[PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED)

Shawn Wells shawn at redhat.com
Tue Aug 20 03:59:57 UTC 2013


On 8/19/13 6:07 PM, Beavers, Randall D. CTR (US) wrote:
> Willy Santos & Shawn Wells,
Willy's no longer with RHT :(

He may still be lurking on the list though.


> I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists.
> (searching CCI information online).
>
> I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs
> to DISA STIGS for my program.  Any help would be appreciated.  Seems the
> DISA IASE website and the VMS site doesn't jive.
>
> Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that
> would help me? In excel format?  In xml format?
>
> Please advise.


Various rules are mapped back to policies via the <ref> tags. Example is 
the selinux_unlabeled_device_files rule:
> |<Rule id="selinux_unlabeled_device_files">
> <title>Ensure No Device Files are Unlabeled by SELinux</title>
> <description>Device files, which are used for communication with important
> system resources, should be labeled with proper SELinux types. If any device
> files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
> correct the file's context.
> </description>
> <ocil clause="there is output">To check for unlabeled device files, run the following command:
> <pre># ls -RZ /dev | grep unlabeled_t</pre>
> It should produce no output in a well-configured system.</ocil>
> <rationale>
> If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
> cannot properly restrict access to the device file.
> </rationale>
> <ident cce="26774-0" />
> <oval id="selinux_all_devicefiles_labeled" />
> <ref nist="AC-6,AU-9,CM-7" disa="22,32"/>
> <tested by="DS" on="20121024"/>
> </Rule>|
(ref: 
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/system/selinux.xml)

Through this metadata we can associate CCE 26774-0 against the indicated 
NIST 800-53 rev3 and DISA CCI requirements.

This information is transformed via the 'make tables' transform, which 
generates CCI to SRG:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6-srgmap-flat.html

and CCI to NIST:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig-rhel6-server-flat.html

Do these help?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130819/d7013be2/attachment.html>


More information about the scap-security-guide mailing list