[PATCH 5/5] Created prose for NFS insecure_locks option.

Willy Santos wsantos at redhat.com
Wed Jul 25 21:36:50 UTC 2012


Added prose to the NFS server section about checking for exports using the insecure_locks option. Added mapping to CCI-764 and removed mapping of CCI-764 to met_inherently. Fixed some formatting issues in NFS section as well.

Signed-off-by: Willy Santos <wsantos at redhat.com>
---
 RHEL6/input/auxiliary/srg_support.xml |    2 +-
 RHEL6/input/services/nfs.xml          |   26 ++++++++++++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index 128a6dd..797bb01 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -12,7 +12,7 @@ not clearly relate.
 Red Hat Enterprise Linux meets this requirement by design.
 <!-- We could include discussion of Common Criteria Testing if so desired here. -->
 </description>
-<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
+<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
 </Group> <!-- end met_inherently -->
 
 <Group id="unmet_impractical_guidance">
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index 7f5e049..abbb12d 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -241,6 +241,9 @@ should be installed to their default location on the local filesystem.</rational
 <oval id="mount_option_nosuid_remote_filesystems" />
 </Rule>
 
+</Group>
+</Group>
+
 <Group id="nfs_configuring_servers">
 <title>Configure NFS Servers</title>
 <description>The steps in this section are appropriate for machines which operate as NFS servers.</description>
@@ -334,8 +337,27 @@ attacker could gain access to data on the NFS server.</rationale>
 <oval id="TO:DO" />
 </Rule>
 
+<Rule id="no_insecure_locks_exports">
+<title>Ensure Insecure File Locking is Not Allowed</title>
+<description>By default the NFS server requires secure file-lock requests, which require credentials
+from the client in order to lock a file. Most NFS clients send credentials with file lock requests,
+however, there are a few clients that do not send credentials when requesting a file-lock, allowing
+the client to only be able to lock world-readable files. To get around this, the <tt>insecure_locks</tt>
+option can be used so these clients can access the desired export. This poses a security risk by
+potentially allowing the client access to data for which it does not have authorization.
+<br /><br />
+This configuration is not recommended and strongly discouraged.
+<br /><br />
+Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure_locks</tt>.
+</description>
+<rationale>Allowing insecure file locking could allow for sensitive data to be viewed or edited by
+an unauthorized user.
+</rationale>
+<ident cce="TO:DO" />
+<oval id="TO:DO" />
+<ref disa="764" />
+</Rule>
+
 </Group> <!-- nfs_configuring_servers -->
 
 </Group>
-</Group>
-</Group>
-- 
1.7.7.6



More information about the scap-security-guide mailing list