Skip to content

Commit 381cf3a

Browse files
vickeybrownvickeybrown
committed
added compliance checks
1 parent 8aa3300 commit 381cf3a

10 files changed

Lines changed: 165 additions & 1 deletion

File tree

‎components/at.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@ packages:
33
- at
44
rules:
55
- file_at_deny_not_exist
6+
- package_at_removed
67
- service_atd_disabled

‎components/dnf.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ packages:
44
- dnf-automatic
55
- dnf-plugin-subscription-manager
66
- libdnf-plugin-subscription-manager
7+
- python3-dnf
78
rules:
89
- clean_components_post_updating
910
- disable_weak_deps
@@ -15,3 +16,4 @@ rules:
1516
- package_dnf-automatic_installed
1617
- package_dnf-plugin-subscription-manager_installed
1718
- package_libdnf-plugin-subscription-manager_installed
19+
- package_python3_dnf_removed

‎components/nmap-ncat.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
name: nmap-ncat
2+
packages:
3+
- nmap-ncat
4+
rules:
5+
- package_netcat_removed

‎components/socat.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
name: socat
2+
packages:
3+
- socat
4+
rules:
5+
- package_socat_removed

‎linux_os/guide/services/cron_and_at/package_at_removed/rule.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
documentation_complete: true
2+
3+
title: 'Uninstall at Package'
4+
5+
description: |-
6+
The at package provides the ability to schedule one-time tasks for future execution,
7+
which is not required in CoreOS environments and can introduce unnecessary risk.
8+
The at package is not installed by default on CoreOS. If found, it should be uninstalled
9+
to reduce the risk of unauthorized or unaccountable task execution.
10+
{{{ describe_package_remove(package="at") }}}
11+
12+
rationale: |-
13+
The at package is not installed by default on CoreOS, but it is available in standard
14+
repositories. With sufficient privileges, it could be installed on CoreOS, introducing
15+
unnecessary risk. If present, attackers could use the at utility to schedule malicious
16+
tasks for future execution, making it harder to detect and trace unauthorized activity.
17+
To prevent such risks and unaccountable task execution, regularly verify that the at
18+
package is not present and remove it if found.
19+
20+
severity: high
21+
22+
ocil_clause: 'the package is installed'
23+
24+
ocil: |-
25+
{{{ complete_ocil_entry_package_removed(package="at") }}}
26+
27+
fixtext: |-
28+
To remove the at package, run the following command:
29+
30+
$ rpm-ostree override remove at
31+
32+
A reboot is required for the changes to take effect.
33+
34+
template:
35+
name: package_removed
36+
vars:
37+
pkgname: at

‎linux_os/guide/system/software/system-tools/package_netcat_removed/rule.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
documentation_complete: true
2+
3+
title: 'Uninstall netcat Package'
4+
5+
description: |-
6+
{{{ describe_package_remove(package="nmap-ncat") }}}
7+
8+
rationale: |-
9+
Utilities such as netcat can be used for legitimate troubleshooting,
10+
but they also present a significant security risk if misused by attackers
11+
to create unauthorized network connections, transfer data, or establish
12+
reverse shells. While netcat is not installed by default on CoreOS, it is
13+
available in standard repositories and could be added with sufficient
14+
privileges. Removing these tools from systems reduces the risk of
15+
unauthorized access and data exfiltration.
16+
17+
severity: high
18+
19+
{{{ complete_ocil_entry_package_removed("nmap-ncat") }}}
20+
21+
fixtext: |-
22+
To remove the nmap-ncat package, run the following command:
23+
24+
$ rpm-ostree override remove nmap-ncat
25+
26+
A reboot is required for the changes to take effect.
27+
28+
template:
29+
name: package_removed
30+
vars:
31+
pkgname: nmap-ncat

