Merge branch 'ComplianceAsCode:master' into CMP-4248-rule-impls

Author: vickeybrown

.packit.yaml

@@ -43,6 +43,10 @@ jobs:
   tmt_plan: /plans/upstream-parallel/ansible
   identifier: contest-ansible
 
+- <<: *contest-oscap
+  tmt_plan: /plans/upstream-parallel/other
+  identifier: contest-other
+
 # when modifying anything below, modify also tests/tmt/
 
 - job: tests

components/chrony.yml

@@ -14,6 +14,7 @@ rules:
 - service_chronyd_enabled
 - chrony_set_nts
 - chronyd_client_only
+- chronyd_configure_local_socket
 - chronyd_no_chronyc_network
 - chronyd_or_ntpd_specify_multiple_servers
 - chronyd_sync_clock

components/ntp.yml

@@ -5,6 +5,7 @@ packages:
 - ntp
 rules:
 - chronyd_client_only
+- chronyd_configure_local_socket
 - chronyd_configure_pool_and_server
 - chronyd_no_chronyc_network
 - chronyd_or_ntpd_set_maxpoll

components/pam.yml

@@ -64,6 +64,7 @@ rules:
 - accounts_passwords_pam_faillock_deny
 - accounts_passwords_pam_faillock_deny_root
 - accounts_passwords_pam_faillock_dir
+- accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
 - accounts_passwords_pam_faillock_enforce_local
 - accounts_passwords_pam_faillock_interval
 - accounts_passwords_pam_faillock_silent

controls/cis_fedora.yml

@@ -2083,7 +2083,8 @@ controls:
           - l2_workstation
       status: automated
       rules:
-          - accounts_passwords_pam_faillock_deny_root
+          - accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
+          - var_accounts_passwords_pam_faillock_root_unlock_time=60
 
     - id: 5.3.3.2.1
       title: Ensure password number of changed characters is configured (Automated)

controls/cusp_fedora.yml

@@ -271,6 +271,7 @@ controls:
           # chrony
           - chronyd_client_only
           - chronyd_no_chronyc_network
+          - chronyd_configure_local_socket
           - chronyd_or_ntpd_set_maxpoll
           - chronyd_run_as_chrony_user
           - chronyd_specify_remote_server

controls/nist_rhcos4.yml

@@ -5222,6 +5222,7 @@ controls:
           https://issues.redhat.com/browse/CMP-274
       rules:
           - chronyd_no_chronyc_network
+          - chronyd_configure_local_socket
       description: |-
           The organization:
            (a)   Reviews the information system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

controls/stig_ol9.yml

@@ -1416,6 +1416,7 @@ controls:
       title: OL 9 must disable network management of the chrony daemon.
       rules:
           - chronyd_no_chronyc_network
+          - chronyd_configure_local_socket
       status: automated
 
     - id: OL09-00-006003

linux_os/guide/auditing/auditd_configure_rules/audit_rules_enable_syscall_auditing/ansible/shared.yml

@@ -57,6 +57,7 @@
     name: auditd.service
     state: restarted
   when:
-    - ansible_facts.services["auditd.service"].state == "running"
+    - ("auditd.service" in ansible_facts.services and
+       ansible_facts.services["auditd.service"].state == "running")
     - (augenrules_syscall_auditing_rule_update_result.changed or
        auditctl_syscall_auditing_rule_update_result.changed)

linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml

@@ -67,4 +67,5 @@
   when:
     - (augenrules_audit_rules_privilege_function_update_result.changed or
        auditctl_audit_rules_privilege_function_update_result.changed)
-    - ansible_facts.services["auditd.service"].state == "running"
+    - ("auditd.service" in ansible_facts.services and
+       ansible_facts.services["auditd.service"].state == "running")