It's not in the STIG, it's in the XCCDF prose. The check exists now, but
it's broken.
Also, what Shawn said in the other thread.
- Maura Dailey
On 09/10/2013 12:56 PM, leam hall wrote:
What's the GENID on this? I didn't find it in the Jun STIG.
Thanks!
Leam
On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura(a)eclipse.ncsc.mil
<mailto:maura@eclipse.ncsc.mil>> wrote:
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil
<mailto:maura@eclipse.ncsc.mil>>
---
RHEL6/input/checks/mount_option_var_tmp_bind.xml | 44
+++++++++++++++-------
1 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
index 4d549c2..02630a7 100644
--- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
+++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
@@ -5,24 +5,40 @@
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /var/tmp directory should be bind mounted
to /tmp
- in order to consolidate temporary storage into one location
protected by the same
- techniques as /tmp.</description>
+ <description>The /var/tmp directory should be bind mounted
to /tmp in
+ order to consolidate temporary storage into one location
protected by the
+ same techniques as /tmp.</description>
+ <reference source="MED" ref_id="20130821"
ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="Unknown test stub"
test_ref="test_bind_mount_var_tmp" />
+ <criteria operator="AND">
+ <criterion comment="Ensure /var/tmp is mounted"
+ test_ref="test_mount_option_var_tmp" />
+ <criterion comment="Ensure /tmp is bind mounted"
+ test_ref="test_mount_option_var_tmp_bind" />
</criteria>
</definition>
+ <linux:partition_test id="test_mount_option_var_tmp"
version="1"
+ comment="Ensure /var/tmp is mounted" check="all">
+ <linux:object object_ref="object_mount_option_var_tmp" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_option_var_tmp"
version="1">
+ <linux:mount_point operation="pattern
match">/var/tmp</linux:mount_point>
+ </linux:partition_object>
- <ind:textfilecontent54_test check="all"
check_existence="at_least_one_exists" comment="bind mount /var/tmp
to /tmp" id="test_bind_mount_var_tmp" version="1">
- <ind:object object_ref="object_bind_mount_var_tmp" />
- </ind:textfilecontent54_test>
+ <!-- The linux:partition_test reads from /proc/mounts, which
does not record
+ the bind mount option. As a result, the less elegant
textfilecontent54_test
+ is required here. -->
- <ind:textfilecontent54_object comment="look for the partition
mount point in /etc/fstab" id="object_bind_mount_var_tmp"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>fstab</ind:filename>
- <ind:pattern operation="pattern
match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or
equal">1</ind:instance>
+ <ind:textfilecontent54_test check="all"
check_existence="at_least_one_exists"
+ comment="Ensure bind mount option is on /var/tmp"
+ id="test_mount_option_var_tmp_bind" version="1">
+ <ind:object object_ref="object_mount_option_var_tmp_bind" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="look for the partition
mount point in /etc/mtab"
+ id="object_mount_option_var_tmp_bind" version="1">
+ <ind:filepath>/etc/mtab</ind:filepath>
+ <ind:pattern operation="pattern
match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or
equal">
+ 1</ind:instance>
</ind:textfilecontent54_object>
-
</def-group>
--
1.7.1
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Mind on a Mission <
http://leamhall.blogspot.com/>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide