Skip to content

Make sure the sequoia package is installed across CIS profiles #14632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggbecker merged 1 commit into from
Apr 13, 2026
Merged

Make sure the sequoia package is installed across CIS profiles #14632

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions products/rhel10/controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,9 +369,10 @@
status: partial
rules:
- ensure_redhat_gpgkey_installed
- package_sequoia-sq_installed
notes: >
In CIS Benchmark, the requirement is manual, because of GPG keys for 3rd party repositories.

Check failure on line 374 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

374:100 [line-length] line too long (100 > 99 characters)
But, add the rule ensure_redhat_gpgkey_installed to the profile because the requirement 1.2.1.2

Check failure on line 375 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

375:100 [line-length] line too long (103 > 99 characters)
adds ensure_gpgcheck_never_disabled which requires GPG key checking. If the Red Hat
GPG key wouldn't be installed, people won't be able to install any RPM package using dnf.

Expand Down Expand Up @@ -974,10 +975,10 @@
notes: |-
The requirement recommends to remove the whole 'Server with GUI' dnf package group.
Unfortunately, OVAL can't check for dnf package groups.
Remediations that would remove and install large package groups are problematic and too destructive.

Check failure on line 978 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

978:100 [line-length] line too long (110 > 99 characters)
We decided to not have a rule for the 'Server with GUI' removal and instead just cover the most singificant package - gdm.

Check failure on line 979 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

979:100 [line-length] line too long (132 > 99 characters)
For more context, see https://github.com/ComplianceAsCode/content/pull/14204 where we failed to create a rule for the package group removal.

Check failure on line 980 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

980:100 [line-length] line too long (150 > 99 characters)
We shall recomend users who want to use the GUI to use the CIS Workstation L2 profile instead.

Check failure on line 981 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

981:100 [line-length] line too long (104 > 99 characters)
rules:
- package_gdm_removed

Expand Down Expand Up @@ -1658,7 +1659,7 @@
- l1_workstation
status: automated
notes: |-
The requirement gives an example of 45 seconds, but is flexible about the values. It is only

Check failure on line 1662 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

1662:100 [line-length] line too long (102 > 99 characters)
necessary to ensure there is a timeout configured in alignment to the site policy.
rules:
- sshd_set_idle_timeout
Expand Down Expand Up @@ -1734,7 +1735,7 @@
status: automated
notes: |-
The CIS benchmark is not opinionated about which loglevel is selected here. Here, this
profile uses VERBOSE by default, as it allows for the capture of login and logout activity

Check failure on line 1738 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

1738:100 [line-length] line too long (100 > 99 characters)
as well as key fingerprints.
rules:
- sshd_set_loglevel_verbose
Expand Down Expand Up @@ -1878,9 +1879,9 @@
- l1_workstation
status: automated
notes: |-
Members of "wheel" or GID 0 groups are checked by default if the group option is not set for

Check failure on line 1882 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

1882:100 [line-length] line too long (102 > 99 characters)
pam_wheel.so module. The recommendation states the group should be empty to reinforce the
use of "sudo" for privileged access. Therefore, members of these groups should be manually

Check failure on line 1884 in products/rhel10/controls/cis_rhel10.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

1884:100 [line-length] line too long (100 > 99 characters)
checked or a different group should be informed.
rules:
- var_pam_wheel_group_for_su=cis
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,7 @@ package_openldap-clients_removed
package_pam_pwquality_installed
package_rsync_removed
package_samba_removed
package_sequoia-sq_installed
package_setroubleshoot_removed
package_squid_removed
package_sudo_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ package_nginx_removed
package_pam_pwquality_installed
package_rsync_removed
package_samba_removed
package_sequoia-sq_installed
package_setroubleshoot_removed
package_squid_removed
package_sudo_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,7 @@ package_nginx_removed
package_pam_pwquality_installed
package_rsync_removed
package_samba_removed
package_sequoia-sq_installed
package_squid_removed
package_sudo_installed
package_systemd-journal-remote_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,7 @@ package_openldap-clients_removed
package_pam_pwquality_installed
package_rsync_removed
package_samba_removed
package_sequoia-sq_installed
package_squid_removed
package_sudo_installed
package_systemd-journal-remote_installed
Expand Down
Loading