[PATCH] new Rules for root path

David Smith dsmith at eclipse.ncsc.mil
Thu Oct 11 12:11:00 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/transition_notes.xml         |    6 +-
 .../system/accounts/restrictions/root_logins.xml   |   42 ++++++++++++++++++++
 RHEL6/input/system/software/integrity.xml          |    4 +-
 3 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 095d39b..8fe2a0a 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -526,7 +526,7 @@ This is covered in RHEL 6 content.
 </note>
 
 <note ref="22524" auth="DS">
-This is covered in the RHEL6 content. 
+This is not covered in the RHEL6 content. AppleTalk support is not included in RHEL6.
 </note>
 
 <note ref="22530" auth="VP">
@@ -811,7 +811,7 @@ This is desirable but not practical in many environments.  Notably, many other O
 do not even support this capability.
 </note>
 
-<note ref="776,777,780,781,782,4382,11975,12765" auth="JB">
+<note ref="780,781,4382,11975,12765" auth="JB">
 This needs to be added to the RHEL6 content.
 </note>
 
@@ -1634,7 +1634,7 @@ exist.
 rule=sshd_enable_warning_banner manual=no
 </note>
 
-<note ref="812,761" auth="DS">
+<note ref="776,777,812,761,782" auth="DS">
 This is covered in the RHEL6 content.
 </note>
 </notegroup>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index e234e7e..e9bc55a 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -150,5 +150,47 @@ access to root privileges in an accountable manner.
 <ref nist="AC-3, AC-11, CM-6, CM-7" disa="366" />
 </Rule>
 
+<Rule id="root_path_defaultabsolute">
+<title>Root Path Must Be Vendor Default</title>
+<description>
+Assuming root shell is bash, edit the following files:
+<pre>~/.profile</pre>
+<pre>~/.bashrc</pre>
+Change any <tt>PATH</tt> variables to the vendor default for root and remove any 
+empty <tt>PATH</tt> entries or references to relative paths.
+</description>
+<ocil clause="any of these conditions are not met">
+To view the root user's <tt>PATH</tt>, run the following command:
+<pre># env | grep PATH</pre>
+If correctly configured, the <tt>PATH</tt> must: use vendor default settings, 
+have no empty entries, and have no entries beginning with a character
+other than a slash (/).
+</ocil>
+<rationale>
+The root account's executable search path must be the vendor default, and must 
+contain only absolute paths.
+</rationale>
+<ref disa="366" />
+</Rule>
+
+<Rule id="root_path_no_wwdir">
+<title>Root Path Must Not Contain World-Writable Directories</title>
+<description>
+If a world-writable directory is found in the <tt>PATH</tt>, remove the 
+world-writable permission for that directory with the following command:
+<pre># chmod o-w <i>/dir</i></pre>
+Alternately, remove the world-writable directory from the <tt>PATH</tt>.
+</description>
+<ocil clause="any world-writable directories are found">
+World-writable permissions on directories in root's path can be checked 
+with the following command:
+<pre># ls -ld 'echo $PATH | sed "s/:/ /g"'</pre>
+</ocil>
+<rationale>
+If the root search path contains a world-writable directory, malicious software 
+could be placed in the path.
+</rationale>
+<ref disa="366" />
+</Rule>
 </Group>
 
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 371b024..37e0d9b 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -31,11 +31,11 @@ configurable, with further configuration information located in
 Install a Host-Based Intrusion Detection Tool
 </description>
 <ocil clause="no host-based intrusion detection systems are installed">
-The preferred host-based intrusion detection system is the McAfee HBSS product.
+For DoD systems, HBSS is typically provided.
 <package-check-macro package="mfehiplsm"/>
 </ocil>
 <rationale>
-Host-based intrusion detection tools allow for system-level intrusion defense. 
+Host-based intrusion detection systems monitor hosts for potentially malicious behavior. 
 </rationale>
 <ref disa="1263"/>
 </Rule>
-- 
1.7.1



More information about the scap-security-guide mailing list