[PATCH 7/7] content editing for permissions section, fixups for title style * my voyage through the content revealed to me how much other content editing is still needed

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 4 23:16:36 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/services/cron.xml                |    2 +-
 RHEL6/input/services/dhcp.xml                |    6 +-
 RHEL6/input/services/dns.xml                 |   14 ++-
 RHEL6/input/services/imap.xml                |    5 +-
 RHEL6/input/services/ldap.xml                |    6 +-
 RHEL6/input/services/squid.xml               |    4 +-
 RHEL6/input/services/xorg.xml                |    4 +-
 RHEL6/input/system/accounts/session.xml      |    2 +-
 RHEL6/input/system/auditing.xml              |   17 ++--
 RHEL6/input/system/permissions/execution.xml |    2 +-
 RHEL6/input/system/permissions/files.xml     |  103 ++++++++++++++-----------
 RHEL6/input/system/permissions/mounting.xml  |    2 +-
 RHEL6/input/system/selinux.xml               |    4 +-
 RHEL6/input/system/software/updating.xml     |    4 +-
 14 files changed, 95 insertions(+), 80 deletions(-)

diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index 8d9f9db..612d40e 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -111,7 +111,7 @@ access to these files should be disabled.</description>
 
 
 <Rule id="disable_at">
-<title>Disable atd Service if Possible</title>
+<title>Disable atd Service</title>
 <description>
 <service-disable-macro service="at" />
 </description>
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 779fc53..cc0631a 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -25,7 +25,7 @@ changes – and should therefore be used with caution.</description>
 
 
 <Group id="disabling_dhcp_server">
-<title>Disable DHCP Server if Possible</title>
+<title>Disable DHCP Server</title>
 <description>
 The DHCP server <tt>dhcpd</tt> is not installed or activated by
 default. If the software was installed and activated, but the
@@ -68,7 +68,7 @@ accidentally reactivated and disrupt network operation.
 </Group> <!-- <Group id="disabling_dhcp_server"> -->
 
 <Group id="dhcp_server_configuration">
-<title>Disable DHCP Server if Possible</title>
+<title>Disable DHCP Server</title>
 <description>If the system must act as a DHCP server, the configuration information it serves should be minimized. Also, support for other protocols and DNS-updating schemes should be explicitly disabled unless needed. The configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file begins with a number of global configuration options. The remainder of the file is divided into sections, one for each block of addresses offered by dhcpd, each of which contains configuration options specific to that address block.</description>
 
 <Rule id="dhcp_server_disable_ddns">
@@ -154,7 +154,7 @@ process.</description>
 </Group> <!-- <Group id="dhcp_server_configuration"> -->
 
 <Group id="disabling_dhcp_client">
-<title>Disable DHCP Client if Possible</title>
+<title>Disable DHCP Client</title>
 <description>
 DHCP is the default network configuration method provided by the system
 installer, and common on many networks. Nevertheless, manual management
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index b572ccd..91d00ce 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -7,7 +7,7 @@ be disabled on any system
 on which it is not needed.</description>
 
 <Group id="disabling_dns_server">
-<title>Disable DNS Server if Possible</title>
+<title>Disable DNS Server</title>
 <description>
 DNS software should be disabled on any machine which does not
 need to be a nameserver. Note that the BIND DNS server software is
@@ -49,12 +49,16 @@ removing it provides a safeguard against its activation.
 
 <Group id="dns_server_isolation">
 <title>Isolate DNS from Other Services</title>
-<description>This section discusses mechanisms for preventing the DNS server from interfering with other services. This is done both to protect the remainder of the network should a nameserver be compromised, and to make direct attacks on nameservers more difficult.</description>
+<description>This section discusses mechanisms for preventing the DNS server
+from interfering with other services. This is done both to protect the
+remainder of the network should a nameserver be compromised, and to make direct
+attacks on nameservers more difficult.</description>
 
 <Rule id="dns_server_dedicated">
-<title>Run DNS Software on Dedicated Servers if Possible</title>
-<description>Since DNS is a high-risk service which must frequently be made available to the entire Internet, it is strongly
-recommended that no other services be offered by machines which act as organizational DNS servers.</description>
+<title>Run DNS Software on Dedicated Servers</title> <description>Since DNS is
+a high-risk service which must frequently be made available to the entire
+Internet, it is strongly recommended that no other services be offered by
+machines which act as organizational DNS servers.</description>
 <!--<ident cce="4219-2" />-->
 <!--<oval id="dns_server_dedicated" />-->
 <!--<ref nist="CM-6, CM-7" />-->
diff --git a/RHEL6/input/services/imap.xml b/RHEL6/input/services/imap.xml
index 6ef53dc..c6a0326 100644
--- a/RHEL6/input/services/imap.xml
+++ b/RHEL6/input/services/imap.xml
@@ -6,7 +6,7 @@ contains more detailed information about Dovecot
 configuration.</description>
 
