[PATCH 4/5] editing on prose for mounting, partitioning, permissions

Shawn Wells shawn at redhat.com
Thu Oct 10 03:25:22 UTC 2013


On 10/9/13 10:58 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/permissions/mounting.xml    |  143 ++++++++++-------------
>   RHEL6/input/system/permissions/partitions.xml  |   16 +--
>   RHEL6/input/system/permissions/permissions.xml |   16 +--
>   3 files changed, 76 insertions(+), 99 deletions(-)
>
> diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
> index 6191a0a..42c7318 100644
> --- a/RHEL6/input/system/permissions/mounting.xml
> +++ b/RHEL6/input/system/permissions/mounting.xml
> @@ -1,23 +1,19 @@
>   <Group id="mounting">
>   <title>Restrict Dynamic Mounting and Unmounting of
>   Filesystems</title>
> -<description>Linux includes a number of facilities for the
> -automated addition and removal of filesystems on a running system.
> -These facilities may increase convenience, but they all bring some
> -risk -- whether direct risk from allowing unprivileged users to
> -introduce arbitrary filesystems to a machine, or risk that software
> -flaws in the automated mount facility itself will allow an attacker
> -to compromise the system.
> +<description>Linux includes a number of facilities for the automated addition
> +and removal of filesystems on a running system.  These facilities may be
> +necessary in many environments, but this capability also carries some risk -- whether direct
> +risk from allowing users to introduce arbitrary filesystems,
> +or risk that software flaws in the automated mount facility itself could
> +allow an attacker to compromise the system.
>   <br /><br />
>   This command can be used to list the types of filesystems that are
>   available to the currently executing kernel:
>   <pre># find/lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</pre>
> -If these filesystems are not required then they should be explicitly disabled
> -in the appropriate <tt>/etc/modprobe.d</tt> configuration file.
> -<br /><br />
> -Use caution when enabling any such facility, and find out
> -whether better configuration management or user education might
> -solve the same problem with less risk.</description>
> +If these filesystems are not required then they can be explicitly disabled
> +in a configuratio file in  <tt>/etc/modprobe.d</tt>.
> +</description>
>   
>   <Rule id="kernel_module_usb-storage_disabled">
>   <title>Disable Modprobe Loading of USB Storage Driver</title>
> @@ -31,66 +27,56 @@ module, but will not prevent an administrator (or another program) from using th
>   <ocil>
>   <module-disable-check-macro module="usb-storage" />
>   </ocil>
> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized
> -software and other vulnerabilities. Support for these devices should be disabled and
> -the devices themselves should be tightly controlled.</rationale>
> +<rationale>USB storage devices such as thumb drives can be used to introduce
> +malicious software.</rationale>
>   <ident cce="27016-5" />
>   <oval id="kernel_module_usb-storage_disabled" />
>   <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
>   </Rule>
> -<!-- Considering removal of this entirely, in favor of previous Rule
> -
> -<Rule id="kernel_module_usb-storage_removed">
> -<title>Remove USB Storage Driver</title>
> -<description>If your system never requires the use of USB storage devices, then the
> -supporting driver can be permanently removed. Though more effective than disabling the
> -module within modprobe, this solution is less elegant than the modprobe method described
> -in "Disable Modprobe Loading of USB". The technique described here will cause the
> -command <tt>rpm -V kernel</tt> to fail which may be an undesirable side effect.
> -<br /><br />
> -To permanently remove the USB storage driver from the system execute this command:
> -<pre># rm/lib/modules/<i>KERNEL-VERSION</i>/kernel/drivers/usb/storage/usb-storage.ko</pre>
> -The variable <tt><i>KERNEL-VERSION</i></tt> can be determined using the <tt>uname -r</tt>
> -command which returns the version of the currently loaded kernel. The <tt>rm</tt> command
> -will need to be repeated every time the kernel is updated.</description>
> -<rationale>USB storage devices such as thumb drives can be used to introduce unauthorized
> -software and other vulnerabilities. Support for these devices should be disabled and
> -the devices themselves should be tightly controlled.</rationale>
> -<ident cce="26970-4" />
> -<oval id="kernel_module_usb-storage_removed" />
> -<ref nist="" disa="1250,85" />
> -</Rule>
> --->
>   
>   <Rule id="bootloader_nousb_argument">
>   <title>Disable Kernel Support for USB via Bootloader Configuration</title>
>   <description>
> -Another means of disabling USB storage is to disable all USB support provided
> -by the operating system. This can be accomplished by adding the <tt>nousb</tt>
> -argument to the kernel's boot loader configuration. To disable kernel support
> -for USB, append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as follows:
> +All USB support can be disabled by adding the <tt>nousb</tt>
> +argument to the kernel's boot loader configuration. To do so,
> +append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as shown:
>   <pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre>
> -<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for systems with USB-based keyboards,
> -mice, or printers. This guidance is inappropriate for systems which require USB connectivity.</i></description>
> -<rationale>Disabling the USB subsystem within the Linux kernel at system boot will also
> -disable USB storage devices if they are plugged into the system. Support for these devices
> -should be disabled and the devices themselves should be tightly controlled.</rationale>
> +<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for
> +systems with USB-based keyboards, mice, or printers. This configuration is
> +infeasible for systems which require USB devices, which is common.</i></description>
> +<rationale>Disabling the USB subsystem within the Linux kernel at system boot will
> +protect against potentially malicious USB devices, although it is only practical
> +in specialized systems.
