What's the GENID on this? I didn't find it in the Jun STIG.
Thanks!
Leam
On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:
Signed-off-by: Maura Dailey <maura@eclipse.ncsc.mil>
---
RHEL6/input/checks/mount_option_var_tmp_bind.xml | 44 +++++++++++++++-------
1 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
index 4d549c2..02630a7 100644
--- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
+++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
@@ -5,24 +5,40 @@
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /var/tmp directory should be bind mounted to /tmp
- in order to consolidate temporary storage into one location protected by the same
- techniques as /tmp.</description>
+ <description>The /var/tmp directory should be bind mounted to /tmp in
+ order to consolidate temporary storage into one location protected by the
+ same techniques as /tmp.</description>
+ <reference source="MED" ref_id="20130821" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="Unknown test stub" test_ref="test_bind_mount_var_tmp" />
+ <criteria operator="AND">
+ <criterion comment="Ensure /var/tmp is mounted"
+ test_ref="test_mount_option_var_tmp" />
+ <criterion comment="Ensure /tmp is bind mounted"
+ test_ref="test_mount_option_var_tmp_bind" />
</criteria>
</definition>
+ <linux:partition_test id="test_mount_option_var_tmp" version="1"
+ comment="Ensure /var/tmp is mounted" check="all">
+ <linux:object object_ref="object_mount_option_var_tmp" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_option_var_tmp" version="1">
+ <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
+ </linux:partition_object>
- <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="bind mount /var/tmp to /tmp" id="test_bind_mount_var_tmp" version="1">
- <ind:object object_ref="object_bind_mount_var_tmp" />
- </ind:textfilecontent54_test>
+ <!-- The linux:partition_test reads from /proc/mounts, which does not record
+ the bind mount option. As a result, the less elegant textfilecontent54_test
+ is required here. -->
- <ind:textfilecontent54_object comment="look for the partition mount point in /etc/fstab" id="object_bind_mount_var_tmp" version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>fstab</ind:filename>
- <ind:pattern operation="pattern match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+ comment="Ensure bind mount option is on /var/tmp"
+ id="test_mount_option_var_tmp_bind" version="1">
+ <ind:object object_ref="object_mount_option_var_tmp_bind" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
+ id="object_mount_option_var_tmp_bind" version="1">
+ <ind:filepath>/etc/mtab</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">
+ 1</ind:instance>
</ind:textfilecontent54_object>
-
</def-group>
--
1.7.1
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide