[PATCH 04/25] Mapped CCI-000804 to unmet_impractical_guidance.

Shawn Wells shawn at redhat.com
Tue Jul 3 01:37:57 UTC 2012


On 7/2/12 8:51 PM, Willy Santos wrote:
> CCI-000804 requires uniquely identifying and authenticating non-organizational users. This is an organization-defined policy (e.g. group membership, identifier appended to username, etc.) and out of the scope of this guide.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index fe2d83e..f5cac5a 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design.
>   The guidance does not meet this requirement.
>   The requirement is impractical or out of scope.
>   </description>
> -<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24" />
> +<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,804" />
>   </Group> <!-- end unmet_impractical_guidance -->
>   
>   <Group id="unmet_impractical_product">


SRG-OS-000121 	CCI-000804 	The operating system must uniquely identify 
and must authenticate non-organizational users (or processes acting on 
behalf of non-organizational users). 	Non-organizational users include 
all operating system users other than organizational users which include 
employees or individuals the organization deems to have equivalent 
status of employees (e.g., contractors, guest researchers, individuals 
from allied nations). Non-organizational users shall be uniquely 
identified and authenticated for all accesses other than those accesses 
explicitly identified and documented by the organization when related to 
the use of anonymous access.



Could we make an argument that this requirement is met by uniquely 
identifying ALL users -- organizational or non-organizational -- by 
assigning them UIDs?

IIRC, this requirement is frequently interpreted as "blue badgers staff 
are organizational users, green badgers are non-organizational users. 
both get unique identifiers." Through this interpretation could we map 
to met_inherently?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120702/bb1741c0/attachment.html>


More information about the scap-security-guide mailing list