-
Notifications
You must be signed in to change notification settings - Fork 706
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add OVAL check for apparmor profile rules
- Loading branch information
1 parent
740e967
commit 944c816
Showing
1 changed file
with
31 additions
and
0 deletions.
There are no files selected for viewing
31 changes: 31 additions & 0 deletions
31
...x_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| <def-group> | ||
| <definition class="compliance" id="{{{ rule_id }}}" version="1"> | ||
| {{{ oval_metadata("Ensure AppArmor profiles are in enforce complain mode") }}} | ||
| <criteria operator="AND"> | ||
| </criteria> | ||
| </definition> | ||
| <ind:textfilecontent54_object id="obj_apparmor_profiles" version="1"> | ||
| <ind:filepath datatype="string">/sys/kernel/security/apparmor/profiles</ind:filepath> | ||
| <ind:pattern operation="pattern match" datatype="string">^.*$</ind:pattern> | ||
| <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| <ind:textfilecontent54_object id="obj_apparmor_enforced_profiles" version="1"> | ||
| <ind:filepath datatype="string">/sys/kernel/security/apparmor/profiles</ind:filepath> | ||
| <ind:pattern operation="pattern match" datatype="string">^\(enforce\)*$</ind:pattern> | ||
| <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| <ind:textfilecontent54_object id="obj_apparmor_complaining_profiles" version="1"> | ||
| <ind:filepath datatype="string">/sys/kernel/security/apparmor/profiles</ind:filepath> | ||
| <ind:pattern operation="pattern match" datatype="string">^\(complain\)*$</ind:pattern> | ||
| <ind:instance operation="greater than or equal" datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| <local_variable datatype="int" id="var_num_apparmor_profiles" version="1" comment="apparmor profiles"> | ||
| <object_component item_field="subexpression" object_ref="obj_apparmor_profiles" /> | ||
| </local_variable> | ||
| <local_variable datatype="int" id="var_num_apparmor_enforced_profiles" version="1" comment="enforce apparmor profiles"> | ||
| <object_component item_field="subexpression" object_ref="obj_apparmor_enforced_profiles" /> | ||
| </local_variable> | ||
| <local_variable datatype="int" id="var_num_apparmor_complaining_profiles" version="1" comment="enforce apparmor profiles"> | ||
| <object_component item_field="subexpression" object_ref="obj_apparmor_complaining_profiles" /> | ||
| </local_variable> | ||
| </def-group> |