Improve aide rules for sle16/suse platform

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml

@@ -11,7 +11,11 @@
 
   <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
     {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and 'fedora' not in product %}}
+    {{% if product in ['sle16'] %}}
+    <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
+    {{% else %}}
     <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
+    {{% endif %}}
     {{% else %}}
     <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
     {{% endif %}}

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 aide --init
@@ -14,5 +14,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -11,5 +11,9 @@ bins=(
 
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha5122" >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_sle,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu
 # packages = aide
 
 aide --init

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml

@@ -4,14 +4,37 @@
 # complexity = low
 # disruption = low
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.service
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
+
+{{% if product in ["sle16"] %}}
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is including /etc/aide.conf"
+  ansible.builtin.copy:
+      dest: /etc/aide_service.conf
+      owner: root
+      group: root
+      mode: 0600
+      content: |-
+        @@include /etc/aide.conf
+
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is in enabled state"
+  ansible.builtin.file:
+    src: /usr/lib/systemd/system/{{{ aide_service }}}
+    path: /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+    state: link
+{{% else %}}
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service {{{ aide_service }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_service }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Aide Check
         [Service]
@@ -20,35 +43,35 @@
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.timer
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer {{{ aide_timer }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_timer }}}
       owner: root
       group: root
-      mode: '0644'
-      block: |
+      mode: 0644
+      content: |-
         [Unit]
         Description=Aide check every day at 5AM
         [Timer]
         OnCalendar=*-*-* 05:00:00
-        Unit=aidecheck.service
+        Unit={{{ aide_service }}}
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service is Enabled"
+{{% endif %}}
+- name: "{{{ rule_title }}} - Ensure AIDE Service {{{ aide_service }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.service
+    name: {{{ aide_service }}}
     enabled: true
     daemon_reload: true
     masked: false
   when: not ansible_check_mode
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service Timer is Enabled"
+- name: "{{{ rule_title }}} - Ensure AIDE Service Timer {{{ aide_timer }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.timer
-    state: started
+    name: {{{ aide_timer }}}
     enabled: true
     daemon_reload: true
+    state: started
     masked: false
   when: not ansible_check_mode

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh

@@ -2,8 +2,22 @@
 
 {{{ bash_package_install("aide") }}}
 
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
+
+{{% if product in ["sle16"] %}}
+cat > /etc/aide_service.conf <<EOF
+@@include /etc/aide.conf
+EOF
+ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+{{% else %}}
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<EOF
+cat > /etc/systemd/system/{{{ aide_service }}} <<EOF
 [Unit]
 Description=Aide Check
 [Service]
@@ -12,28 +26,32 @@ ExecStart={{{ aide_bin_path }}} --check
 [Install]
 WantedBy=multi-user.target
 EOF
-chmod 0644 /etc/systemd/system/aidecheck.service
 
-# create unit file for the aide check timer
-cat > /etc/systemd/system/aidecheck.timer <<EOF
+# create unit file for the aide timer
+cat > /etc/systemd/system/{{{ aide_timer }}} <<EOF
 [Unit]
 Description=Aide check every day at 5AM
 [Timer]
 OnCalendar=*-*-* 05:00:00
-Unit=aidecheck.service
+Unit={{{ aide_service }}}
 [Install]
 WantedBy=multi-user.target
 EOF
 
 #  setup service unit files attributes
-chown root:root /etc/systemd/system/aidecheck.*
-chmod 0644 /etc/systemd/system/aidecheck.*
-
+chown root:root /etc/systemd/system/{{{ aide_timer }}}
+chmod 0644 /etc/systemd/system/{{{ aide_timer }}}
+chown root:root /etc/systemd/system/{{{ aide_service }}}
+chmod 0644 /etc/systemd/system/{{{ aide_service }}}
+{{% endif %}}
 # enable the aide related services
 systemctl daemon-reload
-systemctl enable aidecheck.service
-systemctl enable aidecheck.timer
+
+systemctl unmask {{{ aide_service }}}
+systemctl enable {{{ aide_service }}}
+systemctl unmask {{{ aide_timer }}}
+systemctl enable {{{ aide_timer }}}
 
 if [[ $(systemctl is-system-running) != "offline" ]]; then
-  systemctl start aidecheck.timer
+  systemctl start {{{ aide_timer }}}
 fi

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml

@@ -1,29 +1,36 @@
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="3">
     {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.", rule_title=rule_title) }}}
     <criteria operator="AND">
       <extend_definition comment="Aide is installed" definition_ref="package_aide_installed"/>
       <criteria operator="AND">
         <criterion test_ref="tst_aidecheck-service_enabled"
-          comment="systemd aidecheck.service enabled"/>
+          comment="systemd {{{ aide_service }}} enabled"/>
         <criterion test_ref="tst_aidecheck-timer_enabled"
           comment="systemd aidecheck.timer enabled"/>
         <criterion test_ref="tst_aidecheck-timer_active"
-          comment="systemd aidecheck.timer active"/>
+          comment="systemd {{{ aide_timer }}} active"/>
       </criteria>
     </criteria>
   </definition>
 
   <linux:systemdunitproperty_object id="obj_aidecheck-service_unitfilestate" version="1">
-    <linux:unit>aidecheck.service</linux:unit>
+    <linux:unit>{{{ aide_service }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_unitfilestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_activestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>ActiveState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_state id="ste_aide_is_enabled" version="1">
@@ -34,7 +41,7 @@
   </linux:systemdunitproperty_state>
 
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-service_enabled" version="1"
-    comment="systemd aidecheck.service enabled">
+    comment="systemd {{{ aide_service }}} enabled">
     <linux:object object_ref="obj_aidecheck-service_unitfilestate" />
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
@@ -44,7 +51,7 @@
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-timer_active" version="1"
-    comment="systemd aidecheck.timer active">
+    comment="systemd {{{ aide_timer }}} active">
     <linux:object object_ref="obj_aidecheck-timer_activestate" />
     <linux:state state_ref="ste_aide_is_active" />
   </linux:systemdunitproperty_test>

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh

@@ -2,8 +2,19 @@
 # platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux
 # packages = aide
 
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
+
+{{% if product in ["sle16"] %}}
+ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+{{% else %}}
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<EOF
+cat > /etc/systemd/system/{{{ aide_service }}} <<EOF
 [Unit]
 Description=Aide Check
 [Service]
@@ -14,21 +25,22 @@ WantedBy=multi-user.target
 EOF
 
 # create unit file for the aide check timer
-cat > /etc/systemd/system/aidecheck.timer <<EOF
+cat > /etc/systemd/system/{{{ aide_timer }}} <<EOF
 [Unit]
 Description=Aide check every Monday
 [Timer]
 OnCalendar=Mon *-*-* 05:00:00
-Unit=aidecheck.service
+Unit={{{ aide_service }}}
 [Install]
 WantedBy=multi-user.target
 EOF
 
 #  setup service unit files attributes
-chown root:root /etc/systemd/system/aidecheck.*
-chmod 0644 /etc/systemd/system/aidecheck.*
+chown root:root /etc/systemd/system/aide.*
+chmod 0644 /etc/systemd/system/aide.*
+{{% endif %}}
 
 # enable the aide related services
 systemctl daemon-reload
-systemctl enable aidecheck.service
-systemctl --now enable aidecheck.timer
+systemctl enable {{{ aide_service }}}
+systemctl --now enable {{{ aide_timer }}}