This should be getting closer to a submission that addresses all OS SRG items.
Jeffrey Blank (2): provided details that the RHEL auditing system meets SRG requirements updates to CCI references for Rules in auditing, software integrity * audit tools are protected with vendor default permissions
RHEL6/input/auxiliary/srg_support.xml | 39 +++++++++++++++++++++++----- RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/software/integrity.xml | 2 +- 3 files changed, 34 insertions(+), 9 deletions(-)
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/auxiliary/srg_support.xml | 39 +++++++++++++++++++++++++++------ 1 files changed, 32 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml index 7e00479..d80264b 100644 --- a/RHEL6/input/auxiliary/srg_support.xml +++ b/RHEL6/input/auxiliary/srg_support.xml @@ -7,10 +7,10 @@ not clearly relate. </description>
-<!-- The CCI/SRG item referenced here are: +<!-- The CCI/SRG items referenced here are: - satisfied (through design and implementation) - selected in DoD baseline (per CNSS 1253) --> -<Rule id="met_inherently"> +<Rule id="met_inherently_generic"> <title>Product Meets this Requirement</title> <rationale> Red Hat Enterprise Linux meets this requirement through design and implementation. @@ -21,7 +21,32 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="56,130,1084,42,66,86,135,185,223,131,132,133,134,85,159,171,172,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674,206" /> +<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674" /> +</Rule> + + +<!-- The CCI/SRG items referenced here relate to auditing, and are: + - satisfied (through design and implementation) + - selected in DoD baseline (per CNSS 1253) --> +<Rule id="met_inherently_auditing"> +<title>Product Meets this Requirement</title> +<rationale> +The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. +</rationale> +<ocil>The RHEL6 auditing system supports this requirement and cannot be configured to be out of +compliance. Every audit record in RHEL includes a timestamp, the operation attempted, +success or failure of the operation, the subject involved (executable/process), +the object involved (file/path), and security labels for the subject and object. +It also includes the ability to label events with custom key labels. The auditing system +centralizes the recording of audit events for the entire system and includes +reduction (<tt>ausearch</tt>), reporting (<tt>aureport</tt>), and real-time +response (<tt>audispd</tt>) facilities. +This is a permanent not a finding. +</ocil> +<description> +This requirement is permanent not a finding. No fix is required. +</description> +<ref disa="130,131,132,133,134,135,159,174" /> </Rule>
@@ -39,14 +64,14 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1209,1214,1237,1269,1338,1425,1670" /> +<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1428,1209,1214,1237,1269,1338,1425,1670" /> </Rule>
<!-- The CCI/SRG item listed here are: - satisfied (by Rules in the guidance, which include the reference) - not selected in DoD baseline --> -<!-- disa="26,27,32,771,772,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" --> +<!-- disa="26,27,32,771,772,831,884,888,1095,1115,1117,1250,1339,1348,1353,1464,1496" -->
<!-- The CCI/SRG item referenced here are: @@ -66,7 +91,7 @@ application, policy, or service. This requirement is NA. <description> This requirement is NA. No fix is required. </description> -<ref disa="21,25,28,29,30,165,221,354,779,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1356,1373,1374,1383,1391,1392,1395,1632,1662" /> +<ref disa="21,25,28,29,30,165,221,354,553,779,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1356,1373,1374,1383,1391,1392,1395,1662" /> </Rule>
@@ -109,7 +134,7 @@ application, policy, or service. This requirement is NA. <description> This requirement is NA. No fix is required. </description> -<ref disa="371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" /> +<ref disa="15,371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" /> </Rule>
On 12/17/12 4:36 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil
RHEL6/input/auxiliary/srg_support.xml | 39 +++++++++++++++++++++++++++------ 1 files changed, 32 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml index 7e00479..d80264b 100644 --- a/RHEL6/input/auxiliary/srg_support.xml +++ b/RHEL6/input/auxiliary/srg_support.xml @@ -7,10 +7,10 @@ not clearly relate.
