[PATCH 1/2] copy editing

Shawn Wells swells at redhat.com
Fri Jan 18 13:44:48 UTC 2013



On Jan 18, 2013, at 8:16 AM, David Smith <dsmith at eclipse.ncsc.mil> wrote:

> 
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> .../accounts/restrictions/password_storage.xml     |    4 ++--
> RHEL6/input/system/permissions/files.xml           |    6 +++---
> RHEL6/input/system/permissions/mounting.xml        |    4 ++--
> RHEL6/input/system/permissions/partitions.xml      |   14 +++++++-------
> RHEL6/input/system/software/integrity.xml          |    4 ++--
> 5 files changed, 16 insertions(+), 16 deletions(-)
> 
> diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> index b14eaa2..53bc053 100644
> --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
> +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
> @@ -74,13 +74,13 @@ which is readable by all users.
> Add a group to the system for each GID referenced without a corresponding group.
> </description>
> <ocil clause="there is output">
> -To ensure all GIDs referenced in /etc/passwd are defined in /etc/group, 
> +To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>, 
> run the following command:
> <pre># pwck -r</pre>
> There should be no output.
> </ocil>
> <rationale>
> -Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having unintended rights.
> +Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
> </rationale>
> <ref disa="366" />
> <tested by="DS" on="20121024"/>
> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
> index dede520..a3cac68 100644
> --- a/RHEL6/input/system/permissions/files.xml
> +++ b/RHEL6/input/system/permissions/files.xml
> @@ -123,7 +123,7 @@ is critical for system security.</rationale>
> <title>Verify Permissions on <tt>gshadow</tt> File</title>
> <description><fileperms-desc-macro file="/etc/gshadow" perms="0000"/></description>
> <ocil><fileperms-check-macro file="/etc/gshadow" perms="----------"/></ocil>
> -<rationale>The /etc/gshadow file contains group password hashes. Protection of this file
> +<rationale>The i<tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file


Typo above (extra i)




