[PATCH 13/21] Mapped CCI-001170 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:54:54 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001170 requires preventing the automatic execution of mobile code in org-defined software applications and must require org-defined actions prior to executing the code. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index c8bf6e6..5b2ab64 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158,1166,1695,1169" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158,1166,1695,1169,1170" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000183 	CCI-001170 	The operating system must prevent the 
automatic execution of mobile code in organization-defined software 
applications and must require organization-defined actions prior to 
executing the code. 	Decisions regarding the employment of mobile code 
within operating systems are based on the potential for the code to 
cause damage to the system if used maliciously. Mobile code technologies 
include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, 
Flash animations, and VBScript. Usage restrictions and implementation 
guidance apply to both the selection and use of mobile code installed on 
organizational servers and mobile code downloaded and executed on 
individual workstations.


impractical_product. Assuming the application already has access to it 
(e.g. already MAC and DAC checks), I don't see a method the OS can use 
to prevent code execution within an app.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/4ce3211d/attachment.html>


More information about the scap-security-guide mailing list