From shawn at redhat.com Thu Aug 20 11:34:48 2015 Content-Type: multipart/mixed; boundary="===============0869718430154452409==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED) Date: Mon, 19 Aug 2013 23:59:57 -0400 Message-ID: <5212E9BD.6000408@redhat.com> In-Reply-To: 4722C175AFAA7C4A85CE84AF00B6D57907C8E5FD@ba-exch1.ds.amrdec.army.mil --===============0869718430154452409== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/19/13 6:07 PM, Beavers, Randall D. CTR (US) wrote: > Willy Santos & Shawn Wells, Willy's no longer with RHT :( He may still be lurking on the list though. > I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists. > (searching CCI information online). > > I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs > to DISA STIGS for my program. Any help would be appreciated. Seems the > DISA IASE website and the VMS site doesn't jive. > > Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that > would help me? In excel format? In xml format? > > Please advise. Various rules are mapped back to policies via the tags. Example is = the selinux_unlabeled_device_files rule: > | > Ensure No Device Files are Unlabeled by SELinux > Device files, which are used for communication with important > system resources, should be labeled with proper SELinux types. If any dev= ice > files carry the SELinux type unlabeled_t, investigate the cause = and > correct the file's context. > > To check for unlabeled device files, run= the following command: >
# ls -RZ /dev | grep unlabeled_t
> It should produce no output in a well-configured system.
> > If a device file carries the SELinux type unlabeled_t, then SELi= nux > cannot properly restrict access to the device file. > > > > > >
| (ref: = https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/= system/selinux.xml) Through this metadata we can associate CCE 26774-0 against the indicated = NIST 800-53 rev3 and DISA CCI requirements. This information is transformed via the 'make tables' transform, which = generates CCI to SRG: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel= 6-srgmap-flat.html and CCI to NIST: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig= -rhel6-server-flat.html Do these help? --===============0869718430154452409== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9SVNP LTg4NTktMSIKICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICA8L2hlYWQ+CiAgPGJv ZHkgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAwMDAwMCI+CiAgICA8ZGl2IGNsYXNzPSJtb3ot Y2l0ZS1wcmVmaXgiPk9uIDgvMTkvMTMgNjowNyBQTSwgQmVhdmVycywgUmFuZGFsbCBELgogICAg ICBDVFIgKFVTKSB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCmNpdGU9Im1p ZDo0NzIyQzE3NUFGQUE3QzRBODVDRTg0QUYwMEI2RDU3OTA3QzhFNUZEQGJhLWV4Y2gxLmRzLmFt cmRlYy5hcm15Lm1pbCIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj4KV2ls bHkgU2FudG9zICZhbXA7IFNoYXduIFdlbGxzLDwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAg V2lsbHkncyBubyBsb25nZXIgd2l0aCBSSFQgOig8YnI+CiAgICAmbmJzcDs8YnI+CiAgICBIZSBt YXkgc3RpbGwgYmUgbHVya2luZyBvbiB0aGUgbGlzdCB0aG91Z2guPGJyPgogICAgPGJyPgogICAg PGJyPgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOjQ3MjJDMTc1QUZBQTdDNEE4NUNFODRBRjAw QjZENTc5MDdDOEU1RkRAYmEtZXhjaDEuZHMuYW1yZGVjLmFybXkubWlsIgogICAgICB0eXBlPSJj aXRlIj4KICAgICAgPHByZSB3cmFwPSIiPkknbSBzZWVpbmcgeW91IGd1eXMgbWFwcGluZyBhIGxv dCBvZiBDQ0lzIHRvIFJIRUwgNiBvbiB0aGUgbGlzdHMuCihzZWFyY2hpbmcgQ0NJIGluZm9ybWF0 aW9uIG9ubGluZSkuCgpJJ20gZG9pbmcgc29tZSB3b3JrIG1hcHBpbmcgdGhlIE5JU1QgODAwLTUz ICh2LjQpIHRvIENDSXMgdG8gRElTQSBTUkdzCnRvIERJU0EgU1RJR1MgZm9yIG15IHByb2dyYW0u ICBBbnkgaGVscCB3b3VsZCBiZSBhcHByZWNpYXRlZC4gIFNlZW1zIHRoZQpESVNBIElBU0Ugd2Vi c2l0ZSBhbmQgdGhlIFZNUyBzaXRlIGRvZXNuJ3Qgaml2ZS4KCkRvIHlvdSBndXlzIGhhdmUgc29t ZSBkZWZpbml0aXZlIG1hcHBpbmdzIGZvciBSSEVMIDYuNCBDQ0VzIC8gQ0NJcyB0aGF0CndvdWxk IGhlbHAgbWU/IEluIGV4Y2VsIGZvcm1hdD8gIEluIHhtbCBmb3JtYXQ/CgpQbGVhc2UgYWR2aXNl LjwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgPGJyPgogICAgVmFyaW91cyBy dWxlcyBhcmUgbWFwcGVkIGJhY2sgdG8gcG9saWNpZXMgdmlhIHRoZSAmbHQ7cmVmJmd0OyB0YWdz LgogICAgRXhhbXBsZSBpcyB0aGUgc2VsaW51eF91bmxhYmVsZWRfZGV2aWNlX2ZpbGVzIHJ1bGU6 PGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIDxtZXRhIGNoYXJzZXQ9InV0 Zi04Ij4KICAgICAgPHByZSBzdHlsZT0ibWFyZ2luOiAwcHg7IHBhZGRpbmc6IDBweDsgY29sb3I6 IHJnYigwLCAwLCAwKTsgZm9udC1zaXplOiAxM3B4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQt dmFyaWFudDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9y bWFsOyBsaW5lLWhlaWdodDogMTlweDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aWRvd3M6IGF1dG87IHdv cmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IGJhY2tncm91 bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsiPjxjb2RlIHN0eWxlPSJiYWNrZ3JvdW5kLWNv bG9yOiByZ2JhKDAsIDAsIDAsIDAuMDk4MDM5Mik7IHBhZGRpbmc6IDFweDsgYmFja2dyb3VuZC1w b3NpdGlvbjogaW5pdGlhbCBpbml0aWFsOyBiYWNrZ3JvdW5kLXJlcGVhdDogaW5pdGlhbCBpbml0 aWFsOyI+Jmx0O1J1bGUgaWQ9InNlbGludXhfdW5sYWJlbGVkX2RldmljZV9maWxlcyImZ3Q7CiZs dDt0aXRsZSZndDtFbnN1cmUgTm8gRGV2aWNlIEZpbGVzIGFyZSBVbmxhYmVsZWQgYnkgU0VMaW51 eCZsdDsvdGl0bGUmZ3Q7CiZsdDtkZXNjcmlwdGlvbiZndDtEZXZpY2UgZmlsZXMsIHdoaWNoIGFy ZSB1c2VkIGZvciBjb21tdW5pY2F0aW9uIHdpdGggaW1wb3J0YW50CnN5c3RlbSByZXNvdXJjZXMs IHNob3VsZCBiZSBsYWJlbGVkIHdpdGggcHJvcGVyIFNFTGludXggdHlwZXMuIElmIGFueSBkZXZp