[PATCH] severity changes

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Oct 23 16:36:20 UTC 2012


We're supposed to meet with Michele about this today, but I guess this
serves as an example.

Please work on comprehensive proofreading instead.



On 10/23/2012 10:52 AM, David Smith wrote:
> 
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
>  RHEL6/input/system/network/iptables.xml  |    8 ++++----
>  RHEL6/input/system/selinux.xml           |    6 +++---
>  RHEL6/input/system/software/updating.xml |    8 ++++----
>  3 files changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
> index 1948224..bb97a11 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -49,7 +49,7 @@ num  target     prot opt source       destination</pre>
>  The <tt>ip6tables</tt> default rules are essentially the same.</description>
>  
>  
> -<Rule id="enable_ip6tables">
> +<Rule id="enable_ip6tables" severity="medium">
>  <title>Verify ip6tables Enabled</title>
>  <description>
>  <service-enable-macro service="ip6tables" />
> @@ -63,7 +63,7 @@ capability for IPv6 and ICMPv6.
>  <ref nist="CM-6, CM-7" disa="66,1115,1118,1092,1117,1098,1100,1097,1123,1124,1414"/>
>  </Rule>
>  
> -<Rule id="enable_iptables">
> +<Rule id="enable_iptables" severity="medium">
>  <title>Verify iptables Enabled</title>
>  <description>
>  <service-enable-macro service="iptables" />
> @@ -110,7 +110,7 @@ requirements. Otherwise, this program should not be used to make
>  changes to the firewall configuration because it re-writes the
>  saved configuration file.</warning>
>  
> -<Rule id="set_iptables_default_rule">
> +<Rule id="set_iptables_default_rule" severity="medium">
>  <title>Set Default Iptables Policy for Incoming Packets</title>
>  <description>To set the default policy to DROP (instead of ACCEPT) for
>  the built-in INPUT chain which processes incoming packets,
> @@ -131,7 +131,7 @@ accepted.</rationale>
>  <ref nist="AC-4, CM-6" disa="66,1109,1154,1414" />
>  </Rule>
>  
> -<Rule id="set_iptables_default_rule_forward">
> +<Rule id="set_iptables_default_rule_forward" severity="medium">
>  <title>Set Default Iptables Policy for Forwarded Packets</title>
>  <description>To set the default policy to DROP (instead of ACCEPT) for
>  the built-in FORWARD chain which processes packets that will be forwarded from
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 6e00f85..1592874 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -82,7 +82,7 @@ and to protect the boot process.
>  <value selector="mls">mls</value>
>  </Value>
>  
> -<Rule id="enable_selinux_bootloader">
> +<Rule id="enable_selinux_bootloader" severity="high">
>  <title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
>  <description>SELinux can be disabled at boot time by an argument in
>  <tt>/etc/grub.conf</tt>.
> @@ -104,7 +104,7 @@ the chances that it will remain off during system operation.
>  <ref nist="AC-3, CM-6" disa="22,32"/>
>  </Rule>
>  
> -<Rule id="set_selinux_state">
> +<Rule id="set_selinux_state" severity="high">
>  <title>Ensure SELinux State is Enforcing</title>
>  <description>The SELinux state should be set to <tt>enforcing</tt> at
>  system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
> @@ -208,7 +208,7 @@ which use category labelling.</description>
>  </Group>
>  -->
>  
> -<Rule id="selinux_confinement_of_daemons">
> +<Rule id="selinux_confinement_of_daemons" severity="medium">
>  <title>Ensure No Daemons are Unconfined by SELinux</title>
>  <description>
>  Daemons for which the SELinux policy does not contain rules will inherit the
> diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
> index 30331e6..4ed4123 100644
> --- a/RHEL6/input/system/software/updating.xml
> +++ b/RHEL6/input/system/software/updating.xml
> @@ -18,7 +18,7 @@ for this reason, their use is strongly encouraged.
>  </description>
>  <ref disa="1233" />
>  
> -<Rule id="ensure_redhat_gpgkey_installed">
> +<Rule id="ensure_redhat_gpgkey_installed" severity="high">
>  <title>Ensure Red Hat GPG Key Installed</title>
>  <description>
>  To ensure that the system can cryptographically verify base software
> @@ -46,7 +46,7 @@ are from Red Hat.
>  <!-- REMINDER: Before telling people to update their systems
>       via the security_patches_up_to_date rule, we must
>       ensure they have configured an update source! -->
> -<Rule id="ensure_gpgcheck_globally_activated">
> +<Rule id="ensure_gpgcheck_globally_activated" severity="high">
>  <title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
>  <description>The <tt>gpgcheck</tt> option should be used to ensure that
>  checking of an RPM package's signature always occurs prior to its
> @@ -75,7 +75,7 @@ protects against malicious tampering.
>  <tested by="MM" on="20120928"/>
>  </Rule>
>  
> -<Rule id="ensure_gpgcheck_never_disabled">
> +<Rule id="ensure_gpgcheck_never_disabled" severity="high">
>  <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
>  <description>To ensure that signature checking is not disabled for
>  any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
> @@ -100,7 +100,7 @@ protects against malicious tampering.
>  <tested by="MM" on="20120928"/>
>  </Rule>
>  
> -<Rule id="security_patches_up_to_date">
> +<Rule id="security_patches_up_to_date" severity="high">
>  <title>Ensure Software Patches Installed</title>
>  <description>If the system is joined to the Red Hat Network, a Red Hat Satellite Server,
>  or a yum server, run the following command to install updates:


More information about the scap-security-guide mailing list