</description>
-<!-- The CCI/SRG item referenced here are: +<!-- The CCI/SRG items referenced here are: - satisfied (through design and implementation) - selected in DoD baseline (per CNSS 1253) --> -<Rule id="met_inherently"> +<Rule id="met_inherently_generic">
<title>Product Meets this Requirement</title> <rationale> Red Hat Enterprise Linux meets this requirement through design and implementation. @@ -21,7 +21,32 @@ compliance. This is a permanent not a finding. <description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="56,130,1084,42,66,86,135,185,223,131,132,133,134,85,159,171,172,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674,206" /> +<ref disa="42,56,206,1084,66,85,86,185,223,171,172,1694,770,804,162,163,164,345,346,1096,1111,1291,386,156,186,1083,1082,1090,804,1127,1128,1129,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1632,1693,1665,1674" /> +</Rule> + + +<!-- The CCI/SRG items referenced here relate to auditing, and are: + - satisfied (through design and implementation) + - selected in DoD baseline (per CNSS 1253) --> +<Rule id="met_inherently_auditing"> +<title>Product Meets this Requirement</title> +<rationale> +The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. +</rationale> +<ocil>The RHEL6 auditing system supports this requirement and cannot be configured to be out of +compliance. Every audit record in RHEL includes a timestamp, the operation attempted, +success or failure of the operation, the subject involved (executable/process), +the object involved (file/path), and security labels for the subject and object. +It also includes the ability to label events with custom key labels. The auditing system +centralizes the recording of audit events for the entire system and includes +reduction (<tt>ausearch</tt>), reporting (<tt>aureport</tt>), and real-time +response (<tt>audispd</tt>) facilities. +This is a permanent not a finding. +</ocil> +<description> +This requirement is permanent not a finding. No fix is required. +</description> +<ref disa="130,131,132,133,134,135,159,174" /> </Rule>
@@ -39,14 +64,14 @@ compliance. This is a permanent not a finding.
<description> This requirement is permanent not a finding. No fix is required. </description> -<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1209,1214,1237,1269,1338,1425,1670" /> +<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1428,1209,1214,1237,1269,1338,1425,1670" /> </Rule>
<!-- The CCI/SRG item listed here are: - satisfied (by Rules in the guidance, which include the reference) - not selected in DoD baseline -->
-<!-- disa="26,27,32,771,772,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" --> +<!-- disa="26,27,32,771,772,831,884,888,1095,1115,1117,1250,1339,1348,1353,1464,1496" -->
<!-- The CCI/SRG item referenced here are: @@ -66,7 +91,7 @@ application, policy, or service. This requirement is NA.
<description> This requirement is NA. No fix is required. </description> -<ref disa="21,25,28,29,30,165,221,354,779,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1356,1373,1374,1383,1391,1392,1395,1632,1662" /> +<ref disa="21,25,28,29,30,165,221,354,553,779,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1356,1373,1374,1383,1391,1392,1395,1662" /> </Rule>
@@ -109,7 +134,7 @@ application, policy, or service. This requirement is NA.
<description> This requirement is NA. No fix is required. </description> -<ref disa="371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" /> +<ref disa="15,371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" /> </Rule>
Very clean approach to this. Ack.
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/software/integrity.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index d07d9ed..b64a160 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -93,7 +93,7 @@ actions will be taken if other obstacles exist. </rationale> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> -<ref nist="CM-6, CM-7" disa="347,169,157,172,174,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> +<ref nist="CM-6, CM-7" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> <tested by="DS" on="20121024"/> </Rule>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 9be9221..bc96e7d 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -161,7 +161,7 @@ The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.</rationale> <ident cce="14931-0" /> <oval id="rpm_verify_permissions" /> -<ref nist="SI-7"/> +<ref nist="SI-7" disa="1493,1494,1495" /> </Rule>
<Rule id="rpm_verify_hashes">
On 12/17/12 4:36 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blankblank@eclipse.ncsc.mil
RHEL6/input/system/auditing.xml | 2 +- RHEL6/input/system/software/integrity.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index d07d9ed..b64a160 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
</rationale> <ident cce="4292-9" /> <oval id="service_auditd_enabled" /> -<ref nist="CM-6, CM-7" disa="347,169,157,172,174,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> +<ref nist="CM-6, CM-7" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" /> <tested by="DS" on="20121024"/> </Rule>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 9be9221..bc96e7d 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -161,7 +161,7 @@ The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.</rationale>
<ident cce="14931-0" /> <oval id="rpm_verify_permissions" /> -<ref nist="SI-7"/> +<ref nist="SI-7" disa="1493,1494,1495" /> </Rule>
<Rule id="rpm_verify_hashes"> -- 1.7.1
Ack
scap-security-guide@lists.fedorahosted.org
-
Jeffrey Blank -
Shawn Wells