[PATCH 09/17] Updated mappings for AC-6*

Shawn Wells shawn.d.wells at gmail.com
Tue Jan 1 17:05:32 UTC 2013


-------------- next part --------------
>From 9c7696de54380b2eb3982096fae8c1ab85704eef Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 25 Dec 2012 18:15:07 -0500
Subject: [PATCH 09/17] Updated mappings for AC-6*
 Updated serveral mappings for AC-6. A key distinction between AC-6 and CM-6/CM-7 is that
 AC-6 calls for least privilege -- e.g. file permissions -- whereas the later CM-* sections
 call out least functionality (e.g. only ssh can listen on port 22).

---
 RHEL6/input/intro/intro.xml                        |   15 +++---
 RHEL6/input/services/base.xml                      |    2 +-
 RHEL6/input/services/mail.xml                      |    5 +-
 RHEL6/input/services/ssh.xml                       |    2 +-
 RHEL6/input/system/accounts/physical.xml           |    2 +-
 .../system/accounts/restrictions/root_logins.xml   |    6 +-
 RHEL6/input/system/logging.xml                     |    4 +-
 RHEL6/input/system/permissions/execution.xml       |    2 +-
 RHEL6/input/system/permissions/files.xml           |   46 ++++++++++----------
 RHEL6/input/system/permissions/mounting.xml        |    4 +-
 RHEL6/input/system/permissions/partitions.xml      |    4 +-
 RHEL6/input/system/selinux.xml                     |    4 +-
 RHEL6/input/system/software/integrity.xml          |    2 +-
 13 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/RHEL6/input/intro/intro.xml b/RHEL6/input/intro/intro.xml
index 494eeec..c56249b 100644
--- a/RHEL6/input/intro/intro.xml
+++ b/RHEL6/input/intro/intro.xml
@@ -86,14 +86,15 @@ detection of problems.
 <title>Least Privilege</title>
 <description>
 Grant the least privilege necessary for user accounts and software to perform tasks.
-For example, do not allow users except those that need administrator access to use
-<tt>sudo</tt>. Another example is to limit logins on server systems to only those
-administrators who need to log into them in order to perform administration tasks.
-Using SELinux also follows the principle of least privilege: SELinux policy can
-confine software to perform only actions on the system that are specifically allowed.
-This can be far more restrictive than the actions permissible by the traditional
-Unix permissions model.
+For example, <tt>sudo</tt> can be implimented to limit authorization to super user
+accounts on the system only to designated personnel. Another example is to limit
+logins on server systems to only those administrators who need to log into them in
+order to perform administration tasks. Using SELinux also follows the principle of
+least privilege: SELinux policy can confine software to perform only actions on the
+system that are specifically allowed. This can be far more restrictive than the
+actions permissible by the traditional Unix permissions model.
 </description>
+<refs nist="AC-6,AC-6(5)" />
 </Group>
 
 </Group>
diff --git a/RHEL6/input/services/base.xml b/RHEL6/input/services/base.xml
index 6c040fa..ed12562 100644
--- a/RHEL6/input/services/base.xml
+++ b/RHEL6/input/services/base.xml
@@ -291,7 +291,7 @@ tasks by privileged programs, on behalf of unprivileged ones, has traditionally
 been a source of privilege escalation security issues.</rationale>
 <ident cce="TODO" />
 <oval id="service_oddjobd_disabled" />
-<ref nist="AC-6, CM-6, CM-7" disa="382" />
+<ref nist="CM-6, CM-7" disa="382" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index cd545b7..058aeda 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -117,7 +117,6 @@ privilege escalation or denial of service attacks which might compromise the mai
 steps to ensure that only system administrators are allowed shell access to the MTA host.
 </description>
 <!-- <ident cce="TODO:CCE" /> -->
-<ref nist="AC-6, SC-2" />
 </Group>
 
 <Group id="postfix_restrict_mail_spool_access">
@@ -155,7 +154,7 @@ Ensure log will be rotated as appropriate by adding or correcting the following
 </description>
 <!-- <ident cce="TODO:CCE" /> -->
 <oval id="postfix_logging" />
-<ref nist="AC-6, AU-2, AU-9" />
+<ref nist="AU-2, AU-9" />
 </Rule>
 
 <Group id="postfix_configure_ssl_certs">
@@ -214,7 +213,7 @@ correct permissions:
 </description>
 <!-- <ident cce="TODO:CCE" /> -->
 <oval id="postfix_certificate_files" />
-<ref nist="AC-6, SC-12, SC-13" />
+<ref nist="SC-12, SC-13" />
 </Rule>
 
 </Group><!--End <Group id="postfix_configure_ssl_certs"> -->
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 4455d05..ad56317 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -264,7 +264,7 @@ and also allows direct attack attempts on root's password.
 </rationale>
 <ident cce="27100-7" />
 <oval id="sshd_permitrootlogin_no" />
-<ref disa="770" />
+<ref nist="AC-6(2)" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 3ed7712..7f24565 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -130,7 +130,7 @@ by configuring the bootloader password.
 </rationale>
 <ident cce="27040-5" />
 <oval id="singleuser_password" />
-<ref nist="AC-6, IA-5" disa="213" />
+<ref nist="CM-7,IA-5" disa="213" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 3e12104..b8cdd06 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -59,7 +59,7 @@ using the root account.
 </rationale>
 <ident cce="26855-7" />
 <oval id="securetty_root_login_console_only" />
-<ref nist="CM-6, CM-7" disa="770" />
+<ref nist="AC-6(2),CM-6, CM-7" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -84,7 +84,7 @@ using the root account.
 </rationale>
 <ident cce="27047-0" />
 <oval id="securetty_no_serial" />
-<ref nist="AC-6" disa="770" />
+<ref nist="AC-6(2),CM-7" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -167,7 +167,7 @@ access to root privileges in an accountable manner.
 </rationale>
 <ident cce="26971-2" />
 <oval id="accounts_no_uid_except_zero" />
-<ref nist="AC-11, CM-6, CM-7" disa="366" />
+<ref nist="AC-6,AC-11, CM-6, CM-7" disa="366" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index a557e5a..f41ff5d 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -137,7 +137,7 @@ configuration, user authentication, and other such information. Log files should
 protected from unauthorized access.</rationale>
 <ident cce="26812-8" />
 <oval id="rsyslog_files_ownership" />
-<ref nist="CM-6" disa="1314"/>
+<ref nist="AC-6,CM-6" disa="1314"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -163,7 +163,7 @@ configuration, user authentication, and other such information. Log files should
 protected from unauthorized access.</rationale>
 <ident cce="26821-9" />
 <oval id="rsyslog_files_groupownership" />
-<ref nist="CM-6" disa="1314"/>
+<ref nist="AC-6,CM-6" disa="1314"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index e4e2a1b..a4cd357 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -47,7 +47,7 @@ process at run time.  An unnecessarily permissive umask could result in files
 being created with insecure permissions.</rationale>
 <ident cce="27031-4" />
 <oval id="umask_for_daemons" value="var_umask_for_daemons"/>
-<ref nist="CM-6"/>
+<ref nist="AC-6,CM-6"/>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index f614569..350ef7c 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -28,7 +28,7 @@ to root provides the designated owner with access to sensitive information
 which could weaken the system security posture.</rationale>
 <ident cce="26947-2" />
 <oval id="file_owner_etc_shadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -40,7 +40,7 @@ which could weaken the system security posture.</rationale>
 critical for system security.</rationale>
 <ident cce="26967-0" />
 <oval id="file_groupowner_etc_shadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -55,7 +55,7 @@ to root provides the designated owner with access to sensitive information
 which could weaken the system security posture.</rationale>
 <ident cce="26992-8" />
 <oval id="file_permissions_etc_shadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -67,7 +67,7 @@ which could weaken the system security posture.</rationale>
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="26822-7" />
 <oval id="file_owner_etc_group" />
-<ref nist="CM-6"/>
+<ref nist="AC-6,CM-6"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -79,7 +79,7 @@ on the system. Protection of this file is important for system security.</ration
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="26930-8" />
 <oval id="file_groupowner_etc_group" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -91,7 +91,7 @@ on the system. Protection of this file is important for system security.</ration
 on the system. Protection of this file is important for system security.</rationale>
 <ident cce="26954-8" />
 <oval id="file_permissions_etc_group" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -103,7 +103,7 @@ on the system. Protection of this file is important for system security.</ration
 is critical for system security.</rationale>
 <ident cce="27026-4" />
 <oval id="file_owner_etc_gshadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -115,7 +115,7 @@ is critical for system security.</rationale>
 is critical for system security.</rationale>
 <ident cce="26975-3" />
 <oval id="file_groupowner_etc_gshadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -127,7 +127,7 @@ is critical for system security.</rationale>
 is critical for system security.</rationale>
 <ident cce="26951-4" />
 <oval id="file_permissions_etc_gshadow" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -139,7 +139,7 @@ is critical for system security.</rationale>
 the system. Protection of this file is critical for system security.</rationale>
 <ident cce="26953-0" />
 <oval id="file_owner_etc_passwd" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -151,7 +151,7 @@ the system. Protection of this file is critical for system security.</rationale>
 the system. Protection of this file is critical for system security.</rationale>
 <ident cce="26856-5" />
 <oval id="file_groupowner_etc_passwd" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -165,7 +165,7 @@ accounts on the system and associated information, and protection of this file
 is critical for system security.</rationale>
 <ident cce="26868-0" />
 <oval id="file_permissions_etc_passwd" />
-<ref nist="CM-6" disa="225"/>
+<ref nist="AC-6,CM-6" disa="225"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
@@ -208,7 +208,7 @@ run the following command for each directory <i>DIR</i> which contains shared li
 space of processes (including privileged ones) or of the kernel itself at
 runtime. Restrictive permissions are necessary to protect the integrity of the system.
 </rationale>
-<ref disa="1499"/>
+<ref nist="AC-6" disa="1499"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -238,7 +238,7 @@ run the following command for each directory <i>DIR</i> which contains shared li
 space of processes (including privileged ones) or of the kernel itself at
 runtime. Proper ownership is necessary to protect the integrity of the system.
 </rationale>
-<ref disa="1499"/>
+<ref nist="AC-6" disa="1499"/>
 </Rule>
 
