From 9c3612e01c1ab8946825d025aef1bddedcd88b2c Mon Sep 17 00:00:00 2001
From: Rui Bernardino <rui-p-bernardino@telecom.pt>
Date: Mon, 2 Jun 2014 11:27:09 +0100
Subject: [PATCH] Replaced profile dependent constants by references to profile values


Signed-off-by: Rui Bernardino <rui-p-bernardino@telecom.pt>
---
 RHEL/6/input/services/ssh.xml                      |    4 +-
 RHEL/6/input/system/accounts/pam.xml               |   36 ++++++++++----------
 RHEL/6/input/system/accounts/physical.xml          |    4 +-
 .../accounts/restrictions/account_expiration.xml   |    8 ++---
 .../accounts/restrictions/password_expiration.xml  |   15 ++++----
 RHEL/6/input/system/accounts/session.xml           |   20 +++++-----
 RHEL/6/input/system/auditing.xml                   |   23 +++++-------
 RHEL/6/input/system/permissions/execution.xml      |    7 ++--
 RHEL/6/input/system/selinux.xml                    |   12 +++---
 9 files changed, 62 insertions(+), 67 deletions(-)

diff --git a/RHEL/6/input/services/ssh.xml b/RHEL/6/input/services/ssh.xml
index 695418a..e603834 100644
--- a/RHEL/6/input/services/ssh.xml
+++ b/RHEL/6/input/services/ssh.xml
@@ -150,7 +150,7 @@ automatically logged out.
 <br /><br />
 To set an idle timeout interval, edit the following line in <tt>/etc/ssh/sshd_config</tt> as
 follows:
-<pre>ClientAliveInterval <b>interval</b></pre>
+<pre>ClientAliveInterval <b><sub idref="sshd_idle_timeout_value"/></b></pre>
 The timeout <b>interval</b> is given in seconds. To have a timeout
 of 15 minutes, set <b>interval</b> to 900.
 <br /><br />
@@ -163,7 +163,7 @@ from correctly detecting that the user is idle.
 Run the following command to see what the timeout interval is:
 <pre># grep ClientAliveInterval /etc/ssh/sshd_config</pre>
 If properly configured, the output should be:
-<pre>ClientAliveInterval 900</pre>
+<pre>ClientAliveInterval <sub idref="sshd_idle_timeout_value"/></pre>
 </ocil>
 <rationale>
 Causing idle users to be automatically logged out
diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml
index feddbb6..2c58d54 100644
--- a/RHEL/6/input/system/accounts/pam.xml
+++ b/RHEL/6/input/system/accounts/pam.xml
@@ -225,7 +225,7 @@ operator="equals" interactive="0">
 <description>To configure the number of retry prompts that are permitted per-session:
 <br /><br />
 Edit the <tt>pam_cracklib.so</tt> statement in <tt>/etc/pam.d/system-auth</tt> to 
-show <tt>retry=3</tt>, or a lower value if site policy is more restrictive.
+show <tt>retry=<sub idref="var_password_pam_cracklib_retry"/></tt>, or a lower value if site policy is more restrictive.
 <br /><br />
 The DoD requirement is a maximum of 3 prompts per session.
 </description>
@@ -273,14 +273,14 @@ Passwords with excessive repeating characters may be more vulnerable to password
 usage of digits in a password. When set to a negative number, any password will be required to
 contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each digit.  
-Add <tt>dcredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords.
+Add <tt>dcredit=<sub idref="var_password_pam_cracklib_dcredit"/></tt> after pam_cracklib.so to require use of a digit in passwords.
 </description>
 <ocil clause="dcredit is not found or not set to the required value">
 To check how many digits are required in a password, run the following command:
 <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
 The <tt>dcredit</tt> parameter (as a negative number) will indicate how many digits are required.
 The DoD requires at least one digit in a password.
-This would appear as <tt>dcredit=-1</tt>.
+This would appear as <tt>dcredit=<sub idref="var_password_pam_cracklib_dcredit"/></tt>.
 </ocil>
 <rationale>
 Requiring digits makes password guessing attacks more difficult by ensuring a larger
@@ -298,7 +298,7 @@ search space.
 usage of uppercase letters in a password. When set to a negative number, any password will be required to
 contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each uppercase character.
-Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of an upper case character in passwords.
+Add <tt>ucredit=<sub idref="var_password_pam_cracklib_ucredit"/></tt> after pam_cracklib.so to require use of an upper case character in passwords.
