[PATCH 5/5] added check text to system section

Shawn Wells shawn at redhat.com
Mon Sep 24 15:01:01 UTC 2012


On 9/24/12 9:45 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/accounts/physical.xml           |   25 ++-
>   .../accounts/restrictions/password_storage.xml     |   40 +++--
>   .../system/accounts/restrictions/root_logins.xml   |   10 +-
>   RHEL6/input/system/auditing.xml                    |  204 +++++++++++++++++---
>   RHEL6/input/system/logging.xml                     |   13 +-
>   RHEL6/input/system/network/ipsec.xml               |    8 +-
>   RHEL6/input/system/network/iptables.xml            |    5 +
>   RHEL6/input/system/network/ipv6.xml                |   12 ++
>   RHEL6/input/system/network/kernel.xml              |   45 +++++
>   RHEL6/input/system/network/uncommon.xml            |   32 ++--
>   RHEL6/input/system/network/wireless.xml            |    4 +
>   RHEL6/input/system/permissions/execution.xml       |    6 +-
>   RHEL6/input/system/permissions/files.xml           |  145 ++++++++++-----
>   RHEL6/input/system/selinux.xml                     |   45 ++---
>   14 files changed, 453 insertions(+), 141 deletions(-)
>
> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
> index 26b697c..568fc59 100644
> --- a/RHEL6/input/system/accounts/physical.xml
> +++ b/RHEL6/input/system/accounts/physical.xml
> @@ -29,8 +29,12 @@ If any correction is needed for the permissions on <tt>/etc/grub.conf</tt>, (whi
>   
>   <Rule id="user_owner_grub_conf">
>   <title>Verify /boot/grub/grub.conf User Ownership</title>
> -<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to <tt>/boot/grub/grub.conf</tt> which
> -should be owned by the <tt>root</tt> user to prevent destruction or modification of the file.</description>
> +<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to
> +<tt>/boot/grub/grub.conf</tt> which should be owned by the <tt>root</tt> user
> +to prevent destruction or modification of the file.
> +<fileowner-desc-macro file="/boot/grub/grub.conf" owner="root"/>
> +</description>
> +<ocil><fileowner-check-macro file="/boot/grub/grub.conf" owner="root"/></ocil>
>   <rationale>
>   Only root should be able to modify important boot parameters.
>   </rationale>
> @@ -41,8 +45,12 @@ Only root should be able to modify important boot parameters.
>   
>   <Rule id="group_owner_grub_conf">
>   <title>Verify /boot/grub/grub.conf Group Ownership</title>
> -<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to <tt>/boot/grub/grub.conf</tt> which
> -should be group-owned by the <tt>root</tt> group to prevent destruction or modification of the file.</description>
> +<description>The file <tt>/etc/grub.conf</tt> is a symbolic link to
> +<tt>/boot/grub/grub.conf</tt> which should be group-owned by the <tt>root</tt>
> +group to prevent destruction or modification of the file.
> +<filegroupowner-desc-macro file="/boot/grub/grub.conf" owner="root"/>
> +</description>
> +<ocil><filegroupowner-check-macro file="/boot/grub/grub.conf" owner="root"/></ocil>
>   <rationale>
>   The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this
>   file should not have any access privileges anyway.
> @@ -55,10 +63,13 @@ file should not have any access privileges anyway.
>   <Rule id="permissions_grub_conf">
>   <title>Verify /boot/grub/grub.conf Permissions</title>
>   <description>File permissions for <tt>/boot/grub/grub.conf</tt> should be set to 600, which
> -is the default.</description>
> +is the default.
> +<fileperms-desc-macro file="/boot/grub/grub.conf" owner="600"/>
> +</description>
> +<ocil><fileperms-check-macro file="/boot/grub/grub.conf" owner="-rw-------"/></ocil>
>   <rationale>
> -This ensures that only the root user should be able to modify important boot parameters contained in
> -this file.
> +Proper permissions ensure that only the root user can modify important boot
> +parameters.
>   </rationale>
>   <ident cce="3923-0" />
>   <oval id="file_permissions_grub_conf" />
> diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> index 29572f2..b030ad4 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> @@ -20,15 +20,16 @@ should allow administrators to avoid such misconfiguration.
>   <title>Prevent Log In to Accounts With Empty Password</title>
>   <description>If an account is configured for password authentication
>   but does not have an assigned password, it may be possible to log
> -into the account without authentication. Ensuring that the <tt>nullok</tt>
> -option is <b>NOT</b> used in the <tt>/etc/pam.d/system-auth-ac</tt>
> -prevents logins with empty passwords.
> -<br /><br />
> -To verify manually, the following command can be used:
> -<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
> -If this produces any output, fix the problem by removing any instance
> -of <tt>nullok</tt> in <tt>/etc/pam.d/system-auth-ac</tt>.
> +into the account without authentication. Remove any instances of the <tt>nullok</tt>
> +option in <tt>/etc/pam.d/system-auth-ac</tt> to
> +prevent logins with empty passwords.
>   </description>
> +<ocil>
> +To verify that null passwords cannot be used, run the following command:
> +<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
> +If this produces any output, it may be possible to log into accounts
> +with empty passwords.
> +</ocil>
>   <rationale>
>   If an account has an empty password, anybody may log in and
>   run commands with the privileges of that account. Accounts with
> @@ -42,10 +43,19 @@ environments.
>   
>   <Rule id="no_hashes_outside_shadow">
>   <title>Verify All Account Password Hashes are Shadowed</title>
> -<description>To ensure that no password hashes are stored in
> -<tt>/etc/passwd</tt>, the following command should have no output:
> -<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
> +<description>
> +If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
> +instead of an <tt>x</tt>), the cause of this misconfiguration should be
> +investigated.  The account should have its password reset and the hash should be
> +properly stored, or the account should be deleted entirely.
>   </description>
> +<ocil>
> +To check that no password hashes are stored in
> +<tt>/etc/passwd</tt>, run the following command:
> +<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
> +If it produces any output, then a password hash is
> +stored in <tt>/etc/passwd</tt>.
> +</ocil>
>   <rationale>
>   The hashes for all user account passwords should be stored in
>   the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
> @@ -62,12 +72,14 @@ which is readable by all users.
>   used to auto-login into FTP servers and reside in the user's home
>   directory. These files may contain unencrypted passwords to
>   remote FTP servers making them susceptible to access by unauthorized
> -users and should not be used.
> -<br /><br />
> +users and should not be used.  Any <tt>.netrc</tt> files should be removed.
