[PATCH 16/17] Added mappings for AC-18*, disablement of wireless capabilities

Shawn Wells shawn.d.wells at gmail.com
Tue Jan 1 17:06:14 UTC 2013


-------------- next part --------------
>From 40a87f8adb7d5c9b828cd98b9dc56bcd6f32f883 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 29 Dec 2012 05:45:12 -0500
Subject: [PATCH 16/17] Added mappings for AC-18*, disablement of wireless capabilities
 Updated granularity of existing mappings

---
 RHEL6/input/auxiliary/nist_support.xml  |    7 ++++---
 RHEL6/input/profiles/nist-CL-IL-AL.xml  |   15 +++++++--------
 RHEL6/input/system/network/wireless.xml |   10 ++++------
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index cdbc751..4f9d1b7 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -20,8 +20,9 @@ through automated means.</description>
 <Rule id="nist_not_OS_applicable">
 <title>Not Applicable to Operating System</title>
 <rationale>This requirement is not applicable to an operating system.</rational>
-<description>This requirement is not applicable to an operating system.</rational>
-<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3)" \>
+<description>While this requirement is applicable at an information system level, implimentation
+is not performed within the Operating System.</rational>
+<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5)" \>
 </Rule>
 
 <Rule id="nist_met_inherently">
@@ -35,7 +36,7 @@ compliance. This is a permanent not a finding.
 <description>
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e)" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4)" \>
 </Rule>
 
 
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 5127db4..e2d6634 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -233,14 +233,13 @@ assurance."</description>
 <select idref="service_saslauthd_disabled" selected="true" \>
 <select idref="sshd_allow_only_protocol2" selected="true" \>
 
- AC-18
-
-     AC-18(1)
-     AC-18(2)
-     AC-18(3)
-     AC-18(4)
-     AC-18(5)
-     AC-19
+<!-- AC-18(a) -->
+<select idref="wireless_disable_in_bios" selected="true" \>
+<select idref="deactivate_wireless_interfaces" selected="true" \>
+<select idref="service_bluetooth_disabled" selected="true" \>
+<select idref="kernel_module_bluetooth_disabled" selected="true" \>
+
+<!--     AC-19
      AC-19(1)
      AC-19(2)
      AC-19(3)
diff --git a/RHEL6/input/system/network/wireless.xml b/RHEL6/input/system/network/wireless.xml
index fb07f39..166b9ad 100644
--- a/RHEL6/input/system/network/wireless.xml
+++ b/RHEL6/input/system/network/wireless.xml
@@ -35,7 +35,7 @@ to reboot the system first.
 </rationale>
 <ident cce="26878-9" />
 <!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
-<ref nist="CM-7" disa="85" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
 </Rule>
 
 <Rule id="deactivate_wireless_interfaces">
@@ -65,7 +65,7 @@ protocols which were not designed with security in mind.
 </rationale>
 <ident cce="27057-9" />
 <oval id="wireless_disable_interfaces" />
-<ref nist="CM-7" disa="85" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
 <tested by="DS" on="20121025"/>
 </Rule>
 <!--
@@ -100,7 +100,7 @@ Nevertheless, variation in this risk decision may be expected due to the
 utility of Bluetooth connectivity and its limited range.</rationale>
 <ident cce="27081-9" />
 <oval id="service_bluetooth_disabled" />
-<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-6,CM-7" disa="85,1551" />
 <tested by="DS" on="20121025"/>
 </Rule>
 
@@ -122,11 +122,9 @@ from loading the kernel module provides an additional safeguard against its
 activation.</rationale>
 <ident cce="26763-3" />
 <oval id="kernel_module_bluetooth_disabled" />
-<ref nist="AC-18, CM-6, CM-7" disa="85,1551" />
+<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-6,CM-7" disa="85,1551" />
 <tested by="DS" on="20121025"/>
 </Rule>
 
-
-
 </Group><!--<Group id="wireless_software">-->
 </Group><!--<Group id="network-wireless">-->
-- 
1.7.1



More information about the scap-security-guide mailing list