[PATCH 7/7] General prose updates to Permissions/Partitions section - General language changes for readability and tone consistency

Shawn Wells shawn at redhat.com
Thu Aug 23 22:19:50 UTC 2012


Other notes:
- Should a rule be created for noexec on /var/log and /var/log/audit? Will open a ticket on this for discussion
---
 RHEL6/input/system/permissions/partitions.xml |   37 +++++++++++-------------
 1 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 87e78df..2380a3a 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -1,32 +1,30 @@
 <Group id="partitions">
 <title>Restrict Partition Mount Options</title>
 <description>System partitions can be mounted with certain options
-which limit what files on those partitions can do. These options
-are set in the file <tt>/etc/fstab</tt>, and can be used to make certain
-types of malicious behavior more difficult.</description>
+that limit what files on those partitions can do. These options
+are set in the  <tt>/etc/fstab</tt> configuration file, and can be
+used to make certain types of malicious behavior more difficult.</description>
 
 <Value id="var_removable_partition" type="string" operator="equals" interactive="0">
 <title>Removable Partition</title>
 <description>This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
 and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
-removable media such as CD-ROMs, usb keys, and floppy drives. This value should be modified to reflect any removable
+removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
 partitions that are required on the local system.</description>
 <value selector="dev_cdrom">/dev/cdrom</value>
 </Value>
 
 <Rule id="mountopt_nodev_on_nonroot_partitions">
 <title>Add nodev Option to Non-Root Local Partitions</title>
-<description>The <tt>nodev</tt> mount option prevents files from being
-interpreted as character or block devices. Legitimate character and block
-devices should exist in the <tt>/dev</tt> directory on the root partition or
-within chroot jails built for system services. All other locations should not
-allow character and block devices.
-<br /><br />
-The one exception to this rule is the existance of chroot jails located
-on a partition other than the root partition. In this case, it is not
-advised to set <tt>nodev</tt> on these filesystems.</description>
-<rationale>The only legitimate location for device files is the /dev directory
-located on the root partition. The only exception to this is chroot jails.</rationale>
+<description>Legitimate character and block devices should exist in
+the <tt>/dev</tt> directory on the root partition or within chroot
+jails built for system services. All other locations should not allow
+character and block devices.</description>
+<rationale>The <tt>nodev</tt> mount option prevents files from being
+interpreted as character or block devices. The only legitimate location
+for device files is the /dev directory located on the root partition.
+The only exception to this is chroot jails, for which it is not advised
+to set <tt>nodev</tt> on these filesystems.</rationale>
 <ident cce="4249-9" />
 <oval id="mount_option_nodev_nonroot_local_partitions" />
 <ref nist="CM-6, CM-7, AC-6"/>
@@ -34,13 +32,13 @@ located on the root partition. The only exception to this is chroot jails.</rati
 
 <Rule id="mountopt_nodev_on_removable_partitions">
 <title>Add nodev Option to Removable Media Partitions</title>
-<description>The <tt>nodev</tt> mount option prevents files from being
+<description>Removable Media partitions should be mounted with the <tt>
+nodev</tt> option.</description>
+<rationale>The <tt>nodev</tt> mount option prevents files from being
 interpreted as character or block devices. Legitimate character and block
 devices should exist in the <tt>/dev</tt> directory on the root partition or
 within chroot jails built for system services. All other locations should not
-allow character and block devices.</description>
-<rationale>The only legitimate location for device files is the /dev directory
-located on the root partition. The only exception to this is chroot jails.</rationale>
+allow character and block devices.</rationale>
 <ident cce="3522-0" />
 <oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
 <ref nist="CM-7, MP-2"/>
@@ -169,4 +167,3 @@ necessary to meet requirements, the storage location /var/tmp should be bind mou
 </Rule>
 
 </Group>
-
-- 
1.7.1


--EVF5PPMfhYS0aIcm--


More information about the scap-security-guide mailing list