Skip to content

Commit 35e7cba

Browse files
redhatrisesredhatrises
authored
Merge pull request ComplianceAsCode#6295 from carlosmmatos/update_jre_content_2
Update jre content with more controls and minor fixes
2 parents 3a96ab3 + d0c5744 commit 35e7cba

File tree

27 files changed

+293
-36
lines changed

27 files changed

+293
-36
lines changed

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_exists/oval/jre.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<def-group>
22
<definition class="compliance" id="java_jre_deployment_config_exists" version="1">
33
<metadata>
4-
<title>The Java Configuration File Exists</title>
4+
<title>The Java deployment.config File Exists</title>
55
<affected family="unix">
66
<product>Java Runtime Environment</product>
77
</affected>

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_mandatory/bash/jre.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# platform = Java Runtime Environment
22
JAVA_CONFIG="/etc/.java/deployment/deployment.config"
33

4-
grep -q "^deployment.system.config.mandatory=false$" ${JAVA_CONFIG} && \
5-
sed -i "s/deployment.system.config.mandatory=.*/deployment.system.config.mandatory=false/g" ${JAVA_CONFIG}
4+
grep -q "^deployment.system.config.mandatory=.*" ${JAVA_CONFIG} && \
5+
sed -i "s/deployment.system.config.mandatory=.*/deployment.system.config.mandatory=true/g" ${JAVA_CONFIG}
66
if ! [ $? -eq 0 ] ; then
7-
echo "deployment.system.config.mandatory=false" >> ${JAVA_CONFIG}
7+
echo "deployment.system.config.mandatory=true" >> ${JAVA_CONFIG}
88
fi

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_mandatory/oval/jre.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
</ind:textfilecontent54_test>
1919
<ind:textfilecontent54_object id="object_java_jre_deployment_system_config_mandatory" version="1">
2020
<ind:filepath>/etc/.java/deployment/deployment.config</ind:filepath>
21-
<ind:pattern operation="pattern match">^deployment.system.config.mandatory=false$</ind:pattern>
21+
<ind:pattern operation="pattern match">^deployment.system.config.mandatory=true$</ind:pattern>
2222
<ind:instance datatype="int">1</ind:instance>
2323
</ind:textfilecontent54_object>
2424
</def-group>

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_properties/bash/jre.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
JAVA_CONFIG="/etc/.java/deployment/deployment.config"
33
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
44

5-
grep -q "^deployment.system.config=file://${JAVA_CONFIG}$" ${JAVA_CONFIG} && \
5+
grep -q "^deployment.system.config=.*" ${JAVA_CONFIG} && \
66
sed -i "s;deployment.system.config=.*;deployment.system.config=file:\/\/${JAVA_PROPERTIES};g" ${JAVA_CONFIG}
77
if ! [ $? -eq 0 ] ; then
88
echo "deployment.system.config=file://${JAVA_PROPERTIES}" >> ${JAVA_CONFIG}

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_properties/oval/jre.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<def-group>
22
<definition class="compliance" id="java_jre_deployment_config_properties" version="1">
33
<metadata>
4-
<title>Configure the deployment.properties File Path</title>
4+
<title>Configure the Path to the deployment.properties File</title>
55
<affected family="unix">
66
<product>Java Runtime Environment</product>
77
</affected>

‎jre/guide/java/java_jre_deployment_config_configured/java_jre_deployment_config_properties/rule.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ ocil: |-
3030
run the following command:
3131
<pre>$ grep 'deployment.system.config=file' /etc/.java/deployment/deployment.config</pre>
3232
If properly configured, the output should return:
33-
<pre>deployment.system.config=/etc/.java/deployment/deployment.properties</pre>
33+
<pre>deployment.system.config=file:///etc/.java/deployment/deployment.properties</pre>

‎jre/guide/java/java_jre_deployment_properties_exists/oval/jre.xml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
<def-group>
22
<definition class="compliance" id="java_jre_deployment_properties_exists" version="1">
33
<metadata>
4-
<title>The Java Properties File Exists</title>
4+
<title>The Java deployment.properties File Exists</title>
55
<affected family="unix">
66
<product>Java Runtime Environment</product>
77
</affected>
88
<description>A properties file must be present to hold all the keys
99
that establish properties within the Java control panel.</description>
1010
</metadata>
1111
<criteria>
12-
<criterion comment="Check deployment.properties file" test_ref="test_java_jre_deployment_properties" />
12+
<criterion comment="Check deployment.properties file exists" test_ref="test_java_jre_deployment_properties" />
1313
</criteria>
1414
</definition>
1515

16-
<unix:file_test check="all" comment="Check deployment.properties file" id="test_java_jre_deployment_properties" version="1">
16+
<unix:file_test check="all" comment="Check deployment.properties file exists" id="test_java_jre_deployment_properties" version="1">
1717
<unix:object object_ref="object_java_jre_deployment_properties" />
1818
</unix:file_test>
1919
<unix:file_object id="object_java_jre_deployment_properties" version="1">

‎jre/guide/java/java_jre_untrusted_sources/bash/jre.sh ‎jre/guide/java/java_jre_disable_untrusted_sources/bash/jre.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# platform = Java Runtime Environment
22
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
33

4-
grep -q "^deployment.security.askgrantdialog.notinca=false$" ${JAVA_PROPERTIES} && \
4+
grep -q "^deployment.security.askgrantdialog.notinca=.*$" ${JAVA_PROPERTIES} && \
55
sed -i "s/deployment.security.askgrantdialog.notinca=.*/deployment.security.askgrantdialog.notinca=false/g" ${JAVA_PROPERTIES}
66
if ! [ $? -eq 0 ] ; then
77
echo "deployment.security.askgrantdialog.notinca=false" >> ${JAVA_PROPERTIES}
8-
fi
8+
fi

‎jre/guide/java/java_jre_untrusted_sources/oval/jre.xml ‎jre/guide/java/java_jre_disable_untrusted_sources/oval/jre.xml

+7-7
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
<def-group>
2-
<definition class="compliance" id="java_jre_untrusted_sources" version="1">
2+
<definition class="compliance" id="java_jre_disable_untrusted_sources" version="1">
33
<metadata>
4-
<title>Disable Java Execution From Untrusted Sources</title>
4+
<title>Disable Execution of Signed Java Applets From Untrusted Sources Feature</title>
55
<affected family="unix">
66
<product>Java Runtime Environment</product>
77
</affected>
8-
<description>The dialog to enable users to grant permissions to execute
8+
<description>The dialog to enable users to grant permissions to execute
99
signed content from an un-trusted authority must be disabled.</description>
1010
</metadata>
1111
<criteria>
12-
<criterion comment="Check deployment.security.askgrantdialog.notinca" test_ref="test_java_jre_untrusted_sources" />
12+
<criterion comment="Check deployment.security.askgrantdialog.notinca" test_ref="test_java_jre_disable_untrusted_sources" />
1313
</criteria>
1414
</definition>
1515

16-
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.notinca" id="test_java_jre_untrusted_sources" version="1">
17-
<ind:object object_ref="object_java_jre_untrusted_sources" />
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.notinca" id="test_java_jre_disable_untrusted_sources" version="1">
17+
<ind:object object_ref="object_java_jre_disable_untrusted_sources" />
1818
</ind:textfilecontent54_test>
19-
<ind:textfilecontent54_object id="object_java_jre_untrusted_sources" version="1">
19+
<ind:textfilecontent54_object id="object_java_jre_disable_untrusted_sources" version="1">
2020
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
2121
<ind:pattern operation="pattern match">^deployment.security.askgrantdialog.notinca=false$</ind:pattern>
2222
<ind:instance datatype="int">1</ind:instance>

‎jre/guide/java/java_jre_untrusted_sources/rule.yml ‎jre/guide/java/java_jre_disable_untrusted_sources/rule.yml

+10-6
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,26 @@
11
documentation_complete: true
22

3-
title: 'Disable Java Execution From Untrusted Sources'
3+
title: 'Disable Execution of Signed Java Applets From Untrusted Sources Setting'
44

55
description: |-
66
To ensure that Java cannot execute from untrusted sources, set
77
<tt>deployment.security.askgrantdialog.notinca</tt> to equal <tt>false</tt>
88
in <tt>/etc/.java/deployment/deployment.properties</tt>.
99
1010
rationale: |-
11-
Permitting execution of signed Java applets from un-trusted sources
12-
may result in acquiring malware, and risks system modification, invasion of
13-
privacy, or denial of service.
11+
Permitting execution of signed Java applets from un-trusted sources may
12+
result in acquiring malware, and risks system modification, invasion of
13+
privacy, or denial of service. Block users from granting permissions to
14+
certificates that are not issued by a CA in the Root/JSSE CA certificate
15+
store.
1416
1517
severity: medium
1618

