{"push_id":714891815,"size":51,"distinct_size":51,"ref":"refs/heads/build_all_guides","head":"2f3b24cd93176c46b3bfcdc240e8096eff764dd4","before":"950f17994df48158bd983d153a3fe810d8f63208","commits":[{"sha":"6bf7e4a1e0d5822758df4a5eb37703e89c77a86f","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] Fedora 20 EOL\n\nFedora 20 is now End Of Life:\n  https://lists.fedoraproject.org/pipermail/devel/2015-June/211693.html\n\ntherefore update list of CPEs for Fedora benchmark","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/6bf7e4a1e0d5822758df4a5eb37703e89c77a86f"},{"sha":"864d5d4822eb6ac0e8c7a4ce2ada26c38999c92e","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [shared] Change former 'installed_OS_is_fedora19' OVAL\ncheck to be more universal - working for any Fedora OS version, not just\nexplicitly for Fedora 19.\n\nUpdate 'accounts_password_pam_retry' OVAL check to start using the\nmodified 'installed_OS_is_fedora' version","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/864d5d4822eb6ac0e8c7a4ce2ada26c38999c92e"},{"sha":"7a634ba5a6fc99b82d6d845e855cc4f534283d03","author":{"email":"54669547a225ff20cba8b75a4adca540eef25858@preisler.me","name":"Martin Preisler"},"message":"Merge pull request #587 from iankko/fedora20_eol\n\n[Enhancement] Fedora 20 EOL","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/7a634ba5a6fc99b82d6d845e855cc4f534283d03"},{"sha":"170b196f18a9dbd62c7f732fd91f3b7761e38c66","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [RHEL/7] [Fedora] Fix 'disable_prelink' OVAL check on RHEL-7 and\nFedora systems to work properly also in default configuration (\"prelink\"\nRPM package is not installed by default on these products)","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/170b196f18a9dbd62c7f732fd91f3b7761e38c66"},{"sha":"e8d3fda5ef15fb37725d37023aa4ee391a5d7c4c","author":{"email":"443646d156d0e0db4e143fd54251ca15b42bcccb@redhat.com","name":"Shawn Wells"},"message":"Merge pull request #588 from iankko/rhel7_fedora_disable_prelink_oval_fix\n\n[BugFix] [RHEL/7] [Fedora] Fix 'disable_prelink' OVAL check on RHEL-7 && Fedora systems not to return false positive in the default system install","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/e8d3fda5ef15fb37725d37023aa4ee391a5d7c4c"},{"sha":"51e144aadd74cd17b97bd4af10f56e90230fbe3a","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] fix_audit_watch_rule remediation function enhancements:\n\n* move the implementation into shared/fixes/bash/templates directory\n  (instead it to be RHEL-6 specific),\n\n* enhance it to take another 'audit tool' argument in order to:\n  * it would be possible to specify which tool of 'auditctl' and\n    'augenrules' is used to load audit rules,\n  * it would work also on RHEL-7 and Fedora systems\n\n* update existing RHEL/6 remediation scripts implementations utilizing\n  this function with proper value of the added 'audit tool' argument,\n\n* add input arguments sanity check for this function (it to raise an\n  error, when called incorrectly)","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/51e144aadd74cd17b97bd4af10f56e90230fbe3a"},{"sha":"0ef14e90977e47bcc65e75b8dec52f9819e77bf7","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] Enhance 'fix_audit_syscall_rule' remediation function\nto be able to properly fix both 'auditctl' and also 'augenrules'\naudit rules locations.\n\nThis enhancement allows this remediation function to be used also\non RHEL-7 and Fedora systems to fix audit syscall rule instances.\n\nDemonstrate the future use of that function to create a remediation\nfor RHEL-7 'audit_rules_file_deletion_events' rule.