From f6287d146762b8360bd7099f4724a58eedba7d2a Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Wed, 14 Jun 2023 07:46:55 -0400 Subject: [PATCH] scap-security-guide: add openembedded Signed-off-by: Armin Kuster Upstream-Status: Pending Signed-off-by: Armin Kuster --- CMakeLists.txt | 5 +++ build_product | 1 + products/openembedded/CMakeLists.txt | 6 ++++ products/openembedded/product.yml | 19 +++++++++++ .../openembedded/profiles/standard.profile | 12 +++++++ .../openembedded/transforms/constants.xslt | 10 ++++++ .../oval/installed_OS_is_openembedded.xml | 33 +++++++++++++++++++ .../oval/sysctl_kernel_ipv6_disable.xml | 1 + ssg/constants.py | 5 ++- 9 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 products/openembedded/CMakeLists.txt create mode 100644 products/openembedded/product.yml create mode 100644 products/openembedded/profiles/standard.profile create mode 100644 products/openembedded/transforms/constants.xslt create mode 100644 shared/checks/oval/installed_OS_is_openembedded.xml diff --git a/CMakeLists.txt b/CMakeLists.txt index 85ec289644..09ac96784e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -95,6 +95,7 @@ option(SSG_PRODUCT_UBUNTU1804 "If enabled, the Ubuntu 18.04 SCAP content will be option(SSG_PRODUCT_UBUNTU2004 "If enabled, the Ubuntu 20.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_UBUNTU2204 "If enabled, the Ubuntu 22.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_UOS20 "If enabled, the Uos 20 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) +option(SSG_PRODUCT_OE "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_CENTOS_DERIVATIVES_ENABLED "If enabled, CentOS derivative content will be built from the RHEL content" TRUE) @@ -289,6 +290,7 @@ message(STATUS "Ubuntu 18.04: ${SSG_PRODUCT_UBUNTU1804}") message(STATUS "Ubuntu 20.04: ${SSG_PRODUCT_UBUNTU2004}") message(STATUS "Ubuntu 22.04: ${SSG_PRODUCT_UBUNTU2204}") message(STATUS "Uos 20: ${SSG_PRODUCT_UOS20}") +message(STATUS "OpenEmbedded nodistro: ${SSG_PRODUCT_OE}") @@ -410,6 +412,9 @@ endif() if (SSG_PRODUCT_UOS20) add_subdirectory("products/uos20" "uos20") endif() +if (SSG_PRODUCT_OE) + add_subdirectory("products/openembedded" "openembedded") +endif() # ZIP only contains source datastreams and kickstarts, people who # want sources to build from should get the tarball instead. diff --git a/build_product b/build_product index fc793cbe70..197d925b7e 100755 --- a/build_product +++ b/build_product @@ -333,6 +333,7 @@ all_cmake_products=( UBUNTU2204 UOS20 MACOS1015 + OPENEMBEDDED ) DEFAULT_OVAL_MAJOR_VERSION=5 diff --git a/products/openembedded/CMakeLists.txt b/products/openembedded/CMakeLists.txt new file mode 100644 index 0000000000..1981adf53e --- /dev/null +++ b/products/openembedded/CMakeLists.txt @@ -0,0 +1,6 @@ +# Sometimes our users will try to do: "cd openembedded; cmake ." That needs to error in a nice way. +if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") + message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") +endif() + +ssg_build_product("openembedded") diff --git a/products/openembedded/product.yml b/products/openembedded/product.yml new file mode 100644 index 0000000000..9f2f12d737 --- /dev/null +++ b/products/openembedded/product.yml @@ -0,0 +1,19 @@ +product: openembedded +full_name: OpemEmbedded +type: platform + +benchmark_id: OPENEMBEDDED +benchmark_root: "../../linux_os/guide" + +profiles_root: "./profiles" + +pkg_manager: "dnf" + +init_system: "systemd" + +cpes_root: "../../shared/applicability" +cpes: + - openembedded: + name: "cpe:/o:openembedded" + title: "OpenEmbedded nodistro" + check_id: installed_OS_is_openembedded diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile new file mode 100644 index 0000000000..44339d716c --- /dev/null +++ b/products/openembedded/profiles/standard.profile @@ -0,0 +1,12 @@ +documentation_complete: true + +title: 'Sample Security Profile for OpenEmbedded Distros' + +description: |- + This profile is an sample for use in documentation and example content. + The selected rules are standard and should pass quickly on most systems. + +selections: + - file_owner_etc_passwd + - file_groupowner_etc_passwd + - file_permissions_etc_passwd diff --git a/products/openembedded/transforms/constants.xslt b/products/openembedded/transforms/constants.xslt new file mode 100644 index 0000000000..85e812a7c1 --- /dev/null +++ b/products/openembedded/transforms/constants.xslt @@ -0,0 +1,10 @@ + + + + +OpenEmbedded nodistro +OE nodistro +empty +openembedded + + diff --git a/shared/checks/oval/installed_OS_is_openembedded.xml b/shared/checks/oval/installed_OS_is_openembedded.xml new file mode 100644 index 0000000000..17c2873686 --- /dev/null +++ b/shared/checks/oval/installed_OS_is_openembedded.xml @@ -0,0 +1,33 @@ + + + + OpenEmbedded + + multi_platform_all + + The operating system installed is an OpenEmbedded System + + + + + + + + + + + + + /etc/os-release + + + + + + + /etc/os-release + ^ID=nodistro$ + 1 + + + diff --git a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml index affb9770cb..4f22df262c 100644 --- a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml +++ b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml @@ -8,6 +8,7 @@ multi_platform_debian multi_platform_example multi_platform_fedora + multi_platform_openembedded multi_platform_opensuse multi_platform_ol multi_platform_rhcos diff --git a/ssg/constants.py b/ssg/constants.py index f66ba008fa..630fbdfcb9 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -219,6 +219,7 @@ FULL_NAME_TO_PRODUCT_MAPPING = { "Ubuntu 20.04": "ubuntu2004", "Ubuntu 22.04": "ubuntu2204", "UnionTech OS Server 20": "uos20", + "OpenEmbedded": "openembedded", "Not Applicable" : "example" } @@ -267,7 +268,7 @@ REFERENCES = dict( MULTI_PLATFORM_LIST = ["rhel", "fedora", "rhv", "debian", "ubuntu", "opensuse", "sle", "ol", "ocp", "rhcos", - "example", "eks", "alinux", "uos", "anolis"] + "example", "eks", "alinux", "uos", "anolis", "openembedded"] MULTI_PLATFORM_MAPPING = { "multi_platform_alinux": ["alinux2", "alinux3"], @@ -285,6 +286,7 @@ MULTI_PLATFORM_MAPPING = { "multi_platform_sle": ["sle12", "sle15"], "multi_platform_ubuntu": ["ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204"], "multi_platform_uos": ["uos20"], + "multi_platform_openembedded": ["openembedded"], } RHEL_CENTOS_CPE_MAPPING = { @@ -454,6 +456,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = { 'ocp': 'Red Hat OpenShift Container Platform', 'rhcos': 'Red Hat Enterprise Linux CoreOS', 'eks': 'Amazon Elastic Kubernetes Service', + 'openembedded': 'OpenEmbedded', } # References that can not be used with product-qualifiers -- 2.34.1