Update Rhel8 stig v2r8 to v2r9

controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml

@@ -1,80 +1,81 @@
 controls:
-    -   id: SRG-OS-000037-GPOS-00015
-        levels:
-            - medium
-        title: {{{ full_name }}} must produce audit records containing information to
-            establish what type of events occurred.
-        rules:
-            - audit_rules_dac_modification_chmod
-            - audit_rules_dac_modification_chown
-            - audit_rules_dac_modification_fchmod
-            - audit_rules_dac_modification_fchmodat
-            - audit_rules_dac_modification_fchmodat2
-            - audit_rules_dac_modification_fchown
-            - audit_rules_dac_modification_fchownat
-            - audit_rules_dac_modification_fremovexattr
-            - audit_rules_dac_modification_fsetxattr
-            - audit_rules_dac_modification_lchown
-            - audit_rules_dac_modification_lremovexattr
-            - audit_rules_dac_modification_lsetxattr
-            - audit_rules_dac_modification_removexattr
-            - audit_rules_dac_modification_setxattr
-            - audit_rules_dac_modification_umount
-            - audit_rules_dac_modification_umount2
-            - audit_rules_execution_chacl
-            - audit_rules_execution_setfacl
-            - audit_rules_execution_chcon
-            - audit_rules_execution_semanage
-            - audit_rules_execution_setfiles
-            - audit_rules_execution_setsebool
-            - audit_rules_file_deletion_events_rename
-            - audit_rules_file_deletion_events_renameat
-            - audit_rules_file_deletion_events_renameat2
-            - audit_rules_file_deletion_events_rmdir
-            - audit_rules_file_deletion_events_unlink
-            - audit_rules_file_deletion_events_unlinkat
-            - audit_rules_unsuccessful_file_modification_creat
-            - audit_rules_unsuccessful_file_modification_ftruncate
-            - audit_rules_unsuccessful_file_modification_open
-            - audit_rules_unsuccessful_file_modification_open_by_handle_at
-            - audit_rules_unsuccessful_file_modification_openat
-            - audit_rules_unsuccessful_file_modification_truncate
-            - audit_rules_kernel_module_loading_delete
-            - audit_rules_kernel_module_loading_finit
-            - audit_rules_kernel_module_loading_init
-            - audit_rules_login_events_lastlog
-            - audit_rules_privileged_commands_chage
-            - audit_rules_privileged_commands_chsh
-            - audit_rules_privileged_commands_crontab
-            - audit_rules_privileged_commands_gpasswd
-            - audit_rules_privileged_commands_kmod
-            - audit_rules_privileged_commands_modprobe
-            - audit_rules_privileged_commands_mount
-            - audit_rules_privileged_commands_newgrp
-            - audit_rules_privileged_commands_pam_timestamp_check
-            - audit_rules_privileged_commands_passwd
-            - audit_rules_privileged_commands_pkexec
-            - audit_rules_privileged_commands_postdrop
-            - audit_rules_privileged_commands_postqueue
-            - audit_rules_privileged_commands_ssh_agent
-            - audit_rules_privileged_commands_ssh_keysign
-            - audit_rules_privileged_commands_su
-            - audit_rules_privileged_commands_sudo
-            - audit_rules_privileged_commands_sudoedit
-            - audit_rules_privileged_commands_umount
-            - audit_rules_privileged_commands_unix_chkpwd
-            - audit_rules_privileged_commands_unix_update
-            - audit_rules_privileged_commands_userhelper
-            - audit_rules_privileged_commands_usermod
-            - audit_rules_media_export
-            - audit_rules_sudoers
-            - audit_rules_sudoers_d
-            - audit_rules_usergroup_modification_group
-            - audit_rules_usergroup_modification_gshadow
-            - audit_rules_usergroup_modification_opasswd
-            - audit_rules_usergroup_modification_passwd
-            - audit_rules_usergroup_modification_shadow
-            - grub2_audit_argument
-            - service_auditd_enabled
-            - package_audit_installed
-        status: automated
+    - id: SRG-OS-000037-GPOS-00015
+      levels:
+          - medium
+      title: {{{ full_name }}} must produce audit records containing information to
+          establish what type of events occurred.
+      rules:
+          - audit_rules_dac_modification_chmod
+          - audit_rules_dac_modification_chown
+          - audit_rules_dac_modification_fchmod
+          - audit_rules_dac_modification_fchmodat
+          - audit_rules_dac_modification_fchmodat2
+          - audit_rules_dac_modification_fchown
+          - audit_rules_dac_modification_fchownat
+          - audit_rules_dac_modification_fremovexattr
+          - audit_rules_dac_modification_fsetxattr
+          - audit_rules_dac_modification_lchown
+          - audit_rules_dac_modification_lremovexattr
+          - audit_rules_dac_modification_lsetxattr
+          - audit_rules_dac_modification_removexattr
+          - audit_rules_dac_modification_setxattr
+          - audit_rules_dac_modification_umount
+          - audit_rules_dac_modification_umount2
+          - audit_rules_execution_chacl
+          - audit_rules_execution_chcon
+          - audit_rules_execution_semanage
+          - audit_rules_execution_setfacl
+          - audit_rules_execution_setfiles
+          - audit_rules_execution_setsebool
+          - audit_rules_file_deletion_events_rename
+          - audit_rules_file_deletion_events_renameat
+          - audit_rules_file_deletion_events_renameat2
+          - audit_rules_file_deletion_events_rmdir
+          - audit_rules_file_deletion_events_unlink
+          - audit_rules_file_deletion_events_unlinkat
+          - audit_rules_kernel_module_loading_delete
+          - audit_rules_kernel_module_loading_finit
+          - audit_rules_kernel_module_loading_init
+          - audit_rules_login_events_lastlog
+          - audit_rules_media_export
+          - audit_rules_privileged_commands_chage
+          - audit_rules_privileged_commands_chsh
+          - audit_rules_privileged_commands_crontab
+          - audit_rules_privileged_commands_gpasswd
+          - audit_rules_privileged_commands_kmod
+          - audit_rules_privileged_commands_modprobe
+          - audit_rules_privileged_commands_mount
+          - audit_rules_privileged_commands_newgrp
+          - audit_rules_privileged_commands_pam_timestamp_check
+          - audit_rules_privileged_commands_passwd
+          - audit_rules_privileged_commands_pkexec
+          - audit_rules_privileged_commands_postdrop
+          - audit_rules_privileged_commands_postqueue
+          - audit_rules_privileged_commands_ssh_agent
+          - audit_rules_privileged_commands_ssh_keysign
+          - audit_rules_privileged_commands_su
+          - audit_rules_privileged_commands_sudo
+          - audit_rules_privileged_commands_sudoedit
+          - audit_rules_privileged_commands_umount
+          - audit_rules_privileged_commands_unix_chkpwd
+          - audit_rules_privileged_commands_unix_update
+          - audit_rules_privileged_commands_useradd
+          - audit_rules_privileged_commands_userhelper
+          - audit_rules_privileged_commands_usermod
+          - audit_rules_sudoers
+          - audit_rules_sudoers_d
+          - audit_rules_unsuccessful_file_modification_creat
+          - audit_rules_unsuccessful_file_modification_ftruncate
+          - audit_rules_unsuccessful_file_modification_open
+          - audit_rules_unsuccessful_file_modification_open_by_handle_at
+          - audit_rules_unsuccessful_file_modification_openat
+          - audit_rules_unsuccessful_file_modification_truncate
+          - audit_rules_usergroup_modification_group
+          - audit_rules_usergroup_modification_gshadow
+          - audit_rules_usergroup_modification_opasswd
+          - audit_rules_usergroup_modification_passwd
+          - audit_rules_usergroup_modification_shadow
+          - grub2_audit_argument
+          - package_audit_installed
+          - service_auditd_enabled
+      status: automated

controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml

@@ -1,73 +1,74 @@
 controls:
-    -   id: SRG-OS-000042-GPOS-00020
-        levels:
-            - medium
-        title: {{{ full_name }}} must generate audit records containing the full-text
-            recording of privileged commands.
