[PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package

Jeffrey Blank blank at eclipse.ncsc.mil
Thu May 10 15:44:35 UTC 2012


We definitely want to align with CC when practical.  We should change
this to use screen instead.

I know you'd mentioned it to me at one point before.  Ticket #49 now
exists to track the change.

Thanks!


On 05/07/2012 09:29 AM, Steve Grubb wrote:
> On Friday, May 04, 2012 05:32:40 PM Willy Santos wrote:
>> On 05/04/2012 05:16 PM, Michael Palmiotto wrote:
>>>> The following sections detail commands to enforce idle activation of the
>>>> screen saver, screen locking, a blank-screen screensaver, and an idle
>>>> activation time.
>>>> +<ref disa="56" />
>>>
>>> It appears that a ref tag snuck its way inside the gui_screen_locking
>>> group's description tag. The tag has disa's 56, 57, and 60.
>>
>> You are absolutely correct. That one got past me. I did mean to put it
>> as a ref on the group. I'll fix and push it.
>>
>> Thanks for the catch!
> 
> I'd like to point out that vlock was not part of common criteria for RHEL6. This 
> is because OSPP has tougher requirements than LSPP or CAPP. (This is just one 
> example of where things deviated from past certifications.) OSPP requires that 
> screen locking be automatic. So, to meet this we made some updates to the kernel 
> to delete the scroll back buffer and made a few improvements to screen.
> 
> Are you wanting this to align with what went through certification or keep using 
> vlock?
> 
> -Steve
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list