On 08/21/2013 05:17 PM, Shawn Wells wrote:Unfortunately, the partition_test apparently reads directly from /proc/mounts, which doesn't list the bind option, so by itself, it's not equipped to solve this false positive. The only place the bind option will appear is in /etc/mtab or in /etc/fstab. In the case that had me stumped (the sandbox service runs the mount command at service start), nothing is going to be in /etc/fstab.
On 8/21/13 4:36 PM, Maura Dailey wrote:
One quick thing I forgot to add: this will give you false positives for bind mounted partitions, as I found out when I finally tracked a phantom non-existent /home partition (underneath an NFS mount in the same location) back to the sandbox service. /proc/mounts, which is where linux:partition_test apparently reads from, doesn't know or care which mounts are bind mounted. Additionally, the sandbox service runs mount directly, so there's no evidence of this particular type of bind mount in /etc/fstab either.Definitely don't want deployments getting dinged about this, have to create a waiver, describe to their ISSO/ISSM, etc. Should the XCCDF be updated to reflect this known false positive?
If we accept /etc/mtab as authoritative, I can rewrite the check using a textfilecontent54_test. There is a risk that an unmounted partition in /etc/fstab could escape detection, though. I haven't completely figured out how to solve that yet.
Either way, the existing check is busted, so it does have to be replaced.
- Maura Dailey
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide