Ah, I need to figure out how to have the SSG just check for STIG findings. Cool.


On Tue, Sep 10, 2013 at 1:30 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:
It's not in the STIG, it's in the XCCDF prose. The check exists now, but it's broken.

Also, what Shawn said in the other thread.

- Maura Dailey


On 09/10/2013 12:56 PM, leam hall wrote:
What's the GENID on this? I didn't find it in the Jun STIG.

Thanks!

Leam


On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:

Signed-off-by: Maura Dailey <maura@eclipse.ncsc.mil>
---
 RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44 +++++++++++++++-------
 1 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
index 4d549c2..02630a7 100644
--- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
+++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
@@ -5,24 +5,40 @@
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /var/tmp directory should be bind mounted to /tmp
-      in order to consolidate temporary storage into one location protected by the same
-      techniques as /tmp.</description>
+      <description>The /var/tmp directory should be bind mounted to /tmp in
+      order to consolidate temporary storage into one location protected by the
+      same techniques as /tmp.</description>
+      <reference source="MED" ref_id="20130821" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="Unknown test stub" test_ref="test_bind_mount_var_tmp" />
+    <criteria operator="AND">
+      <criterion comment="Ensure /var/tmp is mounted"
+      test_ref="test_mount_option_var_tmp" />
+      <criterion comment="Ensure /tmp is bind mounted"
+      test_ref="test_mount_option_var_tmp_bind" />
     </criteria>
   </definition>
+  <linux:partition_test id="test_mount_option_var_tmp" version="1"
+  comment="Ensure /var/tmp is mounted" check="all">
+    <linux:object object_ref="object_mount_option_var_tmp" />
+  </linux:partition_test>
+  <linux:partition_object id="object_mount_option_var_tmp" version="1">
+    <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
+  </linux:partition_object>

-  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="bind mount /var/tmp to /tmp" id="test_bind_mount_var_tmp" version="1">
-    <ind:object object_ref="object_bind_mount_var_tmp" />
-  </ind:textfilecontent54_test>
+  <!-- The linux:partition_test reads from /proc/mounts, which does not record
+       the bind mount option. As a result, the less elegant textfilecontent54_test
+       is required here. -->

-  <ind:textfilecontent54_object comment="look for the partition mount point in /etc/fstab" id="object_bind_mount_var_tmp" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>fstab</ind:filename>
-    <ind:pattern operation="pattern match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  comment="Ensure bind mount option is on /var/tmp"
+  id="test_mount_option_var_tmp_bind" version="1">
+    <ind:object object_ref="object_mount_option_var_tmp_bind" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
+  id="object_mount_option_var_tmp_bind" version="1">
+    <ind:filepath>/etc/mtab</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">
+    1</ind:instance>
   </ind:textfilecontent54_object>
-
 </def-group>
--
1.7.1

_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



--


_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide




--
Mind on a Mission