> +</rationale>
>   <ident cce="27011-6" />
>   <oval id="bootloader_nousb_argument" />
> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" />
>   </Rule>
>   
>   <Rule id="bios_disable_usb_boot">
> -<title>Disable Booting from USB Devices</title>
> -<description>An attacker with physical access could try to boot the system from a USB
> -flash drive and then access any data on the system's hard drive, circumventing the normal
> -operating system's access controls. To prevent this, configure the BIOS to disallow
> -booting from USB drives. Also configure the BIOS or firmware password as described in
> -the section titled "Set BIOS Password" to prevent unauthorized configuration changes.</description>
> -<rationale>Booting a system from a USB device would allow an attacker to circumvent
> -any security measures offered by the native OS. Attackers could mount partitions and modify the
> -configuration of the native OS. The BIOS should be configured to disallow booting from USB media.</rationale>
> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
> +<title>Disable Booting from USB Devices in Boot Firmware</title>
> +<description>Configure the system boot firmware (historically called BIOS on PC
> +systems) to disallow booting from USB drives.
> +</description>
> +<rationale>Booting a system from a USB device would allow an attacker to
> +circumvent any security measures provided by the operating system. Attackers
> +could mount partitions and modify the configuration of the OS.</rationale>
> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250" />
> +</Rule>
> +
> +<Rule id="bios_assign_password">
> +<title>Assign Password to Prevent Changes to Boot Firmware Configuration</title>
> +<description>Assign a password to the system boot firmware (historically called BIOS on PC
> +systems) to require a password for any configuration changes.
> +</description>
> +<rationale>Assigning a password to the system boot firmware prevents anyone
> +with physical access from configuring the system to boot
> +from local media and circumvent the operating system's access controls.
> +For systems in physically secure locations, such as
> +a data center or Sensitive Compartmented Information Facility (SCIF), this risk must be weighed
> +against the risk of administrative personnel being unable to conduct recovery operations in
> +a timely fashion.
> +</rationale>
>   </Rule>
>   
>   <Rule id="service_autofs_disabled">
> @@ -99,25 +85,18 @@ configuration of the native OS. The BIOS should be configured to disallow bootin
>   home directories shared via NFS, on demand. In addition, autofs can be used to handle
>   removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>.
>   However, this method of providing access to removable media is not common, so autofs
> -can almost always be disabled if NFS is not in use. Even if NFS is required, it is
> -almost always possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt>
> +can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
> +possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt>
>   rather than relying on the automounter.
>   <br /><br />
> -If the <tt>autofs</tt> service is not needed to dynamically mount NFS filesystems
> -or removable media, disable the service for all runlevels:
> -<pre># chkconfig --level 0123456 autofs off</pre>
> -Stop the service if it is already running:
> -<pre># service autofs stop</pre>
> +<service-disable-macro service="autofs" />
>   </description>
> -<ocil clause="it does not">
> -To verify the <tt>autofs</tt> service is disabled, run the following command:
> -<pre>chkconfig --list autofs</pre>
> -If properly configured, the output should be the following:
> -<pre>autofs         	0:off	1:off	2:off	3:off	4:off	5:off	6:off</pre>
> +<ocil>
> +<service-disable-check-macro service="autofs" />
>   </ocil>
> -<rationale>All filesystems that are required for the successful operation of the system
> -should be explicitly listed in <tt>/etc/fstab</tt> by and administrator. New filesystems should
> -not be arbitrarily introduced via the automounter.</rationale>
> +<rationale>Disabling the automounter permits the administrator to
> +statically control filesystem mounting through <tt>/etc/fstab</tt>.
> +</rationale>
>   <ident cce="26976-1" />
>   <oval id="service_autofs_disabled" />
>   <ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
> @@ -125,7 +104,10 @@ not be arbitrarily introduced via the automounter.</rationale>
>   
>   <Rule id="gconf_gnome_disable_automount">
>   <title>Disable GNOME Automounting</title>
> -<description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME by running the following:
> +<description>The system's default desktop environment, GNOME, will mount
> +devices and removable media (such as DVDs, CDs and USB flash drives) whenever
> +they are inserted into the system. Disable automount and autorun within GNOME
> +by running the following:
>   <pre># gconftool-2 --direct \
>   	--config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
>   	--type bool \
> @@ -134,6 +116,8 @@ not be arbitrarily introduced via the automounter.</rationale>
>   	--config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
>   	--type bool \
>   	--set /apps/nautilus/preferences/media_autorun_never true</pre>
> +</description>
> +<ocil clause="GNOME automounting is not disabled">
>   These settings can be verified by running the following:
>   <pre>$ gconftool-2 --direct \
>   	--config-source xml:read:/etc/gconf/gconf.xml.mandatory \
> @@ -141,15 +125,12 @@ These settings can be verified by running the following:
>   $ gconftool-2 --direct \
>   	--config-source xml:read:/etc/gconf/gconf.xml.mandatory \
>   	--get /apps/nautilus/preferences/media_autorun_never</pre>
> -</description>
> -<rationale>The system's capabilities for automatic mounting should be configured to match whatever is defined by security
> -policy. Disabling USB storage as described in the USB section will prevent the use of USB storage devices, but
> -this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and
> -DVDs.
