[PATCH 15/20] Mapped CM-3, CM-4, CM-5

Shawn Wells shawn.d.wells at gmail.com
Sat Jan 12 18:19:31 UTC 2013


-------------- next part --------------
>From 27f0a5f9f8e46435a0557a674ad08376093080ae Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 10 Jan 2013 09:20:22 -0500
Subject: [PATCH 15/20] Mapped CM-3, CM-4, CM-5
 Various procedural requirements

---
 RHEL6/input/auxiliary/nist_support.xml |    2 +-
 RHEL6/input/intro/intro.xml            |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml |   13 +++++--------
 3 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml
index 68ab786..b929fe3 100644
--- a/RHEL6/input/auxiliary/nist_support.xml
+++ b/RHEL6/input/auxiliary/nist_support.xml
@@ -14,7 +14,7 @@ automated means.</rational>
 <description>This requirement is procedural, and can not be met
 through automated means.</description>
 </description>
-<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AU-2(b),AU-2(3),AU-6(a),AU-6(b),AU-6(3),CA-1(a),CA-1(b),CA-2(a),CA-2(b),CA-2(c),CA-2(d),CA-2(1)CA-2(2),CA-3(a),CA-3(b),CA-3(c),CA-3(1),CA-3(2),CA-5(a),CA-5(b),CA-6(a),CA-6(b),CA-6(c),CA-7(a),CA-7(b),CA-7(c),CA-7(d),CA-7(1),CA-7(2),CM-1(a),CM-1(b),CM-2,CM-2(1)(a),CM-2(1)(b),CM-2(1)(c),CM-2(2),CM-2(5)(a),CM-2(5)(b),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5,AU-1(a)" \>
+<ref nist="AC-1,AC-2,AC-2(7)(a),AC-5,AC-6(1),AC-8(b),AC-11(b),AC-14,AC-17(a),AC-17(b),AC-17(4),AC-17(5),AC-17(6),AC-19(b),AC-19(1),AC-19(2),AC-19(3),AC-19(4)(a),AC-19(4)(b),AC-20(a),AC-20(b),AC-20(1)(a),AC-20(1)(b),AC-20(2),AC-21(a),AC-21(b),AC-22(a),AC-22(b),AC-22(c),AC-22(d),AC-22(e),AU-2(b),AU-2(3),AU-6(a),AU-6(b),AU-6(3),CA-1(a),CA-1(b),CA-2(a),CA-2(b),CA-2(c),CA-2(d),CA-2(1)CA-2(2),CA-3(a),CA-3(b),CA-3(c),CA-3(1),CA-3(2),CA-5(a),CA-5(b),CA-6(a),CA-6(b),CA-6(c),CA-7(a),CA-7(b),CA-7(c),CA-7(d),CA-7(1),CA-7(2),CM-1(a),CM-1(b),CM-2,CM-2(1)(a),CM-2(1)(b),CM-2(1)(c),CM-2(2),CM-2(5)(a),CM-2(5)(b),CM-3(a),CM-3(b),CM-3(c),CM-3(d),CM-3(e),CM-3(f),CM-3(4),CM-4,CM-4(2),CM-5,CM-5(2),CM-5(5)(b),AT-1(a),AT-1(b),AT-2,AT-3,AT-3(2),AT-4(a),AT-4(b),AT-5,AU-1(a)" \>
 </Rule>
 
 <Rule id="nist_not_OS_applicable">
diff --git a/RHEL6/input/intro/intro.xml b/RHEL6/input/intro/intro.xml
index eccd302..2694f29 100644
--- a/RHEL6/input/intro/intro.xml
+++ b/RHEL6/input/intro/intro.xml
@@ -94,7 +94,7 @@ least privilege: SELinux policy can confine software to perform only actions on
 system that are specifically allowed. This can be far more restrictive than the
 actions permissible by the traditional Unix permissions model.
 </description>
-<ref nist="AC-6,AC-6(5),AU-9(4)(a)" />
+<ref nist="AC-6,AC-6(5),AU-9(4)(a),CM-5(5)(a),CM-5(6)" />
 </Group>
 
 </Group>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e791cc4..e74ba27 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -270,15 +270,12 @@ assurance."</description>
 <select idref="ntpd_specify_multiple_servers" selected="true" \>
 
 
+<!-- CM-3
+     	At some point we should look at creating prose for this 
+     	requirement, and perhaps using audit+AIDE to track
+     	changes to relevant files -->
+
 <!-- REMAINING MAPPINGS
-     CM-3
-     CM-3(4)
-     CM-4
-     CM-4(2)
-     CM-5
-     CM-5(2)
-     CM-5(5)
-     CM-5(6)
      CM-6
      CM-6(3)
      CM-7
-- 
1.7.1



More information about the scap-security-guide mailing list