[PATCH 30/31] Renamed enable_randomize_va_space to

Shawn Wells shawn at redhat.com
Fri Dec 27 23:29:13 UTC 2013


-------------- next part --------------
>From da1f850af8ef269e58fbf1534cfc0b9dba8b14d0 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 27 Dec 2013 04:11:35 -0500
Subject: [PATCH 30/31] Renamed enable_randomize_va_space to
 sysctl_kernel_randomize_va_space

- Updated XCCDF to reflect sysctl template
---
 RHEL/6/input/auxiliary/stig_overlay.xml       | 2 +-
 RHEL/6/input/profiles/CS2.xml                 | 2 +-
 RHEL/6/input/profiles/common.xml              | 2 +-
 RHEL/6/input/profiles/rht-ccp.xml             | 2 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml  | 2 +-
 RHEL/6/input/system/permissions/execution.xml | 2 +-
 RHEL/7/input/auxiliary/stig_overlay.xml       | 2 +-
 RHEL/7/input/profiles/rht-ccp.xml             | 8 +++++---
 RHEL/7/input/system/permissions/execution.xml | 2 +-
 9 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 0186138..c452f0e 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -236,7 +236,7 @@
 		<VMSinfo VKey="38593" SVKey="50394" VRelease="1" />
 		<title>The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_randomize_va_space" ownerid="RHEL-06-000078" disa="366" severity="medium">
+	<overlay owner="disastig" ruleid="sysctl_kernel_randomize_va_space" ownerid="RHEL-06-000078" disa="366" severity="medium">
 		<VMSinfo VKey="38596" SVKey="50397" VRelease="1" />
 		<title>The system must implement virtual address space randomization.</title>
 	</overlay>
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index ad0ee18..8221e00 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -70,7 +70,7 @@
 <refine-value idref="var_umask_for_daemons" selector="027"/>
 
 <select idref="disable_users_coredumps" selected="true"/>
-<select idref="enable_randomize_va_space" selected="true"/>
+<select idref="sysctl_kernel_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 <select idref="install_PAE_kernel_on_x86-32" selected="true" />
 <select idref="disable_prelink" selected="true" />
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index 07cfd51..e96823f 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -71,7 +71,7 @@
 <select idref="set_system_login_banner" selected="true"/>
 <!-- CURRENTLY NOT IMPLEMENTED <select idref="set_gui_login_banner" selected="true"/> -->
 
-<select idref="enable_randomize_va_space" selected="true"/>
+<select idref="sysctl_kernel_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 
 <select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml
index 69fbb25..505965a 100644
--- a/RHEL/6/input/profiles/rht-ccp.xml
+++ b/RHEL/6/input/profiles/rht-ccp.xml
@@ -90,7 +90,7 @@
 <select idref="bootloader_password" selected="true"/>
 
 <!-- KERNEL SETTINGS -->
-<select idref="enable_randomize_va_space" selected="true"/>
+<select idref="sysctl_kernel_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 <select idref="kernel_module_ipv6_option_disabled" selected="true"/>
 <select idref="service_ip6tables_enabled" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 403d14f..b5233ce 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -56,7 +56,7 @@
 <select idref="umask_for_daemons" selected="true" />
 <select idref="disable_setuid_coredumps" selected="true" />
 <select idref="disable_users_coredumps" selected="true" />
-<select idref="enable_randomize_va_space" selected="true" />
+<select idref="sysctl_kernel_randomize_va_space" selected="true" />
 <select idref="enable_execshield" selected="true" />
 <select idref="install_PAE_kernel_on_x86-32" selected="true" />
 <select idref="securetty_root_login_console_only" selected="true" /> <!-- slightly different language than rhel5 -->
diff --git a/RHEL/6/input/system/permissions/execution.xml b/RHEL/6/input/system/permissions/execution.xml
index 7e9043b..c381d1d 100644
--- a/RHEL/6/input/system/permissions/execution.xml
+++ b/RHEL/6/input/system/permissions/execution.xml
@@ -134,7 +134,7 @@ address range.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="enable_randomize_va_space" severity="medium">
+<Rule id="sysctl_kernel_randomize_va_space" severity="medium">
 <title>Enable Randomized Layout of Virtual Address Space</title>
 <description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="2" /></description>
 <ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="2" /></ocil>
diff --git a/RHEL/7/input/auxiliary/stig_overlay.xml b/RHEL/7/input/auxiliary/stig_overlay.xml
index 39180cb..7e36484 100644
--- a/RHEL/7/input/auxiliary/stig_overlay.xml
+++ b/RHEL/7/input/auxiliary/stig_overlay.xml
@@ -236,7 +236,7 @@
 		<VMSinfo VKey="38593" SVKey="50394" VRelease="1" />
 		<title>The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="enable_randomize_va_space" ownerid="RHEL-06-000078" disa="366" severity="medium">
+	<overlay owner="disastig" ruleid="sysctl_kernel_randomize_va_space" ownerid="RHEL-06-000078" disa="366" severity="medium">
 		<VMSinfo VKey="38596" SVKey="50397" VRelease="1" />
 		<title>The system must implement virtual address space randomization.</title>
 	</overlay>
diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml
index 9a58d05..6bb7698 100644
--- a/RHEL/7/input/profiles/rht-ccp.xml
+++ b/RHEL/7/input/profiles/rht-ccp.xml
@@ -82,14 +82,16 @@ FILE PERMISSION CHECKS
 <select idref="file_ownership_library_dirs" selected="true"/>
 <select idref="file_permissions_binary_dirs" selected="true"/>
 <select idref="file_ownership_binary_dirs" selected="true"/>
+<!-- these need to be updated 
+     for RHEL7
 <select idref="file_permissions_var_log_audit" selected="true"/>
 <select idref="user_owner_grub_conf" selected="true"/>
 <select idref="group_owner_grub_conf" selected="true"/>
 <select idref="permissions_grub_conf" selected="true"/>
-<select idref="bootloader_password" selected="true"/>
+<select idref="bootloader_password" selected="true"/> -->
 
-KERNEL SETTINGS
-<select idref="enable_randomize_va_space" selected="true"/>
+<!-- KERNEL SETTINGS
+<select idref="sysctl_kernel_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 <select idref="kernel_module_ipv6_option_disabled" selected="true"/>
 <select idref="service_ip6tables_enabled" selected="true"/>
diff --git a/RHEL/7/input/system/permissions/execution.xml b/RHEL/7/input/system/permissions/execution.xml
index f1c5198..32f6310 100644
--- a/RHEL/7/input/system/permissions/execution.xml
+++ b/RHEL/7/input/system/permissions/execution.xml
@@ -134,7 +134,7 @@ address range.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="enable_randomize_va_space" severity="medium">
+<Rule id="sysctl_kernel_randomize_va_space" severity="medium">
 <title>Enable Randomized Layout of Virtual Address Space</title>
 <description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="2" /></description>
 <ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="2" /></ocil>
-- 
1.8.3.1



More information about the scap-security-guide mailing list