Fix documentation warnings from sphinx

Many of the documentation pages in the security role aren't
meant to be displayed in a table of contents, and this was generating
lots of warnings in the sphinx output. This patch sets the :orphan:
tag on any pages that shouldn't appear inside a toctree.

Change-Id: I1b1f95e35946731ab1122bb1835bbd448b356acc

doc/source/controls.rst

@@ -2,7 +2,7 @@
 `Home <index.html>`__ |raquo| Security hardening for openstack-ansible
 
 Security hardening controls in detail
-=================================
+=====================================
 
 .. toctree::
    :maxdepth: 2

doc/source/developer-notes/V-38437.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 If ``autofs`` is installed, it will be disabled by Ansible tasks. To opt-out
 of this change, adjust the following variable:
 

doc/source/developer-notes/V-38438.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Adjusting the bootloader configuration can cause issues with reboots and this

doc/source/developer-notes/V-38439.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Although adding centralized authentication and carefully managing user

doc/source/developer-notes/V-38443.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The ``/etc/gshadow`` file is owned by root by default on Ubuntu 14.04, Ubuntu
 16.04 and CentOS 7. The security role ensures that the file is owned by root.

doc/source/developer-notes/V-38444.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 See V-38551 for additional details. IPv6 configuration and filtering is left

doc/source/developer-notes/V-38445.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The logs generated by the audit daemon are owned by root in Ubuntu 14.04,
 Ubuntu 16.04 and CentOS 7. The Ansible task for V-38445 ensures that the files
 are owned by the root user.

doc/source/developer-notes/V-38446.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Forwarding root's email to another user is highly recommended, but the Ansible
 tasks won't configure an email address to receive root's email unless that
 email address is configured. Set ``security_root_forward_email`` to an email

doc/source/developer-notes/V-38447.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Although Ubuntu provides the ``debsums`` command for checking the contents of

doc/source/developer-notes/V-38448.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Although the ``/etc/gshadow`` file is group-owned by root by default, the
 Ansible tasks will ensure that it is configured that way.

doc/source/developer-notes/V-38449.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The ``/etc/gshadow`` file's permissions will be changed to ``0000`` to meet
 the requirements of the STIG.

doc/source/developer-notes/V-38450.rst

@@ -1 +1,3 @@
+:orphan:
+
 The ownership of ``/etc/passwd`` will be changed to root.

doc/source/developer-notes/V-38451.rst

@@ -1 +1,3 @@
+:orphan:
+
 The group ownership for ``/etc/passwd`` will be set to root.

doc/source/developer-notes/V-38453.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception for Ubuntu**
 
 Verifying ownership and permissions of installed packages isn't possible in the

doc/source/developer-notes/V-38455.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Configuring another mount for ``/tmp`` can disrupt a running system and this

doc/source/developer-notes/V-38456.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Configuring another mount for ``/var`` can disrupt a running system and this

doc/source/developer-notes/V-38457.rst

@@ -1 +1,3 @@
+:orphan:
+
 The permissions for ``/etc/passwd`` will be set to ``0644``.

doc/source/developer-notes/V-38458.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The Ansible task will ensure that the ``/etc/group`` file is owned by the root
 user.

doc/source/developer-notes/V-38459.rst

@@ -1 +1,3 @@
+:orphan:
+
 The tasks in file_perms.yml will ensure that "/etc/group" is owned by the root account.

doc/source/developer-notes/V-38460.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible tasks will check for ``all_squash`` in ``/etc/exports`` (if it is
 present). If found, a warning message will be printed. No configuration
 changes will be made since neither Ubuntu or openstack-ansible configures

doc/source/developer-notes/V-38461.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Ubuntu sets the mode of ``/etc/group`` to ``0644`` by default and the Ansible
 task will ensure that it is current set to those permissions.

doc/source/developer-notes/V-38462.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 All versions of Ubuntu and CentOS supported by the role verify packages against
 GPG signatures by default.
 

