diff --git a/.github/workflows/gate.yaml b/.github/workflows/gate.yaml index 5bb45d2bf94..68a8ced12b1 100644 --- a/.github/workflows/gate.yaml +++ b/.github/workflows/gate.yaml @@ -137,7 +137,7 @@ jobs: run: pip install -r requirements-base.txt -r test-requirements.txt - name: Build run: |- - ./build_product al2023 alinux2 alinux3 anolis23 anolis8 chromium fedora firefox ocp4 rhcos4 rhel8 rhel9 rhel10 + ./build_product al2023 alinux2 alinux3 anolis23 anolis8 fedora firefox ocp4 rhcos4 rhel8 rhel9 rhel10 env: ADDITIONAL_CMAKE_OPTIONS: "-DSSG_OVAL_SCHEMATRON_VALIDATION_ENABLED=OFF" - name: Test diff --git a/.github/workflows/gate_fedora.yml b/.github/workflows/gate_fedora.yml index 4afa21c4293..50a35fd900d 100644 --- a/.github/workflows/gate_fedora.yml +++ b/.github/workflows/gate_fedora.yml @@ -31,7 +31,6 @@ jobs: almalinux9 \ anolis23 \ anolis8 \ - chromium \ eks \ example \ fedora \ diff --git a/.gitpod.launch.json b/.gitpod.launch.json index e6957c92892..dc189eca351 100644 --- a/.gitpod.launch.json +++ b/.gitpod.launch.json @@ -16,7 +16,6 @@ "description": "Select Product Name", "type": "pickString", "options": [ - "chromium", "debian11", "debian12", "eap6", "fedora", diff --git a/CMakeLists.txt b/CMakeLists.txt index 3d381b8db99..7627ee0bdb0 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -90,7 +90,6 @@ option(SSG_PRODUCT_ALINUX3 "If enabled, the Alibaba Cloud Linux 3 SCAP content w option(SSG_PRODUCT_ALMALINUX9 "If enabled, the AlmaLinux OS 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_ANOLIS8 "If enabled, the Anolis OS 8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_ANOLIS23 "If enabled, the Anolis OS 23 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) -option(SSG_PRODUCT_CHROMIUM "If enabled, the Chromium SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_DEBIAN11 "If enabled, the Debian 11 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_DEBIAN12 "If enabled, the Debian 12 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_DEBIAN13 "If enabled, the Debian 13 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) @@ -328,7 +327,6 @@ message(STATUS "Alibaba Cloud Linux 3: ${SSG_PRODUCT_ALINUX3}") message(STATUS "AlmaLinux OS 9: ${SSG_PRODUCT_ALMALINUX9}") message(STATUS "Anolis OS 8: ${SSG_PRODUCT_ANOLIS8}") message(STATUS "Anolis OS 23: ${SSG_PRODUCT_ANOLIS23}") -message(STATUS "Chromium: ${SSG_PRODUCT_CHROMIUM}") message(STATUS "Debian 11: ${SSG_PRODUCT_DEBIAN11}") message(STATUS "Debian 12: ${SSG_PRODUCT_DEBIAN12}") message(STATUS "Debian 13: ${SSG_PRODUCT_DEBIAN13}") @@ -400,10 +398,6 @@ endif() if(SSG_PRODUCT_ANOLIS23) add_subdirectory("products/anolis23" "anolis23") endif() -if(SSG_PRODUCT_CHROMIUM) - add_subdirectory("products/chromium" "chromium") -endif() - if(SSG_PRODUCT_DEBIAN11) add_subdirectory("products/debian11" "debian11") endif() diff --git a/README.md b/README.md index ef141f2e895..3540958fa73 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ The purpose of this project is to create *security policy content* for various platforms — *Red Hat Enterprise Linux*, *Fedora*, *Ubuntu*, *Debian*, *SUSE Linux Enterprise Server (SLES)*,... — -as well as products — *Firefox*, *Chromium*, ... +as well as products — *Firefox*,... We aim to make it as easy as possible to write new and maintain existing security content in all the commonly used formats. diff --git a/build_product b/build_product index c67e704cd5c..76e3d3a6985 100755 --- a/build_product +++ b/build_product @@ -333,7 +333,6 @@ all_cmake_products=( ALMALINUX9 ANOLIS23 ANOLIS8 - CHROMIUM DEBIAN11 DEBIAN12 DEBIAN13 diff --git a/docs/manual/developer/03_creating_content.md b/docs/manual/developer/03_creating_content.md index 81096f3e2a0..60c1ed9c8fa 100644 --- a/docs/manual/developer/03_creating_content.md +++ b/docs/manual/developer/03_creating_content.md @@ -151,10 +151,6 @@ multiple benchmarks in our project:

Firefox

/products/firefox/guide

- -

Chromium

-

/products/chromium/guide

- @@ -353,7 +349,6 @@ endif()
 ...
 all_cmake_products=(
-	CHROMIUM
 	DEBIAN11
  CUSTOM6
 	EAP6
@@ -366,14 +361,13 @@ all_cmake_products=(
 product_directories = ['debian11', 'fedora', 'ol7', 'ol8', 'opensuse',
                        'rhel8', 'rhel9', 'sle12',
                        'ubuntu2404', 'rhosp13',
-                       'chromium', 'eap6', 'firefox',
+                       'eap6', 'firefox',
                        'example', 'custom6']
 ...
 
 ...
 FULL_NAME_TO_PRODUCT_MAPPING = {
-    "Chromium": "chromium",
     "Debian 11": "debian11",
     "Custom 6": "custom6",
     "JBoss EAP 6": "eap6",
@@ -400,7 +394,6 @@ MULTI_PLATFORM_MAPPING = {
 
 ...
 MAKEFILE_ID_TO_PRODUCT_MAP = {
-    'chromium': 'Google Chromium Browser',
     'fedora': 'Fedora',
     'firefox': 'Mozilla Firefox',
     'rhosp': 'Red Hat OpenStack Platform',
diff --git a/docs/manual/user/30_content_notes.md b/docs/manual/user/30_content_notes.md
index 9e1a3e3f4c4..6633f4dea40 100644
--- a/docs/manual/user/30_content_notes.md
+++ b/docs/manual/user/30_content_notes.md
@@ -6,6 +6,7 @@ Below is list of products that have been removed from the project.
 | Product                                      | EOL Date           | Last Release                                                                       |
 |----------------------------------------------|--------------------|------------------------------------------------------------------------------------|
 | Apple macOS 10.15                            | -                  | [content 0.1.76](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76) |
+| Google Chromium                              | -                  | [content 0.1.78](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78) |
 | Debian 8                                     | June 30, 2020      | [content 0.1.52](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.52) |
 | Debian 9                                     | June 30, 2022      | [content 0.1.65](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.65) |
 | Debian 10                                    | June 30, 2024      | [content 0.1.73](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73) |
diff --git a/products/chromium/CMakeLists.txt b/products/chromium/CMakeLists.txt
deleted file mode 100644
index 04dd276760b..00000000000
--- a/products/chromium/CMakeLists.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# Sometimes our users will try to do: "cd chromium; cmake ." That needs to error in a nice way.
-if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
-    message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
-endif()
-
-ssg_build_product("chromium")
diff --git a/products/chromium/guide/benchmark.yml b/products/chromium/guide/benchmark.yml
deleted file mode 100644
index 229e81e8071..00000000000
--- a/products/chromium/guide/benchmark.yml
+++ /dev/null
@@ -1,53 +0,0 @@
----
-documentation_complete: true
-
-title: Guide to the Secure Configuration of {{{ full_name }}}
-
-status: draft
-
-description: |
-    This guide presents a catalog of security-relevant
-    configuration settings for {{{ full_name }}}. It is a rendering of
-    content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
-    in order to support security automation.  The SCAP content is
-    is available in the scap-security-guide package which is developed at
-    {{{ weblink(link="https://www.open-scap.org/security-policies/scap-security-guide") }}}.
-    

- Providing system administrators with such guidance informs them how to securely - configure systems under their control in a variety of network roles. Policy - makers and baseline creators can use this catalog of settings, with its - associated references to higher-level security control catalogs, in order to - assist them in security baseline creation. This guide is a catalog, not a - checklist, and satisfaction of every item is not likely to be possible or - sensible in many operational scenarios. However, the XCCDF format enables - granular selection and adjustment of settings, and their association with OVAL - and OCIL content provides an automated checking capability. Transformations of - this document, and its associated automated checking content, are capable of - providing baselines that meet a diverse set of policy objectives. Some example - XCCDF Profiles, which are selections of items that form checklists and - can be used as baselines, are available with this guide. They can be - processed, in an automated fashion, with tools that support the Security - Content Automation Protocol (SCAP). The DISA STIG for {{{ full_name }}}, - which provides required settings for US Department of Defense systems, is - one example of a baseline created from this guidance. - -notice: - id: terms_of_use - description: | - Do not attempt to implement any of the settings in - this guide without first testing them in a non-operational environment. The - creators of this guidance assume no responsibility whatsoever for its use by - other parties, and makes no guarantees, expressed or implied, about its - quality, reliability, or any other characteristic. - -front-matter: | - The SCAP Security Guide Project
- {{{ weblink(link="https://www.open-scap.org/security-policies/scap-security-guide") }}} - -rear-matter: | - Red Hat and Red Hat Enterprise Linux are either registered - trademarks or trademarks of Red Hat, Inc. in the United States and other - countries. All other names are registered trademarks or trademarks of their - respective companies. - -version: 0.9 diff --git a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/bash/chromium.sh b/products/chromium/guide/chromium/chromium_blacklist_extension_installation/bash/chromium.sh deleted file mode 100644 index 8c1b0777228..00000000000 --- a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "ExtensionInstallBlocklist", '[ "*" ]') }}} diff --git a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/oval/chromium.xml b/products/chromium/guide/chromium/chromium_blacklist_extension_installation/oval/chromium.xml deleted file mode 100644 index 3193a194b2c..00000000000 --- a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Blacklist Extension Installation - - Google Chromium Browser - - Extensions installation must be blacklisted by default. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"ExtensionInstallBlacklist\"\:[\s]+\[\"\*\"\], - 1 - - diff --git a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/rule.yml b/products/chromium/guide/chromium/chromium_blacklist_extension_installation/rule.yml deleted file mode 100644 index 507fdce4f00..00000000000 --- a/products/chromium/guide/chromium/chromium_blacklist_extension_installation/rule.yml +++ /dev/null @@ -1,22 +0,0 @@ -documentation_complete: true - -title: 'Disable All Extensions by Default' - -description: "Extensions are developed by third party sources and are designed to extend \nGoogle Chromium's functionality. As an extension can be made by anyone, all extensions\nshould be blacklisted from installation by default. To blacklist all extensions, set the \nExtensionInstallBlacklist to * in the Chromium policy file." - -rationale: |- - Extensions can access almost anything on a system. This means they pose a high risk - to any system that would allow all extensions to be installed by default. - -severity: unknown - -references: - stigid: DTBC0006 - -ocil_clause: 'extensions are not blacklisted' - -ocil: |- - To verify that all extensions are blacklisted from installing, run the following command: -
$ grep ExtensionInstallBlacklist /etc/chromium/policies/managed/*.json
- The output should contain: -
"ExtensionInstallBlacklist": ["*"],
diff --git a/products/chromium/guide/chromium/chromium_block_desktop_notifications/bash/chromium.sh b/products/chromium/guide/chromium/chromium_block_desktop_notifications/bash/chromium.sh deleted file mode 100644 index 95f27f21513..00000000000 --- a/products/chromium/guide/chromium/chromium_block_desktop_notifications/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultNotificationsSetting", "2") }}} diff --git a/products/chromium/guide/chromium/chromium_block_desktop_notifications/oval/chromium.xml b/products/chromium/guide/chromium/chromium_block_desktop_notifications/oval/chromium.xml deleted file mode 100644 index c5b29d0b091..00000000000 --- a/products/chromium/guide/chromium/chromium_block_desktop_notifications/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Block Desktop Notifications - - Google Chromium Browser - - Sites ability for showing desktop notifications must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DefaultNotificationsSetting\"\:[\s]+2, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_block_desktop_notifications/rule.yml b/products/chromium/guide/chromium/chromium_block_desktop_notifications/rule.yml deleted file mode 100644 index 0680cadca97..00000000000 --- a/products/chromium/guide/chromium/chromium_block_desktop_notifications/rule.yml +++ /dev/null @@ -1,24 +0,0 @@ -documentation_complete: true - -title: 'Prevent Desktop Notifications' - -description: |- - Chromium by default allows websites to display notifications on the desktop. - To disable this setting, set DefaultNotificationsSetting to 2 - in the Chromium policy file. - -rationale: "Disabling Chromium's ability to display notifications on the desktop helps prevent \nmalicious websites from controlling desktop notifications or fooling users into\nclicking on a potentially compromised notification." - -severity: unknown - -references: - stigid: DTBC0003 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that desktop notification is - disabled, run the following command: -
$ grep DefaultNotificationsSetting /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultNotificationsSetting": 2,
diff --git a/products/chromium/guide/chromium/chromium_check_cert_revocation/bash/chromium.sh b/products/chromium/guide/chromium/chromium_check_cert_revocation/bash/chromium.sh deleted file mode 100644 index 93c9b71dc1b..00000000000 --- a/products/chromium/guide/chromium/chromium_check_cert_revocation/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "EnableOnlineRevocationChecks", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_check_cert_revocation/oval/chromium.xml b/products/chromium/guide/chromium/chromium_check_cert_revocation/oval/chromium.xml deleted file mode 100644 index 24b7199a539..00000000000 --- a/products/chromium/guide/chromium/chromium_check_cert_revocation/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Check Certificate Revocation - - Google Chromium Browser - - Online revocation checks must be done. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"EnableOnlineRevocationChecks\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_check_cert_revocation/rule.yml b/products/chromium/guide/chromium/chromium_check_cert_revocation/rule.yml deleted file mode 100644 index b6cc567b0ef..00000000000 --- a/products/chromium/guide/chromium/chromium_check_cert_revocation/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Enable Online OCSP/CRL Certificate Checks' - -description: |- - Certificates can become compromised, and Chromium should check that the - certificates in its store are valid by setting EnableOnlineRevocationChecks - to true in the Chromium policy file. - -rationale: |- - Certificates are revoked when they have been compromised or are no longer valid, - and this option protects users from submitting confidential data to a site that - may be fraudulent or not secure. - -severity: unknown - -references: - stigid: DTBC0037 - -ocil_clause: 'it is not enabled' - -ocil: |- - To verify that online OCSP/CRL checks are enabled, run the following command: -
$ grep EnableOnlineRevocationChecks /etc/chromium/policies/managed/*.json
- The output should contain: -
"EnableOnlineRevocationChecks": true,
diff --git a/products/chromium/guide/chromium/chromium_default_block_plugins/bash/chromium.sh b/products/chromium/guide/chromium/chromium_default_block_plugins/bash/chromium.sh deleted file mode 100644 index cb4df289dab..00000000000 --- a/products/chromium/guide/chromium/chromium_default_block_plugins/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultPluginsSetting", "3") }}} diff --git a/products/chromium/guide/chromium/chromium_default_block_plugins/oval/chromium.xml b/products/chromium/guide/chromium/chromium_default_block_plugins/oval/chromium.xml deleted file mode 100644 index 340d2788a2a..00000000000 --- a/products/chromium/guide/chromium/chromium_default_block_plugins/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Block Plugin Execution By Default - - Google Chromium Browser - - Default behavior must block webpages from automatically running plugins. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DefaultPluginsSetting\"\:[\s]+3, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_default_block_plugins/rule.yml b/products/chromium/guide/chromium/chromium_default_block_plugins/rule.yml deleted file mode 100644 index 5078a52fb5b..00000000000 --- a/products/chromium/guide/chromium/chromium_default_block_plugins/rule.yml +++ /dev/null @@ -1,25 +0,0 @@ -documentation_complete: true - -title: 'Block Plugins by Default' - -description: |- - By default, websites are allowed to automatically run plugins. - Users should be prompted to allow plugins to execute plugins by setting - DefaultPluginsSetting to 3 in the Chromium policy file. - -rationale: |- - Websites should not be allowed to automatically run plugins as the plugins - may be outdated or compromised. - -severity: unknown - -references: - stigid: DTBC0040 - -ocil_clause: 'it is not set correctly' - -ocil: |- - To verify that plugins cannot run automatically, run the following command: -
$ grep DefaultPluginsSetting /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultPluginsSetting": 3,
diff --git a/products/chromium/guide/chromium/chromium_default_search_provider/bash/chromium.sh b/products/chromium/guide/chromium/chromium_default_search_provider/bash/chromium.sh deleted file mode 100644 index da8c1aa0c63..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultSearchProviderEnabled", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_default_search_provider/oval/chromium.xml b/products/chromium/guide/chromium/chromium_default_search_provider/oval/chromium.xml deleted file mode 100644 index 2a4381069af..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Enable Default Search Provider - - Google Chromium Browser - - Default search provider must be enabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DefaultSearchProviderEnabled\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_default_search_provider/rule.yml b/products/chromium/guide/chromium/chromium_default_search_provider/rule.yml deleted file mode 100644 index f5c1ade1648..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider/rule.yml +++ /dev/null @@ -1,24 +0,0 @@ -documentation_complete: true - -title: 'Enable the Default Search Provider' - -description: |- - By default users, can change search provider settings. To disable this, set - DefaultSearchProviderEnabled to true in the Chromium policy file. - -rationale: |- - A default search is performed when the user types text in the omnibox that is not a URL. - This should be organizationally defined and not allowed to be changed by a user. - -severity: unknown - -references: - stigid: DTBC0009 - -ocil_clause: 'it is not enabled' - -ocil: |- - To verify that users cannot change the default search provider, run the following command: -
$ grep DefaultSearchProviderEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultSearchProviderEnabled": true,
diff --git a/products/chromium/guide/chromium/chromium_default_search_provider_name/bash/chromium.sh b/products/chromium/guide/chromium/chromium_default_search_provider_name/bash/chromium.sh deleted file mode 100644 index 610be49db95..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider_name/bash/chromium.sh +++ /dev/null @@ -1,7 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_default_search_provider_name") }}} - -var_default_search_provider_name_modified="$(echo ${var_default_search_provider_name} | sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultSearchProviderName", "${var_default_search_provider_name_modified}", "${var_default_search_provider_name}") }}} diff --git a/products/chromium/guide/chromium/chromium_default_search_provider_name/oval/chromium.xml b/products/chromium/guide/chromium/chromium_default_search_provider_name/oval/chromium.xml deleted file mode 100644 index 3d264583a0f..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider_name/oval/chromium.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - Set Default Search Provider Name - - Google Chromium Browser - - The default search providers name must be set. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+"DefaultSearchProviderName"\:[\s]+"(\S+)",$ - 1 - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_default_search_provider_name/rule.yml b/products/chromium/guide/chromium/chromium_default_search_provider_name/rule.yml deleted file mode 100644 index f2ae2bcef88..00000000000 --- a/products/chromium/guide/chromium/chromium_default_search_provider_name/rule.yml +++ /dev/null @@ -1,23 +0,0 @@ -documentation_complete: true - -title: 'Set the Default Search Provider''s URL' - -description: |- - Specifies the URL of the default search provider that is to be used. To set the URL of the default search provider, set DefaultSearchProviderName to {{{ xccdf_value("var_default_search_provider_name") }}} in the Chromium policy file. - -rationale: |- - When doing internet searches, it is important to set an organizationally approved search - provider as well as use an encrypted connection via https. - -severity: unknown - -references: - stigid: DTBC0007 - -ocil_clause: 'a default search provider is not set' - -ocil: |- - To verify that a default search provider is set, run the following command: -
$ grep DefaultSearchProviderName /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultSearchProviderName": "{{{ xccdf_value("var_default_search_provider_name") }}}",
diff --git a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/bash/chromium.sh deleted file mode 100644 index f8b796c92d3..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "Disable3DAPIs", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/oval/chromium.xml deleted file mode 100644 index 18330c77fc5..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable 3D Graphics APIs - - Google Chromium Browser - - 3D Graphics APIs must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"Disable3DAPIs\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/rule.yml b/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/rule.yml deleted file mode 100644 index b7598c5f8eb..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_3d_graphics_api/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Disable the 3D Graphics APIs' - -description: |- - Chromium uses WebGL to render graphics using the GPU which allows website - access to the GPU. This should be disabled by setting Disable3DAPIs - to true in the Chromium policy file. - -rationale: |- - This setting prevents web pages from accessing the graphics processing unit - (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot - use the Pepper 3D API in order to reduce the attack surface. - -severity: unknown - -references: - stigid: DTBC0019 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that 3D graphics are disabled, run the following command: -
$ grep Disable3DAPIs /etc/chromium/policies/managed/*.json
- The output should contain: -
"Disable3DAPIs": true,
diff --git a/products/chromium/guide/chromium/chromium_disable_autocomplete/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_autocomplete/bash/chromium.sh deleted file mode 100644 index 9e163eb0330..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_autocomplete/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "AutoFillEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_autocomplete/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_autocomplete/oval/chromium.xml deleted file mode 100644 index 8d1a0e632e0..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_autocomplete/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Autocomplete For Forms - - Google Chromium Browser - - AutoFill must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"AutoFillEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_autocomplete/rule.yml b/products/chromium/guide/chromium/chromium_disable_autocomplete/rule.yml deleted file mode 100644 index 6d9746fd1d3..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_autocomplete/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Disable the AutoFill Feature' - -description: |- - The AutoFill feature suggests possible matches when users are filling in forms. To - disable the AutoFill feature, set AutoFillEnabled to false in - the Chromium policy file. - -rationale: |- - It is possible with the AutoFill feature that it will cache sensitive data and store - it in the user's profile, where it might not be protected as rigorously as required by - organizational policy. - -severity: unknown - -references: - stigid: DTBC0022 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that the AutoFill feature is disabled, run the following command: -
$ grep AutoFillEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"AutoFillEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_automatic_installation/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_automatic_installation/bash/chromium.sh deleted file mode 100644 index 663754d4e8c..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_automatic_installation/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DisablePluginFinder", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_automatic_installation/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_automatic_installation/oval/chromium.xml deleted file mode 100644 index 9ee1a6c3698..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_automatic_installation/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Automatic Plugin Search And Installation - - Google Chromium Browser - - Automated installation of missing plugins must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DisablePluginFinder\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_automatic_installation/rule.yml b/products/chromium/guide/chromium/chromium_disable_automatic_installation/rule.yml deleted file mode 100644 index a44b7615464..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_automatic_installation/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Disable Automatic Search And Installation of Plugins' - -description: |- - Chromium will automatically detect, search, and install plugins as required. This - should be disabled by setting DisablePluginFinder to true in the - Chromium policy file. - -rationale: |- - The automatic search and installation of missing or not installed plugins should be - disabled as this can cause significant risk if a unapproved or vulnerable plugin were - to be installed without proper permissions or authorization. - -severity: unknown - -references: - stigid: DTBC0036 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that plugins cannot be automatically installed, run the following command: -
$ grep DisablePluginFinder /etc/chromium/policies/managed/*.json
- The output should contain: -
"DisablePluginFinder": true,
diff --git a/products/chromium/guide/chromium/chromium_disable_background_processing/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_background_processing/bash/chromium.sh deleted file mode 100644 index 771f381543e..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_background_processing/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "BackgroundModeEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_background_processing/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_background_processing/oval/chromium.xml deleted file mode 100644 index df2deb7e0a7..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_background_processing/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Background Processing - - Google Chromium Browser - - Background processing must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"BackgroundModeEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_background_processing/rule.yml b/products/chromium/guide/chromium/chromium_disable_background_processing/rule.yml deleted file mode 100644 index d097b93dc37..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_background_processing/rule.yml +++ /dev/null @@ -1,27 +0,0 @@ -documentation_complete: true - -title: 'Disable Background Processing' - -description: |- - Chromium can be set to run at all times and process in the background. This - should be disabled by setting BackgroundModeEnabled to false - in the Chromium policy file. - -rationale: |- - There is two reasons that this is not wanted. First, it can tie up system - resources that might otherwise be needed. Second, it does not make it - obvious to the user that it is running and poorly written extensions could - cause instability on the system. - -severity: unknown - -references: - stigid: DTBC0017 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that background processing is disabled, run the following command: -
$ grep BackgroundModeEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"BackgroundModeEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/bash/chromium.sh deleted file mode 100644 index 2d78b652690..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "PasswordManagerAllowShowPasswords", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/oval/chromium.xml deleted file mode 100644 index a1b489bb893..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Cleartext Passwords - - Google Chromium Browser - - Cleartext passwords in the Password Manager must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"PasswordManagerAllowShowPasswords\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/rule.yml b/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/rule.yml deleted file mode 100644 index d25d79ad2c7..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cleartext_passwords/rule.yml +++ /dev/null @@ -1,20 +0,0 @@ -documentation_complete: true - -title: 'Disable Use of Cleartext Passwords' - -description: "Chromium allows users to import and store passwords in cleartext. This should be \ndisabled by setting PasswordManagerAllowShowPasswords to false\nin the Chromium policy file." - -rationale: 'Cleartext passwords would allow another individual to see password via shoulder surfing.' - -severity: unknown - -references: - stigid: DTBC0010 - -ocil_clause: 'use of cleartext passwords are not disabled' - -ocil: |- - To verify that the use of cleartext passwords is disabled, run the following command: -
$ grep PasswordManagerAllowShowPasswords /etc/chromium/policies/managed/*.json
- The output should contain: -