-        rules:
-            - audit_rules_dac_modification_chmod
-            - audit_rules_dac_modification_chown
-            - audit_rules_dac_modification_fchmod
-            - audit_rules_dac_modification_fchmodat
-            - audit_rules_dac_modification_fchmodat2
-            - audit_rules_dac_modification_fchown
-            - audit_rules_dac_modification_fchownat
-            - audit_rules_dac_modification_fremovexattr
-            - audit_rules_dac_modification_fsetxattr
-            - audit_rules_dac_modification_lchown
-            - audit_rules_dac_modification_lremovexattr
-            - audit_rules_dac_modification_lsetxattr
-            - audit_rules_dac_modification_removexattr
-            - audit_rules_dac_modification_setxattr
-            - audit_rules_execution_chacl
-            - audit_rules_execution_setfacl
-            - audit_rules_execution_chcon
-            - audit_rules_execution_semanage
-            - audit_rules_execution_setfiles
-            - audit_rules_execution_setsebool
-            - audit_rules_file_deletion_events_rename
-            - audit_rules_file_deletion_events_renameat
-            - audit_rules_file_deletion_events_renameat2
-            - audit_rules_file_deletion_events_rmdir
-            - audit_rules_file_deletion_events_unlink
-            - audit_rules_file_deletion_events_unlinkat
-            - audit_rules_unsuccessful_file_modification_creat
-            - audit_rules_unsuccessful_file_modification_ftruncate
-            - audit_rules_unsuccessful_file_modification_open
-            - audit_rules_unsuccessful_file_modification_open_by_handle_at
-            - audit_rules_unsuccessful_file_modification_openat
-            - audit_rules_unsuccessful_file_modification_truncate
-            - audit_rules_kernel_module_loading_delete
-            - audit_rules_kernel_module_loading_finit
-            - audit_rules_login_events_lastlog
-            - audit_rules_privileged_commands_chage
-            - audit_rules_privileged_commands_chsh
-            - audit_rules_privileged_commands_crontab
-            - audit_rules_privileged_commands_gpasswd
-            - audit_rules_privileged_commands_kmod
-            - audit_rules_privileged_commands_mount
-            - audit_rules_privileged_commands_newgrp
-            - audit_rules_privileged_commands_pam_timestamp_check
-            - audit_rules_privileged_commands_passwd
-            - audit_rules_privileged_commands_postdrop
-            - audit_rules_privileged_commands_postqueue
-            - audit_rules_privileged_commands_ssh_agent
-            - audit_rules_privileged_commands_ssh_keysign
-            - audit_rules_privileged_commands_su
-            - audit_rules_privileged_commands_sudo
-            - audit_rules_privileged_commands_sudoedit
-            - audit_rules_privileged_commands_umount
-            - audit_rules_privileged_commands_unix_chkpwd
-            - audit_rules_privileged_commands_unix_update
-            - audit_rules_privileged_commands_userhelper
-            - audit_rules_privileged_commands_usermod
-            - audit_rules_media_export
-            - audit_rules_sudoers
-            - audit_rules_sudoers_d
-            - audit_rules_usergroup_modification_group
-            - audit_rules_usergroup_modification_gshadow
-            - audit_rules_usergroup_modification_opasswd
-            - audit_rules_usergroup_modification_passwd
-            - audit_rules_usergroup_modification_shadow
-            - grub2_audit_argument
-        status: automated
+    - id: SRG-OS-000042-GPOS-00020
+      levels:
+          - medium
+      title: {{{ full_name }}} must generate audit records containing the full-text
+          recording of privileged commands.
