[PATCH 11/13] Added 800-53 refs for mounting rules.
Willy Santos
wsantos at redhat.fedorahosted.org
Wed Apr 25 13:10:06 UTC 2012
Signed-off-by: Willy Santos <wsantos at redhat>
---
rhel6/src/input/system/permissions/mounting.xml | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/rhel6/src/input/system/permissions/mounting.xml b/rhel6/src/input/system/permissions/mounting.xml
index 87b83d6..1899858 100644
--- a/rhel6/src/input/system/permissions/mounting.xml
+++ b/rhel6/src/input/system/permissions/mounting.xml
@@ -27,7 +27,7 @@ solve the same problem with less risk.</description>
<rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale>
<ident cce="3685-5" />
<oval id="console_device_restrict_access_desktop" />
-<!--<ref nist="CM-6, CM-7" />-->
+<ref nist="AC-6, CM-6, CM-7" />
</Rule>
<Rule id="console_device_restrict_access_server">
@@ -37,7 +37,7 @@ solve the same problem with less risk.</description>
<rationale>When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for <tt>pam_console</tt> for more information</rationale>
<ident cce="3685-5" />
<oval id="console_device_restrict_access_server" />
-<!--<ref nist="CM-6, CM-7" />-->
+<ref nist="AC-6, CM-6, CM-7" />
</Rule>
<Rule id="kernel_module_usb-storage_disabled">
@@ -283,7 +283,7 @@ malicious file would exploit the thumbnailer with the potential for malicious co
is best to disable these thumbnailer applications unless they are explicitly required.</rationale>
<ident cce="TODO" />
<oval id="disable_gnome_thumbnailers" />
-<ref nist="TODO" />
+<ref nist="CM-6, CM-7" />
</Rule>
</Group>
--
1.7.7.6
More information about the scap-security-guide
mailing list