[PATCH 01/25] partition_for_* --> shared/oval/ - Moved
Shawn Wells
shawn at redhat.com
Sat Dec 14 01:57:34 UTC 2013
-------------- next part --------------
>From 0ee4bb5a628ce88e717146b4831039747bd86cf7 Mon Sep 17 00:00:00 2001
From: shawn <shawn at localhost.localdomain>
Date: Sun, 22 Dec 2013 14:31:38 -0500
Subject: [PATCH 01/25] partition_for_* --> shared/oval/ - Moved
partition_for_* checks to shared/oval/ - Tested on RHEL7, added platform tag
- Removed RHEL7 gconf OVAL (as they're not tested yet) - Symlinked
partition_for_* back to appropriate RHEL6 and RHEL7 directories
Signed-off-by: Shawn Wells <shawn at redhat.com>
---
:100644 120000 2081d18... 24da73c... T RHEL/6/input/checks/partition_for_home.xml
:100644 120000 9c28c13... 1d91875... T RHEL/6/input/checks/partition_for_tmp.xml
:100644 120000 2ed1d38... 760145b... T RHEL/6/input/checks/partition_for_var.xml
:100644 120000 94d235b... f19e088... T RHEL/6/input/checks/partition_for_var_log.xml
:100644 120000 b7a7d68... dc91923... T RHEL/6/input/checks/partition_for_var_log_audit.xml
:100644 000000 f78fc89... 0000000... D RHEL/7/input/checks/gconf_gnome_disable_automount.xml
:100644 000000 80045a3... 0000000... D RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml
:100644 000000 0d012a7... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
:100644 000000 c77e608... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml
:100644 000000 cc031fc... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml
:100644 000000 8229d71... 0000000... D RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml
:100644 120000 55b25d0... 24da73c... T RHEL/7/input/checks/partition_for_home.xml
:100644 120000 2438ac7... 1d91875... T RHEL/7/input/checks/partition_for_tmp.xml
:100644 120000 db883eb... 760145b... T RHEL/7/input/checks/partition_for_var.xml
:100644 120000 f0d2f30... f19e088... T RHEL/7/input/checks/partition_for_var_log.xml
:100644 120000 a9e7f37... dc91923... T RHEL/7/input/checks/partition_for_var_log_audit.xml
:000000 100644 0000000... eb50e33... A shared/oval/partition_for_home.xml
:000000 100644 0000000... 83b482a... A shared/oval/partition_for_tmp.xml
:000000 100644 0000000... d86610b... A shared/oval/partition_for_var.xml
:000000 100644 0000000... 06cfffa... A shared/oval/partition_for_var_log.xml
:000000 100644 0000000... ffe3092... A shared/oval/partition_for_var_log_audit.xml
RHEL/6/input/checks/partition_for_home.xml | 27 +------------
RHEL/6/input/checks/partition_for_tmp.xml | 25 +-----------
RHEL/6/input/checks/partition_for_var.xml | 27 +------------
RHEL/6/input/checks/partition_for_var_log.xml | 24 +----------
.../6/input/checks/partition_for_var_log_audit.xml | 28 +------------
.../input/checks/gconf_gnome_disable_automount.xml | 46 ----------------------
.../checks/gconf_gnome_disable_thumbnailers.xml | 32 ---------------
...f_gnome_screensaver_idle_activation_enabled.xml | 30 --------------
.../checks/gconf_gnome_screensaver_idle_delay.xml | 34 ----------------
.../gconf_gnome_screensaver_lock_enabled.xml | 29 --------------
.../checks/gconf_gnome_screensaver_mode_blank.xml | 29 --------------
RHEL/7/input/checks/partition_for_home.xml | 26 +-----------
RHEL/7/input/checks/partition_for_tmp.xml | 24 +----------
RHEL/7/input/checks/partition_for_var.xml | 26 +-----------
RHEL/7/input/checks/partition_for_var_log.xml | 23 +----------
.../7/input/checks/partition_for_var_log_audit.xml | 27 +------------
shared/oval/partition_for_home.xml | 28 +++++++++++++
shared/oval/partition_for_tmp.xml | 26 ++++++++++++
shared/oval/partition_for_var.xml | 27 +++++++++++++
shared/oval/partition_for_var_log.xml | 25 ++++++++++++
shared/oval/partition_for_var_log_audit.xml | 29 ++++++++++++++
21 files changed, 145 insertions(+), 447 deletions(-)
diff --git a/RHEL/6/input/checks/partition_for_home.xml b/RHEL/6/input/checks/partition_for_home.xml
deleted file mode 100644
index 2081d18..0000000
--- a/RHEL/6/input/checks/partition_for_home.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_home" version="1">
- <metadata>
- <title>Ensure /home Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If user home directories will be stored locally, create a
- separate partition for /home. If /home will be mounted from another
- system such as an NFS server, then creating a separate partition is not
- necessary at this time, and the mountpoint can instead be configured
- later.</description>
- <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion test_ref="test_home_partition" comment="/home on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_home_partition" version="1" comment="/home on own partition">
- <linux:object object_ref="object_mount_home_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_home_own_partition" version="1">
