[PATCH 11/13] Added 800-53 refs for mounting rules.

Willy Santos wsantos at redhat.com
Wed Apr 25 13:11:38 UTC 2012


From: Willy Santos <wsantos at redhat>


Signed-off-by: Willy Santos <wsantos at redhat>
---
 rhel6/src/input/system/permissions/mounting.xml |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/rhel6/src/input/system/permissions/mounting.xml b/rhel6/src/input/system/permissions/mounting.xml
index 87b83d6..1899858 100644
--- a/rhel6/src/input/system/permissions/mounting.xml
+++ b/rhel6/src/input/system/permissions/mounting.xml
@@ -27,7 +27,7 @@ solve the same problem with less risk.</description>
 <rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, ​​and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale>
 <ident cce="3685-5" />
 <oval id="console_device_restrict_access_desktop" />
-<!--<ref nist="CM-6, CM-7" />-->
+<ref nist="AC-6, CM-6, CM-7" />
 </Rule>
 
 <Rule id="console_device_restrict_access_server">
@@ -37,7 +37,7 @@ solve the same problem with less risk.</description>
 <rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, ​​and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale>
 <ident cce="3685-5" />
 <oval id="console_device_restrict_access_server" />
-<!--<ref nist="CM-6, CM-7" />-->
+<ref nist="AC-6, CM-6, CM-7" />
 </Rule>
 
 <Rule id="kernel_module_usb-storage_disabled">
@@ -283,7 +283,7 @@ malicious file would exploit the thumbnailer with the potential for malicious co
 is best to disable these thumbnailer applications unless they are explicitly required.</rationale>
 <ident cce="TODO" />
 <oval id="disable_gnome_thumbnailers" />
-<ref nist="TODO" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 </Group>
-- 
1.7.7.6



More information about the scap-security-guide mailing list