---
policy: 'Fedora Common User Security Policy'
title: 'Fedora Common User Security Policy'
id: cusp_fedora
version: '1.0.0'
source: "jodehnal's bachelor thesis on creating a SCAP profile for common users of Fedora workstation\
    \ - link will be added after publication"

controls:
    ###
    ### 1. Hardware and its configuration
    ###
    - id: '1.1'
      title: Protection of the BIOS or UEFI
      description: >-
          Users should protect their BIOS or UEFI with a password.
      status: manual

    - id: '1.2'
      title: Proper BIOS or UEFI Configuration
      description: >-
          Users should disable features and devices in the BIOS or UEFI that are not in use and should
          only include trusted devices in the boot order.
      status: manual

    - id: '1.3'
      title: 64-bit OS
      description: >-
          When possible, users should use a 64-bit system and hardware that supports it.
      status: manual
    ###
    ### 2. System installation
    ###
    - id: '2.1'
      title: Security Policy Selection
      description: >-
          Users should apply the Fedora Common User Security Policy in the installer.
      status: manual

    - id: '2.2'
      title: Disk Partitioning
      description: >-
          Users should put the /home, /tmp, /var, /var/tmp and /var/log directories on separate partitions.
      status: manual

    - id: '2.3'
      title: Password Security
      description: >-
          Users should ensure that all account passwords adhere to the password rules in rule 4.1.
      status: manual

    - id: '2.4'
      title: Disk Encryption
      description: >-
          Users should encrypt their disk with a passphrase that adheres to the password rules in rule
          4.1.
      status: manual
    ###
    ### 3. General system configuration
    ###
    - id: '3.1'
      title: Bootloader Security
      description: >-
          If the BIOS or UEFI does not allow password protection of the boot process, users should set
          a bootloader password.
      status: partial
      rules:
          # BIOS
          - file_groupowner_grub2_cfg
          - file_groupowner_user_cfg
          - file_owner_grub2_cfg
          - file_owner_user_cfg
          - file_permissions_grub2_cfg
          - file_permissions_user_cfg
          - grub2_password
          # UEFI
          - file_groupowner_efi_grub2_cfg
          - file_groupowner_efi_user_cfg
          - file_owner_efi_grub2_cfg
          - file_owner_efi_user_cfg
          - file_permissions_efi_grub2_cfg
          - file_permissions_efi_user_cfg
          - grub2_uefi_password

    - id: '3.2'
      title: Software Updates
      description: >-
          Users should apply updates from the GNOME Software application at least once per day.
      status: partial
      rules:
          - package_gnome_software_installed

    - id: '3.3'
      title: Filesystem Configuration
      description: >-
          Directories /home (-noexec), /tmp, /var, /var/tmp and /var/log mount option configuration.
      status: automated
      rules:
          - mount_option_home_nodev
          - mount_option_home_nosuid
          - kernel_module_cramfs_disabled
          - kernel_module_squashfs_disabled
          - kernel_module_udf_disabled

    - id: '3.4'
      title: Crypto Policy
      description: >-
          System cryto policy configuation and ensuring it is not overridden in critical components.
      status: automated
      rules:
          - configure_crypto_policy
          - var_system_crypto_policy=default_policy
          - configure_bind_crypto_policy
          - configure_kerberos_crypto_policy
          - configure_libreswan_crypto_policy
          - configure_openssl_crypto_policy
          - configure_ssh_crypto_policy

    - id: '3.5'
      title: Auditing and Logging
      description: >-
          Auditd and journald configutation.
      status: automated
      rules:
          # auditd config
          - package_audit_installed
          - service_auditd_enabled
          - grub2_audit_argument
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
          - auditd_data_retention_max_log_file
          - var_auditd_max_log_file=6
          - auditd_data_retention_max_log_file_action
          - var_auditd_max_log_file_action=rotate
          - audit_rules_immutable
          # auditd rules
          - audit_rules_sysadmin_actions
          - audit_rules_suid_privilege_function
          - audit_sudo_log_events
          - audit_rules_time_adjtimex
          - audit_rules_time_settimeofday
          - audit_rules_time_clock_settime
          - audit_rules_time_stime
          - audit_rules_time_watch_localtime
          - audit_rules_networkconfig_modification
          - audit_rules_privileged_commands
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lchown
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr
          - audit_rules_media_export
          - audit_rules_session_events
          - audit_rules_login_events_faillock
          - audit_rules_login_events_lastlog
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat
          - audit_rules_mac_modification
          - audit_rules_mac_modification_usr_share
          - audit_rules_execution_chcon
          - audit_rules_execution_setfacl
          - audit_rules_execution_chacl
          - audit_rules_privileged_commands_usermod
          - audit_rules_kernel_module_loading_delete
          - audit_rules_kernel_module_loading_init
          - audit_rules_sudoers
          - audit_rules_sudoers_d
          # journald config
          - socket_systemd-journal-remote_disabled
          - service_systemd-journald_enabled
          - journald_compress
          - journald_storage