1719
references:
18-
nist: DCBP-1
19-
stigid: JRE0001-UX
20+
srg: SRG-APP-000112
21+
disa: CCI-001695
22+
stigid: JRE8-UX-000080
23+
nist: SC-18 (3)
2024

2125
ocil_clause: 'it does not exist or is not configured properly'
2226

‎jre/guide/java/java_jre_untrusted_sources_locked/bash/jre.sh ‎jre/guide/java/java_jre_disable_untrusted_sources_locked/bash/jre.sh

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
# platform = Java Runtime Environment
22
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
33

4-
grep -q "^deployment.security.askgrantdialog.notinca.locked$" ${JAVA_PROPERTIES} && \
5-
sed -i "s/deployment.security.askgrantdialog.notinca\..*/deployment.security.askgrantdialog.notinca.locked/g" ${JAVA_PROPERTIES}
4+
grep -q "^deployment.security.askgrantdialog.notinca.locked$" ${JAVA_PROPERTIES}
65
if ! [ $? -eq 0 ] ; then
76
echo "deployment.security.askgrantdialog.notinca.locked" >> ${JAVA_PROPERTIES}
87
fi

‎jre/guide/java/java_jre_untrusted_sources_locked/oval/jre.xml ‎jre/guide/java/java_jre_disable_untrusted_sources_locked/oval/jre.xml

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<def-group>
2-
<definition class="compliance" id="java_jre_untrusted_sources_locked" version="1">
2+
<definition class="compliance" id="java_jre_disable_untrusted_sources_locked" version="1">
33
<metadata>
44
<title>Disable User Access to Untrusted Sources Setting</title>
55
<affected family="unix">
@@ -9,14 +9,14 @@
99
content from an un-trusted authority must be locked.</description>
1010
</metadata>
1111
<criteria>
12-
<criterion comment="Check deployment.security.askgrantdialog.notinca.locked" test_ref="test_java_jre_untrusted_sources_locked" />
12+
<criterion comment="Check deployment.security.askgrantdialog.notinca.locked" test_ref="test_java_jre_disable_untrusted_sources_locked" />
1313
</criteria>
1414
</definition>
1515

16-
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.notinca.lock" id="test_java_jre_untrusted_sources_locked" version="1">
17-
<ind:object object_ref="object_java_jre_untrusted_sources_locked" />
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.notinca.lock" id="test_java_jre_disable_untrusted_sources_locked" version="1">
17+
<ind:object object_ref="object_java_jre_disable_untrusted_sources_locked" />
1818
</ind:textfilecontent54_test>
19-
<ind:textfilecontent54_object id="object_java_jre_untrusted_sources_locked" version="1">
19+
<ind:textfilecontent54_object id="object_java_jre_disable_untrusted_sources_locked" version="1">
2020
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
2121
<ind:pattern operation="pattern match">^deployment.security.askgrantdialog.notinca.locked$</ind:pattern>
2222
<ind:instance datatype="int">1</ind:instance>

‎jre/guide/java/java_jre_untrusted_sources_locked/rule.yml ‎jre/guide/java/java_jre_disable_untrusted_sources_locked/rule.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
documentation_complete: true
22

3-
title: 'Disable User Access to Untrusted Sources Settings'
3+
title: 'Disable User Access to Disabling Untrusted Sources Setting'
44

55
description: |-
66
To ensure that users cannot change the untrusted sources settings,
@@ -17,8 +17,10 @@ rationale: |-
1717
severity: medium
1818

1919
references:
20-
nist: DCBP-1
21-
stigid: JRE0010-UX
20+
srg: SRG-APP-000112
21+
disa: CCI-001695
22+
stigid: JRE8-UX-000080
23+
nist: SC-18 (3)
2224