doc/source/developer-notes/V-38463.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Configuring a separate partition for ``/var/log`` is currently left up to the

doc/source/developer-notes/V-38464.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The default configuration for ``disk_error_action`` is ``SUSPEND``, which
 only suspends audit logging when there is a disk error on the system.
 Suspending audit logging can lead to security problems because the system is no

doc/source/developer-notes/V-38465.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Ubuntu 14.04, Ubuntu 16.04 and CentOS 7 set library files to have ``0755`` (or

doc/source/developer-notes/V-38466.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 As with V-38465, Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 set the ownership of

doc/source/developer-notes/V-38467.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Storing audit logs on a separate partition is recommended, but this change

doc/source/developer-notes/V-38468.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The default configuration for ``disk_full_action`` is ``SUSPEND``, which only
 suspends audit logging. Suspending audit logging can lead to security problems
 because the system is no longer keeping track of which syscalls were made.

doc/source/developer-notes/V-38469.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 set the permissions for system

doc/source/developer-notes/V-38470.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The default configuration for ``security_space_left_action`` is ``SUSPEND``,
 which actually only suspends audit logging. Suspending audit logging can lead
 to security problems because the system is no longer keeping track of which

doc/source/developer-notes/V-38471.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 An Ansible task will adjust ``active`` from `no` to `yes` in
 ``/etc/audisp/plugins.d/syslog.conf`` so that auditd records are forwarded to
 syslog automatically. The auditd daemon will be restarted if the configuration

doc/source/developer-notes/V-38472.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 set system commands to be owned by

doc/source/developer-notes/V-38473.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Creating ``/home`` on a different partition is highly recommended but it is

doc/source/developer-notes/V-38474.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The openstack-ansible roles don't install X by default, so there is no

doc/source/developer-notes/V-38475.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Configuration required**
 
 The STIG recommends passwords to be a minimum of 14 characters in length. To

doc/source/developer-notes/V-38476.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The security role verifies that the GPG keys that correspond to each supported
 Linux distribution are installed on each host. If the GPG keys are not found,
 or if they differ from the list of trusted GPG keys, the playbook execution

doc/source/developer-notes/V-38477.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Configuration required**
 
 The STIG recommends setting a limit of one password change per day. To enable

doc/source/developer-notes/V-38478.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Ubuntu and CentOS do not use the Red Hat Network Service. However, there are

doc/source/developer-notes/V-38479.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Configuration required**
 
 The STIG recommends setting a limit of 60 days before a password must

doc/source/developer-notes/V-38480.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Configuration required**
 
 After enabling password age limits in V-38479, be sure to configure

doc/source/developer-notes/V-38481.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Opt-in required**
 
 Operating system patching policies vary from organization to organization and
@@ -14,7 +16,7 @@ are typically established based on business requirements and risk tolerance.
     and the associated risks prior to enabling automatic upgrades.
 
 Deployers can enable automatic updates by setting
-``security_unattended_upgrades`` to ``True`::
+``security_unattended_upgrades`` to ``True``:
 
 .. code-block:: yaml
 

doc/source/developer-notes/V-38482.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Password complexity requirements are left up to the deployer. Deployers are

doc/source/developer-notes/V-38483.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible task for V-38462 already checks for configurations that would
 disable any GPG checks when installing packages. However, it is possible for
 the root user to override these configurations via command line parameters.

doc/source/developer-notes/V-38484.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 already enable the display of the last
 successful login for a user immediately after login.  An Ansible task ensures
 this setting is applied and restarts the ssh daemon if necessary.

doc/source/developer-notes/V-38486.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 System backups are left to the deployer to configure. Deployers are stringly

doc/source/developer-notes/V-38487.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible task for V-38462 already checks for apt configurations that would
 disable any GPG checks when installing packages. However, it's possible for
 the root user to override these configurations via command line parameters.

doc/source/developer-notes/V-38488.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 System backups are left to the deployer to configure. Deployers are stringly

doc/source/developer-notes/V-38489.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The security role installs and configures the ``aide`` package to provide file
 integrity monitoring on the host.

doc/source/developer-notes/V-38490.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Disabling the ``usb-storage`` module can add extra security, but it's not

doc/source/developer-notes/V-38491.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible task will check for the presence of ``/etc/hosts.equiv`` and
 ``/root/.rhosts``.  Both of those files could potentially be used with ``rsh``
 for host access.

doc/source/developer-notes/V-38492.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Virtual consoles are helpful during an emergency and they can only be reached

doc/source/developer-notes/V-38493.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 set the mode of ``/var/log/audit/`` to
 ``0750`` by default. The Ansible task for this requirement ensures that the
 mode is ``0750`` (which is more strict than the STIG requirement).

doc/source/developer-notes/V-38494.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Removing serial consoles from ``/etc/securetty`` can make troubleshooting

doc/source/developer-notes/V-38495.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The Ansible tasks will ensure that files in ``/var/log/audit`` are owned
 by the root user.

doc/source/developer-notes/V-38496.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The Ansible tasks will check for default system accounts (other than root)

doc/source/developer-notes/V-38497.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Ubuntu 14.04, Ubuntu 16.04, and CentOS 7 allow accounts with null passwords to
 authenticate via PAM by default. This STIG requires that those login attempts
 are blocked.

doc/source/developer-notes/V-38498.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Ubuntu and CentOS set the current audit log (the one that is actively being
 written to) to ``0600`` so that only the root user can read and write to it.
 The older, rotated logs are set to ``0400`` since they should not receive

doc/source/developer-notes/V-38499.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The Ansible task will search for password hashes in ``/etc/passwd`` using
 awk and report a failure if any are found.

doc/source/developer-notes/V-38500.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible tasks will search for accounts in ``/etc/passwd`` that have UID 0
 that aren't the normal root account. If any matching accounts are found, a
 warning is printed to stdout and the Ansible play will fail.

doc/source/developer-notes/V-38501.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception and opt-in alternative**
 
 Adjusting PAM configurations is very risky since it affects how all users

doc/source/developer-notes/V-38502.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The user and group ownership of ``/etc/passwd`` is root by default. The Ansible
 task will ensure that the default is maintained.

doc/source/developer-notes/V-38503.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 The user and group ownership of ``/etc/passwd`` is root by default. The Ansible
 task will ensure that the default is maintained.

doc/source/developer-notes/V-38504.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Ubuntu 14.04 and Ubuntu 16.04 set the mode of ``/etc/shadow`` to ``0640``, but
 CentOS 7 sets it to ``000``. The STIG requires the mode to be ``000`` and the
 Ansible tasks in the security role ensure that the mode meets the requirement.

doc/source/developer-notes/V-38511.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Special Case**
 
 Running virtual infrastructure requires IP forwarding to be enabled on various

doc/source/developer-notes/V-38512.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Although a minimal set of iptables rules are configured on openstack-ansible

doc/source/developer-notes/V-38514.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Datagram Congestion Control Protocol (DCCP) must be disabled if it's not
 needed. Although this protocol is occasionally used in some OpenStack
 environments for quality of service functions, it is not in the default

doc/source/developer-notes/V-38515.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Stream Control Transmission Protocol (SCTP) must be disabled. To opt-out of
 this change, set the following variable to ``no``:
 

doc/source/developer-notes/V-38516.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The `Reliable Datagram Sockets (RDS)`_ protocol must be disabled. The Ansible
 tasks in this role will disable the module.
 

doc/source/developer-notes/V-38517.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The `Transparent Inter-Process Communication (TIPC)`_ protocol must be
 disabled. To opt-out of this change, set the following variable to ``no``:
 

doc/source/developer-notes/V-38518.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Different systems may have different log files populated depending on the type

doc/source/developer-notes/V-38520.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 At the moment, openstack-ansible already sends logs to the rsyslog container

doc/source/developer-notes/V-38522.rst

@@ -1 +1,3 @@
+:orphan:
+
 Rules are added for auditing changes to system time made via ``settimeofday``.

