Sorry, this was in reference to a different note.
Leam
On Tue, Sep 10, 2013 at 12:59 PM, leam hall <leamhall(a)gmail.com> wrote:
Making /var/tmp a bind mount to /tmp seems like a really bad idea.
Why do
it?
On Tue, Sep 10, 2013 at 12:57 PM, David Smith <dsmith(a)eclipse.ncsc.mil>wrote:
> until now -- ack!
>
>
> On Tue, Sep 10, 2013 at 12:55 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
>
>> No one's ACKED these.
>>
>> - Maura Dailey
>>
>> On 08/30/2013 01:41 PM, Maura Dailey wrote:
>>
>>> Added test checks for set of partition checks.
>>>
>>> Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
>>> ---
>>> RHEL6/input/checks/partition_**for_home.xml | 18
>>> ++++++++++--------
>>> RHEL6/input/checks/partition_**for_tmp.xml | 14
>>> ++++++++------
>>> RHEL6/input/checks/partition_**for_var.xml | 18
>>> ++++++++++--------
>>> RHEL6/input/checks/partition_**for_var_log.xml | 12
>>> +++++++-----
>>> RHEL6/input/checks/partition_**for_var_log_audit.xml | 18
>>> +++++++++++-------
>>> 5 files changed, 46 insertions(+), 34 deletions(-)
>>>
>>> diff --git a/RHEL6/input/checks/**partition_for_home.xml
>>> b/RHEL6/input/checks/**partition_for_home.xml
>>> index b784316..2081d18 100644
>>> --- a/RHEL6/input/checks/**partition_for_home.xml
>>> +++ b/RHEL6/input/checks/**partition_for_home.xml
>>> @@ -5,20 +5,22 @@
>>> <affected family="unix">
>>> <platform>Red Hat Enterprise Linux 6</platform>
>>> </affected>
>>> - <description>If user home directories will be stored locally,
>>> - create a separate partition for /home. If /home will be mounted
>>> - from another system such as an NFS server, then creating a
>>> separate
>>> - partition is not necessary at this time, and the mountpoint can
>>> - instead be configured later.</description>
>>> + <description>If user home directories will be stored locally,
>>> create a
>>> + separate partition for /home. If /home will be mounted from
>>> another
>>> + system such as an NFS server, then creating a separate partition
>>> is not
>>> + necessary at this time, and the mountpoint can instead be
>>> configured
>>> + later.</description>
>>> + <reference source="MED" ref_id="20130830"
>>> ref_url="test_attestation" />
>>> </metadata>
>>> <criteria>
>>> <criterion test_ref="test_home_partition"
comment="/home on own
>>> partition" />
>>> </criteria>
>>> </definition>
>>> - <linux:partition_test check="all"
check_existence="all_exist"
>>> id="test_home_partition" version="1" comment="/home
on own partition">
>>> - <linux:object
object_ref="object_mount_home_**own_partition" />
>>> + <linux:partition_test check="all"
check_existence="all_exist"
>>> + id="test_home_partition" version="1"
comment="/home on own
>>> partition">
>>> + <linux:object
object_ref="object_mount_home_**own_partition" />
>>> </linux:partition_test>
>>> <linux:partition_object
id="object_mount_home_own_**partition"
>>> version="1">
>>> - <linux:mount_point>/home</**linux:mount_point>
>>> + <linux:mount_point>/home</**linux:mount_point>
>>> </linux:partition_object>
>>> </def-group>
>>> diff --git a/RHEL6/input/checks/**partition_for_tmp.xml
>>> b/RHEL6/input/checks/**partition_for_tmp.xml
>>> index de93ee9..9c28c13 100644
>>> --- a/RHEL6/input/checks/**partition_for_tmp.xml
>>> +++ b/RHEL6/input/checks/**partition_for_tmp.xml
>>> @@ -5,18 +5,20 @@
>>> <affected family="unix">
>>> <platform>Red Hat Enterprise Linux 6</platform>
>>> </affected>
>>> - <description>The /tmp directory is a world-writable directory
>>> - used for temporary file storage. Verify that it has its own
>>> - partition or logical volume.</description>
>>> + <description>The /tmp directory is a world-writable directory
>>> used for
>>> + temporary file storage. Verify that it has its own partition or
>>> logical
>>> + volume.</description>
>>> + <reference source="MED" ref_id="20130830"
>>> ref_url="test_attestation" />
>>> </metadata>
>>> <criteria>
>>> <criterion test_ref="test_tmp_partition"
comment="/tmp on own
>>> partition" />
>>> </criteria>
>>> </definition>
>>> - <linux:partition_test check="all"
check_existence="all_exist"
>>> id="test_tmp_partition" version="1" comment="/tmp on
own partition">
>>> - <linux:object object_ref="object_own_tmp_**partition"
/>
>>> + <linux:partition_test check="all"
check_existence="all_exist"
>>> + id="test_tmp_partition" version="1" comment="/tmp
on own partition">
>>> + <linux:object object_ref="object_own_tmp_**partition"
/>
>>> </linux:partition_test>
>>> <linux:partition_object id="object_own_tmp_partition"
version="1">
>>> - <linux:mount_point>/tmp</**linux:mount_point>
>>> + <linux:mount_point>/tmp</**linux:mount_point>
>>> </linux:partition_object>
>>> </def-group>
>>> diff --git a/RHEL6/input/checks/**partition_for_var.xml
>>> b/RHEL6/input/checks/**partition_for_var.xml
>>> index 58089ab..2ed1d38 100644
>>> --- a/RHEL6/input/checks/**partition_for_var.xml
>>> +++ b/RHEL6/input/checks/**partition_for_var.xml
>>> @@ -5,20 +5,22 @@
>>> <affected family="unix">
>>> <platform>Red Hat Enterprise Linux 6</platform>
>>> </affected>
>>> - <description>Ensuring that /var is mounted on its own partition
>>> enables the
>>> - setting of more restrictive mount options, which is used as
>>> temporary
>>> - storage by many program, particularly system services such as
>>> daemons.
>>> - It is not uncommon for the /var directory to contain
>>> world-writable directories,
>>> - installed by other software packages.</description>
>>> + <description>Ensuring that /var is mounted on its own partition
>>> enables
>>> + the setting of more restrictive mount options, which is used as
>>> temporary
>>> + storage by many program, particularly system services such as
>>> daemons. It
>>> + is not uncommon for the /var directory to contain world-writable
>>> + directories, installed by other software
packages.</description>
>>> + <reference source="MED" ref_id="20130830"
>>> ref_url="test_attestation" />
>>> </metadata>
>>> <criteria>
>>> <criterion test_ref="test_var_partition"
comment="/var on own
>>> partition" />
>>> </criteria>
>>> </definition>
>>> - <linux:partition_test check="all"
check_existence="all_exist"
>>> id="test_var_partition" version="1" comment="/var on
own partition">
>>> - <linux:object
object_ref="object_mount_var_**own_partition" />
>>> + <linux:partition_test check="all"
check_existence="all_exist"
>>> + id="test_var_partition" version="1" comment="/var
on own partition">
>>> + <linux:object object_ref="object_mount_var_**own_partition"
/>
>>> </linux:partition_test>
>>> <linux:partition_object
id="object_mount_var_own_**partition"
>>> version="1">
>>> - <linux:mount_point>/var</**linux:mount_point>
>>> + <linux:mount_point>/var</**linux:mount_point>
>>> </linux:partition_object>
>>> </def-group>
>>> diff --git a/RHEL6/input/checks/**partition_for_var_log.xml
>>> b/RHEL6/input/checks/**partition_for_var_log.xml
>>> index 8a8a6f4..94d235b 100644
>>> --- a/RHEL6/input/checks/**partition_for_var_log.xml
>>> +++ b/RHEL6/input/checks/**partition_for_var_log.xml
>>> @@ -5,17 +5,19 @@
>>> <affected family="unix">
>>> <platform>Red Hat Enterprise Linux 6</platform>
>>> </affected>
>>> - <description>System logs are stored in the /var/log directory.
>>> - Ensure that it has its own partition or logical
>>> volume.</description>
>>> + <description>System logs are stored in the /var/log directory.
>>> Ensure
>>> + that it has its own partition or logical volume.</description>
>>> + <reference source="MED" ref_id="20130830"
>>> ref_url="test_attestation" />
>>> </metadata>
>>> <criteria>
>>> <criterion test_ref="test_var_log_**partition"
>>> comment="/var/log on own partition" />
>>> </criteria>
>>> </definition>
>>> - <linux:partition_test check="all"
check_existence="all_exist"
>>> id="test_var_log_partition" version="1"
comment="/var/log on own partition">
>>> - <linux:object
object_ref="object_mount_var_**log_own_partition"
>>> />
>>> + <linux:partition_test check="all"
check_existence="all_exist"
>>> + id="test_var_log_partition" version="1"
comment="/var/log on own
>>> partition">
>>> + <linux:object
object_ref="object_mount_var_**log_own_partition" />
>>> </linux:partition_test>
>>> <linux:partition_object
id="object_mount_var_log_own_**partition"
>>> version="1">
>>> - <linux:mount_point>/var/log</**linux:mount_point>
>>> + <linux:mount_point>/var/log</**linux:mount_point>
>>> </linux:partition_object>
>>> </def-group>
>>> diff --git a/RHEL6/input/checks/**partition_for_var_log_audit.**xml
>>> b/RHEL6/input/checks/**partition_for_var_log_audit.**xml
>>> index e88ceba..b7a7d68 100644
>>> --- a/RHEL6/input/checks/**partition_for_var_log_audit.**xml
>>> +++ b/RHEL6/input/checks/**partition_for_var_log_audit.**xml
>>> @@ -6,18 +6,22 @@
>>> <platform>Red Hat Enterprise Linux 6</platform>
>>> </affected>
>>> <description>Audit logs are stored in the /var/log/audit
>>> directory.
>>> - Ensure that it has its own partition or logical volume. Make
>>> - absolutely certain that it is large enough to store all audit
>>> logs
>>> - that will be created by the auditing daemon.</description>
>>> + Ensure that it has its own partition or logical volume. Make
>>> absolutely
>>> + certain that it is large enough to store all audit logs that
>>> will be
>>> + created by the auditing daemon.</description>
>>> + <reference source="MED" ref_id="20130830"
>>> ref_url="test_attestation" />
>>> </metadata>
>>> <criteria>
>>> <criterion test_ref="test_var_log_audit_**partition"
>>> comment="/var/log/audit on own partition" />
>>> </criteria>
>>> </definition>
>>> - <linux:partition_test check="all"
check_existence="all_exist"
>>> id="test_var_log_audit_**partition" version="1"
comment="check for
>>> /var/log/audit partition">
>>> - <linux:object
object_ref="object_mount_var_**log_audit_own_partition"
>>> />
>>> + <linux:partition_test check="all"
check_existence="all_exist"
>>> + id="test_var_log_audit_**partition" version="1"
>>> + comment="check for /var/log/audit partition">
>>> + <linux:object
object_ref="object_mount_var_**log_audit_own_partition"
>>> />
>>> </linux:partition_test>
>>> - <linux:partition_object
id="object_mount_var_log_**audit_own_partition"
>>> version="1">
>>> - <linux:mount_point>/var/log/**audit</linux:mount_point>
>>> + <linux:partition_object id="object_mount_var_log_**
>>> audit_own_partition"
>>> + version="1">
>>> + <linux:mount_point>/var/log/**audit</linux:mount_point>
>>> </linux:partition_object>
>>> </def-group>
>>>
>>
>> ______________________________**_________________
>> scap-security-guide mailing list
>>
scap-security-guide@lists.**fedorahosted.org<scap-security-guide(a)lists.fedorahosted.org>
>>
https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide&l...
>>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
--
Mind on a Mission <
http://leamhall.blogspot.com/>