2325
ocil_clause: 'it does not exist or is not configured properly'
2426

‎jre/guide/java/java_jre_enable_jws/bash/jre.sh

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# platform = Java Runtime Environment
2+
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
3+
4+
grep -q "^deployment.webjava.enabled=.*$" ${JAVA_PROPERTIES} && \
5+
sed -i "s/deployment.webjava.enabled=.*/deployment.webjava.enabled=true/g" ${JAVA_PROPERTIES}
6+
if ! [ $? -eq 0 ] ; then
7+
echo "deployment.webjava.enabled=true" >> ${JAVA_PROPERTIES}
8+
fi

‎jre/guide/java/java_jre_enable_jws/oval/jre.xml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<def-group>
2+
<definition class="compliance" id="java_jre_enable_jws" version="1">
3+
<metadata>
4+
<title>Enable Java Web Start Applications to Run</title>
5+
<affected family="unix">
6+
<product>Java Runtime Environment</product>
7+
</affected>
8+
<description>Configure setting to ensure Java allows
9+
Java Web Start (JWS) applications to run.</description>
10+
</metadata>
11+
<criteria>
12+
<criterion comment="Check deployment.webjava.enabled" test_ref="test_java_jre_enable_jws" />
13+
</criteria>
14+
</definition>
15+
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.webjava.enabled" id="test_java_jre_enable_jws" version="1">
17+
<ind:object object_ref="object_java_jre_enable_jws" />
18+
</ind:textfilecontent54_test>
19+
<ind:textfilecontent54_object id="object_java_jre_enable_jws" version="1">
20+
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
21+
<ind:pattern operation="pattern match">^deployment.webjava.enabled=true$</ind:pattern>
22+
<ind:instance datatype="int">1</ind:instance>
23+
</ind:textfilecontent54_object>
24+
</def-group>

‎jre/guide/java/java_jre_enable_jws_locked/bash/jre.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# platform = Java Runtime Environment
2+
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
3+
4+
grep -q "^deployment.webjava.enabled.locked$" ${JAVA_PROPERTIES}
5+
if ! [ $? -eq 0 ] ; then
6+
echo "deployment.webjava.enabled.locked" >> ${JAVA_PROPERTIES}
7+
fi

‎jre/guide/java/java_jre_enable_jws_locked/oval/jre.xml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<def-group>
2+
<definition class="compliance" id="java_jre_enable_jws_locked" version="1">
3+
<metadata>
4+
<title>Disable User Access to Java Web Start Application Setting</title>
5+
<affected family="unix">
6+
<product>Java Runtime Environment</product>
7+
</affected>
8+
<description>The setting that ensures Java allows Java
9+
Web Start applications to run must be locked.</description>
10+
</metadata>
11+
<criteria>
12+
<criterion comment="Check deployment.webjava.enabled.locked" test_ref="test_java_jre_enable_jws_locked" />
13+
</criteria>
14+
</definition>
15+
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.webjava.enabled.locked" id="test_java_jre_enable_jws_locked" version="1">
17+
<ind:object object_ref="object_java_jre_enable_jws_locked" />
18+
</ind:textfilecontent54_test>
19+
<ind:textfilecontent54_object id="object_java_jre_enable_jws_locked" version="1">
20+
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
21+
<ind:pattern operation="pattern match">^deployment.webjava.enabled.locked$</ind:pattern>
22+
<ind:instance datatype="int">1</ind:instance>
23+
</ind:textfilecontent54_object>
24+
</def-group>

‎jre/guide/java/java_jre_lock_untrusted_sources/bash/jre.sh

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# platform = Java Runtime Environment
2+
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
3+
4+
grep -q "^deployment.security.askgrantdialog.show=.*$" ${JAVA_PROPERTIES} && \
5+
sed -i "s/deployment.security.askgrantdialog.show=.*/deployment.security.askgrantdialog.show=false/g" ${JAVA_PROPERTIES}
6+
if ! [ $? -eq 0 ] ; then
7+
echo "deployment.security.askgrantdialog.show=false" >> ${JAVA_PROPERTIES}
8+
fi