 </description>
 <ocil clause="ucredit is not found or not set to the required value">
 To check how many uppercase characters are required in a password, run the following command:
@@ -323,7 +323,7 @@ more difficult by ensuring a larger search space.
 usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to
 contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each special character.
-Add <tt>ocredit=-1</tt> after pam_cracklib.so to require use of a special character in passwords.
+Add <tt>ocredit=<sub idref="var_password_pam_cracklib_ocredit"/></tt> after pam_cracklib.so to require use of a special character in passwords.
 </description>
 <ocil clause="ocredit is not found or not set to the required value">
 To check how many special characters are required in a password, run the following command:
@@ -348,7 +348,7 @@ more difficult by ensuring a larger search space.
 usage of lowercase letters in a password. When set to a negative number, any password will be required to
 contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional
 length credit for each lowercase character.
-Add <tt>lcredit=-1</tt> after pam_cracklib.so to require use of a lowercase character in passwords.
+Add <tt>lcredit=<sub idref="var_password_pam_cracklib_lcredit"/></tt> after pam_cracklib.so to require use of a lowercase character in passwords.
 </description>
 <ocil clause="lcredit is not found or not set to the required value">
 To check how many lowercase characters are required in a password, run the following command:
@@ -371,8 +371,8 @@ more difficult by ensuring a larger search space.
 <title>Set Password Strength Minimum Different Characters</title>
 <description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
 usage of different characters during a password change.
-Add <tt>difok=<i>NUM</i></tt> after pam_cracklib.so to require differing
-characters when changing passwords, substituting <i>NUM</i> appropriately.
+Add <tt>difok=<i><sub idref="var_password_pam_cracklib_difok"/></i></tt> after pam_cracklib.so to require differing
+characters when changing passwords.
 The DoD requirement is <tt>4</tt>.
 </description>
 <ocil clause="difok is not found or not set to the required value">
@@ -421,14 +421,14 @@ To configure the system to lock out accounts after a number of incorrect login
 attempts using <tt>pam_faillock.so</tt>:
 <br /><br />
 Add the following lines immediately below the <tt>pam_unix.so</tt> statement in <tt>AUTH</tt> section of
-both <tt>/etc/pam.d/system-auth</tt> and /etc/pam.d/password-auth:
-<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
-<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
+both <tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt>:
+<pre>auth [default=die] pam_faillock.so authfail deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
+<pre>auth required pam_faillock.so authsucc deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
 </description>
 <ocil clause="that is not the case">
 To ensure the failed password attempt policy is configured correctly, run the following command:
 <pre># grep pam_faillock /etc/pam.d/system-auth</pre>
-The output should show <tt>deny=3</tt>.
+The output should show <tt>deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/></tt>.
 </ocil>
 <rationale>
 Locking out user accounts after a number of incorrect attempts
@@ -446,8 +446,8 @@ To configure the system to lock out accounts after a number of incorrect login
 attempts and require an administrator to unlock the account using <tt>pam_faillock.so</tt>:
 <br /><br />
 Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth</tt>:
-<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
-<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
+<pre>auth [default=die] pam_faillock.so authfail deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
+<pre>auth required pam_faillock.so authsucc deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
 </description>
 <ocil clause="that is not the case">
 To ensure the failed password attempt policy is configured correctly, run the following command:
@@ -473,8 +473,8 @@ attempts.
 <br /><br />
 Add the following <tt>fail_interval</tt> directives to <tt>pam_faillock.so</tt> immediately below the <tt>pam_env.so</tt> statement in
 <tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt>:
-<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
-<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
+<pre>auth [default=die] pam_faillock.so authfail deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
+<pre>auth required pam_faillock.so authsucc deny=<sub idref="var_accounts_passwords_pam_faillock_deny"/> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time"/> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval"/></pre>
 </description>
 <ocil clause="that is not the case">
 To ensure the failed password attempt policy is configured correctly, run the following command:
@@ -494,9 +494,9 @@ specific period of time prevents direct password guessing attacks.
