diff --git a/CMakeLists.txt b/CMakeLists.txt index aca3f1c8967..9d40a2e3ac5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -122,6 +122,7 @@ option(SSG_PRODUCT_UBUNTU2404 "If enabled, the Ubuntu 24.04 SCAP content will be option(SSG_PRODUCT_AL2023 "If enabled, the AL2023 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) # Products derivatives option(SSG_CENTOS_DERIVATIVES_ENABLED "If enabled, CentOS derivative content will be built from the RHEL content" TRUE) +option(SSG_ALMALINUX_DERIVATIVES_ENABLED "If enabled, AlmaLinux derivative content will be built from the RHEL content" TRUE) if("$ENV{PYTHONPATH}" STREQUAL "") set(ENV{PYTHONPATH} "${PROJECT_SOURCE_DIR}") diff --git a/build-scripts/enable_derivatives.py b/build-scripts/enable_derivatives.py index 3d83aae9ea2..ac368e117d6 100755 --- a/build-scripts/enable_derivatives.py +++ b/build-scripts/enable_derivatives.py @@ -25,8 +25,10 @@ oval_ns = ssg.constants.oval_namespace CENTOS_NOTICE_ELEMENT = ssg.xml.ElementTree.fromstring(ssg.constants.CENTOS_NOTICE) +ALMALINUX_NOTICE_ELEMENT = ssg.xml.ElementTree.fromstring(ssg.constants.ALMALINUX_NOTICE) CENTOS_WARNING = 'centos_warning' +ALMALINUX_WARNING = 'almalinux_warning' def parse_args(): @@ -34,6 +36,8 @@ def parse_args(): parser = OptionParser(usage=usage) parser.add_option("--enable-centos", dest="centos", default=False, action="store_true", help="Enable CentOS") + parser.add_option("--enable-almalinux", dest="almalinux", default=False, + action="store_true", help="Enable AlmaLinux") parser.add_option("-i", "--input", dest="input_content", default=False, action="store", help="INPUT can be XCCDF or Source data stream") @@ -73,6 +77,12 @@ def main(): warning = CENTOS_WARNING derivative = "CentOS" + if options.almalinux: + mapping = ssg.constants.RHEL_ALMALINUX_CPE_MAPPING + notice = ALMALINUX_NOTICE_ELEMENT + warning = ALMALINUX_WARNING + derivative = "AlmaLinux" + tree = ssg.xml.open_xml(options.input_content) root = tree.getroot() @@ -89,9 +99,10 @@ def main(): raise RuntimeError("No Benchmark found!") for namespace, benchmark in benchmarks: - if args[1] not in ("cs9", "cs10") and not args[1].startswith("centos"): + if args[1] not in ("cs9", "cs10", "almalinux9") and not args[1].startswith("centos"): # In all CentOS and CentOS Streams, profiles are kept because they are systems # intended to test content that will get into RHEL + # In AlmaLinux, profiles are kept because this is a clone of RHEL. ssg.build_derivatives.profile_handling(benchmark, namespace) if not ssg.build_derivatives.add_cpes(benchmark, namespace, mapping): import pprint diff --git a/build_product b/build_product index d7d7092bae9..aef893ad16a 100755 --- a/build_product +++ b/build_product @@ -335,6 +335,9 @@ set_no_derivatives_options() { if grep -q 'rhel' <<< "${_arg_product[*]}"; then CMAKE_OPTIONS+=("-DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF") fi + if grep -q 'rhel' <<< "${_arg_product[*]}"; then + CMAKE_OPTIONS+=("-DSSG_ALMALINUX_DERIVATIVES_ENABLED:BOOL=OFF") + fi } set_sce_options() { diff --git a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml index 13970997c3e..b37094fea66 100644 --- a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml +++ b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml @@ -22,6 +22,13 @@ test_ref="test_redhat_package_gpgkey-{{{ centos_pkg_version }}}-{{{ centos_pkg_release }}}_installed" /> {{%- endif %}} + {{%- if almalinux_major_version %}} + + + + + {{%- endif %}} @@ -71,5 +78,19 @@ {{%- endif %}} + {{%- if almalinux_major_version %}} + + + + + + + {{{ almalinux_pkg_release }}} + {{{ almalinux_pkg_version }}} + + {{%- endif %}} + {{% endif %}} diff --git a/products/rhel9/CMakeLists.txt b/products/rhel9/CMakeLists.txt index c2153dadd57..b2f572a625f 100644 --- a/products/rhel9/CMakeLists.txt +++ b/products/rhel9/CMakeLists.txt @@ -24,3 +24,7 @@ ssg_build_html_stig_tables_per_profile(${PRODUCT} "stig_gui") if(SSG_CENTOS_DERIVATIVES_ENABLED) ssg_build_derivative_product(${PRODUCT} "centos" "cs9") endif() + +if(SSG_ALMALINUX_DERIVATIVES_ENABLED) + ssg_build_derivative_product(${PRODUCT} "almalinux" "almalinux9") +endif() diff --git a/products/rhel9/product.yml b/products/rhel9/product.yml index 30cbdeb0c22..69807fac651 100644 --- a/products/rhel9/product.yml +++ b/products/rhel9/product.yml @@ -58,4 +58,8 @@ centos_pkg_release: "5ccc5b19" centos_pkg_version: "8483c65d" centos_major_version: "9" +almalinux_pkg_release: "61e69f29" +almalinux_pkg_version: "b86b3716" +almalinux_major_version: "9" + journald_conf_dir_path: /etc/systemd/journald.conf.d diff --git a/shared/applicability/almalinux9.yml b/shared/applicability/almalinux9.yml new file mode 100644 index 00000000000..0f548ef5e7a --- /dev/null +++ b/shared/applicability/almalinux9.yml @@ -0,0 +1,3 @@ +name: cpe:/o:almalinux:almalinux:9 +title: AlmaLinux 9 +check_id: installed_OS_is_almalinux9 diff --git a/shared/checks/oval/installed_OS_is_almalinux9.xml b/shared/checks/oval/installed_OS_is_almalinux9.xml new file mode 100644 index 00000000000..70dafe02685 --- /dev/null +++ b/shared/checks/oval/installed_OS_is_almalinux9.xml @@ -0,0 +1,34 @@ + + + + AlmaLinux 9 + + multi_platform_all + + + The operating system installed on the system is + AlmaLinux 9 + + + + + + + + + + + + + + + ^9.*$ + + + almalinux-release + + diff --git a/ssg/constants.py b/ssg/constants.py index f64c168495a..08c94b4986a 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -320,6 +320,10 @@ "cpe:/o:redhat:enterprise_linux:10": "cpe:/o:centos:centos:10", } +RHEL_ALMALINUX_CPE_MAPPING = { + "cpe:/o:redhat:enterprise_linux:9": "cpe:/o:almalinux:almalinux:9", +} + CENTOS_NOTICE = \ "
\n" \ "

This benchmark is a direct port of a SCAP Security Guide " \ @@ -355,6 +359,41 @@ ".

" \ "
" +ALMALINUX_NOTICE = \ + "
\n" \ + "

This benchmark is a direct port of a SCAP Security Guide " \ + "benchmark developed for Red Hat Enterprise Linux. It has been " \ + "modified through an automated process to remove specific dependencies " \ + "on Red Hat Enterprise Linux and to function with AlmaLinux. " \ + "The result is a generally useful SCAP Security Guide benchmark " \ + "with the following caveats:

\n" \ + "\n" \ + "\n" \ + "

Members of the AlmaLinux community are invited to participate in " \ + "OpenSCAP and " \ + "" \ + "SCAP Security Guide development. Bug reports and patches " \ + "can be sent to GitHub: " \ + "" \ + "https://github.com/ComplianceAsCode/content. " \ + "The mailing list is at " \ + "" \ + "https://fedorahosted.org/mailman/listinfo/scap-security-guide" \ + ".

" \ + "
" + XCCDF_REFINABLE_PROPERTIES = ["weight", "severity", "role", "selector"] OVAL_TO_XCCDF_DATATYPE_CONSTRAINTS = { @@ -483,6 +522,7 @@ class OvalNamespaces: "centos8": "rhel8", "cs9": "rhel9", "cs10": "rhel10", + "almalinux9": "rhel9", } BENCHMARKS = { diff --git a/tests/data/product_stability/rhel9.yml b/tests/data/product_stability/rhel9.yml index 839bc42a030..20601ee4a61 100644 --- a/tests/data/product_stability/rhel9.yml +++ b/tests/data/product_stability/rhel9.yml @@ -13,6 +13,9 @@ benchmark_root: ../../linux_os/guide centos_major_version: '9' centos_pkg_release: 5ccc5b19 centos_pkg_version: 8483c65d +almalinux_major_version: "9" +almalinux_pkg_release: "61e69f29" +almalinux_pkg_version: "b86b3716" chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ components_root: ../../components