[PATCH] Title "Added OCIL Checking"

Michael McConachie michael at redhat.com
Wed Sep 19 04:39:41 UTC 2012


---
 RHEL6/input/system/selinux.xml           |  8 +++++++
 RHEL6/input/system/software/updating.xml | 41 +++++++++++++++++++++++++-------
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 7893c27..726b771 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -89,6 +89,14 @@ in <tt>/etc/grub.conf</tt>.
 To ensure that SELinux is not disabled at boot time, ensure that <tt>selinux=0</tt> is not
 found in the kernel arguments in that file.
 </description>
+<ocil>
+Run the following command to determine if SELinux has been
+disabled at boot time:
+<pre># grep selinux=0 /etc/grub.conf</pre>
+If it doesn't reurn a value, then it hasn't been disabled. ex:
+<pre># grep selinux=0 /etc/grub.conf</pre>
+<pre># &lt;---Flashing cursor</pre>
+</ocil>
 <rationale>
 Disabling a major host protection feature such as SELinux at boot time prevents
 it from confining system services at boot time, and increases
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index b43e21f..34b18f5 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -21,17 +21,18 @@ for this reason, their use is strongly encouraged.
 <Rule id="ensure_redhat_gpgkey_installed">
 <title>Ensure Red Hat GPG Key Installed</title>
 <description>
-To ensure that the system can cryptographically verify base
-software packages come from Red Hat (and to connect to the Red
-Hat Network to receive them if desired), the Red Hat GPG key
-must properly be installed. Run the following command to
-install the Red Hat GPG key, of which Red Hat uses to sign
-publically released software:
-
+To ensure that the system can cryptographically verify base software
+packages come from Red Hat (and to connect to the Red Hat Network to
+receive them if desired), the Red Hat GPG key must properly be installed.
+Run the following command to install the Red Hat GPG key, of which Red Hat
+uses to sign. To ensure that the GPG Key is isntalled, run:
+<pre># rhn_register</pre>
+</description>
+<ocil>To ensure that the GPG Key is isntalled, run:
 <pre>$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey</pre>
 The command should return the string:
 <pre>gpg(Red Hat, Inc. (release key &lt;security at redhat.com&gt;)</pre>
-</description>
+</ocil>
 <rationale>
 This key is necessary to cryptographically verify that packages
 are from Red Hat.
@@ -53,6 +54,13 @@ need to be updated:
 To actually install these updates, run:
 <pre># yum update</pre>
 </description>
+<ocil>
+After running the update command, you can reinvoke the same command
+to determine if updates were applied. If you run the command and
+nothing comes back as needing to be updated, then your system is up
+to date.
+<pre># yum update</pre>
+</ocil>
 <rationale>
 Installing software updates is a fundamental mitigation against
 the exploitation of publicly-known vulnerabilities.
@@ -68,6 +76,14 @@ them, ensure that the following line appears in <tt>/etc/yum.conf</tt> in
 the <tt>[main]</tt> section:
 <pre>gpgcheck=1</pre>
 </description>
+<ocil>
+By performing a simple grep, one can determine if the value is set in
+the file or not. Run the following command to deterine the status of
+the variable in the file.
+<pre># grep gpgcheck=1 /etc/yum.conf</pre>
+If it reurns a value, then it is enabled. ex:
+<pre># gpgcheck=1 &lt;--- Returned value from the grep command</pre>
+</ocil>
 <rationale>
 Ensuring the validity of packages' cryptographic signatures prior to
 installation ensures the provenance of the software and
@@ -85,6 +101,15 @@ any repos, ensure that the following line DOES NOT appear in any
 repo configuration files in <tt>/etc/yum.repos.d</tt> or elsewhere:
 <pre>gpgcheck=0</pre>
 </description>
+<ocil>
+By performing a simple grep, one can determine if the value is set
+in the file or not. Run the following command to deterine the status
+of the variable in the file.
+<pre># grep gpgcheck=0 /etc/yum.conf</pre>
+If it doesn't reurn a value, then it hasn't been disabled. ex:
+<pre># grep gpgcheck=0 /etc/yum.conf</pre>
+<pre># &lt;---Flashing cursor</pre>
+</ocil>
 <rationale>
 Ensuring that all packages' cryptographic signatures are valid prior to
 installation ensures the provenance of the software and
-- 
1.7.11.4


--------------090207040906070002050900--


More information about the scap-security-guide mailing list