 <Group id="disabling_dovecot">
-<title>Disable Dovecot if Possible</title>
+<title>Disable Dovecot</title>
 <description>If the system does not need to operate as an IMAP or
 POP3 server, the dovecot software should be disabled and removed.
 </description>
@@ -26,12 +26,11 @@ avenue of attack, and should be disabled if not needed.
 </Rule>
 
 <Rule id="uninstall_dovecot">
-<title>Uninstall dovecot RPM Package</title>
+<title>Uninstall dovecot Package</title>
 <description>The <tt>dovecot</tt> package can be uninstalled
 with the following command:
 <pre># yum erase dovecot</pre>
 </description>
-
 <rationale>
 If there is no need to make the Dovecot software available,
 removing it provides a safeguard against its activation.
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index 58e4553..6c2bebf 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -26,7 +26,7 @@ LDAP client, ensure that a working LDAP server is present on the
 network.</warning>
 
 <Rule id="ldap_client_start_tls">
-<title>LDAP Uses TLS For All Transactions</title>
+<title>Configure LDAP to Use TLS For All Transactions</title>
 <description>Configure LDAP to enforce TLS use. First, edit the file 
 <tt>/etc/pam_ldap.conf</tt>, and add or correct the following lines:
 <pre>ssl start_tls</pre>
@@ -41,7 +41,7 @@ than doing LDAP over SSL.</rationale>
 </Rule>
 
 <Rule id="ldap_client_tls_cacertpath">
-<title>LDAP Uses TLS For All Transactions</title>
+<title>Configure Certificate Directives for LDAP Use of TLS</title>
 <description>Ensure a copy of the site's CA certificate has been placed in
 the file <tt>/etc/pki/tls/CA/cacert.pem</tt>. Configure LDAP to enforce TLS 
 use and to trust certificates signed by the site's CA. First, edit the file 
@@ -72,7 +72,7 @@ securing an OpenLDAP infrastructure nonetheless.
 </description>
 
 <Rule id="package_openldap-servers_removed">
-<title>Uninstall the OpenLDAP Server RPM</title>
+<title>Uninstall openldap-servers Package</title>
 <description>The <tt>openldap-servers</tt> package should be removed if not in use.
 Is this machine the OpenLDAP server? If not, remove the package:
 <pre># yum erase openldap-servers</pre>
diff --git a/RHEL6/input/services/squid.xml b/RHEL6/input/services/squid.xml
index 08d1fb8..4dbfa30 100644
--- a/RHEL6/input/services/squid.xml
+++ b/RHEL6/input/services/squid.xml
@@ -16,7 +16,7 @@ and removed.
 </description>
 
 <Rule id="disable_squid">
-<title>Disable Squid if Possible</title>
+<title>Disable Squid</title>
 <description>
 <service-disable-macro service="squid" />
 </description>
@@ -29,7 +29,7 @@ of attack, and should be removed if not needed.
 </Rule>
 
 <Rule id="uninstall_squid">
-<title>Uninstall Squid if Possible</title>
+<title>Uninstall squid Package</title>
 <description>The <tt>squid</tt> package can be uninstalled with the
 following command:
 <pre># yum erase squid</pre>
diff --git a/RHEL6/input/services/xorg.xml b/RHEL6/input/services/xorg.xml
index 04611f4..5b60568 100644
--- a/RHEL6/input/services/xorg.xml
+++ b/RHEL6/input/services/xorg.xml
@@ -4,7 +4,7 @@
 system is called X.org.</description>
 
 <Group id="disabling_xwindows">
-<title>Disable X Windows if Possible</title>
+<title>Disable X Windows</title>
 <description>Unless there is a mission-critical reason for the
 system to run a graphical user interface, ensure that X is not set to start
 automatically at boot and remove the X Windows software packages.
@@ -26,7 +26,7 @@ features a <tt>3</tt> as shown:
 
