[PATCH 17/17] Finished mappings through AC-*
Shawn Wells
shawn.d.wells at gmail.com
Tue Jan 1 17:06:20 UTC 2013
-------------- next part --------------
>From 8d7ae49d6632648f69199ffb0a79ef4824082046 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 1 Jan 2013 12:01:33 -0500
Subject: [PATCH 17/17] Finished mappings through AC-*
---
RHEL6/input/auxiliary/nist_support.xml | 7 ++---
RHEL6/input/profiles/nist-CL-IL-AL.xml | 28 +++++++++---------------
RHEL6/input/system/permissions/mounting.xml | 10 ++++----
RHEL6/input/system/permissions/partitions.xml | 7 ++---
4 files changed, 22 insertions(+), 30 deletions(-)
diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 4f9d1b7..2518823 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -14,7 +14,7 @@ automated means.</rational>
<description>This requirement is procedural, and can not be met
through automated means.</description>
</description>
-<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6)" \>
+<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5" \>
</Rule>
<Rule id="nist_not_OS_applicable">
@@ -22,7 +22,7 @@ through automated means.</description>
<rationale>This requirement is not applicable to an operating system.</rational>
<description>While this requirement is applicable at an information system level, implimentation
is not performed within the Operating System.</rational>
-<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5)" \>
+<ref nist="PM-11,PM-10,PM-9,PM-8,PM-7,PM-6,PM-5,PM-4,PM-3,PM-2,PM-1,AC-17(3),AC-18(a),AC-18(b),AC-18(5),AC-21(1)" \>
</Rule>
<Rule id="nist_met_inherently">
@@ -36,8 +36,7 @@ compliance. This is a permanent not a finding.
<description>
This requirement is permanent not a finding. No fix is required.
</description>
-<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4)" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4),AC-19(c),AC-19(f),AC-19(g)" \>
</Rule>
-
</Group>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e2d6634..49375ce 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -239,23 +239,17 @@ assurance."</description>
<select idref="service_bluetooth_disabled" selected="true" \>
<select idref="kernel_module_bluetooth_disabled" selected="true" \>
-<!-- AC-19
- AC-19(1)
- AC-19(2)
- AC-19(3)
- AC-19(4)
- AC-20
- AC-20(1)
- AC-20(2)
- AC-21
- AC-21(1)
- AC-22
- AT-1
- AT-2
- AT-3
- AT-3(2)
- AT-4
- AT-5
+<!-- AC-19(a), AC-19(d), AC-19(e) -->
+<select idref="mountopt_nodev_on_removable_partitions" selected="true" \>
+<select idref="mountopt_noexec_on_removable_partitions" selected="true" \>
+<select idref="mountopt_nosuid_on_removable_partitions" selected="true" \>
+<select idref="kernel_module_usb-storage_disabled" selected="true" \>
+<select idref="bootloader_nousb_argument" selected="true" \>
+<select idref="bios_disable_usb_boot" selected="true" \>
+<select idref="service_autofs_disabled" selected="true" \>
+<select idref="gconf_gnome_disable_automount" selected="true" \>
+
+<!-- REMAINING MAPPINGS
AU-1
AU-2
AU-2(3)
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 9e87286..7081f0f 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -75,7 +75,7 @@ software and other vulnerabilities. Support for these devices should be disabled
the devices themselves should be tightly controlled.</rationale>
<ident cce="27016-5" />
<oval id="kernel_module_usb-storage_disabled" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
</Rule>
<!-- Considering removal of this entirely, in favor of previous Rule
@@ -116,7 +116,7 @@ disable USB storage devices if they are plugged into the system. Support for the
should be disabled and the devices themselves should be tightly controlled.</rationale>
<ident cce="27011-6" />
<oval id="bootloader_nousb_argument" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
</Rule>
<Rule id="bios_disable_usb_boot">
@@ -131,7 +131,7 @@ any security measures offered by the native OS. Attackers could mount partitions
configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale>
<ident cce="26952-2" />
<!-- <oval id="bios_disable_usb_boot" /> -->
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
</Rule>
<Rule id="service_autofs_disabled">
@@ -159,7 +159,7 @@ should be explicitly listed in /etc/fstab by and administrator. New filesystems
not be arbitrarily introduced via the automounter.</rationale>
<ident cce="26976-1" />
<oval id="service_autofs_disabled" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
</Rule>
<Rule id="gconf_gnome_disable_automount">
@@ -188,7 +188,7 @@ DVDs.
</rationale>
<ident cce="27035-5" />
<oval id="gconf_gnome_disable_automount" />
-<ref nist="CM-6, CM-7" disa="1250,85" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-6,CM-7" disa="1250,85" />
</Rule>
<Rule id="disable_module_cramfs">
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 8333e8a..a6e9f52 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -48,7 +48,7 @@ not advised to set <tt>nodev</tt> on partitions which contain their root
filesystems. </rationale>
<ident cce="26860-7" />
<oval id="mount_option_nodev_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7, MP-2"/>
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/>
</Rule>
<Rule id="mountopt_noexec_on_removable_partitions">
@@ -71,7 +71,7 @@ The output should show <tt>noexec</tt> in use.
</ocil>
<ident cce="27196-5" />
<oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7,MP-2" disa="87" />
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2" disa="87" />
</Rule>
<!-- investigate: this is like obsoleted by gvfs/DeviceKit-based mounting now -->
@@ -89,7 +89,7 @@ should not be able to execute suid or sgid binaries from partitions mounted off
removable media.</rationale>
<ident cce="27056-1" />
<oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" />
-<ref nist="CM-7, MP-2"/>
+<ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/>
</Rule>
<Rule id="mount_option_tmp_nodev">
@@ -198,4 +198,3 @@ necessary to meet requirements, the storage location /var/tmp should be bind mou
</Rule>
</Group>
-
--
1.7.1
More information about the scap-security-guide
mailing list