diff --git a/CMakeLists.txt b/CMakeLists.txt
index 774519b55e5..1bcf28ed86f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -117,6 +117,7 @@ option(SSG_PRODUCT_RHEL10 "If enabled, the RHEL10 SCAP content will be built" ${
option(SSG_PRODUCT_RHV4 "If enabled, the RHV4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_SLE12 "If enabled, the SLE12 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_SLE15 "If enabled, the SLE15 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_SLE16 "If enabled, the SLE16 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_SLMICRO5 "If enabled, the SLE Micro 5 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_SLMICRO6 "If enabled, the SLE Micro 6 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_TENCENTOS4 "If enabled, the TencentOS Server 4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -358,6 +359,7 @@ message(STATUS "RHEL 10: ${SSG_PRODUCT_RHEL10}")
message(STATUS "RHV 4: ${SSG_PRODUCT_RHV4}")
message(STATUS "SUSE 12: ${SSG_PRODUCT_SLE12}")
message(STATUS "SUSE 15: ${SSG_PRODUCT_SLE15}")
+message(STATUS "SUSE 16: ${SSG_PRODUCT_SLE16}")
message(STATUS "SLE Micro 5: ${SSG_PRODUCT_SLMICRO5}")
message(STATUS "SLE Micro 6: ${SSG_PRODUCT_SLMICRO6}")
message(STATUS "TencentOS Server 4: ${SSG_PRODUCT_TENCENTOS4}")
@@ -478,6 +480,9 @@ endif()
if(SSG_PRODUCT_SLE15)
add_subdirectory("products/sle15" "sle15")
endif()
+if(SSG_PRODUCT_SLE16)
+ add_subdirectory("products/sle16" "sle16")
+endif()
if(SSG_PRODUCT_SLMICRO5)
add_subdirectory("products/slmicro5" "slmicro5")
endif()
diff --git a/build_product b/build_product
index 567375462b9..bb288933456 100755
--- a/build_product
+++ b/build_product
@@ -383,6 +383,7 @@ all_cmake_products=(
RHV4
SLE12
SLE15
+ SLE16
SLMICRO5
SLMICRO6
TENCENTOS4
diff --git a/controls/base_sle16.yml b/controls/base_sle16.yml
new file mode 100644
index 00000000000..88b54bcff2a
--- /dev/null
+++ b/controls/base_sle16.yml
@@ -0,0 +1,48 @@
+---
+policy: Basis System Security Profile for SUSE Linux Enterprise 16
+title: DRAFT Basis System Security Profile SUSE Linux Enterprise 16
+id: base_sle16
+version: '1.0'
+source: not_publicly_available
+reference_type: suse-base-sle16
+
+levels:
+ - id: pcidss4
+ - id: anssi_minimal
+
+product: sle16
+
+controls:
+ - id: SLES-16-16016015
+ levels:
+ - pcidss4
+ - anssi_minimal
+ title: SLES 16 must be a vendor-supported release.
+ rules:
+ - installed_OS_is_vendor_supported
+ status: automated
+
+ - id: SLES-16-16016020
+ title: Enable NX/XD Support
+ levels:
+ - pcidss4
+ automated: partially
+ rules:
+ - bios_enable_execution_restrictions
+ - install_PAE_kernel_on_x86-32
+
+ - id: SLES-16-16016025
+ title: Ensure All Files Are Owned by a Group
+ levels:
+ - anssi_minimal
+ rules:
+ - file_permissions_ungroupowned
+ status: automated
+
+ - id: SLES-16-16016030
+ title: Ensure All Files Are Owned by a User
+ levels:
+ - anssi_minimal
+ rules:
+ - no_files_unowned_by_user
+ status: automated
diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
index 98cd1fdfbb0..a028877c12a 100644
--- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/oval/shared.xml
@@ -13,6 +13,7 @@
+
diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml
index 4858543fdf9..1cd04cfd2f6 100644
--- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml
+++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml
@@ -8,7 +8,7 @@ description: |-
{{% if 'ol' in product %}}
Oracle Linux is supported by Oracle Corporation. As the Oracle
Linux vendor, Oracle Corporation is responsible for providing security patches.
-{{% elif product in ["sle12", "sle15", "slmicro5", "slmicro6"] %}}
+{{% elif product in ["sle12", "sle15", "sle16", "slmicro5", "slmicro6"] %}}
SUSE Linux Enterprise is supported by SUSE. As the SUSE Linux Enterprise
vendor, SUSE is responsible for providing security patches.
{{% elif 'almalinux' in product %}}
@@ -39,7 +39,7 @@ identifiers:
cce@sle12: CCE-83001-8
cce@sle15: CCE-83260-0
cce@slmicro5: CCE-93601-3
- cce@slmicro6: CCE-95035-2
+ cce@slmicro6: CCE-95035-2
references:
cis-csc: 18,20,4
@@ -63,7 +63,7 @@ ocil: |-
$ grep -i "red hat" /etc/redhat-release
{{% elif 'ol' in product %}}
$ grep -i "oracle" /etc/oracle-release
-{{% elif product in ["sle12", "sle15", "slmicro5", "slmicro6"] %}}
+{{% elif product in ["sle12", "sle15", "sle16", "slmicro5", "slmicro6"] %}}
$ grep -i "suse" /etc/os-release
{{% elif 'ubuntu' in product %}}
$ grep DISTRIB_DESCRIPTION /etc/lsb-release
diff --git a/products/sle16/CMakeLists.txt b/products/sle16/CMakeLists.txt
new file mode 100644
index 00000000000..c105c69cd8a
--- /dev/null
+++ b/products/sle16/CMakeLists.txt
@@ -0,0 +1,10 @@
+# Sometimes our users will try to do: "cd sle16; cmake ." That needs to error in a nice way.
+if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
+ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
+endif()
+
+set(PRODUCT "sle16")
+ssg_build_product("sle16")
+
+
+ssg_build_html_cce_table(${PRODUCT})
diff --git a/products/sle16/product.yml b/products/sle16/product.yml
new file mode 100644
index 00000000000..326e1138e52
--- /dev/null
+++ b/products/sle16/product.yml
@@ -0,0 +1,47 @@
+product: sle16
+full_name: SUSE Linux Enterprise Server 16
+type: platform
+
+families:
+ - suse
+
+major_version_ordinal: 16
+
+benchmark_id: SLE-16
+benchmark_root: "../../linux_os/guide"
+
+profiles_root: "./profiles"
+
+init_system: "systemd"
+
+pkg_manager: "zypper"
+pkg_manager_config_file: "/etc/zypp/zypp.conf"
+
+aide_bin_path: "/usr/bin/aide"
+
+cpes_root: "../../shared/applicability"
+cpes:
+ - sle16:
+ name: "cpe:/o:suse:linux_enterprise_server:16"
+ title: "SUSE Linux Enterprise Server 16"
+ check_id: installed_OS_is_sle16
+
+platform_package_overrides:
+ login_defs: "shadow"
+ grub2: "grub2"
+ sssd: "sssd"
+ crontabs: "cronie"
+ passwd: "shadow"
+
+reference_uris:
+ suse-base-sle16: 'not_publicly_available'
+
+dconf_gdm_dir: "gdm.d"
+
+sysctl_remediate_drop_in_file: "true"
+journald_conf_dir_path: /etc/systemd/journal.d
+xwindows_packages:
+ - xorg-x11-server
+ - xorg-x11-server-extra
+ - xorg-x11-server-Xvfb
+ - xwayland
diff --git a/products/sle16/profiles/anssi_bp28_minimal.profile b/products/sle16/profiles/anssi_bp28_minimal.profile
new file mode 100644
index 00000000000..c6a90af08e0
--- /dev/null
+++ b/products/sle16/profiles/anssi_bp28_minimal.profile
@@ -0,0 +1,28 @@
+---
+documentation_complete: true
+
+metadata:
+ SMEs:
+ - svet-se
+ - rumch-se
+ - teacup-on-rockingchair
+
+title: 'DRAFT ANSSI-BP-028 (minimal)'
+
+description: |-
+ This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
+
+ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information.
+ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
+
+ A copy of the ANSSI-BP-028 can be found at the ANSSI website:
+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
+
+ Only the components strictly necessary to the service provided by the system should be installed.
+ Those whose presence can not be justified should be disabled, removed or deleted.
+ Performing a minimal install is a good starting point, but doesn't provide any assurance
+ over any package installed later.
+ Manual review is required to assess if the installed services are minimal.
+
+selections:
+ - base_sle16:all:anssi_minimal
diff --git a/products/sle16/profiles/base.profile b/products/sle16/profiles/base.profile
new file mode 100644
index 00000000000..1d6c2bcfd35
--- /dev/null
+++ b/products/sle16/profiles/base.profile
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+metadata:
+ version: 1.0
+ SMEs:
+ - svet-se
+ - rumch-se
+ - teacup-on-rockingchair
+
+reference: not_publicly_available
+
+title: 'DRAFT General System Security Profile for SUSE Linux Enterprise (SLES) 16'
+
+description: |-
+ This profile contains configuration checks that align to the
+ General System Security Profile for SUSE Linux Enterprise (SLES) 16.