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/0ef14e90977e47bcc65e75b8dec52f9819e77bf7"},{"sha":"27743ac83a2745e4b54ed85fe9600f42ac0c56b5","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] Modify the existing RHEL/6 calls of 'fix_audit_syscall_rule'\nremediation function to use five arguments (the audit tool used to\nload audit rules being the first one), as required by recent\n'fix_audit_syscall_rule' declaration change","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/27743ac83a2745e4b54ed85fe9600f42ac0c56b5"},{"sha":"cc75124bb57c5e30e34804afa945f33df0abb000","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [Infrastructure] Fix issues reported by the ShellCheck tool\non the 'fix_audit_syscall_rule' and 'fix_audit_watch_rule' remediation functions","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/cc75124bb57c5e30e34804afa945f33df0abb000"},{"sha":"89858cd68b031bdccbec631e299269946478af20","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] New remediation for audit 'audit_rules_kernel_module_loading' rule\n\nAlso while on these quote the array expansion in:\n* audit_rules_file_deletion_events,\n* audit_rules_kernel_module_loading\n\nrules (ShellCheck recommendation)","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/89858cd68b031bdccbec631e299269946478af20"},{"sha":"9a8c2a2816ee9b0eb7ef2cafec50e811b6b98a03","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] New remediation for 'audit_rules_sysadmin_actions' rule\n\nAlso update remediation fixes for 'audit_rules_file_deletion_events' and\n'audit_rules_kernel_module_loading' they to start using same layout","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/9a8c2a2816ee9b0eb7ef2cafec50e811b6b98a03"},{"sha":"139070644a34a645735eee8b70f80bfad960566b","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [RHEL/6] 'audit_rules_media_export' rule remediation - fix\nquote RULE_ARCHS bash array expansion (fixes ShellCheck warning)\n\n[Enhancement] [RHEL/7] New remediation for 'audit_rules_media_export' rule\n\nTesting report:\n---------------\nTested the changed manually on both of RHEL-6 && RHEL-7 systems && verified\nit works as expected","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/139070644a34a645735eee8b70f80bfad960566b"},{"sha":"e47c5ec6dc36eac2d38f1a5cd09fdfdd99d83a7f","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] Add new remediation for 'audit_rules_unsuccessful_file_modification' rule\n\nOther small bugfixes:\n[BugFix] [RHEL/6] audit_rules_media_export rule enhance the '-key' value in the PATTERN to be '*'\n[BugFix] [RHEL/6] audit_rules_unsuccessful_file_modification:\n  * fix one ShellCheck warning,\n  * enhance '-key' value in the PATTERN to be '*' instead of concrete string\n\nTesting report:\n---------------\nVerified manually on both of RHEL-6 && RHEL-7 the proposed changes work fine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/e47c5ec6dc36eac2d38f1a5cd09fdfdd99d83a7f"},{"sha":"e426d19f8838f426f4ff86d71379026ef46cdcf7","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/6] [RHEL/7] New RHEL-6 && RHEL-7 remediation\nfor 'audit_rules_session_events' rule\n\nTesting report:\n---------------\nTested manually on both systems -- RHEL-6 and RHEL-7 (with both\n'auditctl' and 'augenrules' settings in this case) and verified\nthe proposed changes works fine on both of them.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/e426d19f8838f426f4ff86d71379026ef46cdcf7"},{"sha":"753ae6e02d9b219ff9127608d97e62556dcf398d","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] Add new RHEL-7 remediations for the following\naudit DAC 'xattr' group rules:\n* audit_rules_dac_modification_setxattr,\n* audit_rules_dac_modification_removexattr,\n* audit_rules_dac_modification_lsetxattr,\n* audit_rules_dac_modification_lremovexattr,\n* audit_rules_dac_modification_fsetxattr, and\n* audit_rules_dac_modification_fremovexattr\n\nNote: For the case someone might be wondering all the different *.sh\nnames are used for the identical / very same own bash script. The same\nremediation script is able to fix the requirements for all the six different\nsystem calls. We are using multiple copies of the same script, rather than\nsymbolic links, since symbolic links concept wouldn't work e.g. on Microsoft Windows\nsystem.