Merge ~ahasenack/ubuntu/+source/ubuntu-advantage-tools:disco-v18-update into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Andreas Hasenack]

Bileto ticket and ppa: https://bileto.ubuntu.com/#/ticket/3593

The package build runs unit tests, way more comprehensive than the dep8 tests.

This contains all the changes since v17 (available in disco) to what is in the master branch on github, effectively bringing the code in sync. I used git rebase to transport the github commits onto the ubuntu package git repo.

If reviewing each commit, what will complicate things a bit is the revert of "Merge pull request #147 from panlinux/switch-kernel-for-lp".

[Christian Ehrhardt  (paelzer)]

Considering that the content was already reviewed on the actual project I can't find an issue from the packaging perspective.
So Ack?

I took a look at the rest (high level only) and found a few worth to mention:

I was wondering why the Readme.md didn't get an entry for "Canonical CIS Ubuntu Benchmark Audit tool", but all other elements got one - intentional?

Furthermore "FIPS PPA repository" got changed to "FIPS repository", but all the commoncriteria/CIS entries still call it "PPA repository" that feels a bit inconsistent.

How do you want to continue, do you want to fix up the mentioned issues and/or a deeper review of what was changed upstream?
Or would you want to upload v18 as-is (it is a correctly packaged v18) and work on those things fro v19 at the source?

review: Needs Information

[Andreas Hasenack (ahasenack)]

I'll fix that here.

[Andreas Hasenack (ahasenack)]

Updated and pushed. There are other mentions of "PPA" elsewhere in the code (status messages, that kind of thing), but changing those is a bigger chunk of work as it also affects tests and UI. I would prefer to change that in a later version. The PPA change you noted in the help output was indeed an oversight and what I did is just a continuation of https://github.com/CanonicalLtd/ubuntu-advantage-script/pull/153, so that's OK to do here.

I also updated the README.md file regarding the CIS audit tool. No URL for it yet, though, so I'll just leave it mentioned.

[Christian Ehrhardt  (paelzer)]

Thanks, the packaging and the changes in general LGTM

review: Approve

[Andreas Hasenack (ahasenack)]

Tagged and uploaded.

diff --git a/README.md b/README.md
index f18d214..b217889 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,8 @@ Currently it supports the following:
 - [Ubuntu Extended Security Maintenance](https://ubuntu.com/esm) archive.
 - [Canonical Livepatch](https://www.ubuntu.com/server/livepatch) service for managed live kernel patching.
 - Canonical FIPS 140-2 Certified Modules. Install Configure and Enable FIPS modules.
+- Canonical Common Criteria EAL2 certification artifacts provisioning
+- Canonical CIS Ubuntu Benchmark Audit tool
 
 Run 
 
diff --git a/debian/changelog b/debian/changelog
index 39ea084..6b4db06 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+ubuntu-advantage-tools (18) disco; urgency=medium
+
+  [ Andreas Hasenack ]
+  * Have ua status cope with the additional livepatch status of running a
+    kernel that is not supported for livepatches.
+
+  [ Vineetha Kamath ]
+  * Add support to common criteria EAL2 artifacts installation #144
+  * Add new flag enable-cisaudit to support cis audit
+  * Add support for disable-cc-provisioning
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 14 Jan 2019 16:39:31 -0200
+
 ubuntu-advantage-tools (17) bionic; urgency=medium
 
   * New upstream release (LP: #1759280):
diff --git a/keyrings/ubuntu-cc-keyring.gpg b/keyrings/ubuntu-cc-keyring.gpg
 new file mode 100644
index 0000000..d00f63f
 Binary files /dev/null and b/keyrings/ubuntu-cc-keyring.gpg differ
diff --git a/keyrings/ubuntu-securitybenchmarks-keyring.gpg b/keyrings/ubuntu-securitybenchmarks-keyring.gpg
 new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/keyrings/ubuntu-securitybenchmarks-keyring.gpg
diff --git a/modules/service-cc.sh b/modules/service-cc.sh
 new file mode 100644
index 0000000..2995c33
--- /dev/null
+++ b/modules/service-cc.sh
@@ -0,0 +1,75 @@
+# shellcheck disable=SC2034,SC2039
+ 
+CC_PROVISIONING_SERVICE_TITLE="Canonical Common Criteria EAL2 Provisioning"
+CC_PROVISIONING_SUPPORTED_SERIES="xenial"
+CC_PROVISIONING_SUPPORTED_ARCHS="x86_64 ppc64le s390x"
+
+CC_PROVISIONING_REPO_URL="https://private-ppa.launchpad.net/ubuntu-advantage/commoncriteria"
+CC_PROVISIONING_REPO_KEY_FILE="ubuntu-cc-keyring.gpg"
+CC_PROVISIONING_REPO_LIST=${CC_PROVISIONING_REPO_LIST:-"/etc/apt/sources.list.d/ubuntu-cc-${SERIES}.list"}
+CC_PROVISIONING_UBUNTU_COMMONCRITERIA="ubuntu-commoncriteria"
+
+cc_provisioning_enable() {
+    local token="$1"
+    local result=0
+
+    _cc_is_installed || result=$?
+    if [ $result -eq 0 ]; then
+        error_msg "Common Criteria artifacts are already installed and available in /usr/lib/common-criteria."
+        error_exit service_already_enabled
+    fi
+
+    check_token "$CC_PROVISIONING_REPO_URL" "$token"
+    apt_add_repo "$CC_PROVISIONING_REPO_LIST" "$CC_PROVISIONING_REPO_URL" "$token" \
+                 "${KEYRINGS_DIR}/${CC_PROVISIONING_REPO_KEY_FILE}"
+    apt_install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
+    apt_install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
+    echo -n 'Running apt-get update... '
+    check_result apt_get update
+    echo 'Ubuntu Common Criteria PPA repository enabled.'
+
+    echo -n 'Installing Common Criteria artifacts (this may take a while)... '
+    # shellcheck disable=SC2086
+    check_result apt_get install $CC_PROVISIONING_UBUNTU_COMMONCRITERIA
+
+    echo "Successfully prepared this machine to host the Common Criteria artifacts."
+    echo "Please follow instructions in /usr/share/doc/ubuntu-commoncriteria/README to configure EAL2 on the target machine(s)."
+}
+
+cc_provisioning_disable() {
+    if [ -f "$CC_PROVISIONING_REPO_LIST" ]; then
+        apt_remove_repo "$CC_PROVISIONING_REPO_LIST" "$CC_PROVISIONING_REPO_URL" \
+                        "$APT_KEYS_DIR/$CC_PROVISIONING_REPO_KEY_FILE"
+        echo -n 'Running apt-get update... '
+        check_result apt_get update
+        echo 'Canonical Common Criteria EAL2 Provisioning Disabled.'
+    else
+        echo 'Canonical Common Criteria EAL2 Provisioning is not Enabled.'
+    fi
+
+    if apt_is_package_installed $CC_PROVISIONING_UBUNTU_COMMONCRITERIA; then
+        check_result apt_get remove $CC_PROVISIONING_UBUNTU_COMMONCRITERIA
+        echo 'Canonical Common Criteria EAL2 Artifacts Removed.'
+    fi
+}
+
+cc_provisioning_is_enabled() {
+    _cc_is_installed
+}
+
+cc_provisioning_print_status() {
+    echo "cc-provisioning: artifacts are in /usr/lib/common-criteria"
+}
+
+_cc_is_installed() {
+    apt_is_package_installed ubuntu-commoncriteria && return 0 
+}
+
+cc_provisioning_validate_token() {
+    local token="$1"
+
+    if ! validate_user_pass_token "$token"; then
+        error_msg 'Invalid token, it must be in the form "user:password"'
+        return 1
+    fi
+}
diff --git a/modules/service-cis.sh b/modules/service-cis.sh
 new file mode 100644
index 0000000..12fb3e4
--- /dev/null
+++ b/modules/service-cis.sh
@@ -0,0 +1,75 @@
+# shellcheck disable=SC2034,SC2039
+ 
+CISAUDIT_SERVICE_TITLE="Canonical CIS Benchmark 16.04 Audit Tool"
+CISAUDIT_SUPPORTED_SERIES="xenial"
+CISAUDIT_SUPPORTED_ARCHS="x86_64 ppc64le s390x"
+
+CISAUDIT_REPO_URL="https://private-ppa.launchpad.net/ubuntu-advantage/security-benchmarks"
+CISAUDIT_REPO_KEY_FILE="ubuntu-securitybenchmarks-keyring.gpg"
+CISAUDIT_REPO_LIST=${CISAUDIT_REPO_LIST:-"/etc/apt/sources.list.d/ubuntu-cis-${SERIES}.list"}
+CISAUDIT_UBUNTU_CISBENCHMARK="ubuntu-cisbenchmark-16.04"
+
+cisaudit_enable() {
+    local token="$1"
+    local result=0
+
+    _cisaudit_is_installed || result=$?
+    if [ $result -eq 0 ]; then
+        error_msg "CIS benchmark audit package is already installed and files are available in /usr/share/ubuntu-securityguides/$CISAUDIT_UBUNTU_CISBENCHMARK."
+        error_exit service_already_enabled
+    fi
+
+    check_token "$CISAUDIT_REPO_URL" "$token"
+    apt_add_repo "$CISAUDIT_REPO_LIST" "$CISAUDIT_REPO_URL" "$token" \
+                 "${KEYRINGS_DIR}/${CISAUDIT_REPO_KEY_FILE}"
+    apt_install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
+    apt_install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
+    echo -n 'Running apt-get update... '
+    check_result apt_get update
+    echo 'Ubuntu Security Benchmarks PPA repository enabled.'
+
+    echo -n 'Installing CIS audit benchmark tool (this may take a while)... '
+    # shellcheck disable=SC2086
+    check_result apt_get install $CISAUDIT_UBUNTU_CISBENCHMARK
+
+    echo "Successfully installed the CIS audit tool."
+    echo "Please follow instructions in /usr/share/doc/$CISAUDIT_UBUNTU_CISBENCHMARK/README to run the CIS audit tool on the target machine(s)."
+}
+
+cisaudit_disable() {
+    if [ -f "$CISAUDIT_REPO_LIST" ]; then
+        apt_remove_repo "$CISAUDIT_REPO_LIST" "$CISAUDIT_REPO_URL" \
+                        "$APT_KEYS_DIR/$CISAUDIT_REPO_KEY_FILE"
+        echo -n 'Running apt-get update... '
+        check_result apt_get update
+        echo "Canonical CIS Benchmark 16.04 Audit Tool Repository Disabled."
+    else
+        echo 'Canonical CIS Benchmark 16.04 Audit Tool Repository is not Enabled.'
+    fi
+
+    if apt_is_package_installed $CISAUDIT_UBUNTU_CISBENCHMARK; then
+        check_result apt_get remove $CISAUDIT_UBUNTU_CISBENCHMARK
+        echo 'Canonical CIS Benchmark 16.04 Audit Tool Removed.'
+    fi
+}
+
+cisaudit_is_enabled() {
+    _cisaudit_is_installed
+}
+
+cisaudit_print_status() {
+    echo "cisaudit: files are in /usr/share/ubuntu-securityguides/$CISAUDIT_UBUNTU_CISBENCHMARK"
+}
+
+_cisaudit_is_installed() {
+    apt_is_package_installed $CISAUDIT_UBUNTU_CISBENCHMARK && return 0 
+}
+
+cisaudit_validate_token() {
+    local token="$1"
+
+    if ! validate_user_pass_token "$token"; then
+        error_msg 'Invalid token, it must be in the form "user:password"'
+        return 1
+    fi
+}
diff --git a/modules/service-livepatch.sh b/modules/service-livepatch.sh
index 0e35020..d7e920d 100644
--- a/modules/service-livepatch.sh
+++ b/modules/service-livepatch.sh
@@ -45,7 +45,7 @@ livepatch_disable() {
 
     echo 'Disabling Livepatch...'
     canonical-livepatch disable
-    if [ "$remove_snap" ]; then
+    if [ -n "$remove_snap" ]; then
         echo 'Removing the canonical-livepatch snap...'
         snap remove canonical-livepatch
     else
@@ -59,8 +59,20 @@ livepatch_is_enabled() {
     canonical-livepatch status >/dev/null 2>&1 || return 1
 }
 
+livepatch_disabled_reason() {
+    local output
+    local result=0
+    local unsupported_kernel_msg="is not eligible for livepatch updates"
+
+    output=$(canonical-livepatch status 2>&1) || result=$?
+    if echo "${output}" | grep -q "${unsupported_kernel_msg}"; then
+        echo " (unsupported kernel)"
+    fi
+}
+
 livepatch_print_status() {
-    canonical-livepatch status
+    # remove empty lines
+    canonical-livepatch status | grep -vE '^[[:blank:]]*$'
 }
 
 livepatch_validate_token() {
diff --git a/modules/service.sh b/modules/service.sh
index 26dc63e..f8e8d80 100644
--- a/modules/service.sh
+++ b/modules/service.sh
@@ -49,15 +49,23 @@ service_print_status() {
         status="disabled"
         if ! is_supported "$series" "$archs"; then
             status+=" (not available)"
+        else
+            status+=$(service_disabled_reason "${service}")
         fi
     fi
 
-    echo "$service: $status"
+    echo "${service//_/-}: $status"
     if [ "$status" = enabled ]; then
         _service_print_detailed_status "$service"
     fi
 }
 
+service_disabled_reason() {
+    local service="$1"
+
+    call_if_defined "${service}_disabled_reason"
+}
+
 service_check_user() {
     if [ "$(id -u)" -ne 0 ]; then
         error_msg "This command must be run as root (try using sudo)"
diff --git a/tests/fakes.py b/tests/fakes.py
index 0075504..ca6566d 100644
--- a/tests/fakes.py
+++ b/tests/fakes.py
@@ -30,6 +30,16 @@ EOF
 fi
 """
 
+# regardless of the command, canonical-livepatch will always exit with
+# status 1 and a message like this
+LIVEPATCH_UNSUPPORTED_KERNEL = """
+cat <<EOF
+2018/05/24 18:51:29 cannot use livepatch: your kernel "4.15.0-1010-kvm" \
+is not eligible for livepatch updates
+EOF
+exit 1
+"""
+
 LIVEPATCH_ENABLED = """
 if [ "$1" = "status" ]; then
     cat <<EOF
@@ -50,6 +60,10 @@ status:
       * CVE-2015-7837 LP: #1509563
       * CVE-2016-0758 LP: #1581202
 EOF
+# empty lines, for regression testing of
+# https://github.com/CanonicalLtd/ubuntu-advantage-script/issues/145
+echo
+echo
 elif [ "$1" = "enable" ]; then
     echo -n "2017/08/04 18:03:47 Error executing enable?auth-token="
     echo "deafbeefdeadbeefdeadbeefdeadbeef."
@@ -159,6 +173,12 @@ fips: disabled (not available)
 livepatch: disabled (not available)
 """
 
+STATUS_CACHE_LIVEPATCH_DISABLED_UNSUPPORTED = """\
+esm: disabled (not available)
+fips: disabled (not available)
+livepatch: disabled (unsupported kernel)
+"""
+
 STATUS_CACHE_MIXED_CONTENT = """\
 esm: enabled
     patchState: should-not-be-here
diff --git a/tests/test_cc.py b/tests/test_cc.py
 new file mode 100644
index 0000000..04ab50b
--- /dev/null
+++ b/tests/test_cc.py
@@ -0,0 +1,186 @@
+"""Tests for CC-related commands."""
+
+from testing import UbuntuAdvantageTest
+
+
+class CCTest(UbuntuAdvantageTest):
+
+    SERIES = 'xenial'
+    ARCH = 'x86_64'
+
+    def setUp(self):
+        super().setUp()
+        self.setup_cc()
+
+    def test_enable_cc_provisioning(self):
+        """The enable-cc-provisioning enables commoncriteria repository."""
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Ubuntu Common Criteria PPA repository enabled.',
+            process.stdout)
+        expected = (
+            'deb https://private-ppa.launchpad.net/ubuntu-advantage/'
+            'commoncriteria/ubuntu xenial main\n'
+            '# deb-src https://private-ppa.launchpad.net/'
+            'ubuntu-advantage/commoncriteria/ubuntu xenial main\n')
+        self.assertEqual(expected, self.cc_repo_list.read_text())
+        self.assertEqual(
+            self.apt_auth_file.read_text(),
+            'machine private-ppa.launchpad.net/ubuntu-advantage/'
+            'commoncriteria/ubuntu/'
+            ' login user password pass\n')
+        self.assertEqual(self.apt_auth_file.stat().st_mode, 0o100600)
+        keyring_file = self.trusted_gpg_dir / 'ubuntu-cc-keyring.gpg'
+        self.assertEqual('GPG key', keyring_file.read_text())
+        self.assertIn(
+            'Successfully prepared this machine to host'
+            ' the Common Criteria artifacts',
+            process.stdout)
+        # the apt-transport-https dependency is already installed
+        self.assertNotIn(
+            'Installing missing dependency apt-transport-https',
+            process.stdout)
+
+    def test_enable_cc_provisioning_auth_if_other_entries(self):
+        """Existing auth.conf entries are preserved."""
+        auth = 'machine example.com login user password pass\n'
+        self.apt_auth_file.write_text(auth)
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(auth, self.apt_auth_file.read_text())
+
+    def test_enable_cc_provisioning_install_apt_transport_https(self):
+        """enable-cc-provisioning installs apt-transport-https if needed."""
+        self.apt_method_https.unlink()
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Installing missing dependency apt-transport-https',
+            process.stdout)
+
+    def test_enable_cc_provisioning_install_apt_transport_https_fails(self):
+        """Stderr is printed if apt-transport-https install fails."""
+        self.apt_method_https.unlink()
+        self.make_fake_binary('apt-get', command='echo failed >&2; false')
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(1, process.returncode)
+        self.assertIn('failed', process.stderr)
+
+    def test_enable_cc_provisioning_install_ca_certificates(self):
+        """enable-fips installs ca-certificates if needed."""
+        self.ca_certificates.unlink()
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Installing missing dependency ca-certificates',
+            process.stdout)
+
+    def test_enable_cc_provisioning_install_ca_certificates_fails(self):
+        """Stderr is printed if ca-certificates install fails."""
+        self.ca_certificates.unlink()
+        self.make_fake_binary('apt-get', command='echo failed >&2; false')
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(1, process.returncode)
+        self.assertIn('failed', process.stderr)
+
+    def test_enable_cc_provisioning_missing_token(self):
+        """The token must be specified when using enable-fips."""
+        process = self.script('enable-cc-provisioning')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_enable_cc_provisioning_invalid_token_format(self):
+        """The CC token must be specified as "user:password"."""
+        process = self.script('enable-cc-provisioning', 'foo-bar')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_enable_cc_provisioning_invalid_token(self):
+        """If token is invalid, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  401  Unauthorized [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn('Invalid token', process.stderr)
+
+    def test_enable_cc_provisioning_error_checking_token(self):
+        """If token check fails, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  404  Not Found [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn(
+            'Failed checking token (404  Not Found [IP: 1.2.3.4])',
+            process.stderr)
+
+    def test_enable_cc_provisioning_skip_token_check_no_helper(self):
+        """If apt-helper is not found, the token check is skipped."""
+        self.apt_helper.unlink()
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn('Checking token... SKIPPED', process.stdout)
+
+    def test_enable_cc_provisioning_only_supported_on_xenial(self):
+        """The enable-cc-provisioning option fails if not on Xenial."""
+        self.SERIES = 'zesty'
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(4, process.returncode)
+        self.assertIn(
+            'Canonical Common Criteria EAL2 Provisioning is '
+            'not supported on zesty',
+            process.stderr)
+
+    def test_unsupported_on_i686(self):
+        """CC is unsupported on i686 arch."""
+        self.ARCH = 'i686'
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(7, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical Common Criteria EAL2 Provisioning '
+            'is not supported on i686',
+            process.stderr)
+
+    def test_unsupported_on_arm64(self):
+        """CC is unsupported on arm64 arch."""
+        self.ARCH = 'arm64'
+        process = self.script('enable-cc-provisioning', 'user:pass')
+        self.assertEqual(7, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical Common Criteria EAL2 Provisioning '
+            'is not supported on arm64',
+            process.stderr)
+
+    def test_disable_cc_provisioning(self):
+        """The disable-cc-provisioning option disables commoncriteria repo."""
+        self.setup_cc(enabled=True)
+        other_auth = 'machine example.com login user password pass\n'
+        self.apt_auth_file.write_text(other_auth)
+        process = self.script('disable-cc-provisioning')
+        self.assertEqual(0, process.returncode)
+        self.assertFalse(self.cc_repo_list.exists())
+        # the keyring file is removed
+        keyring_file = self.trusted_gpg_dir / 'ubuntu-cc-keyring.gpg'
+        self.assertFalse(keyring_file.exists())
+        # credentials are removed
+        self.assertEqual(self.apt_auth_file.read_text(), other_auth)
+
+    def test_disable_cc_provisioning_fails_already_disabled(self):
+        """If commoncriteria repo is not enabled, disable fails."""
+        process = self.script('disable-cc-provisioning')
+        self.assertEqual(8, process.returncode)
+        self.assertIn(
+            'Canonical Common Criteria EAL2 Provisioning is not enabled\n',
+            process.stderr)
diff --git a/tests/test_cisaudit.py b/tests/test_cisaudit.py
 new file mode 100644
index 0000000..47b2784
--- /dev/null
+++ b/tests/test_cisaudit.py
@@ -0,0 +1,187 @@
+"""Tests for CISAudit-related commands."""
+
+from testing import UbuntuAdvantageTest
+
+
+class CISAUDITTest(UbuntuAdvantageTest):
+
+    SERIES = 'xenial'
+    ARCH = 'x86_64'
+
+    def setUp(self):
+        super().setUp()
+        self.setup_cisaudit()
+
+    def test_enable_cisaudit(self):
+        """The enable-cisaudit enables security benchmarks repository."""
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Ubuntu Security Benchmarks PPA repository enabled.',
+            process.stdout)
+        expected = (
+            'deb https://private-ppa.launchpad.net/ubuntu-advantage/'
+            'security-benchmarks/ubuntu xenial main\n'
+            '# deb-src https://private-ppa.launchpad.net/'
+            'ubuntu-advantage/security-benchmarks/ubuntu xenial main\n')
+        self.assertEqual(expected, self.cisaudit_repo_list.read_text())
+        self.assertEqual(
+            self.apt_auth_file.read_text(),
+            'machine private-ppa.launchpad.net/ubuntu-advantage/'
+            'security-benchmarks/ubuntu/'
+            ' login user password pass\n')
+        self.assertEqual(self.apt_auth_file.stat().st_mode, 0o100600)
+        cis_keyring = 'ubuntu-securitybenchmarks-keyring.gpg'
+        keyring_file = self.trusted_gpg_dir / cis_keyring
+        self.assertEqual('GPG key', keyring_file.read_text())
+        self.assertIn(
+            'Successfully installed the CIS audit tool.',
+            process.stdout)
+        # the apt-transport-https dependency is already installed
+        self.assertNotIn(
+            'Installing missing dependency apt-transport-https',
+            process.stdout)
+
+    def test_enable_cisaudit_auth_if_other_entries(self):
+        """Existing auth.conf entries are preserved."""
+        auth = 'machine example.com login user password pass\n'
+        self.apt_auth_file.write_text(auth)
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(auth, self.apt_auth_file.read_text())
+
+    def test_enable_cisaudit_install_apt_transport_https(self):
+        """enable-cisaudit installs apt-transport-https if needed."""
+        self.apt_method_https.unlink()
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Installing missing dependency apt-transport-https',
+            process.stdout)
+
+    def test_enable_cisaudit_install_apt_transport_https_fails(self):
+        """Stderr is printed if apt-transport-https install fails."""
+        self.apt_method_https.unlink()
+        self.make_fake_binary('apt-get', command='echo failed >&2; false')
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(1, process.returncode)
+        self.assertIn('failed', process.stderr)
+
+    def test_enable_cisaudit_install_ca_certificates(self):
+        """enable-cisaudit installs ca-certificates if needed."""
+        self.ca_certificates.unlink()
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(
+            'Installing missing dependency ca-certificates',
+            process.stdout)
+
+    def test_enable_cisaudit_install_ca_certificates_fails(self):
+        """Stderr is printed if ca-certificates install fails."""
+        self.ca_certificates.unlink()
+        self.make_fake_binary('apt-get', command='echo failed >&2; false')
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(1, process.returncode)
+        self.assertIn('failed', process.stderr)
+
+    def test_enable_cisaudit_missing_token(self):
+        """The token must be specified when using enable-cisaudit."""
+        process = self.script('enable-cisaudit')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_enable_cisaudit_invalid_token_format(self):
+        """The cisaudit token must be specified as "user:password"."""
+        process = self.script('enable-cisaudit', 'foo-bar')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_enable_cisaudit_invalid_token(self):
+        """If token is invalid, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  401  Unauthorized [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn('Invalid token', process.stderr)
+
+    def test_enable_cisaudit_error_checking_token(self):
+        """If token check fails, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  404  Not Found [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn(
+            'Failed checking token (404  Not Found [IP: 1.2.3.4])',
+            process.stderr)
+
+    def test_enable_cisaudit_skip_token_check_no_helper(self):
+        """If apt-helper is not found, the token check is skipped."""
+        self.apt_helper.unlink()
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(0, process.returncode)
+        self.assertIn('Checking token... SKIPPED', process.stdout)
+
+    def test_enable_cisaudit_only_supported_on_xenial(self):
+        """The enable-cisaudit option fails if not on Xenial."""
+        self.SERIES = 'zesty'
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(4, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical CIS Benchmark 16.04 '
+            'Audit Tool is not supported on zesty\n',
+            process.stderr)
+
+    def test_unsupported_on_i686(self):
+        """CISAudit is unsupported on i686 arch."""
+        self.ARCH = 'i686'
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(7, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical CIS Benchmark 16.04 Audit Tool '
+            'is not supported on i686',
+            process.stderr)
+
+    def test_unsupported_on_arm64(self):
+        """CISAudit is unsupported on arm64 arch."""
+        self.ARCH = 'arm64'
+        process = self.script('enable-cisaudit', 'user:pass')
+        self.assertEqual(7, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical CIS Benchmark 16.04 Audit Tool '
+            'is not supported on arm64',
+            process.stderr)
+
+    def test_disable_cisaudit(self):
+        """The disable-cisaudit option disables security-benchmarks repo."""
+        self.setup_cisaudit(enabled=True)
+        other_auth = 'machine example.com login user password pass\n'
+        self.apt_auth_file.write_text(other_auth)
+        process = self.script('disable-cisaudit')
+        self.assertEqual(0, process.returncode)
+        self.assertFalse(self.cisaudit_repo_list.exists())
+        # the keyring file is removed
+        cis_keyring = 'ubuntu-securitybenchmarks-keyring.gpg'
+        keyring_file = self.trusted_gpg_dir / cis_keyring
+        self.assertFalse(keyring_file.exists())
+        # credentials are removed
+        self.assertEqual(self.apt_auth_file.read_text(), other_auth)
+
+    def test_disable_cisaudit_fails_already_disabled(self):
+        """If security-benchmarks repo is not enabled, disable fails."""
+        process = self.script('disable-cisaudit')
+        self.assertEqual(8, process.returncode)
+        self.assertIn(
+            'Canonical CIS Benchmark 16.04 Audit Tool is not enabled\n',
+            process.stderr)
diff --git a/tests/test_livepatch_motd.py b/tests/test_livepatch_motd.py
index c8beeda..a934f4c 100644
--- a/tests/test_livepatch_motd.py
+++ b/tests/test_livepatch_motd.py
@@ -9,6 +9,7 @@ from fakes import (
     STATUS_CACHE_LIVEPATCH_ENABLED_NO_CONTENT,
     STATUS_CACHE_LIVEPATCH_DISABLED_AVAILABLE,
     STATUS_CACHE_LIVEPATCH_DISABLED_UNAVAILABLE,
+    STATUS_CACHE_LIVEPATCH_DISABLED_UNSUPPORTED,
     STATUS_CACHE_MIXED_CONTENT)
 from random import randrange
 
@@ -98,6 +99,19 @@ class LivepatchMOTDTest(UbuntuAdvantageTest):
         self.assertEqual(0, process.returncode)
         self.assertEqual('', process.stdout)
 
+    def test_disabled_unsupported(self):
+        """Livepatch is disabled and unsupported."""
+        self.KERNEL_VERSION = '4.15.0-1010-kvm'
+        self.ua_status_cache.write_text(
+            STATUS_CACHE_LIVEPATCH_DISABLED_UNSUPPORTED)
+        process = self.script()
+        self.assertEqual(0, process.returncode)
+        self.assertIn('Canonical Livepatch is installed but disabled',
+                      process.stdout)
+        self.assertIn('Kernel {} is not supported (https://bit.ly/'
+                      'livepatch-faq)'.format(self.KERNEL_VERSION),
+                      process.stdout)
+
     def test_other_state_fields_ignored(self):
         """The MOTD script ignores *State fields not from livepatch."""
         self.ua_status_cache.write_text(STATUS_CACHE_MIXED_CONTENT)
diff --git a/tests/test_script.py b/tests/test_script.py
index 4e7da93..ec4be19 100644
--- a/tests/test_script.py
+++ b/tests/test_script.py
@@ -1,6 +1,7 @@
 """Tests for the ubuntu-advantage script."""
 
 from testing import UbuntuAdvantageTest
+from fakes import LIVEPATCH_UNSUPPORTED_KERNEL
 
 
 class UbuntuAdvantageScriptTest(UbuntuAdvantageTest):
@@ -54,6 +55,14 @@ class UbuntuAdvantageScriptTest(UbuntuAdvantageTest):
         self.assertIn("livepatch: disabled (not available)", process.stdout)
         self.assertIn("esm: enabled", process.stdout)
 
+    def test_livepatch_status_no_empty_line(self):
+        """The status output has no empty lines when livepatch is enabled."""
+        self.setup_livepatch(installed=True, enabled=True)
+        process = self.script('status', 'livepatch')
+        lines = process.stdout.split('\n')[:-1]
+        for line in lines:
+            self.assertNotEqual('', line.strip())
+
     def test_status_xenial(self):
         """The status command shows only livepatch available on xenial."""
         self.SERIES = 'xenial'
@@ -91,6 +100,17 @@ class UbuntuAdvantageScriptTest(UbuntuAdvantageTest):
         process = self.script('status', 'unknown')
         self.assertEqual(process.returncode, 1)
 
+    def test_status_livepatch_unsupported_kernel(self):
+        """Livepatch is unavailable on an unsupported kernel."""
+        self.SERIES = 'xenial'
+        self.ARCH = 'x86_64'
+        self.setup_livepatch(
+            installed=True, enabled=False,
+            livepatch_command=LIVEPATCH_UNSUPPORTED_KERNEL)
+        process = self.script('status')
+        self.assertIn('livepatch: disabled (unsupported kernel)',
+                      process.stdout)
+
     def test_version(self):
         """The version command shows the package version."""
         self.make_fake_binary('dpkg-query', command='echo 123')
diff --git a/tests/testing.py b/tests/testing.py
index c684f48..17fc080 100644
--- a/tests/testing.py
+++ b/tests/testing.py
@@ -57,6 +57,8 @@ class UbuntuAdvantageTest(TestWithFixtures):
         self.fips_repo_list = Path(self.tempdir.join('fips-repo.list'))
         self.fips_updates_repo_list = Path(
             self.tempdir.join('fips-updates-repo.list'))
+        self.cc_repo_list = Path(self.tempdir.join('cc-repo.list'))
+        self.cisaudit_repo_list = Path(self.tempdir.join('cisaudit-repo.list'))
         self.fips_repo_preferences = Path(
             self.tempdir.join('preferences-fips'))
         self.fips_updates_repo_preferences = Path(
@@ -82,6 +84,9 @@ class UbuntuAdvantageTest(TestWithFixtures):
         (self.keyrings_dir / 'ubuntu-fips-keyring.gpg').write_text('GPG key')
         (self.keyrings_dir / 'ubuntu-fips-updates-keyring.gpg').write_text(
             'GPG key')
+        (self.keyrings_dir / 'ubuntu-cc-keyring.gpg').write_text('GPG key')
+        (self.keyrings_dir /
+            'ubuntu-securitybenchmarks-keyring.gpg').write_text('GPG key')
         self.cpuinfo.write_text('flags\t\t: fpu apic')
         self.make_fake_binary('apt-get')
         self.make_fake_binary('apt-helper')
@@ -117,12 +122,14 @@ class UbuntuAdvantageTest(TestWithFixtures):
             'ESM_REPO_LIST': str(self.esm_repo_list),
             'FIPS_REPO_LIST': str(self.fips_repo_list),
             'FIPS_UPDATES_REPO_LIST': str(self.fips_updates_repo_list),
+            'CC_PROVISIONING_REPO_LIST': str(self.cc_repo_list),
+            'CISAUDIT_REPO_LIST': str(self.cisaudit_repo_list),
             'FIPS_BOOT_CFG': str(self.boot_cfg),
             'FIPS_BOOT_CFG_DIR': str(self.etc_dir),
             'FIPS_ENABLED_FILE': str(self.fips_enabled_file),
             'FIPS_REPO_PREFERENCES': str(self.fips_repo_preferences),
             'FIPS_UPDATES_REPO_PREFERENCES': str(
-                                        self.fips_updates_repo_preferences),
+                self.fips_updates_repo_preferences),
             'KEYRINGS_DIR': str(self.keyrings_dir),
             'APT_HELPER': str(self.apt_helper),
             'APT_AUTH_FILE': str(self.apt_auth_file),
@@ -174,3 +181,21 @@ class UbuntuAdvantageTest(TestWithFixtures):
             return
         self.make_fake_binary('dpkg-query')
         self.fips_enabled_file.write_text('1' if enabled else '0')
+
+    def setup_cc(self, enabled=False):
+        """Setup the CC repository."""
+        if enabled is True:
+            self.make_fake_binary(
+                'dpkg-query', command='[ $2 = ubuntu-commoncriteria ]')
+        else:
+            self.make_fake_binary(
+                'dpkg-query', command='[ $2 != ubuntu-commoncriteria ]')
+
+    def setup_cisaudit(self, enabled=False):
+        """Setup the CISAudit repository."""
+        if enabled is True:
+            self.make_fake_binary(
+                'dpkg-query', command='[ $2 = ubuntu-cisbenchmark-16.04 ]')
+        else:
+            self.make_fake_binary(
+                'dpkg-query', command='[ $2 != ubuntu-cisbenchmark-16.04 ]')
diff --git a/ubuntu-advantage b/ubuntu-advantage
index 1ad03a5..19293f2 100755
--- a/ubuntu-advantage
+++ b/ubuntu-advantage
@@ -4,7 +4,7 @@
 SCRIPTNAME=$(basename "$0")
 
 # Services managed by the script (in alphabetical order)
-SERVICES="esm fips livepatch"
+SERVICES="cc-provisioning esm fips livepatch cisaudit"
 
 # system details
 SERIES=${SERIES:-$(lsb_release -cs)}
@@ -41,13 +41,13 @@ print_status() {
     local service="$1"
 
     local services="$SERVICES"
-    if [ "$service" ]; then
-        name_in_list "$service" "$SERVICES" || error_exit invalid_command
+    if [ -n "$service" ]; then
+        name_in_list "${service//_/-}" "$SERVICES" || error_exit invalid_command
         services="$service"
     fi
 
     for service in $services; do
-        service_print_status "$service"
+        service_print_status "${service//-/_}"
     done
 }
 
@@ -63,6 +63,8 @@ Currently available are:
 - Canonical FIPS 140-2 Certified Modules
 - Canonical FIPS 140-2 Non-Certified Module Updates
 - Canonical Livepatch Service (https://www.ubuntu.com/server/livepatch)
+- Canonical Common Criteria EAL2 certification artifacts provisioning
+- Canonical CIS Ubuntu Benchmark Audit tool
 
