update default profile to keep rules in the data stream

Author: vojtapolasek

products/rhel8/profiles/default.profile

@@ -734,3 +734,6 @@ selections:
     - harden_sshd_ciphers_opensshserver_conf_crypto_policy
     - harden_sshd_macs_opensshserver_conf_crypto_policy
     - sysctl_crypto_fips_enabled
+    - configure_gnutls_tls_crypto_policy
+    - configure_openssl_tls_crypto_policy
+    - sshd_use_approved_kex_ordered_stig

tests/data/profile_stability/rhel8/stig.profile

@@ -140,8 +140,6 @@ clean_components_post_updating
 configure_bind_crypto_policy
 configure_crypto_policy
 configure_firewalld_ports
-configure_gnutls_tls_crypto_policy
-configure_kerberos_crypto_policy
 configure_libreswan_crypto_policy
 configure_usbguard_auditbackend
 configured_firewalld_default_deny
@@ -173,7 +171,6 @@ disable_users_coredumps
 disallow_bypass_password_sudo
 display_login_attempts
 enable_authselect
-enable_dracut_fips_module
 enable_fips_mode
 enable_gpgcheck_for_all_repositories
 encrypt_partitions
@@ -207,6 +204,7 @@ file_permissions_var_log
 file_permissions_var_log_audit
 file_permissions_var_log_messages
 fips_crypto_subpolicy
+fips_custom_stig_sub_policy
 firewalld-backend
 gnome_gdm_disable_automatic_login
 grub2_admin_username
@@ -219,10 +217,6 @@ grub2_pti_argument
 grub2_uefi_admin_username
 grub2_uefi_password
 grub2_vsyscall_argument
-harden_sshd_ciphers_openssh_conf_crypto_policy
-harden_sshd_ciphers_opensshserver_conf_crypto_policy
-harden_sshd_macs_openssh_conf_crypto_policy
-harden_sshd_macs_opensshserver_conf_crypto_policy
 install_smartcard_packages
 installed_OS_is_vendor_supported
 kerberos_disable_no_keytab
@@ -370,7 +364,6 @@ sudo_require_reauthentication
 sudo_restrict_privilege_elevation_to_authorized
 sudoers_default_includedir
 sudoers_validate_passwd
-sysctl_crypto_fips_enabled
 sysctl_fs_protected_hardlinks
 sysctl_fs_protected_symlinks
 sysctl_kernel_core_pattern
@@ -448,7 +441,7 @@ var_ssh_client_rekey_limit_time=1hour
 var_sshd_set_keepalive=1
 var_sssd_certificate_verification_digest_function=sha1
 var_sudo_timestamp_timeout=always_prompt
-var_system_crypto_policy=fips
+var_system_crypto_policy=fips_stig
 var_time_service_set_maxpoll=18_hours
 var_user_initialization_files_regex=all_dotfiles
 wireless_disable_interfaces

tests/data/profile_stability/rhel8/stig_gui.profile

@@ -140,8 +140,6 @@ clean_components_post_updating
 configure_bind_crypto_policy
 configure_crypto_policy
 configure_firewalld_ports
-configure_gnutls_tls_crypto_policy
-configure_kerberos_crypto_policy
 configure_libreswan_crypto_policy
 configure_usbguard_auditbackend
 configured_firewalld_default_deny
@@ -173,7 +171,6 @@ disable_users_coredumps
 disallow_bypass_password_sudo
 display_login_attempts
 enable_authselect
-enable_dracut_fips_module
 enable_fips_mode
 enable_gpgcheck_for_all_repositories
 encrypt_partitions
@@ -207,6 +204,7 @@ file_permissions_var_log
 file_permissions_var_log_audit
 file_permissions_var_log_messages
 fips_crypto_subpolicy
+fips_custom_stig_sub_policy
 firewalld-backend
 gnome_gdm_disable_automatic_login
 grub2_admin_username
@@ -219,10 +217,6 @@ grub2_pti_argument
 grub2_uefi_admin_username
 grub2_uefi_password
 grub2_vsyscall_argument
-harden_sshd_ciphers_openssh_conf_crypto_policy
-harden_sshd_ciphers_opensshserver_conf_crypto_policy
-harden_sshd_macs_openssh_conf_crypto_policy
-harden_sshd_macs_opensshserver_conf_crypto_policy
 install_smartcard_packages
 installed_OS_is_vendor_supported
 kerberos_disable_no_keytab
@@ -368,7 +362,6 @@ sudo_require_reauthentication
 sudo_restrict_privilege_elevation_to_authorized
 sudoers_default_includedir
 sudoers_validate_passwd
-sysctl_crypto_fips_enabled
 sysctl_fs_protected_hardlinks
 sysctl_fs_protected_symlinks
 sysctl_kernel_core_pattern
@@ -446,7 +439,7 @@ var_ssh_client_rekey_limit_time=1hour
 var_sshd_set_keepalive=1
 var_sssd_certificate_verification_digest_function=sha1
 var_sudo_timestamp_timeout=always_prompt
-var_system_crypto_policy=fips
+var_system_crypto_policy=fips_stig
 var_time_service_set_maxpoll=18_hours
 var_user_initialization_files_regex=all_dotfiles
 wireless_disable_interfaces