Merge pull request #4611 from adelton/service_usbguard_enabled

Enable the usbguard service in OSPP profiles.
ComplianceAsCode · Jul 15, 2019 · 97ab483 · 97ab483
2 parents 2eecbaf + 33286d9
commit 97ab483
Show file tree

Hide file tree

Showing 7 changed files with 37 additions and 3 deletions.
diff --git a/fedora/templates/csv/services_enabled.csv b/fedora/templates/csv/services_enabled.csv
@@ -6,3 +6,4 @@ ntpd,ntp,
 pcscd,pcsc-lite,
 postfix,,
 sssd,,
+usbguard,,
diff --git a/linux_os/guide/services/usbguard/group.yml b/linux_os/guide/services/usbguard/group.yml
@@ -0,0 +1,7 @@
+documentation_complete: true
+
+title: 'USBGuard daemon'
+
+description: |-
+    The USBGuard daemon enforces the USB device authorization policy for all USB devices.
+
diff --git a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml
@@ -0,0 +1,25 @@
+documentation_complete: true
+
+prodtype: rhel8,fedora,ol8
+
+title: 'Enable the USBGuard Service'
+
+description: |-
+    The USBGuard service should be enabled.
+    {{{ describe_service_enable(service="usbguard") }}}
+
+rationale: |-
+    The <tt>usbguard</tt> service must be running in order to
+    enforce the USB device authorization policy for all USB devices.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: 82853-3
+
+references:
+    ospp: FMT_SMF_EXT.1
+
+ocil_clause: 'the service is not enabled'
+
+ocil: '{{{ ocil_service_enabled(service="usbguard") }}}'
diff --git a/ol8/templates/csv/services_enabled.csv b/ol8/templates/csv/services_enabled.csv
@@ -5,3 +5,4 @@ firewalld,firewalld,
 ntpd,ntp,
 pcscd,pcsc-lite,
 rsyslog,rsyslog,
+usbguard,usbguard,
diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
@@ -1094,8 +1094,8 @@ selections:
     ## TO DO: HOW TO HANDLE??
     #setup_usbguard
 
-    ## TO DO: https://github.com/ComplianceAsCode/content/issues/4474
-    #systemctl enable usbguard
+    ## Enable the USBGuard Service
+    - service_usbguard_enabled
 
     #################################################################
     ## Enable / Configure FIPS

diff --git a/rhel8/templates/csv/services_enabled.csv b/rhel8/templates/csv/services_enabled.csv
@@ -6,3 +6,4 @@ ntpd,ntp,
 pcscd,pcsc-lite,
 postfix,,
 sssd,,
+usbguard,,
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
@@ -669,7 +669,6 @@ CCE-82849-1
 CCE-82850-9
 CCE-82851-7
 CCE-82852-5
-CCE-82853-3
 CCE-82854-1
 CCE-82855-8
 CCE-82856-6