[PATCH 2/2] added or modified check text, adding OCIL clauses where appropriate

David Smith dsmith at eclipse.ncsc.mil
Wed Sep 26 14:43:50 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/system/permissions/files.xml |   20 ++++++++++----------
 1 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 59f0a3a..e7cc860 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -186,7 +186,7 @@ Kernel modules, which can be added to the kernel during runtime, are
 stored in <tt>/lib/modules</tt>. All files in these directories should not be
 group-writable or world-writable.
 </description>
-<ocil>
+<ocil clause="there is output">
 To find shared libraries that are group-writable or world-writable,
 run the following command for each directory <i>DIR</i> which contains shared libraries:
 <pre>$ find <i>DIR</i> -perm /022</pre>
@@ -211,7 +211,7 @@ Kernel modules, which can be added to the kernel during runtime, are also
 stored in <tt>/lib/modules</tt>.  All files in these directories should be
 owned by the <tt>root</tt> user.
 </description>
-<ocil>
+<ocil clause="there is output">
 To find shared libraries that are not owned by <tt>root</tt>,
 run the following command for each directory <i>DIR</i> which contains shared libraries:
 <pre>$ find <i>DIR</i> \! -user root</pre>
@@ -235,7 +235,7 @@ System executables are stored in the following directories by default:
 /usr/local/sbin</pre>
 All files in these directories should not be group-writable or world-writable.
 </description>
-<ocil>
+<ocil clause="there is output">
 To find system executables that are group-writable or world-writable,
 run the following command for each directory <i>DIR</i> which contains system executables:
 <pre>$ find <i>DIR</i> -perm /022</pre>
@@ -258,7 +258,7 @@ System executables are stored in the following directories by default:
 /usr/local/sbin</pre>
 All files in these directories should be owned by the <tt>root</tt> user.
 </description>
-<ocil>
+<ocil clause="there is output">
 To find system executables that are not owned by <tt>root</tt>,
 run the following command for each directory <i>DIR</i> which contains system executables:
 <pre>$ find <i>DIR</i> \! -user root</pre>
@@ -289,7 +289,7 @@ To set the sticky bit on a world-writable directory <i>DIR</i>, run the
 following command:
 <pre># chmod +t <i>DIR</i></pre>
 </description>
-<ocil>
+<ocil clause="there is output">
 To find world-writable directories that lack the sticky bit, run the following command:
 <pre># find / -type d -perm -002 ! -perm -1000</pre>
 </ocil>
@@ -312,7 +312,7 @@ documentation for specific applications before making changes.
 Also, monitor for recurring world-writable files, as these may be
 symptoms of a misconfigured application or user
 account.</description>
-<ocil>
+<ocil clause="there is output">
 To find world-writable files, run the following command:
 <pre># find / -type f -perm -002</pre>
 </ocil>
@@ -328,7 +328,7 @@ unauthorized SGID files is determine if any were not installed as part of an
 RPM package, which is cryptographically verified. Investigate the origin
 of any unpackaged SGID files. 
 </description>
-<ocil>
+<ocil clause="there is output">
 To find world-writable files, run the following command:
 <pre># find / -type f -perm -002</pre>
 </ocil>
@@ -370,7 +370,7 @@ cause of their lack of ownership should be investigated.
 Following this, the files should be deleted or assigned to an
 appropriate user.
 </description>
-<ocil>
+<ocil clause="there is output">
 The following command will discover and print any
 files on local partitions which do not belong to a valid user.
 Run it once for each local partition <i>PART</i>:
@@ -397,7 +397,7 @@ cause of their lack of group-ownership should be investigated.
 Following this, the files should be deleted or assigned to an
 appropriate group.
 </description>
-<ocil>
+<ocil clause="there is output">
 The following command will discover and print any
 files on local partitions which do not belong to a valid group.
 Run it once for each local partition <i>PART</i>:
@@ -426,7 +426,7 @@ owned by a system account, this should be investigated.
 Following this, the files should be deleted or assigned to an
 appropriate group.
 </description>
-<ocil>
+<ocil clause="there is output">
 The following command will discover and print world-writable directories that
 are not owned by a system account, given the assumption that only system
 accounts have a uid lower than 500.  Run it once for each local partition <i>PART</i>:
-- 
1.7.1



More information about the scap-security-guide mailing list