[PATCH 1/2] copy editing

David Smith dsmith at eclipse.ncsc.mil
Fri Jan 18 13:16:20 UTC 2013


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 .../accounts/restrictions/password_storage.xml     |    4 ++--
 RHEL6/input/system/permissions/files.xml           |    6 +++---
 RHEL6/input/system/permissions/mounting.xml        |    4 ++--
 RHEL6/input/system/permissions/partitions.xml      |   14 +++++++-------
 RHEL6/input/system/software/integrity.xml          |    4 ++--
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index b14eaa2..53bc053 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -74,13 +74,13 @@ which is readable by all users.
 Add a group to the system for each GID referenced without a corresponding group.
 </description>
 <ocil clause="there is output">
-To ensure all GIDs referenced in /etc/passwd are defined in /etc/group, 
+To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>, 
 run the following command:
 <pre># pwck -r</pre>
 There should be no output.
 </ocil>
 <rationale>
-Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having unintended rights.
+Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
 </rationale>
 <ref disa="366" />
 <tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index dede520..a3cac68 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -123,7 +123,7 @@ is critical for system security.</rationale>
 <title>Verify Permissions on <tt>gshadow</tt> File</title>
 <description><fileperms-desc-macro file="/etc/gshadow" perms="0000"/></description>
 <ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
-<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
+<rationale>The i<tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
 is critical for system security.</rationale>
 <ident cce="26951-4" />
 <oval id="file_permissions_etc_gshadow" />
@@ -327,8 +327,8 @@ Failing to set the sticky bit on public directories allows unauthorized users to
 <br/><br/>
 The only authorized public directories are those temporary directories supplied with the system, 
 or those designed to be temporary file repositories.  The setting is normally reserved for directories 
-used by the system, and by users for temporary file storage - such as /tmp - 
-and for directories requiring global read/write access.
+used by the system, by users for temporary file storage (such as <tt>/tmp</tt>), and for directories 
+requiring global read/write access.
 </rationale>
 <ident cce="26840-9" />
 <oval id="dir_perms_world_writable_sticky_bits" />
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 85fa056..e4c7a4e 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -107,7 +107,7 @@ the devices themselves should be tightly controlled.</rationale>
 Another means of disabling USB storage is to disable all USB support provided
 by the operating system. This can be accomplished by adding the <tt>nousb</tt>
 argument to the kernel's boot loader configuration. To disable kernel support
-for USB, append "nousb" to the kernel line in /etc/grub.conf as follows:
+for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows:
 <pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre>
 <i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards,
 mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description>
@@ -157,7 +157,7 @@ If properly configured, the output should be the following:
 <pre>autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off</pre>
 </ocil>
 <rationale>All filesystems that are required for the successful operation of the system
-should be explicitly listed in /etc/fstab by and administrator. New filesystems should
+should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should
 not be arbitrarily introduced via the automounter.</rationale>
 <ident cce="26976-1" />
 <oval id="service_autofs_disabled" />
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 6b476cd..9078598 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -25,7 +25,7 @@ jails built for system services.
 </description>
 <rationale>The <tt>nodev</tt> mount option prevents files from being
 interpreted as character or block devices. The only legitimate location
-for device files is the /dev directory located on the root partition.
+for device files is the <tt>/dev</tt> directory located on the root partition.
 The only exception to this is chroot jails, for which it is not advised
 to set <tt>nodev</tt> on these filesystems.</rationale>
 <ident cce="27045-4" />
@@ -42,7 +42,7 @@ the <tt>/dev</tt> directory on the root partition or within chroot
 jails built for system services. 
 <mount-desc-macro option="nodev" part="any removable media partitions" />
 </description>
-<rationale> The only legitimate location for device files is the /dev directory
+<rationale> The only legitimate location for device files is the <tt>/dev</tt> directory
 located on the root partition.  An exception to this is chroot jails, and it is
 not advised to set <tt>nodev</tt> on partitions which contain their root
 filesystems.  </rationale>
@@ -101,7 +101,7 @@ Legitimate character and block devices should not exist
 within temporary directories like <tt>/tmp</tt>. 
 <mount-desc-macro option="nodev" part="/tmp" />
 </description>
-<rationale>The only legitimate location for device files is the /dev directory
+<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
 located on the root partition. The only exception to this is chroot jails.</rationale>
 <ident cce="26499-4" />
 <oval id="mount_option_tmp_nodev" />
@@ -144,7 +144,7 @@ Legitimate character and block devices should not exist
 within temporary directories like <tt>/dev/shm</tt>. 
 <mount-desc-macro option="nodev" part="/dev/shm" />
 </description>
-<rationale>The only legitimate location for device files is the /dev directory
+<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
 located on the root partition. The only exception to this is chroot jails.</rationale>
 <ident cce="26778-1" />
 <oval id="mount_option_dev_shm_nodev" />
@@ -160,7 +160,7 @@ from world-writable temporary storage directories such as <tt>/dev/shm</tt>.
 <mount-desc-macro option="noexec" part="/dev/shm" />
 </description>
 <rationale>Allowing users to execute binaries from world-writable directories
-such as /dev/shm can expose the system to potential compromise.</rationale>
+such as <tt>/dev/shm</tt> can expose the system to potential compromise.</rationale>
 <ident cce="26622-1" />
 <oval id="mount_option_dev_shm_noexec" />
 <ref nist="CM-7, MP-2"/>
@@ -190,8 +190,8 @@ one location protected by the same techniques as <tt>/tmp</tt>.  To do so, edit
 See the mount(8) man page for further explanation of bind mounting.
 </description>
 <rationale>Having multiple locations for temporary storage is not required. Unless absolutely
-necessary to meet requirements, the storage location /var/tmp should be bind mounted to
-/tmp and thus share the same protections.</rationale>
+necessary to meet requirements, the storage location <tt>/var/tmp</tt> should be bind mounted to
+<tt>/tmp</tt> and thus share the same protections.</rationale>
 <ident cce="26582-7" />
 <oval id="mount_option_var_tmp_bind" />
 <ref nist="CM-7" />
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 05f0940..e8a2a19 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -85,7 +85,7 @@ must be captured and it should be able to be verified against the installed file
 <title>Configure Periodic Execution of AIDE</title>
 <description>
 AIDE should be executed on a periodic basis to check for changes.
-To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
+To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
 <pre>05 4 * * * root /usr/sbin/aide --check</pre>
 AIDE can be executed periodically through other means; this is merely one example.
 </description>
@@ -214,7 +214,7 @@ sessions which may become compromised.
 <br/>
 Install an additional intrusion detection tool to provide complementary or
 duplicative monitoring, reporting, and reaction capabilities to those of the base
-platform.  For DoD systems, the McAfee Host-based Security System is provided
+platform.  For DoD systems, the McAfee Host Based Security System is provided
 to fulfill this role.  
 <!-- provide link to cybercom site? -->
 <!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux -->
-- 
1.7.1



More information about the scap-security-guide mailing list