Merge pull request #7715 from mdedonno1337/debian11

Add support for Debian 11
ComplianceAsCode · Oct 18, 2021 · 5bcb87d · 5bcb87d
2 parents fc6bdac + 183bcc0
commit 5bcb87d
Show file tree

Hide file tree

Showing 71 changed files with 546 additions and 36 deletions.
diff --git a/.github/workflows/gate.yaml b/.github/workflows/gate.yaml
@@ -21,6 +21,29 @@ jobs:
         run: ctest -j2 --output-on-failure -E unique-stigids
         working-directory: ./build
 
+  validate-debian:
+    name: Build, Test on Debian 10 (Container)
+    runs-on: ubuntu-latest
+    container:
+      image: debian:buster
+    steps:
+      - name: Update the package repository
+        run: apt-get update
+      - name: Install Deps
+        run: apt-get install -y ansible-lint bats check cmake expat libopenscap8 libxml2-utils ninja-build python3-github python3-jinja2 python3-pip python3-pytest python3-pytest-cov python3-yaml xsltproc
+      - name: Install deps python
+        run: pip3 install ruamel.yaml yamlpath
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Build
+        env:
+          ADDITIONAL_CMAKE_OPTIONS: "-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED=ON"
+        run: |-
+          ./build_product debian9 debian10 debian11
+      - name: Test
+        working-directory: ./build
+        run: ctest -j2 --output-on-failure -E unique-stigids
+
   validate-ubuntu:
     name: Build, Test on Ubuntu 20.04
     runs-on: ubuntu-20.04

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -68,6 +68,7 @@ option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be bui
 option(SSG_PRODUCT_CHROMIUM "If enabled, the Chromium SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_DEBIAN9 "If enabled, the Debian 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_DEBIAN10 "If enabled, the Debian 10 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_DEBIAN11 "If enabled, the Debian 11 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_EXAMPLE "If enabled, the Example SCAP content will be built" FALSE)
 option(SSG_PRODUCT_FEDORA "If enabled, the Fedora SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_FIREFOX "If enabled, the Firefox SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -263,6 +264,7 @@ message(STATUS "Products:")
 message(STATUS "Chromium: ${SSG_PRODUCT_CHROMIUM}")
 message(STATUS "Debian 9: ${SSG_PRODUCT_DEBIAN9}")
 message(STATUS "Debian 10: ${SSG_PRODUCT_DEBIAN10}")
+message(STATUS "Debian 11: ${SSG_PRODUCT_DEBIAN11}")
 message(STATUS "Example: ${SSG_PRODUCT_EXAMPLE}")
 message(STATUS "Fedora: ${SSG_PRODUCT_FEDORA}")
 message(STATUS "Firefox: ${SSG_PRODUCT_FIREFOX}")
@@ -333,6 +335,9 @@ endif()
 if (SSG_PRODUCT_DEBIAN10)
     add_subdirectory("products/debian10" "debian10")
 endif()
+if (SSG_PRODUCT_DEBIAN11)
+    add_subdirectory("products/debian11" "debian11")
+endif()
 if (SSG_PRODUCT_EXAMPLE)
     add_subdirectory("products/example" "example")
 endif()

diff --git a/build_product b/build_product
@@ -285,6 +285,7 @@ all_cmake_products=(
 	CHROMIUM
 	DEBIAN9
 	DEBIAN10
+	DEBIAN11
 	EXAMPLE
 	FEDORA
 	FIREFOX

diff --git a/linux_os/guide/services/apt/apt_conf_disallow_unauthenticated/rule.yml b/linux_os/guide/services/apt/apt_conf_disallow_unauthenticated/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,ubuntu1604,ubuntu1804,ubuntu2004
+prodtype: debian11,debian10,debian9,ubuntu1604,ubuntu1804,ubuntu2004
 
 title: 'Disable unauthenticated repositories in APT configuration'
 

diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
@@ -0,0 +1,27 @@
+<def-group>
+  <definition class="compliance" id="apt_sources_list_official" version="1">
+    {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.") }}}
+    <criteria comment="Match sources.list distribution repositories usage" operator="AND">
+      <criterion comment="Check /etc/apt/sources(.d/.+).list file for base" test_ref="test_apt_sources_list_base_official" />
+      <criterion comment="Check /etc/apt/sources(.d/.+).list file for security" test_ref="test_apt_sources_list_security_official" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories"
+  id="test_apt_sources_list_base_official" version="1">
+    <ind:object object_ref="obj_apt_sources_list_base_official" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
+    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories"
+  id="test_apt_sources_list_security_official" version="1">
+    <ind:object object_ref="obj_apt_sources_list_security_official" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
+    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/rule.yml b/linux_os/guide/services/apt/apt_sources_list_official/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9
+prodtype: debian11,debian10,debian9
 
 title: 'Ensure that official distribution repositories are used'
 

diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Uninstall net-snmp Package'
 
