diff --git a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/ansible/shared.yml index 13dbf9ec612f..6bb54d80f23d 100644 --- a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/ansible/shared.yml @@ -6,7 +6,7 @@ {{{ ansible_instantiate_variables("var_logind_session_timeout") }}} -{{% if product in ["sle15", "sle16"] %}} +{{% if product in ["rhel9", "rhel10", "sle15", "sle16"] %}} # create drop-in in the /etc/systemd/logind.conf.d/ directory {{% set logind_conf_file = "/etc/systemd/logind.conf.d/oscap-idle-sessions.conf" %}} {{% else %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/bash/shared.sh index 72a2ca90de7e..72e3aa52ba40 100644 --- a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/bash/shared.sh @@ -2,7 +2,7 @@ {{{ bash_instantiate_variables("var_logind_session_timeout") }}} -{{% if product in ["sle15", "sle16"] %}} +{{% if product in ["rhel9", "rhel10", "sle15", "sle16"] %}} # create drop-in in the /etc/systemd/logind.conf.d/ directory {{% set logind_conf_file = "/etc/systemd/logind.conf.d/oscap-idle-sessions.conf" %}} {{% else %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/oval/shared.xml index e4466d9b0c9b..80c8b6a55aa1 100644 --- a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/oval/shared.xml @@ -1,4 +1,4 @@ -{{% if product in ["sle15", "sle16"] %}} +{{% if product in ["rhel9", "rhel10", "sle15", "sle16"] %}} {{% set logind_conf_file = "/etc/systemd/logind.conf.d/" %}} {{% else %}} {{% set logind_conf_file = "/etc/systemd/logind.conf" %}} @@ -6,7 +6,7 @@ - {{% if product in ["sle15", "sle16"] %}} + {{% if product in ["rhel9", "rhel10", "sle15", "sle16"] %}} {{{ oval_metadata("Ensure 'StopIdleSessionSec' is configured with desired value in section 'Login' in {{{ logind_conf_file }}}", rule_title=rule_title) }}} diff --git a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/tests/common.sh b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/tests/common.sh index 441b663d9240..f40b296ec76b 100644 --- a/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/tests/common.sh +++ b/linux_os/guide/system/accounts/accounts-physical/logind_session_timeout/tests/common.sh @@ -3,7 +3,7 @@ # this file prepares unified test environment used by other scenarios # These should be tuned per product to match defaults -{{% if product in ["sle15", "sle16"] %}} +{{% if product in ["rhel9", "rhel10", "sle15", "sle16"] %}} LOGIND_CONF_FILE="/etc/systemd/logind.conf.d/oscap-idle-sessions.conf" mkdir -p /etc/systemd/logind.conf.d/ {{% else %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml index 0faa359e3937..a8bf7416aa2e 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml @@ -11,6 +11,7 @@ dest: /etc/systemd/system/emergency.service.d/10-oscap.conf block: | [Service] + ExecStart= ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency {{% else %}} - name: Require emergency mode password diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh index a9995656d996..43dda82dea2f 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh @@ -16,6 +16,7 @@ sulogin='/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default {{% if 'sle' in product or 'rhel' in product or product == 'fedora' or product == 'slmicro5' or 'ol' in families %}} mkdir -p "${service_dropin_cfg_dir}" echo "[Service]" >> "${service_dropin_file}" +echo "ExecStart=" >> "${service_dropin_file}" echo "ExecStart=-$sulogin" >> "${service_dropin_file}" {{% else %}} if grep "^ExecStart=.*" "$service_file" ; then diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml index 3a3bc5278b49..b5fe9798720c 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml @@ -28,6 +28,9 @@ references: stigid@ol7: OL07-00-021031 stigid@ol8: OL08-00-010700 +identifiers: + cce@rhel9: CCE-86469-4 + ocil_clause: 'there is output' ocil: |- diff --git a/products/rhel9/controls/stig_rhel9.yml b/products/rhel9/controls/stig_rhel9.yml index 7007e84787f1..902c50ec108a 100644 --- a/products/rhel9/controls/stig_rhel9.yml +++ b/products/rhel9/controls/stig_rhel9.yml @@ -1303,7 +1303,7 @@ controls: title: All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user. rules: - - dir_perms_world_writable_root_owned + - dir_perms_world_writable_system_owned status: automated - id: RHEL-09-232245 @@ -2087,9 +2087,10 @@ controls: - id: RHEL-09-271065 levels: - medium - title: RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity. + title: RHEL 9 must automatically lock graphical user sessions after 10 minutes of inactivity. rules: - dconf_gnome_screensaver_idle_delay + - inactivity_timeout_value=10_minutes status: automated - id: RHEL-09-271070 @@ -2511,7 +2512,7 @@ controls: title: RHEL 9 must terminate idle user sessions. rules: - logind_session_timeout - - var_logind_session_timeout=15_minutes + - var_logind_session_timeout=10_minutes status: automated - id: RHEL-09-431010 @@ -3500,6 +3501,16 @@ controls: - audit_rules_privileged_commands_crontab status: automated + - id: RHEL-09-654097 + levels: + - medium + title: RHEL 9 must audit any script or executable called by cron as root or by any privileged user. + rules: + - audit_rules_etc_cron_d + - audit_rules_var_spool_cron + status: automated + + - id: RHEL-09-654100 levels: - medium diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index f1dff1792b67..a9080fc38054 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -3,7 +3,6 @@ CCE-86461-1 CCE-86465-2 CCE-86466-0 CCE-86468-6 -CCE-86469-4 CCE-86482-7 CCE-86483-5 CCE-86484-3 diff --git a/shared/references/disa-stig-rhel9-v2r6-xccdf-manual.xml b/shared/references/disa-stig-rhel9-v2r7-xccdf-manual.xml similarity index 83% rename from shared/references/disa-stig-rhel9-v2r6-xccdf-manual.xml rename to shared/references/disa-stig-rhel9-v2r7-xccdf-manual.xml index 8381fa5bfa40..b4685141b79d 100644 --- a/shared/references/disa-stig-rhel9-v2r6-xccdf-manual.xml +++ b/shared/references/disa-stig-rhel9-v2r7-xccdf-manual.xml @@ -1,10 +1,13 @@ -acceptedRed Hat Enterprise Linux 9 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 6 Benchmark Date: 01 Oct 20253.5.11.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>