diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml index a74fd113fea..2d87c094137 100644 --- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml +++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml @@ -63,7 +63,7 @@ ocil: |-
$ grep -i "red hat" /etc/redhat-release{{% elif 'ol' in families %}}
$ grep -i "oracle" /etc/oracle-release-{{% elif product in ["sle12", "sle15", "slmicro5", "slmicro6"] %}} +{{% elif product in ["sle12", "sle15", "sle16", "slmicro5", "slmicro6"] %}}
$ grep -i "suse" /etc/os-release{{% elif 'ubuntu' in product %}}
$ grep DISTRIB_DESCRIPTION /etc/lsb-releasediff --git a/controls/base_sle16.yml b/products/sle16/controls/base_sle16.yml similarity index 50% rename from controls/base_sle16.yml rename to products/sle16/controls/base_sle16.yml index a71bac72070..b09c87b68ce 100644 --- a/controls/base_sle16.yml +++ b/products/sle16/controls/base_sle16.yml @@ -7,17 +7,7 @@ source: not_publicly_available reference_type: suse-base-sle16 levels: - - id: high - - id: medium - - id: low + - id: pcidss4 + - id: anssi_minimal product: sle16 - -controls: - - id: SLES-16-16016015 - levels: - - high - title: SLES 16 must be a vendor-supported release. - rules: - - installed_OS_is_vendor_supported - status: automated diff --git a/products/sle16/controls/base_sle16/0000_os_general.yml b/products/sle16/controls/base_sle16/0000_os_general.yml new file mode 100644 index 00000000000..0741e741066 --- /dev/null +++ b/products/sle16/controls/base_sle16/0000_os_general.yml @@ -0,0 +1,16 @@ +# +# A group of rules regarding general operating system functionality +# and system software installed +# +# SLES-16 ids allocated for this group from SLES-16-16016000 till SLES-16-16016099 +# + +controls: + - id: SLES-16-16016005 + levels: + - pcidss4 + - anssi_minimal + title: SLES 16 must be a vendor-supported release. + rules: + - installed_OS_is_vendor_supported + status: automated diff --git a/products/sle16/controls/base_sle16/0100_file_ownership_n_permissions.yml b/products/sle16/controls/base_sle16/0100_file_ownership_n_permissions.yml new file mode 100644 index 00000000000..99a5a1b0b13 --- /dev/null +++ b/products/sle16/controls/base_sle16/0100_file_ownership_n_permissions.yml @@ -0,0 +1,20 @@ +# +# Rules regarding secure file ownersip and permissions +# SLES-16 ids allocated for this group from SLES-16-16016100 till SLES-16-16016399 +# +controls: + - id: SLES-16-16016100 + title: Ensure All Files Are Owned by a Group + levels: + - anssi_minimal + rules: + - file_permissions_ungroupowned + status: automated + + - id: SLES-16-16016105 + title: Ensure All Files Are Owned by a User + levels: + - anssi_minimal + rules: + - no_files_unowned_by_user + status: automated diff --git a/products/sle16/controls/base_sle16/0400_kernel_paramters.yml b/products/sle16/controls/base_sle16/0400_kernel_paramters.yml new file mode 100644 index 00000000000..efcbb0d0fa5 --- /dev/null +++ b/products/sle16/controls/base_sle16/0400_kernel_paramters.yml @@ -0,0 +1,14 @@ +# +# A group of rules regarding kernel parameters and modules configuration and installation +# +# SLES-16 ids allocated for this group from SLES-16-16016400 till SLES-16-16016499 +# +controls: + - id: SLES-16-16016400 + title: Enable NX/XD Support + levels: + - pcidss4 + automated: partially + rules: + - bios_enable_execution_restrictions + - install_PAE_kernel_on_x86-32 diff --git a/shared/checks/oval/installed_OS_is_sle16.xml b/shared/checks/oval/installed_OS_is_sle16.xml index a2c5b1618ee..c8a80169785 100644 --- a/shared/checks/oval/installed_OS_is_sle16.xml +++ b/shared/checks/oval/installed_OS_is_sle16.xml @@ -29,7 +29,7 @@