[PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing

Maura Dailey maura at eclipse.ncsc.mil
Wed Aug 21 21:52:45 UTC 2013


On 08/21/2013 05:17 PM, Shawn Wells wrote:
> On 8/21/13 4:36 PM, Maura Dailey wrote:
>> One quick thing I forgot to add: this will give you false positives 
>> for bind mounted partitions, as I found out when I finally tracked a 
>> phantom non-existent /home partition (underneath an NFS mount in the 
>> same location) back to the sandbox service. /proc/mounts, which is 
>> where linux:partition_test apparently reads from, doesn't know or 
>> care which mounts are bind mounted. Additionally, the sandbox service 
>> runs mount directly, so there's no evidence of this particular type 
>> of bind mount in /etc/fstab either. 
>  Definitely don't want deployments getting dinged about this, have to 
> create a waiver, describe to their ISSO/ISSM, etc. Should the XCCDF be 
> updated to reflect this known false positive?
>

Unfortunately, the partition_test apparently reads directly from 
/proc/mounts, which doesn't list the bind option, so by itself, it's not 
equipped to solve this false positive. The only place the bind option 
will appear is in /etc/mtab or in /etc/fstab. In the case that had me 
stumped (the sandbox service runs the mount command at service start), 
nothing is going to be in /etc/fstab.

If we accept /etc/mtab as authoritative, I can rewrite the check using a 
textfilecontent54_test. There is a risk that an unmounted partition in 
/etc/fstab could escape detection, though. I haven't completely figured 
out how to solve that yet.

Either way, the existing check is busted, so it does have to be replaced.

- Maura Dailey


More information about the scap-security-guide mailing list