 
 <Rule id="packagegroup_xwindows_remove">
-<title>Remove the X Windows Package Group if Possible</title>
+<title>Remove the X Windows Package Group</title>
 <description>Removing all packages which constitute the X Window System
 ensures that users or malicious software cannot start X.
 To do so, run the following command:
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 66d9263..26e33b6 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -23,7 +23,7 @@ operator="equals" interactive="0">
 </Value>
 
 <Rule id="max_concurrent_login_sessions">
-<title>Set the number of concurrent login sessions allowed per user</title>
+<title>Limit the Number of Concurrent Login Sessions Allowed Per User</title>
 <description>
 Limiting the number of allowed users and sessions per user can limit risks related to Denial of 
 Service attacks. This addresses concurrent sessions for a single account and does not address 
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 796464e..1649cfc 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -116,7 +116,7 @@ process during boot.
 </Rule>
 
 <Group id="configure_auditd_data_retention">
-<title> Configure <tt>auditd</tt> Data Retention</title>
+<title>Configure <tt>auditd</tt> Data Retention</title>
 <description>
 The audit system writes data to <tt>/var/log/audit/audit.log</tt>. By default,
 <tt>auditd</tt> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
@@ -448,7 +448,7 @@ to the system time should be audited.</rationale>
 </Rule>
 
 <Rule id="audit_rules_time_stime">
-<title>Record attempts to alter time through stime</title>
+<title>Record Attempts to Alter Time Through stime</title>
 <description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre># audit_time_rules
 -a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
@@ -471,7 +471,7 @@ to the system time should be audited.</rationale>
 </Rule>
 
 <Rule id="audit_rules_time_clock_settime">
-<title>Record attempts to alter time through clock_settime</title>
+<title>Record Attempts to Alter Time Through clock_settime</title>
 <description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre># audit_time_rules
 -a always,exit -F arch=b32 -S clock_settime -k audit_time_rules</pre>
@@ -496,7 +496,7 @@ to the system time should be audited.</rationale>
 </Rule>
 
 <Rule id="audit_rules_time_watch_localtime">
-<title>Record attempts to alter the localtime file</title>
+<title>Record Attempts to Alter the localtime File</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre>-w /etc/localtime -p wa -k audit_time_rules</pre>
 The -k option allows for the specification of a key in string form that can 
@@ -535,7 +535,7 @@ legitimacy.</rationale>
 </Rule>
 
 <Rule id="audit_network_modifications">
-<title>Record Events that Modify the System’s Network Environment</title>
+<title>Record Events that Modify the System's Network Environment</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
 ARCH to either b32 or b64 as appropriate for your system:
 <pre># audit_network_modifications
@@ -555,7 +555,7 @@ audited.</rationale>
 
 
 <Rule id="audit_mac_changes">
-<title>Record Events that Modify the System’s Mandatory Access
+<title>Record Events that Modify the System's Mandatory Access
 Controls</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
@@ -1014,8 +1014,7 @@ unusual activity.
 </Rule>
 
 <Rule id="audit_media_exports">
-<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media
-(successful)</title>
+<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)</title>
 <description>At a minimum the audit system should collect media
 exportation events for all users and root. Add the following to
 <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
@@ -1032,7 +1031,7 @@ loss.</rationale>
 </Rule>
 
 <Rule id="audit_file_deletions">
-<title>Ensure <tt>auditd</tt> Collects Files Deletion Events by User</title>
+<title>Ensure <tt>auditd</tt> Collects File Deletion Events by User</title>
 <description>At a minimum the audit system should collect file
 deletion events for all users and root. Add the following to
 <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index b6c40a0..c7e4034 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -68,7 +68,7 @@ the kernel allows core dumps from these programs at all. The default
 value of 0 is recommended.</description>
 
 <Rule id="disable_users_coredumps">
-<title>Disable Core Dumps for all users</title>
+<title>Disable Core Dumps for All Users</title>
 <description>To disable core dumps for all users, add the following line to <tt>/etc/security/limits.conf</tt>:
 <pre>*     hard   core    0</pre>
 </description>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index b796200..b82c024 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -9,16 +9,16 @@ to ensure that no harmful discrepancies have
 arisen.</description>
 
