Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++---------
1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
index a5e6334..e0abd50 100644
--- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
+++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
@@ -1,36 +1,38 @@
<def-group>
- <definition class="compliance"
id="mount_option_nodev_nonroot_local_partitions" version="1">
+ <definition class="compliance"
+ id="mount_option_nodev_nonroot_local_partitions" version="1">
<metadata>
<title>Add nodev Option to Non-Root Local Partitions</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The nodev mount option prevents files from being
- interpreted as character or block devices. Legitimate character and block
- devices should exist in the /dev directory on the root partition or
- within chroot jails built for system services. All other locations should not
- allow character and block devices.</description>
+ <description>The nodev mount option prevents files from being interpreted
+ as character or block devices. Legitimate character and block devices
+ should exist in the /dev directory on the root partition or within chroot
+ jails built for system services. All other locations should not allow
+ character and block devices.</description>
+ <reference source="MED" ref_id="20130821"
ref_url="test_attestation" />
</metadata>
<criteria>
- <criterion comment="nodev on local filesystems"
test_ref="test_nodev_nonroot_local_partitions" />
+ <criterion comment="nodev on local filesystems"
+ test_ref="test_nodev_nonroot_local_partitions" negate="true"
/>
</criteria>
</definition>
-
- <linux:partition_test check="all" check_existence="all_exist"
id="test_nodev_nonroot_local_partitions" version="1"
comment="nodev on local filesystems">
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_nodev_nonroot_local_partitions" version="1"
+ comment="nodev on local filesystems">
<linux:object object_ref="object_non_root_partitions" />
<linux:state state_ref="state_local_nodev" />
</linux:partition_test>
-
<linux:partition_object id="object_non_root_partitions"
version="1">
<!-- look at all partitions except root -->
<linux:mount_point operation="pattern
match">^/\w.*$</linux:mount_point>
<filter action="include">state_local_nodev</filter>
</linux:partition_object>
-
<linux:partition_state id="state_local_nodev" version="1">
<!-- this check defines a local partition as one which has a device node in /dev
-->
<linux:device operation="pattern
match">^/dev/.*$</linux:device>
- <linux:mount_options datatype="string" entity_check="at least
one" operation="equals">nodev</linux:mount_options>
+ <linux:mount_options datatype="string" entity_check="all"
+ operation="not equal">nodev</linux:mount_options>
</linux:partition_state>
-
</def-group>
--
1.7.1
Show replies by date