[PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package

Steve Grubb sgrubb at redhat.com
Mon May 7 13:29:23 UTC 2012


On Friday, May 04, 2012 05:32:40 PM Willy Santos wrote:
> On 05/04/2012 05:16 PM, Michael Palmiotto wrote:
> >> The following sections detail commands to enforce idle activation of the
> >> screen saver, screen locking, a blank-screen screensaver, and an idle
> >> activation time.
> >> +<ref disa="56" />
> > 
> > It appears that a ref tag snuck its way inside the gui_screen_locking
> > group's description tag. The tag has disa's 56, 57, and 60.
> 
> You are absolutely correct. That one got past me. I did mean to put it
> as a ref on the group. I'll fix and push it.
> 
> Thanks for the catch!

I'd like to point out that vlock was not part of common criteria for RHEL6. This 
is because OSPP has tougher requirements than LSPP or CAPP. (This is just one 
example of where things deviated from past certifications.) OSPP requires that 
screen locking be automatic. So, to meet this we made some updates to the kernel 
to delete the scroll back buffer and made a few improvements to screen.

Are you wanting this to align with what went through certification or keep using 
vlock?

-Steve


More information about the scap-security-guide mailing list