 <Group id="permissions_important_account_files">
-<title>Verify Permissions on <tt>passwd</tt>, <tt>shadow</tt>,
-<tt>group</tt> and <tt>gshadow</tt> Files</title>
-<description>Default permissions for the <tt>passwd</tt>, <tt>shadow</tt>,
-<tt>group</tt>, and <tt>gshadow</tt> files should be maintained.  Many
-utilities need read access to the <tt>passwd</tt> file in order to function
-properly, but read access to the <tt>shadow</tt> file allows malicious attacks
-against system passwords, and should never be enabled.</description>
+<title>Verify Permissions on Files with Local Account Information and Credentials</title>
+<description>The default restritctive permissions for files which act as
+important security databases such as <tt>passwd</tt>, <tt>shadow</tt>,
+<tt>group</tt>, and <tt>gshadow</tt> files must be maintained.  Many utilities
+need read access to the <tt>passwd</tt> file in order to function properly, but
+read access to the <tt>shadow</tt> file allows malicious attacks against system
+passwords, and should never be enabled.</description>
 
 <Rule id="userowner_shadow_file">
-<title>Verify user who owns <tt>shadow</tt> file</title>
+<title>Verify User Who Owns <tt>shadow</tt> File</title>
 <description>The <tt>/etc/shadow</tt> file should be owned by
 root.</description>
 <rationale>The <tt>/etc/shadow</tt> file contains the list of local
@@ -32,10 +32,10 @@ which could weaken the system security posture.</rationale>
 </Rule>
 
 <Rule id="groupowner_shadow_file">
-<title>Verify group who owns <tt>shadow</tt> file</title>
+<title>Verify Group Who Owns <tt>shadow</tt> File</title>
 <description>The <tt>/etc/shadow</tt> file should be group-owned by
 root.</description>
-<rationale>The /etc/shadow file stores password hashes. Protection of this file is
+<rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
 critical for system security.</rationale>
 <ident cce="3988-3" />
 <oval id="file_groupowner_etc_shadow" />
@@ -43,9 +43,9 @@ critical for system security.</rationale>
 </Rule>
 
 <Rule id="perms_shadow_file">
-<title>Verify permissions on <tt>shadow</tt> file</title>
+<title>Verify Permissions on <tt>shadow</tt> File</title>
 <description>File permissions for <tt>/etc/shadow</tt> should be set
-to 0400 or more restrictive.</description>
+to 0000.</description>
 <rationale>The <tt>/etc/shadow</tt> file contains the list of local
 system accounts and stores password hashes. Protection of this file is
 critical for system security. Failure to give ownership of this file
@@ -57,10 +57,10 @@ which could weaken the system security posture.</rationale>
 </Rule>
 
 <Rule id="userowner_group_file">
-<title>Verify user who owns <tt>group</tt> file</title>
+<title>Verify User Who Owns <tt>group</tt> File</title>
 <description>The <tt>/etc/group</tt> file should be owned by
 root.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="3276-3" />
 <oval id="file_owner_etc_group" />
@@ -68,10 +68,10 @@ on the system. Protection of this file is important for system security.</ration
 </Rule>
 
 <Rule id="groupowner_group_file">
-<title>Verify group who owns <tt>group</tt> file</title>
+<title>Verify Group Who Owns <tt>group</tt> File</title>
 <description>The <tt>/etc/group</tt> file should be group-owned by
 root.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="3883-6" />
 <oval id="file_groupowner_etc_group" />
@@ -79,10 +79,10 @@ on the system. Protection of this file is important for system security.</ration
 </Rule>
 
 <Rule id="perms_group_file">
-<title>Verify permissions on <tt>group</tt> file</title>
+<title>Verify Permissions on <tt>group</tt> File</title>
 <description>File permissions for <tt>/etc/group</tt> should be set
 correctly.</description>
-<rationale>The /etc/group file contains information regarding groups that are configured
+<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="3967-7" />
 <oval id="file_permissions_etc_group" />
@@ -90,10 +90,10 @@ on the system. Protection of this file is important for system security.</ration
 </Rule>
 
 <Rule id="userowner_gshadow_file">
-<title>Verify user who owns <tt>gshadow</tt> file</title>
+<title>Verify User Who Owns <tt>gshadow</tt> File</title>
 <description>The <tt>/etc/gshadow</tt> file should be group-owned by
 root.</description>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
 is critical for system security.</rationale>
 <ident cce="4210-1" />
 <oval id="file_owner_etc_gshadow" />
@@ -101,10 +101,10 @@ is critical for system security.</rationale>
 </Rule>
 
 <Rule id="groupowner_gshadow_file">
-<title>Verify group who owns <tt>gshadow</tt> file</title>
+<title>Verify Group Who Owns <tt>gshadow</tt> File</title>
 <description>The <tt>/etc/gshadow</tt> file should be group-owned by
 root.</description>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
 is critical for system security.</rationale>
 <ident cce="4064-2" />
 <oval id="file_groupowner_etc_gshadow" />
@@ -112,7 +112,7 @@ is critical for system security.</rationale>
 </Rule>
 