> is critical for system security.</rationale>
> <ident cce="26951-4" />
> <oval id="file_permissions_etc_gshadow" />
> @@ -327,8 +327,8 @@ Failing to set the sticky bit on public directories allows unauthorized users to
> <br/><br/>
> The only authorized public directories are those temporary directories supplied with the system, 
> or those designed to be temporary file repositories.  The setting is normally reserved for directories 
> -used by the system, and by users for temporary file storage - such as /tmp - 
> -and for directories requiring global read/write access.
> +used by the system, by users for temporary file storage (such as <tt>/tmp</tt>), and for directories 
> +requiring global read/write access.
> </rationale>
> <ident cce="26840-9" />
> <oval id="dir_perms_world_writable_sticky_bits" />
> diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
> index 85fa056..e4c7a4e 100644
> --- a/RHEL6/input/system/permissions/mounting.xml
> +++ b/RHEL6/input/system/permissions/mounting.xml
> @@ -107,7 +107,7 @@ the devices themselves should be tightly controlled.</rationale>
> Another means of disabling USB storage is to disable all USB support provided
> by the operating system. This can be accomplished by adding the <tt>nousb</tt>
> argument to the kernel's boot loader configuration. To disable kernel support
> -for USB, append "nousb" to the kernel line in /etc/grub.conf as follows:
> +for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows:
> <pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre>
> <i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards,
> mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description>
> @@ -157,7 +157,7 @@ If properly configured, the output should be the following:
> <pre>autofs             0:off    1:off    2:off    3:off    4:off    5:off    6:off</pre>
> </ocil>
> <rationale>All filesystems that are required for the successful operation of the system
> -should be explicitly listed in /etc/fstab by and administrator. New filesystems should
> +should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should
> not be arbitrarily introduced via the automounter.</rationale>
> <ident cce="26976-1" />
> <oval id="service_autofs_disabled" />
> diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
> index 6b476cd..9078598 100644
> --- a/RHEL6/input/system/permissions/partitions.xml
> +++ b/RHEL6/input/system/permissions/partitions.xml
> @@ -25,7 +25,7 @@ jails built for system services.
> </description>
> <rationale>The <tt>nodev</tt> mount option prevents files from being
> interpreted as character or block devices. The only legitimate location
> -for device files is the /dev directory located on the root partition.
> +for device files is the <tt>/dev</tt> directory located on the root partition.
> The only exception to this is chroot jails, for which it is not advised
> to set <tt>nodev</tt> on these filesystems.</rationale>
> <ident cce="27045-4" />
> @@ -42,7 +42,7 @@ the <tt>/dev</tt> directory on the root partition or within chroot
> jails built for system services. 
> <mount-desc-macro option="nodev" part="any removable media partitions" />
> </description>
> -<rationale> The only legitimate location for device files is the /dev directory
> +<rationale> The only legitimate location for device files is the <tt>/dev</tt> directory
> located on the root partition.  An exception to this is chroot jails, and it is
> not advised to set <tt>nodev</tt> on partitions which contain their root
> filesystems.  </rationale>
> @@ -101,7 +101,7 @@ Legitimate character and block devices should not exist
> within temporary directories like <tt>/tmp</tt>. 
> <mount-desc-macro option="nodev" part="/tmp" />
> </description>
> -<rationale>The only legitimate location for device files is the /dev directory
> +<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
> located on the root partition. The only exception to this is chroot jails.</rationale>
> <ident cce="26499-4" />
> <oval id="mount_option_tmp_nodev" />
> @@ -144,7 +144,7 @@ Legitimate character and block devices should not exist
> within temporary directories like <tt>/dev/shm</tt>. 
> <mount-desc-macro option="nodev" part="/dev/shm" />
> </description>
> -<rationale>The only legitimate location for device files is the /dev directory
> +<rationale>The only legitimate location for device files is the <tt>/dev</tt> directory
> located on the root partition. The only exception to this is chroot jails.</rationale>
> <ident cce="26778-1" />
> <oval id="mount_option_dev_shm_nodev" />
> @@ -160,7 +160,7 @@ from world-writable temporary storage directories such as <tt>/dev/shm</tt>.
> <mount-desc-macro option="noexec" part="/dev/shm" />
> </description>
> <rationale>Allowing users to execute binaries from world-writable directories
> -such as /dev/shm can expose the system to potential compromise.</rationale>
> +such as <tt>/dev/shm</tt> can expose the system to potential compromise.</rationale>
> <ident cce="26622-1" />
> <oval id="mount_option_dev_shm_noexec" />
> <ref nist="CM-7, MP-2"/>
> @@ -190,8 +190,8 @@ one location protected by the same techniques as <tt>/tmp</tt>.  To do so, edit
> See the mount(8) man page for further explanation of bind mounting.
> </description>
> <rationale>Having multiple locations for temporary storage is not required. Unless absolutely
> -necessary to meet requirements, the storage location /var/tmp should be bind mounted to
> -/tmp and thus share the same protections.</rationale>
> +necessary to meet requirements, the storage location <tt>/var/tmp</tt> should be bind mounted to
> +<tt>/tmp</tt> and thus share the same protections.</rationale>
> <ident cce="26582-7" />
> <oval id="mount_option_var_tmp_bind" />
> <ref nist="CM-7" />
> diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
> index 05f0940..e8a2a19 100644
> --- a/RHEL6/input/system/software/integrity.xml
> +++ b/RHEL6/input/system/software/integrity.xml
> @@ -85,7 +85,7 @@ must be captured and it should be able to be verified against the installed file
> <title>Configure Periodic Execution of AIDE</title>
> <description>
> AIDE should be executed on a periodic basis to check for changes.
> -To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
> +To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
> <pre>05 4 * * * root /usr/sbin/aide --check</pre>
> AIDE can be executed periodically through other means; this is merely one example.
> </description>
> @@ -214,7 +214,7 @@ sessions which may become compromised.
> <br/>
> Install an additional intrusion detection tool to provide complementary or
> duplicative monitoring, reporting, and reaction capabilities to those of the base
> -platform.  For DoD systems, the McAfee Host-based Security System is provided
> +platform.  For DoD systems, the McAfee Host Based Security System is provided
> to fulfill this role.  
> <!-- provide link to cybercom site? -->
> <!-- need additional commentary: verify that HBSS (sans HIPS module) compatible w/SELinux -->
> -- 
> 1.7.1
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


Ack, pending the typo


More information about the scap-security-guide mailing list