Ensure dnf Removes Previous Package Versions

An XCCDF Rule

Description

dnf should be configured to remove previous software components after new versions have been installed. To configure dnf to remove the previous software components after updating, set the clean_requirements_on_remove to 1 in /etc/dnf/dnf.conf.

Rationale

Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.

ID: xccdf_org.ssgproject.content_rule_clean_components_post_updating
Severity: Low
References: 18 20 4

APO12.01 APO12.02 APO12.03 APO12.04 BAI03.10 DSS05.01 DSS05.02

3.4.8

CCI-002617

4.2.3 4.2.3.12 4.2.3.7 4.2.3.9

A.12.6.1 A.14.2.3 A.16.1.3 A.18.2.2 A.18.2.3

CM-11(a) CM-11(b) CM-6(a) SI-2(6)

ID.RA-1 PR.IP-12

SRG-OS-000437-GPOS-00194

SV-257824r925459_rule
Updated: about 1 year ago

# Remediation is applicable only in certain platforms
if rpm --quiet -q dnf; then

if grep --silent ^clean_requirements_on_remove /etc/dnf/dnf.conf ; then
        sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/dnf/dnf.conf
else        echo -e "\n# Set clean_requirements_on_remove to 1 per security requirements" >> /etc/dnf/dnf.conf
        echo "clean_requirements_on_remove=1" >> /etc/dnf/dnf.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-RHEL-09-214035
  - NIST-800-171-3.4.8  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure dnf Removes Previous Package Versions - Ensure DNF Removes Previous
    Package Versions
  ansible.builtin.lineinfile:
    dest: /etc/dnf/dnf.conf
    regexp: ^#?clean_requirements_on_remove
    line: clean_requirements_on_remove=1
    insertafter: \[main\]
    create: true
  when: '"dnf" in ansible_facts.packages'
  tags:
  - DISA-STIG-RHEL-09-214035
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

Ensure dnf Removes Previous Package Versions

Description

Rationale

Remediation - Shell Script

Remediation - Ansible