    - id: '3.6'
      title: Files, Permissions, and Ownership
      description: >-
          User and critical system file permissions and ownership, user and group file and directory
          ownership, identifiers.
      status: partial
      rules:
          # file config
          - dir_perms_world_writable_sticky_bits
          - file_permissions_unauthorized_world_writable
          - no_files_unowned_by_user
          - file_permissions_ungroupowned
          # permission and ownership of critical files
          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd
          - file_groupowner_etc_shadow
          - file_owner_etc_shadow
          - file_permissions_etc_shadow
          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group
          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow
          - file_permissions_etc_gshadow
          - file_groupowner_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_permissions_backup_etc_passwd
          - file_groupowner_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_permissions_backup_etc_shadow
          - file_groupowner_backup_etc_group
          - file_owner_backup_etc_group
          - file_permissions_backup_etc_group
          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow
          - file_permissions_backup_etc_gshadow
          # user and group config
          - no_empty_passwords_etc_shadow
          - gid_passwd_group_same
          - account_unique_id
          - group_unique_id
          - account_unique_name
          - group_unique_name
          - accounts_root_path_dirs_no_write
          - accounts_no_uid_except_zero
          - accounts_user_interactive_home_directory_exists
          - file_ownership_home_directories
          - file_groupownership_home_directories
          - file_permissions_home_directories
          - accounts_user_dot_no_world_writable_programs

    - id: '3.7'
      title: Memory Protection
      description: >-
          Enable ASLR and ExecShield, restrict exposed kernel pointer.
      status: automated
      rules:
          - sysctl_kernel_randomize_va_space
          - sysctl_kernel_exec_shield
          - sysctl_kernel_kptr_restrict

    - id: '3.8'
      title: GUI Configuration
      description: >-
          Do not show user list, disable xdmpc and auto login, set up idle lock and protect the settings.
      status: automated
      rules:
          - gnome_gdm_disable_xdmcp
          - gnome_gdm_disable_automatic_login

    - id: '3.9'
      title: Time and Schedulers
      description: >-
          Chrony and time-based scheduler security configuration.
      status: automated
      rules:
          # chrony
          - chronyd_client_only
          - chronyd_no_chronyc_network
          - chronyd_or_ntpd_set_maxpoll
          - chronyd_run_as_chrony_user
          - chronyd_specify_remote_server
          # file permissions
          - file_owner_crontab
          - file_groupowner_crontab
          - file_permissions_crontab
          - file_owner_cron_hourly
          - file_groupowner_cron_hourly
          - file_permissions_cron_hourly
          - file_owner_cron_daily
          - file_groupowner_cron_daily
          - file_permissions_cron_daily
          - file_owner_cron_weekly
          - file_groupowner_cron_weekly
          - file_permissions_cron_weekly
          - file_owner_cron_monthly
          - file_groupowner_cron_monthly
          - file_permissions_cron_monthly
          - file_owner_cron_d
          - file_groupowner_cron_d
          - file_permissions_cron_d
          - file_owner_cron_allow
          - file_groupowner_cron_allow
          - file_permissions_cron_allow
          - file_owner_at_allow
          - file_groupowner_at_allow
          - file_permissions_at_allow

    - id: '3.10'
      title: Service Minimization
      description: >-
          Users should remove any services that are not necessary for normal system usage.
      status: partial
      rules:
          - package_xinetd_removed
          - package_dhcp_removed
          - package_bind_removed
          - package_vsftpd_removed
          - package_tftp-server_removed
          - package_tftp_removed
          - package_httpd_removed
          - package_nginx_removed
          - package_cyrus-imapd_removed
          - package_dovecot_removed
          - package_samba_removed
          - package_squid_removed
          - package_net-snmp_removed
          - package_ypserv_removed
          - package_telnet_removed
          - package_telnet-server_removed
          - service_nfs_disabled
          - service_rpcbind_disabled
          - package_rsync_removed
          - package_rsh_removed
          - package_rsh-server_removed
          - package_sendmail_removed
          - package_ypbind_removed
          - package_talk-server_removed
          - package_talk_removed
    ###
    ### 4. User access and control
    ###
    - id: '4.1'
      title: Account Protection
      description: >-
          All account passwords must be passphrases of at least 4 words and 15 characters with at least
          three character classes, generated with a large wordlist and a source of randomness.
      status: partial
      rules:
          - no_empty_passwords
          - set_password_hashing_algorithm_systemauth
          - set_password_hashing_algorithm_passwordauth
          - set_password_hashing_algorithm_logindefs
          - var_password_hashing_algorithm=SHA512
          - var_password_hashing_algorithm_pam=sha512
          - accounts_tmout
          - var_accounts_tmout=15_min
          - accounts_root_gid_zero
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_login_defs
          - accounts_umask_etc_profile
          - var_accounts_user_umask=027
          - account_password_selinux_faillock_dir
          - enable_authselect
          # password requirements
          - accounts_password_pam_pwquality_password_auth
          - accounts_password_pam_pwquality_system_auth
          - accounts_password_pam_maxrepeat
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_retry
          - var_password_pam_minclass=3
          - var_password_pam_minlen=15
          # password reuse
          - var_password_pam_remember_control_flag=requisite_or_required
          - var_password_pam_remember=5
          - accounts_password_pam_difok
          - var_password_pam_difok=8

