SPECS for new SCA Rocky Linux 9

[72nomada]

Create SPECS as needed for a new OS SCA

PR - wazuh/wazuh#17810 Is ready to merge
Branch - https://github.com/wazuh/wazuh/tree/SCA-Rocky-Linux-9

PLEASE confirm with @wazuh/threat-intel before merging.

[vikman90]

This is a subtask of wazuh/wazuh#16618.

[DFolchA]

Update: Testing

AGENT

[root@rockylinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-agent-4.5.1-0.0.0.rocky9.x86_64.rpm -y
Last metadata expiration check: 2:25:08 ago on Wed 19 Jul 2023 11:55:50 AM UTC.
wazuh-agent-4.5.1-0.0.0.rocky9.x86_64.rpm                                                                   792 kB/s | 8.8 MB     00:11    
Dependencies resolved.
============================================================================================================================================
 Package                         Architecture               Version                                  Repository                        Size
============================================================================================================================================
Installing:
 wazuh-agent                     x86_64                     4.5.1-0.0.0.rocky9                       @commandline                     8.8 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 8.8 M
Installed size: 25 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Installing       : wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Verifying        : wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 

Installed:
  wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                                                     

Complete!
[root@rockylinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_rocky_linux_9.yml

MANAGER

[root@rockylinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-manager-4.5.1-0.0.0.rocky9.x86_64.rpm -y
Last metadata expiration check: 2:33:15 ago on Wed 19 Jul 2023 11:55:50 AM UTC.
wazuh-manager-4.5.1-0.0.0.rocky9.x86_64.rpm                                                                 7.6 MB/s | 164 MB     00:21    
Dependencies resolved.
============================================================================================================================================
 Package                           Architecture               Version                                Repository                        Size
============================================================================================================================================
Installing:
 wazuh-manager                     x86_64                     4.5.1-0.0.0.rocky9                     @commandline                     164 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 164 M
Installed size: 598 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Installing       : wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Verifying        : wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 

Installed:
  wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                                                   

Complete!
[root@rockylinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_amazon_linux_1.yml.disabled     cis_mongodb_36.yml.disabled           cis_sqlserver_2014.yml.disabled
cis_amazon_linux_2.yml.disabled     cis_mysql5-6_community.yml.disabled   cis_sqlserver_2016.yml.disabled
cis_apache_24.yml.disabled          cis_mysql5-6_enterprise.yml.disabled  cis_sqlserver_2017.yml.disabled
cis_apple_macOS_10.11.yml.disabled  cis_nginx_1.yml.disabled              cis_sqlserver_2019.yml.disabled
cis_apple_macOS_10.12.yml.disabled  cis_oracle_database_19c.yml.disabled  cis_ubuntu14-04.yml.disabled
cis_apple_macOS_10.13.yml.disabled  cis_postgre-sql-13.yml.disabled       cis_ubuntu16-04.yml.disabled
cis_apple_macOS_10.14.yml.disabled  cis_rhel5_linux.yml.disabled          cis_ubuntu18-04.yml.disabled
cis_apple_macOS_10.15.yml.disabled  cis_rhel6_linux.yml.disabled          cis_ubuntu20-04.yml.disabled
cis_apple_macOS_11.1.yml.disabled   cis_rhel7_linux.yml.disabled          cis_ubuntu22-04.yml.disabled
cis_apple_macOS_12.0.yml.disabled   cis_rhel8_linux.yml.disabled          cis_win10_enterprise.yml.disabled
cis_centos6_linux.yml.disabled      cis_rhel9_linux.yml.disabled          cis_win11_enterprise.yml.disabled
cis_centos7_linux.yml.disabled      cis_rocky_linux_9.yml                 cis_win2012r2.yml.disabled
cis_centos8_linux.yml.disabled      cis_sles11_linux.yml.disabled         cis_win2016.yml.disabled
cis_debian10.yml.disabled           cis_sles12_linux.yml.disabled         cis_win2019.yml.disabled
cis_debian7.yml.disabled            cis_sles15_linux.yml.disabled         cis_win2022.yml.disabled
cis_debian8.yml.disabled            cis_solaris11.4.yml.disabled          sca_unix_audit.yml.disabled
cis_debian9.yml.disabled            cis_solaris11.yml.disabled            web_vulnerabilities.yml.disabled
cis_iis_10.yml.disabled             cis_sqlserver_2012.yml.disabled
[root@rockylinux9 vagrant]# 

[vikman90]

PR #2303 ready, blocked by wazuh/wazuh#17810.

