Merge pull request #14125 from mrkanon/update-ol8-profiles-hipaa

Update hipaa profile for OL8

Author: Xeicker

products/ol8/profiles/hipaa.profile

@@ -1,4 +1,4 @@
-documentation_complete: True
+documentation_complete: true
 
 reference: https://www.hhs.gov/hipaa/for-professionals/index.html
 
@@ -17,148 +17,72 @@ description: |-
     Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
 
 selections:
-    - grub2_password
-    - grub2_uefi_password
-    - file_groupowner_grub2_cfg
-    - file_groupowner_efi_grub2_cfg
-    - file_permissions_grub2_cfg
-    - file_permissions_efi_grub2_cfg
-    - file_owner_grub2_cfg
-    - file_owner_efi_grub2_cfg
-    - grub2_disable_interactive_boot
-    - no_direct_root_logins
-    - no_empty_passwords
-    - require_singleuser_auth
-    - restrict_serial_port_logins
-    - securetty_root_login_console_only
-    - service_debug-shell_disabled
-    - disable_ctrlaltdel_reboot
-    - disable_ctrlaltdel_burstaction
-    - dconf_db_up_to_date
-    - dconf_gnome_remote_access_credential_prompt
-    - dconf_gnome_remote_access_encryption
-    - sshd_disable_empty_passwords
-    - sshd_disable_root_login
-    - libreswan_approved_tunnels
+    - hipaa:all
     - no_rsh_trust_files
-    - package_rsh-server_removed
-    - package_talk_removed
-    - package_talk-server_removed
-    - package_telnet_removed
-    - package_telnet-server_removed
-    - package_xinetd_removed
-    - service_crond_enabled
-    - service_rexec_disabled
-    - service_rlogin_disabled
-    - service_telnet_disabled
-    - service_xinetd_disabled
-    - use_kerberos_security_all_exports
-    - var_authselect_profile=sssd
-    - enable_authselect
-    - disable_host_auth
-    - sshd_allow_only_protocol2
-    - sshd_disable_compression
-    - sshd_disable_gssapi_auth
-    - sshd_disable_kerb_auth
-    - sshd_do_not_permit_user_env
-    - sshd_enable_strictmodes
-    - sshd_enable_warning_banner
-    - var_sshd_set_keepalive=0
-    - sshd_set_keepalive_0
-    - encrypt_partitions
     - var_system_crypto_policy=fips
-    - configure_crypto_policy
-    - configure_ssh_crypto_policy
-    - var_selinux_policy_name=targeted
-    - var_selinux_state=enforcing
-    - grub2_enable_selinux
-    - sebool_selinuxuser_execheap
-    - sebool_selinuxuser_execmod
-    - sebool_selinuxuser_execstack
-    - selinux_confinement_of_daemons
-    - selinux_policytype
-    - selinux_state
-    - service_kdump_disabled
-    - sysctl_fs_suid_dumpable
-    - sysctl_kernel_dmesg_restrict
-    - sysctl_kernel_randomize_va_space
-    - rpm_verify_hashes
-    - rpm_verify_permissions
+    - '!audit_rules_dac_modification_fchmodat2'
+    - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_kernel_module_loading_finit'
+    - '!audit_rules_mac_modification_usr_share'
+    - '!audit_rules_privileged_commands_unix2_chkpwd'
+    - '!audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat'
+    - '!audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write'
+    - '!audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order'
+    - '!audit_rules_unsuccessful_file_modification_open_o_creat'
+    - '!audit_rules_unsuccessful_file_modification_open_o_trunc_write'
+    - '!audit_rules_unsuccessful_file_modification_open_rule_order'
+    - '!audit_rules_unsuccessful_file_modification_openat_o_creat'
+    - '!audit_rules_unsuccessful_file_modification_openat_o_trunc_write'
+    - '!audit_rules_unsuccessful_file_modification_openat_rule_order'
+    - '!audit_rules_unsuccessful_file_modification_rename'
+    - '!audit_rules_unsuccessful_file_modification_renameat'
+    - '!audit_rules_unsuccessful_file_modification_unlink'
+    - '!audit_rules_unsuccessful_file_modification_unlinkat'
+    - '!auditd_data_retention_action_mail_acct'
+    - '!auditd_data_retention_admin_space_left_action'
+    - '!auditd_data_retention_max_log_file_action'
+    - '!auditd_data_retention_max_log_file_action_stig'
+    - '!auditd_data_retention_space_left_action'
+    - '!coreos_audit_option'
+    - '!coreos_disable_interactive_boot'
+    - '!coreos_enable_selinux_kernel_argument'
+    - '!coreos_nousb_kernel_argument'
+    - '!ensure_almalinux_gpgkey_installed'
+    - '!ensure_fedora_gpgkey_installed'
+    - '!ensure_gpgcheck_repo_metadata'
+    - '!ensure_suse_gpgkey_installed'
+    - '!file_groupowner_user_cfg'
+    - '!file_owner_user_cfg'
+    - '!file_permissions_grub2_cfg'
+    - '!file_permissions_user_cfg'
+    - '!grub2_admin_username'
+    - '!grub2_uefi_admin_username'
+    - '!package_audit-audispd-plugins_installed'
+    - '!package_audit_installed'
+    - '!package_cron_installed'
+    - '!package_rsh_removed'
+    - '!package_rsyslog_installed'
+    - '!package_talk-server_removed'
+    - '!package_talk_removed'
+    - '!package_tcp_wrappers_removed'
+    - '!package_ypbind_removed'
+    - '!package_ypserv_removed'
+    - '!partition_for_var_log_audit'
+    - '!require_emergency_target_auth'
+    - '!service_cron_enabled'
+    - '!service_rsh_disabled'
+    - '!service_rsyslog_enabled'
+    - '!service_ypbind_disabled'
+    - '!service_zebra_disabled'
+    - '!sshd_disable_rhosts_rsa'
+    - '!sshd_disable_user_known_hosts'
+    - '!sshd_set_keepalive'
+    - '!sshd_use_approved_ciphers'
+    - '!sshd_use_approved_macs'
+    - '!sshd_use_directory_configuration'
+    - '!sshd_use_priv_separation'
+    - '!ensure_redhat_gpgkey_installed'
+    - '!sysctl_kernel_exec_shield'
+    - var_sshd_set_keepalive=0
     - ensure_oracle_gpgkey_installed
-    - ensure_gpgcheck_globally_activated
-    - ensure_gpgcheck_never_disabled
-    - ensure_gpgcheck_local_packages
-    - grub2_audit_argument
-    - service_auditd_enabled
-    - audit_rules_privileged_commands_sudo
-    - audit_rules_privileged_commands_su
-    - audit_rules_immutable
-    - kernel_module_usb-storage_disabled
-    - service_autofs_disabled
-    - auditd_audispd_syslog_plugin_activated
-    - rsyslog_remote_loghost
-    - auditd_data_retention_flush
-    - audit_rules_dac_modification_chmod
-    - audit_rules_dac_modification_chown
-    - audit_rules_dac_modification_fchmodat
-    - audit_rules_dac_modification_fchmod
-    - audit_rules_dac_modification_fchownat
-    - audit_rules_dac_modification_fchown
-    - audit_rules_dac_modification_fremovexattr
-    - audit_rules_dac_modification_fsetxattr
-    - audit_rules_dac_modification_lchown
-    - audit_rules_dac_modification_lremovexattr
-    - audit_rules_dac_modification_lsetxattr
-    - audit_rules_dac_modification_removexattr
-    - audit_rules_dac_modification_setxattr
-    - audit_rules_execution_chcon
-    - audit_rules_execution_restorecon
-    - audit_rules_execution_semanage
-    - audit_rules_execution_setsebool
-    - audit_rules_file_deletion_events_renameat
-    - audit_rules_file_deletion_events_rename
-    - audit_rules_file_deletion_events_rmdir
-    - audit_rules_file_deletion_events_unlinkat
-    - audit_rules_file_deletion_events_unlink
-    - audit_rules_kernel_module_loading_delete
-    - audit_rules_kernel_module_loading_init
-    - audit_rules_login_events_faillock
-    - audit_rules_login_events_lastlog
-    - audit_rules_login_events_tallylog
-    - audit_rules_mac_modification
-    - audit_rules_media_export
-    - audit_rules_networkconfig_modification
-    - audit_rules_privileged_commands_chage
-    - audit_rules_privileged_commands_chsh
-    - audit_rules_privileged_commands_crontab
-    - audit_rules_privileged_commands_gpasswd
-    - audit_rules_privileged_commands_newgrp
-    - audit_rules_privileged_commands_pam_timestamp_check
-    - audit_rules_privileged_commands_passwd
-    - audit_rules_privileged_commands_postdrop
-    - audit_rules_privileged_commands_postqueue
-    - audit_rules_privileged_commands_ssh_keysign
-    - audit_rules_privileged_commands_sudoedit
-    - audit_rules_privileged_commands_umount
-    - audit_rules_privileged_commands_unix_chkpwd
-    - audit_rules_privileged_commands_userhelper
-    - audit_rules_session_events
-    - audit_rules_sysadmin_actions
-    - audit_rules_system_shutdown
-    - var_audit_failure_mode=panic
-    - audit_rules_time_adjtimex
-    - audit_rules_time_clock_settime
-    - audit_rules_time_settimeofday
-    - audit_rules_time_stime
-    - audit_rules_time_watch_localtime
-    - audit_rules_unsuccessful_file_modification_creat
-    - audit_rules_unsuccessful_file_modification_ftruncate
-    - audit_rules_unsuccessful_file_modification_openat
-    - audit_rules_unsuccessful_file_modification_open_by_handle_at
-    - audit_rules_unsuccessful_file_modification_open
-    - audit_rules_unsuccessful_file_modification_truncate
-    - audit_rules_usergroup_modification_group
-    - audit_rules_usergroup_modification_gshadow
-    - audit_rules_usergroup_modification_opasswd
-    - audit_rules_usergroup_modification_passwd
-    - audit_rules_usergroup_modification_shadow
+    - package_rsh-server_removed