 <title>Limit Password Reuse</title>
 <description>Do not allow users to reuse recent passwords. This can
 be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
-module.  In the file <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=24</tt> to the 
+module.  In the file <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=<sub idref="var_password_history_retain_limit" /></tt> to the 
 line which refers to the <tt>pam_unix.so</tt> module, as shown:
-<pre>password sufficient pam_unix.so <i>existing_options</i> remember=24</pre>
+<pre>password sufficient pam_unix.so <i>existing_options</i> remember=<sub idref="var_password_history_retain_limit" /></pre>
 The DoD and FISMA requirement is 24 passwords.</description>
 <ocil clause="it does not">
 To verify the password reuse setting is compliant, run the following command:
diff --git a/RHEL/6/input/system/accounts/physical.xml b/RHEL/6/input/system/accounts/physical.xml
index e36056e..ce5c24a 100644
--- a/RHEL/6/input/system/accounts/physical.xml
+++ b/RHEL/6/input/system/accounts/physical.xml
@@ -256,12 +256,12 @@ the man page <tt>gconftool-2(1)</tt>.</description>
 <title>Set GNOME Login Inactivity Timeout</title>
 <description>
 Run the following command to set the idle time-out value for
-inactivity in the GNOME desktop to 15 minutes:
+inactivity in the GNOME desktop to <sub idref="inactivity_timeout_value" /> minutes:
 <pre># gconftool-2 \
   --direct \
   --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
   --type int \
-  --set /desktop/gnome/session/idle_delay 15</pre>
+  --set /desktop/gnome/session/idle_delay <sub idref="inactivity_timeout_value" /></pre>
 </description>
 <ocil clause="it is not">
 To check the current idle time-out value, run the following command:
diff --git a/RHEL/6/input/system/accounts/restrictions/account_expiration.xml b/RHEL/6/input/system/accounts/restrictions/account_expiration.xml
index 58e9191..946556c 100644
--- a/RHEL/6/input/system/accounts/restrictions/account_expiration.xml
+++ b/RHEL/6/input/system/accounts/restrictions/account_expiration.xml
@@ -32,12 +32,10 @@ normal command line utilities.
 <title>Set Account Expiration Following Inactivity</title>
 <description>To specify the number of days after a password expires (which
 signifies inactivity) until an account is permanently disabled, add or correct
-the following lines in <tt>/etc/default/useradd</tt>, substituting
-<tt><i>NUM_DAYS</i></tt> appropriately:
-<pre>INACTIVE=<i>NUM_DAYS</i></pre>
-A value of 35 is recommended.  
+the following lines in <tt>/etc/default/useradd</tt>, to match:
+<pre>INACTIVE=<i><sub idref="var_account_disable_post_pw_expiration"/></i></pre>
 If a password is currently on the
-verge of expiration, then 35 days remain until the account is automatically
+verge of expiration, then <sub idref="var_account_disable_post_pw_expiration"/> days remain until the account is automatically
 disabled. However, if the password will not expire for another 60 days, then 95
 days could elapse until the account would be automatically disabled. See the
 <tt>useradd</tt> man page for more information.  Determining the inactivity
diff --git a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
index ce8a082..f3c80b6 100644
--- a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
@@ -81,7 +81,8 @@ age, and 7 day warning period with the following command:
 <description>To specify password length requirements for new accounts,
 edit the file <tt>/etc/login.defs</tt> and add or correct the following
 lines:
-<pre>PASS_MIN_LEN 14<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
+<pre>PASS_MIN_LEN <sub idref="var_accounts_password_minlen_login_defs"/> </pre>
+
 <br/><br/>
 The DoD requirement is <tt>14</tt>. 
 The FISMA requirement is <tt>12</tt>.
@@ -113,8 +114,8 @@ behavior that may result.
 <title>Set Password Minimum Age</title>
 <description>To specify password minimum age for new accounts,
 edit the file <tt>/etc/login.defs</tt>
-and add or correct the following line, replacing <i>DAYS</i> appropriately:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
+and add or correct the following line to match:
+<pre>PASS_MIN_DAYS <sub idref="var_accounts_minimum_age_login_defs"/></pre>
 A value of 1 day is considered for sufficient for many
 environments.
 The DoD requirement is 1. 
@@ -140,8 +141,8 @@ after satisfying the password reuse requirement.
 <title>Set Password Maximum Age</title>
 <description>To specify password maximum age for new accounts,
 edit the file <tt>/etc/login.defs</tt>
-and add or correct the following line, replacing <i>DAYS</i> appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
+and add or correct the following line to match:
+<pre>PASS_MAX_DAYS <sub idref="var_accounts_maximum_age_login_defs"/></pre>
 A value of 180 days is sufficient for many environments. 
 The DoD requirement is 60.
 </description>
@@ -168,8 +169,8 @@ location subject to physical compromise.</rationale>
 <description>To specify how many days prior to password
 expiration that a warning will be issued to users,
 edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line, replacing <i>DAYS</i> appropriately:
-<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+ the following line to match:
+<pre>PASS_WARN_AGE <sub idref="var_accounts_password_warn_age_login_defs"/></pre>
 The DoD requirement is 7.
 <!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
 </description>
diff --git a/RHEL/6/input/system/accounts/session.xml b/RHEL/6/input/system/accounts/session.xml
index 83dcb54..06113dc 100644
--- a/RHEL/6/input/system/accounts/session.xml
+++ b/RHEL/6/input/system/accounts/session.xml
@@ -31,7 +31,7 @@ Limiting the number of allowed users and sessions per user can limit risks relat
 Service attacks. This addresses concurrent sessions for a single account and does not address 
 concurrent sessions by a single user via multiple accounts.  The DoD requirement is 10.   To set the number of concurrent
 sessions per user add the following line in <tt>/etc/security/limits.conf</tt>:
-<pre>* hard maxlogins 10</pre>
+<pre>* hard maxlogins <sub idref="var_accounts_max_concurrent_login_sessions" /></pre>
 </description>
 <rationale>Limiting simultaneous user logins can insulate the system from denial of service 
 problems caused by excessive logins. Automated login processes operating improperly or 
@@ -42,7 +42,7 @@ Run the following command to ensure the <tt>maxlogins</tt> value is configured f
 on the system:
 <pre># grep "maxlogins" /etc/security/limits.conf</pre>
 You should receive output similar to the following:
-<pre>*		hard	maxlogins	10</pre>
+<pre>*		hard	maxlogins	<sub idref="max_concurrent_login_sessions_value" /></pre>
 </ocil>
 <oval id="accounts_max_concurrent_login_sessions" value="var_accounts_max_concurrent_login_sessions" />
 <ident cce="27457-1" />
@@ -211,7 +211,7 @@ operator="equals" interactive="0">
 To ensure the default umask for users of the Bash shell is set properly,
 add or correct the <tt>umask</tt> setting in <tt>/etc/bashrc</tt> to read
 as follows:
-<pre>umask 077<!-- <sub idref="var_accounts_user_umask" /> --></pre>
+<pre>umask <sub idref="var_accounts_user_umask" /></pre>
 </description>
 <rationale>The umask value influences the permissions assigned to files when they are created.
 A misconfigured umask value could result in files with excessive permissions that can be read or
@@ -222,8 +222,8 @@ running the following command:
 <pre># grep "umask" /etc/bashrc</pre>
 All output must show the value of <tt>umask</tt> set to 077, as shown below:
 <pre># grep "umask" /etc/bashrc
-umask 077
-umask 077</pre>
+umask <sub idref="var_accounts_user_umask"/>
+umask <sub idref="var_accounts_user_umask"/></pre>
 </ocil>
 <ident cce="26917-5" />
 <oval id="accounts_umask_bashrc" value="var_accounts_user_umask"/>
@@ -236,7 +236,7 @@ umask 077</pre>
 <description>
 To ensure the default umask for users of the C shell is set properly,
 add or correct the <tt>umask</tt> setting in <tt>/etc/csh.cshrc</tt> to read as follows:
-<pre>umask 077<!-- <sub idref="var_accounts_user_umask" /> --></pre>
+<pre>umask <sub idref="var_accounts_user_umask" /></pre>
 </description>
 <rationale>The umask value influences the permissions assigned to files when they are created.
 A misconfigured umask value could result in files with excessive permissions that can be read or
@@ -247,7 +247,7 @@ running the following command:
 <pre># grep "umask" /etc/csh.cshrc</pre>
 All output must show the value of <tt>umask</tt> set to 077, as shown in the below:
 <pre># grep "umask" /etc/csh.cshrc
-umask 077</pre>
+umask <sub idref="var_accounts_user_umask"/></pre>
 </ocil>
 <ident cce="27034-8" />
 <oval id="accounts_umask_cshrc" value="var_accounts_user_umask"/>
@@ -260,7 +260,7 @@ umask 077</pre>
 <description>
 To ensure the default umask controlled by <tt>/etc/profile</tt> is set properly,
 add or correct the <tt>umask</tt> setting in <tt>/etc/profile</tt> to read as follows:
-<pre>umask 077<!--<sub idref="var_accounts_user_umask" /> --></pre>
+<pre>umask <sub idref="var_accounts_user_umask" /></pre>
 </description>
 <rationale>The umask value influences the permissions assigned to files when they are created.
 A misconfigured umask value could result in files with excessive permissions that can be read or
@@ -272,7 +272,7 @@ running the following command:
 <pre># grep "umask" /etc/profile</pre>
 All output must show the value of <tt>umask</tt> set to 077, as shown in the below:
 <pre># grep "umask" /etc/profile
-umask 077</pre>
+umask <sub idref="var_accounts_user_umask"/></pre>
 </ocil>
 <oval id="accounts_umask_etc_profile" value="var_accounts_user_umask" />
 <tested by="swells" on="20120929"/>
@@ -284,7 +284,7 @@ umask 077</pre>
 <description>
 To ensure the default umask controlled by <tt>/etc/login.defs</tt> is set properly,
 add or correct the <tt>UMASK</tt> setting in <tt>/etc/login.defs</tt> to read as follows:
-<pre>UMASK 077<!-- <sub idref="var_accounts_user_umask" /> --></pre>
+<pre>UMASK <sub idref="var_accounts_user_umask" /></pre>
 </description>
 <rationale>The umask value influences the permissions assigned to files when they are created.
 A misconfigured umask value could result in files with excessive permissions that can be read and 
diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
index 9923680..fe1a65c 100644
--- a/RHEL/6/input/system/auditing.xml
+++ b/RHEL/6/input/system/auditing.xml
@@ -232,9 +232,8 @@ normally.</i>
 <description>Determine how many log files
 <tt>auditd</tt> should retain when it rotates logs.
 Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following
-line, substituting <i>NUMLOGS</i> with the correct value:
-<pre>num_logs = <i>NUMLOGS</i></pre>
-Set the value to 5 for general-purpose systems. 
+line:
+<pre>num_logs = <i><sub idref="var_auditd_num_logs" /></i></pre>
 Note that values less than 2 result in no log rotation.</description>
 <ocil clause="the system log file retention has not been properly configured">
 Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
@@ -255,10 +254,8 @@ file size and the number of logs retained.</rationale>
 <title>Configure auditd Max Log File Size</title>
 <description>Determine the amount of audit data (in megabytes)
 which should be retained in each log file. Edit the file
-<tt>/etc/audit/auditd.conf</tt>. Add or modify the following line, substituting
-the correct value for <i>STOREMB</i>:
-<pre>max_log_file = <i>STOREMB</i></pre>
-Set the value to <tt>6</tt> (MB) or higher for general-purpose systems.
+<tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:
+<pre>max_log_file = <i><sub idref="var_auditd_max_log_file" /></i></pre>
 Larger values, of course,
 support retention of even more audit data.</description>
 <ocil clause="the system audit data threshold has not been properly configured">
@@ -291,8 +288,8 @@ page. These include:
 <li><tt>rotate</tt></li>
 <li><tt>keep_logs</tt></li>
 </ul>
-Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation
-occurs.  This is the default.  The setting is case-insensitive.
+Set the <tt><i>ACTION</i></tt> to <tt><sub idref="var_auditd_max_log_file_action" /></tt> to ensure compliance.
+The setting is case-insensitive.
 </description>
 <ocil clause="the system has not been properly configured to rotate audit logs">
 Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
@@ -344,8 +341,8 @@ These include:
 <li><tt>single</tt></li>
 <li><tt>halt</tt></li>
 </ul>
-Set this to <tt>email</tt> (instead of the default,
-which is <tt>suspend</tt>) as it is more likely to get prompt attention. Acceptable values
+Set this to <tt><sub idref="var_auditd_space_left_action"/></tt> (instead of the default which is <tt>suspend</tt>) 
+as it is more likely to get prompt attention. Acceptable values
 also include <tt>suspend</tt>, <tt>single</tt>, and <tt>halt</tt>.
 </description>
 <ocil clause="the system is not configured to send an email to the system administrator when
@@ -371,7 +368,7 @@ allow them to take corrective action prior to any disruption.</rationale>
 when disk space is running low but prior to running out of space completely. 
 Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
 substituting <i>ACTION</i> appropriately:
-<pre>admin_space_left_action = <i>ACTION</i></pre>
+<pre>admin_space_left_action = <i><sub idref="var_auditd_admin_space_left_action" /></i></pre>
 Set this value to <tt>single</tt> to cause the system to switch to single user
 mode for corrective action. Acceptable values also include <tt>suspend</tt> and
 <tt>halt</tt>. For certain systems, the need for availability
@@ -402,7 +399,7 @@ is used, running low on space for audit records should never occur.
 a designated account in certain situations. Add or correct the following line
 in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
 via email for those situations:
-<pre>action_mail_acct = root</pre>
+<pre>action_mail_acct = <sub idref="var_auditd_action_mail_acct" /></pre>
 </description>
 <ocil clause="auditd is not configured to send emails per identified actions">
 Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
diff --git a/RHEL/6/input/system/permissions/execution.xml b/RHEL/6/input/system/permissions/execution.xml
index 360dd62..732eb4c 100644
--- a/RHEL/6/input/system/permissions/execution.xml
+++ b/RHEL/6/input/system/permissions/execution.xml
@@ -28,9 +28,8 @@ for system daemons.
 <description>The file <tt>/etc/init.d/functions</tt> includes initialization
 parameters for most or all daemons started at boot time.  The default umask of
 022 prevents creation of group- or world-writable files.  To set the default
-umask for daemons, edit the following line, inserting 022 or 027 for
-<i>UMASK</i> appropriately:
-<pre>umask <i>UMASK</i></pre>
+umask for daemons, edit the following line to match:
+<pre>umask <i><sub idref="var_umask_for_daemons"/></i></pre>
 Setting the umask to too restrictive a setting can cause serious errors at
 runtime.  Many daemons on the system already individually restrict themselves to
 a umask of 077 in their own init scripts.
@@ -38,7 +37,7 @@ a umask of 077 in their own init scripts.
 <ocil clause="it does not">
 To check the value of the <tt>umask</tt>, run the following command:
 <pre>$ grep umask /etc/init.d/functions</pre>
-The output should show either <tt>022</tt> or <tt>027</tt>.
+The output should show <tt><sub idref="var_umask_for_daemons"/></tt>.
 </ocil>
 <rationale>The umask influences the permissions assigned to files created by a
 process at run time.  An unnecessarily permissive umask could result in files
diff --git a/RHEL/6/input/system/selinux.xml b/RHEL/6/input/system/selinux.xml
index 59a84cb..25377c7 100644
--- a/RHEL/6/input/system/selinux.xml
+++ b/RHEL/6/input/system/selinux.xml
@@ -70,14 +70,14 @@ the chances that it will remain off during system operation.
 
 <Rule id="selinux_state" severity="medium">
 <title>Ensure SELinux State is Enforcing</title>
-<description>The SELinux state should be set to <tt>enforcing</tt> at
+<description>The SELinux state should be set to <tt><sub idref="var_selinux_state_name"/></tt> at
 system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
 following line to configure the system to boot into enforcing mode:
-<pre>SELINUX=enforcing</pre>
+<pre>SELINUX=<sub idref="var_selinux_state_name"/></pre>
 </description>
 <ocil clause="SELINUX is not set to enforcing">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
-<pre>SELINUX=enforcing</pre>
+<pre>SELINUX=<sub idref="var_selinux_state_name"/></pre>
 </ocil>
 <rationale>
 Setting the SELinux state to enforcing ensures SELinux is able to confine
@@ -93,18 +93,18 @@ privileges.
 
 <Rule id="selinux_policytype">
 <title>Configure SELinux Policy</title>
-<description>The SELinux <tt>targeted</tt> policy is appropriate for
+<description>The SELinux <tt><sub idref="var_selinux_policy_name"/></tt> policy is appropriate for
 general-purpose desktops and servers, as well as systems in many other roles.
 To configure the system to use this policy, add or correct the following line
 in <tt>/etc/selinux/config</tt>:
-<pre>SELINUXTYPE=targeted</pre>
+<pre>SELINUXTYPE=<sub idref="var_selinux_policy_name"/></pre>
 Other policies, such as <tt>mls</tt>, provide additional security labeling
 and greater confinement but are not compatible with many general-purpose
 use cases.
 </description>
 <ocil clause="it does not">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
-<pre>SELINUXTYPE=targeted</pre>
+<pre>SELINUXTYPE=<sub idref="var_selinux_policy_name"/></pre>
 </ocil>
 <rationale>
 Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
-- 
1.7.1

