[PATCH 5/5] Created prose for NFS insecure_locks option.
Willy Santos
wsantos at redhat.com
Wed Jul 25 21:36:50 UTC 2012
Added prose to the NFS server section about checking for exports using the insecure_locks option. Added mapping to CCI-764 and removed mapping of CCI-764 to met_inherently. Fixed some formatting issues in NFS section as well.
Signed-off-by: Willy Santos <wsantos at redhat.com>
---
RHEL6/input/auxiliary/srg_support.xml | 2 +-
RHEL6/input/services/nfs.xml | 26 ++++++++++++++++++++++++--
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index 128a6dd..797bb01 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -12,7 +12,7 @@ not clearly relate.
Red Hat Enterprise Linux meets this requirement by design.
<!-- We could include discussion of Common Criteria Testing if so desired here. -->
</description>
-<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
+<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
</Group> <!-- end met_inherently -->
<Group id="unmet_impractical_guidance">
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index 7f5e049..abbb12d 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -241,6 +241,9 @@ should be installed to their default location on the local filesystem.</rational
<oval id="mount_option_nosuid_remote_filesystems" />
</Rule>
+</Group>
+</Group>
+
<Group id="nfs_configuring_servers">
<title>Configure NFS Servers</title>
<description>The steps in this section are appropriate for machines which operate as NFS servers.</description>
@@ -334,8 +337,27 @@ attacker could gain access to data on the NFS server.</rationale>
<oval id="TO:DO" />
</Rule>
+<Rule id="no_insecure_locks_exports">
+<title>Ensure Insecure File Locking is Not Allowed</title>
+<description>By default the NFS server requires secure file-lock requests, which require credentials
+from the client in order to lock a file. Most NFS clients send credentials with file lock requests,
+however, there are a few clients that do not send credentials when requesting a file-lock, allowing
+the client to only be able to lock world-readable files. To get around this, the <tt>insecure_locks</tt>
+option can be used so these clients can access the desired export. This poses a security risk by
+potentially allowing the client access to data for which it does not have authorization.
+<br /><br />
+This configuration is not recommended and strongly discouraged.
+<br /><br />
+Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure_locks</tt>.
+</description>
+<rationale>Allowing insecure file locking could allow for sensitive data to be viewed or edited by
+an unauthorized user.
+</rationale>
+<ident cce="TO:DO" />
+<oval id="TO:DO" />
+<ref disa="764" />
+</Rule>
+
</Group> <!-- nfs_configuring_servers -->
</Group>
-</Group>
-</Group>
--
1.7.7.6
More information about the scap-security-guide
mailing list