[mjcr99]

Issue updates

(15/01/2024) - Updated PR with the requested changes to add Rocky Linux 9 SCA files. The PR has been tested, the resulting packages contain the new files as expected:

Manager

Manager package build: https://ci.wazuh.info/job/Packages_builder/180778

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-manager-4.8.1-rl9.x86_64.rpm
Rocky Linux 9 - BaseOS                          2.3 MB/s | 2.2 MB     00:00    
Rocky Linux 9 - AppStream                       1.9 MB/s | 7.4 MB     00:03    
Rocky Linux 9 - Extras                           14 kB/s |  14 kB     00:00    
wazuh-manager-4.8.1-rl9.x86_64.rpm               21 MB/s | 351 MB     00:16    
Dependencies resolved.
================================================================================
 Package              Architecture  Version           Repository           Size
================================================================================
Installing:
 wazuh-manager        x86_64        4.8.1-rl9         @commandline        351 M

Transaction Summary
================================================================================
Install  1 Package

Total size: 351 M
Installed size: 856 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Installing       : wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Running scriptlet: wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Verifying        : wazuh-manager-4.8.1-rl9.x86_64                         1/1 

Installed:
  wazuh-manager-4.8.1-rl9.x86_64                                                

Complete!

SCA file found:

[root@localhost vagrant]# ls /var/ossec/ruleset/sca/
cis_amazon_linux_1.yml.disabled       cis_rhel6_linux.yml.disabled
cis_amazon_linux_2023.yml.disabled    cis_rhel7_linux.yml.disabled
cis_amazon_linux_2.yml.disabled       cis_rhel8_linux.yml.disabled
cis_apache_24.yml.disabled            cis_rhel9_linux.yml.disabled
cis_apple_macOS_10.11.yml.disabled    cis_rocky_linux_8.yml.disabled
cis_apple_macOS_10.12.yml.disabled    cis_rocky_linux_9.yml
cis_apple_macOS_10.13.yml.disabled    cis_sles11_linux.yml.disabled
cis_apple_macOS_10.14.yml.disabled    cis_sles12_linux.yml.disabled
cis_apple_macOS_10.15.yml.disabled    cis_sles15_linux.yml.disabled
cis_apple_macOS_11.1.yml.disabled     cis_solaris11.4.yml.disabled
cis_apple_macOS_12.0.yml.disabled     cis_solaris11.yml.disabled
cis_apple_macOS_13.x.yml.disabled     cis_sqlserver_2012.yml.disabled
cis_apple_macOS_14.0.yml.disabled     cis_sqlserver_2014.yml.disabled
cis_centos6_linux.yml.disabled        cis_sqlserver_2016.yml.disabled
cis_centos7_linux.yml.disabled        cis_sqlserver_2017.yml.disabled
cis_centos8_linux.yml.disabled        cis_sqlserver_2019.yml.disabled
cis_debian10.yml.disabled             cis_ubuntu14-04.yml.disabled
cis_debian11.yml.disabled             cis_ubuntu16-04.yml.disabled
cis_debian12.yml.disabled             cis_ubuntu18-04.yml.disabled
cis_debian7.yml.disabled              cis_ubuntu20-04.yml.disabled
cis_debian8.yml.disabled              cis_ubuntu22-04.yml.disabled
cis_debian9.yml.disabled              cis_win10_enterprise.yml.disabled
cis_iis_10.yml.disabled               cis_win11_enterprise.yml.disabled
cis_mongodb_36.yml.disabled           cis_win2012r2.yml.disabled
cis_mysql5-6_community.yml.disabled   cis_win2016.yml.disabled
cis_mysql5-6_enterprise.yml.disabled  cis_win2019.yml.disabled
cis_nginx_1.yml.disabled              cis_win2022.yml.disabled
cis_oracle_database_19c.yml.disabled  sca_unix_audit.yml.disabled
cis_postgre-sql-13.yml.disabled       web_vulnerabilities.yml.disabled
cis_rhel5_linux.yml.disabled

Agent

Agent package build: https://ci.wazuh.info/job/Packages_builder/180779

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-agent-4.8.1-rl9.x86_64.rpm
Rocky Linux 9 - BaseOS                         1.0 MB/s | 2.2 MB     00:02    
Rocky Linux 9 - AppStream                      1.5 MB/s | 7.4 MB     00:04    
Rocky Linux 9 - Extras                          25 kB/s |  14 kB     00:00    
wazuh-agent-4.8.1-rl9.x86_64.rpm               3.8 MB/s | 9.3 MB     00:02    
Dependencies resolved.
===============================================================================
 Package            Architecture  Version            Repository           Size
===============================================================================
Installing:
 wazuh-agent        x86_64        4.8.1-rl9          @commandline        9.3 M

Transaction Summary
===============================================================================
Install  1 Package

Total size: 9.3 M
Installed size: 27 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                       1/1 
  Running scriptlet: wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Installing       : wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Running scriptlet: wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Verifying        : wazuh-agent-4.8.1-rl9.x86_64                          1/1 

Installed:
  wazuh-agent-4.8.1-rl9.x86_64                                                 

Complete!

SCA file found:

[root@localhost vagrant]#  ls /var/ossec/ruleset/sca
cis_rocky_linux_9.yml