- <linux:mount_point>/home</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/6/input/checks/partition_for_home.xml b/RHEL/6/input/checks/partition_for_home.xml
new file mode 120000
index 0000000..24da73c
--- /dev/null
+++ b/RHEL/6/input/checks/partition_for_home.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_home.xml
\ No newline at end of file
diff --git a/RHEL/6/input/checks/partition_for_tmp.xml b/RHEL/6/input/checks/partition_for_tmp.xml
deleted file mode 100644
index 9c28c13..0000000
--- a/RHEL/6/input/checks/partition_for_tmp.xml
+++ /dev/null
@@ -1,24 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_tmp" version="1">
- <metadata>
- <title>Ensure /tmp Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The /tmp directory is a world-writable directory used for
- temporary file storage. Verify that it has its own partition or logical
- volume.</description>
- <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion test_ref="test_tmp_partition" comment="/tmp on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_tmp_partition" version="1" comment="/tmp on own partition">
- <linux:object object_ref="object_own_tmp_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_own_tmp_partition" version="1">
- <linux:mount_point>/tmp</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/6/input/checks/partition_for_tmp.xml b/RHEL/6/input/checks/partition_for_tmp.xml
new file mode 120000
index 0000000..1d91875
--- /dev/null
+++ b/RHEL/6/input/checks/partition_for_tmp.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_tmp.xml
\ No newline at end of file
diff --git a/RHEL/6/input/checks/partition_for_var.xml b/RHEL/6/input/checks/partition_for_var.xml
deleted file mode 100644
index 2ed1d38..0000000
--- a/RHEL/6/input/checks/partition_for_var.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var" version="1">
- <metadata>
- <title>Ensure /var Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Ensuring that /var is mounted on its own partition enables
- the setting of more restrictive mount options, which is used as temporary
- storage by many program, particularly system services such as daemons. It
- is not uncommon for the /var directory to contain world-writable
- directories, installed by other software packages.</description>
- <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion test_ref="test_var_partition" comment="/var on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_partition" version="1" comment="/var on own partition">
- <linux:object object_ref="object_mount_var_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_own_partition" version="1">
- <linux:mount_point>/var</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/6/input/checks/partition_for_var.xml b/RHEL/6/input/checks/partition_for_var.xml
new file mode 120000
index 0000000..760145b
--- /dev/null
+++ b/RHEL/6/input/checks/partition_for_var.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var.xml
\ No newline at end of file
diff --git a/RHEL/6/input/checks/partition_for_var_log.xml b/RHEL/6/input/checks/partition_for_var_log.xml
deleted file mode 100644
index 94d235b..0000000
--- a/RHEL/6/input/checks/partition_for_var_log.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var_log" version="1">
- <metadata>
- <title>Ensure /var/log Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>System logs are stored in the /var/log directory. Ensure
- that it has its own partition or logical volume.</description>
- <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion test_ref="test_var_log_partition" comment="/var/log on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_log_partition" version="1" comment="/var/log on own partition">
- <linux:object object_ref="object_mount_var_log_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_log_own_partition" version="1">
- <linux:mount_point>/var/log</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/6/input/checks/partition_for_var_log.xml b/RHEL/6/input/checks/partition_for_var_log.xml
new file mode 120000
index 0000000..f19e088
--- /dev/null
+++ b/RHEL/6/input/checks/partition_for_var_log.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var_log.xml
\ No newline at end of file
diff --git a/RHEL/6/input/checks/partition_for_var_log_audit.xml b/RHEL/6/input/checks/partition_for_var_log_audit.xml
deleted file mode 100644
index b7a7d68..0000000
--- a/RHEL/6/input/checks/partition_for_var_log_audit.xml
+++ /dev/null
@@ -1,27 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var_log_audit" version="1">
- <metadata>
- <title>Ensure /var/log/audit Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Audit logs are stored in the /var/log/audit directory.
- Ensure that it has its own partition or logical volume. Make absolutely
- certain that it is large enough to store all audit logs that will be
- created by the auditing daemon.</description>
- <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion test_ref="test_var_log_audit_partition" comment="/var/log/audit on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_log_audit_partition" version="1"
- comment="check for /var/log/audit partition">
- <linux:object object_ref="object_mount_var_log_audit_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_log_audit_own_partition"
- version="1">
- <linux:mount_point>/var/log/audit</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/6/input/checks/partition_for_var_log_audit.xml b/RHEL/6/input/checks/partition_for_var_log_audit.xml
new file mode 120000
index 0000000..dc91923
--- /dev/null
+++ b/RHEL/6/input/checks/partition_for_var_log_audit.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var_log_audit.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/gconf_gnome_disable_automount.xml b/RHEL/7/input/checks/gconf_gnome_disable_automount.xml
deleted file mode 100644
index f78fc89..0000000
--- a/RHEL/7/input/checks/gconf_gnome_disable_automount.xml
+++ /dev/null
@@ -1,46 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_disable_automount" version="1">
- <metadata>
- <title>Disable GNOME Automounting</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The system's default desktop environment, GNOME, will mount
- devices and removable media (such as DVDs, CDs and USB flash drives)
- whenever they are inserted into the system. Disable automount and autorun
- within GNOME.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" />
- <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all" check_existence="all_exist"
- comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount"
- version="1">
- <ind:object object_ref="obj_gconf_gnome_disable_automount" />
- <ind:state state_ref="state_gconf_gnome_disable_automount" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1">
- <ind:value_of datatype="string">false</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_test check="all" check_existence="all_exist"
- comment="Disable autorun in GNOME"
- id="test_gconf_gnome_disable_automount_autorun" version="1">
- <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" />
- <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
-</def-group>
diff --git a/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml
deleted file mode 100644
index 80045a3..0000000
--- a/RHEL/7/input/checks/gconf_gnome_disable_thumbnailers.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1">
- <metadata>
- <title>Disable All GNOME Thumbnailers</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The system's default desktop environment, GNOME, uses a
- number of different thumbnailer programs to generate thumbnails for any
- new or modified content in an opened folder. Disable the execution of
- these thumbnail applications within GNOME.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all" check_existence="all_exist"
- comment="Disable thumbnailers in GNOME"
- id="test_gconf_gnome_disable_thumbnailers" version="1">
- <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" />
- <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
-</def-group>
diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
deleted file mode 100644
index 0d012a7..0000000
--- a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_screensaver_idle_activation_enabled" version="1">
- <metadata>
- <title>Implement idle activation of screen saver</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Idle activation of the screen saver should be
- enabled.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1">
- <ind:object object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_gnome_screensaver_idle_activated" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
-</def-group>
diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml
deleted file mode 100644
index c77e608..0000000
--- a/RHEL/7/input/checks/gconf_gnome_screensaver_idle_delay.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_screensaver_idle_delay" version="1">
- <metadata>
- <title>Configure GUI Screen Locking</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The allowed period of inactivity before the screensaver is
- activated.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all"
- comment="test screensaver timeout period"
- id="test_gnome_screensaver_idle_delay" version="1">
- <ind:object object_ref="object_gnome_screensaver_idle_delay" />
- <ind:state state_ref="state_gnome_screensaver_idle_delay" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_state comment="idle timeout"
- id="state_gnome_screensaver_idle_delay" version="1">
- <ind:value_of datatype="int" operation="less than or equal" var_check="all"
- var_ref="inactivity_timeout_value" />
- </ind:xmlfilecontent_state>
- <external_variable comment="inactivity timeout variable" datatype="int"
- id="inactivity_timeout_value" version="1" />
-</def-group>
diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml
deleted file mode 100644
index cc031fc..0000000