\n\nTesting report:\n---------------\nThe proposed change has been tested on RHEL-7 system, and seems to be working\nfine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/753ae6e02d9b219ff9127608d97e62556dcf398d"},{"sha":"ab883fcff537a06b1aca0b78dd8824cfe13342aa","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [RHEL/6] Update RHEL-6 remediation script for the\n'audit_rules_dac_modification_setxattr' rule to start using\n'fix_audit_syscall_rule' remediation function instead of using\nit's own implementation.\n\nReplace symbolic links for:\n* audit_rules_dac_modification_fremovexattr,\n* audit_rules_dac_modification_fsetxattr,\n* audit_rules_dac_modification_lremovexattr,\n* audit_rules_dac_modification_lsetxattr, and\n* audit_rules_dac_modification_removexattr\n\nRHEL-6 remediation scripts with multiple identical copies of the\nsame remediation script (symbolic links concept has been realized\nnot to be working properly when editing the repository content e.g.\non Microsoft Windows OS).\n\nTesting report:\n---------------\nTested the proposed changes manually on RHEL-6 system, and they seem\nto be working fine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/ab883fcff537a06b1aca0b78dd8824cfe13342aa"},{"sha":"f634600339678361b2fd36cc95d8fce6408af3d9","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] Add new RHEL-7 remediations for the following\naudit DAC 'chown' group rules:\n* audit_rules_dac_modification_chown,\n* audit_rules_dac_modification_fchown,\n* audit_rules_dac_modification_fchownat, and\n* audit_rules_dac_modification_lchown.\n\nNote: It is intended the four remediation fixes are identical (one\nscript fixes the settings for all four of the system calls). Since\nit's not good to use symbolic links, we use multiple copies.\n\nTesting report:\n---------------\nThe proposed change has been tested on RHEL-7 system and seems to be\nworking fine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/f634600339678361b2fd36cc95d8fce6408af3d9"},{"sha":"2121fbeb501cceec8542ca41b6f920f1d665502e","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [RHEL/6] Start using the 'fix_audit_syscall_rule' remediation\nfunction for the following RHEL-6 audit DAC 'chown' group remediations:\n* audit_rules_dac_modification_chown,\n* audit_rules_dac_modification_fchown,\n* audit_rules_dac_modification_fchownat,\n* audit_rules_dac_modification_lchown.\n\nThis change replaces the current 'audit_rules_dac_modification_chown'\nRHEL-6 remediation script own implementation by calling the 'fix_audit_syscall_rule'\nuniversal remediation function with proper arguments.\n\nFormer symbolic links for the other three remediations have been replaced\nwith own copies of the very same file (symbolic links shouldn't be used).\n\nTesting report:\n---------------\nTested the proposed change manually on RHEL-6 system, and it seems\nto be working fine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/2121fbeb501cceec8542ca41b6f920f1d665502e"},{"sha":"8760a939fa441879f949c028422328a6b4a2009c","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[Enhancement] [RHEL/7] Add new RHEL-7 remediations for the following\naudit DAC 'chmod' group rules:\n* audit_rules_dac_modification_chmod,\n* audit_rules_dac_modification_fchmod, and\n* audit_rules_dac_modification_fchmodat\n\nTesting report:\n---------------\nVerified manually on RHEL-7 (both with using 'auditctl' and 'augenrules')\nthe change is working fine.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/8760a939fa441879f949c028422328a6b4a2009c"},{"sha":"98b73e658a926b22df276f113d926bf331942f6f","author":{"email":"e37a56a2335d0871acbecdea8315e90f18c3461f@redhat.com","name":"Jan Lieskovsky"},"message":"[BugFix] [RHEL/6] Replace own implementation of the remediation\nfix for the following RHEL-6 rules:\n* audit_rules_dac_modification_chmod,\n* audit_rules_dac_modification_fchmod, and\n* audit_rules_dac_modification_fchmodat\n\nwith the call of universal fix_audit_syscall_rule remediation\nfunction with proper arguments.\n\nTesting report:\n---------------\nVerified manually on RHEL-6 system the propose change is working\nfine for all three rules touched by this change.","distinct":true,"url":"https://api.github.com/repos/mpreisler/scap-security-guide/commits/98b73e658a926b22df276f113d926bf331942f6f"}]}