[PATCH 7/7] General prose updates to Permissions/Partitions section - General language changes for readability and tone consistency
Shawn Wells
shawn at redhat.com
Thu Aug 23 22:19:50 UTC 2012
Other notes:
- Should a rule be created for noexec on /var/log and /var/log/audit? Will open a ticket on this for discussion
---
RHEL6/input/system/permissions/partitions.xml | 37 +++++++++++-------------
1 files changed, 17 insertions(+), 20 deletions(-)
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 87e78df..2380a3a 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -1,32 +1,30 @@
<Group id="partitions">
<title>Restrict Partition Mount Options</title>
<description>System partitions can be mounted with certain options
-which limit what files on those partitions can do. These options
-are set in the file <tt>/etc/fstab</tt>, and can be used to make certain
-types of malicious behavior more difficult.</description>
+that limit what files on those partitions can do. These options
+are set in the <tt>/etc/fstab</tt> configuration file, and can be
+used to make certain types of malicious behavior more difficult.</description>
<Value id="var_removable_partition" type="string" operator="equals" interactive="0">
<title>Removable Partition</title>
<description>This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
-removable media such as CD-ROMs, usb keys, and floppy drives. This value should be modified to reflect any removable
+removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
partitions that are required on the local system.</description>
<value selector="dev_cdrom">/dev/cdrom</value>
</Value>
<Rule id="mountopt_nodev_on_nonroot_partitions">
<title>Add nodev Option to Non-Root Local Partitions</title>
-<description>The <tt>nodev</tt> mount option prevents files from being
-interpreted as character or block devices. Legitimate character and block
-devices should exist in the <tt>/dev</tt> directory on the root partition or
-within chroot jails built for system services. All other locations should not
-allow character and block devices.
-<br /><br />
-The one exception to this rule is the existance of chroot jails located
-on a partition other than the root partition. In this case, it is not
-advised to set <tt>nodev</tt> on these filesystems.</description>
-<rationale>The only legitimate location for device files is the /dev directory
-located on the root partition. The only exception to this is chroot jails.</rationale>
+<description>Legitimate character and block devices should exist in
+the <tt>/dev</tt> directory on the root partition or within chroot
+jails built for system services. All other locations should not allow
+character and block devices.</description>
+<rationale>The <tt>nodev</tt> mount option prevents files from being
+interpreted as character or block devices. The only legitimate location
+for device files is the /dev directory located on the root partition.
+The only exception to this is chroot jails, for which it is not advised
+to set <tt>nodev</tt> on these filesystems.</rationale>
<ident cce="4249-9" />
<oval id="mount_option_nodev_nonroot_local_partitions" />
<ref nist="CM-6, CM-7, AC-6"/>
@@ -34,13 +32,13 @@ located on the root partition. The only exception to this is chroot jails.</rati
<Rule id="mountopt_nodev_on_removable_partitions">
<title>Add nodev Option to Removable Media Partitions</title>
-<description>The <tt>nodev</tt> mount option prevents files from being
+<description>Removable Media partitions should be mounted with the <tt>
+nodev</tt> option.</description>
+<rationale>The <tt>nodev</tt> mount option prevents files from being
interpreted as character or block devices. Legitimate character and block
devices should exist in the <tt>/dev</tt> directory on the root partition or
within chroot jails built for system services. All other locations should not
-allow character and block devices.</description>
-<rationale>The only legitimate location for device files is the /dev directory
-located on the root partition. The only exception to this is chroot jails.</rationale>
+allow character and block devices.</rationale>
<ident cce="3522-0" />
<oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
<ref nist="CM-7, MP-2"/>
@@ -169,4 +167,3 @@ necessary to meet requirements, the storage location /var/tmp should be bind mou
</Rule>
</Group>
-
--
1.7.1
--EVF5PPMfhYS0aIcm--
More information about the scap-security-guide
mailing list