forked from ComplianceAsCode/content
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathtemplate_OVAL_kernel_module_disabled
124 lines (101 loc) · 6.79 KB
/
template_OVAL_kernel_module_disabled
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
<def-group>
<definition class="compliance"
id="kernel_module_{{{ KERNMODULE }}}_disabled" version="1">
<metadata>
<title>Disable {{{ KERNMODULE }}} Kernel Module</title>
{{{- oval_affected(products) }}}
<description>The kernel module {{{ KERNMODULE }}} should be disabled.</description>
</metadata>
<criteria operator="OR">
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_disabled" comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modprobe.d" />
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_modprobeconf" comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modprobe.conf" />
{{% if product != "rhel6" %}}
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_etcmodules-load" comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modules-load.d" />
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_runmodules-load" comment="kernel module {{{ KERNMODULE }}} disabled in /run/modules-load.d" />
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_libmodules-load" comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modules-load.d" />
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_runmodprobed" comment="kernel module {{{ KERNMODULE }}} disabled in /run/modprobe.d" />
<criterion test_ref="test_kernmod_{{{ KERNMODULE }}}_libmodprobed" comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modprobe.d" />
{{% endif %}}
</criteria>
</definition>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_disabled" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_disabled" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_modprobeconf" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modprobe.conf">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_modprobeconf" />
</ind:textfilecontent54_test>
{{% if product != "rhel6" %}}
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_etcmodules-load" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modules-load.d">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_etcmodules-load" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_runmodules-load" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /run/modules-load.d">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_runmodules-load" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_libmodules-load" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modules-load.d">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_libmodules-load" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_runmodprobed" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /run/modprobe.d">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_runmodprobed" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_test id="test_kernmod_{{{ KERNMODULE }}}_libmodprobed" version="1" check="all"
comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modprobe.d">
<ind:object object_ref="obj_kernmod_{{{ KERNMODULE }}}_libmodprobed" />
</ind:textfilecontent54_test>
{{% endif %}}
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_disabled"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled">
<ind:path>/etc/modprobe.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_modprobeconf"
version="1" comment="Check deprecated /etc/modprobe.conf for disablement of {{{ KERNMODULE }}}">
<ind:filepath>/etc/modprobe.conf</ind:filepath>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% if product != "rhel6" %}}
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_etcmodules-load"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled in /etc/modules-load.d">
<ind:path>/etc/modules-load.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_runmodules-load"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled in /run/modules-load.d">
<ind:path>/run/modules-load.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_libmodules-load"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modules-load.d">
<ind:path>/usr/lib/modules-load.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_runmodprobed"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled in /run/modprobe.d">
<ind:path>/run/modprobe.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="obj_kernmod_{{{ KERNMODULE }}}_libmodprobed"
version="1" comment="kernel module {{{ KERNMODULE }}} disabled in /usr/lib/modprobe.d">
<ind:path>/usr/lib/modprobe.d</ind:path>
<ind:filename operation="pattern match">^.*\.conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*install\s+{{{ KERNMODULE }}}\s+(/bin/false|/bin/true)$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% endif %}}
</def-group>