Feature: fedramp
Description
A feature that configures Garden Linux for Federal Risk and Authorization Management Program (FedRAMP) compliance. It is a meta-feature that includes sub-features for intrusion detection, antivirus, and firewall hardening.
What it does
Installs apparmor and chrony (replacing systemd-timesyncd). Configures FedRAMP-required settings including: FIPS and AppArmor kernel parameters, SSH hardening, resource limits, a pre-login banner, and an IPv4/IPv6 firewall. Includes aide and clamav for intrusion detection and antivirus scanning.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Switches from systemd-timesyncd to chrony, enables AppArmor, and applies FedRAMP configuration. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
pkg.exclude (ref) | Prevents installation of: systemd-timesyncd. |
pkg.include (ref) | Installs: apparmor, chrony. |
file.include/etc/issue.net (file.include) | Pre-login banner displayed to remote users per FedRAMP requirement. |
file.include/etc/chrony/chrony.conf (file.include) | NTP configuration using chrony instead of systemd-timesyncd. |
file.include/etc/firewall/ipv4_flush.sh (file.include) | Script that flushes all IPv4 firewall rules. |
file.include/etc/firewall/ipv4_gl_default.conf (file.include) | Default Garden Linux IPv4 firewall rules. |
file.include/etc/firewall/ipv6_flush.sh (file.include) | Script that flushes all IPv6 firewall rules. |
file.include/etc/firewall/ipv6_gl_default.conf (file.include) | Default Garden Linux IPv6 firewall rules. |
file.include/etc/kernel/cmdline.d/30-fips.cfg (file.include) | Enables FIPS mode in the kernel command line per FedRAMP requirement. |
file.include/etc/kernel/cmdline.d/90-lsm.cfg (file.include) | Sets AppArmor as the active Linux Security Module. |
file.include/etc/security/limits.conf (file.include) | Resource limits per FedRAMP requirements. |
file.include/etc/ssh/sshd_config (file.include) | SSH daemon configuration hardened per FedRAMP requirements. |
file.include/etc/systemd/system/gardenlinux-fw-ipv4.service (file.include) | systemd service that applies the Garden Linux IPv4 firewall rules at boot. |
file.include/etc/systemd/system/gardenlinux-fw-ipv6.service (file.include) | systemd service that applies the Garden Linux IPv6 firewall rules at boot. |
Related features
Includes:
aide— host-based intrusion detection required by FedRAMP.clamav— antivirus scanning required by FedRAMP.
Excludes (incompatible with):
cis—fedrampandcisboth implement overlapping compliance requirements and cannot be composed together.