--- a/RHEL/7/input/checks/gconf_gnome_screensaver_lock_enabled.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_screensaver_lock_enabled" version="1">
- <metadata>
- <title>Implement idle activation of screen lock</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Idle activation of the screen lock should be
- enabled.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled"
- id="test_screensaver_lock_enabled" version="1">
- <ind:object object_ref="object_screensaver_lock_enabled" />
- <ind:state state_ref="state_screensaver_lock_enabled" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
-</def-group>
diff --git a/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml
deleted file mode 100644
index 8229d71..0000000
--- a/RHEL/7/input/checks/gconf_gnome_screensaver_mode_blank.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<def-group>
- <definition class="compliance" id="gconf_gnome_screensaver_mode_blank" version="1">
- <metadata>
- <title>Implement blank screen saver</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The screen saver should be blank.</description>
- <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
- </metadata>
- <criteria operator="OR">
- <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
- <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" />
- </criteria>
- </definition>
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver set to blank screen"
- id="test_gnome_screensaver_mode" version="1">
- <ind:object object_ref="object_gnome_screensaver_mode" />
- <ind:state state_ref="state_gnome_screensaver_mode" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_gnome_screensaver_mode" version="1">
- <ind:value_of datatype="string">blank-only</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1">
- <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
- <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
- </ind:xmlfilecontent_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_home.xml b/RHEL/7/input/checks/partition_for_home.xml
deleted file mode 100644
index 55b25d0..0000000
--- a/RHEL/7/input/checks/partition_for_home.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_home" version="1">
- <metadata>
- <title>Ensure /home Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 7</platform>
- </affected>
- <description>If user home directories will be stored locally, create a
- separate partition for /home. If /home will be mounted from another
- system such as an NFS server, then creating a separate partition is not
- necessary at this time, and the mountpoint can instead be configured
- later.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_home_partition" comment="/home on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_home_partition" version="1" comment="/home on own partition">
- <linux:object object_ref="object_mount_home_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_home_own_partition" version="1">
- <linux:mount_point>/home</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_home.xml b/RHEL/7/input/checks/partition_for_home.xml
new file mode 120000
index 0000000..24da73c
--- /dev/null
+++ b/RHEL/7/input/checks/partition_for_home.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_home.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/partition_for_tmp.xml b/RHEL/7/input/checks/partition_for_tmp.xml
deleted file mode 100644
index 2438ac7..0000000
--- a/RHEL/7/input/checks/partition_for_tmp.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_tmp" version="1">
- <metadata>
- <title>Ensure /tmp Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 7</platform>
- </affected>
- <description>The /tmp directory is a world-writable directory used for
- temporary file storage. Verify that it has its own partition or logical
- volume.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_tmp_partition" comment="/tmp on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_tmp_partition" version="1" comment="/tmp on own partition">
- <linux:object object_ref="object_own_tmp_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_own_tmp_partition" version="1">
- <linux:mount_point>/tmp</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_tmp.xml b/RHEL/7/input/checks/partition_for_tmp.xml
new file mode 120000
index 0000000..1d91875
--- /dev/null
+++ b/RHEL/7/input/checks/partition_for_tmp.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_tmp.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/partition_for_var.xml b/RHEL/7/input/checks/partition_for_var.xml
deleted file mode 100644
index db883eb..0000000
--- a/RHEL/7/input/checks/partition_for_var.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var" version="1">
- <metadata>
- <title>Ensure /var Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 7</platform>
- </affected>
- <description>Ensuring that /var is mounted on its own partition enables
- the setting of more restrictive mount options, which is used as temporary
- storage by many program, particularly system services such as daemons. It
- is not uncommon for the /var directory to contain world-writable
- directories, installed by other software packages.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_var_partition" comment="/var on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_partition" version="1" comment="/var on own partition">
- <linux:object object_ref="object_mount_var_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_own_partition" version="1">
- <linux:mount_point>/var</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_var.xml b/RHEL/7/input/checks/partition_for_var.xml
new file mode 120000
index 0000000..760145b
--- /dev/null
+++ b/RHEL/7/input/checks/partition_for_var.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/partition_for_var_log.xml b/RHEL/7/input/checks/partition_for_var_log.xml
deleted file mode 100644
index f0d2f30..0000000
--- a/RHEL/7/input/checks/partition_for_var_log.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var_log" version="1">
- <metadata>
- <title>Ensure /var/log Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 7</platform>
- </affected>
- <description>System logs are stored in the /var/log directory. Ensure
- that it has its own partition or logical volume.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_var_log_partition" comment="/var/log on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_log_partition" version="1" comment="/var/log on own partition">
- <linux:object object_ref="object_mount_var_log_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_log_own_partition" version="1">
- <linux:mount_point>/var/log</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_var_log.xml b/RHEL/7/input/checks/partition_for_var_log.xml
new file mode 120000
index 0000000..f19e088
--- /dev/null
+++ b/RHEL/7/input/checks/partition_for_var_log.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var_log.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/partition_for_var_log_audit.xml b/RHEL/7/input/checks/partition_for_var_log_audit.xml
deleted file mode 100644
index a9e7f37..0000000
--- a/RHEL/7/input/checks/partition_for_var_log_audit.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<def-group>
- <definition class="compliance" id="partition_for_var_log_audit" version="1">
- <metadata>
- <title>Ensure /var/log/audit Located On Separate Partition</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 7</platform>
- </affected>
- <description>Audit logs are stored in the /var/log/audit directory.
- Ensure that it has its own partition or logical volume. Make absolutely
- certain that it is large enough to store all audit logs that will be
- created by the auditing daemon.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_var_log_audit_partition" comment="/var/log/audit on own partition" />
- </criteria>
- </definition>
- <linux:partition_test check="all" check_existence="all_exist"
- id="test_var_log_audit_partition" version="1"
- comment="check for /var/log/audit partition">
- <linux:object object_ref="object_mount_var_log_audit_own_partition" />
- </linux:partition_test>
- <linux:partition_object id="object_mount_var_log_audit_own_partition"
- version="1">
- <linux:mount_point>/var/log/audit</linux:mount_point>
- </linux:partition_object>
-</def-group>
diff --git a/RHEL/7/input/checks/partition_for_var_log_audit.xml b/RHEL/7/input/checks/partition_for_var_log_audit.xml
new file mode 120000
index 0000000..dc91923
--- /dev/null
+++ b/RHEL/7/input/checks/partition_for_var_log_audit.xml
@@ -0,0 +1 @@
+../../../../shared/oval/partition_for_var_log_audit.xml
\ No newline at end of file
diff --git a/shared/oval/partition_for_home.xml b/shared/oval/partition_for_home.xml
new file mode 100644
index 0000000..eb50e33
--- /dev/null
+++ b/shared/oval/partition_for_home.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <definition class="compliance" id="partition_for_home" version="1">
+ <metadata>
+ <title>Ensure /home Located On Separate Partition</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ <platform>Red Hat Enterprise Linux 7</platform>
+ </affected>
+ <description>If user home directories will be stored locally, create a
+ separate partition for /home. If /home will be mounted from another
+ system such as an NFS server, then creating a separate partition is not
+ necessary at this time, and the mountpoint can instead be configured
+ later.</description>
+ <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
+ <!-- RHEL7: <reference source="SDW" ref_id="20131222" ref_url="test_attestation" /> -->
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_home_partition" comment="/home on own partition" />
+ </criteria>
+ </definition>
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_home_partition" version="1" comment="/home on own partition">
+ <linux:object object_ref="object_mount_home_own_partition" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_home_own_partition" version="1">
+ <linux:mount_point>/home</linux:mount_point>
+ </linux:partition_object>
+</def-group>
diff --git a/shared/oval/partition_for_tmp.xml b/shared/oval/partition_for_tmp.xml
new file mode 100644
index 0000000..83b482a
--- /dev/null
+++ b/shared/oval/partition_for_tmp.xml
@@ -0,0 +1,26 @@
+<def-group>
+ <definition class="compliance" id="partition_for_tmp" version="1">
+ <metadata>
