Yes indeed. But you've got bigger problems if somebody was able to
start writing there to begin with. I was unable to conjure a security
argument strong enough to justify typing this, much less requiring it.
While terribly tempting and very much in the C&A mindset, I would
generally prefer that we avoid erecting gates like this:
http://www.jokeroo.com/pictures/car/security-gate-fail.html
On 08/30/2012 09:43 PM, Shawn Wells wrote:
On 8/28/12 10:29 AM, Jeffrey Blank wrote:
> ACK to these minor changes.
Pushed
> I don't see the value in noexec on /var/log and /var/log/audit, and
> there had better be clear value in anything that is added.
Some places mount it with noexec as there should be no executables on
those partitions, while others don't. Wanted to bring it up for discussion.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide