From ebf5d8529b44028c7b02e36904ea4ce88d9ab34f Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Thu, 15 Oct 2026 08:57:44 -0400 Subject: [PATCH 1/6] Update method for persistence Prior method was based on method established before release of SaltStack 2017.7.0. With the 2017.7.0 release, the `selinux.fcontext_policy_applied` state became available. Use of it, rather than statically-prescribed SELinux attributes via `file.managed`: - Ensures that the labels applied match what `matchpathcon` say they should be - Ensures that if someone subequently does an system-wide SELinux relabel task, the labels don't "drift" --- .../el9/STIGbyID/cat2/RHEL-09-291025.sls | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls index 29709c3d..c559dd7c 100644 --- a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls +++ b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls @@ -44,9 +44,9 @@ {%- set stig_id = stigIdByVendor[salt.grains.get('os')] %} {%- set helperLoc = tpldir ~ '/files' %} {%- set skipIt = salt.pillar.get('ash-linux:lookup:skip-stigs', []) %} -{%- set cfgFile ='/etc/usbguard/usbguard-daemon.conf' %} +{%- set cfgFile = '/etc/usbguard/usbguard-daemon.conf' %} {%- set cfgParm = 'AuditBackend' %} -{%- set cfgValu = salt.pillar.get('ash-linux:lookup:usb_guard:audit_backend', 'LinuxAudit') %} +{%- set cfgValu = salt.pillar.get('ash-linux:lookup:usb_guard:audit_backend', 'LinuxAudit') %} {{ stig_id }}-description: test.show_notification: @@ -63,37 +63,38 @@ notify_{{ stig_id }}-skipSet: - text: | Handler for {{ stig_id }} has been selected for skip. {%- else %} -Create USBguard config-file ({{ stig_id }}): - file.touch: - - name: '{{ cfgFile }}' - - makedirs: True - - unless: - - 'stat {{ cfgFile }}' - -Set permission-bits on {{ cfgFile }} ({{ stig_id }}): +# Establish correct mode and user/group ownership +# - Create a null-file if no file already exists +# - Ensures correct mode & user/group ownership on file (irrespective of +# file's previous existence) +Ensure {{ cfgFile }} exists with strict permissions ({{ stig_id }}): file.managed: - - name: '{{ cfgFile }}' + - contents: '' - group: 'root' + - makedirs: True - mode: '0600' + - name: '{{ cfgFile }}' - replace: False - - selinux: - serange: 's0' - serole: 'object_r' - setype: 'etc_t' - seuser: 'system_u' - user: 'root' - - watch: - - file: 'Create USBguard config-file ({{ stig_id }})' +# Ensurse STIG-prescribed config-directive exists in file Enable USBguard audit-logging ({{ stig_id }}): file.replace: - - name: '{{ cfgFile }}' - append_if_not_found: True + - name: '{{ cfgFile }}' - not_found_content: | # Set per rule {{ stig_id }} {{ cfgParm }}={{ cfgValu }} - pattern: '(^(|\s\s*)){{ cfgParm }}.*$' - repl: '{{ cfgParm }}={{ cfgValu }}' - - watch: - - file: 'Set permission-bits on {{ cfgFile }} ({{ stig_id }})' + - require: + - file: 'Ensure {{ cfgFile }} exists with strict permissions ({{ stig_id }})' + +# Bypasses the broken file.managed SELinux parameter on RHEL 9/10 and ensures +# that label matches the rule from `matchpathcon` +Apply SELinux context to {{ cfgFile }} ({{ stig_id }}): + selinux.fcontext_policy_applied: + - name: '{{ cfgFile }}' + - require: + - file: 'Enable USBguard audit-logging ({{ stig_id }})' {%- endif %} From b966402ac3987ae31050c5f9d213a442219ef38a Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Thu, 15 Oct 2026 09:02:06 -0400 Subject: [PATCH 2/6] Mooted by STIG-rule Addition of the STIG rule-ID `RHEL-09-291025` and the associated logic in ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls Obviates the need for this rule-handler --- ...t_rule_configure_usbguard_auditbackend.sls | 77 ------------------- 1 file changed, 77 deletions(-) delete mode 100644 ash-linux/el9/RuleById/low/content_rule_configure_usbguard_auditbackend.sls diff --git a/ash-linux/el9/RuleById/low/content_rule_configure_usbguard_auditbackend.sls b/ash-linux/el9/RuleById/low/content_rule_configure_usbguard_auditbackend.sls deleted file mode 100644 index 7b969fc8..00000000 --- a/ash-linux/el9/RuleById/low/content_rule_configure_usbguard_auditbackend.sls +++ /dev/null @@ -1,77 +0,0 @@ -# Rule ID: content_rule_configure_usbguard_auditbackend -# Finding Level: low -# -# Rule Summary: -# Configure USBGuard daemon to log via Linux Audit service by setting the -# `AuditBackend` option in the `/etc/usbguard/usbguard-daemon.conf` -# file