[PATCH 7/8] temporary fixups to shorthand macros, still need to improve further

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Oct 9 15:09:36 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/transforms/shorthand2xccdf.xslt |   32 ++++++++++++++++++++++----------
 1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index c794881..c9077d1 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -195,7 +195,7 @@ exclude-result-prefixes="xccdf xhtml dc">
           <!-- add clauses if specific macros are found within -->
             <xsl:if test="sysctl-check-macro">the correct value is not returned</xsl:if>
             <xsl:if test="fileperms-check-macro or fileowner-check-macro or filegroupowner-check-macro">it does not</xsl:if>
-            <xsl:if test="partition-check-macro">the directory in question does not reside on its own partition or volume group</xsl:if>
+            <xsl:if test="partition-check-macro">no line is returned</xsl:if>
             <xsl:if test="service-disable-check-macro">the service is running</xsl:if>
             <xsl:if test="service-enable-check-macro">the service is not running</xsl:if>
             <xsl:if test="package-check-macro">the package is installed</xsl:if>
@@ -240,18 +240,29 @@ exclude-result-prefixes="xccdf xhtml dc">
     run the following command:
     <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of select="@sysctl"/> <xsl:value-of select="@value"/></xhtml:pre>
 
-    To persist this configuration, the following line must be added to <xhtml:code>/etc/sysctl.conf</xhtml:code>:
+	<!-- The following text could also be included conditionally, if the defaultness of the sysctl were indicated. -->
+    If this is not the system's default value, add the following line to <xhtml:code>/etc/sysctl.conf</xhtml:code>:
     <xhtml:pre xml:space="preserve"><xsl:value-of select="@sysctl"/> <xsl:value-of select="@value"/></xhtml:pre>
   </xsl:template>
 
   <xsl:template match="sysctl-check-macro">
-    The runtime status of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried
+    The status of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried
     by running the following command:
-    <xhtml:pre>$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>
-    The output of the command should indicate a value of <xhtml:code><xsl:value-of select="@value"/></xhtml:code>.<xhtml:br />
+    <xhtml:pre xml:space="preserve">$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>
+    The output of the command should indicate a value of <xhtml:code><xsl:value-of select="@value"/></xhtml:code>.
+    If this value is not the default value, investigate how it could have been
+    adjusted at runtime, and verify that it is not set improperly in
+    <xhtml:code>/etc/sysctl.conf</xhtml:code>.
+    <!--
+	The following text could be conditionally added, for any cases where the default sysctl value
+	is not the required one. We could indicate this with an additional attribute
+	in the macro.  (Adding default values to sysctl.conf just increases C&A cost with no benefit; it makes default
+	systems fail compliance checks when they shouldn't.)
+
+    <xhtml:br />
     To verify persistent configuration of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter, 
     verify that the following line is present in <xhtml:code>/etc/sysctl.conf</xhtml:code>:
-    <xhtml:pre>$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>    
+    <xhtml:pre xml:space="preserve">$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>    -->
   </xsl:template>
 
   <xsl:template match="fileperms-desc-macro">
@@ -308,10 +319,11 @@ exclude-result-prefixes="xccdf xhtml dc">
   </xsl:template>
 
   <xsl:template match="partition-check-macro">
-    After running the following command verify that <xhtml:code><xsl:value-of select="@part"/></xhtml:code> is in fact on its own partition, or logical volume:
-  <xhtml:pre># df -h <xsl:value-of select="@part"/> </xhtml:pre>
-  To verify if <xhtml:code><xsl:value-of select="@part"/></xhtml:code> lives on its own partition, or volume group simply review the output of the above command.
-  Often times, people forget to assign important system filesystems to individual slices while building the core system.  This results in everything "living" under the root volume group -- which in many enterprise environments is not the preferred method.
+    Run the following command to determine if  <xhtml:code><xsl:value-of select="@part"/></xhtml:code>
+    is on its own partition or logical volume:
+  <xhtml:pre>$ mount | grep "on <xsl:value-of select="@part"/>"</xhtml:pre>
+  If <xhtml:code><xsl:value-of select="@part"/></xhtml:code> has its own partition or volume group, a line
+  will be returned.
   </xsl:template>
 
   <xsl:template match="service-disable-macro">
-- 
1.7.1



More information about the scap-security-guide mailing list