Skip to content

Commit

Permalink
Automatically add Ubuntu to existing shared fixes
Browse files Browse the repository at this point in the history
$ ./build-scripts/profile_tool.py stats --benchmark build/ssg-ubuntu2004-xccdf.xml --profile stig --missing-fixes | sed '/\*\*/d' | grep -i '^ ' | grep -io '[a-z0-9_-]*' | sort -u | xargs -L1 -I{} ./utils/mod_fixes.py {} bash add multi_platform_ubuntu
$ ./build-scripts/profile_tool.py stats --benchmark build/ssg-ubuntu2004-xccdf.xml --profile stig --missing-fixes | sed '/\*\*/d' | grep -i '^ ' | grep -io '[a-z0-9_-]*' | sort -u | xargs -L1 -I{} ./utils/mod_fixes.py {} ansible add multi_platform_ubuntu

After regeneration, some rules were added/removed manually based on
availability of specific files for Ubuntu distro

Signed-off-by: Richard Maciel Costa <richard.maciel.costa@canonical.com>
  • Loading branch information
richardmaciel-canonical committed Aug 25, 2021
1 parent 60345d7 commit 9fbf7c4
Show file tree
Hide file tree
Showing 55 changed files with 55 additions and 55 deletions.
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_wrlinux,multi_platform_ol,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_wrlinux
. /usr/share/scap-security-guide/remediation_functions
{{{ bash_instantiate_variables("var_time_service_set_maxpoll") }}}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Oracle Linux 7,multi_platform_sle
# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Oracle Linux 7,multi_platform_sle
# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_sle,multi_platform_ubuntu,multi_platform_wrlinux
if grep -q -P '^\s*[Cc]iphers\s+' /etc/ssh/sshd_config; then
sed -i 's/^\s*[Cc]iphers.*/Ciphers aes256-ctr,aes192-ctr,aes128-ctr/' /etc/ssh/sshd_config
else
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Oracle Linux 7,multi_platform_sle
# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Oracle Linux 7,multi_platform_sle
# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_sle,multi_platform_ubuntu,multi_platform_wrlinux
if grep -q -P '^\s*MACs\s+' /etc/ssh/sshd_config; then
sed -i 's/^\s*MACs.*/MACs hmac-sha2-512,hmac-sha2-256/' /etc/ssh/sshd_config
else
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = unknown
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = unknown
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
{{% set pam_lastlog_filename = "postlogin" %}}
{{% endif %}}

# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu,multi_platform_wrlinux
# reboot = false
# strategy = configure
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_wrlinux

. /usr/share/scap-security-guide/remediation_functions

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_wrlinux
. /usr/share/scap-security-guide/remediation_functions
{{{ bash_instantiate_variables("var_password_pam_unix_remember") }}}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_ubuntu,multi_platform_wrlinux
. /usr/share/scap-security-guide/remediation_functions
{{{ bash_instantiate_variables("var_password_hashing_algorithm") }}}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = disable
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu


{{{ bash_replace_or_append('/etc/systemd/system.conf', '^CtrlAltDelBurstAction=', 'none', '@CCENUM@', '%s=%s') }}}
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = disable
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = enable
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_wrlinux
. /usr/share/scap-security-guide/remediation_functions
{{{ bash_instantiate_variables("var_accounts_max_concurrent_login_sessions") }}}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu

- name: Start apparmor.service
systemd:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu

# Enable apparmor
{{{ bash_service_command("enable", "apparmor") }}}
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# platform = multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# complexity = low
# disruption = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_ubuntu,multi_platform_wrlinux
# reboot = false
# complexity = low
# disruption = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = true
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = true
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = true
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_ol,multi_platform_fedora,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu,multi_platform_wrlinux
# reboot = false
# strategy = configure
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_wrlinux
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_wrlinux,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu,multi_platform_wrlinux
. /usr/share/scap-security-guide/remediation_functions
{{{ bash_instantiate_variables("var_auditd_space_left") }}}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
- name: Check 'UTC' timezone is set
shell: |
set -o pipefail
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle
# platform = multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = high
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = medium
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ubuntu
# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_sle,multi_platform_ubuntu

for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
do
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = medium
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
find /bin/ \
/usr/bin/ \
/usr/local/bin/ \
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = medium
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
for LIBDIR in /usr/lib /usr/lib64 /lib /lib64
do
if [ -d $LIBDIR ]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = medium
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_ubuntu
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu
DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
find -L $DIRS -perm /022 -execdir chmod go-w '{}' \;
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = high
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = unknown
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_ubuntu


{{{ bash_dconf_settings("org/gnome/desktop/screensaver", "lock-enabled", "true", "local.d", "00-security-settings") }}}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu
# reboot = false
# strategy = unknown
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_sle,multi_platform_rhel
# platform = multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel,multi_platform_ol,multi_platform_rhv
# platform = multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_ubuntu

if grep --silent ^clean_requirements_on_remove /etc/yum.conf ; then
sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/yum.conf
Expand Down

0 comments on commit 9fbf7c4

Please sign in to comment.