[PATCH 3/8] rework of CCI references in SRG support file to indicate selection on DoD baselines

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Dec 17 14:15:34 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/srg_support.xml |   88 ++++++++++++++++++++++-----------
 1 files changed, 59 insertions(+), 29 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index 0682834..849e23b 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -6,11 +6,14 @@ those cases where Groups or Rules elsewhere in scap-security-guide do
 not clearly relate.
 </description>
 
+
+<!-- The CCI/SRG item referenced here are:
+     - satisfied (through design and implementation)
+     - selected in DoD baseline (per CNSS 1253) -->
 <Rule id="met_inherently">
 <title>Product Meets this Requirement</title>
 <rationale>
-Red Hat Enterprise Linux meets this requirement by design.
-<!-- We could include discussion of Common Criteria Testing if so desired here. -->
+Red Hat Enterprise Linux meets this requirement through design and implementation.
 </rationale>
 <ocil>RHEL6 supports this requirement and cannot be configured to be out of 
 compliance. This is a permanent not a finding. 
@@ -18,15 +21,17 @@ compliance. This is a permanent not a finding.
 <description> 
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref disa="56,1084,42,66,68,135,223,131,132,133,134,85,159,1694,770,804,162,163,164,345,346,872,1493,1494,1495,226,1096,1111,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
-</Rule> <!-- end met_inherently -->
+<ref disa="56,1084,42,66,135,223,131,132,133,134,85,159,1694,770,804,162,163,164,345,346,1493,1494,1495,1096,1111,1291,386,156,186,1083,1082,1090,804,1248,1265,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1674,206" />
+</Rule>
 
 
+<!-- The CCI/SRG item referenced here are:
+     - satisfied (through design and implementation)
+     - not selected in a DoD baseline -->
 <Rule id="met_inherently_nonselected">
 <title>Product Meets this Requirement</title>
 <rationale>
-Red Hat Enterprise Linux meets this requirement by design.
-<!-- We could include discussion of Common Criteria Testing if so desired here. -->
+Red Hat Enterprise Linux meets this requirement through design and implementation.
 </rationale>
 <ocil>RHEL6 supports this requirement and cannot be configured to be out of 
 compliance. This is a permanent not a finding. 
@@ -34,10 +39,21 @@ compliance. This is a permanent not a finding.
 <description> 
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref disa="1086,1087,1090,1091,1424,1426,802" />
-</Rule> <!-- end met_inherently -->
+<ref disa="34,35,99,154,226,802,872,1086,1087,1089,1091,1424,1426,1209,1214,1237,1269,1338,1425,1670" />
+</Rule> 
+
+
+<!-- The CCI/SRG item listed here are:
+     - satisfied (by Rules in the guidance, which include the reference)
+     - not selected in DoD baseline -->
+<!-- disa="26,27,32,771,772,779,831,884,888,1095,1115,1117,1250,1339,1348,1353,1428,1464,1496" -->
 
-<Rule id="unmet_impractical_guidance">
+
+<!-- The CCI/SRG item referenced here are:
+     - not satisfied
+     - not selected in a DoD baseline
+     - considered out of scope -->
+<Rule id="unmet_nonfinding_nonselected_scope">
 <title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
 <rationale>
 The guidance does not meet this requirement.
@@ -50,37 +66,51 @@ application, policy, or service. This requirement is NA.
 <description> 
 This requirement is NA. No fix is required.
 </description>
-<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,37,221,25,28,29,30,24,1112,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1340,1352,1401,1555,1556,1150" />
-</Rule> <!-- end unmet_impractical_guidance -->
+<ref disa="21,25,28,29,30,165,221,354,780,781,1009,1094,1123,1124,1125,1132,1135,1140,1141,1142,1143,1145,1147,1148,1166,1295,1340,1341,1350,1373,1374,1383,1391,1392,1395,1662" />
+</Rule>
+
 
-<Rule id="requirement_unclear">
-<title>Implementation of the Requirement is Unclear</title>
+<!-- The CCI/SRG items referenced here are:
+     - not satisfied
+     - not selected in a DoD baseline
+     - considered permanent findings -->
+<Rule id="unmet_finding_nonselected">
+<title>Implementation of the Requirement is Not Supported</title>
 <rationale>
-It is unclear how to satisfy this requirement.
-</rationale> 
-<ocil> 
-RHEL6 does not support this requirement. This is a permanent finding. 
-</ocil> 
+RHEL6 does not support this requirement.
+</rationale>
+<ocil>
+This is a permanent finding.
+</ocil>
 <description>
-This requirement is a permanent finding and cannot be fixed. An appropriate 
-mitigation for the system must be implemented but this finding cannot be 
+This requirement is a permanent finding and cannot be fixed. An appropriate
+mitigation for the system must be implemented but this finding cannot be
 considered fixed.
 </description>
-<ref disa="20,31,218,219,1158,1291,1294,1295,1428,1500" />
-</Rule> <!-- end requirement_unclear -->
+<ref disa="20,31,52,53,218,219,1158,1294,1295,1500" />
+<!-- Note: CCI 52 supported for text login, but not graphical -->
+</Rule>
 
-<Rule id="new_rule_needed">
-<title>A New Policy/Manual Rule is Needed</title>
+
+<!-- The CCI/SRG items referenced here are:
+     - not satisfied
+     - selected in a DoD baseline
+     - considered NA -->
+<Rule id="unmet_nonfinding_scope">
+<title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
 <rationale>
-A new Rule needs to be created in the scap-security-guide content.
+The guidance does not meet this requirement.
+The requirement is impractical or out of scope.
 </rationale> 
 <ocil> 
-RHEL6 does support this requirement but the guidance is not yet written. 
+RHEL6 cannot support this requirement without assistance from an external 
+application, policy, or service. This requirement is NA. 
 </ocil> 
 <description> 
-When the guidance is written, the fix will be forthcoming.
+This requirement is NA. No fix is required.
 </description>
-<ref disa="52,53,1009,1019,1159,1125,1140,1143" />
-</Rule> <!-- end new_rule_needed -->
+<ref disa="371,372,535,537,539,1682,370,37,24,1112,1126,1143,1149,1157,1159,1210,1211,1274,1372,1376,1377,1352,1401,1555,1556,1150" />
+</Rule>
+
 
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list