diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml index 20efae3dcb42..a4c826eee4d4 100644 --- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml +++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml @@ -2,8 +2,14 @@ {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}} - - + + + + + + + + - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main 1 - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main 1 + + + + + + + + + + + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$ + Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)* + 1 + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml index 8390203d356c..9cdf67d43405 100644 --- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml +++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml @@ -2,8 +2,14 @@ {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}} - - + + + + + + + + - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bookworm[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[/]?[\s]+bookworm[\s]+main 1 - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bookworm-security[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://security\.debian\.org/debian-security[/]?[\s]+bookworm-security[\s]+main 1 + + + + + + + + + + + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$ + Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)* + 1 + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml index 35a236f537c0..619fb82e2a8b 100644 --- a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml +++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml @@ -1,9 +1,15 @@ {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}} - - - + + + + + + + + + - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://[a-z\.]+\.debian\.org/debian[\s]+[a-z]+[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[\s]+[a-z]+[\s]+main 1 - ^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$ - ^deb[\s]+http://security\.debian\.org/debian-security[\s]+[a-z]+/updates[\s]+main + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$ + ^deb[\s]+https?://security\.debian\.org/debian-security[\s]+[a-z]+/updates[\s]+main 1 + + + + + + + + + + + ^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$ + Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)* + 1 + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + + + ^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$) + diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh new file mode 100644 index 000000000000..0cb8b2446c53 --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# platform = Debian 12 +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* + +cat > /etc/apt/sources.list.d/debian.sources << 'EOF' +Types: deb +URIs: http://deb.debian.org/debian +Suites: bookworm bookworm-updates +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg + +Types: deb +URIs: http://deb.debian.org/debian-security +Suites: bookworm-security +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +EOF diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh new file mode 100644 index 000000000000..8b5e6bec5f75 --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# platform = Debian 12 +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* + +cat > /etc/apt/sources.list.d/debian.sources << 'EOF' +Types: deb +URIs: https://deb.debian.org/debian +Suites: bookworm bookworm-updates +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg + +Types: deb +URIs: https://deb.debian.org/debian-security +Suites: bookworm-security +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +EOF diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh new file mode 100644 index 000000000000..10930deb51ca --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# platform = Debian 12 +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* + +cat > /etc/apt/sources.list.d/debian.sources << 'EOF' +Types: deb +URIs: http://deb.debian.org/debian +Suites: bookworm +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +EOF + +cat > /etc/apt/sources.list.d/debian-security.sources << 'EOF' +Types: deb +URIs: http://deb.debian.org/debian-security +Suites: bookworm-security +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +EOF diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh new file mode 100644 index 000000000000..b66b8a3b7fa2 --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# platform = Debian 12 +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* + +cat > /etc/apt/sources.list.d/debian.list << 'EOF' +deb http://deb.debian.org/debian bookworm main +deb http://security.debian.org/debian-security bookworm-security main +EOF diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh new file mode 100644 index 000000000000..cbf1c28a28db --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# platform = multi_platform_debian +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* + +cat > /etc/apt/sources.list.d/example.sources << 'EOF' +Types: deb +URIs: https://packages.example.com/debian +Suites: stable +Components: main +Signed-By: /usr/share/keyrings/example.gpg +EOF diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh new file mode 100644 index 000000000000..a882dd4a2db2 --- /dev/null +++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# platform = multi_platform_debian +# remediation = none + +mkdir -p /etc/apt/sources.list.d +rm -f /etc/apt/sources.list /etc/apt/sources.list.d/* +touch /etc/apt/sources.list