+ <title>Ensure /tmp Located On Separate Partition</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ <platform>Red Hat Enterprise Linux 7</platform>
+ </affected>
+ <description>The /tmp directory is a world-writable directory used for
+ temporary file storage. Verify that it has its own partition or logical
+ volume.</description>
+ <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
+ <!-- RHEL7: <reference source="SDW" ref_id="20131222" ref_url="test_attestation" /> -->
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_tmp_partition" comment="/tmp on own partition" />
+ </criteria>
+ </definition>
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_tmp_partition" version="1" comment="/tmp on own partition">
+ <linux:object object_ref="object_own_tmp_partition" />
+ </linux:partition_test>
+ <linux:partition_object id="object_own_tmp_partition" version="1">
+ <linux:mount_point>/tmp</linux:mount_point>
+ </linux:partition_object>
+</def-group>
diff --git a/shared/oval/partition_for_var.xml b/shared/oval/partition_for_var.xml
new file mode 100644
index 0000000..d86610b
--- /dev/null
+++ b/shared/oval/partition_for_var.xml
@@ -0,0 +1,27 @@
+<def-group>
+ <definition class="compliance" id="partition_for_var" version="1">
+ <metadata>
+ <title>Ensure /var Located On Separate Partition</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 7</platform>
+ </affected>
+ <description>Ensuring that /var is mounted on its own partition enables
+ the setting of more restrictive mount options, which is used as temporary
+ storage by many program, particularly system services such as daemons. It
+ is not uncommon for the /var directory to contain world-writable
+ directories, installed by other software packages.</description>
+ <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
+ <!-- RHEL7: <reference source="SDW" ref_id="20131222" ref_url="test_attestation" /> -->
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_var_partition" comment="/var on own partition" />
+ </criteria>
+ </definition>
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_var_partition" version="1" comment="/var on own partition">
+ <linux:object object_ref="object_mount_var_own_partition" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_var_own_partition" version="1">
+ <linux:mount_point>/var</linux:mount_point>
+ </linux:partition_object>
+</def-group>
diff --git a/shared/oval/partition_for_var_log.xml b/shared/oval/partition_for_var_log.xml
new file mode 100644
index 0000000..06cfffa
--- /dev/null
+++ b/shared/oval/partition_for_var_log.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="partition_for_var_log" version="1">
+ <metadata>
+ <title>Ensure /var/log Located On Separate Partition</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ <platform>Red Hat Enterprise Linux 7</platform>
+ </affected>
+ <description>System logs are stored in the /var/log directory. Ensure
+ that it has its own partition or logical volume.</description>
+ <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
+ <!-- RHEL7: <reference source="SDW" ref_id="20131222" ref_url="test_attestation" /> -->
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_var_log_partition" comment="/var/log on own partition" />
+ </criteria>
+ </definition>
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_var_log_partition" version="1" comment="/var/log on own partition">
+ <linux:object object_ref="object_mount_var_log_own_partition" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_var_log_own_partition" version="1">
+ <linux:mount_point>/var/log</linux:mount_point>
+ </linux:partition_object>
+</def-group>
diff --git a/shared/oval/partition_for_var_log_audit.xml b/shared/oval/partition_for_var_log_audit.xml
new file mode 100644
index 0000000..ffe3092
--- /dev/null
+++ b/shared/oval/partition_for_var_log_audit.xml
@@ -0,0 +1,29 @@
+<def-group>
+ <definition class="compliance" id="partition_for_var_log_audit" version="1">
+ <metadata>
+ <title>Ensure /var/log/audit Located On Separate Partition</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ <platform>Red Hat Enterprise Linux 7</platform>
+ </affected>
+ <description>Audit logs are stored in the /var/log/audit directory.
+ Ensure that it has its own partition or logical volume. Make absolutely
+ certain that it is large enough to store all audit logs that will be
+ created by the auditing daemon.</description>
+ <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
+ <!-- RHEL7: <reference source="SDW" ref_id="20131222" ref_url="test_attestation" /> -->
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_var_log_audit_partition" comment="/var/log/audit on own partition" />
+ </criteria>
+ </definition>
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_var_log_audit_partition" version="1"
+ comment="check for /var/log/audit partition">
+ <linux:object object_ref="object_mount_var_log_audit_own_partition" />
+ </linux:partition_test>
+ <linux:partition_object id="object_mount_var_log_audit_own_partition"
+ version="1">
+ <linux:mount_point>/var/log/audit</linux:mount_point>
+ </linux:partition_object>
+</def-group>
--
1.8.3.1
More information about the scap-security-guide
mailing list