[PATCH] OCIL clause tags added to 6 files in the /input dir

Michael McConachie michael at redhat.com
Tue Sep 25 20:09:59 UTC 2012


---
 RHEL6/input/services/obsolete.xml                             | 2 +-
 RHEL6/input/system/accounts/restrictions/password_storage.xml | 6 +++---
 RHEL6/input/system/accounts/restrictions/root_logins.xml      | 6 +++---
 RHEL6/input/system/selinux.xml                                | 8 ++++----
 RHEL6/input/system/software/disk_partitioning.xml             | 4 +---
 RHEL6/input/system/software/updating.xml                      | 8 ++++----
 6 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 9484265..eaf853c 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -182,7 +182,7 @@ location:
 <pre># rm /etc/hosts.equiv</pre>
 <pre>$ rm ~/.rhosts</pre>
 </description>
-<ocil>
+<ocil clause="these files exist">
 The existence of the file <tt>/etc/hosts.equiv</tt> or a file named
 <tt>.rhosts</tt> inside a user home directory indicates the presence
 of an Rsh trust relationship.
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index b030ad4..415bfd2 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -24,7 +24,7 @@ into the account without authentication. Remove any instances of the <tt>nullok<
 option in <tt>/etc/pam.d/system-auth-ac</tt> to
 prevent logins with empty passwords.
 </description>
-<ocil>
+<ocil clause="NULL passwords can be used">
 To verify that null passwords cannot be used, run the following command:
 <pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
 If this produces any output, it may be possible to log into accounts
@@ -49,7 +49,7 @@ instead of an <tt>x</tt>), the cause of this misconfiguration should be
 investigated.  The account should have its password reset and the hash should be
 properly stored, or the account should be deleted entirely.
 </description>
-<ocil>
+<ocil clause="any stored hashes are found in /etc/passwd">
 To check that no password hashes are stored in
 <tt>/etc/passwd</tt>, run the following command:
 <pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
@@ -74,7 +74,7 @@ directory. These files may contain unencrypted passwords to
 remote FTP servers making them susceptible to access by unauthorized
 users and should not be used.  Any <tt>.netrc</tt> files should be removed.
 </description>
-<ocil>
+<ocil clause="any .netrc files exist">
 To check the system for the existence of any <tt>.netrc</tt> files,
 run the following command:
 <pre># find / -name .netrc</pre>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index f08b702..fee9a54 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -47,7 +47,7 @@ vc/3
 vc/4</pre>
 <!-- TODO: discussion/description of virtual consoles-->
 </description>
-<ocil>To check for these entries from the command prompt, issue the
+<ocil clause="the user root hasn't been restricted from VCD's">To check for these entries from the command prompt, issue the
 following command:
 <pre># grep ^vc/[0-9] /etc/securetty</pre>
 If any values are returned, you need to remove them by manipulating the file.
@@ -73,7 +73,7 @@ ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
 ttyS1</pre>
 <!-- TODO: discussion/description of serial port -->
 </description>
-<ocil>To check for these entries from the command prompt,
+<ocil clause="the user root hasn't been restricted from Serial Ports">To check for these entries from the command prompt,
 issue the following command:
 <pre># grep ^ttyS/[0-9] /etc/securetty</pre>
 If any values are returned, you need to remove them by manipulating
@@ -109,7 +109,7 @@ than root.
 </description>
 <!--For each identified system account SYSACCT, lock the account:
 <pre># usermod -L SYSACCT</pre>-->
-<ocil>If any account <i>SYSACCT</i> has a login shell,
+<ocil clause="any SYSACCTs have a login shell">If any account <i>SYSACCT</i> has a login shell,
 disable it with the command:
 <pre># usermod -s /sbin/nologin SYSACCT</pre>
 The RHEL6 default is <tt>/sbin/nologin</tt>, but any command which will
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 3d68315..b2c660d 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -89,7 +89,7 @@ and to protect the boot process.
 Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
 file to prevent SELinux from being being disabled at boot.
 </description>
-<ocil>
+<ocil clause="SELinux is Disabled at boot time">
 Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
 in the kernel boot arguments.  Presences of <tt>selinux=0</tt> indicates
 that SELinux is disabled at boot time.
@@ -111,7 +111,7 @@ system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
 line <tt>SELINUX=enforcing</tt> to configure the system to boot into enforcing
 mode.
 </description>
-<ocil>
+<ocil clause="SELINUX=enforcing is not set properly">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
 <pre>SELINUX=enforcing</pre>
 </ocil>
@@ -137,7 +137,7 @@ Other policies, such as <tt>mls</tt>, provide additional security labeling
 and greater confinement but are not compatible with many general-purpose
 use cases.
 </description>
-<ocil>
+<ocil clause="SELINUX=targeted is not set properly">
 Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
 <pre>SELINUXTYPE=targeted</pre>
 </ocil>
@@ -232,7 +232,7 @@ or allow privileges that the daemon does not require.
 <description>Device files are used for communication with important system resources.
 SELinux contexts should exist for these.  By checking for <tt>unlabeled_t</tt> file
 contexts, we can determine if the system is optimally configured.</description>
-<ocil>To check for unlabeled device files, run the following command in
+<ocil clause="unlabeled_t file contexts exist">To check for unlabeled device files, run the following command in
 the directory that you want to check the SELinux contexts:
 <pre># ls -Z | grep unlabeled_t</pre>
 It should produce no output in a well-configured system.</ocil>
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index 1c4d260..e678d61 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -31,9 +31,7 @@ The <tt>/tmp</tt> directory is a world-writable directory used
 for temporary file storage. Ensure that it has its own partition or
 logical volume at installation time, or migrate it using LVM.
 </description>
-<ocil clause="no line is returned">
-<partition-check-macro part="/tmp"/>
-</ocil>
+<ocil><partition-check-macro part="/tmp"/></ocil>
 <rationale>
 The <tt>/tmp</tt> partition is used as temporary storage by many programs.
 Placing <tt>/tmp</tt> in its own partition enables the setting of more
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index 99b6520..0ec2f32 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -28,7 +28,7 @@ Run the following command to install the Red Hat GPG key, of which Red Hat
 uses to sign. To ensure that the GPG Key is isntalled, run:
 <pre># rhn_register</pre>
 </description>
-<ocil>To ensure that the GPG Key is isntalled, run:
+<ocil clause="the Red Hat GPG Key isn't installed">To ensure that the GPG Key is isntalled, run:
 <pre>$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey</pre>
 The command should return the string:
 <pre>gpg(Red Hat, Inc. (release key &lt;security at redhat.com&gt;)</pre>
@@ -54,7 +54,7 @@ them, ensure that the following line appears in <tt>/etc/yum.conf</tt> in
 the <tt>[main]</tt> section:
 <pre>gpgcheck=1</pre>
 </description>
-<ocil>
+<ocil clause="GPG checking isn't enabled">
 To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
 inspect <tt>/etc/yum.conf</tt> and ensure that the following appears in the
 <tt>[main]</tt> section:
@@ -79,7 +79,7 @@ protects against malicious tampering.
 any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
 <pre>gpgcheck=0</pre>
 </description>
-<ocil>
+<ocil clause="GPG checking is disabled">
 To determine whether <tt>yum</tt> has been configured to disable
 <tt>gpgcheck</tt> for any repos,  inspect all files in
 <tt>/etc/yum.repos.d</tt> and ensure that the following does not appear in any
@@ -105,7 +105,7 @@ need to be updated:
 To actually install these updates, run:
 <pre># yum update</pre>
 </description>
-<ocil>
+<ocil clause="Updates are not installed">
 After running the update command, invoking the update command again can be used
 to determine success of the updates. If nothing is returned, the update was
 successful.
-- 
1.7.11.4


--qMm9M+Fa2AknHoGS--


More information about the scap-security-guide mailing list