On 8/19/13 6:07 PM, Beavers, Randall D. CTR (US) wrote:
Willy Santos & Shawn Wells,
Willy's no longer with RHT :(
 
He may still be lurking on the list though.


I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists.
(searching CCI information online).

I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs
to DISA STIGS for my program.  Any help would be appreciated.  Seems the
DISA IASE website and the VMS site doesn't jive.

Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that
would help me? In excel format?  In xml format?

Please advise.


Various rules are mapped back to policies via the <ref> tags. Example is the selinux_unlabeled_device_files rule:
<Rule id="selinux_unlabeled_device_files">
<title>Ensure No Device Files are Unlabeled by SELinux</title>
<description>Device files, which are used for communication with important
system resources, should be labeled with proper SELinux types. If any device
files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
correct the file's context.
</description>
<ocil clause="there is output">To check for unlabeled device files, run the following command:
<pre># ls -RZ /dev | grep unlabeled_t</pre>
It should produce no output in a well-configured system.</ocil>
<rationale>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
cannot properly restrict access to the device file.
</rationale>
<ident cce="26774-0" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="AC-6,AU-9,CM-7" disa="22,32"/>
<tested by="DS" on="20121024"/>
</Rule>
(ref: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/system/selinux.xml)

Through this metadata we can associate CCE 26774-0 against the indicated NIST 800-53 rev3 and DISA CCI requirements.

This information is transformed via the 'make tables' transform, which generates CCI to SRG:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6-srgmap-flat.html

and CCI to NIST:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig-rhel6-server-flat.html

Do these help?