[PATCH 17/17] Finished mappings through AC-*

Shawn Wells shawn.d.wells at gmail.com
Tue Jan 1 17:06:20 UTC 2013


-------------- next part --------------
>From 8d7ae49d6632648f69199ffb0a79ef4824082046 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 1 Jan 2013 12:01:33 -0500
Subject: [PATCH 17/17] Finished mappings through AC-*

---
 RHEL6/input/auxiliary/nist_support.xml        |    7 ++---
 RHEL6/input/profiles/nist-CL-IL-AL.xml        |   28 +++++++++---------------
 RHEL6/input/system/permissions/mounting.xml   |   10 ++++----
 RHEL6/input/system/permissions/partitions.xml |    7 ++---
 4 files changed, 22 insertions(+), 30 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 4f9d1b7..2518823 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -14,7 +14,7 @@ automated means.</rational>
 <description>This requirement is procedural, and can not be met
 through automated means.</description>
 </description>
-<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6)" \>
+<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5" \>
 </Rule>
 
 <Rule id="nist_not_OS_applicable">
@@ -22,7 +22,7 @@ through automated means.</description>
 <rationale>This requirement is not applicable to an operating system.</rational>
 <description>While this requirement is applicable at an information system level, implimentation
 is not performed within the Operating System.</rational>
-<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5)" \>
+<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5),AC-21(1)" \>
 </Rule>
 
 <Rule id="nist_met_inherently">
@@ -36,8 +36,7 @@ compliance. This is a permanent not a finding.
 <description>
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4)" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4),AC-19(c),AC-19(f),AC-19(g)" \>
 </Rule>
 
-
 </Group>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e2d6634..49375ce 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -239,23 +239,17 @@ assurance."</description>
 <select idref="service_bluetooth_disabled" selected="true" \>
 <select idref="kernel_module_bluetooth_disabled" selected="true" \>
 
-<!--     AC-19
-     AC-19(1)
-     AC-19(2)
-     AC-19(3)
-     AC-19(4)
-     AC-20
-     AC-20(1)
-     AC-20(2)    
-     AC-21
-     AC-21(1)
-     AC-22
-     AT-1
-     AT-2
-     AT-3
-     AT-3(2)
-     AT-4
-     AT-5
+<!-- AC-19(a), AC-19(d), AC-19(e) -->
+<select idref="mountopt_nodev_on_removable_partitions" selected="true" \>
+<select idref="mountopt_noexec_on_removable_partitions" selected="true" \>
+<select idref="mountopt_nosuid_on_removable_partitions" selected="true" \>
+<select idref="kernel_module_usb-storage_disabled" selected="true" \>
+<select idref="bootloader_nousb_argument" selected="true" \>
+<select idref="bios_disable_usb_boot" selected="true" \>
+<select idref="service_autofs_disabled" selected="true" \>
+<select idref="gconf_gnome_disable_automount" selected="true" \>
+
+<!-- REMAINING MAPPINGS
      AU-1
      AU-2
      AU-2(3)
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 9e87286..7081f0f 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -75,7 +75,7 @@ software and other vulnerabilities. Support for these devices should be disabled
 the devices themselves should be tightly controlled.</rationale>
 <ident cce="27016-5" />
 <oval id="kernel_module_usb-storage_disabled" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
 </Rule>
 <!-- Considering removal of this entirely, in favor of previous Rule
 
@@ -116,7 +116,7 @@ disable USB storage devices if they are plugged into the system. Support for the
 should be disabled and the devices themselves should be tightly controlled.</rationale>
 <ident cce="27011-6" />
 <oval id="bootloader_nousb_argument" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
 </Rule>
 
 <Rule id="bios_disable_usb_boot">
@@ -131,7 +131,7 @@ any security measures offered by the native OS. Attackers could mount partitions
 configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale>
 <ident cce="26952-2" />
 <!-- <oval id="bios_disable_usb_boot" /> -->
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
 </Rule>
 
 <Rule id="service_autofs_disabled">
@@ -159,7 +159,7 @@ should be explicitly listed in /etc/fstab by and administrator. New filesystems
 not be arbitrarily introduced via the automounter.</rationale>
 <ident cce="26976-1" />
 <oval id="service_autofs_disabled" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
 </Rule>
 
 <Rule id="gconf_gnome_disable_automount">
@@ -188,7 +188,7 @@ DVDs.
 </rationale>
 <ident cce="27035-5" />
 <oval id="gconf_gnome_disable_automount" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
 </Rule>
 
 <Rule id="disable_module_cramfs">
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 8333e8a..a6e9f52 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -48,7 +48,7 @@ not advised to set <tt>nodev</tt> on partitions which contain their root
 filesystems.  </rationale>
 <ident cce="26860-7" />
 <oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7, MP-2"/>
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/>
 </Rule>
 
 <Rule id="mountopt_noexec_on_removable_partitions">
@@ -71,7 +71,7 @@ The output should show <tt>noexec</tt> in use.
 </ocil>
 <ident cce="27196-5" />
 <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7,MP-2" disa="87" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2" disa="87" />
 </Rule>
 
 <!-- investigate: this is like obsoleted by gvfs/DeviceKit-based mounting now -->
@@ -89,7 +89,7 @@ should not be able to execute suid or sgid binaries from partitions mounted off
 removable media.</rationale>
 <ident cce="27056-1" />
 <oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7, MP-2"/>
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/>
 </Rule>
 
 <Rule id="mount_option_tmp_nodev">
@@ -198,4 +198,3 @@ necessary to meet requirements, the storage location /var/tmp should be bind mou
 </Rule>
 
 </Group>
-
-- 
1.7.1



More information about the scap-security-guide mailing list