 
@@ -267,7 +267,7 @@ run the following command for each directory <i>DIR</i> which contains system ex
 and restrictive permissions are necessary to ensure execution of these programs
 cannot be co-opted.
 </rationale>
-<ref disa="1499"/>
+<ref nist="AC-6" disa="1499"/>
 </Rule>
 
 <Rule id="file_ownership_binary_dirs" severity="medium">
@@ -295,7 +295,7 @@ run the following command for each directory <i>DIR</i> which contains system ex
 and restrictive permissions are necessary to ensure that their
 execution of these programs cannot be co-opted.
 </rationale>
-<ref disa="1499"/>
+<ref nist="AC-6" disa="1499"/>
 </Rule>
 
 
@@ -332,7 +332,7 @@ and for directories requiring global read/write access.
 </rationale>
 <ident cce="26840-9" />
 <oval id="dir_perms_world_writable_sticky_bits" />
-<ref nist="CM-6"/>
+<ref nist="AC-6,CM-6"/>
 <tested by="swells" on="20120929"/>
 </Rule>
 
@@ -355,7 +355,7 @@ configured using a combination of user and group permissions to
 support whatever legitimate access is needed without the risk
 caused by world-writable files.</rationale>
 <ident cce="26910-0" />
-<ref nist="CM-6"/>
+<ref nist="AC-6,CM-6"/>
 </Rule>
 
 <Rule id="no_unpackaged_sgid_files">
@@ -376,7 +376,7 @@ unprivileged users to elevate privileges. The presence of these files should be
 strictly controlled on the system.</rationale>
 <ident cce="26769-0" />
 <oval id="file_permissions_unauthorized_sgid" />
-<ref nist="CM-6"/>
+<ref nist="CM-7,CM-6"/>
 </Rule>
 
