[PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing

Steve Grubb sgrubb at redhat.com
Thu Aug 22 19:31:50 UTC 2013


On Thursday, August 22, 2013 03:09:33 PM Maura Dailey wrote:
> > I might need to backtrack on this thread and see what's wrong. But
> > partition_test should have all mount options.
> 
> I tried the following unsuccessfully while troubleshooting how to detect
> a bind mount of /tmp on /var/tmp (another check):
> 
> First, I ran 'mount --bind /var/tmp /tmp
> 
> Then I tried this chunk of code in place of the
> mount_option_var_tmp_bind check:
>    <linux:partition_test id ="test_mount_option_var_tmp_bind"
> version="1" comment="Detect bind mount" check="all">
>      <linux:object object_ref="object_mount_option_var_tmp_bind" />
>    </linux:partition_test>
> 
>    <linux:partition_object id="object_mount_option_var_tmp_bind"
> version="1">
>      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
>    </linux:partition_object>
> 
> I wasn't even trying to search for mount options yet, just get a
> complete list of all mounts. The resulting OVAL that testcheck.py
> generated did NOT show any bind mount options for any mount point
> detected. /var/tmp, which I was trying to detect, was an exact duplicate
> of /tmp's own mount section (and an exact duplicate out the output of
> /proc/mounts, which is where I developed my suspicions about the source
> of its data). I'm using oscap 0.9.3.

I wrote a test program to see what's happening. It would appear that the 
"bind" option is being dropped inside the kernel and its not reflected in 
/proc/mounts. However, the information is available in statvfs. So, if we need 
the bind flag, and I suspect we do, we can add it to the mount options returned 
by getmntent_r(3) in openscap's partition probe.

Do we need the bind mount flag?

-Steve


More information about the scap-security-guide mailing list