"PasswordManagerAllowShowPasswords": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/bash/chromium.sh deleted file mode 100644 index 2913aef29bc..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "CloudPringProxyEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/oval/chromium.xml deleted file mode 100644 index 78320f8d0f9..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Cloud Print Sharing - - Google Chromium Browser - - Cloud print sharing must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"CloudPrintProxyEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/rule.yml b/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/rule.yml deleted file mode 100644 index 26e1e0b790e..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_cloud_print_sharing/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Disable Cloud Print Sharing' - -description: |- - Chromium has cloud sharing capabilities including sharing printers connected to the - system. This is done via a proxy. To disable printer sharing, set CloudPrintProxyEnabled - to false in the Chromium policy file. - -rationale: |- - Google Chromium has the capability to act as a proxy between Google Cloud Print - and legacy printers connected to the machine. Users can then enable the cloud - print proxy by authentication with their Google account. - -severity: unknown - -references: - stigid: DTBC0023 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that the Cloud Print Sharing feature is disabled, run the following command: -
$ grep CloudPrintProxyEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"CloudPrintProxyEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_firewall_traversal/bash/chromium.sh deleted file mode 100644 index a0c2eee3743..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "RemoteAccessHostFirewallTraversal", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_firewall_traversal/oval/chromium.xml deleted file mode 100644 index af43159c1ba..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Firewall Traversal - - Google Chromium Browser - - Firewall traversal from remote host must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"RemoteAccessHostFirewallTraversal\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/rule.yml b/products/chromium/guide/chromium/chromium_disable_firewall_traversal/rule.yml deleted file mode 100644 index bb118a86264..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_firewall_traversal/rule.yml +++ /dev/null @@ -1,18 +0,0 @@ -documentation_complete: true - -title: 'Disable Chromium''s Ability to Traverse Firewalls' - -description: "Chromium has the ability to bypass and ignore the system firewall. This\nability should be disabled. To disable this setting, set \nRemoteAccessHostFirewallTraversal to false in the \nChromium policy file." - -rationale: |- - Remote connections should never be allowed to bypass the system firewall - as there is no way to verify if they can be trusted. - -severity: unknown - -references: - stigid: DTBC0001 - -ocil_clause: 'it is not disabled' - -ocil: "To verify that Chromium's abililty to traverse the system firewall is \ndisabled, run the following command:\n
$ grep RemoteAccessHostFirewallTraversal /etc/chromium/policies/managed/*.json
\nThe output should contain:\n
\"RemoteAccessHostFirewallTraversal\": false,
" diff --git a/products/chromium/guide/chromium/chromium_disable_google_sync/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_google_sync/bash/chromium.sh deleted file mode 100644 index 8fc1e031cb3..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_google_sync/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "SyncDisabled", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_google_sync/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_google_sync/oval/chromium.xml deleted file mode 100644 index 2cce2b56450..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_google_sync/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Google Data Synchronization - - Google Chromium Browser - - Google Data Synchronization must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"SyncDisabled\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_google_sync/rule.yml b/products/chromium/guide/chromium/chromium_disable_google_sync/rule.yml deleted file mode 100644 index 4fe3b97170f..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_google_sync/rule.yml +++ /dev/null @@ -1,25 +0,0 @@ -documentation_complete: true - -title: 'Disable Data Synchronization to Google' - -description: 'SyncDisabled to true in the Chromium policy file.' - -rationale: |- - Google Sync is used to sync information between different user devices, - this data is then stored on Google owned servers. The synced data may consist - of information such as email, calendars, viewing history, etc. This feature must - be disabled because the organization does not have control over the servers the - data is stored on. - -severity: unknown - -references: - stigid: DTBC0020 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that data synchronization is disabled, run the following command: -
$ grep SyncDisabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"SyncDisabled": true,
diff --git a/products/chromium/guide/chromium/chromium_disable_incognito_mode/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_incognito_mode/bash/chromium.sh deleted file mode 100644 index c907d02ce7c..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_incognito_mode/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "IncognitoModeAvailability", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_incognito_mode/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_incognito_mode/oval/chromium.xml deleted file mode 100644 index 2ca79a6a866..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_incognito_mode/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Incognito Mode - - Google Chromium Browser - - Incognito mode must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"IncognitoModeAvailability\"\:[\s]+1, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_incognito_mode/rule.yml b/products/chromium/guide/chromium/chromium_disable_incognito_mode/rule.yml deleted file mode 100644 index 141ed9964d9..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_incognito_mode/rule.yml +++ /dev/null @@ -1,27 +0,0 @@ -documentation_complete: true - -title: 'Disable Incognito Mode' - -description: |- - Incognito Mode allows users to browse in private which prevents monitoring - and validating user browsing habits. This capability should be disabled by - setting IncognitoModeAvailability to 1 in the Chromium - policy file. - -rationale: |- - Incognito mode allows the user to browse the Internet without recording their - browsing history/activity. From a forensics perspective, this is unacceptable. - Best practice requires that browser history is retained. - -severity: unknown - -references: - stigid: DTBC0030 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that incognito mode is disabled, run the following command: -
$ grep IncognitoModeAvailability /etc/chromium/policies/managed/*.json
- The output should contain: -
"IncognitoModeAvailability": 1,
diff --git a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_metrics_reporting/bash/chromium.sh deleted file mode 100644 index 02d4a6a759e..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "MetricsReportingEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_metrics_reporting/oval/chromium.xml deleted file mode 100644 index 9e9339d1ffd..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Metrics Reporting - - Google Chromium Browser - - Metrics reporting to Google must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"MetricsReportingEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/rule.yml b/products/chromium/guide/chromium/chromium_disable_metrics_reporting/rule.yml deleted file mode 100644 index 2d89928717c..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_metrics_reporting/rule.yml +++ /dev/null @@ -1,22 +0,0 @@ -documentation_complete: true - -title: 'Disable Metrics Reporting' - -description: "Whenever Chromium crashes, it sends its usage and crash-related data to Google.\nThis should be disabled by setting MetricsReportingEnabled to \nfalse in the Chromium policy file." - -rationale: |- - Anonymous reporting of usage and crash-related data is sent to Google. - A crash report could contain sensitive information from the computer's memory. - -severity: unknown - -references: - stigid: DTBC0026 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that metrics reporting is disabled, run the following command: -
$ grep MetricsReportingEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"MetricsReportingEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_network_prediction/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_network_prediction/bash/chromium.sh deleted file mode 100644 index 001f52c998c..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_network_prediction/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DnsPrefetchingEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_network_prediction/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_network_prediction/oval/chromium.xml deleted file mode 100644 index a0731474909..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_network_prediction/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Network Prediction - - Google Chromium Browser - - Network prediction must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DnsPrefetchingEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_network_prediction/rule.yml b/products/chromium/guide/chromium/chromium_disable_network_prediction/rule.yml deleted file mode 100644 index 7f673e30722..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_network_prediction/rule.yml +++ /dev/null @@ -1,24 +0,0 @@ -documentation_complete: true - -title: 'Disable Network Prediction' - -description: |- - To disable the network prediction feature, set DnsPrefetchingEnabled - to false in the Chromium policy file. - -rationale: |- - This controls not only DNS prefetching but also TCP and SSL preconnection - and prerendering of web pages. - -severity: unknown - -references: - stigid: DTBC0025 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that network prediction is disabled, run the following command: -
$ grep DnsPrefetchingEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"DnsPrefetchingEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_outdated_plugins/bash/chromium.sh deleted file mode 100644 index dbde7c8c8d8..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "AllowOutdatedPlugins", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_outdated_plugins/oval/chromium.xml deleted file mode 100644 index 25c52465456..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Outdated Plugins - - Google Chromium Browser - - The running of outdated plugins must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"AllowOutdatedPlugins\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/rule.yml b/products/chromium/guide/chromium/chromium_disable_outdated_plugins/rule.yml deleted file mode 100644 index 6df19bc7e57..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_outdated_plugins/rule.yml +++ /dev/null @@ -1,25 +0,0 @@ -documentation_complete: true - -title: 'Disable Outdated Plugins' - -description: |- - Outdated plugins should be disabled by setting AllowOutdatedPlugins - to false in the Chromium policy file. - -rationale: |- - Running outdated plugins could lead to system compromise through the use - of known exploits. Having plugins updated to the most current version - ensures the smallest attack surfuce possible. - -severity: unknown - -references: - stigid: DTBC0013 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that outdated plugins are disabled, run the following command: -
$ grep AllowOutdatedPlugins /etc/chromium/policies/managed/*.json
- The output should contain: -
"AllowOutdatedPlugins": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_password_manager/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_password_manager/bash/chromium.sh deleted file mode 100644 index 9d78eecac82..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_password_manager/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "PasswordManagerEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_password_manager/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_password_manager/oval/chromium.xml deleted file mode 100644 index d53f6beb97d..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_password_manager/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Password Manager - - Google Chromium Browser - - The Password Manager must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"PasswordManagerEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_password_manager/rule.yml b/products/chromium/guide/chromium/chromium_disable_password_manager/rule.yml deleted file mode 100644 index d61b68a8574..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_password_manager/rule.yml +++ /dev/null @@ -1,23 +0,0 @@ -documentation_complete: true - -title: 'Disable Chromium Password Manager' - -description: "Chromium Password Manager allows the saving and using of passwords in Chromium. This\nshould be disabled by setting PasswordManagerEnabled to false in \nthe Chromium policy file." - -rationale: |- - Enables saving passwords and using saved passwords in Google Chromium. Malicious - sites may take advantage of this feature by using hidden fields gain access - to the stored information. - -severity: unknown - -references: - stigid: DTBC0011 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that the use of Password Manager is disabled, run the following command: -
$ grep PasswordManagerEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"PasswordManagerEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/bash/chromium.sh deleted file mode 100644 index 9ebdd3580bc..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DisabledPlugins", '[ "*" ]') }}} diff --git a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/oval/chromium.xml deleted file mode 100644 index 42879549029..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Blacklist Plugins - - Google Chromium Browser - - Plugins must be disabled by default. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DisabledPlugins\"\:[\s]+\[\"\*\"\], - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/rule.yml b/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/rule.yml deleted file mode 100644 index 9c6cefa6bc1..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_plugin_blacklist/rule.yml +++ /dev/null @@ -1,23 +0,0 @@ -documentation_complete: true - -title: 'Disable All Plugins by Default' - -description: "Plugins are developed internally or by third party sources and are designed to extend\nGoogle Chromium's functionality. All plugins should be blacklisted from \ninstallation by default. To blacklist all plugins set DisabledPlugins\nto * in the Chromium policy file." - -rationale: |- - Plugins can access almost anything on a system and users can enable or install them - at will. This means they pose a high risk to any system that would allow all plugins - to be installed by default. - -severity: unknown - -references: - stigid: DTBC0034 - -ocil_clause: 'they are not disabled' - -ocil: |- - To verify that all plugins are blacklisted, run the following command: -
$ grep DisabledPlugins /etc/chromium/policies/managed/*.json
- The output should contain: -
"DisabledPlugins": ["*"],
diff --git a/products/chromium/guide/chromium/chromium_disable_popups/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_popups/bash/chromium.sh deleted file mode 100644 index 01b3ca4ce46..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_popups/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultPopupsSetting", "2") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_popups/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_popups/oval/chromium.xml deleted file mode 100644 index 86d2d1e604d..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_popups/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Pop-ups - - Google Chromium Browser - - Sites ability to show pop-ups must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DefaultPopupsSetting\"\:[\s]+2, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_popups/rule.yml b/products/chromium/guide/chromium/chromium_disable_popups/rule.yml deleted file mode 100644 index 63e7b9030a7..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_popups/rule.yml +++ /dev/null @@ -1,22 +0,0 @@ -documentation_complete: true - -title: 'Disable Popups' - -description: "Chromium allows you to manage whether or not unwanted pop-up windows appear.\nTo disable pop-ups, set DefaultPopupsSetting to 2 \nin the Chromium policy file." - -rationale: |- - Pop-up windows should be disabled to prevent malicious websites from controlling - pop-up windows or fooling users into clicking on the wrong window. - -severity: unknown - -references: - stigid: DTBC0004 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that pop-ups are disabled, run the following command: -
$ grep DefaultPopupsSetting /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultPopupsSetting": 2,
diff --git a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_protocol_schemas/bash/chromium.sh deleted file mode 100644 index dd60e4e41ec..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/bash/chromium.sh +++ /dev/null @@ -1,7 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_url_blacklist") }}} - -var_url_blacklist_modified="$(echo ${var_url_blacklist}| sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "URLBlacklist", "\[${var_url_blacklist_modified}\]", "\[${var_url_blacklist}\]") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_protocol_schemas/oval/chromium.xml deleted file mode 100644 index a5a7d811de5..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/oval/chromium.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - Disable Javascript URL Protocol Schemas - - Google Chromium Browser - - The URL protocol schema javascript must be disabled. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"URLBlacklist\"\:[\s]+\[\"(\S+)"\], - 1 - - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/rule.yml b/products/chromium/guide/chromium/chromium_disable_protocol_schemas/rule.yml deleted file mode 100644 index d4981e3c654..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_protocol_schemas/rule.yml +++ /dev/null @@ -1,29 +0,0 @@ -documentation_complete: true - -title: 'Disable Insecure And Obsolete Protocol Schemas' - -description: |- - Each access to a URL is handled by the browser according to the URL's "scheme". - The "scheme" of a URL is the section before the ":". The term "protocol" is often - mistakenly used for a "scheme". The difference is that the scheme is how the browser - handles a URL and the protocol is how the browser communicates with a service. To - disable insecure and obsolete protocol schema, set URLBlacklist to - in the Chromium policy file. - -rationale: |- - If a scheme or its associated protocol used by a browser is insecure or obsolete, - vulnerabilities can be exploited resulting in exposed data or unrestricted access - to the browser's system. - -severity: unknown - -references: - stigid: DTBC0021 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that data synchronization is disabled, run the following command: -
$ grep URLBlacklist /etc/chromium/policies/managed/*.json
- The output should contain: -
"URLBlacklist": [""],
diff --git a/products/chromium/guide/chromium/chromium_disable_saved_passwords/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_saved_passwords/bash/chromium.sh deleted file mode 100644 index a1b856ca73e..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_saved_passwords/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "ImportSavedPasswords", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_saved_passwords/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_saved_passwords/oval/chromium.xml deleted file mode 100644 index 97906894f8c..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_saved_passwords/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Importing Saved Passwords - - Google Chromium Browser - - Importing of saved passwords must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"ImportSavedPasswords\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_saved_passwords/rule.yml b/products/chromium/guide/chromium/chromium_disable_saved_passwords/rule.yml deleted file mode 100644 index 51452cc3345..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_saved_passwords/rule.yml +++ /dev/null @@ -1,25 +0,0 @@ -documentation_complete: true - -title: 'Disable Saved Passwords' - -description: |- - Disable by setting ImportSavedPasswords to false in the Chromium - policy file. - -rationale: |- - Importing of saved passwords should be disabled as it could lead to - unencrypted account passwords stored on the system from another browser - to be viewed. - -severity: unknown - -references: - stigid: DTBC0029 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that importing passwords is disabled, run the following command: -
$ grep ImportSavedPasswords /etc/chromium/policies/managed/*.json
- The output should contain: -
"ImportSavedPasswords": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_search_suggestions/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_search_suggestions/bash/chromium.sh deleted file mode 100644 index ae454415bdf..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_search_suggestions/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "SearchSuggestEnabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_search_suggestions/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_search_suggestions/oval/chromium.xml deleted file mode 100644 index 25b7dac3f19..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_search_suggestions/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Search Suggestopms - - Google Chromium Browser - - Search suggestions must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"SearchSuggestEnabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_search_suggestions/rule.yml b/products/chromium/guide/chromium/chromium_disable_search_suggestions/rule.yml deleted file mode 100644 index 52ed2ce22ef..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_search_suggestions/rule.yml +++ /dev/null @@ -1,22 +0,0 @@ -documentation_complete: true - -title: 'Disable Search Suggestion' - -description: "Chromium tries to guess what users are searching for when users enter\nsearch data in the search Omnibox. This should be disabled by \nsetting SearchSuggestEnabled to false in the Chromium \npolicy file." - -rationale: |- - Search suggestion should be disabled as it could lead to searches being conducted - that were never intended to be made. - -severity: unknown - -references: - stigid: DTBC0027 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that search suggestion is disabled, run the following command: -
$ grep SearchSuggestEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"SearchSuggestEnabled": false,
diff --git a/products/chromium/guide/chromium/chromium_disable_session_cookies/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_session_cookies/bash/chromium.sh deleted file mode 100644 index a4570e637bf..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_session_cookies/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "CookiesSessionOnlyForUrls", "\[none\]") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_session_cookies/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_session_cookies/oval/chromium.xml deleted file mode 100644 index 11d354208b8..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_session_cookies/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Per Session Cookies - - Google Chromium Browser - - Session only based cookies must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"CookiesSessionOnlyForUrls\"\:[\s]+\[\"(none|)"\], - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_session_cookies/rule.yml b/products/chromium/guide/chromium/chromium_disable_session_cookies/rule.yml deleted file mode 100644 index 515892e4981..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_session_cookies/rule.yml +++ /dev/null @@ -1,23 +0,0 @@ -documentation_complete: true - -title: 'Disable Session Cookies' - -description: |- - To disable session only cookies sites, set CookiesSessionOnlyForUrls - to none in the Chromium policy file. - -rationale: "Cookies should only be allowed per session and only for approved URLs as \npermanently stored cookies can be used for malicious intent." - -severity: unknown - -references: - stigid: DTBC0045 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that sessions cookies for approved sites only are enabled, - run the following command: -
$ grep CookiesSessionOnlyForUrls /etc/chromium/policies/managed/*.json
- The output should contain: -
"CookiesSessionOnlyForUrls": ["none"],
diff --git a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/bash/chromium.sh deleted file mode 100644 index 19073838b0f..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "BlockThirdPartyCookies", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/oval/chromium.xml deleted file mode 100644 index 373817713c5..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disable Third Party Cookies - - Google Chromium Browser - - Third party cookies must be blocked. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"BlockThirdPartyCookies\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/rule.yml b/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/rule.yml deleted file mode 100644 index 4c4fbd24c20..00000000000 --- a/products/chromium/guide/chromium/chromium_disable_thirdparty_cookies/rule.yml +++ /dev/null @@ -1,27 +0,0 @@ -documentation_complete: true - -title: 'Disable 3rd Party Cookies' - -description: |- - Third party cookies should be be enabled. To disable third party cookies, - set BlockThirdPartyCookies to true in the Chromium policy - file. - -rationale: |- - Third party cookies are cookies which can be set by web page elements that - are not from the domain that is in the browser's address bar. This prevents - cookies from being set by web page elements that are not from the domain - that is in the browser's address bar. - -severity: unknown - -references: - stigid: DTBC0015 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that third party cookies are disabled, run the following command: -
$ grep BlockThirdPartyCookies /etc/chromium/policies/managed/*.json
- The output should contain: -
"BlockThirdPartyCookies": true,
diff --git a/products/chromium/guide/chromium/chromium_disallow_location_tracking/bash/chromium.sh b/products/chromium/guide/chromium/chromium_disallow_location_tracking/bash/chromium.sh deleted file mode 100644 index c9816e9564b..00000000000 --- a/products/chromium/guide/chromium/chromium_disallow_location_tracking/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultGeolocationSetting", "2") }}} diff --git a/products/chromium/guide/chromium/chromium_disallow_location_tracking/oval/chromium.xml b/products/chromium/guide/chromium/chromium_disallow_location_tracking/oval/chromium.xml deleted file mode 100644 index d07575d1616..00000000000 --- a/products/chromium/guide/chromium/chromium_disallow_location_tracking/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Disallow Location Tracking - - Google Chromium Browser - - Site tracking users location must be disabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"DefaultGeolocationSetting\"\:[\s]+2, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_disallow_location_tracking/rule.yml b/products/chromium/guide/chromium/chromium_disallow_location_tracking/rule.yml deleted file mode 100644 index e7dded2488f..00000000000 --- a/products/chromium/guide/chromium/chromium_disallow_location_tracking/rule.yml +++ /dev/null @@ -1,20 +0,0 @@ -documentation_complete: true - -title: 'Disable Location Tracking' - -description: "Location tracking is enabled by default and can track user's browsing habits.\nLocation tracking should be disabled by setting DefaultGeolocationSetting \nto 2 in the Chromium policy file." - -rationale: "Website tracking is the practice of gathering information as to which websites\nwere accesses by a browser. The common method of doing this is to have a website\ncreate a tracking cookie on the browser. If the information of what sites are\nbeing accessed is made available to unauthorized persons, this violates \nconfidentiality requirements, and over time poses a significant OPSEC issue." - -severity: unknown - -references: - stigid: DTBC0002 - -ocil_clause: 'it is not disabled' - -ocil: |- - To verify that location tracking is disabled, run the following command: -
$ grep DefaultGeolocationSetting /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultGeolocationSetting": 2,
diff --git a/products/chromium/guide/chromium/chromium_enable_approved_plugins/bash/chromium.sh b/products/chromium/guide/chromium/chromium_enable_approved_plugins/bash/chromium.sh deleted file mode 100644 index 2a292980d74..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_approved_plugins/bash/chromium.sh +++ /dev/null @@ -1,12 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_enable_approved_plugins") }}} - -# set var to empty string if None -if [ "$var_enable_approved_plugins" = "None" ]; then - var_enable_approved_plugins="" -fi - -var_enable_approved_plugins_modified="$(echo ${var_enable_approved_plugins} | sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "EnabledPlugins", "\[${var_enable_approved_plugins_modified}\]", "\[${var_enable_approved_plugins}\]") }}} diff --git a/products/chromium/guide/chromium/chromium_enable_approved_plugins/oval/chromium.xml b/products/chromium/guide/chromium/chromium_enable_approved_plugins/oval/chromium.xml deleted file mode 100644 index 0f071b22778..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_approved_plugins/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Enable Approved Plugins - - Google Chromium Browser - - Plugins approved for use must be enabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"EnabledPlugins\"\:[\s]+\[\"((none|[a-zA-Z]*)|!*)\"\], - 1 - - diff --git a/products/chromium/guide/chromium/chromium_enable_approved_plugins/rule.yml b/products/chromium/guide/chromium/chromium_enable_approved_plugins/rule.yml deleted file mode 100644 index 6a66b1f652f..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_approved_plugins/rule.yml +++ /dev/null @@ -1,26 +0,0 @@ -documentation_complete: true - -title: 'Enable Only Approved Plugins' - -description: |- - An organization might need to use an internal or third party developed plugins. Any - organizationally approved plugin should be enabled. To enable approved plugins, - set EnabledPlugins to the list of organizationally approved plugins - in the Chromium policy file. - -rationale: |- - The whitelist should only contain organizationally approved plugins. This is to prevent - a user from accidently whitelisitng a malicious plugin. - -severity: unknown - -references: - stigid: DTBC0035 - -ocil_clause: 'no plugins exist or it is not set to none' - -ocil: |- - To verify that approved plugins are set, run the following command: -
$ grep EnabledPlugins /etc/chromium/policies/managed/*.json
- The output should contain: -
"EnabledPlugins": ["approved_plugin1", "approved_plugin2"],
diff --git a/products/chromium/guide/chromium/chromium_enable_browser_history/bash/chromium.sh b/products/chromium/guide/chromium/chromium_enable_browser_history/bash/chromium.sh deleted file mode 100644 index bce16969aa9..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_browser_history/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "SavingBrowserHistoryDisabled", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_enable_browser_history/oval/chromium.xml b/products/chromium/guide/chromium/chromium_enable_browser_history/oval/chromium.xml deleted file mode 100644 index 1bef391a6da..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_browser_history/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Enable Browser History - - Google Chromium Browser - - Browser history must be saved. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"SavingBrowserHistoryDisabled\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_enable_browser_history/rule.yml b/products/chromium/guide/chromium/chromium_enable_browser_history/rule.yml deleted file mode 100644 index 72d1633dc4a..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_browser_history/rule.yml +++ /dev/null @@ -1,23 +0,0 @@ -documentation_complete: true - -title: 'Enable Saving the Browser History' - -description: |- - Users can enable or disable the saving of browser history in Chromium. Browser - history should be retained by setting SavingBrowserHistoryDisabled to - false in the Chromium policy file. - -rationale: 'Best practice requires that browser history is retained.' - -severity: unknown - -references: - stigid: DTBC0039 - -ocil_clause: 'it is not enabled' - -ocil: |- - To verify that saving the browser history is enabled, run the following command: -
$ grep SavingBrowserHistoryDisabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"SavingBrowserHistoryDisabled": false,
diff --git a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/bash/chromium.sh b/products/chromium/guide/chromium/chromium_enable_encrypted_searching/bash/chromium.sh deleted file mode 100644 index a5426a6bb06..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/bash/chromium.sh +++ /dev/null @@ -1,7 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_enable_encrypted_searching") }}} - -var_enable_encrypted_searching_modified="$(echo ${var_enable_encrypted_searching} | sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "DefaultSearchProviderSearchURL", "${var_enable_encrypted_searching_modified}", "${var_enable_encrypted_searching}") }}} diff --git a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/oval/chromium.xml b/products/chromium/guide/chromium/chromium_enable_encrypted_searching/oval/chromium.xml deleted file mode 100644 index 97a9ee9b3cb..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/oval/chromium.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - Enable Encrypted Searching - - Google Chromium Browser - - The default search provider URL must be set to perform encrypted searches. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"DefaultSearchProviderSearchURL\"\:[\s]+\"(\S+)", - 1 - - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/rule.yml b/products/chromium/guide/chromium/chromium_enable_encrypted_searching/rule.yml deleted file mode 100644 index ae3bab2ca33..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_encrypted_searching/rule.yml +++ /dev/null @@ -1,24 +0,0 @@ -documentation_complete: true - -title: 'Enable Encrypted Searching' - -description: |- - Specifies the URL of the search engine used when doing a default search. - The URL should contain the string {searchTerms}. To set the URL of the - search engine, set DefaultSearchProviderSearchURL to - in the Chromium policy file. - -rationale: 'When doing internet searches, it is important to use an encrypted connection via https.' - -severity: unknown - -references: - stigid: DTBC0008 - -ocil_clause: 'it is not set' - -ocil: |- - To verify that the URL of the search engine is set, run the following command: -
$ grep DefaultSearchProviderSearchURL /etc/chromium/policies/managed/*.json
- The output should contain: -
"DefaultSearchProviderSearchURL": "",
diff --git a/products/chromium/guide/chromium/chromium_enable_safe_browsing/bash/chromium.sh b/products/chromium/guide/chromium/chromium_enable_safe_browsing/bash/chromium.sh deleted file mode 100644 index ab7f00e6eb3..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_safe_browsing/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "SafeBrowsingEnabled", "true") }}} diff --git a/products/chromium/guide/chromium/chromium_enable_safe_browsing/oval/chromium.xml b/products/chromium/guide/chromium/chromium_enable_safe_browsing/oval/chromium.xml deleted file mode 100644 index 6eb0aa63a55..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_safe_browsing/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Enable Safe Browsing - - Google Chromium Browser - - Safe Browsing must be enabled. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"SafeBrowsingEnabled\"\:[\s]+true, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_enable_safe_browsing/rule.yml b/products/chromium/guide/chromium/chromium_enable_safe_browsing/rule.yml deleted file mode 100644 index 301f0d3255c..00000000000 --- a/products/chromium/guide/chromium/chromium_enable_safe_browsing/rule.yml +++ /dev/null @@ -1,22 +0,0 @@ -documentation_complete: true - -title: 'Enable the Safe Browsing Feature' - -description: "Chromium has the capability to check URLs for known malware and phishing \nassociated with websites through the Safe Browsing Feature. This can be \nenabled by setting SafeBrowsingEnabled to true in the Chromium\npolicy file." - -rationale: |- - Safe browsing uses a signature database to test sites when they are be loaded - to ensure that sites do not contain any known malware. - -severity: unknown - -references: - stigid: DTBC0038 - -ocil_clause: 'it is not enabled' - -ocil: |- - To verify that the safe browsing feature is enabled, run the following command: -
$ grep SafeBrowsingEnabled /etc/chromium/policies/managed/*.json
- The output should contain: -
"SafeBrowsingEnabled": true,
diff --git a/products/chromium/guide/chromium/chromium_extension_whitelist/bash/chromium.sh b/products/chromium/guide/chromium/chromium_extension_whitelist/bash/chromium.sh deleted file mode 100644 index 6452c504058..00000000000 --- a/products/chromium/guide/chromium/chromium_extension_whitelist/bash/chromium.sh +++ /dev/null @@ -1,7 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_extension_whitelist") }}} - -var_extension_whitelist_modified="$(echo ${var_extension_whitelist} | sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "ExtensionInstallWhitelist", "${var_extension_whitelist_modified}", "${var_extension_whitelist}") }}} diff --git a/products/chromium/guide/chromium/chromium_extension_whitelist/oval/chromium.xml b/products/chromium/guide/chromium/chromium_extension_whitelist/oval/chromium.xml deleted file mode 100644 index e01a195e611..00000000000 --- a/products/chromium/guide/chromium/chromium_extension_whitelist/oval/chromium.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - Extension Whitelist - - Google Chromium Browser - - Extensions that are approved for use must be whitelisted. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"ExtensionInstallWhitelist\"\:[\s]+\[\"(\S+)\"], - 1 - - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_extension_whitelist/rule.yml b/products/chromium/guide/chromium/chromium_extension_whitelist/rule.yml deleted file mode 100644 index cee90feeba3..00000000000 --- a/products/chromium/guide/chromium/chromium_extension_whitelist/rule.yml +++ /dev/null @@ -1,28 +0,0 @@ -documentation_complete: true - -title: 'Enable Only Approved Extensions' - -description: |- - An organization might need to use an internal or third party developed extension. Any - organizationally approved extenstion should be enabled. To enable approved extensions, - set ExtensionInstallWhitelist to - in the Chromium policy file. - If there are no approved extensions, ExtensionInstallWhitelist should be set to - . - -rationale: |- - The whitelist should only contain organizationally approved extensions. This is to prevent - a user from accidently whitelisitng a malicious extension. - -severity: unknown - -references: - stigid: DTBC0003 - -ocil_clause: 'approved extensions are not set' - -ocil: |- - To verify that approved extensions are whitelisted, run the following command: -
$ grep ExtensionInstallWhitelist /etc/chromium/policies/managed/*.json
- The output should contain: -
"ExtensionInstallWhitelist": [""],
diff --git a/products/chromium/guide/chromium/chromium_http_authentication/bash/chromium.sh b/products/chromium/guide/chromium/chromium_http_authentication/bash/chromium.sh deleted file mode 100644 index 2858e63fd88..00000000000 --- a/products/chromium/guide/chromium/chromium_http_authentication/bash/chromium.sh +++ /dev/null @@ -1,5 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_auth_schema") }}} - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "AuthSchemes", '${var_auth_schema}') }}} diff --git a/products/chromium/guide/chromium/chromium_http_authentication/oval/chromium.xml b/products/chromium/guide/chromium/chromium_http_authentication/oval/chromium.xml deleted file mode 100644 index 8b4071109a1..00000000000 --- a/products/chromium/guide/chromium/chromium_http_authentication/oval/chromium.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - HTTP Authentication - - Google Chromium Browser - - The HTTP Authentication must be set to negotiate. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"AuthSchemes\"\:[\s]+\"(\S+)\", - 1 - - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_http_authentication/rule.yml b/products/chromium/guide/chromium/chromium_http_authentication/rule.yml deleted file mode 100644 index b834f197e9b..00000000000 --- a/products/chromium/guide/chromium/chromium_http_authentication/rule.yml +++ /dev/null @@ -1,21 +0,0 @@ -documentation_complete: true - -title: 'Set Chromium''s HTTP Authentication Scheme' - -description: |- - To set the default Chromium's HTTP Authentication Scheme, set AuthSchemes to {{{ xccdf_value("var_auth_schema") }}} in the Chromium policy file. - -rationale: 'Specifies which HTTP Authentication schemes are supported by Google Chromium.' - -severity: unknown - -references: - stigid: DTBC0012 - -ocil_clause: 'it is not set' - -ocil: |- - To verify that the HTTP Authentication Scheme is set, run the following command: -
$ grep AuthSchemes /etc/chromium/policies/managed/*.json
- The output should contain: -
"AuthSchemes": "{{{ xccdf_value("var_auth_schema") }}}",
diff --git a/products/chromium/guide/chromium/chromium_plugins_require_authorization/bash/chromium.sh b/products/chromium/guide/chromium/chromium_plugins_require_authorization/bash/chromium.sh deleted file mode 100644 index d9235800b1c..00000000000 --- a/products/chromium/guide/chromium/chromium_plugins_require_authorization/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "AlwaysAuthorizePlugins", "false") }}} diff --git a/products/chromium/guide/chromium/chromium_plugins_require_authorization/oval/chromium.xml b/products/chromium/guide/chromium/chromium_plugins_require_authorization/oval/chromium.xml deleted file mode 100644 index b4e767134c0..00000000000 --- a/products/chromium/guide/chromium/chromium_plugins_require_authorization/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Plugins Require Authentication - - Google Chromium Browser - - Plugins requiring authorization must ask for user permission. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\"AlwaysAuthorizePlugins\"\:[\s]+false, - 1 - - diff --git a/products/chromium/guide/chromium/chromium_plugins_require_authorization/rule.yml b/products/chromium/guide/chromium/chromium_plugins_require_authorization/rule.yml deleted file mode 100644 index 13dc90360ec..00000000000 --- a/products/chromium/guide/chromium/chromium_plugins_require_authorization/rule.yml +++ /dev/null @@ -1,25 +0,0 @@ -documentation_complete: true - -title: 'Require Outdated Plugins to be Authorized' - -description: |- - Chromium should prompt users for authorization to run outdated plugins. This - can be enabled by setting AlwaysAuthorizePlugins to false - in the Chromium policy file. - -rationale: |- - Outdated plugins can compromise security and should request authorization from - the user before running. - -severity: unknown - -references: - stigid: DTBC0014 - -ocil_clause: 'it is not set' - -ocil: |- - To verify that plugins require authorization to run, run the following command: -
$ grep AlwaysAuthorizePlugins /etc/chromium/policies/managed/*.json
- The output should contain: -
"AlwaysAuthorizePlugins": false,
diff --git a/products/chromium/guide/chromium/chromium_policy_file/bash/chromium.sh b/products/chromium/guide/chromium/chromium_policy_file/bash/chromium.sh deleted file mode 100644 index 41b46202eb7..00000000000 --- a/products/chromium/guide/chromium/chromium_policy_file/bash/chromium.sh +++ /dev/null @@ -1,28 +0,0 @@ -# platform = Google Chromium Browser -CHROME_POL_FILE="chrome_stig_policy.json" -CHROME_POL_DIR="/etc/chromium/policies/managed/" - -if [ ! -d ${CHROME_POL_DIR} ] ; then - mkdir -p ${CHROME_POL_DIR} - chmod 755 ${CHROME_POL_DIR} -fi - -if [ ! -f ${CHROME_POL_DIR}/${CHROME_POL_FILE} ] ; then - touch ${CHROME_POL_DIR}/${CHROME_POL_FILE} - chmod 644 ${CHROME_POL_DIR}/${CHROME_POL_FILE} -fi - -grep -q -E '^\{' ${CHROME_POL_DIR}/${CHROME_POL_FILE} -if ! [ $? -eq 0 ] ; then - if [ -s ${CHROME_POL_DIR}/${CHROME_POL_FILE} ] ; then - sed -i '1s/^/\{\n/' ${CHROME_POL_DIR}/${CHROME_POL_FILE} - else - echo -e "{" >> ${CHROME_POL_DIR}/${CHROME_POL_FILE} - fi -fi - -tail -1 ${CHROME_POL_DIR}/${CHROME_POL_FILE} | grep -q -E '^\}' -if ! [ $? -eq 0 ] ; then - echo -e "}" >> ${CHROME_POL_DIR}/${CHROME_POL_FILE} -fi - diff --git a/products/chromium/guide/chromium/chromium_policy_file/oval/chromium.xml b/products/chromium/guide/chromium/chromium_policy_file/oval/chromium.xml deleted file mode 100644 index c4adc5c4d52..00000000000 --- a/products/chromium/guide/chromium/chromium_policy_file/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Chromium Policy File Exists - - Google Chromium Browser - - The Chromium policy file must exist and be configured correctly. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^\{([^\n]*\n+)+[\s]+\".*\"\:[\s]+.*,([^\n]*\n+)+\} - 1 - - diff --git a/products/chromium/guide/chromium/chromium_policy_file/rule.yml b/products/chromium/guide/chromium/chromium_policy_file/rule.yml deleted file mode 100644 index 9502087239b..00000000000 --- a/products/chromium/guide/chromium/chromium_policy_file/rule.yml +++ /dev/null @@ -1,24 +0,0 @@ -documentation_complete: true - -title: 'Ensure the Chromium Policy Configuration File Exists' - -description: "Chromium can be configured with numerous policies and settings. These\nsettings can be set so that a user is unable to edit or change them.\nTo prevent users from setting or changing Chromium settings, a \nJavaScript Object Notation (JSON) file (contains the .json\nextension) must exist in /etc/chromium/policies/managed.\n

\n\n\n
" - -rationale: "The Chromium policy file must exist as this file contains configuration \nsettings set by the System's Administrator to meet organization and/or \nsecurity requirements." - -severity: unknown - -ocil_clause: 'it does not exist or is not configured correctly' - -ocil: |- - To verify that the Chromium policy file exists, run the following command: -
$ ls /etc/chromium/policies/managed
- The output should show file(s) ending in .json extension. - For example: -
chrome-stig-policy.json
- -warnings: - - general: |- - If the .json file in - /etc/chromium/policies/managed is not formatted correctly, - no policies will be configured or set correctly. diff --git a/products/chromium/guide/chromium/chromium_trusted_home_page/bash/chromium.sh b/products/chromium/guide/chromium/chromium_trusted_home_page/bash/chromium.sh deleted file mode 100644 index 6a220a5438d..00000000000 --- a/products/chromium/guide/chromium/chromium_trusted_home_page/bash/chromium.sh +++ /dev/null @@ -1,7 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_instantiate_variables("var_trusted_home_page") }}} - -var_trusted_home_page_modified="$(echo ${var_trusted_home_page} | sed 's/\//\\\/\\/')" - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "HomepageLocation", "${var_trusted_home_page_modified}", "${var_trusted_home_page}") }}} diff --git a/products/chromium/guide/chromium/chromium_trusted_home_page/oval/chromium.xml b/products/chromium/guide/chromium/chromium_trusted_home_page/oval/chromium.xml deleted file mode 100644 index 4837f047e2b..00000000000 --- a/products/chromium/guide/chromium/chromium_trusted_home_page/oval/chromium.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - Set Trusted Homepage URL - - Google Chromium Browser - - The homepage must be set to a trusted site. - - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"HomepageLocation\"\:[\s]+\"(\S+)\", - 1 - - - - - - - - - diff --git a/products/chromium/guide/chromium/chromium_trusted_home_page/rule.yml b/products/chromium/guide/chromium/chromium_trusted_home_page/rule.yml deleted file mode 100644 index 60fa5b860a4..00000000000 --- a/products/chromium/guide/chromium/chromium_trusted_home_page/rule.yml +++ /dev/null @@ -1,28 +0,0 @@ -documentation_complete: true - -title: 'Set the Default Home Page' - -description: |- - When a browser is started the first web page displayed is the "home page". - While the home page can be selected by the user, the default home page needs - to be defined to display an approved page. To set the default home page, - set HomepageLocation to - in the Chromium policy file. - -rationale: |- - If no home page is defined then there is a possibility that a URL to a malicious - site may be used as a home page which could effectively cause a denial of service - to the browser. - -severity: unknown - -references: - stigid: DTBC0048 - -ocil_clause: 'it is not set correctly' - -ocil: |- - To verify that the defaut home page is set, run the following command: -
$ grep HomepageLocation /etc/chromium/policies/managed/*.json
- The output should contain: -
"HomepageLocation": "",
diff --git a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/bash/chromium.sh b/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/bash/chromium.sh deleted file mode 100644 index 4677c8bb7b4..00000000000 --- a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/bash/chromium.sh +++ /dev/null @@ -1,3 +0,0 @@ -# platform = Google Chromium Browser - -{{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "PluginsAllowedForUrls", "none") }}} diff --git a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/oval/chromium.xml b/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/oval/chromium.xml deleted file mode 100644 index dc0f1ce48aa..00000000000 --- a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/oval/chromium.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Configure Whitelisted Plugins For Use - - Google Chromium Browser - - URLs must be whitelisted for plugin use. - - - - - - - - - - - ^/etc/chromium/policies/managed/.*\.json$ - ^[\s]+\"PluginsAllowedForUrls\"\:[\s]+\[\"(none|!*)\"\], - 1 - - diff --git a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/rule.yml b/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/rule.yml deleted file mode 100644 index fe1c2b435b4..00000000000 --- a/products/chromium/guide/chromium/chromium_whitelist_plugin_urls/rule.yml +++ /dev/null @@ -1,21 +0,0 @@ -documentation_complete: true - -title: 'Enable Plugins for Only Approved URLs' - -description: |- - In some cases, plugins utilized by organizationally approved websites may be allowed - to be used by those websites, configure the approved URLs allowed to run plugins by - setting PluginsAllowedForUrls to organizationally approved URLs - in the Chromium policy file. If there are no approved URLs, this should be set - to none - -rationale: 'Only approved plugins for approved sites should be allowed to be utilized.' - -severity: unknown - -references: - stigid: DTBC0051 - -ocil_clause: 'no urls exist or it is not set to none' - -ocil: "To verify that plugins are allowed for only approved URLs, \nrun the following command:\n
$ grep PluginsAllowedForUrls /etc/chromium/policies/managed/*.json
\nThe output should contain:\n
\"PluginsAllowedForUrls\": [\"[*.]mil\", \"[*.]example.com\", \"www.example.com\"],
" diff --git a/products/chromium/guide/chromium/group.yml b/products/chromium/guide/chromium/group.yml deleted file mode 100644 index 08e04dd1bae..00000000000 --- a/products/chromium/guide/chromium/group.yml +++ /dev/null @@ -1,5 +0,0 @@ -documentation_complete: true - -title: Chromium - -description: "Chromium is an open-source web browser, powered by WebKit (Blink),\nand developed by Google. Web browsers such as Chromium are used for a number of\nreasons. This section provides settings for configuring Chromium policies to \nmeet compliance settings for Chromium running on Red Hat Enterprise Linux \nsystems.\n\nRefer to for\na list of currently supported Chromium policies.\nRefer to for \npre-created Chromium JSON policy files." diff --git a/products/chromium/guide/chromium/var_auth_schema.var b/products/chromium/guide/chromium/var_auth_schema.var deleted file mode 100644 index cdf79a2aa37..00000000000 --- a/products/chromium/guide/chromium/var_auth_schema.var +++ /dev/null @@ -1,17 +0,0 @@ -documentation_complete: true - -title: 'Chromium HTTP Authentication Setting' - -description: 'Chromium HTTP Authentication Types' - -type: string - -interactive: false - -options: - all: basic,digest,ntlm,negotiate - basic: basic - default: negotiate - digest: digest - negotiate: negotiate - ntlm: ntlm diff --git a/products/chromium/guide/chromium/var_default_search_provider_name.var b/products/chromium/guide/chromium/var_default_search_provider_name.var deleted file mode 100644 index e5fe6f085b6..00000000000 --- a/products/chromium/guide/chromium/var_default_search_provider_name.var +++ /dev/null @@ -1,15 +0,0 @@ -documentation_complete: true - -title: 'The Default Search provider in Chromium' - -description: 'The URL for the Default Search provider in Chromium' - -type: string - -interactive: false - -options: - bing: https://www.bing.com - default: https://www.google.com - google: https://www.google.com - yahoo: https://www.yahoo.com diff --git a/products/chromium/guide/chromium/var_enable_approved_plugins.var b/products/chromium/guide/chromium/var_enable_approved_plugins.var deleted file mode 100644 index 996db9fc001..00000000000 --- a/products/chromium/guide/chromium/var_enable_approved_plugins.var +++ /dev/null @@ -1,13 +0,0 @@ -documentation_complete: true - -title: 'Chromium Enabled Plugins' - -description: 'Chromium Enabled Plugins' - -type: string - -interactive: true - -options: - default: '' - none: '' diff --git a/products/chromium/guide/chromium/var_enable_encrypted_searching.var b/products/chromium/guide/chromium/var_enable_encrypted_searching.var deleted file mode 100644 index 3a25b135d58..00000000000 --- a/products/chromium/guide/chromium/var_enable_encrypted_searching.var +++ /dev/null @@ -1,15 +0,0 @@ -documentation_complete: true - -title: 'Encrypted Chromium Search URLs' - -description: 'Encrypted search URL for the Default Search Provider' - -type: string - -interactive: false - -options: - bing: https://www.bing.com/search?q={searchTerms} - default: https://www.google.com/#q={searchTerms} - google: https://www.google.com/#q={searchTerms} - yahoo: https://www.yahoo.com/search?q={searchTerms} diff --git a/products/chromium/guide/chromium/var_extension_whitelist.var b/products/chromium/guide/chromium/var_extension_whitelist.var deleted file mode 100644 index a5fe46fcfff..00000000000 --- a/products/chromium/guide/chromium/var_extension_whitelist.var +++ /dev/null @@ -1,13 +0,0 @@ -documentation_complete: true - -title: 'Whitelisted Chromium Extenstions' - -description: 'Chromium extensions approved for use' - -type: string - -interactive: false - -options: - default: oiigbmnaadbkfbmpbfijlflahbdbdgdf - none: oiigbmnaadbkfbmpbfijlflahbdbdgdf diff --git a/products/chromium/guide/chromium/var_trusted_home_page.var b/products/chromium/guide/chromium/var_trusted_home_page.var deleted file mode 100644 index c9f102b980e..00000000000 --- a/products/chromium/guide/chromium/var_trusted_home_page.var +++ /dev/null @@ -1,13 +0,0 @@ -documentation_complete: true - -title: 'Default Chromium Homepage' - -description: 'Default homepage for Chromium users' - -type: string - -interactive: false - -options: - blank: about:blank - default: about:blank diff --git a/products/chromium/guide/chromium/var_url_blacklist.var b/products/chromium/guide/chromium/var_url_blacklist.var deleted file mode 100644 index f478776a33d..00000000000 --- a/products/chromium/guide/chromium/var_url_blacklist.var +++ /dev/null @@ -1,13 +0,0 @@ -documentation_complete: true - -title: 'Blacklisted Chromium Protocols' - -description: 'Blacklisted Protocol Schemas in Chromium' - -type: string - -interactive: false - -options: - default: javascript://* - javascript: javascript://* diff --git a/products/chromium/product.yml b/products/chromium/product.yml deleted file mode 100644 index a7fb2a94ab1..00000000000 --- a/products/chromium/product.yml +++ /dev/null @@ -1,15 +0,0 @@ -product: chromium -full_name: Chromium -type: product - -benchmark_id: CHROMIUM -benchmark_root: "./guide" - -profiles_root: "./profiles" - -cpes_root: "../../shared/applicability" -cpes: - - chromium: - name: "cpe:/a:google:chromium-browser" - title: "Google Chromium Browser" - check_id: installed_app_is_chromium diff --git a/products/chromium/profiles/stig.profile b/products/chromium/profiles/stig.profile deleted file mode 100644 index 0e737350cd9..00000000000 --- a/products/chromium/profiles/stig.profile +++ /dev/null @@ -1,63 +0,0 @@ -documentation_complete: true - -title: 'Upstream STIG for Google Chromium' - -description: |- - This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, - serving as the upstream development environment for the Google Chromium STIG. - - As a result of the upstream/downstream relationship between the SCAP Security Guide project - and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. - For official DISA FSO STIG content, refer to https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security%2Cbrowser-guidance. - - While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note - that commercial support of this SCAP content is NOT available. This profile is provided as example - SCAP content with no endorsement for suitability or production readiness. Support for this - profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The - upstream project homepage is https://www.open-scap.org/security-policies/scap-security-guide/. - -selections: - - var_default_search_provider_name=google - - var_url_blacklist=javascript - - var_enable_encrypted_searching=google - - var_extension_whitelist=none - - var_auth_schema=negotiate - - var_trusted_home_page=blank - - var_enable_approved_plugins=none - - chromium_policy_file - - chromium_disable_firewall_traversal - - chromium_block_desktop_notifications - - chromium_disable_popups - - chromium_disallow_location_tracking - - chromium_blacklist_extension_installation - - chromium_extension_whitelist - - chromium_default_search_provider_name - - chromium_enable_encrypted_searching - - chromium_default_search_provider - - chromium_disable_cleartext_passwords - - chromium_disable_password_manager - - chromium_http_authentication - - chromium_disable_outdated_plugins - - chromium_plugins_require_authorization - - chromium_disable_thirdparty_cookies - - chromium_disable_background_processing - - chromium_disable_3d_graphics_api - - chromium_disable_google_sync - - chromium_disable_protocol_schemas - - chromium_disable_autocomplete - - chromium_disable_cloud_print_sharing - - chromium_disable_network_prediction - - chromium_disable_metrics_reporting - - chromium_disable_search_suggestions - - chromium_disable_saved_passwords - - chromium_disable_incognito_mode - - chromium_disable_plugin_blacklist - - chromium_enable_approved_plugins - - chromium_disable_automatic_installation - - chromium_check_cert_revocation - - chromium_enable_safe_browsing - - chromium_enable_browser_history - - chromium_default_block_plugins - - chromium_disable_session_cookies - - chromium_trusted_home_page - - chromium_whitelist_plugin_urls diff --git a/products/chromium/transforms/constants.xslt b/products/chromium/transforms/constants.xslt deleted file mode 100644 index 4194223d046..00000000000 --- a/products/chromium/transforms/constants.xslt +++ /dev/null @@ -1,12 +0,0 @@ - - - - -Google Chromium -Chromium -CHROMIUM_STIG -chromium - -empty - - diff --git a/products/chromium/transforms/table-style.xslt b/products/chromium/transforms/table-style.xslt deleted file mode 100644 index 8b6caeab8cd..00000000000 --- a/products/chromium/transforms/table-style.xslt +++ /dev/null @@ -1,5 +0,0 @@ - - - - - diff --git a/products/chromium/transforms/xccdf-apply-overlay-stig.xslt b/products/chromium/transforms/xccdf-apply-overlay-stig.xslt deleted file mode 100644 index 4789419b80a..00000000000 --- a/products/chromium/transforms/xccdf-apply-overlay-stig.xslt +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - diff --git a/products/chromium/transforms/xccdf2table-cce.xslt b/products/chromium/transforms/xccdf2table-cce.xslt deleted file mode 100644 index f156a669566..00000000000 --- a/products/chromium/transforms/xccdf2table-cce.xslt +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/products/chromium/transforms/xccdf2table-profileccirefs.xslt b/products/chromium/transforms/xccdf2table-profileccirefs.xslt deleted file mode 100644 index 9d8d3e5faf1..00000000000 --- a/products/chromium/transforms/xccdf2table-profileccirefs.xslt +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/shared/applicability/oval/installed_app_is_chromium.xml b/shared/applicability/oval/installed_app_is_chromium.xml deleted file mode 100644 index b93fc5bdc10..00000000000 --- a/shared/applicability/oval/installed_app_is_chromium.xml +++ /dev/null @@ -1,39 +0,0 @@ - - - - Google Chromium Browser - - Google Chromium Browser - - - The application installed on the system is the Google Chromium Browser - - - - - - - - - - - - - - - chromium-browser - - - - - - - chromium - - - diff --git a/shared/checks/oval/installed_OS_is_part_of_Unix_family.xml b/shared/checks/oval/installed_OS_is_part_of_Unix_family.xml index 8d32c735561..091a7743aa9 100644 --- a/shared/checks/oval/installed_OS_is_part_of_Unix_family.xml +++ b/shared/checks/oval/installed_OS_is_part_of_Unix_family.xml @@ -4,7 +4,6 @@ Installed operating system is part of the Unix family multi_platform_all - Google Chromium Browser Mozilla Firefox The operating system installed on the system is part of the Unix OS family diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja index d164843c117..fd7413c567c 100644 --- a/shared/macros/10-bash.jinja +++ b/shared/macros/10-bash.jinja @@ -2196,40 +2196,6 @@ dpkg-query --show --showformat='${db:Status-Status}' '{{{ package }}}' 2>/dev/nu {{%- endif -%}} {{%- endmacro -%}} - -{{# -Macro to replace configuration setting(s) in the Chromium stig policy (.json) file or add the -preference if it does not exist. - -Example macro invocation:: - - {{{ bash_chromium_pol_setting("chrome_stig_policy.json", "/etc/chromium/policies/managed/", "ExtensionInstallBlacklist", "\[\"*\"\]") }}} - -:param chrome_pol_file: Policy file to that will be modified -:type chrome_pol_file: str -:param chrome_pol_dir: Directory where the policy file is located -:type chrome_pol_dir: str -:param pol_setting: The setting that will be modified -:type pol_setting: str -:param pol_setting_val: Value of the setting to replace the current value with -:type pol_setting_val: str -:param pol_setting_val_edit: Value of the setting to be inserted if setting and value not present -:type pol_setting_val_edit: str - -#}} -{{%- macro bash_chromium_pol_setting(chrome_pol_file, chrome_pol_dir, pol_setting, pol_setting_val, pol_setting_val_edit=None) %}} -{{% if not pol_setting_val_edit %}} -{{% set pol_setting_val_edit = pol_setting_val %}} -{{% endif %}} - -if ! grep -q {{{ pol_setting }}} {{{ chrome_pol_dir }}}{{{ chrome_pol_file }}}; then - sed -i -e '/{/a \ "'{{{ pol_setting }}}'": '{{{ pol_setting_val_edit }}}',' {{{ chrome_pol_dir }}}{{{ chrome_pol_file }}} -else - sed -i -e 's/\"'{{{ pol_setting }}}'.*/\"'{{{ pol_setting }}}'\": '{{{ pol_setting_val }}}',/g' {{{ chrome_pol_dir }}}{{{ chrome_pol_file }}} -fi -{{%- endmacro -%}} - - {{# Macro that lets you define the body of a loop that iterates over the output of the find command Use with the call block syntax {{% call iterate_over_find_output("fname", "mydir -name *.conf") %}} ... @@ -2285,11 +2251,11 @@ for f in $(echo -n "{{{ files }}}"); do # find key in section and change value if grep -qzosP "[[:space:]]*\[{{{ section }}}\]([^\n\[]*\n+)+?[[:space:]]*{{{ key }}}" "$f"; then if ! grep -qPz "{{{ key }}}={{{ value }}}" "$f"; then -{{% if no_quotes %}} +{{% if no_quotes %}} sed -i "s/{{{ key }}}[^(\n)]*/{{{ key }}}={{{ value | replace("/", "\/") }}}/" "$f" {{% else %}} sed -i 's/{{{ key }}}[^(\n)]*/{{{ key }}}="{{{ value | replace("/", "\/") }}}"/' "$f" -{{% endif %}} +{{% endif %}} fi found=true diff --git a/ssg/constants.py b/ssg/constants.py index 5eabb42f582..25a9693a4cb 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -44,7 +44,6 @@ 'anolis8', 'anolis23', 'al2023', - 'chromium', 'debian11', 'debian12', 'debian13', 'example', 'eks', @@ -215,7 +214,6 @@ "Anolis OS 8": "anolis8", "Anolis OS 23": "anolis23", "Amazon Linux 2023": "al2023", - "Chromium": "chromium", "Debian 11": "debian11", "Debian 12": "debian12", "Debian 13": "debian13", @@ -430,7 +428,6 @@ 'alinux': 'Alibaba Cloud Linux', 'almalinux': 'AlmaLinux OS', 'anolis': 'Anolis OS', - 'chromium': 'Google Chromium Browser', 'fedora': 'Fedora', 'firefox': 'Mozilla Firefox', 'kylinserver': 'Kylin Server', @@ -505,7 +502,6 @@ class OvalNamespaces: BENCHMARKS = { "applications", "linux_os/guide", - "products/chromium/guide", "products/firefox/guide", } diff --git a/ssg/oval_object_model/general.py b/ssg/oval_object_model/general.py index 556062f138f..edd4eca38e5 100644 --- a/ssg/oval_object_model/general.py +++ b/ssg/oval_object_model/general.py @@ -19,7 +19,7 @@ def required_attribute(_xml_el, _key): def get_product_name(product, product_version=None): # Current SSG checks aren't unified which element of '' # and '' to use as OVAL AffectedType metadata element, - # e.g. Chromium content uses both of them across the various checks + # e.g. Chromium (historically) content uses both of them across the various checks # Thus for now check both of them when checking concrete platform / product # Get official name for product (prefixed with content of afftype) diff --git a/tests/data/product_stability/chromium.yml b/tests/data/product_stability/chromium.yml deleted file mode 100644 index 72a50857f37..00000000000 --- a/tests/data/product_stability/chromium.yml +++ /dev/null @@ -1,95 +0,0 @@ -aide_also_checks_audispd: 'yes' -aide_also_checks_rsyslog: 'no' -aide_bin_path: /usr/sbin/aide -aide_conf_path: /etc/aide.conf -audisp_conf_path: /etc/audit -audit_binaries: - - /sbin/auditctl - - /sbin/aureport - - /sbin/ausearch - - /sbin/autrace - - /sbin/auditd - - /sbin/audispd - - /sbin/augenrules -audit_watches_style: legacy -auid: 1000 -basic_properties_derived: true -benchmark_id: CHROMIUM -benchmark_root: ./guide -bootable_containers_supported: 'false' -chrony_conf_path: /etc/chrony.conf -chrony_d_path: /etc/chrony.d/ -cpes: -- chromium: - check_id: installed_app_is_chromium - name: cpe:/a:google:chromium-browser - title: Google Chromium Browser -cpes_root: ../../shared/applicability -dconf_gdm_dir: gdm.d -dynamic_uid_max: 65519 -dynamic_uid_min: 61184 -faillock_path: /var/run/faillock -full_name: Chromium -gid_min: 1000 -groups: {} -grub2_boot_path: /boot/grub2 -grub2_uefi_boot_path: /boot/grub2 -grub_helper_executable: grubby -login_defs_path: /etc/login.defs -nobody_gid: 65534 -nobody_uid: 65534 -platform_package_overrides: - aarch64_arch: null - grub2: grub2-common - login_defs: login - no_ovirt: null - non-uefi: null - not_aarch64_arch: null - not_s390x_arch: null - ovirt: null - s390x_arch: null - sssd: sssd-common - sssd-ldap: null - uefi: null - zipl: s390utils-base -product: chromium -profiles_root: ./profiles -reference_uris: - anssi: https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf - app-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=application-servers - app-srg-ctr: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security - bsi: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf - cis-csc: https://www.cisecurity.org/controls/ - cjis: https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf - cobit5: https://www.isaca.org/resources/cobit - cui: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf - dcid: not_officially_available - disa: https://www.cyber.mil/stigs/cci/ - hipaa: https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf - isa-62443-2009: https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat - isa-62443-2013: https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu - ism: https://www.cyber.gov.au/acsc/view-all-content/ism - iso27001-2013: https://www.iso.org/contents/data/standard/05/45/54534.html - nerc-cip: https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx - nist: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf - nist-csf: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - os-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os - ospp: https://www.niap-ccevs.org/Profile/PP.cfm - pcidss: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - pcidss4: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf - stigid: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux - stigref: https://www.cyber.mil/stigs/srg-stig-tools/ -rsyslog_cafile: /etc/pki/tls/cert.pem -sshd_distributed_config: 'false' -sysctl_remediate_drop_in_file: 'false' -target_oval_version: -- 5 -- 11 -target_oval_version_str: '5.11' -type: product -uid_min: 1000 -xwindows_packages: -- xorg-x11-server-Xorg -- xorg-x11-server-common -- xorg-x11-server-utils -- xorg-x11-server-Xwayland diff --git a/tests/data/utils/no_new_global_applicable_rules.json b/tests/data/utils/no_new_global_applicable_rules.json index 7bf18c39597..2c5015c135e 100644 --- a/tests/data/utils/no_new_global_applicable_rules.json +++ b/tests/data/utils/no_new_global_applicable_rules.json @@ -1 +1 @@ -["avahi_disable_publishing", "package_cron_installed", "service_cron_enabled", "package_inetutils-telnetd_removed", "package_nis_removed", "package_ntpdate_removed", "package_telnetd-ssl_removed", "package_telnetd_removed", "dhcp_client_restrict_options", "dhcp_server_minimize_served_info", "fapolicyd_prevent_home_folder_access", "ftp_configure_firewall", "ftp_limit_users", "package_postfix_installed", "postfix_client_configure_mail_alias", "postfix_client_configure_mail_alias_postmaster", "postfix_client_configure_relayhost", "service_netfs_disabled", "no_all_squash_exports", "chronyd_server_directive", "chronyd_specify_remote_server", "ntpd_specify_multiple_servers", "ntpd_specify_remote_server", "package_chrony_installed", "package_ntp_installed", "service_chronyd_enabled", "service_ntp_enabled", "service_ntpd_enabled", "no_rsh_trust_files", "file_groupownership_sshd_private_key", "file_groupownership_sshd_pub_key", "file_ownership_sshd_private_key", "file_ownership_sshd_pub_key", "file_permissions_sshd_private_key", "file_permissions_sshd_pub_key", "iptables_sshd_disabled", "package_openssh-server_installed", "package_openssh-server_removed", "service_sshd_disabled", "disable_host_auth", "sshd_allow_only_protocol2", "sshd_disable_compression", "sshd_disable_empty_passwords", "sshd_disable_gssapi_auth", "sshd_disable_kerb_auth", "sshd_disable_pubkey_auth", "sshd_disable_rhosts", "sshd_disable_rhosts_rsa", "sshd_disable_root_login", "sshd_disable_root_password_login", "sshd_disable_tcp_forwarding", "sshd_disable_user_known_hosts", "sshd_disable_x11_forwarding", "sshd_do_not_permit_user_env", "sshd_enable_gssapi_auth", "sshd_enable_pam", "sshd_enable_pubkey_auth", "sshd_enable_strictmodes", "sshd_enable_warning_banner", "sshd_enable_warning_banner_net", "sshd_enable_x11_forwarding", "sshd_limit_user_access", "sshd_print_last_log", "sshd_rekey_limit", "sshd_set_idle_timeout", "sshd_set_keepalive", "sshd_set_keepalive_0", "sshd_set_login_grace_time", "sshd_set_loglevel_info", "sshd_set_loglevel_verbose", "sshd_set_max_auth_tries", "sshd_set_max_sessions", "sshd_set_maxstartups", "sshd_use_priv_separation", "disallow_bypass_password_sudo", "display_login_attempts", "account_passwords_pam_faillock_audit", "account_passwords_pam_faillock_dir", "accounts_passwords_pam_faillock_audit", "account_unique_name", "account_use_centralized_automated_auth", "accounts_maximum_age_login_defs", "accounts_minimum_age_login_defs", "accounts_password_minlen_login_defs", "accounts_password_warn_age_login_defs", "accounts_password_all_shadowed", "accounts_password_last_change_is_in_past", "gid_passwd_group_same", "no_empty_passwords", "no_empty_passwords_etc_shadow", "no_netrc_files", "accounts_no_uid_except_zero", "accounts_root_gid_zero", "no_direct_root_logins", "no_password_auth_for_systemaccounts", "restrict_serial_port_logins", "securetty_root_login_console_only", "accounts_logon_fail_delay", "accounts_max_concurrent_login_sessions", "accounts_polyinstantiated_tmp", "accounts_polyinstantiated_var_tmp", "file_permissions_home_dirs", "accounts_root_path_dirs_no_write", "root_path_no_dot", "accounts_umask_etc_login_defs", "accounts_umask_etc_profile", "audit_rules_dac_modification_chmod", "audit_rules_dac_modification_chown", "audit_rules_dac_modification_fchmod", "audit_rules_dac_modification_fchmodat", "audit_rules_dac_modification_fchown", "audit_rules_dac_modification_fchownat", "audit_rules_dac_modification_fremovexattr", "audit_rules_dac_modification_fsetxattr", "audit_rules_dac_modification_lchown", "audit_rules_dac_modification_lremovexattr", "audit_rules_dac_modification_lsetxattr", "audit_rules_dac_modification_removexattr", "audit_rules_dac_modification_setxattr", "audit_rules_dac_modification_umount", "audit_rules_dac_modification_umount2", "audit_rules_file_deletion_events_rename", "audit_rules_file_deletion_events_renameat", "audit_rules_file_deletion_events_rmdir", "audit_rules_file_deletion_events_unlink", "audit_rules_file_deletion_events_unlinkat", "audit_privileged_commands_init", "audit_privileged_commands_poweroff", "audit_privileged_commands_reboot", "audit_privileged_commands_shutdown", "audit_rules_privileged_commands", "audit_rules_immutable", "audit_rules_mac_modification", "audit_rules_mac_modification_usr_share", "audit_rules_media_export", "audit_rules_networkconfig_modification", "audit_rules_session_events", "audit_rules_sysadmin_actions", "audit_rules_usergroup_modification", "audit_rules_time_adjtimex", "audit_rules_time_clock_settime", "audit_rules_time_settimeofday", "audit_rules_time_stime", "audit_rules_time_watch_localtime", "directory_access_var_log_audit", "directory_permissions_var_log_audit", "file_groupownership_audit_configuration", "file_ownership_audit_configuration", "file_ownership_var_log_audit", "file_permissions_audit_configuration", "auditd_audispd_syslog_plugin_activated", "auditd_data_disk_error_action", "auditd_data_disk_error_action_stig", "auditd_data_disk_full_action", "auditd_data_disk_full_action_stig", "auditd_data_retention_action_mail_acct", "auditd_data_retention_admin_space_left_action", "auditd_data_retention_max_log_file", "auditd_data_retention_max_log_file_action", "auditd_data_retention_max_log_file_action_stig", "auditd_data_retention_num_logs", "auditd_data_retention_space_left_action", "auditd_freq", "auditd_local_events", "auditd_log_format", "auditd_name_format", "auditd_overflow_action", "auditd_write_logs", "package_audit-audispd-plugins_installed", "package_audit_installed", "service_auditd_enabled", "grub2_disable_recovery", "grub2_enable_iommu_force", "grub2_l1tf_argument", "grub2_mce_argument", "grub2_nosmap_argument_absent", "grub2_nosmep_argument_absent", "grub2_rng_core_default_quality_argument", "grub2_slab_nomerge_argument", "grub2_spec_store_bypass_disable_argument", "grub2_spectre_v2_argument", "grub2_systemd_debug-shell_argument_absent", "kernel_disable_entropy_contribution_for_solid_state_drives", "kernel_config_acpi_custom_method", "kernel_config_binfmt_misc", "kernel_config_bug", "kernel_config_compat_brk", "kernel_config_compat_vdso", "kernel_config_debug_credentials", "kernel_config_debug_fs", "kernel_config_debug_list", "kernel_config_debug_notifiers", "kernel_config_debug_sg", "kernel_config_default_mmap_min_addr", "kernel_config_devkmem", "kernel_config_hibernation", "kernel_config_ia32_emulation", "kernel_config_ipv6", "kernel_config_kexec", "kernel_config_legacy_ptys", "kernel_config_module_sig", "kernel_config_module_sig_all", "kernel_config_module_sig_force", "kernel_config_module_sig_hash", "kernel_config_module_sig_key", "kernel_config_module_sig_sha512", "kernel_config_page_poisoning_no_sanity", "kernel_config_page_poisoning_zero", "kernel_config_page_table_isolation", "kernel_config_panic_on_oops", "kernel_config_panic_timeout", "kernel_config_proc_kcore", "kernel_config_randomize_base", "kernel_config_randomize_memory", "kernel_config_retpoline", "kernel_config_seccomp", "kernel_config_seccomp_filter", "kernel_config_security", "kernel_config_security_dmesg_restrict", "kernel_config_security_writable_hooks", "kernel_config_security_yama", "kernel_config_slub_debug", "kernel_config_syn_cookies", "kernel_config_unmap_kernel_at_el0", "kernel_config_x86_vsyscall_emulation", "rsyslog_encrypt_offload_actionsendstreamdriverauthmode", "rsyslog_encrypt_offload_actionsendstreamdrivermode", "rsyslog_encrypt_offload_defaultnetstreamdriver", "rsyslog_files_groupownership", "rsyslog_files