[PATCH] [bugfix] Ticket Rule "disable_at" duplicate "service_atd_disabled"
Shawn Wells
shawn.d.wells at gmail.com
Sat Apr 20 06:48:53 UTC 2013
-------------- next part --------------
>From 3259031dd3c83a6088c339f1c6e5999f387c4636 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 20 Apr 2013 02:47:07 -0400
Subject: [PATCH] [bugfix] Ticket Rule "disable_at" duplicate "service_atd_disabled"
Services/base.xml held service_atd_disabled, while services/cron.xml held disable_atd.
Updated everything to use service_atd_disabled.
Thank you to ruchkinalexandr for reporting!
---
RHEL6/input/auxiliary/alt-titles-stig.xml | 3 ---
RHEL6/input/profiles/common.xml | 1 -
RHEL6/input/profiles/nist-CL-IL-AL.xml | 1 -
RHEL6/input/profiles/stig-rhel6-server.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL6/input/services/base.xml | 21 ---------------------
RHEL6/input/services/cron.xml | 22 +++++++++++++---------
7 files changed, 15 insertions(+), 37 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index d4a9cf0..6f4a59a 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -530,9 +530,6 @@ The sysstat service must not be running.
<title rule="enable_cron" shorttitle="Enable cron Service">
The cron service must be running.
</title>
-<title rule="disable_at" shorttitle="Disable atd Service">
-The atd service must be disabled.
-</title>
<title rule="sshd_allow_only_protocol2" shorttitle="Allow Only SSH Protocol 2">
The SSH daemon must be configured to use only the SSHv2 protocol.
</title>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 2a7565a..2a97ac7 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -161,7 +161,6 @@
<select idref="uninstall_tftp-server" selected="true"/>
<select idref="disable_tftp" selected="true"/>
<select idref="enable_cron" selected="true"/>
-<select idref="disable_at" selected="true"/>
<select idref="sshd_allow_only_protocol2" selected="true"/>
<select idref="sshd_set_idle_timeout" selected="true"/>
<select idref="sshd_set_keepalive" selected="true"/>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e092650..3abc947 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -350,7 +350,6 @@ assurance."</description>
<select idref="disable_avahi" selected="true" \>
<select idref="enable_cron" selected="true" \>
<select idref="disable_anacron" selected="true" \>
-<select idref="disable_at" selected="true" \>
<select idref="disable_dns_server" selected="true" \>
<select idref="uninstall_bind" selected="true" \>
<select idref="package_openldap-servers_removed" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 3650ffc..460143a 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -95,6 +95,6 @@
<!-- from inherited Rule, deny_password_attempts -->
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3"/>
-<select idref="disable_at" selected="false" />
+<select idref="service_atd_disabled" selected="false" />
</Profile>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index af95ac2..8d89f10 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -217,8 +217,8 @@
<select idref="enable_cron" selected="true" />
<select idref="disable_anacron" selected="true" />
<!-- PLACEHOLDER: cron file perms go here when ready -->
-<select idref="disable_at" selected="true" />
<select idref="sshd_allow_only_protocol2" selected="true" />
+<select idref="service_atd_disabled" selected="true" \>
<select idref="sshd_set_keepalive" selected="true" />
<select idref="sshd_set_idle_timeout" selected="true" />
<select idref="sshd_disable_rhosts" selected="true" />
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 3453e9a..9e86170 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -42,27 +42,6 @@ it is appropriate.</rationale>
<ref nist="CM-7" />
</Rule>
-<Rule id="service_atd_disabled">
-<title>Disable At Service (atd)</title>
-<description>The <tt>at</tt> and <tt>batch</tt> commands can be used to
-schedule tasks that are meant to be executed only once. This allows delayed
-execution in a manner similar to cron, except that it is not
-recurring. The daemon <tt>atd</tt> keeps track of tasks scheduled via
-<tt>at</tt> and <tt>batch</tt>, and executes them at the specified time.
-<service-disable-macro service="atd" />
-</description>
-<ocil><service-disable-check-macro service="atd" /></ocil>
-<rationale>
-The <tt>atd</tt> service could be used by an unsophisticated insider to carry
-out activities outside of a normal login session, which could complicate
-accountability. Furthermore, the need to schedule tasks with <tt>at</tt> or
-<tt>batch</tt> is not common.
-</rationale>
-<ident cce="27249-2" />
-<oval id="service_atd_disabled" />
-<ref nist="CM-7" disa="381" />
-</Rule>
-
<Rule id="service_certmonger_disabled">
<title>Disable Certmonger Service (certmonger)</title>
<description>Certmonger is a D-Bus based service that attempts to simplify interaction
diff --git a/RHEL6/input/services/cron.xml b/RHEL6/input/services/cron.xml
index 5972a7f..422d74d 100644
--- a/RHEL6/input/services/cron.xml
+++ b/RHEL6/input/services/cron.xml
@@ -111,21 +111,25 @@ access to these files should be disabled.</description>
-->
-
-<Rule id="disable_at">
-<title>Disable atd Service</title>
-<description>
+<Rule id="service_atd_disabled">
+<title>Disable At Service (atd)</title>
+<description>The <tt>at</tt> and <tt>batch</tt> commands can be used to
+schedule tasks that are meant to be executed only once. This allows delayed
+execution in a manner similar to cron, except that it is not
+recurring. The daemon <tt>atd</tt> keeps track of tasks scheduled via
+<tt>at</tt> and <tt>batch</tt>, and executes them at the specified time.
<service-disable-macro service="atd" />
</description>
<ocil><service-disable-check-macro service="atd" /></ocil>
<rationale>
-Many of the periodic or delayed execution features of the at
-daemon can be provided through the cron daemon instead.
+The <tt>atd</tt> service could be used by an unsophisticated insider to carry
+out activities outside of a normal login session, which could complicate
+accountability. Furthermore, the need to schedule tasks with <tt>at</tt> or
+<tt>batch</tt> is not common.
</rationale>
-<ident cce="26548-8" />
+<ident cce="27249-2" />
<oval id="service_atd_disabled" />
-<ref nist="CM-7" />
-<tested by="DS" on="20121024"/>
+<ref nist="CM-7" disa="381" />
</Rule>
<Group id="restrict_at_cron_users">
--
1.7.1
More information about the scap-security-guide
mailing list