> +</ocil>
> +<rationale>Disabling
>   </rationale>
>   <ident cce="27035-5" />
>   <oval id="gconf_gnome_disable_automount" />
> -<ref nist="AC-19(a),AC-19(d),AC-19(e)" disa="1250,85" />
> +<ref nist="AC-19(a),AC-19(d),AC-19(e)" />
>   </Rule>
>   
>   <Rule id="kernel_module_cramfs_disabled">
> diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
> index d5b5da6..f74423b 100644
> --- a/RHEL6/input/system/permissions/partitions.xml
> +++ b/RHEL6/input/system/permissions/partitions.xml
> @@ -54,12 +54,10 @@ filesystems.  </rationale>
>   <Rule id="mountopt_noexec_on_removable_partitions">
>   <title>Add noexec Option to Removable Media Partitions</title>
>   <description>The <tt>noexec</tt> mount option prevents the direct
> -execution of binaries on the mounted filesystem. Users should not
> -be allowed to execute binaries that exist on partitions mounted
> -from removable media (such as a USB key). The <tt>noexec</tt>
> -option prevents code from being executed directly from the media
> -itself, and may therefore provide a line of defense against
> -certain types of worms or malicious code.
> +execution of binaries on the mounted filesystem.
> +Preventing the direct execution of binaries from removable media (such as a USB
> +key) provides a defense against malicious software that may be present on such
> +untrusted media.
>   <mount-desc-macro option="noexec" part="any removable media partitions" />
>   </description>
>   <rationale>Allowing users to execute binaries from removable media such as USB keys exposes
> @@ -85,9 +83,9 @@ of the file respectively. Users should not be allowed to introduce suid and guid
>   files into the system via partitions mounted from removeable media.
>   <mount-desc-macro option="nosuid" part="any removable media partitions" />
>   </description>
> -<rationale>The presence of suid and sgid executables should be tightly controlled. Users
> -should not be able to execute suid or sgid binaries from partitions mounted off of
> -removable media.</rationale>
> +<rationale>The presence of suid and sgid executables should be tightly controlled. Allowing
> +users to introduce suid or sgid binaries from partitions mounted off of
> +removable media would allow them to introduce their own highly-privileged programs.</rationale>
>   <ident cce="27056-1" />
>   <oval id="mount_option_nosuid_removable_partitions" value="var_removable_partition" />
>   <ref nist="AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2"/>
> diff --git a/RHEL6/input/system/permissions/permissions.xml b/RHEL6/input/system/permissions/permissions.xml
> index 8e5e148..7f3302a 100644
> --- a/RHEL6/input/system/permissions/permissions.xml
> +++ b/RHEL6/input/system/permissions/permissions.xml
> @@ -2,22 +2,20 @@
>   <title>File Permissions and Masks</title>
>   <description>Traditional Unix security relies heavily on file and
>   directory permissions to prevent unauthorized users from reading or
> -modifying files to which they should not have access. Adhere to the
> -principle of least privilege - configure each file, directory, and
> -filesystem to allow only the access needed in order for that file
> -to serve its purpose.
> +modifying files to which they should not have access.
>   <br /><br />
> -Note: Several of the commands in this section search filesystems
> +Several of the commands in this section search filesystems
>   for files or directories with certain characteristics, and are
>   intended to be run on every local partition on a given machine.
>   When the variable <i>PART</i> appears in one of the commands below,
>   it means that the command is intended to be run repeatedly, with the
>   name of each local partition substituted for <i>PART</i> in turn.
>   <br /><br />
> -The following command prints a list of ext4 partitions on the local
> -machine, which is the default filesystem for Red Hat Enterprise Linux
> +The following command prints a list of all ext4 partitions on the local
> +system, which is the default filesystem for Red Hat Enterprise Linux
>   6 installations:
>   <pre>$ mount -t ext4 | awk '{print $3}'</pre>
> -If your site uses a local filesystem type other than ext4, you
> -will need to modify this command.</description>
> +For any systems that use a different
> +local filesystem type, modify this command as appropriate.
> +</description>
>   </Group>
> -- 1.7.1


ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131009/9e2bf9cd/attachment-0001.html>


More information about the scap-security-guide mailing list