+      rules:
+          - audit_rules_dac_modification_chmod
+          - audit_rules_dac_modification_chown
+          - audit_rules_dac_modification_fchmod
+          - audit_rules_dac_modification_fchmodat
+          - audit_rules_dac_modification_fchmodat2
+          - audit_rules_dac_modification_fchown
+          - audit_rules_dac_modification_fchownat
+          - audit_rules_dac_modification_fremovexattr
+          - audit_rules_dac_modification_fsetxattr
+          - audit_rules_dac_modification_lchown
+          - audit_rules_dac_modification_lremovexattr
+          - audit_rules_dac_modification_lsetxattr
+          - audit_rules_dac_modification_removexattr
+          - audit_rules_dac_modification_setxattr
+          - audit_rules_execution_chacl
+          - audit_rules_execution_chcon
+          - audit_rules_execution_semanage
+          - audit_rules_execution_setfacl
+          - audit_rules_execution_setfiles
+          - audit_rules_execution_setsebool
+          - audit_rules_file_deletion_events_rename
+          - audit_rules_file_deletion_events_renameat
+          - audit_rules_file_deletion_events_renameat2
+          - audit_rules_file_deletion_events_rmdir
+          - audit_rules_file_deletion_events_unlink
+          - audit_rules_file_deletion_events_unlinkat
+          - audit_rules_kernel_module_loading_delete
+          - audit_rules_kernel_module_loading_finit
+          - audit_rules_login_events_lastlog
+          - audit_rules_media_export
+          - audit_rules_privileged_commands_chage
+          - audit_rules_privileged_commands_chsh
+          - audit_rules_privileged_commands_crontab
+          - audit_rules_privileged_commands_gpasswd
+          - audit_rules_privileged_commands_kmod
+          - audit_rules_privileged_commands_mount
+          - audit_rules_privileged_commands_newgrp
+          - audit_rules_privileged_commands_pam_timestamp_check
+          - audit_rules_privileged_commands_passwd
+          - audit_rules_privileged_commands_postdrop
+          - audit_rules_privileged_commands_postqueue
+          - audit_rules_privileged_commands_ssh_agent
+          - audit_rules_privileged_commands_ssh_keysign
+          - audit_rules_privileged_commands_su
+          - audit_rules_privileged_commands_sudo
+          - audit_rules_privileged_commands_sudoedit
+          - audit_rules_privileged_commands_umount
+          - audit_rules_privileged_commands_unix_chkpwd
+          - audit_rules_privileged_commands_unix_update
+          - audit_rules_privileged_commands_useradd
+          - audit_rules_privileged_commands_userhelper
+          - audit_rules_privileged_commands_usermod
+          - audit_rules_sudoers
+          - audit_rules_sudoers_d
+          - audit_rules_unsuccessful_file_modification_creat
+          - audit_rules_unsuccessful_file_modification_ftruncate
+          - audit_rules_unsuccessful_file_modification_open
+          - audit_rules_unsuccessful_file_modification_open_by_handle_at
+          - audit_rules_unsuccessful_file_modification_openat
+          - audit_rules_unsuccessful_file_modification_truncate
+          - audit_rules_usergroup_modification_group
+          - audit_rules_usergroup_modification_gshadow
+          - audit_rules_usergroup_modification_opasswd
+          - audit_rules_usergroup_modification_passwd
+          - audit_rules_usergroup_modification_shadow
+          - grub2_audit_argument
+      status: automated

controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml

@@ -63,6 +63,7 @@ controls:
           - audit_rules_privileged_commands_unix_update
           - audit_rules_privileged_commands_userhelper
           - audit_rules_privileged_commands_usermod
+          - audit_rules_privileged_commands_useradd
           - audit_rules_media_export
           - audit_rules_sudoers
           - audit_rules_sudoers_d