Hi Shawn,
I see the wording as literal: "Run the following command to verify that
|/(whateverfs)| lives on its own partition:" -- The text in question was
automatically generated from the macros that were pushed early last week.
There is nothing below to me that indicates that your system is
"compliant", (I am not sure how you determined that. ) It simply
informed you that your /tmp slice lives on:
"/dev/mapper/vg_rhel6-lv_root" -- which tells you that you aren't
compliant with the policy, right?
When I asked the same question, I was told that it was up to the user to
interpret the output of the provided texts -- in order to determine if
the system in question is compliant, or non compliant. Not to script
the Check Text commands -- to provide a response which then informs the
end user how to the response. I started down a similar path (which I
think you're also forseeing) and was asked to curb that for the time
being. I was in fact getting a bit too granular, and scripty with the
checks that I was writing, which now is a mute point since the macros
that were implemented (pretty much) took care of the bulk of the text
that we now see in that column, negating and/or erasing what I had
provided in the weeks prior - which was more along the lines of what I
think you would like to see.
Not sure how you want to handle this one, but that is what I have been
told. What would you prefer to do for all of the FS / Slice / LV checks?
Thanks,
MM
On 09/30/2012 02:57 PM, Shawn Wells wrote:
On 9/28/12 1:17 PM, Michael J. McConachie wrote:
>
> 0001-Test-tags-added-to-input-system-software-disk_partit.patch
>
>
> From 6c89fda05476255dc941b8ebe6c72d989ca3a3b7 Mon Sep 17 00:00:00 2001
> From: Michael McConachie <michael(a)redhat.com>
> Date: Fri, 28 Sep 2012 13:17:03 -0400
> Subject: [PATCH] Test tags added to
> input/system/software/disk_partitioning.xml
>
> ---
> RHEL6/input/system/software/disk_partitioning.xml | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/RHEL6/input/system/software/disk_partitioning.xml
b/RHEL6/input/system/software/disk_partitioning.xml
> index e678d61..ef2ef29 100644
> --- a/RHEL6/input/system/software/disk_partitioning.xml
> +++ b/RHEL6/input/system/software/disk_partitioning.xml
> @@ -38,8 +38,9 @@ Placing <tt>/tmp</tt> in its own partition enables the
setting of more
> restrictive mount options, which can help protect programs which use it.
> </rationale>
> <ident cce="14161-4"/>
> -<oval id="mount_tmp_own_partition" />
> +<oval id="mount_tmp_own_partition"/>
> <ref nist="CM-6" />
> +<tested by="MM" on="20120928"/>
> </Rule>
>
> <Rule id="partition_for_var">
> @@ -59,6 +60,7 @@ world-writable directories, installed by other software packages.
> <ident cce="14777-7"/>
> <oval id="mount_var_own_partition" />
> <ref nist="CM-6" />
> +<tested by="MM" on="20120928"/>
> </Rule>
>
> <Rule id="partition_for_var_log">
> @@ -77,6 +79,7 @@ and other files in <tt>/var/</tt>.
> <ident cce="14011-1" />
> <oval id="mount_var_log_own_partition" />
> <ref nist="CM-6, AU-9" />
> +<tested by="MM" on="20120928"/>
> </Rule>
>
> <Rule id="partition_for_var_log_audit">
> @@ -98,6 +101,7 @@ of space.
> <ident cce="14171-3" />
> <oval id="mount_var_log_audit_own_partition" />
> <ref nist="CM-6, AU-9" disa="137"/>
> +<tested by="MM" on="20120928"/>
> </Rule>
>
> <Rule id="partition_for_home">
> @@ -118,6 +122,7 @@ users cannot trivially fill partitions used for log or audit data
storage.
> <ident cce="14559-9" />
> <oval id="mount_home_own_partition" />
> <ref nist="CM-6"/>
> +<tested by="MM" on="20120928"/>
> </Rule>
>
> <Group id="partition_encryption" >
> -- 1.7.11.4
Nack
OCIL unclear. According to current wording, my system config is compliant:
$ df -h /tmp
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_rhel6-lv_root
5.5G 3.0G 2.2G 58% /
clearly it is not
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide