[PATCH 10/14] Created macro "service-disable-ocil-macro", mapped to service_bluetooth_disabled - Created service-disable-ocil-macro for use as macro when making OCIL checks on disabled services - Mapped OCIL of service_bluetooth_disabled as an example

Shawn Wells shawn at redhat.com
Wed Sep 19 17:01:48 UTC 2012


---
 RHEL6/input/system/network/wireless.xml |    1 +
 RHEL6/transforms/shorthand2xccdf.xslt   |   10 ++++++++++
 2 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
index 689fe69..fcf38d2 100644
--- a/RHEL6/input/system/network/wireless.xml
+++ b/RHEL6/input/system/network/wireless.xml
@@ -94,6 +94,7 @@ the need to install such a driver first.
 connections to to Bluetooth devices, which entails some security risk.
 Nevertheless, variation in this risk decision may be expected due to the
 utility of Bluetooth connectivity and its limited range.</rationale>
+<ocil><service-disable-ocil-macro service="bluetooth" /></ocil>
 <ident cce="4355-4" />
 <oval id="service_bluetooth_disabled" />
 <ref nist="AC-18, CM-6, CM-7" disa="85" />
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index 0d8f56e..e219c3d 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -220,6 +220,16 @@ exclude-result-prefixes="xccdf xhtml">
     <xhtml:pre># chkconfig <xsl:value-of select="@service"/> off</xhtml:pre>
   </xsl:template>
 
+  <xsl:template match="service-disable-ocil-macro">
+    Run the following command to verify the <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service has been
+    disabled:
+   <xhtml:pre># chkconfig <xhtml:code><xsl:value-of select="@service"/></xhtml:code> --list</xhtml:pre>
+   Output should indicate the <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service has been disabled at all runlevels,
+   as shown in the example below:
+   <xhtml:pre># chkconfig <xhtml:code><xsl:value-of select="@service"/></xhtml:code> --list
+<xhtml:code><xsl:value-of select="@service"/></xhtml:code>       0:off   1:off   2:off   3:off   4:off   5:off   6:off</xhtml:pre>
+  </xsl:template>
+
   <xsl:template match="service-enable-macro">
     The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command:
     <xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
-- 
1.7.1


--X1bOJ3K7DJ5YkBrT--


More information about the scap-security-guide mailing list