[PATCH 11/21] Mapped CCI-001695 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:50:47 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001695 requires preventing the execution of prohibited mobile code. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 06b1b9d..662ef25 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158,1166" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158,1166,1695" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000181 	CCI-001695 	The operating system must prevent the 
execution of prohibited mobile code. 	Decisions regarding the employment 
of mobile code within operating systems are based on the potential for 
the code to cause damage to the system if used maliciously. Mobile code 
technologies include Java, JavaScript, ActiveX, PDF, Postscript, 
Shockwave movies, Flash animations, and VBScript. Usage restrictions and 
implementation guidance apply to both the selection and use of mobile 
code installed on organizational servers and mobile code downloaded and 
executed on individual workstations.


impractical_product

The OS isn't aware of what is /prohibited/ mobile code. The closest 
thing I've heard of to meet this would be DigSig, which was a kernel 
module that required all binaries to be signed. If they weren't the 
kernel wouldn't let them be run. http://disec.sourceforge.net/

This sounds like a good RFE to Red Hat though.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/ae4589b7/attachment.html>


More information about the scap-security-guide mailing list