Merge pull request #12930 from vojtapolasek/rhel9_stig_add_fapolicy

add rule fapolicy_default_deny to rhel9 stig
ComplianceAsCode · Jan 29, 2025 · 95eed20 · 95eed20
2 parents dc71fb3 + cf95bf9
commit 95eed20
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/controls/stig_rhel9.yml b/controls/stig_rhel9.yml
@@ -2714,6 +2714,14 @@ controls:
             - service_fapolicyd_enabled
         status: automated
 
+    -   id: RHEL-09-433016
+        levels:
+            - medium
+        title: The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
+        rules:
+            - fapolicy_default_deny
+        status: automated
+
     -   id: RHEL-09-611010
         levels:
             - medium

diff --git a/tests/data/profile_stability/rhel9/stig.profile b/tests/data/profile_stability/rhel9/stig.profile
@@ -226,6 +226,7 @@ selections:
 - ensure_gpgcheck_local_packages
 - ensure_gpgcheck_never_disabled
 - ensure_redhat_gpgkey_installed
+- fapolicy_default_deny
 - file_audit_tools_group_ownership
 - file_audit_tools_ownership
 - file_audit_tools_permissions

diff --git a/tests/data/profile_stability/rhel9/stig_gui.profile b/tests/data/profile_stability/rhel9/stig_gui.profile
@@ -238,6 +238,7 @@ selections:
 - ensure_gpgcheck_local_packages
 - ensure_gpgcheck_never_disabled
 - ensure_redhat_gpgkey_installed
+- fapolicy_default_deny
 - file_audit_tools_group_ownership
 - file_audit_tools_ownership
 - file_audit_tools_permissions