diff --git a/controls/stig_rhel9.yml b/controls/stig_rhel9.yml
index 5449c82967a..d1a4ab494f6 100644
--- a/controls/stig_rhel9.yml
+++ b/controls/stig_rhel9.yml
@@ -2567,7 +2567,7 @@ controls:
- medium
title: RHEL 9 must ensure session control is automatically started at shell initialization.
rules:
- - configure_bashrc_exec_tmux
+ - configure_bashrc_tmux
status: automated
- id: RHEL-09-412020
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/ansible/shared.yml
index 5c6dd41e1d0..75395cf61a7 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/ansible/shared.yml
@@ -8,14 +8,14 @@
ansible.builtin.find:
paths: '/etc'
patterns: 'bashrc'
- contains: '.*case "$name" in sshd|login\) tmux ;; esac.*'
+ contains: '.*case "$name" in sshd|login\) exec tmux ;; esac.*'
register: tmux_in_bashrc
- name: "{{{ rule_title }}}: Determine If the Tmux Launch Script Is Present in /etc/profile.d/*.sh"
ansible.builtin.find:
paths: '/etc/profile.d'
patterns: '*.sh'
- contains: .*case "$name" in sshd|login\) tmux ;; esac.*
+ contains: .*case "$name" in sshd|login\) exec tmux ;; esac.*
register: tmux_in_profile_d
- name: "{{{ rule_title }}}: Insert the Correct Script into /etc/profile.d/tmux.sh"
@@ -25,7 +25,7 @@
if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
- case "$name" in sshd|login) tmux ;; esac
+ case "$name" in sshd|login) exec tmux ;; esac
fi
create: true
when:
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
index 3d056e4cf45..e139c3d494e 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/bash/shared.sh
@@ -4,12 +4,12 @@
# complexity = low
# disruption = low
-if ! grep -x ' case "$name" in sshd|login) tmux ;; esac' /etc/bashrc; then
+if ! grep -x ' case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then
cat >> /etc/profile.d/tmux.sh <<'EOF'
if [ "$PS1" ]; then
parent=$(ps -o ppid= -p $$)
name=$(ps -o comm= -p $parent)
- case "$name" in sshd|login) tmux ;; esac
+ case "$name" in sshd|login) exec tmux ;; esac
fi
EOF
chmod 0644 /etc/profile.d/tmux.sh
diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
index e3c4b6ef0e5..58f91eadf66 100644
--- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/oval/shared.xml
@@ -1,7 +1,7 @@
$ sudo grep tmux /etc/bashrc /etc/profile.d/* - /etc/profile.d/tmux.sh: case "$name" in (sshd|login) tmux ;; esac+ /etc/profile.d/tmux.sh: case "$name" in (sshd|login) exec tmux ;; esac Review the tmux script by using the following example: @@ -48,7 +48,7 @@ ocil: |- if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in (sshd|login) tmux ;; esac + case "$name" in (sshd|login) exec tmux ;; esac fi If the shell file is not configured as the example above, is commented out, or is missing, this is a finding. @@ -63,7 +63,7 @@ fixtext: |- if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) tmux ;; esac + case "$name" in sshd|login) exec tmux ;; esac fi Then, ensure a correct mode of /etc/profile.d/tmux.sh using this command: diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh index 77b7a61a5b9..fbc7590f27d 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value.pass.sh @@ -5,7 +5,7 @@ cat >> /etc/bashrc <<'EOF' if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) tmux ;; esac + case "$name" in sshd|login) exec tmux ;; esac fi EOF diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh index c0ddc93e5ef..6107f86f248 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/correct_value_d_directory.pass.sh @@ -6,7 +6,7 @@ cat >> /etc/profile.d/00-complianceascode.conf <<'EOF' if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) tmux ;; esac + case "$name" in sshd|login) exec tmux ;; esac fi EOF diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh index 120541cd056..c662221eca1 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/tests/duplicate_value_multiple_files.pass.sh @@ -5,7 +5,7 @@ cat >> /etc/profile.d/00-complianceascode.conf <<'EOF' if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) tmux ;; esac + case "$name" in sshd|login) exec tmux ;; esac fi EOF @@ -13,7 +13,7 @@ cat >> /etc/bashrc <<'EOF' if [ "$PS1" ]; then parent=$(ps -o ppid= -p $$) name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) tmux ;; esac + case "$name" in sshd|login) exec tmux ;; esac fi EOF diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_tmux/rule.yml index 0afa3d15581..80bdc7a3c8e 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_tmux/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_tmux/rule.yml @@ -20,6 +20,7 @@ severity: medium identifiers: cce@rhel8: CCE-90782-4 + cce@rhel9: CCE-86073-4 references: @@ -27,6 +28,7 @@ references: srg: SRG-OS-000031-GPOS-00012,SRG-OS-000028-GPOS-00009,SRG-OS-000030-GPOS-00011 stigid@ol8: OL08-00-020041 stigid@rhel8: RHEL-08-020041 + stigid@rhel9: RHEL-09-412015 platform: package[tmux] diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 80c5472525f..a2172147a19 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -1,4 +1,3 @@ -CCE-86073-4 CCE-86074-2 CCE-86076-7 CCE-86078-3