[PATCH 7/7] ** UPDATED ** Test-Tags-added-to-input-system-accounts-restriction.patch
Shawn Wells
shawn at redhat.com
Sun Sep 30 17:59:58 UTC 2012
On 9/30/12 12:48 AM, Michael J. McConachie wrote:
>
> 0007-Test-Tags-added-to-input-system-accounts-restriction.patch
>
>
> From 0cbaf75f038cdd0154e9beb77bc2de050d85c97f Mon Sep 17 00:00:00 2001
> From: Michael McConachie<michael at redhat.com>
> Date: Sun, 30 Sep 2012 00:44:49 -0400
> Subject: [PATCH 7/7] Test Tags added to
> input/system/accounts/restrictions/root_logins.xml
>
> ---
> RHEL6/input/system/accounts/restrictions/root_logins.xml | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> index f54c7e0..1240972 100644
> --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
> +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
> @@ -130,6 +130,7 @@ become inaccessible.
> <ident cce="3987-5" />
> <oval id="accounts_nologin_for_system" />
> <ref nist="AC-3, CM-6" />
> +<tested by="MM" on="20120929"/>
> </Rule>
nein nein nein
- Description text says "first, do this..." but never says "and then, do
this other thing..." Language needs to be cleaned up.
- Current OCIL text tells the user to perform an action, vs validate a
setting. Arguably existing OCIL can be moved to <description> and new
OCIL created
> @@ -156,6 +157,7 @@ access to the root account.
> <ident cce="4009-7" />
> <oval id="accounts_no_uid_except_zero" />
> <ref nist="AC-3, AC-11, CM-6, CM-7" disa="366"/>
> +<tested by="MM" on="20120929"/>
> </Rule>
>
> </Group>
> -- 1.7.11.4
nack
- rational text gives an opinion that sudo is recommended. This belongs
better in the description text
- description text does not give instruction on how to check if anyone
else has UID 0
- grammar errors in the ocil clause text
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20120930/09cac174/attachment.html>
More information about the scap-security-guide
mailing list