> +</description>
> +<ocil>
>   To check the system for the existence of any <tt>.netrc</tt> files,
>   run the following command:
>   <pre># find / -name .netrc</pre>
> -</description>
> +<!-- needs fixup to limit search to home dirs -->
> +</ocil>
>   <rationale>
>   Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
>   files. DoD policy requires passwords be encrypted in storage and not used
> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> index 0ee4e8b..f08b702 100644
> --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
> +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> @@ -134,12 +134,16 @@ become inaccessible.
>   <Rule id="no_uidzero_except_root">
>   <title>Verify Only Root Has UID 0</title>
>   <description>
> -This command will print all password file entries for
> +If any account other than root has a UID of 0,
> +this misconfiguration should be investigated and the
> +accounts other than root should be removed or have their UID changed.
> +</description>
> +<ocil>
> +To list all password file entries for
>   accounts with UID 0:
>   <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
>   This should print only one line, for the user root.
> -<br /><br />
> -</description>
> +</ocil>
>   <rationale>
>   An account has root authority if it has a UID of 0. Multiple accounts
>   with a UID of 0 afford more opportunity for potential intruders to
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index 1649cfc..5cdb2ff 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -87,6 +87,7 @@ the Linux Auditing System, as it is responsible for writing audit records to
>   disk.
>   <service-enable-macro service="auditd" />
>   </description>
> +<ocil><service-enable-check-macro service="auditd" /></ocil>
>   <rationale>Ensuring that the <tt>auditd</tt> service is active ensures that
>   audit records generated by the kernel can be written to disk, or that appropriate
>   actions will be taken if other obstacles exist.
> @@ -103,6 +104,10 @@ those which start prior to the audit daemon, add the argument
>   <tt>audit=1</tt> to the kernel line in <tt>/etc/grub.conf</tt>, in the manner below:
>   <pre>kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1</pre>
>   </description>
> +<ocil>
> +Inspect the kernel boot arguments (which follow the word <tt>kernel</tt>) in
> +<tt>/etc/grub.conf</tt> to ensure that they include <tt>audit=1</tt>.
> +</ocil>
>   <rationale>
>   Each process on the system carries an "auditable" flag which
>   indicates whether its activities can be audited. Although <tt>auditd</tt>
> @@ -226,10 +231,15 @@ normally.</i>
>   <description>Determine how many log files
>   <tt>auditd</tt> should retain when it rotates logs.
>   Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following
> -line, substituting <i>NUMLOGS</i> with an appropriate value:
> +line, substituting <i>NUMLOGS</i> with the correct value:
>   <pre>num_logs = <i>NUMLOGS</i></pre>
> -The default value of 5 is recommended for general-purpose systems. Note that
> -values less than 2 result in no log rotation.</description>
> +Set the value to 5 for general-purpose systems.
> +Note that values less than 2 result in no log rotation.</description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine how many logs the system is configured to retain after rotation:
> +<pre>num_logs = 5</pre>
> +</ocil>
>   <rationale>The total storage for audit log files must be large enough to retain
>   log information over the period required. This is a function of the maxium log
>   file size and the number of logs retained.</rationale>
> @@ -242,11 +252,16 @@ file size and the number of logs retained.</rationale>
>   <description>Determine the amount of audit data (in megabytes)
>   which should be retained in each log file. Edit the file
>   <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line, substituting
> -<i>STOREMB</i> with an appropriate value:
> +the correct value for <i>STOREMB</i>:
>   <pre>max_log_file = <i>STOREMB</i></pre>
> -The default value of 6 (MB) or even higher is recommended for general-purpose systems.
> +Set the value to <tt>6</tt> (MB) or higher for general-purpose systems.
>   Larger values, of course,
>   support retention of even more audit data.</description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine how much data the system will retain in each audit log file:
> +<pre>max_log_file = 6</pre>
> +</ocil>
>   <rationale>The total storage for audit log files must be large enough to retain
>   log information over the period required. This is a function of the maxium
>   log file size and the number of logs retained.</rationale>
> @@ -260,13 +275,23 @@ log file size and the number of logs retained.</rationale>
>   is to rotate the log files, discarding the oldest one. To configure the action taken
>   by <tt>auditd</tt>, add or correct the line:
>   <pre>max_log_file_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>suspend</tt>, <tt>rotate</tt>,
> -and <tt>keep_logs</tt>.
> -<br/><br/>
> -The default (case-insensitive) setting,
> -<tt>rotate</tt>, is recommended for most environments.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man
> +page. These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>rotate</tt></li>
> +<li><tt>keep_logs</tt></li>
> +</ul>
> +Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation
> +occurs.  This is the default.  The setting is case-insensitive.
>   </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to rotate logs when they reach their
> +maximum size: <pre>max_log_file_action <tt>rotate</tt></pre>
> +</ocil>
>   <rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>)
>   minimizes the chances of the system unexpectedly running out of disk space by
>   being overwhelmed with log data. However, for systems that must never discard
> @@ -293,16 +318,29 @@ installation time. The partition should be larger than the maximum space which
>   <title>Configure auditd space_left Action on Low Disk Space</title>
>   <description>The <tt>auditd</tt> service can be configured to take an action
>   when disk space <i>starts</i> to run low.
> -Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
> +Edit the file <tt>/etc/audit/auditd.conf</tt>. Modify the following line,
>   substituting <i>ACTION</i> appropriately:
>   <pre>space_left_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
> -<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>.
> -<br/><br/>
> -Setting this to <tt>email</tt> is recommended over the default
> -(<tt>suspend</tt>) as it may be more likely to get prompt attention.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
> +These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>email</tt></li>
> +<li><tt>exec</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>single</tt></li>
> +<li><tt>halt</tt></li>
> +</ul>
> +Set this to <tt>email</tt> (instead of the default,
> +which is <tt>suspend</tt>) as it is more likely to get prompt attention.
>   </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to email the administrator when
> +disk space is starting to run low:
> +<pre>space_left_action email</pre>
> +</ocil>
>   <rationale>Notifying administrators of an impending disk space problem may
>   allow them to take corrective action prior to any disruption.</rationale>
>   <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
> @@ -317,14 +355,28 @@ when disk space is running low but prior to running out of space completely.
>   Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
>   substituting <i>ACTION</i> appropriately:
>   <pre>admin_space_left_action = <i>ACTION</i></pre>
> -Valid values for <i>ACTION</i> include are described in the <tt>auditd.conf</tt> man page, and include
> -<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
> -<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>. The default setting is
> -<tt>suspend</tt>, which may not be noticed by some administrators.
> -<br/><br/>
> -Setting this value to <tt>single</tt> will cause the system to switch to
> -single user mode for corrective action, and is recommended.
> +Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
> +These include:
> +<ul>
> +<li><tt>ignore</tt></li>
> +<li><tt>syslog</tt></li>
> +<li><tt>email</tt></li>
> +<li><tt>exec</tt></li>
> +<li><tt>suspend</tt></li>
> +<li><tt>single</tt></li>
> +<li><tt>halt</tt></li>
> +</ul>
> +Set this value to <tt>single</tt> to cause the system to switch to single user
> +mode for corrective action.  For certain systems, the need for availability
> +outweighs the need to log all actions, and a different setting should be
> +determined.
>   </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to switch to single user mode
> +when disk space has run low:
> +<pre>admin_space_left_action single</pre>
> +</ocil>
>   <rationale>Administrators should be made aware of an inability to record
>   audit records. If a separate partition or logical volume of adequate size
>   is used, running low on space for audit records should never occur.
> @@ -342,6 +394,12 @@ in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
>   via email for those situations:
>   <pre>action_mail_acct = root</pre>
>   </description>
> +<ocil>
> +Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
> +determine if the system is configured to send email to an
> +account when it needs to notify an administrator:
> +<pre>action_mail_acct = root</pre>
> +</ocil>
>   <rationale>Email sent to the root account is typically aliased to the
>   administrators of the system, who can take appropriate action.</rationale>
>   <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
> @@ -412,6 +470,9 @@ desired, but is not required. See an example of multiple combined syscalls:
>   <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
>   -k audit_time_rules</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>Arbitrary changes to the system time can be used to obfuscate
>   nefarious activites in log files as well as to confuse network services that
>   are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -437,6 +498,9 @@ desired, but is not required. See an example of multiple combined syscalls:
>   <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
>   -k audit_time_rules</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>Arbitrary changes to the system time can be used to obfuscate
>   nefarious activites in log files as well as to confuse network services that
>   are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -460,6 +524,9 @@ See an example of multiple combined syscalls:
>   <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
>   -k audit_time_rules</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>Arbitrary changes to the system time can be used to obfuscate
>   nefarious activites in log files as well as to confuse network services that
>   are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -485,6 +552,9 @@ desired, but is not required. See an example of multiple combined syscalls:
>   <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
>   -k audit_time_rules</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>Arbitrary changes to the system time can be used to obfuscate
>   nefarious activites in log files as well as to confuse network services that
>   are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -503,6 +573,13 @@ The -k option allows for the specification of a key in string form that can
>   be used for better reporting capability through ausearch and aureport and
>   should always be used.
>   </description>
> +<ocil>
> +To determine if the system is configured to audit attempts to
> +alter time via the /etc/localtime file, run the following
> +command:
> +<pre># auditctl -l | grep "watch=/etc/localtime"</pre>
> +If the system is configured to audit this activity, it will return a line.
> +</ocil>
>   <rationale>Arbitrary changes to the system time can be used to obfuscate
>   nefarious activites in log files as well as to confuse network services that
>   are highly dependent upon an accurate system time (such as sshd). All changes
> @@ -525,9 +602,16 @@ to capture events that modify account changes:
>   -w /etc/shadow -p wa -k audit_account_changes
>   -w /etc/security/opasswd -p wa -k audit_account_changes</pre>
>   </description>
> +<ocil>
> +To determine if the system is configured to audit account changes,
> +run the following command:
> +<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> +If the system is configured to watch for account changes, lines should be returned for
> +each file specified (and with <tt>perm=wa</tt> for each).
> +</ocil>
>   <rationale>In addition to auditing new user and group accounts, these watches
> -will alert the system administrator(s) to any modifications. It is recommended
> -that any unexpected users, groups, or modifications be investigated for
> +will alert the system administrator(s) to any modifications. Any
> +unexpected users, groups, or modifications should be investigated for
>   legitimacy.</rationale>
>   <ident cce="14829-6" />
>   <oval id="audit_rules_usergroup_modification" />
> @@ -545,6 +629,13 @@ ARCH to either b32 or b64 as appropriate for your system:
>   -w /etc/hosts -p wa -k audit_network_modifications
>   -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre>
>   </description>
> +<ocil>
> +To determine if the system is configured to audit changes to its network configuration,
> +run the following command:
> +<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> +If the system is configured to watch for account changes, a line should be returned for
> +each file specified (and <tt>perm=wa</tt> should be indicated for each).
> +</ocil>
>   <rationale>The network environment should not be modified by anything other
>   than administrator action. Any change to network parameters should be
>   audited.</rationale>
> @@ -560,7 +651,14 @@ Controls</title>
>   <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
>   <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
>   </description>
> -<!-- TODO add info for selinux system calls which load new policy? -->
> +<ocil>
> +To determine if the system is configured to audit changes to its SELinux
> +configuration files, run the following command:
> +<pre># auditctl -l | grep "dir=selinux"</pre>
> +If the system is configured to watch for changes to its SELinux
> +configuration, a line should be returned (including
> +<tt>perm=wa</tt> indicating permissions that are watched).
> +</ocil>
>   <rationale>The system's mandatory access policy (SELinux) should not be
>   arbitrarily changed by anything other than administrator action. All changes to
>   MAC policy should be audited.</rationale>
> @@ -618,6 +716,9 @@ If the system is 64 bit then also add the following:
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
>   unauthorized users.</rationale>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <warning category="general">Note that these rules can be configured in a
>   number of ways while still acheiving the desired effect.  Here the system calls
>   have been placed independant of other system calls.  Grouping these system
> @@ -640,6 +741,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -666,6 +770,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -692,6 +799,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmodat" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -718,6 +828,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchown" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -744,6 +857,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchownat" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -770,6 +886,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fremovexattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -796,6 +915,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fsetxattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -822,6 +944,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="fchmod" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -848,6 +973,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="lremovexattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -874,6 +1002,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="lsetxattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -900,6 +1031,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="removexattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -926,6 +1060,9 @@ If the system is 64 bit then also add the following:
>   <pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=500 -F auid!=4294967295 \
>       -k perm_mod</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="setxattr" />
> +</ocil>
>   <rationale>The changing of file permissions could indicate that a user is attempting to
>   gain access to information that would otherwise be disallowed. Auditing DAC modifications
>   can facilitate the identification of patterns of abuse amoung both authorized and
> @@ -985,6 +1122,7 @@ appropriate for your system:
>   -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
>       -S ftruncate -F exit=-EPERM -F auid&gt;=500 -F auid!=4294967295 -k access</pre>
>   </description>
> +
>   <rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
>   these events could serve as evidence of potential system compromise.</rationale>
>   <ident cce="14917-9" />
> @@ -1039,6 +1177,12 @@ appropriate for your system:
>   <pre>-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
>       -F auid&gt;=500 -F auid!=4294967295 -k delete</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="unlink" />
> +<audit-syscall-check-macro syscall="unlinkat" />
> +<audit-syscall-check-macro syscall="rename" />
> +<audit-syscall-check-macro syscall="renameat" />
> +</ocil>
>   <rationale>Auditing file deletions will create an audit trail for files that are removed
>   from the system. The audit trail could aid in system troubleshooting as well as detecting
>   malicious processes that attempt to delete log files to conceal their presence.</rationale>
> @@ -1071,6 +1215,10 @@ to capture kernel module loading and unloading events:
>   -w /sbin/modprobe -p x -k modules
>   -a always,exit -S init_module -S delete_module -k modules</pre>
>   </description>
> +<ocil>
> +<audit-syscall-check-macro syscall="init_module" />
> +<audit-syscall-check-macro syscall="delete_module" />
> +</ocil>
>   <rationale>The addition/removal of kernel modules can be used to alter the behavior of
>   the kernel and potentially introduce malicious code into kernel space. It is important
>   to have an audit trail of modules that have been introduced into the kernel.</rationale>
> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
> index ea30340..d24b421 100644
> --- a/RHEL6/input/system/logging.xml
> +++ b/RHEL6/input/system/logging.xml
> @@ -20,12 +20,12 @@ monitor logs.</description>
>   <Rule id="package_rsyslog_installed">
>   <title>Ensure rsyslog is Installed</title>
>   <description>
> -Rsyslog is installed by default. Ensure that it is installed
> -by running:
> -<pre>$ rpm -q rsyslog</pre>
> -If it is not installed, install it by running:
> -<pre># yum install rsyslog</pre>
> +Rsyslog is installed by default.
> +<package-install-macro service="rsyslog" />
>   </description>
> +<ocil>
> +<package-check-macro package="rsyslog" />
> +</ocil>
>   <rationale>
>   The rsyslog package provides the rsyslog daemon, which provides
>   system logging services.
> @@ -41,6 +41,9 @@ system logging services.
>   <description>The <tt>rsyslog</tt> service provides syslog-style logging by default on RHEL 6.
>   <service-enable-macro service="rsyslog" />
>   </description>
> +<ocil>
> +<service-enable-check-macro service="rsyslog" />
> +</ocil>
>   <rationale>The <tt>rsyslog</tt> service must be running in order to provide
>   logging services, which are essential to system administration.
>   </rationale>
> diff --git a/RHEL6/input/system/network/ipsec.xml b/RHEL6/input/system/network/ipsec.xml
> index a9bc1a7..a738354 100644
> --- a/RHEL6/input/system/network/ipsec.xml
> +++ b/RHEL6/input/system/network/ipsec.xml
> @@ -8,10 +8,12 @@ is provided in RHEL 6 with Openswan.
>   <title>Install openswan Package</title>
>   <description>The Openswan package provides an implementation of IPsec
>   and IKE, which permits the creation of secure tunnels over
> -untrusted networks.  The <tt>openswan</tt> package can be installed
> -with the following command:
> -<pre># yum install openswan</pre>
> +untrusted networks.
> +<package-install-macro package="openswan" />
>   </description>
> +<ocil>
> +<package-check-macro package="openswan" />
> +</ocil>
>   <rationale>Providing the ability for remote users or systems
>   to initiate a secure VPN connection protects information when it is
>   transmitted over a wide area network.
> diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
> index 31237b7..9aae35d 100644
> --- a/RHEL6/input/system/network/iptables.xml
> +++ b/RHEL6/input/system/network/iptables.xml
> @@ -71,6 +71,7 @@ IPv6 lacks reliable connection-tracking functionality.</description>
>   <description>
>   <service-enable-macro service="ip6tables" />
>   </description>
> +<ocil><service-enable-check-macro service="ip6tables" /></ocil>
>   <rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
>   capability for IPv6 and ICMPv6.
>   </rationale>
> @@ -84,6 +85,7 @@ capability for IPv6 and ICMPv6.
>   <description>
>   <service-enable-macro service="iptables" />
>   </description>
> +<ocil><service-enable-check-macro service="iptables" /></ocil>
>   <rationale>
>   The <tt>iptables</tt> service provides the system's host-based firewalling
>   capability for IPv4 and ICMP.
> @@ -133,6 +135,9 @@ add or correct the following line in
>   <tt>/etc/sysconfig/iptables</tt>:
>   <pre>:INPUT DROP [0:0]</pre>
>   </description>
> +<ocil>Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine
> +the default policy for the INPUT chain. It should be set to DROP.
> +</ocil>
>   <rationale>In <tt>iptables</tt> the default policy is applied only after all
>   the applicable rules in the table are examined for a match. Setting the
>   default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
> diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
> index 7b43edd..b703e1d 100644
> --- a/RHEL6/input/system/network/ipv6.xml
> +++ b/RHEL6/input/system/network/ipv6.xml
> @@ -22,6 +22,18 @@ instruct the IPv6 kernel module not to load it.</description>
>   This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it),
>   while disabling support for the IPv6 protocol.
>   </description>
> +<ocil>
> +If the system is configured to prevent the loading of the
> +<tt>ipv6</tt> kernel module, it will contain a line
> +of the form
> +<pre>options ipv6 disable=1</pre>
> +inside any file in <tt>/etc/modprobe.d</tt> or the deprecated<tt>/etc/modprobe.conf</tt>.
> +This permits insertion of the IPv6 kernel module (which other parts of the system
> +expect to be present), but otherwise keeps it inactive.
> +Run the following command to search for such lines in all files in <tt>/etc/modprobe.d</tt>
> +and the deprecated <tt>/etc/modprobe.conf</tt>:
> +<pre xml:space="preserve">$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d</pre>
> +</ocil>
>   <rationale>
>   Any networking stack, including IPv6, that does not need to be active should be
>   disabled in order to reduce the system's vulnerability
> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
> index 63bb1f5..5485fcd 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -16,6 +16,9 @@ of network traffic.</description>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
> +</ocil>
>   <rationale>Sending ICMP redirects permits the system to instruct other systems
>   to update their routing information.  The ability to send ICMP redirects is
>   only appropriate for routers.</rationale>
> @@ -29,6 +32,9 @@ only appropriate for routers.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
> +</ocil>
>   <rationale>Sending ICMP redirects permits the system to instruct other systems
>   to update their routing information.  The ability to send ICMP redirects is
>   only appropriate for routers.</rationale>
> @@ -42,6 +48,9 @@ only appropriate for routers.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
> +</ocil>
>   <rationale>IP forwarding permits the kernel to forward packets from one network
>   interface to another. The ability to forward packets between two networks is
>   only appropriate for routers.</rationale>
> @@ -190,6 +199,9 @@ operator="equals" interactive="0">
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
> +</ocil>
>   <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
>   uses. It should be disabled unless it is absolutely required.</rationale>
>   <ident cce="4236-6" />
> @@ -202,6 +214,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
> +</ocil>
>   <rationale>Accepting ICMP redirects has few legitimate
>   uses. It should be disabled unless it is absolutely required.</rationale>
>   <ident cce="4217-6" />
> @@ -215,6 +230,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
> +</ocil>
>   <rationale>Accepting "secure" ICMP redirects (from those gateways listed as
>   default gateways) has few legitimate uses. It should be disabled unless it is
>   absolutely required.</rationale>
> @@ -228,6 +246,9 @@ absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
> +</ocil>
>   <rationale>The presence of "martian" packets (which have impossible addresses)
>   as well as spoofed packets, source-routed packets, and redirects could be a
>   sign of nefarious network activity. Logging these packets enables this activity
> @@ -243,6 +264,9 @@ to be detected.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
> +</ocil>
>   <rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
>   uses. It should be disabled unless it is absolutely required.</rationale>
>   <ident cce="4091-5" />
> @@ -256,6 +280,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
> +</ocil>
>   <rationale>This feature of the IPv4 protocol has few legitimate
>   uses. It should be disabled unless it is absolutely required.</rationale>
>   <ident cce="4186-3" />
> @@ -269,6 +296,9 @@ uses. It should be disabled unless it is absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
> +</ocil>
>   <rationale>Accepting "secure" ICMP redirects (from those gateways listed as
>   default gateways) has few legitimate uses. It should be disabled unless it is
>   absolutely required.</rationale>
> @@ -283,6 +313,9 @@ absolutely required.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
> +</ocil>
>   <rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
>   addresses makes the system slightly more difficult to enumerate on the network.
>   </rationale>
> @@ -297,6 +330,9 @@ addresses makes the system slightly more difficult to enumerate on the network.
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
> +</ocil>
>   <rationale>Ignoring bogus ICMP error responses reduces
>   log size, although some activity would not be logged.</rationale>
>   <ident cce="4133-5" />
> @@ -309,6 +345,9 @@ log size, although some activity would not be logged.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
> +</ocil>
>   <rationale> A TCP SYN flood attack can cause a denial of service by filling a
>   system's TCP connection table with connections in the SYN_RCVD state.
>   Syncookies can be used to track a connection when a subsequent ACK is received,
> @@ -326,6 +365,9 @@ enables the system to continue servicing valid connection requests.
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
> +</ocil>
>   <rationale>Enabling reverse path filtering drops packets with source addresses
>   that should not have been able to be received on the interface they were
>   received on. It should not be used on systems which are routers for
> @@ -341,6 +383,9 @@ networks.</rationale>
>   <description>
>   <sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
>   </description>
> +<ocil>
> +<sysctl-check-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
> +</ocil>
>   <rationale>Enabling reverse path filtering drops packets with source addresses
>   that should not have been able to be received on the interface they were
>   received on. It should not be used on systems which are routers for
> diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
> index 75e35d7..84697d5 100644
> --- a/RHEL6/input/system/network/uncommon.xml
> +++ b/RHEL6/input/system/network/uncommon.xml
> @@ -14,13 +14,15 @@ prior to disabling them.
>   
>   <Rule id="disable_protocol_dccp" severity="medium">
>   <title>Disable DCCP Support</title>
> -<description>To prevent the DCCP kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install dccp /bin/true</pre>
> +<description>
>   The Datagram Congestion Control Protocol (DCCP) is a
>   relatively new transport layer protocol, designed to support
>   streaming media and telephony.
> +<module-disable-macro module="dccp" />
>   </description>
> +<ocil>
> +<module-disable-check-macro module="dccp" />
> +</ocil>
>   <rationale>
>   Disabling DCCP protects
>   the system against exploitation of any flaws in its implementation.
> @@ -33,14 +35,16 @@ the system against exploitation of any flaws in its implementation.
>   
>   <Rule id="disable_protocol_sctp" severity="medium">
>   <title>Disable SCTP Support</title>
> -<description>To prevent the SCTP kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install sctp /bin/true</pre>
> +<description>
>   The Stream Control Transmission Protocol (SCTP) is a
>   transport layer protocol, designed to support the idea of
>   message-oriented communication, with several streams of messages
>   within one connection.
> +<module-disable-macro module="sctp" />
>   </description>
> +<ocil>
> +<module-disable-check-macro module="sctp" />
> +</ocil>
>   <rationale>
>   Disabling SCTP protects
>   the system against exploitation of any flaws in its implementation.
> @@ -53,13 +57,15 @@ the system against exploitation of any flaws in its implementation.
>   
>   <Rule id="disable_protocol_rds">
>   <title>Disable RDS Support</title>
> -<description>To prevent the RDS kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install rds /bin/true</pre>
> +<description>
>   The Reliable Datagram Sockets (RDS) protocol is a transport
>   layer protocol designed to provide reliable high- bandwidth,
>   low-latency communications between nodes in a cluster.
> +<module-disable-macro module="rds" />
>   </description>
> +<ocil>
> +<module-disable-check-macro module="rds" />
> +</ocil>
>   <rationale>
>   Disabling RDS protects
>   the system against exploitation of any flaws in its implementation.
> @@ -72,13 +78,15 @@ the system against exploitation of any flaws in its implementation.
>   
>   <Rule id="disable_protocol_tipc" severity="medium">
>   <title>Disable TIPC Support</title>
> -<description>To prevent the TIPC kernel module from being loaded,
> -add the following line to the appropriate <tt>/etc/modprobe.d</tt> configuration file.:
> -<pre>install tipc /bin/true</pre>
> +<description>
>   The Transparent Inter-Process Communication (TIPC) protocol
>   is designed to provide communications between nodes in a
>   cluster.
> +<module-disable-macro module="tipc" />
>   </description>
> +<ocil>
> +<module-disable-check-macro module="tipc" />
> +</ocil>
>   <rationale>
>   Disabling TIPC protects
>   the system against exploitation of any flaws in its implementation.
> diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
> index 689fe69..7686390 100644
> --- a/RHEL6/input/system/network/wireless.xml
> +++ b/RHEL6/input/system/network/wireless.xml
> @@ -90,6 +90,9 @@ the need to install such a driver first.
>   <description>
>   <service-disable-macro service="bluetooth" />
>   </description>
> +<ocil>
> +<service-disable-check-macro service="bluetooth" />
> +</ocil>
>   <rationale>Disabling the <tt>bluetooth</tt> service prevents the system from attempting
>   connections to to Bluetooth devices, which entails some security risk.
>   Nevertheless, variation in this risk decision may be expected due to the
> @@ -108,6 +111,7 @@ to prevent the loading of the Bluetooth module:
>   <pre>install net-pf-31 /bin/true
>   install bluetooth /bin/true</pre>
>   </description>
> +
>   <rationale>If Bluetooth functionality must be disabled, preventing the kernel
>   from loading the kernel module provides an additional safeguard against its
>   activation.</rationale>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index c7e4034..6d32805 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -69,7 +69,8 @@ value of 0 is recommended.</description>
>   
>   <Rule id="disable_users_coredumps">
>   <title>Disable Core Dumps for All Users</title>
> -<description>To disable core dumps for all users, add the following line to <tt>/etc/security/limits.conf</tt>:
> +<description>To disable core dumps for all users, add the following line to
> +<tt>/etc/security/limits.conf</tt>:
>   <pre>*     hard   core    0</pre>
>   </description>
>   <rationale>A core dump includes a memory image taken at the time the operating system
> @@ -84,6 +85,7 @@ only for developers trying to debug problems.</rationale>
>   <Rule id="disable_setuid_coredumps">
>   <title>Disable Core Dumps for SUID programs</title>
>   <description><sysctl-desc-macro sysctl="fs.suid_dumpable" value="0" /></description>
> +<ocil><sysctl-check-macro sysctl="fs.suid_dumpable" value="0" /></ocil>
>   <rationale>The core dump of a setuid program is more likely to contain
>   sensitive data, as the program itself runs with greater privileges than the
>   user who initiated execution of the program.  Disabling the ability for any
> @@ -109,6 +111,7 @@ controlled through <tt>sysctl</tt> variables <tt>kernel.exec-shield</tt> and
>   <Rule id="enable_execshield">
>   <title>Enable ExecShield</title>
>   <description><sysctl-desc-macro sysctl="kernel.exec-shield" value="1" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.exec-shield" value="1" /></ocil>
>   <rationale>ExecShield uses the segmentation feature on all x86 systems
>   to prevent execution in memory higher than a certain address. It
>   writes an address as a limit in the code segment descriptor, to
> @@ -124,6 +127,7 @@ address range.</rationale>
>   <Rule id="enable_randomize_va_space">
>   <title>Enable Randomized Layout of Virtual Address Space</title>
>   <description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="1" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="1" /></ocil>
>   <rationale> Address space layout randomization (ASLR) makes it more difficult
>   for an attacker to predict the location of attack code he or she has introduced
>   into a process's address space during an attempt at exploitation.  ASLR also
> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
> index b82c024..59f0a3a 100644
> --- a/RHEL6/input/system/permissions/files.xml
> +++ b/RHEL6/input/system/permissions/files.xml
> @@ -19,8 +19,8 @@ passwords, and should never be enabled.</description>
>   
>   <Rule id="userowner_shadow_file">
>   <title>Verify User Who Owns <tt>shadow</tt> File</title>
> -<description>The <tt>/etc/shadow</tt> file should be owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/shadow" owner="root"/></ocil>
>   <rationale>The <tt>/etc/shadow</tt> file contains the list of local
>   system accounts and stores password hashes. Protection of this file is
>   critical for system security. Failure to give ownership of this file
> @@ -33,8 +33,8 @@ which could weaken the system security posture.</rationale>
>   
>   <Rule id="groupowner_shadow_file">
>   <title>Verify Group Who Owns <tt>shadow</tt> File</title>
> -<description>The <tt>/etc/shadow</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/shadow" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/shadow" group="root"/></ocil>
>   <rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
>   critical for system security.</rationale>
>   <ident cce="3988-3" />
> @@ -44,8 +44,8 @@ critical for system security.</rationale>
>   
>   <Rule id="perms_shadow_file">
>   <title>Verify Permissions on <tt>shadow</tt> File</title>
> -<description>File permissions for <tt>/etc/shadow</tt> should be set
> -to 0000.</description>
> +<description><fileperms-desc-macro file="/etc/shadow" perms="0000"/></description>
> +<ocil><fileperms-check-macro file="/etc/shadow" perms="----------"/></ocil>
>   <rationale>The <tt>/etc/shadow</tt> file contains the list of local
>   system accounts and stores password hashes. Protection of this file is
>   critical for system security. Failure to give ownership of this file
> @@ -58,8 +58,8 @@ which could weaken the system security posture.</rationale>
>   
>   <Rule id="userowner_group_file">
>   <title>Verify User Who Owns <tt>group</tt> File</title>
> -<description>The <tt>/etc/group</tt> file should be owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/group" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/group" owner="root"/></ocil>
>   <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
>   on the system. Protection of this file is important for system security.</rationale>
>   <ident cce="3276-3" />
> @@ -69,8 +69,8 @@ on the system. Protection of this file is important for system security.</ration
>   
>   <Rule id="groupowner_group_file">
>   <title>Verify Group Who Owns <tt>group</tt> File</title>
> -<description>The <tt>/etc/group</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/group" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/group" group="root"/></ocil>
>   <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
>   on the system. Protection of this file is important for system security.</rationale>
>   <ident cce="3883-6" />
> @@ -80,8 +80,8 @@ on the system. Protection of this file is important for system security.</ration
>   
>   <Rule id="perms_group_file">
>   <title>Verify Permissions on <tt>group</tt> File</title>
> -<description>File permissions for <tt>/etc/group</tt> should be set
> -correctly.</description>
> +<description><fileperms-desc-macro file="/etc/group" perms="644"/></description>
> +<ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil>
>   <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
>   on the system. Protection of this file is important for system security.</rationale>
>   <ident cce="3967-7" />
> @@ -91,8 +91,8 @@ on the system. Protection of this file is important for system security.</ration
>   
>   <Rule id="userowner_gshadow_file">
>   <title>Verify User Who Owns <tt>gshadow</tt> File</title>
> -<description>The <tt>/etc/gshadow</tt> file should be group-owned by
> -root.</description>
> +<description><fileowner-desc-macro file="/etc/gshadow" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/gshadow" owner="root"/></ocil>
>   <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
>   is critical for system security.</rationale>
>   <ident cce="4210-1" />
> @@ -102,8 +102,8 @@ is critical for system security.</rationale>
>   
>   <Rule id="groupowner_gshadow_file">
>   <title>Verify Group Who Owns <tt>gshadow</tt> File</title>
> -<description>The <tt>/etc/gshadow</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/gshadow" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/gshadow" group="root"/></ocil>
>   <rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
>   is critical for system security.</rationale>
>   <ident cce="4064-2" />
> @@ -113,8 +113,8 @@ is critical for system security.</rationale>
>   
>   <Rule id="perms_gshadow_file">
>   <title>Verify Permissions on <tt>gshadow</tt> File</title>
> -<description>File permissions for <tt>/etc/gshadow</tt> should be set
> -correctly.</description>
> +<description><fileperms-desc-macro file="/etc/gshadow" perms="0000"/></description>
> +<ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
>   <rationale>The /etc/gshadow file contains group password hashes. Protection of this file
>   is critical for system security.</rationale>
>   <ident cce="3932-1" />
> @@ -124,6 +124,8 @@ is critical for system security.</rationale>
>   
>   <Rule id="userowner_passwd_file">
>   <title>Verify User Who Owns <tt>passwd</tt> File</title>
> +<description><fileowner-desc-macro file="/etc/passwd" owner="root"/></description>
> +<ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil>
>   <description>The <tt>/etc/passwd</tt> file should be owned by
>   root.</description>
>   <rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on
> @@ -135,8 +137,8 @@ the system. Protection of this file is critical for system security.</rationale>
>   
>   <Rule id="groupowner_passwd_file">
>   <title>Verify Group Who Owns <tt>passwd</tt> File</title>
> -<description>The <tt>/etc/passwd</tt> file should be group-owned by
> -root.</description>
> +<description><filegroupowner-desc-macro file="/etc/passwd" group="root"/></description>
> +<ocil><filegroupowner-check-macro file="/etc/passwd" group="root"/></ocil>
>   <rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
>   the system. Protection of this file is critical for system security.</rationale>
>   <ident cce="3495-9" />
> @@ -146,8 +148,8 @@ the system. Protection of this file is critical for system security.</rationale>
>   
>   <Rule id="file_permissions_etc_passwd">
>   <title>Verify Permissions on <tt>passwd</tt> File</title>
> -<description>File permissions for <tt>/etc/passwd</tt> should be set
> -to 0644 or less permissive.</description>
> +<description><fileperms-desc-macro file="/etc/passwd" perms="0644"/></description>
> +<ocil><fileperms-check-macro file="/etc/passwd" perms="-rw-r--r--"/></ocil>
>   <rationale>If the <tt>/etc/passwd</tt> file is writable by a group-owner or the
>   world the risk of its compromise is increased. The file contains the list of
>   acounts on the system and associated information, and protection of this file
> @@ -184,6 +186,11 @@ Kernel modules, which can be added to the kernel during runtime, are
>   stored in <tt>/lib/modules</tt>. All files in these directories should not be
>   group-writable or world-writable.
>   </description>
> +<ocil>
> +To find shared libraries that are group-writable or world-writable,
> +run the following command for each directory <i>DIR</i> which contains shared libraries:
> +<pre>$ find <i>DIR</i> -perm /022</pre>
> +</ocil>
>   <rationale>Files from shared library directories are loaded into the address
>   space of processes (including privileged ones) or of the kernel itself at
>   runtime. Restrictive permissions are necessary to protect the integrity of the system.
> @@ -204,6 +211,11 @@ Kernel modules, which can be added to the kernel during runtime, are also
>   stored in <tt>/lib/modules</tt>.  All files in these directories should be
>   owned by the <tt>root</tt> user.
>   </description>
> +<ocil>
> +To find shared libraries that are not owned by <tt>root</tt>,
> +run the following command for each directory <i>DIR</i> which contains shared libraries:
> +<pre>$ find <i>DIR</i> \! -user root</pre>
> +</ocil>
>   <rationale>Files from shared library directories are loaded into the address
>   space of processes (including privileged ones) or of the kernel itself at
>   runtime. Proper ownership is necessary to protect the integrity of the system.
> @@ -223,6 +235,11 @@ System executables are stored in the following directories by default:
>   /usr/local/sbin</pre>
>   All files in these directories should not be group-writable or world-writable.
>   </description>
> +<ocil>
> +To find system executables that are group-writable or world-writable,
> +run the following command for each directory <i>DIR</i> which contains system executables:
> +<pre>$ find <i>DIR</i> -perm /022</pre>
> +</ocil>
>   <rationale>System binaries are executed by privileged users as well as system services,
>   and restrictive permissions are necessary to ensure that their
>   execution of these programs cannot be co-opted.
> @@ -241,6 +258,11 @@ System executables are stored in the following directories by default:
>   /usr/local/sbin</pre>
>   All files in these directories should be owned by the <tt>root</tt> user.
>   </description>
> +<ocil>
> +To find system executables that are not owned by <tt>root</tt>,
> +run the following command for each directory <i>DIR</i> which contains system executables:
> +<pre>$ find <i>DIR</i> \! -user root</pre>
> +</ocil>
>   <rationale>System binaries are executed by privileged users as well as system services,
>   and restrictive permissions are necessary to ensure that their
>   execution of these programs cannot be co-opted.
> @@ -261,7 +283,16 @@ there is no reason for a directory to be world-writable, a better
>   solution is to remove that permission rather than to set the sticky
>   bit. However, if a directory is used by a particular application,
>   consult that application's documentation instead of blindly
> -changing modes.</description>
> +changing modes.
> +<br/>
> +To set the sticky bit on a world-writable directory <i>DIR</i>, run the
> +following command:
> +<pre># chmod +t <i>DIR</i></pre>
> +</description>
> +<ocil>
> +To find world-writable directories that lack the sticky bit, run the following command:
> +<pre># find / -type d -perm -002 ! -perm -1000</pre>
> +</ocil>
>   <ident cce="3399-3" />
>   <oval id="dir_perms_world_writable_sticky_bits" />
>   <ref nist="CM-6"/>
> @@ -281,6 +312,10 @@ documentation for specific applications before making changes.
>   Also, monitor for recurring world-writable files, as these may be
>   symptoms of a misconfigured application or user
>   account.</description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
>   <ident cce="3795-2" />
>   <ref nist="CM-6"/>
>   </Rule>
> @@ -293,6 +328,10 @@ unauthorized SGID files is determine if any were not installed as part of an
>   RPM package, which is cryptographically verified. Investigate the origin
>   of any unpackaged SGID files.
>   </description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
>   <rationale>Executable files with the SGID permission run with the privileges of
>   the owner of the file. SGID files of uncertain provenance could allow for
>   unprivileged users to elevate privileges. The presence of these files should be
> @@ -310,6 +349,10 @@ unauthorized SGID files is determine if any were not installed as part of an
>   RPM package, which is cryptographically verified. Investigate the origin
>   of any unpackaged SUID files.
>   </description>
> +<ocil>
> +To find world-writable files, run the following command:
> +<pre># find / -type f -perm -002</pre>
> +</ocil>
>   <rationale>Executable files with the SUID permission run with the privileges of
>   the owner of the file. SUID files of uncertain provenance could allow for
>   unprivileged users to elevate privileges. The presence of these files should be
> @@ -322,16 +365,20 @@ strictly controlled on the system.</rationale>
>   
>   <Rule id="no_files_unowned_by_user">
>   <title>Ensure All Files Are Owned by a User</title>
> -<description>The following command will discover and print any
> -files on local partitions which do not belong to a valid user and a
> -valid group. Run it once for each local partition PART:
> -<pre># find PART -xdev \( -nouser -o -nogroup \) -print</pre>
> -If this command prints any results, investigate each reported file and
> -either assign it to an appropriate user and group or remove it.
> +<description>If any files are not owned by a user, then the
> +cause of their lack of ownership should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate user.
>   </description>
> +<ocil>
> +The following command will discover and print any
> +files on local partitions which do not belong to a valid user.
> +Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -nouser -print</pre>
> +</ocil>
>   <rationale>
>   Unowned files do not directly imply a security problem, but they are generally
> -a sign that something is wrong with some system process. They may
> +a sign that something is amiss. They may
>   be caused by an intruder, by incorrect software installation or
>   draft software removal, or by failure to remove all files belonging
>   to a deleted account. The files should be repaired so that they
> @@ -345,16 +392,20 @@ and the cause should be discovered and addressed.
>   
>   <Rule id="no_files_unowned_by_group">
>   <title>Ensure All Files Are Owned by a Group</title>
> -<description>The following command will discover and print any
> -files on local partitions which do not belong to a valid user and a
> -valid group. Run it once for each local partition PART:
> -<pre># find PART -xdev \( -nouser -o -nogroup \) -print</pre>
> -If this command prints any results, investigate each reported file and
> -either assign it to an appropriate user and group or remove it.
> +<description>If any files are not owned by a group, then the
> +cause of their lack of group-ownership should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate group.
>   </description>
> +<ocil>
> +The following command will discover and print any
> +files on local partitions which do not belong to a valid group.
> +Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -nogroup -print</pre>
> +</ocil>
>   <rationale>
>   Unowned files do not directly imply a security problem, but they are generally
> -a sign that something is wrong with some system process. They may
> +a sign that something is amiss. They may
>   be caused by an intruder, by incorrect software installation or
>   draft software removal, or by failure to remove all files belonging
>   to a deleted account. The files should be repaired so that they
> @@ -368,15 +419,19 @@ and the cause should be discovered and addressed.
>   
>   <Rule id="world_writable_files_system_ownership">
>   <title>Ensure All World-Writable Directories Are Owned by a System Account</title>
> -<description>Locate any directories in local partitions which are
> -world-writable and ensure that they are owned by root or another
> -system account. The following command will discover and print these
> -(assuming only system accounts have a uid lower than 500). Run it
> -once for each local partition PART:
> -<pre># find PART -xdev -type d -perm -0002 -uid +500 -print</pre>
> -If this command produces any output, investigate why the
> -current owner is not root or another system account.
> +<description>All directories in local partitions which are
> +world-writable should be owned by root or another
> +system account.  If any world-writable directories are not
> +owned by a system account, this should be investigated.
> +Following this, the files should be deleted or assigned to an
> +appropriate group.
>   </description>
> +<ocil>
> +The following command will discover and print world-writable directories that
> +are not owned by a system account, given the assumption that only system
> +accounts have a uid lower than 500.  Run it once for each local partition <i>PART</i>:
> +<pre># find <i>PART</i> -xdev -type d -perm -0002 -uid +500 -print</pre>
> +</ocil>
>   <rationale>
>   Allowing a user account to own a world-writeable directory is
>   undesirable because it allows the owner of that directory to remove
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 1565d5f..3d68315 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -84,18 +84,15 @@ and to protect the boot process.
>   
>   <Rule id="enable_selinux_bootloader">
>   <title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
> -<description>SELinux can be disabled at boot time by an argument
> -in <tt>/etc/grub.conf</tt>.
> -To ensure that SELinux is not disabled at boot time, ensure that <tt>selinux=0</tt> is not
> -found in the kernel arguments in that file.
> +<description>SELinux can be disabled at boot time by an argument in
> +<tt>/etc/grub.conf</tt>.
> +Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
> +file to prevent SELinux from being being disabled at boot.
>   </description>
>   <ocil>
> -Run the following command to determine if SELinux has been
> -disabled at boot time:
> -<pre># grep selinux=0 /etc/grub.conf</pre>
> -If it doesn't reurn a value, then it hasn't been disabled. ex:
> -<pre># grep selinux=0 /etc/grub.conf</pre>
> -<pre># &lt;---Flashing cursor</pre>
> +Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
> +in the kernel boot arguments.  Presences of <tt>selinux=0</tt> indicates
> +that SELinux is disabled at boot time.
>   </ocil>
>   <rationale>
>   Disabling a major host protection feature such as SELinux at boot time prevents
> @@ -109,13 +106,15 @@ the chances that it remain off during system operation.
>   
>   <Rule id="set_selinux_state">
>   <title>Ensure SELinux State is Enforcing</title>
> -<description>The SELinux state should be set to <tt>enforcing</tt> during
> -normal system operation.</description>
> -<ocil>To ensure the system is configured to boot into enforcing mode, add
> -or correct the following line in: <tt>/etc/selinux/config</tt> by ensuring the
> -following text is present: <tt>SELINUX=enforcing</tt>
> -<pre># grep "SELINUX=enforcing" /etc/selinux/config</pre>
> -If needed add the text to the file, and save it.</ocil>
> +<description>The SELinux state should be set to <tt>enforcing</tt> at
> +system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
> +line <tt>SELINUX=enforcing</tt> to configure the system to boot into enforcing
> +mode.
> +</description>
> +<ocil>
> +Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
> +<pre>SELINUX=enforcing</pre>
> +</ocil>
>   <rationale>
>   Setting the SELinux state to enforcing ensures that SELinux is able to confine
>   potentially compromised processes to the security policy, which is designed to
> @@ -135,13 +134,13 @@ To configure the system to use this policy, add or correct the following line
>   in <tt>/etc/selinux/config</tt>:
>   <pre>SELINUXTYPE=targeted</pre>
>   Other policies, such as <tt>mls</tt>, provide additional security labeling
> -and greater confinement.
> +and greater confinement but are not compatible with many general-purpose
> +use cases.
>   </description>
> -<ocil>To ensure the system is configured to boot into targeted mode, add
> -or correct the following line in: <tt>/etc/selinux/config</tt> by ensuring the
> -following text is present: <tt>SELINUX=targeted</tt>
> -<pre># grep "SELINUX=targeted" /etc/selinux/config</pre>
> -If needed add the text to the file, and save it.</ocil>
> +<ocil>
> +Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
> +<pre>SELINUXTYPE=targeted</pre>
> +</ocil>
>   <rationale>
>   Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
>   ensures that the system will confine processes that are likely to be

I didn't know you'd be working on any of this, so this will conflict 
with my patches & content, but ack since you pushed your patches out first.

Likely need to have a status call on content on who is working on what. 
It's clear we both spent several hours working on the same content, 
which was a gross duplication of effort.



More information about the scap-security-guide mailing list