to `LinuxAudit` -# -# Identifiers: -# - content_rule_configure_usbguard_auditbackend -# -# References: -# - DISA -# - CCI-000169 -# - CCI-000172 -# - NIST -# - AU-2 -# - CM-8(3) -# - IA-3 -# - OSPP -# - FMT_SMF_EXT.1 -# - OS-SRG -# - SRG-OS-000062-GPOS-00031 -# - SRG-OS-000471-GPOS-00215 -# - APP-SRG -# - SRG-APP-000141-CTR-000315 -# -################################################################# -{%- set stig_id = 'configure_usbguard_auditbackend' %} -{%- set helperLoc = tpldir ~ '/files' %} -{%- set skipIt = salt.pillar.get('ash-linux:lookup:skip-stigs', []) %} -{%- set cfgFile = '/etc/usbguard/usbguard-daemon.conf' %} - -{{ stig_id }}-description: - test.show_notification: - - text: | - -------------------------------------- - STIG Finding ID: {{ stig_id }}: - Configure USBGuard daemon to log via - Linux Audit service - -------------------------------------- - -{%- if stig_id in skipIt %} -notify_{{ stig_id }}-skipSet: - test.show_notification: - - text: | - Handler for {{ stig_id }} has been selected for skip. -{%- else %} -# Ensure file-protections -{{ cfgFile }} - Exists: - file.managed: - - name: '{{ cfgFile }}' - - mode: '0600' - - user: 'root' - - group: 'root' - - selinux: - serange: 's0' - serole: 'object_r' - setype: 'usbguard_conf_t' - seuser: 'system_u' - -# Make config-change -{{ cfgFile }} - Update content: - file.replace: - - name: '{{ cfgFile }}' - - append_if_not_found: True - - not_found_content: |- - # Set per rule '{{ stig_id }}' - AuditBackend=LinuxAudit - - pattern: '^(|\s*)(AuditBackend)=.*$' - - repl: '# Set per rule "{{ stig_id }}"\n\2=LinuxAudit' - - require: - - file: {{ cfgFile }} - Exists - - unless: - - '[[ $( grep AuditBackend=LinuxAudit {{ cfgFile }} ) ]]' - -{%- endif %} From 903b0770c742fe3cf4862df4b19966542a8653c7 Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Thu, 15 Oct 2026 09:04:05 -0400 Subject: [PATCH 3/6] Remove ref to deleted handler --- ash-linux/el9/RuleById/low/init.sls | 1 - 1 file changed, 1 deletion(-) diff --git a/ash-linux/el9/RuleById/low/init.sls b/ash-linux/el9/RuleById/low/init.sls index cd5d1dfe..ca72b49a 100644 --- a/ash-linux/el9/RuleById/low/init.sls +++ b/ash-linux/el9/RuleById/low/init.sls @@ -1,3 +1,2 @@ include: - - ash-linux.el9.RuleById.low.content_rule_configure_usbguard_auditbackend - ash-linux.el9.RuleById.low.content_rule_no_tmux_in_shells From 8117ed7c62cf4a286de30a5c3c16ef68862a7faa Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Thu, 15 Oct 2026 11:33:46 -0400 Subject: [PATCH 4/6] Fix labels --- ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls index c559dd7c..43f9516a 100644 --- a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls +++ b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls @@ -1,11 +1,11 @@ # Ref Doc: # - STIG - RHEL 9 v2r6 (01 Oct 2025) # - STIG - OEL 9 vXrY (01 Oct 2025) -# - STIG - AlmaLinux 9 vXrY (01 Oct 2025) +# - STIG - AlmaLinux 9 v1r4 (01 Oct 2025) # Finding ID: # - RHEL: V-258037 # - OEL: V-271700 -# - Alma: V-NNNNNN +# - Alma: V-269465 # Rule ID: # - RHEL: SV-258037r1014863_rule # - OEL: SV-271700r1091812_rule From f36cff4c814b8c6b398be8ab7f7288ba0e612e7a Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Fri, 16 Oct 2026 07:17:02 -0400 Subject: [PATCH 5/6] Add missing requirements --- tests/requirements.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/requirements.txt b/tests/requirements.txt index 3b697c70..43e50a8d 100644 --- a/tests/requirements.txt +++ b/tests/requirements.txt @@ -1,5 +1,7 @@ audit +firewalld openssh-server +policycoreutils +policycoreutils-python-utils rsyslog salt-minion -firewalld From 2df3c6b19ed80516146b36c2dcb7d5f2f053bc77 Mon Sep 17 00:00:00 2001 From: Thomas H Jones II Date: Fri, 16 Oct 2026 11:09:26 -0400 Subject: [PATCH 6/6] Remove `contents` parameter *SHOULD* be superfluous when `replace: False` is set --- ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls | 1 - 1 file changed, 1 deletion(-) diff --git a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls index 43f9516a..38aa3609 100644 --- a/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls +++ b/ash-linux/el9/STIGbyID/cat2/RHEL-09-291025.sls @@ -69,7 +69,6 @@ notify_{{ stig_id }}-skipSet: # file's previous existence) Ensure {{ cfgFile }} exists with strict permissions ({{ stig_id }}): file.managed: - - contents: '' - group: 'root' - makedirs: True - mode: '0600'