    - id: '4.2'
      title: Sudo
      description: >-
          Secure sudo configuration.
      status: automated
      rules:
          - package_sudo_installed
          - sudo_add_use_pty
          - sudo_custom_logfile
          - sudo_require_authentication
          - sudo_require_reauthentication
          - use_pam_wheel_for_su
          - sudoers_default_includedir

    - id: '4.3'
      title: SSH Server
      description: >-
          Secure ssh server configuration.
      status: automated
      rules:
          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config
          - file_permissions_sshd_private_key
          - file_permissions_sshd_pub_key
          - sshd_set_loglevel_verbose
          - sshd_enable_pam
          - sshd_disable_root_login
          - disable_host_auth
          - sshd_disable_empty_passwords
          - sshd_do_not_permit_user_env
          - sshd_disable_rhosts
          - sshd_disable_x11_forwarding
          - sshd_disable_tcp_forwarding
          - sshd_max_auth_tries_value=4
          - sshd_set_max_auth_tries
          - sshd_set_maxstartups
          - var_sshd_set_maxstartups=10:30:60
          - sshd_set_max_sessions
          - var_sshd_max_sessions=10
          - sshd_set_login_grace_time
          - var_sshd_set_login_grace_time=60
          - sshd_idle_timeout_value=15_minutes
          - sshd_set_idle_timeout
          - sshd_set_keepalive
          - var_sshd_set_keepalive=0
          - sshd_x11_use_localhost
          - sshd_disable_kerb_auth
          - sshd_disable_gssapi_auth
          - sshd_enable_strictmodes
          - sshd_rekey_limit
          - var_rekey_limit_size=1G
          - var_rekey_limit_time=1hour
          - sshd_use_strong_rng
          - sshd_set_keepalive_0
    ###
    ### 5. Networking
    ###
    - id: '5.1'
      title: General Network Configuration
      description: >-
          If users did not configure IPv6 on the system and it is not needed, it should be disabled.
      status: partial
      rules:
          - kernel_module_sctp_disabled
          - kernel_module_dccp_disabled
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_all_accept_source_route
          - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_default_accept_source_route
          - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_accept_redirects
          - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_all_accept_redirects
          - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_default_accept_redirects
          - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_all_log_martians
          - sysctl_net_ipv4_conf_all_log_martians_value=enabled
          - sysctl_net_ipv4_conf_default_log_martians
          - sysctl_net_ipv4_conf_default_log_martians_value=enabled
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
          - sysctl_net_ipv4_conf_default_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter_value=enabled
          - sysctl_net_ipv4_tcp_syncookies
          - sysctl_net_ipv4_tcp_syncookies_value=enabled

    - id: '5.2'
      title: Firewall Configuration
      description: >-
          Users should ensure that all network interfaces are in the appropriate firewall zone and that
          ports and services allowed by the firewall are reduced to the necessary minimum.
      status: partial
      rules:
          - package_firewalld_installed
          - service_nftables_disabled
          - service_firewalld_enabled
    ###
    ### 6. User applications
    ###
    - id: '6.1'
      title: Web Browser
      description: >-
          Users should install the Firefox Flatpak from FlatHub and use it instead of the default Firefox
          application. If the default Firefox application must be used, the users should apply the Common
          User Security Profile for Mozilla Firefox CaC profile.
      status: manual
    ###
    ### 7. Advanced security features
    ###
    - id: '7.1'
      title: Mandatory Access Control
      description: >-
          Ensure SELinux is installed and enabled, in enforcing mode using targeted policy.
      status: partial
      rules:
          - package_libselinux_installed
          - grub2_enable_selinux
          - var_selinux_policy_name=targeted
          - selinux_policytype
          - var_selinux_state=enforcing
          - selinux_state
          - package_mcstrans_removed
          - sysctl_fs_protected_hardlinks
          - sysctl_fs_protected_symlinks

    - id: '7.2'
      title: Periodic Compliance Scans
      description: >-
          Users should perform periodic system scans and remediations with the Common User Security Profile
          by using the oscap tool or SCAP Workbench.
      status: manual