 <Rule id="no_unpackaged_suid_files">
@@ -397,7 +397,7 @@ unprivileged users to elevate privileges. The presence of these files should be
 strictly controlled on the system.</rationale>
 <ident cce="26497-8" />
 <oval id="file_permissions_unauthorized_suid" />
-<ref nist="CM-6"/>
+<ref nist="CM-6,CM-7"/>
 </Rule>
 
 
@@ -425,7 +425,7 @@ and the cause should be discovered and addressed.
 </rationale>
 <ident cce="27032-2" />
 <oval id="file_permissions_unowned" />
-<ref nist="CM-6" disa="224"/>
+<ref nist="AC-6,CM-6" disa="224"/>
 </Rule>
 
 <Rule id="no_files_unowned_by_group">
@@ -452,7 +452,7 @@ and the cause should be discovered and addressed.
 </rationale>
 <ident cce="26872-2" />
 <oval id="file_permissions_ungroupowned" />
-<ref nist="CM-6" disa="224"/>
+<ref nist="AC-6,CM-6" disa="224"/>
 </Rule>
 
 <Rule id="world_writable_files_system_ownership">
@@ -478,7 +478,7 @@ users.
 </rationale>
 <ident cce="26642-9" />
 <oval id="dir_perms_world_writable_system_owned" />
-<ref nist="CM-6"/>
+<ref nist="AC-6,CM-6"/>
 <tested by="swells" on="20120929"/>
 </Rule>
 </Group>
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index c1b0618..9e87286 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -36,7 +36,7 @@ limited for non-root users. Review the man page for <tt>pam_console</tt> for
 more information</rationale>
 <ident cce="27192-4" />
 <oval id="console_device_restrict_access_desktop" />
-<ref nist="AC-6, CM-6, CM-7" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="console_device_restrict_access_server">
@@ -55,7 +55,7 @@ limited for non-root users. Review the man page for <tt>pam_console</tt> for
 more information</rationale>
 <ident cce="26892-0" />
 <oval id="console_device_restrict_access_server" />
-<ref nist="AC-6, CM-6, CM-7" />
+<ref nist="CM-6, CM-7" />
 </Rule>
 
 <Rule id="kernel_module_usb-storage_disabled">
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 10d4ea1..8333e8a 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -30,7 +30,7 @@ The only exception to this is chroot jails, for which it is not advised
 to set <tt>nodev</tt> on these filesystems.</rationale>
 <ident cce="27045-4" />
 <oval id="mount_option_nodev_nonroot_local_partitions" />
-<ref nist="CM-6, CM-7, AC-6"/>
+<ref nist="CM-6, CM-7"/>
 </Rule>
 
 <Rule id="mountopt_nodev_on_removable_partitions">
@@ -71,7 +71,7 @@ The output should show <tt>noexec</tt> in use.
 </ocil>
 <ident cce="27196-5" />
 <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7, MP-2" disa="87" />
+<ref nist="CM-7,MP-2" disa="87" />
 </Rule>
 
 <!-- investigate: this is like obsoleted by gvfs/DeviceKit-based mounting now -->
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index a409ae7..6b4c253 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -99,7 +99,7 @@ the chances that it will remain off during system operation.
 </rationale>
 <ident cce="26956-3" />
 <oval id="selinux_bootloader_notdisabled" />
-<ref nist="AC-3, CM-6" disa="22,32"/>
+<ref nist="AC-3,AC-6,CM-6" disa="22,32"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -148,7 +148,7 @@ targeted for exploitation, such as network or system services.
 </rationale>
 <ident cce="26875-5" />
 <oval id="selinux_policytype" value="var_selinux_policy_name"/>
-<ref nist="AC-4,CM-6" disa="22,32"/>
+<ref nist="AC-3,AC-4,AC-6,CM-6" disa="22,32"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 </Group>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index e1308f6..1258b0f 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -161,7 +161,7 @@ The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.</rationale>
 <ident cce="26731-0" />
 <oval id="rpm_verify_permissions" />
-<ref nist="CM-6" disa="1493,1494,1495" />
+<ref nist="AC-6,CM-6" disa="1493,1494,1495" />
 </Rule>
 
 <Rule id="rpm_verify_hashes">
-- 
1.7.1



More information about the scap-security-guide mailing list