@@ -41,6 +41,7 @@ template:
         pkgname: net-snmp
         pkgname@debian9: snmp
         pkgname@debian10: snmp
+        pkgname@debian11: snmp
         pkgname@ubuntu1604: snmp
         pkgname@ubuntu1804: snmp
         pkgname@ubuntu2004: snmp
diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,rhel7,rhel8,rhel9,sle15
+prodtype: debian11,debian10,debian9,rhel7,rhel8,rhel9,sle15
 
 title: 'Disable snmpd Service'
 
@@ -36,4 +36,5 @@ template:
         servicename: snmpd
         packagename@debian9: snmpd
         packagename@debian10: snmpd
+        packagename@debian11: snmpd
         packagename: net-snmp
diff --git a/...s/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/ansible/shared.yml b/...s/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = debian 10,debian 9,multi_platform_fedora,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,WRLinux 1019
+# platform = debian 11,debian 10,debian 9,multi_platform_fedora,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,WRLinux 1019
 # reboot = false
 # strategy = configure
 # complexity = low

diff --git a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/bash/shared.sh b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/bash/shared.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = debian 10,debian 9,multi_platform_fedora,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,WRLinux 1019
+# platform = debian 11,debian 10,debian 9,multi_platform_fedora,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,WRLinux 1019
 
 {{{ bash_instantiate_variables("var_snmpd_ro_string", "var_snmpd_rw_string") }}}
 

diff --git a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhel7,rhel8,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhel7,rhel8,wrlinux1019
 
 title: 'Ensure Default SNMP Password Is Not Used'
 

diff --git a/linux_os/guide/services/ssh/service_sshd_disabled/rule.yml b/linux_os/guide/services/ssh/service_sshd_disabled/rule.yml
@@ -5,7 +5,7 @@ title: 'Disable SSH Server If Possible (Unusual)'
 description: |-
     The SSH server service, sshd, is commonly needed.
     However, if it can be disabled, do so.
-    {{% if product in ['debian9', 'debian10', 'ubuntu1604', 'ubuntu1804'] %}}
+    {{% if product in ['debian9', 'debian10', 'debian11', 'ubuntu1604', 'ubuntu1804'] %}}
     {{{ describe_service_disable(service="sshd") }}}
     {{% else %}}
     {{{ describe_service_disable(service="sshd") }}}
@@ -29,5 +29,6 @@ template:
         packagename@sle12: openssh
         daemonname@debian9: ssh
         daemonname@debian10: ssh
+        daemonname@debian11: ssh
         daemonname@ubuntu1604: ssh
         daemonname@ubuntu1804: ssh
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml
@@ -25,6 +25,7 @@ identifiers:
 
 references:
     cis@debian10: 9.3.2
+    cis@debian11: 9.3.2
     cis@rhel7: 5.3.5
     cis@rhel8: 5.2.5
     cis@sle12: 5.3.6

diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml
@@ -21,6 +21,7 @@ identifiers:
 
 references:
     cis@debian9: 9.3.5
+    cis@debian11: 9.3.5
     cis@rhel7: 5.3.7
     cis@rhel8: 5.2.7
     cis@sle12: 5.3.8

diff --git a/...ditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml b/...ditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
 
 title: 'Ensure auditd Collects File Deletion Events by User'
 

diff --git a/...nfigure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml b/...nfigure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
 
 title: 'Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)'
 

diff --git a/...e_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/...e_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - creat'
 

diff --git a/...les/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/...les/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - ftruncate'
 

diff --git a/...re_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/...re_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - open'
 

diff --git a/...t_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/...t_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - open_by_handle_at'
 

diff --git a/..._rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/..._rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - openat'
 

diff --git a/...ules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml b/...ules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Unsuccessful Access Attempts to Files - truncate'
 

diff --git a/...td_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml b/...td_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
 
 title: 'Ensure auditd Collects Information on Kernel Module Loading and Unloading'
 

diff --git a/...igure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml b/...igure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Ensure auditd Collects Information on Kernel Module Unloading - delete_module'
 

diff --git a/...figure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/...figure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module'
 

diff --git a/...nfigure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml b/...nfigure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Ensure auditd Collects Information on Kernel Module Loading - init_module'
 

diff --git a/...stem/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml b/...stem/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
 
 title: 'Record Attempts to Alter Logon and Logout Events'
 

diff --git a/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml b/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019
 
 title: 'Record Attempts to Alter Logon and Logout Events - faillock'
 

diff --git a/...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml b/...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Attempts to Alter Logon and Logout Events - lastlog'
 