 <Rule id="perms_gshadow_file">
-<title>Verify permissions on <tt>gshadow</tt> file</title>
+<title>Verify Permissions on <tt>gshadow</tt> File</title>
 <description>File permissions for <tt>/etc/gshadow</tt> should be set
 correctly.</description>
 <rationale>The /etc/gshadow file contains group password hashes. Protection of this file
@@ -123,10 +123,10 @@ is critical for system security.</rationale>
 </Rule>
 
 <Rule id="userowner_passwd_file">
-<title>Verify user who owns <tt>passwd</tt> file</title>
+<title>Verify User Who Owns <tt>passwd</tt> File</title>
 <description>The <tt>/etc/passwd</tt> file should be owned by
 root.</description>
-<rationale>The /etc/passwd contains information about the users that are configured on
+<rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on
 the system. Protection of this file is critical for system security.</rationale>
 <ident cce="3958-6" />
 <oval id="file_owner_etc_passwd" />
@@ -134,10 +134,10 @@ the system. Protection of this file is critical for system security.</rationale>
 </Rule>
 
 <Rule id="groupowner_passwd_file">
-<title>Verify group who owns <tt>passwd</tt> file</title>
+<title>Verify Group Who Owns <tt>passwd</tt> File</title>
 <description>The <tt>/etc/passwd</tt> file should be group-owned by
 root.</description>
-<rationale>The /etc/passwd contains information about the users that are configured on
+<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
 the system. Protection of this file is critical for system security.</rationale>
 <ident cce="3495-9" />
 <oval id="file_groupowner_etc_passwd" />
@@ -145,12 +145,13 @@ the system. Protection of this file is critical for system security.</rationale>
 </Rule>
 
 <Rule id="file_permissions_etc_passwd">
-<title>Verify permissions on <tt>passwd</tt> file</title>
+<title>Verify Permissions on <tt>passwd</tt> File</title>
 <description>File permissions for <tt>/etc/passwd</tt> should be set
 to 0644 or less permissive.</description>
-<rationale>If the passwd file is writable by a group-owner or the world the
-risk of passwd file compromise is increased. The passwd file contains the
-list of acounts on the system and associated information.</rationale>
+<rationale>If the <tt>/etc/passwd</tt> file is writable by a group-owner or the
+world the risk of its compromise is increased. The file contains the list of
+acounts on the system and associated information, and protection of this file
+is critical for system security.</rationale>
 <ident cce="3566-7" />
 <oval id="file_permissions_etc_passwd" />
 <ref nist="AC-3, CM-6" disa="225"/>
@@ -267,7 +268,7 @@ changing modes.</description>
 </Rule>
 
 <Rule id="world_writeable_files">
-<title>Find Unauthorized World-Writable Files</title>
+<title>Ensure No World-Writable Files Exist</title>
 <description>Data in world-writable files can be modified by any
 user on the system. In almost all circumstances, files can be
 configured using a combination of user and group permissions to
@@ -281,25 +282,38 @@ Also, monitor for recurring world-writable files, as these may be
 symptoms of a misconfigured application or user
 account.</description>
 <ident cce="3795-2" />
-<oval id="dir_perms_world_writable_system_owned" />
 <ref nist="CM-6"/>
 </Rule>
 
 <Rule id="no_unpackaged_sgid_files">
-<title>Find Unauthorized SGID System Executables</title>
-<description>The sgid bit should not be set for all files.</description>
-<rationale>Executable files with the SGID permission allow users to gain permissions commensurate with the
-group owner of the file. The presence of these files should be strictly controlled on the system.</rationale>
+<title>Ensure All Setgid Executables Are Authorized</title>
+<description>The SGID (set group id) bit should be set only on files that were
+installed via authorized means. A straightforward means of identifying
+unauthorized SGID files is determine if any were not installed as part of an
+RPM package, which is cryptographically verified. Investigate the origin
+of any unpackaged SGID files. 
+</description>
+<rationale>Executable files with the SGID permission run with the privileges of
+the owner of the file. SGID files of uncertain provenance could allow for
+unprivileged users to elevate privileges. The presence of these files should be
+strictly controlled on the system.</rationale>
 <ident cce="14970-8" />
 <oval id="file_permissions_unauthorized_sgid" />
 <ref nist="CM-6"/>
 </Rule>
 
