[PATCH] Ident element should represent a single identifier.

Simon Lukasik slukasik at redhat.com
Fri Mar 30 11:53:10 UTC 2012


The XCCDF standard allows 0-n ident elements per xccdf:Rule.
Each element should represent 'a globally meaningful identifier
for the rule'.
---
 rhel6/src/input/services/dhcp.xml     |    8 +++++++-
 rhel6/src/input/services/dns.xml      |    4 +++-
 rhel6/src/input/services/ldap.xml     |   16 ++++++++++++++--
 rhel6/src/input/services/printing.xml |    6 ++++--
 4 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/rhel6/src/input/services/dhcp.xml b/rhel6/src/input/services/dhcp.xml
index 224cf9c..3c07613 100644
--- a/rhel6/src/input/services/dhcp.xml
+++ b/rhel6/src/input/services/dhcp.xml
@@ -133,7 +133,13 @@ option time-offset</pre>
 the DHCP server. In particular, domain-name, domain-name-servers, and routers are configured via DHCP.
 These settings are typically necessary for proper network functionality, but are also usually static across machines
 at a given site.</warning>
-<ident cce="3724-2, 4243-2, 4389-3, 3913-1, 4169-9, 4318-2, 4319-0" />
+<ident cce="3724-2" />
+<ident cce="4243-2" />
+<ident cce="4389-3" />
+<ident cce="3913-1" />
+<ident cce="4169-9" />
+<ident cce="4318-2" />
+<ident cce="4319-0" />
 <!--<oval id="dhcp_server_minimize_served_info" /> -->
 <!--<ref nist="CM-6, CM-7" /> -->
 </Rule>
diff --git a/rhel6/src/input/services/dns.xml b/rhel6/src/input/services/dns.xml
index 58dd88b..fb45b7e 100644
--- a/rhel6/src/input/services/dns.xml
+++ b/rhel6/src/input/services/dns.xml
@@ -89,7 +89,9 @@ so that files outside the jail are not visible to the chrooted process. Since RH
 for placing BIND in a chroot jail, you should take advantage of this feature.</rationale>
 <warning category="general">If you are running BIND in a chroot jail, then you should use the jailed <tt>named.conf</tt> as the primary nameserver configuration file. That is, when this guide recommends editing <tt>/etc/named.conf</tt>, you should instead edit <tt>/var/named/chroot/etc/named.conf</tt>.
 </warning>
-<ident cce="3985-9, 4487-5, 4258-0" />
+<ident cce="3985-9" />
+<ident cce="4487-5" />
+<ident cce="4258-0" />
 <!--<oval id="dns_server_chroot" />-->
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
diff --git a/rhel6/src/input/services/ldap.xml b/rhel6/src/input/services/ldap.xml
index 05a31d8..c9975f6 100644
--- a/rhel6/src/input/services/ldap.xml
+++ b/rhel6/src/input/services/ldap.xml
@@ -181,7 +181,18 @@ that certificate is encrypted, and to the public certificate file belonging to t
 for the key to be protected further, so that processes running as ldap could not read it. If this were done, the
 LDAP server process would need to be restarted manually whenever the server rebooted.
 </description>
-<ident cce="4360-4,4378-6,4492-5,4263-0,3502-2,4449-5,4361-2,4427-1,4321-6,4339-8,4105-3,3718-4" />
+<ident cce="4360-4" />
+<ident cce="4378-6" />
+<ident cce="4492-5" />
+<ident cce="4263-0" />
+<ident cce="3502-2" />
+<ident cce="4449-5" />
+<ident cce="4361-2" />
+<ident cce="4427-1" />
+<ident cce="4321-6" />
+<ident cce="4339-8" />
+<ident cce="4105-3" />
+<ident cce="3718-4" />
 <oval id="ldap_server_config_certificate_files" />
 <ref nist="AC-6, CM-7, SC-11, SC-12, SC-13, SC-17" />
 </Rule>
@@ -349,7 +360,8 @@ be able to change data without an explicit access statement.
 Some manual methods of inserting information into the LDAP database may leave these files with incorrect
 permissions. This will prevent slapd from starting correctly.
 </description>
-<ident cce="4484-2, 4502-1" />
+<ident cce="4484-2" />
+<ident cce="4502-1" />
 <oval id="ldap_server_config_directory_file_security" />
 <ref nist="AC-6, CM-7" />
 </Rule>
diff --git a/rhel6/src/input/services/printing.xml b/rhel6/src/input/services/printing.xml
index 55d82c6..c4ef68d 100644
--- a/rhel6/src/input/services/printing.xml
+++ b/rhel6/src/input/services/printing.xml
@@ -26,7 +26,8 @@ open source printing system</reference>
 </description>
 <rationale>Turn off unneeded services to reduce attack surface.
 </rationale>
-<ident cce="CCE-4112-9, CCE-3755-6" />
+<ident cce="CCE-4112-9" />
+<ident cce="CCE-3755-6" />
 <oval id="service_cups_disabled" />
 <ref nist="CM-7" />
 </Rule>
@@ -69,7 +70,8 @@ BrowseAllow none
 </description>
 <rationale>The CUPS print service can be configured to broadcast a list of available printers to the network. Other machines on the network, also running the CUPS print service, can be configured to listen to these broadcasts and add and configure these printers for immediate use. By disabling this browsing capability, the machine will no longer generate or receive such broadcasts.
 </rationale>
-<ident cce="CCE-4420-6, CCE-4407-3" />
+<ident cce="CCE-4420-6" />
+<ident cce="CCE-4407-3" />
 <oval id="cups_disable_browsing" />
 <!--<ref nist="TODO:NIST" />-->
 </Rule>
-- 
1.7.7.6


--------------090908000500030804000504--


More information about the scap-security-guide mailing list