‎linux_os/guide/system/software/system-tools/package_python3_dnf_removed/rule.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
documentation_complete: true
2+
3+
title: 'Remove dnf and python3-dnf Packages'
4+
5+
description: |-
6+
The dnf and python3-dnf packages provide package management utilities and Python bindings
7+
for installing, updating, and removing software on Linux systems. CoreOS is designed to be
8+
an immutable operating system, where software installation and updates are managed through
9+
atomic upgrades and containerization, rather than traditional package management.
10+
Retaining these utilities can introduce risks by allowing direct package installation,
11+
which may compromise system integrity and increase the attack surface.
12+
It is recommended to remove these packages to maintain the intended security posture of CoreOS.
13+
14+
rationale: |-
15+
Retaining dnf and python3-dnf on CoreOS allows anyone with access to the system to install
16+
or modify packages, potentially altering the operating system and undermining its immutability.
17+
Attackers or unauthorized users could also reconfigure DNF to use untrusted repositories,
18+
introducing malicious software or vulnerabilities. Removing dnf and python3-dnf prevents
19+
unauthorized changes and maintains system integrity.
20+
21+
severity: high
22+
23+
ocil_clause: 'the packages are installed'
24+
25+
ocil: |-
26+
To verify that the <tt>dnf</tt> and <tt>python3-dnf</tt> packages are not installed,
27+
run the following command:
28+
<pre>$ rpm -q dnf python3-dnf</pre>
29+
The output should indicate that both packages are not installed.
30+
31+
fixtext: |-
32+
To remove the dnf and python3-dnf packages, execute the following command:
33+
34+
$ rpm-ostree override remove dnf python3-dnf
35+
36+
A reboot is required for the changes to take effect.
37+
38+
template:
39+
name: package_removed
40+
vars:
41+
pkgname:
42+
- dnf
43+
- python3-dnf

‎linux_os/guide/system/software/system-tools/package_socat_removed/rule.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
documentation_complete: true
2+
3+
title: 'Uninstall socat Package'
4+
5+
description: |-
6+
{{{ describe_package_remove(package="socat") }}}
7+
8+
rationale: |-
9+
Utilities such as socat can be used for legitimate troubleshooting,
10+
but they also present a significant security risk if misused by attackers
11+
to create unauthorized network connections, transfer data, or establish
12+
reverse shells. While socat is not installed by default on CoreOS, it is
13+
available in standard repositories and could be added with sufficient
14+
privileges. Removing these tools from systems reduces the risk of
15+
unauthorized access and data exfiltration.
16+
17+
severity: high
18+
19+
{{{ complete_ocil_entry_package_removed("socat") }}}
20+
21+
fixtext: |-
22+
To remove the socat package, run the following command:
23+
24+
$ rpm-ostree override remove socat
25+
26+
A reboot is required for the changes to take effect.
27+
28+
template:
29+
name: package_removed
30+
vars:
31+
pkgname: socat

‎products/rhcos4/profiles/default.profile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,11 @@ selections:
185185
- grub2_ipv6_disable_argument
186186
- file_permissions_backup_etc_group
187187
- etc_system_fips_exists
188+
- package_at_removed
188189
- package_net-snmp_removed
190+
- package_netcat_removed
191+
- package_python3_dnf_removed
192+
- package_socat_removed
189193
- package_fapolicyd_installed
190194
- audit_rules_for_ospp
191195
- sshd_enable_pam

‎shared/macros/10-bash.jinja‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -485,7 +485,12 @@ zypper install -y "{{{ package }}}"
485485

486486
#}}
487487
{{%- macro bash_package_remove(package) -%}}
488-
{{%- if pkg_manager is defined -%}}
488+
{{%- if product == "rhcos4" -%}}
489+
# RHCOS uses rpm-ostree for package management
490+
if rpm -q --quiet "{{{ package }}}" ; then
491+
rpm-ostree override remove "{{{ package }}}"
492+
fi
493+
{{%- elif pkg_manager is defined -%}}
489494
{{%- if pkg_manager == "yum" or pkg_manager == "dnf" -%}}
490495
if rpm -q --quiet "{{{ package }}}" ; then
491496
{{% if SSG_TEST_SUITE_ENV %}}

0 commit comments

Comments
 (0)