 <Rule id="no_unpackaged_suid_files">
-<title>Find Unauthorized SUID System Executables</title>
-<description>The suid bit should not be set for all files.</description>
-<rationale>Executable files with the SUID permission allow users to gain permissions commensurate with the
-owner of the file. The presence of these files should be strictly controlled on the system.</rationale>
+<title>Ensure All SUID Executables Are Authorized</title>
+<description>The SUID (set user id) bit should be set only on files that were
+installed via authorized means. A straightforward means of identifying
+unauthorized SGID files is determine if any were not installed as part of an
+RPM package, which is cryptographically verified. Investigate the origin
+of any unpackaged SUID files. 
+</description>
+<rationale>Executable files with the SUID permission run with the privileges of
+the owner of the file. SUID files of uncertain provenance could allow for
+unprivileged users to elevate privileges. The presence of these files should be
+strictly controlled on the system.</rationale>
 <ident cce="14340-4" />
 <oval id="file_permissions_unauthorized_suid" />
 <ref nist="AC-3, CM-6"/>
@@ -307,7 +321,7 @@ owner of the file. The presence of these files should be strictly controlled on
 
 
 <Rule id="no_files_unowned_by_user">
-<title>Find files unowned by a user</title>
+<title>Ensure All Files Are Owned by a User</title>
 <description>The following command will discover and print any
 files on local partitions which do not belong to a valid user and a
 valid group. Run it once for each local partition PART:
@@ -330,7 +344,7 @@ and the cause should be discovered and addressed.
 </Rule>
 
 <Rule id="no_files_unowned_by_group">
-<title>Find files unowned by a group</title>
+<title>Ensure All Files Are Owned by a Group</title>
 <description>The following command will discover and print any
 files on local partitions which do not belong to a valid user and a
 valid group. Run it once for each local partition PART:
@@ -353,8 +367,7 @@ and the cause should be discovered and addressed.
 </Rule>
 
 <Rule id="world_writable_files_system_ownership">
-<title>Find world writable directories not owned by a
-system account</title>
+<title>Ensure All World-Writable Directories Are Owned by a System Account</title>
 <description>Locate any directories in local partitions which are
 world-writable and ensure that they are owned by root or another
 system account. The following command will discover and print these
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 6dc1fbc..c52707a 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -117,7 +117,7 @@ configuration of the native OS. The BIOS should be configured to disallow bootin
 </Rule>
 
 <Rule id="service_autofs_disabled">
-<title>Disable the Automounter if Possible</title>
+<title>Disable the Automounter</title>
 <description>The <tt>autofs</tt> daemon mounts and unmounts filesystems, such as user
 home directories shared via NFS, on demand. In addition, autofs can be used to handle
 removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>.
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 9fcbae5..7893c27 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -100,7 +100,7 @@ the chances that it remain off during system operation.
 </Rule>
 
 <Rule id="set_selinux_state">
-<title>Check SELinux State</title>
+<title>Ensure SELinux State is Enforcing</title>
 <description>The SELinux state should be set to <tt>enforcing</tt> during
 normal system operation. To ensure the system is configured to
 boot into enforcing mode, add or correct the following line in
@@ -119,7 +119,7 @@ privileges.
 </Rule>
 
 <Rule id="set_selinux_policy">
-<title>Check SELinux Policy</title>
+<title>Configure SELinux Policy</title>
 <description>The SELinux <tt>targeted</tt> policy is appropriate for
 general-purpose desktops and servers, as well as systems in many other roles.
 To configure the system to use this policy,
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 8cd6727..2670147 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -60,7 +60,7 @@ the exploitation of publicly-known vulnerabilities.
 <ref nist="SI-2" disa="1232"/>
 </Rule>
 <Rule id="ensure_gpgcheck_globally_activated">
-<title>Ensure "gpgcheck" Enabled In Yum Configuration</title>
+<title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
 <description>The <tt>gpgcheck</tt> option should be used to ensure that
 checking of an RPM package’s signature always occurs prior to its
 installation. To force yum to check package signatures before installing
@@ -79,7 +79,7 @@ protects against malicious tampering.
 </Rule>
 
 <Rule id="ensure_gpgcheck_never_disabled">
-<title>Ensure "gpgcheck" Enabled For All Yum Package Repositories</title>
+<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
 <description>To ensure that signature checking is not disabled for
 any repos, ensure that the following line DOES NOT appear in any
 repo configuration files in <tt>/etc/yum.repos.d</tt> or elsewhere:
-- 
1.7.1



More information about the scap-security-guide mailing list