[PATCH 1/2] copy editing
David Smith
dsmith at eclipse.ncsc.mil
Fri Jan 18 13:16:20 UTC 2013
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
.../accounts/restrictions/password_storage.xml | 4 ++--
RHEL6/input/system/permissions/files.xml | 6 +++---
RHEL6/input/system/permissions/mounting.xml | 4 ++--
RHEL6/input/system/permissions/partitions.xml | 14 +++++++-------
RHEL6/input/system/software/integrity.xml | 4 ++--
5 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index b14eaa2..53bc053 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -74,13 +74,13 @@ which is readable by all users.
Add a group to the system for each GID referenced without a corresponding group.
</description>
<ocil clause="there is output">
-To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
+To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>,
run the following command:
<pre># pwck -r</pre>
There should be no output.
</ocil>
<rationale>
-Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having unintended rights.
+Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
</rationale>
<ref disa="366" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index dede520..a3cac68 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -123,7 +123,7 @@ is critical for system security.</rationale>
<title>Verify Permissions on <tt>gshadow</tt> File</title>
<description><fileperms-desc-macro file="/etc/gshadow" perms="0000"/></description>
<ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The i<tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident cce="26951-4" />
<oval id="file_permissions_etc_gshadow" />
@@ -327,8 +327,8 @@ Failing to set the sticky bit on public directories allows unauthorized users to
<br/><br/>
The only authorized public directories are those temporary directories supplied with the system,
or those designed to be temporary file repositories. The setting is normally reserved for directories
-used by the system, and by users for temporary file storage - such as /tmp -
-and for directories requiring global read/write access.
+used by the system, by users for temporary file storage (such as <tt>/tmp</tt>), and for directories
+requiring global read/write access.
</rationale>
<ident cce="26840-9" />
<oval id="dir_perms_world_writable_sticky_bits" />
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 85fa056..e4c7a4e 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -107,7 +107,7 @@ the devices themselves should be tightly controlled.</rationale>
Another means of disabling USB storage is to disable all USB support provided
by the operating system. This can be accomplished by adding the <tt>nousb</tt>
argument to the kernel's boot loader configuration. To disable kernel support
-for USB, append "nousb" to the kernel line in /etc/grub.conf as follows:
+for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows:
<pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre>
<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards,
mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description>
@@ -157,7 +157,7 @@ If properly configured, the output should be the following:
<pre>autofs 0:off 1:off 2:off 3:off 4:off 5:off 6:off</pre>
</ocil>
<rationale>All filesystems that are required for the successful operation of the system
-should be explicitly listed in /etc/fstab by and administrator. New filesystems should
+should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should
not be arbitrarily introduced via the automounter.</rationale>
<ident cce="26976-1" />
<oval id="service_autofs_disabled" />
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 6b476cd..9078598 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -25,7 +25,7 @@ jails built for system services.
</description>
<rationale>The <tt>nodev</tt> mount option prevents files from being
interpreted as character or block devices. The only legitimate location
-for device files is the /dev directory located on the root partition.
+for device files is the <tt>/dev</tt> directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set <tt>nodev</tt> on these filesystems.</rationale>
<ident cce="27045-4" />
@@ -42,7 +42,7 @@ the <tt>/dev</tt> directory on the root partition or within chroot
jails built for system services.
<mount-desc-macro option="nodev" part="any removable media partitions" />
</description>
-<rationale> The only legitimate location for device files is the /dev directory
+<rationale> The only legitimate location for device files is the <tt>/dev</tt> directory
located on the root partition. An exception to this is chroot jails, and it is
not advised to set <tt>nodev</tt> on partitions which contain their root
filesystems. </rationale>
@@ -101,7 +101,7 @@ Legitimate character and block devices should not exist
within temporary directories like <tt>/tmp</tt>.
<mount-desc-macro option="nodev" part="/tmp" />
</description>
-<rationale>The only legitimate location for device files is the /dev directory
+<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
<ident cce="26499-4" />
<oval id="mount_option_tmp_nodev" />
@@ -144,7 +144,7 @@ Legitimate character and block devices should not exist
within temporary directories like <tt>/dev/shm</tt>.
<mount-desc-macro option="nodev" part="/dev/shm" />
</description>
-<rationale>The only legitimate location for device files is the /dev directory
+<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
<ident cce="26778-1" />
<oval id="mount_option_dev_shm_nodev" />
@@ -160,7 +160,7 @@ from world-writable temporary storage directories such as <tt>/dev/shm</tt>.
<mount-desc-macro option="noexec" part="/dev/shm" />
</description>
<rationale>Allowing users to execute binaries from world-writable directories
-such as /dev/shm can expose the system to potential compromise.</rationale>
+such as <tt>/dev/shm</tt> can expose the system to potential compromise.</rationale>
<ident cce="26622-1" />
<oval id="mount_option_dev_shm_noexec" />
<ref nist="CM-7, MP-2"/>
@@ -190,8 +190,8 @@ one location protected by the same techniques as <tt>/tmp</tt>. To do so, edit
See the mount(8) man page for further explanation of bind mounting.
</description>
<rationale>Having multiple locations for temporary storage is not required. Unless absolutely
-necessary to meet requirements, the storage location /var/tmp should be bind mounted to
-/tmp and thus share the same protections.</rationale>
+necessary to meet requirements, the storage location <tt>/var/tmp</tt> should be bind mounted to
+<tt>/tmp</tt> and thus share the same protections.</rationale>
<ident cce="26582-7" />
<oval id="mount_option_var_tmp_bind" />
<ref nist="CM-7" />
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 05f0940..e8a2a19 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -85,7 +85,7 @@ must be captured and it should be able to be verified against the installed file
<title>Configure Periodic Execution of AIDE</title>
<description>
AIDE should be executed on a periodic basis to check for changes.
-To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
+To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
<pre>05 4 * * * root /usr/sbin/aide --check</pre>
AIDE can be executed periodically through other means; this is merely one example.
</description>
@@ -214,7 +214,7 @@ sessions which may become compromised.
<br/>
Install an additional intrusion detection tool to provide complementary or
duplicative monitoring, reporting, and reaction capabilities to those of the base
-platform. For DoD systems, the McAfee Host-based Security System is provided
+platform. For DoD systems, the McAfee Host Based Security System is provided
to fulfill this role.
<!-- provide link to cybercom site? -->
<!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux -->
--
1.7.1
More information about the scap-security-guide
mailing list