‎jre/guide/java/java_jre_lock_untrusted_sources/oval/jre.xml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<def-group>
2+
<definition class="compliance" id="java_jre_lock_untrusted_sources" version="1">
3+
<metadata>
4+
<title>Lock Execution of Signed Java Applets From Untrusted Sources Setting</title>
5+
<affected family="unix">
6+
<product>Java Runtime Environment</product>
7+
</affected>
8+
<description>The dialog to enable users to grant permissions to execute
9+
signed content from an un-trusted authority must be locked.</description>
10+
</metadata>
11+
<criteria>
12+
<criterion comment="Check deployment.security.askgrantdialog.show" test_ref="test_java_jre_lock_untrusted_sources" />
13+
</criteria>
14+
</definition>
15+
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.show" id="test_java_jre_lock_untrusted_sources" version="1">
17+
<ind:object object_ref="object_java_jre_lock_untrusted_sources" />
18+
</ind:textfilecontent54_test>
19+
<ind:textfilecontent54_object id="object_java_jre_lock_untrusted_sources" version="1">
20+
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
21+
<ind:pattern operation="pattern match">^deployment.security.askgrantdialog.show=false$</ind:pattern>
22+
<ind:instance datatype="int">1</ind:instance>
23+
</ind:textfilecontent54_object>
24+
</def-group>

‎jre/guide/java/java_jre_lock_untrusted_sources/rule.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
documentation_complete: true
2+
3+
title: 'Lock Execution of Signed Java Applets From Untrusted Sources Setting'
4+
5+
description: |-
6+
To ensure that Java cannot execute from untrusted sources, set
7+
<tt>deployment.security.askgrantdialog.show</tt> to equal <tt>false</tt>
8+
in <tt>/etc/.java/deployment/deployment.properties</tt>.
9+
10+
rationale: |-
11+
Permitting execution of signed Java applets from un-trusted sources may
12+
result in acquiring malware, and risks system modification, invasion of
13+
privacy, or denial of service. Block users from granting permissions to
14+
applets and JWS applications.
15+
16+
severity: medium
17+
18+
references:
19+
srg: SRG-APP-000112
20+
disa: CCI-001695
21+
stigid: JRE8-UX-000090
22+
nist: SC-18 (3)
23+
24+
ocil_clause: 'it does not exist or is not configured properly'
25+
26+
ocil: |-
27+
To verify that Java cannot execute from untrusted sources,
28+
run the following command:
29+
<pre>$ grep 'askgrantdialog.show=false' /etc/.java/deployment/deployment.properties</pre>
30+
If properly configured, the output should return:
31+
<pre>deployment.security.askgrantdialog.show=false</pre>

‎jre/guide/java/java_jre_lock_untrusted_sources_locked/bash/jre.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# platform = Java Runtime Environment
2+
JAVA_PROPERTIES="/etc/.java/deployment/deployment.properties"
3+
4+
grep -q "^deployment.security.askgrantdialog.show.locked$" ${JAVA_PROPERTIES}
5+
if ! [ $? -eq 0 ] ; then
6+
echo "deployment.security.askgrantdialog.show.locked" >> ${JAVA_PROPERTIES}
7+
fi

‎jre/guide/java/java_jre_lock_untrusted_sources_locked/oval/jre.xml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<def-group>
2+
<definition class="compliance" id="java_jre_lock_untrusted_sources_locked" version="1">
3+
<metadata>
4+
<title>Disable User Access to Locking Untrusted Sources Setting</title>
5+
<affected family="unix">
6+
<product>Java Runtime Environment</product>
7+
</affected>
8+
<description>The dialog enabling users to grant permissions to execute signed
9+
content from an un-trusted authority must be locked.</description>
10+
</metadata>
11+
<criteria>
12+
<criterion comment="Check deployment.security.askgrantdialog.show.locked" test_ref="test_java_jre_lock_untrusted_sources_locked" />
13+
</criteria>
14+
</definition>
15+
16+
<ind:textfilecontent54_test check="all" comment="Check deployment.security.askgrantdialog.show.lock" id="test_java_jre_lock_untrusted_sources_locked" version="1">
17+
<ind:object object_ref="object_java_jre_lock_untrusted_sources_locked" />
18+
</ind:textfilecontent54_test>
19+
<ind:textfilecontent54_object id="object_java_jre_lock_untrusted_sources_locked" version="1">
20+
<ind:filepath>/etc/.java/deployment/deployment.properties</ind:filepath>
21+
<ind:pattern operation="pattern match">^deployment.security.askgrantdialog.show.locked$</ind:pattern>
22+
<ind:instance datatype="int">1</ind:instance>
23+
</ind:textfilecontent54_object>
24+
</def-group>

0 commit comments

Comments
 (0)