2-common installed">
+     
+   
+   
+-    grub2-pc
++    grub2-common
+   
+ {{% endif %}}
+ 
+diff --git a/ssg/constants.py b/ssg/constants.py
+index b07fe5f0fe..88316374b5 100644
+--- a/ssg/constants.py
++++ b/ssg/constants.py
+@@ -468,7 +468,7 @@
+ 
+ # Default platform to package mapping
+ XCCDF_PLATFORM_TO_PACKAGE = {
+-  "grub2": "grub2-pc",
++  "grub2": "grub2-common",
+   "login_defs": "login",
+   "sssd": "sssd-common",
+   "zipl": "s390utils-base",
+
+From fba876cfc7f85f5b9a696d0f5fa1177299b7c6bb Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Mon, 5 Oct 2020 16:49:15 +0200
+Subject: [PATCH 2/2] Handle exception of grub2-coomon in ppc64le
+
+ppc64le systems can use Grub2 or OPAL and the package set will be the
+same in both cases.
+Add a few more checks to make sure ppc64le arch is handled correctly.
+---
+ .../oval/installed_env_has_grub2_package.xml  | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/shared/checks/oval/installed_env_has_grub2_package.xml b/shared/checks/oval/installed_env_has_grub2_package.xml
+index 2a170d668e..fb2c9cc784 100644
+--- a/shared/checks/oval/installed_env_has_grub2_package.xml
++++ b/shared/checks/oval/installed_env_has_grub2_package.xml
+@@ -9,8 +9,18 @@
+       Checks if package grub2-common is installed.
+       
+     
+-    
++    
+       
++      
++        
++        
++        
++        
++        
++      
+     
+   
+ 
+@@ -34,4 +44,11 @@
+   
+ {{% endif %}}
+ 
++  
++    
++  
++  
++    /sys/firmware/opal
++  
++
+ 
diff --git a/SOURCES/scap-security-guide-0.1.53-fix-platform-to-package-mapping_PR_6059.patch b/SOURCES/scap-security-guide-0.1.53-fix-platform-to-package-mapping_PR_6059.patch
new file mode 100644
index 0000000..8c84ee4
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-fix-platform-to-package-mapping_PR_6059.patch
@@ -0,0 +1,38 @@
+From 7dfeb5ec0513a58502eb83aa2900e7c5fb0d478e Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 8 Sep 2020 11:29:57 +0200
+Subject: [PATCH] Fix load of product platform mapping
+
+The product specific mappings were overriding the common mappings,
+instead of being merged with them.
+---
+ ssg/yaml.py | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/ssg/yaml.py b/ssg/yaml.py
+index 22cf5bad66..d8856e52c9 100644
+--- a/ssg/yaml.py
++++ b/ssg/yaml.py
+@@ -13,6 +13,7 @@
+                         PKG_MANAGER_TO_CONFIG_FILE,
+                         XCCDF_PLATFORM_TO_PACKAGE)
+ from .constants import DEFAULT_UID_MIN
++from .utils import merge_dicts
+ 
+ try:
+     from yaml import CSafeLoader as yaml_SafeLoader
+@@ -139,10 +140,11 @@ def open_raw(yaml_file):
+ 
+ def open_environment(build_config_yaml, product_yaml):
+     contents = open_raw(build_config_yaml)
+-    # Load common platform package mappings,
+-    # any specific mapping in product_yaml will override the default
+-    contents["platform_package_overrides"] = XCCDF_PLATFORM_TO_PACKAGE
+     contents.update(open_raw(product_yaml))
++    platform_package_overrides = contents.get("platform_package_overrides", {})
++    # Merge common platform package mappings, while keeping product specific mappings
++    contents["platform_package_overrides"] = merge_dicts(XCCDF_PLATFORM_TO_PACKAGE,
++                                                         platform_package_overrides)
+     contents.update(_get_implied_properties(contents))
+     return contents
+ 
diff --git a/SOURCES/scap-security-guide-0.1.53-fix-zipl-package-mapping_PR_6130.patch b/SOURCES/scap-security-guide-0.1.53-fix-zipl-package-mapping_PR_6130.patch
new file mode 100644
index 0000000..fc1fecd
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-fix-zipl-package-mapping_PR_6130.patch
@@ -0,0 +1,22 @@
+From 570dc073739e9044b54e872c8368125bccadb704 Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 29 Sep 2020 15:28:02 +0200
+Subject: [PATCH] Fix zIPL package mapping
+
+---
+ ssg/constants.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ssg/constants.py b/ssg/constants.py
+index 0eca2f4f95..fa6c756ff6 100644
+--- a/ssg/constants.py
++++ b/ssg/constants.py
+@@ -470,7 +470,7 @@
+   "grub2": "grub2-pc",
