[PATCH 2/3] use of new macros for disk partition checking, minor language updates
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu Sep 6 21:14:08 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/system/software/disk_partitioning.xml | 41 ++++++++++++---------
1 files changed, 23 insertions(+), 18 deletions(-)
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index f133cc5..e678d61 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -29,12 +29,13 @@ detailed information on LVM.</description>
<description>
The <tt>/tmp</tt> directory is a world-writable directory used
for temporary file storage. Ensure that it has its own partition or
-logical volume.
+logical volume at installation time, or migrate it using LVM.
</description>
+<ocil><partition-check-macro part="/tmp"/></ocil>
<rationale>
-The <tt>/tmp</tt> partition is used as temporary storage
-by many programs.
-Placing <tt>/tmp</tt> in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.
+The <tt>/tmp</tt> partition is used as temporary storage by many programs.
+Placing <tt>/tmp</tt> in its own partition enables the setting of more
+restrictive mount options, which can help protect programs which use it.
</rationale>
<ident cce="14161-4"/>
<oval id="mount_tmp_own_partition" />
@@ -45,7 +46,9 @@ Placing <tt>/tmp</tt> in its own partition enables the setting of more restricti
<title>Ensure /var Located On Separate Partition</title>
<description>The <tt>/var</tt> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <tt>/var</tt> has its own partition
-or logical volume.</description>
+or logical volume at installation time, or migrate it using LVM.
+</description>
+<ocil><partition-check-macro part="/var"/></ocil>
<rationale>
Ensuring that <tt>/var</tt> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
@@ -63,8 +66,9 @@ world-writable directories, installed by other software packages.
<description>
System logs are stored in the <tt>/var/log</tt> directory.
Ensure that it has its own partition or logical
-volume.
+volume at installation time, or migrate it using LVM.
</description>
+<ocil><partition-check-macro part="/var/log"/></ocil>
<rationale>
Placing <tt>/var/log</tt> in its own partition
enables better separation between log files
@@ -72,17 +76,18 @@ and other files in <tt>/var/</tt>.
</rationale>
<ident cce="14011-1" />
<oval id="mount_var_log_own_partition" />
-<ref nist="CM-6, AU-9" cnss="CNSSexample7.8.9" disa=""/>
+<ref nist="CM-6, AU-9" />
</Rule>
<Rule id="partition_for_var_log_audit">
<title>Ensure /var/log/audit Located On Separate Partition</title>
<description>
-Audit logs are stored in the <tt>/var/log/audit</tt> directory.
-Ensure that it has its own partition or logical volume. Make
-absolutely certain that it is large enough to store all audit logs
-that will be created by the auditing daemon.
+Audit logs are stored in the <tt>/var/log/audit</tt> directory. Ensure that it
+has its own partition or logical volume at installation time, or migrate it
+later using LVM. Make absolutely certain that it is large enough to store all
+audit logs that will be created by the auditing daemon.
</description>
+<ocil><partition-check-macro part="/var/log/audit"/></ocil>
<rationale>
Placing <tt>/var/log/audit</tt> in its own partition
enables better separation between audit files
@@ -98,12 +103,13 @@ of space.
<Rule id="partition_for_home">
<title>Ensure /home Located On Separate Partition</title>
<description>
-If user home directories will be stored locally,
-create a separate partition for <tt>/home</tt>. If <tt>/home</tt> will be mounted
-from another system such as an NFS server, then creating a separate
-partition is not necessary at this time, and the mountpoint can
-instead be configured later.
+If user home directories will be stored locally, create a separate partition
+for <tt>/home</tt> at installation time (or migrate it later using LVM). If
+<tt>/home</tt> will be mounted from another system such as an NFS server, then
+creating a separate partition is not necessary at installation time, and the
+mountpoint can instead be configured later.
</description>
+<ocil><partition-check-macro part="/home"/></ocil>
<rationale>
Ensuring that <tt>/home</tt> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
@@ -117,8 +123,7 @@ users cannot trivially fill partitions used for log or audit data storage.
<Group id="partition_encryption" >
<title>Encrypting Partitions</title>
<description>
-One of the best ways to protect data at rest is by using partition encryption. In
-Red Hat Enterprise Linux 6 partition encryption is natively supported through the
+Red Hat Enterprise Linux 6 natively supports partition encryption through the
Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to
encrypt a partition is during install time.
<br /><br />
--
1.7.1
More information about the scap-security-guide
mailing list