_ownership", "rsyslog_files_permissions", "service_systemd-journald_enabled", "ensure_logrotate_activated", "package_logrotate_installed", "package_rsyslog_installed", "package_syslogng_installed", "rsyslog_accept_remote_messages_tcp", "rsyslog_accept_remote_messages_udp", "service_syslogng_enabled", "rsyslog_remote_loghost", "service_rsyslog_enabled", "service_ip6tables_enabled", "service_iptables_enabled", "set_ip6tables_default_rule", "set_ipv6_loopback_traffic", "set_loopback_traffic", "set_iptables_default_rule", "set_iptables_default_rule_forward", "kernel_module_ipv6_option_disabled", "sysctl_net_ipv6_conf_all_disable_ipv6", "sysctl_net_ipv6_conf_default_disable_ipv6", "sysctl_net_ipv4_conf_all_accept_local", "sysctl_net_ipv4_conf_all_arp_filter", "sysctl_net_ipv4_conf_all_arp_ignore", "sysctl_net_ipv4_conf_all_route_localnet", "sysctl_net_ipv4_conf_all_shared_media", "sysctl_net_ipv4_conf_default_shared_media", "service_ufw_enabled", "kernel_module_rds_disabled", "kernel_module_tipc_disabled", "dir_perms_world_writable_sticky_bits", "file_permissions_systemmap", "file_permissions_unauthorized_world_writable", "file_groupowner_backup_etc_group", "file_groupowner_backup_etc_gshadow", "file_groupowner_backup_etc_passwd", "file_groupowner_backup_etc_shadow", "file_groupowner_etc_group", "file_groupowner_etc_gshadow", "file_groupowner_etc_passwd", "file_groupowner_etc_shadow", "file_owner_backup_etc_group", "file_owner_backup_etc_gshadow", "file_owner_backup_etc_passwd", "file_owner_backup_etc_shadow", "file_owner_etc_group", "file_owner_etc_gshadow", "file_owner_etc_passwd", "file_owner_etc_shadow", "file_permissions_backup_etc_group", "file_permissions_backup_etc_gshadow", "file_permissions_backup_etc_passwd", "file_permissions_backup_etc_shadow", "file_permissions_etc_group", "file_permissions_etc_gshadow", "file_permissions_etc_passwd", "file_permissions_etc_shadow", "file_groupowner_var_log", "file_groupowner_var_log_messages", "file_groupowner_var_log_syslog", "file_owner_var_log", "file_owner_var_log_messages", "file_owner_var_log_syslog", "file_permissions_var_log", "file_permissions_var_log_messages", "file_permissions_var_log_syslog", "dir_ownership_binary_dirs", "dir_ownership_library_dirs", "dir_permissions_binary_dirs", "dir_permissions_library_dirs", "file_ownership_binary_dirs", "file_ownership_library_dirs", "file_permissions_binary_dirs", "file_permissions_library_dirs", "sysctl_fs_protected_hardlinks", "sysctl_fs_protected_symlinks", "mount_option_dev_shm_nodev", "mount_option_dev_shm_nosuid", "coredump_disable_backtraces", "coredump_disable_storage", "sysctl_fs_suid_dumpable", "sysctl_kernel_kptr_restrict", "sysctl_kernel_randomize_va_space", "kernel_module_uvcvideo_disabled", "sysctl_kernel_panic_on_oops", "selinux_not_disabled", "selinux_state", "partition_for_dev_shm", "partition_for_home", "partition_for_srv", "partition_for_tmp", "partition_for_var", "partition_for_var_log", "partition_for_var_log_audit", "gnome_gdm_disable_xdmcp", "harden_ssh_client_crypto_policy", "configure_user_data_backups", "package_MFEhiplsm_installed", "prefer_64bit_os", "sudo_add_noexec", "sudo_add_requiretty", "sudo_add_use_pty", "sudo_custom_logfile", "sudo_remove_no_authenticate", "sudo_remove_nopasswd", "sudo_require_authentication", "sudo_vdsm_nopasswd", "sudoers_explicit_command_args", "sudoers_no_command_negation", "package_gnutls-utils_installed", "package_nss-tools_installed", "chromium_blacklist_extension_installation", "chromium_block_desktop_notifications", "chromium_check_cert_revocation", "chromium_default_block_plugins", "chromium_default_search_provider", "chromium_default_search_provider_name", "chromium_disable_3d_graphics_api", "chromium_disable_autocomplete", "chromium_disable_automatic_installation", "chromium_disable_background_processing", "chromium_disable_cleartext_passwords", "chromium_disable_cloud_print_sharing", "chromium_disable_firewall_traversal", "chromium_disable_google_sync", "chromium_disable_incognito_mode", "chromium_disable_metrics_reporting", "chromium_disable_network_prediction", "chromium_disable_outdated_plugins", "chromium_disable_password_manager", "chromium_disable_plugin_blacklist", "chromium_disable_popups", "chromium_disable_protocol_schemas", "chromium_disable_saved_passwords", "chromium_disable_search_suggestions", "chromium_disable_session_cookies", "chromium_disable_thirdparty_cookies", "chromium_disallow_location_tracking", "chromium_enable_approved_plugins", "chromium_enable_browser_history", "chromium_enable_encrypted_searching", "chromium_enable_safe_browsing", "chromium_extension_whitelist", "chromium_http_authentication", "chromium_plugins_require_authorization", "chromium_policy_file", "chromium_trusted_home_page", "chromium_whitelist_plugin_urls", "firefox_preferences-enable_ca_trust", "audit_failure_halt", "service_com_apple_auditd_enabled"] +["avahi_disable_publishing","package_cron_installed","service_cron_enabled","package_inetutils-telnetd_removed","package_nis_removed","package_ntpdate_removed","package_telnetd-ssl_removed","package_telnetd_removed","dhcp_client_restrict_options","dhcp_server_minimize_served_info","fapolicyd_prevent_home_folder_access","ftp_configure_firewall","ftp_limit_users","package_postfix_installed","postfix_client_configure_mail_alias","postfix_client_configure_mail_alias_postmaster","postfix_client_configure_relayhost","service_netfs_disabled","no_all_squash_exports","chronyd_server_directive","chronyd_specify_remote_server","ntpd_specify_multiple_servers","ntpd_specify_remote_server","package_chrony_installed","package_ntp_installed","service_chronyd_enabled","service_ntp_enabled","service_ntpd_enabled","no_rsh_trust_files","file_groupownership_sshd_private_key","file_groupownership_sshd_pub_key","file_ownership_sshd_private_key","file_ownership_sshd_pub_key","file_permissions_sshd_private_key","file_permissions_sshd_pub_key","iptables_sshd_disabled","package_openssh-server_installed","package_openssh-server_removed","service_sshd_disabled","disable_host_auth","sshd_allow_only_protocol2","sshd_disable_compression","sshd_disable_empty_passwords","sshd_disable_gssapi_auth","sshd_disable_kerb_auth","sshd_disable_pubkey_auth","sshd_disable_rhosts","sshd_disable_rhosts_rsa","sshd_disable_root_login","sshd_disable_root_password_login","sshd_disable_tcp_forwarding","sshd_disable_user_known_hosts","sshd_disable_x11_forwarding","sshd_do_not_permit_user_env","sshd_enable_gssapi_auth","sshd_enable_pam","sshd_enable_pubkey_auth","sshd_enable_strictmodes","sshd_enable_warning_banner","sshd_enable_warning_banner_net","sshd_enable_x11_forwarding","sshd_limit_user_access","sshd_print_last_log","sshd_rekey_limit","sshd_set_idle_timeout","sshd_set_keepalive","sshd_set_keepalive_0","sshd_set_login_grace_time","sshd_set_loglevel_info","sshd_set_loglevel_verbose","sshd_set_max_auth_tries","sshd_set_max_sessions","sshd_set_maxstartups","sshd_use_priv_separation","disallow_bypass_password_sudo","display_login_attempts","account_passwords_pam_faillock_audit","account_passwords_pam_faillock_dir","accounts_passwords_pam_faillock_audit","account_unique_name","account_use_centralized_automated_auth","accounts_maximum_age_login_defs","accounts_minimum_age_login_defs","accounts_password_minlen_login_defs","accounts_password_warn_age_login_defs","accounts_password_all_shadowed","accounts_password_last_change_is_in_past","gid_passwd_group_same","no_empty_passwords","no_empty_passwords_etc_shadow","no_netrc_files","accounts_no_uid_except_zero","accounts_root_gid_zero","no_direct_root_logins","no_password_auth_for_systemaccounts","restrict_serial_port_logins","securetty_root_login_console_only","accounts_logon_fail_delay","accounts_max_concurrent_login_sessions","accounts_polyinstantiated_tmp","accounts_polyinstantiated_var_tmp","file_permissions_home_dirs","accounts_root_path_dirs_no_write","root_path_no_dot","accounts_umask_etc_login_defs","accounts_umask_etc_profile","audit_rules_dac_modification_chmod","audit_rules_dac_modification_chown","audit_rules_dac_modification_fchmod","audit_rules_dac_modification_fchmodat","audit_rules_dac_modification_fchown","audit_rules_dac_modification_fchownat","audit_rules_dac_modification_fremovexattr","audit_rules_dac_modification_fsetxattr","audit_rules_dac_modification_lchown","audit_rules_dac_modification_lremovexattr","audit_rules_dac_modification_lsetxattr","audit_rules_dac_modification_removexattr","audit_rules_dac_modification_setxattr","audit_rules_dac_modification_umount","audit_rules_dac_modification_umount2","audit_rules_file_deletion_events_rename","audit_rules_file_deletion_events_renameat","audit_rules_file_deletion_events_rmdir","audit_rules_file_deletion_events_unlink","audit_rules_file_deletion_events_unlinkat","audit_privileged_commands_init","audit_privileged_commands_poweroff","audit_privileged_commands_reboot","audit_privileged_commands_shutdown","audit_rules_privileged_commands","audit_rules_immutable","audit_rules_mac_modification","audit_rules_mac_modification_usr_share","audit_rules_media_export","audit_rules_networkconfig_modification","audit_rules_session_events","audit_rules_sysadmin_actions","audit_rules_usergroup_modification","audit_rules_time_adjtimex","audit_rules_time_clock_settime","audit_rules_time_settimeofday","audit_rules_time_stime","audit_rules_time_watch_localtime","directory_access_var_log_audit","directory_permissions_var_log_audit","file_groupownership_audit_configuration","file_ownership_audit_configuration","file_ownership_var_log_audit","file_permissions_audit_configuration","auditd_audispd_syslog_plugin_activated","auditd_data_disk_error_action","auditd_data_disk_error_action_stig","auditd_data_disk_full_action","auditd_data_disk_full_action_stig","auditd_data_retention_action_mail_acct","auditd_data_retention_admin_space_left_action","auditd_data_retention_max_log_file","auditd_data_retention_max_log_file_action","auditd_data_retention_max_log_file_action_stig","auditd_data_retention_num_logs","auditd_data_retention_space_left_action","auditd_freq","auditd_local_events","auditd_log_format","auditd_name_format","auditd_overflow_action","auditd_write_logs","package_audit-audispd-plugins_installed","package_audit_installed","service_auditd_enabled","grub2_disable_recovery","grub2_enable_iommu_force","grub2_l1tf_argument","grub2_mce_argument","grub2_nosmap_argument_absent","grub2_nosmep_argument_absent","grub2_rng_core_default_quality_argument","grub2_slab_nomerge_argument","grub2_spec_store_bypass_disable_argument","grub2_spectre_v2_argument","grub2_systemd_debug-shell_argument_absent","kernel_disable_entropy_contribution_for_solid_state_drives","kernel_config_acpi_custom_method","kernel_config_binfmt_misc","kernel_config_bug","kernel_config_compat_brk","kernel_config_compat_vdso","kernel_config_debug_credentials","kernel_config_debug_fs","kernel_config_debug_list","kernel_config_debug_notifiers","kernel_config_debug_sg","kernel_config_default_mmap_min_addr","kernel_config_devkmem","kernel_config_hibernation","kernel_config_ia32_emulation","kernel_config_ipv6","kernel_config_kexec","kernel_config_legacy_ptys","kernel_config_module_sig","kernel_config_module_sig_all","kernel_config_module_sig_force","kernel_config_module_sig_hash","kernel_config_module_sig_key","kernel_config_module_sig_sha512","kernel_config_page_poisoning_no_sanity","kernel_config_page_poisoning_zero","kernel_config_page_table_isolation","kernel_config_panic_on_oops","kernel_config_panic_timeout","kernel_config_proc_kcore","kernel_config_randomize_base","kernel_config_randomize_memory","kernel_config_retpoline","kernel_config_seccomp","kernel_config_seccomp_filter","kernel_config_security","kernel_config_security_dmesg_restrict","kernel_config_security_writable_hooks","kernel_config_security_yama","kernel_config_slub_debug","kernel_config_syn_cookies","kernel_config_unmap_kernel_at_el0","kernel_config_x86_vsyscall_emulation","rsyslog_encrypt_offload_actionsendstreamdriverauthmode","rsyslog_encrypt_offload_actionsendstreamdrivermode","rsyslog_encrypt_offload_defaultnetstreamdriver","rsyslog_files_groupownership","rsyslog_files_ownership","rsyslog_files_permissions","service_systemd-journald_enabled","ensure_logrotate_activated","package_logrotate_installed","package_rsyslog_installed","package_syslogng_installed","rsyslog_accept_remote_messages_tcp","rsyslog_accept_remote_messages_udp","service_syslogng_enabled","rsyslog_remote_loghost","service_rsyslog_enabled","service_ip6tables_enabled","service_iptables_enabled","set_ip6tables_default_rule","set_ipv6_loopback_traffic","set_loopback_traffic","set_iptables_default_rule","set_iptables_default_rule_forward","kernel_module_ipv6_option_disabled","sysctl_net_ipv6_conf_all_disable_ipv6","sysctl_net_ipv6_conf_default_disable_ipv6","sysctl_net_ipv4_conf_all_accept_local","sysctl_net_ipv4_conf_all_arp_filter","sysctl_net_ipv4_conf_all_arp_ignore","sysctl_net_ipv4_conf_all_route_localnet","sysctl_net_ipv4_conf_all_shared_media","sysctl_net_ipv4_conf_default_shared_media","service_ufw_enabled","kernel_module_rds_disabled","kernel_module_tipc_disabled","dir_perms_world_writable_sticky_bits","file_permissions_systemmap","file_permissions_unauthorized_world_writable","file_groupowner_backup_etc_group","file_groupowner_backup_etc_gshadow","file_groupowner_backup_etc_passwd","file_groupowner_backup_etc_shadow","file_groupowner_etc_group","file_groupowner_etc_gshadow","file_groupowner_etc_passwd","file_groupowner_etc_shadow","file_owner_backup_etc_group","file_owner_backup_etc_gshadow","file_owner_backup_etc_passwd","file_owner_backup_etc_shadow","file_owner_etc_group","file_owner_etc_gshadow","file_owner_etc_passwd","file_owner_etc_shadow","file_permissions_backup_etc_group","file_permissions_backup_etc_gshadow","file_permissions_backup_etc_passwd","file_permissions_backup_etc_shadow","file_permissions_etc_group","file_permissions_etc_gshadow","file_permissions_etc_passwd","file_permissions_etc_shadow","file_groupowner_var_log","file_groupowner_var_log_messages","file_groupowner_var_log_syslog","file_owner_var_log","file_owner_var_log_messages","file_owner_var_log_syslog","file_permissions_var_log","file_permissions_var_log_messages","file_permissions_var_log_syslog","dir_ownership_binary_dirs","dir_ownership_library_dirs","dir_permissions_binary_dirs","dir_permissions_library_dirs","file_ownership_binary_dirs","file_ownership_library_dirs","file_permissions_binary_dirs","file_permissions_library_dirs","sysctl_fs_protected_hardlinks","sysctl_fs_protected_symlinks","mount_option_dev_shm_nodev","mount_option_dev_shm_nosuid","coredump_disable_backtraces","coredump_disable_storage","sysctl_fs_suid_dumpable","sysctl_kernel_kptr_restrict","sysctl_kernel_randomize_va_space","kernel_module_uvcvideo_disabled","sysctl_kernel_panic_on_oops","selinux_not_disabled","selinux_state","partition_for_dev_shm","partition_for_home","partition_for_srv","partition_for_tmp","partition_for_var","partition_for_var_log","partition_for_var_log_audit","gnome_gdm_disable_xdmcp","harden_ssh_client_crypto_policy","configure_user_data_backups","package_MFEhiplsm_installed","prefer_64bit_os","sudo_add_noexec","sudo_add_requiretty","sudo_add_use_pty","sudo_custom_logfile","sudo_remove_no_authenticate","sudo_remove_nopasswd","sudo_require_authentication","sudo_vdsm_nopasswd","sudoers_explicit_command_args","sudoers_no_command_negation","package_gnutls-utils_installed","package_nss-tools_installed","firefox_preferences-enable_ca_trust","audit_failure_halt","service_com_apple_auditd_enabled"]