+   "login_defs": "login",
+   "sssd": "sssd-common",
+-  "zipl": "s390x-utils",
++  "zipl": "s390utils-base",
+ }
+ 
+ # _version_name_map = {
diff --git a/SOURCES/scap-security-guide-0.1.53-move-grub2-vsyscall-rule_PR_6129.patch b/SOURCES/scap-security-guide-0.1.53-move-grub2-vsyscall-rule_PR_6129.patch
new file mode 100644
index 0000000..20310cb
--- /dev/null
+++ b/SOURCES/scap-security-guide-0.1.53-move-grub2-vsyscall-rule_PR_6129.patch
@@ -0,0 +1,16 @@
+From 7a069a2deb4d1ce69b02b7615523424f2ecf281f Mon Sep 17 00:00:00 2001
+From: Watson Sato 
+Date: Tue, 29 Sep 2020 15:04:39 +0200
+Subject: [PATCH] Move grub2_vsyscall_argument to grub2 group
+
+This will put the rule under grub2 platform, so the rule is only
+applicable on a machine system with grub2.
+---
+ .../grub2_vsyscall_argument/rule.yml                              | 0
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+ rename linux_os/guide/system/{permissions/restrictions => bootloader-grub2}/grub2_vsyscall_argument/rule.yml (100%)
+
+diff --git a/linux_os/guide/system/permissions/restrictions/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
+similarity index 100%
+rename from linux_os/guide/system/permissions/restrictions/grub2_vsyscall_argument/rule.yml
+rename to linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml
diff --git a/SPECS/scap-security-guide.spec b/SPECS/scap-security-guide.spec
index e098e0d..8430bd2 100644
--- a/SPECS/scap-security-guide.spec
+++ b/SPECS/scap-security-guide.spec
@@ -1,6 +1,6 @@
 Name:		scap-security-guide
 Version:	0.1.50
-Release:	14%{?dist}
+Release:	16%{?dist}
 Summary:	Security guidance and baselines in SCAP formats
 Group:		Applications/System
 License:	BSD
@@ -35,6 +35,23 @@ Patch23:		scap-security-guide-0.1.51-no_shelllogin_for_systemaccounts_ubi8-PR_58
 Patch24:		scap-security-guide-0.1.51-grub2_doc_fix-PR_5890.patch
 Patch25:		scap-security-guide-0.1.51-remove_grub_doc_links-PR_5851.patch
 Patch26:		scap-security-guide-0.1.53-cui_kickstart-PR_6035.patch
+Patch27:		scap-security-guide-0.1.51-add-zipl-rules_PR_5784.patch
+Patch28:		scap-security-guide-0.1.51-add-zipl-and-grub2-cpes_PR_5905.patch
+Patch29:		scap-security-guide-0.1.51-fix-zipl-cpe-dictionary_PR_5912.patch
+Patch30:		scap-security-guide-0.1.51-fix-rhel6-cpe-dictionary_PR_5928.patch
+Patch31:		scap-security-guide-0.1.52-reorganize-zipl-rules_PR_5888.patch
+Patch32:		scap-security-guide-0.1.52-add-zipl-boot-options-template_PR_5908.patch
+Patch33:		scap-security-guide-0.1.52-add-grub2-platform-to-more-rules_PR_5952.patch
+# To ease backport, patch 33 also includes changes from #5995
+Patch34:		scap-security-guide-0.1.53-add-ansible-platform_PR_6025.patch
+Patch35:		scap-security-guide-0.1.53-add-platform-to-package-mapping_PR_6047.patch
+Patch36:		scap-security-guide-0.1.53-fix-platform-to-package-mapping_PR_6059.patch
+Patch37:		scap-security-guide-0.1.53-add-bash-platform_PR_6061.patch
+Patch38:		scap-security-guide-0.1.53-drop-zipl-pti-rule_PR_6065.patch
+Patch39:		scap-security-guide-0.1.53-move-grub2-vsyscall-rule_PR_6129.patch
+Patch40:		scap-security-guide-0.1.53-fix-zipl-package-mapping_PR_6130.patch
+Patch41:		scap-security-guide-0.1.53-fix-grub2-applicability-in-aarch64-ppc64le-PR_6153.patch
+Patch42:		scap-security-guide-0.1.53-fix-empty-bash-wrapping-PR_6173.patch
 
 BuildArch:	noarch
 
@@ -96,6 +113,22 @@ present in %{name} package.
 %patch24 -p1
 %patch25 -p1
 %patch26 -p1
+%patch27 -p1
+%patch28 -p1
+%patch29 -p1
+%patch30 -p1
+%patch31 -p1
+%patch32 -p1
+%patch33 -p1
+%patch34 -p1
+%patch35 -p1
+%patch36 -p1
+%patch37 -p1
+%patch38 -p1
+%patch39 -p1
+%patch40 -p1
+%patch41 -p1
+%patch42 -p1
 mkdir build
 
 %build
@@ -130,6 +163,13 @@ cd build
 %doc %{_docdir}/%{name}/tables/*.html
 
 %changelog
+* Fri Oct 09 2020 Watson Sato  - 0.1.50-16
+- Fix Bash platform in empty remediations (rhbz#1886318)
+
+* Tue Oct 06 2020 Watson Sato  - 0.1.50-15
+- Add and select zIPL bootloader rules in OSPP (rhbz#1886318)
+- Add support for remediation platforms
+
 * Wed Sep 02 2020 Matěj Týč  - 0.1.50-14
 - Added a kickstart for the RHEL-8 CUI Profile (RHBZ#1762962)