-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update rules for RHEL 9 STIG #9512
Conversation
b3feb22
to
d541c51
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR; I left a few comments throughout.
...ounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml
Outdated
Show resolved
Hide resolved
...x_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/rule.yml
Show resolved
Hide resolved
..._os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_login_defs/rule.yml
Outdated
Show resolved
Hide resolved
...e/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action_stig/rule.yml
Outdated
Show resolved
Hide resolved
Using a dedicated checktext key we can remove the DoD specific notes from the general purpose OCIL text.
I have tried to address the feedback in the new commits. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just one minor change is requested so that we don't lose some work.
@@ -65,5 +65,3 @@ fixtext: |- | |||
Remove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. | |||
|
|||
Document all authorized accounts on the system. | |||
|
|||
srg_requirement: '{{{ full_name }}} must not have unnecessary accounts.' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I belive that this should still be here.
I have add back SRG requirement to accounts_authorized_local_users. |
Code Climate has analyzed commit a51d10e and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 40.4% (0.0% change). View more on Code Climate. |
@jan-cerny: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Description:
According to feedback from DISA we updated some rules and their OCIL, fixtext, SRG requirements, etc.
Rationale:
Update the rules for RHEL 9 STIG.