Y2UKZmlsZXMgY2FycnkgdGhlIFNFTGludXggdHlwZSAmbHQ7dHQmZ3Q7dW5sYWJlbGVkX3QmbHQ7 L3R0Jmd0OywgaW52ZXN0aWdhdGUgdGhlIGNhdXNlIGFuZApjb3JyZWN0IHRoZSBmaWxlJ3MgY29u dGV4dC4KJmx0Oy9kZXNjcmlwdGlvbiZndDsKJmx0O29jaWwgY2xhdXNlPSJ0aGVyZSBpcyBvdXRw dXQiJmd0O1RvIGNoZWNrIGZvciB1bmxhYmVsZWQgZGV2aWNlIGZpbGVzLCBydW4gdGhlIGZvbGxv d2luZyBjb21tYW5kOgombHQ7cHJlJmd0OyMgbHMgLVJaIC9kZXYgfCBncmVwIHVubGFiZWxlZF90 Jmx0Oy9wcmUmZ3Q7Ckl0IHNob3VsZCBwcm9kdWNlIG5vIG91dHB1dCBpbiBhIHdlbGwtY29uZmln dXJlZCBzeXN0ZW0uJmx0Oy9vY2lsJmd0OwombHQ7cmF0aW9uYWxlJmd0OwpJZiBhIGRldmljZSBm aWxlIGNhcnJpZXMgdGhlIFNFTGludXggdHlwZSAmbHQ7dHQmZ3Q7dW5sYWJlbGVkX3QmbHQ7L3R0 Jmd0OywgdGhlbiBTRUxpbnV4CmNhbm5vdCBwcm9wZXJseSByZXN0cmljdCBhY2Nlc3MgdG8gdGhl IGRldmljZSBmaWxlLgombHQ7L3JhdGlvbmFsZSZndDsKJmx0O2lkZW50IGNjZT0iMjY3NzQtMCIg LyZndDsKJmx0O292YWwgaWQ9InNlbGludXhfYWxsX2RldmljZWZpbGVzX2xhYmVsZWQiIC8mZ3Q7 CiZsdDtyZWYgbmlzdD0iQUMtNixBVS05LENNLTciIGRpc2E9IjIyLDMyIi8mZ3Q7CiZsdDt0ZXN0 ZWQgYnk9IkRTIiBvbj0iMjAxMjEwMjQiLyZndDsKJmx0Oy9SdWxlJmd0OzwvY29kZT48L3ByZT4K ICAgIDwvYmxvY2txdW90ZT4KICAgIChyZWY6CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9Imh0dHBzOi8vZ2l0LmZlZG9yYWhvc3RlZC5vcmcvY2dpdC9zY2FwLXNlY3VyaXR5 LWd1aWRlLmdpdC90cmVlL1JIRUw2L2lucHV0L3N5c3RlbS9zZWxpbnV4LnhtbCI+aHR0cHM6Ly9n aXQuZmVkb3JhaG9zdGVkLm9yZy9jZ2l0L3NjYXAtc2VjdXJpdHktZ3VpZGUuZ2l0L3RyZWUvUkhF TDYvaW5wdXQvc3lzdGVtL3NlbGludXgueG1sPC9hPik8YnI+CiAgICA8YnI+CiAgICBUaHJvdWdo IHRoaXMgbWV0YWRhdGEgd2UgY2FuIGFzc29jaWF0ZSBDQ0UgMjY3NzQtMCBhZ2FpbnN0IHRoZQog ICAgaW5kaWNhdGVkIE5JU1QgODAwLTUzIHJldjMgYW5kIERJU0EgQ0NJIHJlcXVpcmVtZW50cy48 YnI+CiAgICA8YnI+CiAgICBUaGlzIGluZm9ybWF0aW9uIGlzIHRyYW5zZm9ybWVkIHZpYSB0aGUg J21ha2UgdGFibGVzJyB0cmFuc2Zvcm0sCiAgICB3aGljaCBnZW5lcmF0ZXMgQ0NJIHRvIFNSRzo8 YnI+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9wZW9wbGUu cmVkaGF0LmNvbS9zd2VsbHMvc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9vdXRwdXQvdGFibGUt cmhlbDYtc3JnbWFwLWZsYXQuaHRtbCI+aHR0cDovL3Blb3BsZS5yZWRoYXQuY29tL3N3ZWxscy9z Y2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2L291dHB1dC90YWJsZS1yaGVsNi1zcmdtYXAtZmxhdC5o dG1sPC9hPjxicj4KICAgIDxicj4KICAgIGFuZCBDQ0kgdG8gTklTVDo8YnI+CjxhIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9wZW9wbGUucmVkaGF0LmNvbS9zd2Vs bHMvc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9vdXRwdXQvdGFibGUtc3RpZy1yaGVsNi1zZXJ2 ZXItZmxhdC5odG1sIj5odHRwOi8vcGVvcGxlLnJlZGhhdC5jb20vc3dlbGxzL3NjYXAtc2VjdXJp dHktZ3VpZGUvUkhFTDYvb3V0cHV0L3RhYmxlLXN0aWctcmhlbDYtc2VydmVyLWZsYXQuaHRtbDwv YT48YnI+CiAgICA8YnI+CiAgICBEbyB0aGVzZSBoZWxwPzxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============0869718430154452409==--