+
+selections:
+ - base_sle16:all
diff --git a/products/sle16/profiles/pci-dss-4.profile b/products/sle16/profiles/pci-dss-4.profile
new file mode 100644
index 00000000000..60342f5fab3
--- /dev/null
+++ b/products/sle16/profiles/pci-dss-4.profile
@@ -0,0 +1,17 @@
+documentation_complete: true
+
+metadata:
+ SMEs:
+ - svet-se
+ - rumch-se
+ - teacup-on-rockingchair
+
+reference: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf
+
+title: 'DRAFT PCI-DSS v4 Control Baseline for SUSE Linux Enterprise 16'
+
+description: |-
+ Ensures PCI-DSS v4 security configuration settings are applied.
+
+selections:
+ - base_sle16:all:pcidss4
diff --git a/products/sle16/transforms/constants.xslt b/products/sle16/transforms/constants.xslt
new file mode 100644
index 00000000000..830c77a787d
--- /dev/null
+++ b/products/sle16/transforms/constants.xslt
@@ -0,0 +1,9 @@
+
+
+
+
+SUSE Linux Enterprise Server 16.0
+SLES 16
+sle16
+
+
diff --git a/products/sle16/transforms/table-style.xslt b/products/sle16/transforms/table-style.xslt
new file mode 100644
index 00000000000..8b6caeab8cd
--- /dev/null
+++ b/products/sle16/transforms/table-style.xslt
@@ -0,0 +1,5 @@
+
+
+
+
+
diff --git a/products/sle16/transforms/xccdf-apply-overlay-stig.xslt b/products/sle16/transforms/xccdf-apply-overlay-stig.xslt
new file mode 100644
index 00000000000..4789419b80a
--- /dev/null
+++ b/products/sle16/transforms/xccdf-apply-overlay-stig.xslt
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
diff --git a/products/sle16/transforms/xccdf2table-cce.xslt b/products/sle16/transforms/xccdf2table-cce.xslt
new file mode 100644
index 00000000000..f156a669566
--- /dev/null
+++ b/products/sle16/transforms/xccdf2table-cce.xslt
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/products/sle16/transforms/xccdf2table-profileccirefs.xslt b/products/sle16/transforms/xccdf2table-profileccirefs.xslt
new file mode 100644
index 00000000000..9d8d3e5faf1
--- /dev/null
+++ b/products/sle16/transforms/xccdf2table-profileccirefs.xslt
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/shared/checks/oval/installed_OS_is_sle16.xml b/shared/checks/oval/installed_OS_is_sle16.xml
new file mode 100644
index 00000000000..c8a80169785
--- /dev/null
+++ b/shared/checks/oval/installed_OS_is_sle16.xml
@@ -0,0 +1,64 @@
+
+
+
+ SUSE Linux Enterprise 16
+
+ multi_platform_all
+
+
+ The operating system installed on the system is SUSE Linux Enterprise Server 16.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ unix
+
+
+
+
+
+
+
+
+ ^16.*$
+
+
+ SLES-release
+
+
+
+
+
+
+
+ ^16.*$
+
+
+ SLES_SAP-release
+
+
+
+
+
+
+
+ ^16.*$
+
+
+ sle-ha-release
+
+
diff --git a/ssg/constants.py b/ssg/constants.py
index 0dd3752b308..de789d849aa 100644
--- a/ssg/constants.py
+++ b/ssg/constants.py
@@ -59,7 +59,7 @@
'openembedded',
'rhel8', 'rhel9', 'rhel10',
'rhv4',
- 'sle12', 'sle15', 'slmicro5', 'slmicro6',
+ 'sle12', 'sle15', 'sle16', 'slmicro5', 'slmicro6',
'tencentos4',
'ubuntu2204', 'ubuntu2404'
]
@@ -238,6 +238,7 @@
"Red Hat Virtualization 4": "rhv4",
"SUSE Linux Enterprise 12": "sle12",
"SUSE Linux Enterprise 15": "sle15",
+ "SUSE Linux Enterprise 16": "sle16",
"SUSE Linux Enterprise Micro 5": "slmicro5",
"SUSE Linux Enterprise Micro 6": "slmicro6",
"TencentOS Server 4": "tencentos4",
@@ -315,7 +316,7 @@
"multi_platform_rhcos": ["rhcos4"],
"multi_platform_rhel": ["rhel8", "rhel9", "rhel10"],
"multi_platform_rhv": ["rhv4"],
- "multi_platform_sle": ["sle12", "sle15"],
+ "multi_platform_sle": ["sle12", "sle15", "sle16"],
"multi_platform_slmicro": ["slmicro5", "slmicro6"],
"multi_platform_tencentos": ["tencentos4"],
"multi_platform_ubuntu": ["ubuntu2204", "ubuntu2404"],