1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
<def-group>
<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Verify all partitions are encrypted except /boot /boot/efi",
affected_platforms=["multi_platform_ol", "multi_platform_ubuntu", "multi_platform_sle"],
rule_title=rule_title) }}}
<criteria>
<criterion test_ref="test_encrypted_partitions" comment="Check all partitions are encrypted" />
<!-- Needed to collect the obj_crypttab_partitions object -->
<criterion test_ref="test_crypttab_partitions" comment="Check there are encrypted partitions in /etc/crypttab" />
</criteria>
</definition>
<linux:partition_test id="test_encrypted_partitions" version="1" check="all"
check_existence="none_exist" comment="Check there are no partitions not encrypted">
<linux:object object_ref="obj_encrypted_partitions" />
</linux:partition_test>
<ind:textfilecontent54_test id="test_crypttab_partitions" check_existence="at_least_one_exists" version="1"
comment="There are encrypted partitions" check="all" >
<ind:object object_ref="obj_crypttab_partitions" />
</ind:textfilecontent54_test>
<linux:partition_object id="obj_encrypted_partitions" version="1">
<!-- Collect all partition but /boot and /boot/efi -->
<linux:mount_point operation="pattern match">^(?!\/boot(?:\/efi)?$).*</linux:mount_point>
<filter action="exclude">state_encrypted_partitions</filter>
<filter action="include">state_non_temporary_partitions</filter>
<filter action="include">state_non_pseudo_file_systems</filter>
</linux:partition_object>
<linux:partition_state id="state_encrypted_partitions" version="1">
<linux:device operation="equals" var_check="at least one" var_ref="var_crypttab_partitions" />
</linux:partition_state>
<linux:partition_state id="state_non_temporary_partitions" version="1">
<linux:mount_options operation="not equal">bind</linux:mount_options>
</linux:partition_state>
<linux:partition_state id="state_non_pseudo_file_systems" version="1">
<linux:uuid operation="pattern match">.+</linux:uuid>
<linux:fs_type operation="not equal">iso9660</linux:fs_type>
</linux:partition_state>
<ind:textfilecontent54_object id="obj_crypttab_partitions" version="1">
<ind:filepath operation="equals">/etc/crypttab</ind:filepath>
<ind:pattern operation="pattern match">^\s*(\S+)</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
<local_variable id="var_crypttab_partitions" datatype="string" version="1"
comment="devices of partitions in /etc/crypttab">
<concat>
<literal_component>/dev/mapper/</literal_component>
<object_component item_field="subexpression" object_ref="obj_crypttab_partitions" />
</concat>
</local_variable>
</def-group>
|
