forked from ComplianceAsCode/content
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request ComplianceAsCode#12319 from yuumasato/update_ocp4_…
…stig_to_v2r1 Add OCP STIG V2R1 profiles
- Loading branch information
Showing
8 changed files
with
4,158 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| documentation_complete: true | ||
|
|
||
| platform: ocp4-node | ||
|
|
||
| metadata: | ||
| version: V2R1 | ||
| SMEs: | ||
| - Vincent056 | ||
| - rhmdnd | ||
| - yuumasato | ||
|
|
||
| reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R1_STIG.zip | ||
|
|
||
| title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Node level' | ||
|
|
||
| description: |- | ||
| This profile contains configuration checks that align to the DISA STIG for | ||
| Red Hat OpenShift Container Platform 4. | ||
|
|
||
| filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms' | ||
|
|
||
| selections: | ||
| - stig_ocp4:all |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| documentation_complete: true | ||
|
|
||
| platform: ocp4 | ||
|
|
||
| metadata: | ||
| version: V2R1 | ||
| SMEs: | ||
| - Vincent056 | ||
| - rhmdnd | ||
| - yuumasato | ||
|
|
||
| reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R1_STIG.zip | ||
|
|
||
| title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level' | ||
|
|
||
| description: |- | ||
| This profile contains configuration checks that align to the DISA STIG for | ||
| Red Hat OpenShift Container Platform 4. | ||
|
|
||
| filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms' | ||
|
|
||
| selections: | ||
| - stig_ocp4:all | ||
| ### Variables | ||
| - var_openshift_audit_profile=WriteRequestBodies | ||
| - var_oauth_token_maxage=8h | ||
| ### Helper Rules | ||
| ### This is a helper rule to fetch the required api resource for detecting OCP version | ||
| - version_detect_in_ocp | ||
| - version_detect_in_hypershift |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| documentation_complete: true | ||
|
|
||
| metadata: | ||
| version: V2R1 | ||
| SMEs: | ||
| - Vincent056 | ||
| - rhmdnd | ||
| - yuumasato | ||
|
|
||
| reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R1_STIG.zip | ||
|
|
||
| title: 'DISA STIG for Red Hat Enterprise Linux CoreOS' | ||
|
|
||
| description: |- | ||
| This profile contains configuration checks that align to the DISA STIG for | ||
| Red Hat Enterprise Linux CoreOS 4. | ||
|
|
||
| selections: | ||
| - stig_ocp4:all | ||
| - var_sshd_set_keepalive=0 | ||
| - var_selinux_policy_name=targeted | ||
| - var_selinux_state=enforcing | ||
| - var_accounts_passwords_pam_faillock_dir=run | ||
| # Following rules once had a prodtype incompatible with the rhcos4 product | ||
| - '!audit_rules_suid_privilege_function' | ||
| - '!audit_rules_sudoers' | ||
| - '!audit_rules_privileged_commands_kmod' | ||
| - '!audit_rules_sudoers_d' | ||
| - '!audit_rules_execution_setfacl' | ||
| - '!audit_rules_privileged_commands_usermod' | ||
| - '!audit_rules_privileged_commands_unix_update' | ||
| - '!audit_rules_execution_chacl' | ||
| - '!audit_rules_privileged_commands_ssh_agent' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,18 @@ | ||
| documentation_complete: true | ||
|
|
||
| metadata: | ||
| version: V1R1 | ||
| version: V2R1 | ||
| SMEs: | ||
| - jhrozek | ||
| - Vincent056 | ||
| - rhmdnd | ||
| - david-rh | ||
| - yuumasato | ||
|
|
||
| reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Container_Platform_V1R3_SRG.zip | ||
| reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R1_STIG.zip | ||
|
|
||
| title: 'DISA STIG for Red Hat Enterprise Linux CoreOS' | ||
|
|
||
| description: |- | ||
| This profile contains configuration checks that align to the DISA STIG for | ||
| Red Hat Enterprise Linux CoreOS 4. | ||
|
|
||
| extends: stig-v1r1 | ||
| extends: stig-v2r1 |
4,061 changes: 4,061 additions & 0 deletions
4,061
shared/references/disa-stig-ocp4-v2r1-xccdf-manual.xml
Large diffs are not rendered by default.
Oops, something went wrong.