+
+ object_static_usr_local_lib_sysctld_sysctl_kernel_core_pattern_empty_string
object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string
+
/etc/sysctl.conf
^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$
@@ -205,6 +118,23 @@
^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$
1
+
+
+ /usr/local/lib/sysctl.d
+ ^.*\.conf$
+ ^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$
+ 1
+
+
+
+
+ /usr/lib/sysctl.d
+ ^.*\.conf$
+ ^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$
+ 1
+
+
+
diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml
index 4f228f0c3a4a..ac8e9953350d 100644
--- a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml
+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml
@@ -11,9 +11,7 @@ title: 'Disable XDMCP in GDM'
{{% endif %}}
description: |-
- XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g.
- {{{ weblink("https://help.gnome.org/admin/gdm/stable/security.html.en_GB#xdmcpsecurity", "XDMCP Gnome docs") }}}.
-
+ XDMCP is an unencrypted protocol, and therefore, presents a security risk.
To disable XDMCP support in Gnome, set Enable to false under the [xdmcp] configuration section in {{{ gdm_conf_path }}}. For example:
[xdmcp]
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_custom_crypto_policy_cis/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_custom_crypto_policy_cis/rule.yml
index b80f01777048..72387b459f09 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_custom_crypto_policy_cis/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_custom_crypto_policy_cis/rule.yml
@@ -52,7 +52,8 @@ title: Implement Custom Crypto Policy Modules for CIS Benchmark
{
"module_name": "NO-RPMSHA1",
"key": "hash@rpm",
- "value": "-SHA1"
+ "value": "-SHA1",
+ "scope": "rpm-sequoia"
},
] %}}
{{% elif product == "rhel10" or product == "fedora" %}}
diff --git a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
index 8080f0c6ced3..514841546662 100644
--- a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
+++ b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
@@ -40,19 +40,31 @@
{{% endif %}}
-- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints"
+{{% if "rhel" in families and major_version_ordinal >= 10 %}}
+- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints (without PQC)"
+ ansible.builtin.set_fact:
+ gpg_valid_fingerprints:
+ - "{{{ release_key_fingerprint }}}"
+ - "{{{ auxiliary_key_fingerprint }}}"
+ when: ansible_distribution_version is version('10.1', '<')
+
+- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints (with PQC)"
ansible.builtin.set_fact:
gpg_valid_fingerprints:
- "{{{ release_key_fingerprint }}}"
- "{{{ auxiliary_key_fingerprint }}}"
-{{% if "rhel" in families and major_version_ordinal >= 10 %}}
- "{{{ pqc_key_fingerprint }}}"
+ when: ansible_distribution_version is version('10.1', '>=')
+{{% else %}}
+- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints"
+ ansible.builtin.set_fact:
+ gpg_valid_fingerprints:
+ - "{{{ release_key_fingerprint }}}"
+ - "{{{ auxiliary_key_fingerprint }}}"
{{% endif %}}
- name: "{{{ rule_title }}}: Import RedHat GPG key"
- ansible.builtin.rpm_key:
- state: present
- key: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+ ansible.builtin.command: rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
when:
- gpg_key_directory_permission.stat.mode <= '0755'
- (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0
diff --git a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh
index 53931cd4009d..5fdb792b79cd 100644
--- a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh
+++ b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh
@@ -25,13 +25,16 @@ then
# No CRC error, safe to proceed
if [ "${GPG_RESULT}" -eq "0" ]
then
+ # If $REDHAT_RELEASE_KEY file doesn't contain any keys with unknown fingerprint, import it
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
- echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}|${REDHAT_PQC_FINGERPRINT}" || {
+ if {{{ bash_os_linux_conditional("rhel", expected_ver="10.1", op=">=") | trim }}}
+ then
+ echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}|${REDHAT_PQC_FINGERPRINT}" || rpm --import "${REDHAT_RELEASE_KEY}"
+ else
+ echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}" || rpm --import "${REDHAT_RELEASE_KEY}"
+ fi
{{% else %}}
- echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}" || {
+ echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}" || rpm --import "${REDHAT_RELEASE_KEY}"
{{% endif %}}
- # If $REDHAT_RELEASE_KEY file doesn't contain any keys with unknown fingerprint, import it
- rpm --import "${REDHAT_RELEASE_KEY}"
- }
fi
fi
diff --git a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml
index 6871feba83b3..52461f678900 100644
--- a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml
+++ b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml
@@ -13,8 +13,13 @@
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
-
+
+
+
+
+
+
+
{{% endif %}}
{{%- if centos_major_version %}}
@@ -88,5 +93,22 @@
{{%- endif %}}
+{{% if "rhel" in families and major_version_ordinal >= 10 %}}
+
+
+
+
+
+
+ /etc/os-release
+ ^VERSION_ID=["']?([\w.]+)["']?$
+ 1
+
+
+
+ 10.1
+
+{{% endif %}}
+