[PATCH 02/12] made text consistent for mount option settings

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Oct 15 19:00:23 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/permissions/partitions.xml |   98 ++++++++++++++++---------
 1 files changed, 62 insertions(+), 36 deletions(-)

diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index de23af3..2837344 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -16,10 +16,13 @@ partitions that are required on the local system.</description>
 
 <Rule id="mountopt_nodev_on_nonroot_partitions">
 <title>Add nodev Option to Non-Root Local Partitions</title>
-<description>Legitimate character and block devices should exist in
+<description>The <tt>nodev</tt> mount option prevents files from being
+interpreted as character or block devices. 
+Legitimate character and block devices should exist only in
 the <tt>/dev</tt> directory on the root patition or within chroot
-jails built for system services. All other locations should not allow
-character and block devices.</description>
+jails built for system services.
+<mount-desc-macro option="nodev" part="any non-root local partitions" />
+</description>
 <rationale>The <tt>nodev</tt> mount option prevents files from being
 interpreted as character or block devices. The only legitimate location
 for device files is the /dev directory located on the root partition.
@@ -32,13 +35,17 @@ to set <tt>nodev</tt> on these filesystems.</rationale>
 
 <Rule id="mountopt_nodev_on_removable_partitions">
 <title>Add nodev Option to Removable Media Partitions</title>
-<description>Removable Media partitions should be mounted with the <tt>
-nodev</tt> option.</description>
-<rationale>The <tt>nodev</tt> mount option prevents files from being
-interpreted as character or block devices. The only legitimate location
-for device files is the /dev directory located on the root partition.
-The only exception to this is chroot jails, for which it is not advised
-to set <tt>nodev</tt> on these filesystems.</rationale>
+<description>The <tt>nodev</tt> mount option prevents files from being
+interpreted as character or block devices. 
+Legitimate character and block devices should exist only in
+the <tt>/dev</tt> directory on the root patition or within chroot
+jails built for system services. 
+<mount-desc-macro option="nodev" part="any removable media partitions" />
+</description>
+<rationale> The only legitimate location for device files is the /dev directory
+located on the root partition.  An exception to this is chroot jails, and it is
+not advised to set <tt>nodev</tt> on partitions which contain their root
+filesystems.  </rationale>
 <ident cce="3522-0" />
 <oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
 <ref nist="CM-7, MP-2"/>
@@ -52,7 +59,9 @@ be allowed to execute binaries that exist on partitions mounted
 from removable media (such as a USB key). The <tt>noexec</tt>
 option prevents code from being executed directly from the media
 itself, and may therefore provide a line of defense against
-certain types of worms or malicious code.</description>
+certain types of worms or malicious code.
+<mount-desc-macro option="noexec" part="any removable media partitions" />
+</description>
 <rationale>Allowing users to execute binaries from removable media such as USB keys exposes
 the system to potential compromise.</rationale>
 <ident cce="4275-4" />
@@ -60,13 +69,16 @@ the system to potential compromise.</rationale>
 <ref nist="CM-7, MP-2" disa="87" />
 </Rule>
 
+<!-- investigate: this is like obsoleted by gvfs/DeviceKit-based mounting now -->
 <Rule id="mountopt_nosuid_on_removable_partitions">
 <title>Add nosuid Option to Removable Media Partitions</title>
 <description>The <tt>nosuid</tt> mount option prevents set-user-identifier (suid)
 and set-group-identifier (sgid) permissions from taking effect. These permissions
 allow users to execute binaries with the same permissions as the owner and group
 of the file respectively. Users should not be allowed to introduce suid and guid
-files into the system via partitions mounted from removeable media.</description>
+files into the system via partitions mounted from removeable media.
+<mount-desc-macro option="nosuid" part="any removable media partitions" />
+</description>
 <rationale>The presence of suid and sgid executables should be tightly controlled. Users
 should not be able to execute suid or sgid binaries from partitions mounted off of
 removable media.</rationale>
@@ -77,9 +89,13 @@ removable media.</rationale>
 
 <Rule id="mount_option_tmp_nodev">
 <title>Add nodev Option to /tmp</title>
-<description>Legitimate character and block devices should not exist
-within temporary directories like <tt>/tmp</tt>. The <tt>nodev</tt>
-mount option should be specified for <tt>/tmp</tt>.</description>
+<description>
+The <tt>nodev</tt> mount option can be used to prevent device files from
+being created in <tt>/tmp</tt>.
+Legitimate character and block devices should not exist
+within temporary directories like <tt>/tmp</tt>. 
+<mount-desc-macro option="nodev" part="/tmp" />
+</description>
 <rationale>The only legitimate location for device files is the /dev directory
 located on the root partition. The only exception to this is chroot jails.</rationale>
 <ident cce="14412-1" />
@@ -89,12 +105,13 @@ located on the root partition. The only exception to this is chroot jails.</rati
 
 <Rule id="mount_option_tmp_noexec">
 <title>Add noexec Option to /tmp</title>
-<description>It can be dangerous to allow the execution of binaries
-from world-writeable temporary storage directories such as <tt>/tmp</tt>.
-The <tt>noexec</tt> mount option prevents binaries from being executed
-out of <tt>/tmp</tt>.</description>
+<description>The <tt>noexec</tt> mount option can be used to prevent binaries
+from being executed out of <tt>/tmp</tt>.
+<mount-desc-macro option="noexec" part="/tmp" />
+</description>
 <rationale>Allowing users to execute binaries from world-writeable directories
-such as /tmp can expose the system to potential compromise.</rationale>
+such as <tt>/tmp</tt> should never be necessary in normal operation and
+can expose the system to potential compromise.</rationale>
 <ident cce="14927-8" />
 <oval id="mount_option_tmp_noexec" />
 <ref nist="CM-7, MP-2"/>
@@ -102,9 +119,11 @@ such as /tmp can expose the system to potential compromise.</rationale>
 
 <Rule id="mount_option_tmp_nosuid">
 <title>Add nosuid Option to /tmp</title>
-<description>The <tt>nosuid</tt> mount option should be set for temporary
-storage partitions such as <tt>/tmp</tt>. The suid/sgid permissions
-should not be required in these world-writeable directories.</description>
+<description>The <tt>nosuid</tt> mount option can be used to prevent
+execution of setuid programs in <tt>/tmp</tt>. The suid/sgid permissions
+should not be required in these world-writeable directories.
+<mount-desc-macro option="nosuid" part="/tmp" />
+</description>
 <rationale>The presence of suid and sgid executables should be tightly controlled. Users
 should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
 <ident cce="14940-1" />
@@ -114,9 +133,12 @@ should not be able to execute suid or sgid binaries from temporary storage parti
 
 <Rule id="mount_option_dev_shm_nodev">
 <title>Add nodev Option to /dev/shm</title>
-<description>Legitimate character and block devices should not exist
-within temporary directories like <tt>/dev/shm</tt>. The <tt>nodev</tt>
-mount option should specified for <tt>/dev/shm</tt>.</description>
+<description>The <tt>nodev</tt> mount option can be used to prevent creation
+of device files in <tt>/dev/shm</tt>.
+Legitimate character and block devices should not exist
+within temporary directories like <tt>/dev/shm</tt>. 
+<mount-desc-macro option="nodev" part="/dev/shm" />
+</description>
 <rationale>The only legitimate location for device files is the /dev directory
 located on the root partition. The only exception to this is chroot jails.</rationale>
 <ident cce="15007-8" />
@@ -126,10 +148,12 @@ located on the root partition. The only exception to this is chroot jails.</rati
 
 <Rule id="mount_option_dev_shm_noexec">
 <title>Add noexec Option to /dev/shm</title>
-<description>It can be dangerous to allow the execution of binaries
+<description>The <tt>noexec</tt> mount option can be used to prevent binaries
+from being executed out of <tt>/dev/shm</tt>.
+It can be dangerous to allow the execution of binaries
 from world-writeable temporary storage directories such as <tt>/dev/shm</tt>.
-The <tt>noexec</tt> mount option prevents binaries from being executed
-out of <tt>/dev/shm</tt>.</description>
+<mount-desc-macro option="noexec" part="/dev/shm" />
+</description>
 <rationale>Allowing users to execute binaries from world-writeable directories
 such as /dev/shm can expose the system to potential compromise.</rationale>
 <ident cce="14703-3" />
@@ -139,9 +163,11 @@ such as /dev/shm can expose the system to potential compromise.</rationale>
 
 <Rule id="mount_option_dev_shm_nosuid">
 <title>Add nosuid Option to /dev/shm</title>
-<description>The <tt>nosuid</tt> mount option should be set for temporary
-storage partitions such as <tt>/dev/shm</tt>. The suid/sgid permissions
-should not be required in these world-writeable directories.</description>
+<description>The <tt>nosuid</tt> mount option can be used to prevent execution
+of setuid programs in <tt>/dev/shm</tt>.  The suid/sgid permissions should not
+be required in these world-writeable directories.
+<mount-desc-macro option="nosuid" part="/dev/shm" />
+</description>
 <rationale>The presence of suid and sgid executables should be tightly controlled. Users
 should not be able to execute suid or sgid binaries from temporary storage partitions.</rationale>
 <ident cce="14306-5" />
@@ -151,10 +177,10 @@ should not be able to execute suid or sgid binaries from temporary storage parti
 
 <Rule id="mount_option_var_tmp_bind_var">
 <title>Bind Mount /var/tmp To /tmp</title>
-<description>The <tt>/var/tmp</tt> directory should be bind mounted to <tt>/tmp</tt>
-in order to consolidate temporary storage into one location protected by the same
-techniques as <tt>/tmp</tt>. This is done by editing <tt>/etc/fstab</tt> and adding
-the following line if needed:
+<description>The <tt>/var/tmp</tt> directory is a world-writable directory.  
+Bind-mount it to <tt>/tmp</tt> in order to consolidate temporary storage into
+one location protected by the same techniques as <tt>/tmp</tt>.  To do so, edit
+<tt>/etc/fstab</tt> and add the following line:
 <pre>/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0</pre>
 See the mount(8) man page for further explanation of bind mounting.
 </description>
-- 
1.7.1



More information about the scap-security-guide mailing list