[PATCH 08/20] Mapped AU-9

Shawn Wells shawn.d.wells at gmail.com
Sat Jan 12 18:18:56 UTC 2013


-------------- next part --------------
>From f9ae6d94385a32f4931d287c3555cf4418143d56 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 10 Jan 2013 08:24:11 -0500
Subject: [PATCH 08/20] Mapped AU-9

AU-9:   Secure file permissions of audit data. We already had the chmod/chown set, added selinux

AU-9(4)(a):     Calls for least priv. regarding access to audit data

AU-9(4)(b):     Protect non-local access data, which is native behavior
---
 RHEL6/input/auxiliary/nist_support.xml |    2 +-
 RHEL6/input/intro/intro.xml            |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml |    2 --
 RHEL6/input/system/selinux.xml         |   14 ++++++--------
 4 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 364b06a..563f514 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -36,7 +36,7 @@ compliance. This is a permanent not a finding.
 <description>
 This requirement is permanent not a finding. No fix is required.
 </description>
-<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4),AC-19(c),AC-19(f),AC-19(g),AU-3,AU-8" \>
+<ref nist="AC-3(4),AC-17(c),AC-17(d),AC-17(e),AC-18(b),AC-18(c),AC-18(4),AC-19(c),AC-19(f),AC-19(g),AU-3,AU-8,AU-9(4)(b)" \>
 </Rule>
 
 </Group>
diff --git a/RHEL6/input/intro/intro.xml b/RHEL6/input/intro/intro.xml
index 06abd93..eccd302 100644
--- a/RHEL6/input/intro/intro.xml
+++ b/RHEL6/input/intro/intro.xml
@@ -94,7 +94,7 @@ least privilege: SELinux policy can confine software to perform only actions on
 system that are specifically allowed. This can be far more restrictive than the
 actions permissible by the traditional Unix permissions model.
 </description>
-<ref nist="AC-6,AC-6(5)" />
+<ref nist="AC-6,AC-6(5),AU-9(4)(a)" />
 </Group>
 
 </Group>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index c865cac..e375c4b 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -271,8 +271,6 @@ assurance."</description>
 
 
 <!-- REMAINING MAPPINGS
-     AU-9
-     AU-9(4)
      AU-11
      AU-12
      CA-1
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 6b4c253..22b154f 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -99,7 +99,7 @@ the chances that it will remain off during system operation.
 </rationale>
 <ident cce="26956-3" />
 <oval id="selinux_bootloader_notdisabled" />
-<ref nist="AC-3,AC-6,CM-6" disa="22,32"/>
+<ref nist="AC-3,AC-6,AU-9,CM-6" disa="22,32"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -122,7 +122,7 @@ privileges.
 </rationale>
 <ident cce="26969-6" />
 <oval id="selinux_mode" value="var_selinux_state_name"/>
-<ref nist="AC-3,AC-4,AC-6,CM-6" disa="22,32,26"/>
+<ref nist="AC-3,AC-4,AC-6,AU-9,CM-6" disa="22,32,26"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -148,7 +148,7 @@ targeted for exploitation, such as network or system services.
 </rationale>
 <ident cce="26875-5" />
 <oval id="selinux_policytype" value="var_selinux_policy_name"/>
-<ref nist="AC-3,AC-4,AC-6,CM-6" disa="22,32"/>
+<ref nist="AC-3,AC-4,AC-6,AU-9,CM-6" disa="22,32"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 </Group>
@@ -167,10 +167,9 @@ file context is applied to files. This allows automatic correction
 of file contexts created by some programs.</rationale>
 <ident cce="26991-0" />
 <oval id="service_restorecond_enabled" />
-<ref nist="AC-3,AC-4,AC-6, CM-6" />
+<ref nist="AC-3,AC-4,AC-6,AU-9,CM-6" />
 </Rule>
 
-
 <!--
 <Group id="selinux_daemons">
 <title>Disable Unnecessary SELinux Daemons</title>
@@ -224,7 +223,7 @@ It should produce no output in a well-configured system.
 Daemons which run with the <tt>initrc_t</tt> context may cause AVC denials,
 or allow privileges that the daemon does not require.
 </rationale>
-<ref nist="AC-6, CM-6, CM-7" />
+<ref nist="AC-6,AU-9,CM-6,CM-7" />
 </Rule>
 
 <Rule id="selinux_unlabeled_device_files">
@@ -243,8 +242,7 @@ cannot properly restrict access to the device file.
 </rationale>
 <ident cce="26774-0" />
 <oval id="selinux_all_devicefiles_labeled" />
-<ref nist="AC-6, CM-6, CM-7" disa="22,32"/>
+<ref nist="AC-6,AU-9,CM-6,CM-7" disa="22,32"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 </Group>
-
-- 
1.7.1



More information about the scap-security-guide mailing list