Ah, I need to figure out how to have the SSG just check for STIG findings.
Cool.
On Tue, Sep 10, 2013 at 1:30 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
It's not in the STIG, it's in the XCCDF prose. The check
exists now, but
it's broken.
Also, what Shawn said in the other thread.
- Maura Dailey
On 09/10/2013 12:56 PM, leam hall wrote:
What's the GENID on this? I didn't find it in the Jun STIG.
Thanks!
Leam
On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
>
> Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
> ---
> RHEL6/input/checks/mount_option_var_tmp_bind.xml | 44
> +++++++++++++++-------
> 1 files changed, 30 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> index 4d549c2..02630a7 100644
> --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> @@ -5,24 +5,40 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>The /var/tmp directory should be bind mounted to /tmp
> - in order to consolidate temporary storage into one location
> protected by the same
> - techniques as /tmp.</description>
> + <description>The /var/tmp directory should be bind mounted to /tmp
> in
> + order to consolidate temporary storage into one location protected
> by the
> + same techniques as /tmp.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> - <criteria>
> - <criterion comment="Unknown test stub"
> test_ref="test_bind_mount_var_tmp" />
> + <criteria operator="AND">
> + <criterion comment="Ensure /var/tmp is mounted"
> + test_ref="test_mount_option_var_tmp" />
> + <criterion comment="Ensure /tmp is bind mounted"
> + test_ref="test_mount_option_var_tmp_bind" />
> </criteria>
> </definition>
> + <linux:partition_test id="test_mount_option_var_tmp"
version="1"
> + comment="Ensure /var/tmp is mounted" check="all">
> + <linux:object object_ref="object_mount_option_var_tmp" />
> + </linux:partition_test>
> + <linux:partition_object id="object_mount_option_var_tmp"
version="1">
> + <linux:mount_point operation="pattern
> match">/var/tmp</linux:mount_point>
> + </linux:partition_object>
>
> - <ind:textfilecontent54_test check="all"
> check_existence="at_least_one_exists" comment="bind mount /var/tmp to
/tmp"
> id="test_bind_mount_var_tmp" version="1">
> - <ind:object object_ref="object_bind_mount_var_tmp" />
> - </ind:textfilecontent54_test>
> + <!-- The linux:partition_test reads from /proc/mounts, which does not
> record
> + the bind mount option. As a result, the less elegant
> textfilecontent54_test
> + is required here. -->
>
> - <ind:textfilecontent54_object comment="look for the partition mount
> point in /etc/fstab" id="object_bind_mount_var_tmp"
version="1">
> - <ind:path>/etc</ind:path>
> - <ind:filename>fstab</ind:filename>
> - <ind:pattern operation="pattern
> match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
> - <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> + <ind:textfilecontent54_test check="all"
> check_existence="at_least_one_exists"
> + comment="Ensure bind mount option is on /var/tmp"
> + id="test_mount_option_var_tmp_bind" version="1">
> + <ind:object object_ref="object_mount_option_var_tmp_bind" />
> + </ind:textfilecontent54_test>
> + <ind:textfilecontent54_object comment="look for the partition mount
> point in /etc/mtab"
> + id="object_mount_option_var_tmp_bind" version="1">
> + <ind:filepath>/etc/mtab</ind:filepath>
> + <ind:pattern operation="pattern
> match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
> + <ind:instance datatype="int" operation="greater than or
equal">
> + 1</ind:instance>
> </ind:textfilecontent54_object>
> -
> </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
--
Mind on a Mission <
http://leamhall.blogspot.com/>
_______________________________________________
scap-security-guide mailing
listscap-security-guide@lists.fedorahosted.orghttps://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide