Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/auxiliary/transition_notes.xml | 6 +-
.../system/accounts/restrictions/root_logins.xml | 42 ++++++++++++++++++++
RHEL6/input/system/software/integrity.xml | 4 +-
3 files changed, 47 insertions(+), 5 deletions(-)
diff --git a/RHEL6/input/auxiliary/transition_notes.xml
b/RHEL6/input/auxiliary/transition_notes.xml
index 095d39b..8fe2a0a 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -526,7 +526,7 @@ This is covered in RHEL 6 content.
</note>
<note ref="22524" auth="DS">
-This is covered in the RHEL6 content.
+This is not covered in the RHEL6 content. AppleTalk support is not included in RHEL6.
</note>
<note ref="22530" auth="VP">
@@ -811,7 +811,7 @@ This is desirable but not practical in many environments. Notably,
many other O
do not even support this capability.
</note>
-<note ref="776,777,780,781,782,4382,11975,12765" auth="JB">
+<note ref="780,781,4382,11975,12765" auth="JB">
This needs to be added to the RHEL6 content.
</note>
@@ -1634,7 +1634,7 @@ exist.
rule=sshd_enable_warning_banner manual=no
</note>
-<note ref="812,761" auth="DS">
+<note ref="776,777,812,761,782" auth="DS">
This is covered in the RHEL6 content.
</note>
</notegroup>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml
b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index e234e7e..e9bc55a 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -150,5 +150,47 @@ access to root privileges in an accountable manner.
<ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
</Rule>
+<Rule id="root_path_defaultabsolute">
+<title>Root Path Must Be Vendor Default</title>
+<description>
+Assuming root shell is bash, edit the following files:
+<pre>~/.profile</pre>
+<pre>~/.bashrc</pre>
+Change any <tt>PATH</tt> variables to the vendor default for root and remove
any
+empty <tt>PATH</tt> entries or references to relative paths.
+</description>
+<ocil clause="any of these conditions are not met">
+To view the root user's <tt>PATH</tt>, run the following command:
+<pre># env | grep PATH</pre>
+If correctly configured, the <tt>PATH</tt> must: use vendor default settings,
+have no empty entries, and have no entries beginning with a character
+other than a slash (/).
+</ocil>
+<rationale>
+The root account's executable search path must be the vendor default, and must
+contain only absolute paths.
+</rationale>
+<ref disa="366" />
+</Rule>
+
+<Rule id="root_path_no_wwdir">
+<title>Root Path Must Not Contain World-Writable Directories</title>
+<description>
+If a world-writable directory is found in the <tt>PATH</tt>, remove the
+world-writable permission for that directory with the following command:
+<pre># chmod o-w <i>/dir</i></pre>
+Alternately, remove the world-writable directory from the <tt>PATH</tt>.
+</description>
+<ocil clause="any world-writable directories are found">
+World-writable permissions on directories in root's path can be checked
+with the following command:
+<pre># ls -ld 'echo $PATH | sed "s/:/ /g"'</pre>
+</ocil>
+<rationale>
+If the root search path contains a world-writable directory, malicious software
+could be placed in the path.
+</rationale>
+<ref disa="366" />
+</Rule>
</Group>
diff --git a/RHEL6/input/system/software/integrity.xml
b/RHEL6/input/system/software/integrity.xml
index 371b024..37e0d9b 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -31,11 +31,11 @@ configurable, with further configuration information located in
Install a Host-Based Intrusion Detection Tool
</description>
<ocil clause="no host-based intrusion detection systems are installed">
-The preferred host-based intrusion detection system is the McAfee HBSS product.
+For DoD systems, HBSS is typically provided.
<package-check-macro package="mfehiplsm"/>
</ocil>
<rationale>
-Host-based intrusion detection tools allow for system-level intrusion defense.
+Host-based intrusion detection systems monitor hosts for potentially malicious behavior.
</rationale>
<ref disa="1263"/>
</Rule>
--
1.7.1