One quick thing I forgot to add: this will give you false positives for
bind mounted partitions, as I found out when I finally tracked a phantom
non-existent /home partition (underneath an NFS mount in the same
location) back to the sandbox service. /proc/mounts, which is where
linux:partition_test apparently reads from, doesn't know or care which
mounts are bind mounted. Additionally, the sandbox service runs mount
directly, so there's no evidence of this particular type of bind mount
in /etc/fstab either.
- Maura Dailey
On 08/21/2013 04:24 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++---------
1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
index a5e6334..e0abd50 100644
--- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
+++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
@@ -1,36 +1,38 @@
<def-group>
- <definition class="compliance"
id="mount_option_nodev_nonroot_local_partitions" version="1">
+ <definition class="compliance"
+ id="mount_option_nodev_nonroot_local_partitions" version="1">
<metadata>
<title>Add nodev Option to Non-Root Local Partitions</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The nodev mount option prevents files from being
- interpreted as character or block devices. Legitimate character and block
- devices should exist in the /dev directory on the root partition or
- within chroot jails built for system services. All other locations should not
- allow character and block devices.</description>
+ <description>The nodev mount option prevents files from being interpreted
+ as character or block devices. Legitimate character and block devices
+ should exist in the /dev directory on the root partition or within chroot
+ jails built for system services. All other locations should not allow
+ character and block devices.</description>
+ <reference source="MED" ref_id="20130821"
ref_url="test_attestation" />
</metadata>
<criteria>
- <criterion comment="nodev on local filesystems"
test_ref="test_nodev_nonroot_local_partitions" />
+ <criterion comment="nodev on local filesystems"
+ test_ref="test_nodev_nonroot_local_partitions" negate="true"
/>
</criteria>
</definition>
-
- <linux:partition_test check="all" check_existence="all_exist"
id="test_nodev_nonroot_local_partitions" version="1"
comment="nodev on local filesystems">
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_nodev_nonroot_local_partitions" version="1"
+ comment="nodev on local filesystems">
<linux:object object_ref="object_non_root_partitions" />
<linux:state state_ref="state_local_nodev" />
</linux:partition_test>
-
<linux:partition_object id="object_non_root_partitions"
version="1">
<!-- look at all partitions except root -->
<linux:mount_point operation="pattern
match">^/\w.*$</linux:mount_point>
<filter action="include">state_local_nodev</filter>
</linux:partition_object>
-
<linux:partition_state id="state_local_nodev" version="1">
<!-- this check defines a local partition as one which has a device node in /dev
-->
<linux:device operation="pattern
match">^/dev/.*$</linux:device>
- <linux:mount_options datatype="string" entity_check="at least
one" operation="equals">nodev</linux:mount_options>
+ <linux:mount_options datatype="string" entity_check="all"
+ operation="not equal">nodev</linux:mount_options>
</linux:partition_state>
-
</def-group>