[PATCH] New check uses /etc/mtab and mount partition check to look for bind mount on /var/tmp

leam hall leamhall at gmail.com
Tue Sep 10 16:56:00 UTC 2013


What's the GENID on this? I didn't find it in the Jun STIG.

Thanks!

Leam


On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:

>
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
>  RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44
> +++++++++++++++-------
>  1 files changed, 30 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> index 4d549c2..02630a7 100644
> --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
> @@ -5,24 +5,40 @@
>        <affected family="unix">
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
> -      <description>The /var/tmp directory should be bind mounted to /tmp
> -      in order to consolidate temporary storage into one location
> protected by the same
> -      techniques as /tmp.</description>
> +      <description>The /var/tmp directory should be bind mounted to /tmp
> in
> +      order to consolidate temporary storage into one location protected
> by the
> +      same techniques as /tmp.</description>
> +      <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
>      </metadata>
> -    <criteria>
> -      <criterion comment="Unknown test stub"
> test_ref="test_bind_mount_var_tmp" />
> +    <criteria operator="AND">
> +      <criterion comment="Ensure /var/tmp is mounted"
> +      test_ref="test_mount_option_var_tmp" />
> +      <criterion comment="Ensure /tmp is bind mounted"
> +      test_ref="test_mount_option_var_tmp_bind" />
>      </criteria>
>    </definition>
> +  <linux:partition_test id="test_mount_option_var_tmp" version="1"
> +  comment="Ensure /var/tmp is mounted" check="all">
> +    <linux:object object_ref="object_mount_option_var_tmp" />
> +  </linux:partition_test>
> +  <linux:partition_object id="object_mount_option_var_tmp" version="1">
> +    <linux:mount_point operation="pattern
> match">/var/tmp</linux:mount_point>
> +  </linux:partition_object>
>
> -  <ind:textfilecontent54_test check="all"
> check_existence="at_least_one_exists" comment="bind mount /var/tmp to /tmp"
> id="test_bind_mount_var_tmp" version="1">
> -    <ind:object object_ref="object_bind_mount_var_tmp" />
> -  </ind:textfilecontent54_test>
> +  <!-- The linux:partition_test reads from /proc/mounts, which does not
> record
> +       the bind mount option. As a result, the less elegant
> textfilecontent54_test
> +       is required here. -->
>
> -  <ind:textfilecontent54_object comment="look for the partition mount
> point in /etc/fstab" id="object_bind_mount_var_tmp" version="1">
> -    <ind:path>/etc</ind:path>
> -    <ind:filename>fstab</ind:filename>
> -    <ind:pattern operation="pattern
> match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
> -    <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> +  <ind:textfilecontent54_test check="all"
> check_existence="at_least_one_exists"
> +  comment="Ensure bind mount option is on /var/tmp"
> +  id="test_mount_option_var_tmp_bind" version="1">
> +    <ind:object object_ref="object_mount_option_var_tmp_bind" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object comment="look for the partition mount
> point in /etc/mtab"
> +  id="object_mount_option_var_tmp_bind" version="1">
> +    <ind:filepath>/etc/mtab</ind:filepath>
> +    <ind:pattern operation="pattern
> match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or equal">
> +    1</ind:instance>
>    </ind:textfilecontent54_object>
> -
>  </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>



-- 
Mind on a Mission <http://leamhall.blogspot.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/ed68b01e/attachment.html>


More information about the scap-security-guide mailing list