 Commands:
  version                           show the tool version
@@ -70,16 +72,26 @@ Commands:
                                    offerings (or of a specific one if provided)
  enable-esm <TOKEN>                enable the ESM repository
  disable-esm                       disable the ESM repository
- enable-fips <TOKEN>               enable the FIPS PPA repository and install,
+ enable-fips <TOKEN>               enable the FIPS repository and install,
                                    configure and enable FIPS certified modules
  disable-fips                      currently not supported
- enable-fips-updates <TOKEN> [-y]  enable non-certified FIPS-UPDATES PPA
+ enable-fips-updates <TOKEN> [-y]  enable non-certified FIPS-UPDATES
                                    repository and install updates. With an
                                    optional "-y" the user prompt will be
                                    bypassed.
  enable-livepatch <TOKEN>          enable the Livepatch service
  disable-livepatch [-r]            disable the Livepatch service. With "-r", the
                                    canonical-livepatch snap will also be removed
+ enable-cc-provisioning <TOKEN>    enable the commoncriteria repository and
+                                   install the ubuntu-commoncriteria DEB package
+ disable-cc-provisioning           disable the commoncriteria repository and
+                                   remove the ubuntu-commoncriteria DEB package
+ enable-cisaudit <TOKEN>           enable the security benchmarks repository
+                                   and install the ubuntu-cisbenchmark-16.04 DEB
+                                   package.
+ disable-cisaudit                  disable the security benchmarks repository
+                                   and uninstall the ubuntu-cisbenchmark-16.04 DEB
+                                   package.
 EOF
     error_exit invalid_command
 }
@@ -91,11 +103,15 @@ main() {
     local service
     service=$(service_from_command "$command")
     # if the command contains a service name, check that it's valid
-    if [ "$service" ] && ! name_in_list "$service" "$SERVICES" \
+    if [ -n "$service" ] && ! name_in_list "$service" "$SERVICES" \
            && [ "$service" != "fips-updates" ]; then
         error_msg "Invalid command: \"$command\""
         usage
     fi
+    # replace -(hyphen) in service commands with _(underscore) (eg: cc-provisioning) to
+    # use in generic service function invocations. Adding it here so the name_in_list
+    # function call above uses the original command.
+    service=${service//-/_}
 
     case "$command" in
         status)
diff --git a/ubuntu-advantage.1 b/ubuntu-advantage.1
index e86b85d..e53a774 100644
--- a/ubuntu-advantage.1
+++ b/ubuntu-advantage.1
@@ -86,8 +86,42 @@ https://ubuntu.com/livepatch
 .B
 disable-livepatch \fR[\fB\-r\fR]
 Disable the Livepatch service. If the \fB\-r\fR option is given, the
-canonical-livepatch snap will be removed after the sevice is disabled.
+canonical-livepatch snap will be removed after the service is disabled.
 
+.SH CC (Canonical Common Critieria EAL2 Provisioning)
+Enable Common Criteria PPA and install Common Criteria EAL2 artifacts
+.TP
+.B
+enable-cc-provisioning \fItoken\fR
+Enables the Commoncriteria PPA repository, installs the ubuntu-commoncriteria
+package which has the common criteria artifacts. The artifacts include a
+configure script, a tarball with additional packages and post install scripts.
+The artifacts will be installed in /usr/lib/common-criteria directory. The
+evaluated configuration guide and README instructions on how to set up a
+system to be Common Criteria compliant are available in
+/usr/share/doc/ubuntu-commoncriteria directory.
+.TP
+.B
+disable-cc-provisioning
+Disables the commoncriteria PPA repository and removes the ubuntu-commoncriteria
+DEB package.
+.SH CIS (Canonical CIS Audit tooling)
+Enable CIS Auditing PPA and install CIS audit tool package
+.TP
+.B
+enable-cisaudit \fItoken\fR
+Enables the Security Benchmarks PPA, installs the ubuntu-cisbenchmark-16.04
+package which has the CIS Audit tooling files. They include the xccdf and xml
+files and scripts to check compliance against the CIS 16.04 benchmark. The
+files will be installed in
+/usr/share/ubuntu-securityguides/ubuntu-cisbenchmark-16.04.
+The documentation for the tool is available in
+/usr/share/doc/ubuntu-cisbenchmark-16.04.
+.TP
+.B
+disable-cisaudit
+Disables the security benchmarks PPA repository and removes the
+ubuntu-cisbenchmark-16.04 DEB package installed on the machine.
 .SH EXIT STATUS
 .TP
 .B
diff --git a/update-motd.d/80-livepatch b/update-motd.d/80-livepatch
index de59bf1..ee09a73 100755
--- a/update-motd.d/80-livepatch
+++ b/update-motd.d/80-livepatch
@@ -2,6 +2,7 @@
 
 UA=${UA:-"/usr/bin/ubuntu-advantage"}
 UA_STATUS_CACHE=${UA_STATUS_CACHE:-"/var/cache/ubuntu-advantage-tools/ubuntu-advantage-status.cache"}
+KERNEL_VERSION=${KERNEL_VERSION:-"$(uname -r)"}
 
 [ -x "$UA" ] || exit 0
 
@@ -73,6 +74,11 @@ case "$livepatch_status" in
     "disabled (not available)")
         # do nothing
         ;;
+    "disabled (unsupported kernel)")
+        echo
+        echo " * Canonical Livepatch is installed but disabled"
+        echo "   - Kernel ${KERNEL_VERSION} is not supported (https://bit.ly/livepatch-faq)"
+        ;;
     "enabled")
         echo
         echo " * Canonical Livepatch is enabled."