[PATCH 2/3] use of new macros for disk partition checking, minor language updates

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Sep 6 21:14:08 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/software/disk_partitioning.xml |   41 ++++++++++++---------
 1 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index f133cc5..e678d61 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -29,12 +29,13 @@ detailed information on LVM.</description>
 <description>
 The <tt>/tmp</tt> directory is a world-writable directory used
 for temporary file storage. Ensure that it has its own partition or
-logical volume.
+logical volume at installation time, or migrate it using LVM.
 </description>
+<ocil><partition-check-macro part="/tmp"/></ocil>
 <rationale>
-The <tt>/tmp</tt> partition is used as temporary storage
-by many programs.
-Placing <tt>/tmp</tt> in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.
+The <tt>/tmp</tt> partition is used as temporary storage by many programs.
+Placing <tt>/tmp</tt> in its own partition enables the setting of more
+restrictive mount options, which can help protect programs which use it.
 </rationale>
 <ident cce="14161-4"/>
 <oval id="mount_tmp_own_partition" />
@@ -45,7 +46,9 @@ Placing <tt>/tmp</tt> in its own partition enables the setting of more restricti
 <title>Ensure /var Located On Separate Partition</title>
 <description>The <tt>/var</tt> directory is used by daemons and other system
 services to store frequently-changing data. Ensure that <tt>/var</tt> has its own partition
-or logical volume.</description>
+or logical volume at installation time, or migrate it using LVM.
+</description>
+<ocil><partition-check-macro part="/var"/></ocil>
 <rationale>
 Ensuring that <tt>/var</tt> is mounted on its own partition enables the
 setting of more restrictive mount options. This helps protect
@@ -63,8 +66,9 @@ world-writable directories, installed by other software packages.
 <description>
 System logs are stored in the <tt>/var/log</tt> directory.
 Ensure that it has its own partition or logical
-volume.
+volume at installation time, or migrate it using LVM.
 </description>
+<ocil><partition-check-macro part="/var/log"/></ocil>
 <rationale>
 Placing <tt>/var/log</tt> in its own partition
 enables better separation between log files
@@ -72,17 +76,18 @@ and other files in <tt>/var/</tt>.
 </rationale>
 <ident cce="14011-1" />
 <oval id="mount_var_log_own_partition" />
-<ref nist="CM-6, AU-9" cnss="CNSSexample7.8.9" disa=""/>
+<ref nist="CM-6, AU-9" />
 </Rule>
 
 <Rule id="partition_for_var_log_audit">
 <title>Ensure /var/log/audit Located On Separate Partition</title>
 <description>
-Audit logs are stored in the <tt>/var/log/audit</tt> directory.
-Ensure that it has its own partition or logical volume. Make
-absolutely certain that it is large enough to store all audit logs
-that will be created by the auditing daemon.
+Audit logs are stored in the <tt>/var/log/audit</tt> directory.  Ensure that it
+has its own partition or logical volume at installation time, or migrate it
+later using LVM. Make absolutely certain that it is large enough to store all
+audit logs that will be created by the auditing daemon.
 </description>
+<ocil><partition-check-macro part="/var/log/audit"/></ocil>
 <rationale>
 Placing <tt>/var/log/audit</tt> in its own partition
 enables better separation between audit files
@@ -98,12 +103,13 @@ of space.
 <Rule id="partition_for_home">
 <title>Ensure /home Located On Separate Partition</title>
 <description>
-If user home directories will be stored locally,
-create a separate partition for <tt>/home</tt>. If <tt>/home</tt> will be mounted
-from another system such as an NFS server, then creating a separate
-partition is not necessary at this time, and the mountpoint can
-instead be configured later.
+If user home directories will be stored locally, create a separate partition
+for <tt>/home</tt> at installation time (or migrate it later using LVM). If
+<tt>/home</tt> will be mounted from another system such as an NFS server, then
+creating a separate partition is not necessary at installation time, and the
+mountpoint can instead be configured later.
 </description>
+<ocil><partition-check-macro part="/home"/></ocil>
 <rationale>
 Ensuring that <tt>/home</tt> is mounted on its own partition enables the
 setting of more restrictive mount options, and also helps ensure that
@@ -117,8 +123,7 @@ users cannot trivially fill partitions used for log or audit data storage.
 <Group id="partition_encryption" >
 <title>Encrypting Partitions</title>
 <description>
-One of the best ways to protect data at rest is by using partition encryption. In
-Red Hat Enterprise Linux 6 partition encryption is natively supported through the
+Red Hat Enterprise Linux 6 natively supports partition encryption through the
 Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to 
 encrypt a partition is during install time.
 <br /><br />
-- 
1.7.1



More information about the scap-security-guide mailing list