[PATCH 16/17] Added mappings for AC-18*, disablement of wireless capabilities
Shawn Wells
shawn.d.wells at gmail.com
Tue Jan 1 17:06:14 UTC 2013
-------------- next part --------------
>From 40a87f8adb7d5c9b828cd98b9dc56bcd6f32f883 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 29 Dec 2012 05:45:12 -0500
Subject: [PATCH 16/17] Added mappings for AC-18*, disablement of wireless capabilities
Updated granularity of existing mappings
---
RHEL6/input/auxiliary/nist_support.xml | 7 ++++---
RHEL6/input/profiles/nist-CL-IL-AL.xml | 15 +++++++--------
RHEL6/input/system/network/wireless.xml | 10 ++++------
3 files changed, 15 insertions(+), 17 deletions(-)
diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index cdbc751..4f9d1b7 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -20,8 +20,9 @@ through automated means.</description>
<Rule id="nist_not_OS_applicable">
<title>Not Applicable to Operating System</title>
<rationale>This requirement is not applicable to an operating system.</rational>
-<description>This requirement is not applicable to an operating system.</rational>
-<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3)" \>
+<description>While this requirement is applicable at an information system level, implimentation
+is not performed within the Operating System.</rational>
+<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5)" \>
</Rule>
<Rule id="nist_met_inherently">
@@ -35,7 +36,7 @@ compliance. This is a permanent not a finding.
<description>
This requirement is permanent not a finding. No fix is required.
</description>
-<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e)" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4)" \>
</Rule>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 5127db4..e2d6634 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -233,14 +233,13 @@ assurance."</description>
<select idref="service_saslauthd_disabled" selected="true" \>
<select idref="sshd_allow_only_protocol2" selected="true" \>
- AC-18
-
- AC-18(1)
- AC-18(2)
- AC-18(3)
- AC-18(4)
- AC-18(5)
- AC-19
+<!-- AC-18(a) -->
+<select idref="wireless_disable_in_bios" selected="true" \>
+<select idref="deactivate_wireless_interfaces" selected="true" \>
+<select idref="service_bluetooth_disabled" selected="true" \>
+<select idref="kernel_module_bluetooth_disabled" selected="true" \>
+
+<!-- AC-19
AC-19(1)
AC-19(2)
AC-19(3)
diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
index fb07f39..166b9ad 100644
--- a/RHEL6/input/system/network/wireless.xml
+++ b/RHEL6/input/system/network/wireless.xml
@@ -35,7 +35,7 @@ to reboot the system first.
</rationale>
<ident cce="26878-9" />
<!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
-<ref nist="CM-7" disa="85" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
</Rule>
<Rule id="deactivate_wireless_interfaces">
@@ -65,7 +65,7 @@ protocols which were not designed with security in mind.
</rationale>
<ident cce="27057-9" />
<oval id="wireless_disable_interfaces" />
-<ref nist="CM-7" disa="85" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
<tested by="DS" on="20121025"/>
</Rule>
<!--
@@ -100,7 +100,7 @@ Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range.</rationale>
<ident cce="27081-9" />
<oval id="service_bluetooth_disabled" />
-<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-6,CM-7" disa="85,1551" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -122,11 +122,9 @@ from loading the kernel module provides an additional safeguard against its
activation.</rationale>
<ident cce="26763-3" />
<oval id="kernel_module_bluetooth_disabled" />
-<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-6,CM-7" disa="85,1551" />
<tested by="DS" on="20121025"/>
</Rule>
-
-
</Group><!--<Group id="wireless_software">-->
</Group><!--<Group id="network-wireless">-->
--
1.7.1
More information about the scap-security-guide
mailing list