diff --git a/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml b/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
+prodtype: debian11,debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019
 
 title: 'Record Attempts to Alter Logon and Logout Events - tallylog'
 

diff --git a/linux_os/guide/system/auditing/package_audit_installed/rule.yml b/linux_os/guide/system/auditing/package_audit_installed/rule.yml
@@ -46,3 +46,4 @@ template:
         pkgname@ubuntu2004: auditd
         pkgname@debian9: auditd
         pkgname@debian10: auditd
+        pkgname@debian11: auditd
diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml
@@ -71,6 +71,7 @@ template:
         packagename: audit
         packagename@debian9: auditd
         packagename@debian10: auditd
+        packagename@debian11: auditd
         packagename@ubuntu1604: auditd
         packagename@ubuntu1804: auditd
         packagename@ubuntu2004: auditd
diff --git a/...ogging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml b/...ogging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml
@@ -3,7 +3,7 @@
     {{{ oval_metadata("All syslog log files should be owned by the appropriate group.") }}}
 
     <criteria operator="AND">
-      {{% if product in ["debian9", "debian10", "ubuntu1604"] %}}
+      {{% if product in ["debian9", "debian10", "debian11", "ubuntu1604"] %}}
       <extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="package_rsyslog_installed" />
       {{% endif %}}
       <criterion comment="Check if all system log files are owned by the appropriate group" test_ref="test_rsyslog_files_groupownership" />
@@ -106,7 +106,7 @@
 
   <unix:file_state id="state_rsyslog_files_groupownership" version="1">
     <unix:type operation="equals">regular</unix:type>
-    {{% if product in ["debian9", "debian10", "ubuntu1604", "ubuntu2004"] %}}
+    {{% if product in ["debian9", "debian10", "debian11", "ubuntu1604", "ubuntu2004"] %}}
     <unix:group_id datatype="int">4</unix:group_id>
     {{% else %}}
     <unix:group_id datatype="int">0</unix:group_id>

diff --git a/...em/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/...em/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
@@ -48,7 +48,7 @@ do
 		unset ARRAY_FOR_LOG_FILE
 	fi
 done
-{{% if product in ["debian9", "debian10", "ubuntu1604", "ubuntu1804", "ubuntu2004", "sle15", "sle12"] %}}
+{{% if product in ["debian9", "debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "sle15", "sle12"] %}}
 DESIRED_PERM_MOD=640
 {{% else %}}
 DESIRED_PERM_MOD=600

diff --git a/...m/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/...m/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
@@ -3,7 +3,7 @@
     {{{ oval_metadata("File permissions for all syslog log files should be set correctly.") }}}
 
     <criteria operator="AND">
-      {{% if product in ["debian9", "debian10", "ubuntu1604", "ubuntu1804"] %}}
+      {{% if product in ["debian9", "debian10", "debian11", "ubuntu1604", "ubuntu1804"] %}}
       <extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="package_rsyslog_installed" />
       {{% endif %}}
       <criterion comment="Check permissions of all system log files" test_ref="test_rsyslog_files_permissions" />
@@ -108,7 +108,7 @@
   <unix:file_state id="state_rsyslog_files_permissions" version="1">
     <unix:type operation="equals">regular</unix:type>
     <unix:uexec datatype="boolean">false</unix:uexec>
-    {{% if product in ["debian9", "debian10", "ubuntu1604", "ubuntu1804", "ubuntu2004", "sle15", "sle12"] %}}
+    {{% if product in ["debian9", "debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "sle15", "sle12"] %}}
     <unix:gread datatype="boolean">true</unix:gread>
     {{% else %}}
     <unix:gread datatype="boolean">false</unix:gread>

diff --git a/...system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml b/...system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml
@@ -66,5 +66,6 @@ template:
         datatype: int
         sysctlval@debian9: ''
         sysctlval@debian10: ''
+        sysctlval@debian11: ''
         sysctlval@ubuntu1604: ''
         sysctlval@ubuntu1804: ''
diff --git a/...ons/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml b/...ons/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml
@@ -38,6 +38,7 @@ template:
         filegid: '0'
         filegid@debian9: '42'
         filegid@debian10: '42'
+        filegid@debian11: '42'
         filegid@ubuntu1604: '42'
         filegid@ubuntu1804: '42'
         filegid@ubuntu2004: '42'

diff --git a/...ions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml b/...ions/files/permissions_important_account_files/file_groupowner_backup_etc_shadow/rule.yml
@@ -41,6 +41,7 @@ template:
         filegid: '0'
         filegid@debian9: '42'
         filegid@debian10: '42'
+        filegid@debian11: '42'
         filegid@ubuntu1604: '42'
         filegid@ubuntu1804: '42'
         filegid@ubuntu2004: '42'