From maura at eclipse.ncsc.mil Thu Aug 20 11:34:54 2015 Content-Type: multipart/mixed; boundary="===============2017644241488897269==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing Date: Wed, 21 Aug 2013 16:36:49 -0400 Message-ID: <521524E1.3030700@eclipse.ncsc.mil> In-Reply-To: 1377116695-3471-1-git-send-email-maura@eclipse.ncsc.mil --===============2017644241488897269== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable One quick thing I forgot to add: this will give you false positives for = bind mounted partitions, as I found out when I finally tracked a phantom = non-existent /home partition (underneath an NFS mount in the same = location) back to the sandbox service. /proc/mounts, which is where = linux:partition_test apparently reads from, doesn't know or care which = mounts are bind mounted. Additionally, the sandbox service runs mount = directly, so there's no evidence of this particular type of bind mount = in /etc/fstab either. - Maura Dailey On 08/21/2013 04:24 PM, Maura Dailey wrote: > Signed-off-by: Maura Dailey > --- > ...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++---= ------ > 1 files changed, 15 insertions(+), 13 deletions(-) > > diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitio= ns.xml b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml > index a5e6334..e0abd50 100644 > --- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml > +++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml > @@ -1,36 +1,38 @@ > > - > + + id=3D"mount_option_nodev_nonroot_local_partitions" version=3D"1"> > > Add nodev Option to Non-Root Local Partitions > > Red Hat Enterprise Linux 6 > > - The nodev mount option prevents files from being > - interpreted as character or block devices. Legitimate character an= d block > - devices should exist in the /dev directory on the root partition or > - within chroot jails built for system services. All other locations= should not > - allow character and block devices. > + The nodev mount option prevents files from being inte= rpreted > + as character or block devices. Legitimate character and block devi= ces > + should exist in the /dev directory on the root partition or within= chroot > + jails built for system services. All other locations should not al= low > + character and block devices. > + > > > - > + + test_ref=3D"test_nodev_nonroot_local_partitions" negate=3D"true" /> > > > - > - > + + id=3D"test_nodev_nonroot_local_partitions" version=3D"1" > + comment=3D"nodev on local filesystems"> > > > > - > > > ^/\w.*$ > state_local_nodev > > - > > > ^/dev/.*$ > - nodev > + + operation=3D"not equal">nodev > > - > --===============2017644241488897269==--