---
id: ospp
title: 'Protection Profile for General Purpose Operating Systems'
policy: 'Common Criteria'
source: 'https://www.niap-ccevs.org/Profile/Info.cfm?PPID=469&id=469'
version: '4.3'

levels:
    - id: base

controls:
    - id: AGD_OPE.1
      title: 'Operational User Guidance'
      levels:
          - base
      rules:
          - package_openscap-scanner_installed
          - package_scap-security-guide_installed
      status: automated
    - id: AGD_PRE.1
      title: 'Preparative Procedures'
      levels:
          - base
      rules:
          - package_openscap-scanner_installed
          - package_scap-security-guide_installed
      status: automated
    - id: FAU_GEN.1
      title: 'Audit Data Generation (Refined)'
      levels:
          - base
      rules:
          - auditd_data_retention_flush
          - auditd_freq
          - grub2_audit_argument
          - package_audit_installed
          - audit_basic_configuration
          - service_auditd_enabled
          - var_auditd_flush=incremental_async
          - sshd_disable_root_login
          - zipl_audit_argument
      status: automated
    - id: FAU_GEN.1.1
      title: 'Audit Data Generation - Event Types to be Audited'
      levels:
          - base
      rules:
          - audit_access_failed
          - audit_access_failed_aarch64
          - audit_access_failed_ppc64le
          - audit_access_success
          - audit_access_success.role=unscored
          - audit_access_success.severity=info
          - audit_access_success_aarch64
          - audit_access_success_aarch64.role=unscored
          - audit_access_success_aarch64.severity=info
          - audit_access_success_ppc64le
          - audit_access_success_ppc64le.role=unscored
          - audit_access_success_ppc64le.severity=info
          - audit_create_failed
          - audit_create_failed_aarch64
          - audit_create_failed_ppc64le
          - audit_create_success
          - audit_create_success_aarch64
          - audit_create_success_ppc64le
          - audit_delete_failed
          - audit_delete_failed_aarch64
          - audit_delete_failed_ppc64le
          - audit_delete_success
          - audit_delete_success_aarch64
          - audit_delete_success_ppc64le
          - audit_modify_failed
          - audit_modify_failed_aarch64
          - audit_modify_failed_ppc64le
          - audit_modify_success
          - audit_modify_success_aarch64
          - audit_modify_success_ppc64le
          - audit_module_load
          - audit_module_load_ppc64le
          - audit_ospp_general
          - audit_ospp_general_aarch64
          - audit_ospp_general_ppc64le
          - audit_owner_change_failed
          - audit_owner_change_failed_aarch64
          - audit_owner_change_failed_ppc64le
          - audit_owner_change_success
          - audit_owner_change_success_aarch64
          - audit_owner_change_success_ppc64le
          - audit_perm_change_failed
          - audit_perm_change_failed_aarch64
          - audit_perm_change_failed_ppc64le
          - audit_perm_change_success
          - audit_perm_change_success_aarch64
          - audit_perm_change_success_ppc64le
      status: automated
    - id: FAU_GEN.1.2
      title: 'Audit Data Generation - Audit Event Format'
      levels:
          - base
      rules:
          - auditd_log_format
          - auditd_name_format
          - audit_immutable_login_uids
          - disable_ctrlaltdel_burstaction
          - disable_ctrlaltdel_reboot
      status: automated
    - id: FAU_STG.1
      title: 'Protected audit trail storage'
      levels:
          - base
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
          - zipl_audit_backlog_limit_argument
      status: automated
    - id: FCS_CKM.1
      title: 'Cryptographic Key Generation'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated
    - id: FCS_CKM.1.1
      title: 'Cryptographic Key Generation - asymmetric cryptographic'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated
    - id: FCS_CKM.2
      title: 'Cryptographic Key Establishment'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated
    - id: FCS_COP.1/ENCRYPT
      title: 'Cryptographic Operation - Encryption/Decryption'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated
    - id: FCS_COP.1/HASH
      title: 'Cryptographic Operation - Hashing'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated

    - id: FCS_COP.1/SIGN
      title: 'Cryptographic Operation - Signing'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated
    - id: FCS_COP.1/KEYHMAC
      title: 'Keyed-Hash Message Authentication'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
          - configure_openssl_crypto_policy
      status: automated

    - id: FCS_RBG_EXT.1
      title: 'Random Bit Generation'
      levels:
          - base
      rules:
          - enable_dracut_fips_module
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
      status: automated
    - id: FCS_RBG_EXT.1.1
      title: 'Random Bit Generation - deterministic random bit generation'
      levels:
          - base
      rules:
          - enable_dracut_fips_module
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
      status: automated

    - id: FCS_RBG_EXT.1.2
      title: 'Random Bit Generation - entropy source'
      levels:
          - base
      rules:
          - enable_dracut_fips_module
          - enable_fips_mode
          - var_system_crypto_policy=fips_ospp
      status: automated

    - id: FCS_SSHC_EXT.1
      title: 'SSH Client Protocol'
      levels:
          - base
      rules:
          - package_openssh-clients_installed
          - configure_ssh_crypto_policy
      status: automated
    - id: FCS_SSHS_EXT.1
      title: 'SSH Server Protocol'
      levels:
          - base
      rules:
          - package_openssh-server_installed
          - configure_ssh_crypto_policy
      status: automated

    - id: FCS_SSH_EXT.1
      title: 'SSH Protocol'
      levels:
          - base
      rules:
          - package_openssh-clients_installed
          - package_openssh-server_installed
          - configure_ssh_crypto_policy
          - sshd_use_directory_configuration
      status: automated

    - id: FCS_SSH_EXT.1.2
      title: 'SSH Protocol - Authentication Methods'
      levels:
          - base
      rules:
          - sshd_disable_gssapi_auth
          - sshd_disable_kerb_auth
      status: automated

    - id: FCS_SSH_EXT.1.8
      title: 'SSH Protocol - Session'
      levels:
          - base
      rules:
          - ssh_client_rekey_limit
          - var_ssh_client_rekey_limit_size=1G
          - var_ssh_client_rekey_limit_time=1hour
          - sshd_rekey_limit
          - var_rekey_limit_size=1G
          - var_rekey_limit_time=1hour
      status: automated

    - id: FCS_TLSC_EXT.1
      title: 'TLS Client Protocol'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - configure_openssl_crypto_policy
      status: automated

    - id: FCS_TLSC_EXT.1.1
      title: 'Allowed Cipher Suites'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - package_crypto-policies_installed
          - enable_fips_mode
          - configure_openssl_crypto_policy
      status: automated
    - id: FIA_AFL.1
      title: 'Authentication failure handling'
      levels:
          - base
      rules:
          - accounts_passwords_pam_faillock_deny
          - var_accounts_passwords_pam_faillock_deny=3
          - accounts_passwords_pam_faillock_interval
          - var_accounts_passwords_pam_faillock_fail_interval=900
          - accounts_passwords_pam_faillock_unlock_time
          - var_accounts_passwords_pam_faillock_unlock_time=never
      status: automated

    - id: FIA_UAU.1
      title: 'Timing of authentication'
      levels:
          - base
      rules:
          - disable_host_auth
          - sshd_disable_empty_passwords
          - require_singleuser_auth
          - service_debug-shell_disabled
          - no_empty_passwords
          - grub2_disable_recovery
          - grub2_systemd_debug-shell_argument_absent
          - grub2_password
          - zipl_systemd_debug-shell_argument_absent
      status: automated

    - id: FIA_UAU.5
      title: 'Multiple Authentication Mechanisms'
      levels:
          - base
      rules:
          - package_openssh-clients_installed
          - package_openssh-server_installed
      status: automated

    - id: FIA_X509_EXT.1
      title: 'X.509 Certificate Validation'
      levels:
          - base
      rules:
          - package_gnutls-utils_installed
      status: automated

    - id: FIA_X509_EXT.1.1
      title: 'X.509 Certificate Validation - Valid Certificates'
      levels:
          - base
      rules:
          - package_gnutls-utils_installed
      status: automated

    - id: FIA_X509_EXT.2
      title: 'X.509 Certificate Validation - basicConstraints'
      levels:
          - base
      rules:
          - package_gnutls-utils_installed
      status: automated

    - id: FMT_MOF_EXT.1
      title: 'Management of security functions behavior'
      levels:
          - base
      rules:
          - package_sudo_installed
          - logind_session_timeout
          - var_logind_session_timeout=30_minutes
          - selinux_policytype  # SELinux doesn't have a SFR associated, this one seems the least controversial
          - selinux_state
          - var_selinux_state=enforcing
          - var_selinux_policy_name=targeted
      status: automated

    - id: FMT_SMF_EXT.1
      title: 'Specification of Management Functions'
      levels:
          - base
      rules:
          - package_fapolicyd_installed
          - service_fapolicyd_enabled
          - chronyd_client_only
          - package_chrony_installed
          - configure_usbguard_auditbackend
          - package_usbguard_installed
          - service_usbguard_enabled
          - usbguard_allow_hid_and_hub
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - var_password_pam_minlen=12
          - var_password_pam_ocredit=1
          - var_password_pam_dcredit=1
          - var_password_pam_ucredit=1
          - var_password_pam_lcredit=1
          - package_firewalld_installed
          - service_firewalld_enabled
          - kernel_module_can_disabled
          - kernel_module_tipc_disabled
          - kernel_module_bluetooth_disabled
          - kernel_module_sctp_disabled
          - service_systemd-coredump_disabled
          - sysctl_kernel_core_pattern_empty_string
          - sysctl_kernel_core_uses_pid
          - sysctl_kernel_perf_event_paranoid
          - sysctl_kernel_unprivileged_bpf_disabled_accept_default
          - sysctl_kernel_unprivileged_bpf_disabled_value=2
          - sysctl_kernel_dmesg_restrict
          - sysctl_kernel_kptr_restrict
          - sysctl_kernel_kexec_load_disabled
          - sysctl_kernel_yama_ptrace_scope
          - sysctl_user_max_user_namespaces
          - partition_for_var_log_audit
          - mount_option_var_log_audit_nodev
          - mount_option_var_log_audit_nosuid
          - mount_option_var_log_audit_noexec
          - dnf-automatic_apply_updates
          - timer_dnf-automatic_enabled
          - logind_session_timeout
          - var_logind_session_timeout=30_minutes
      status: automated

    - id: FMT_SMF_EXT.1.1
      title: 'Management of security functions behavior - Restrict Administrator Functions'
      levels:
          - base
      rules:
          - service_kdump_disabled
          - logind_session_timeout
          - use_pam_wheel_for_su
      status: automated

    - id: FPT_ASLR_EXT.1
      title: 'Address Space Layout Randomization'
      levels:
          - base
      rules:
          - grub2_vsyscall_argument
      status: automated

    - id: FPT_TUD_EXT.1
      title: 'Trusted Update'
      levels:
          - base
      rules:
          - package_dnf-plugin-subscription-manager_installed
          - package_dnf-automatic_installed
          - package_subscription-manager_installed
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_local_packages
          - ensure_gpgcheck_never_disabled
          - ensure_redhat_gpgkey_installed
          # This package is needed for RHEL 10
          - package_sequoia-sq_installed
      status: automated

    - id: FPT_TUD_EXT.2
      title: 'Trusted Update for Application Software'
      levels:
          - base
      rules:
          - package_dnf-plugin-subscription-manager_installed
          - package_dnf-automatic_installed
          - package_subscription-manager_installed
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_local_packages
          - ensure_gpgcheck_never_disabled
          - ensure_redhat_gpgkey_installed
          # This package is needed for RHEL 10
          - package_sequoia-sq_installed
      status: automated

    - id: FPT_TST_EXT.1
      title: Boot Integrity
      levels:
          - base
      rules:
          - zipl_bls_entries_only
          - zipl_bootmap_is_up_to_date
      status: automated

    - id: FTA_SSL.1
      title: 'TSF-initiated session locking'
      levels:
          - base
      rules:
          - logind_session_timeout
          - var_logind_session_timeout=30_minutes
      status: automated

    - id: FTA_TAB.1
      title: 'Default TOE access banners'
      levels:
          - base
      rules:
          - sshd_enable_warning_banner
      status: automated

    - id: FTP_ITC_EXT.1
      title: 'Trusted channel communication'
      levels:
          - base
      rules:
          - package_openssh-clients_installed
          - package_openssh-server_installed
          - sshd_disable_gssapi_auth
          - sshd_disable_kerb_auth
      status: automated

    - id: FTP_ITC_EXT.1.1
      title: 'Trusted channel communication - TLS'
      levels:
          - base
      rules:
          - package_openssh-clients_installed
          - package_openssh-server_installed
          - sshd_disable_gssapi_auth
          - sshd_disable_kerb_auth
      status: automated

    - id: AVA_VAN.1
      title: 'Vulnerability Assessment'
      levels:
          - base
      rules:
          - grub2_init_on_alloc_argument
          - grub2_page_alloc_shuffle_argument
          - zipl_init_on_alloc_argument
          - zipl_page_alloc_shuffle_argument
      status: automated
