Skip to content

RHEL 8 V2R7 Changes

This is my change summary notes based on a diff analysis of the RHEL 8 STIG V2R7 and V2R6. Reminder: I am no longer posting to /r/redhat since they keep blocking my posts. I have reached out, but their mod team is not responding.

Added Rules

  • None

Removed Rules

  • None

Rule ID and Severity Changes

  • RHEL-08-010275: CAT 2 -> CAT 1. FIPS-Related.
  • RHEL-08-010280: CAT 2 -> CAT 1; Editorial change. FIPS-Related.
  • RHEL-08-010290: CAT 2 -> CAT 1. FIPS-Related.
  • RHEL-08-010291: CAT 2 -> CAT 1. FIPS-Related.
  • RHEL-08-010296: CAT 2 -> CAT 1. FIPS-Related.
  • RHEL-08-010297: CAT 2 -> CAT 1. FIPS-Related.
  • RHEL-08-040010: CAT 1 -> CAT 2. (EPEL repository)
  • RHEL-08-020010: Editorial change.
  • RHEL-08-020012: Editorial change.
  • RHEL-08-020014: Editorial change.
  • RHEL-08-020016: Editorial change.
  • RHEL-08-020018: Editorial change.
  • RHEL-08-020020: Editorial change.
  • RHEL-08-020022: Editorial change.

Rule ID and Check Changes

  • RHEL-08-010010: Control is N/A "[i]f the system is not an internet connected system".
  • RHEL-08-010572: Removes vfat comment, N/A for BIOS systems.
  • RHEL-08-010580: Removes vfat comment, editorial change.

Rule ID, Check, and Fix Changes

  • RHEL-08-010040: Check and fix add a line break in the first line of the DoD Notice and Consent Banner.
  • RHEL-08-010372: Editorial change and updates control to allow for drop files.
  • RHEL-08-010373: Editorial change and updates control to allow for drop files.
  • RHEL-08-010374: Editorial change and updates control to allow for drop files.
  • RHEL-08-010375: Editorial change and updates control to allow for drop files.
  • RHEL-08-010376: Editorial change and updates control to allow for drop files.
  • RHEL-08-040020: Some editorial changes, but essentially the same blacklist uvcvideo control.
  • RHEL-08-040283: Editorial change and updates control to allow for drop files.
  • RHEL-08-040285: Reverse path filtering systemctl control. Changes from net.ipv4.conf.default.rp_filter = 1 to net.ipv4.conf.all.rp_filter = 1.