[PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package

Michael Palmiotto mpalmiotto at tresys.com
Fri May 4 21:16:17 UTC 2012


>The following sections detail commands to enforce idle activation of the screen saver,
> screen locking, a blank-screen screensaver, and an idle
> activation time.
>+<ref disa="56" />

It appears that a ref tag snuck its way inside the gui_screen_locking group's description tag.
The tag has disa's 56, 57, and 60.

> <br /><br />
> Because users should be trained to lock the screen when they
>@@ -288,7 +289,7 @@ for users who may need to suspend console logins.
> </rationale>
> <ident cce="3910-7" />
> <oval id="package_vlock_installed" />
>-<ref nist="CM-6, CM-7" />
>+<ref nist="CM-6, CM-7" disa="56" />
> </Rule>
> </Group>
> </Group>

I think it should suffice to pull it down to the next <ref> tag, just before the end of the Rule.
Thoughts?

There was another error with the key-sequence 'inactivity_timeout_value'.
I checked the OVAL and XCCDF shorthand and everything seems to check out, yet this
error still pops up when trying to run a make validate:
"No match found for key-sequence ['inactivity_timeout_value'] of keyref '{http://checklists.nist.gov/xccdf/1.1}valueIdKeyRef'."

 
--Mike


More information about the scap-security-guide mailing list