doc/source/developer-notes/V-38523.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The STIG makes several requirements for IPv4 network restrictions, but these

doc/source/developer-notes/V-38524.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 This patch disables ICMPv4 redirects feature on the host.
 Accepting ICMP redirects has few legitimate uses.
 It should be disabled unless it is absolutely required.

doc/source/developer-notes/V-38525.rst

@@ -1 +1,3 @@
+:orphan:
+
 Rules are added for auditing changes to system time done via ``stime``.

doc/source/developer-notes/V-38527.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing changes to system time done via
 ``clock_settime``.

doc/source/developer-notes/V-38528.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The Ansible task in this role will ensure that martian packets are logged to
 rsyslog.  Wikpedia's article on `martian packets`_ provides additional
 information.

doc/source/developer-notes/V-38530.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added to auditd to log all attempts to change the system time using
 ``/etc/localtime``.

doc/source/developer-notes/V-38531.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The audit rules from V-38534 already cover all account modifications.

doc/source/developer-notes/V-38534.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Audit rules are added in a task so that any events associated with
 account modifications are logged. The new audit rule will be loaded immediately
 with ``augenrules --load``.

doc/source/developer-notes/V-38535.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 By default, Ubuntu 14.04 rejects ICMPv4 packets sent to a broadcast address.
 The Ansible tasks for this STIG configuration ensures that the secure default
 setting is maintained.

doc/source/developer-notes/V-38536.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The audit rules from V-38534 already cover all account modifications.

doc/source/developer-notes/V-38537.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Ubuntu already ignores ICMPv4 bogus error messages by default. The role will
 ensure that this default setting is maintained.

doc/source/developer-notes/V-38538.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The audit rules from V-38534 already cover all account modifications.

doc/source/developer-notes/V-38539.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 The STIG recommends enabling TCP SYN cookies to deal with TCP SYN floods.
 Ubuntu 14.04 already enables SYN cookies by default, and this role will ensure
 that the default is maintained.

doc/source/developer-notes/V-38540.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 Rules are added for auditing network configuration changes. The path to
 Ubuntu's standard network configuration location has replaced the path
 to Red Hat's default network configuration location.

doc/source/developer-notes/V-38541.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 For Ubuntu, rules are added to auditd that will log any changes made in the
 ``/etc/apparmor`` directory.
 

doc/source/developer-notes/V-38543.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 The audit rules which monitor ``chmod``, ``fchmod``, and ``fchmodat``

doc/source/developer-notes/V-38545.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditd to log discretionary access control permission
 changes done with chown.

doc/source/developer-notes/V-38546.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Opt-in required**
 
 The STIG requires IPv6 to be disabled system-wide unless it is needed for the

doc/source/developer-notes/V-38548.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Disabling IPv6 redirects can cause issues with OpenStack environments which

doc/source/developer-notes/V-38549.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Adding IPv6 firewalling on OpenStack hosts is left up to the deployer to

doc/source/developer-notes/V-38551.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Filtering IPv6 traffic is left up to the deployer to implement. The

doc/source/developer-notes/V-38552.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes
 made by fchown.

doc/source/developer-notes/V-38554.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes made by
 fchownat.

doc/source/developer-notes/V-38555.rst

@@ -1,3 +1,5 @@
+:orphan:
+
 **Exception**
 
 Adding IPv4 firewalling on OpenStack hosts is left up to the deployer to

doc/source/developer-notes/V-38556.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes made
 by fremovexattr.

doc/source/developer-notes/V-38557.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes made via
 ``fsetxattr``.

doc/source/developer-notes/V-38558.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes made via
 ``lchown``.

doc/source/developer-notes/V-38559.rst

@@ -1,2 +1,4 @@
+:orphan:
+
 Rules are added for auditing discretionary access control changes made via
 ``lremovexattr``.