[PATCH] New check uses /etc/mtab and mount partition check to look for bind mount on /var/tmp

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 10 17:30:02 UTC 2013


It's not in the STIG, it's in the XCCDF prose. The check exists now, but 
it's broken.

Also, what Shawn said in the other thread.

- Maura Dailey

On 09/10/2013 12:56 PM, leam hall wrote:
> What's the GENID on this? I didn't find it in the Jun STIG.
>
> Thanks!
>
> Leam
>
>
> On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura at eclipse.ncsc.mil 
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
>
>     Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil
>     <mailto:maura at eclipse.ncsc.mil>>
>     ---
>      RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44
>     +++++++++++++++-------
>      1 files changed, 30 insertions(+), 14 deletions(-)
>
>     diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>     b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>     index 4d549c2..02630a7 100644
>     --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>     +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>     @@ -5,24 +5,40 @@
>            <affected family="unix">
>              <platform>Red Hat Enterprise Linux 6</platform>
>            </affected>
>     -      <description>The /var/tmp directory should be bind mounted
>     to /tmp
>     -      in order to consolidate temporary storage into one location
>     protected by the same
>     -      techniques as /tmp.</description>
>     +      <description>The /var/tmp directory should be bind mounted
>     to /tmp in
>     +      order to consolidate temporary storage into one location
>     protected by the
>     +      same techniques as /tmp.</description>
>     +      <reference source="MED" ref_id="20130821"
>     ref_url="test_attestation" />
>          </metadata>
>     -    <criteria>
>     -      <criterion comment="Unknown test stub"
>     test_ref="test_bind_mount_var_tmp" />
>     +    <criteria operator="AND">
>     +      <criterion comment="Ensure /var/tmp is mounted"
>     +      test_ref="test_mount_option_var_tmp" />
>     +      <criterion comment="Ensure /tmp is bind mounted"
>     +      test_ref="test_mount_option_var_tmp_bind" />
>          </criteria>
>        </definition>
>     +  <linux:partition_test id="test_mount_option_var_tmp" version="1"
>     +  comment="Ensure /var/tmp is mounted" check="all">
>     +    <linux:object object_ref="object_mount_option_var_tmp" />
>     +  </linux:partition_test>
>     +  <linux:partition_object id="object_mount_option_var_tmp"
>     version="1">
>     +    <linux:mount_point operation="pattern
>     match">/var/tmp</linux:mount_point>
>     +  </linux:partition_object>
>
>     -  <ind:textfilecontent54_test check="all"
>     check_existence="at_least_one_exists" comment="bind mount /var/tmp
>     to /tmp" id="test_bind_mount_var_tmp" version="1">
>     -    <ind:object object_ref="object_bind_mount_var_tmp" />
>     -  </ind:textfilecontent54_test>
>     +  <!-- The linux:partition_test reads from /proc/mounts, which
>     does not record
>     +       the bind mount option. As a result, the less elegant
>     textfilecontent54_test
>     +       is required here. -->
>
>     -  <ind:textfilecontent54_object comment="look for the partition
>     mount point in /etc/fstab" id="object_bind_mount_var_tmp" version="1">
>     -    <ind:path>/etc</ind:path>
>     -    <ind:filename>fstab</ind:filename>
>     -    <ind:pattern operation="pattern
>     match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
>     -    <ind:instance datatype="int" operation="greater than or
>     equal">1</ind:instance>
>     +  <ind:textfilecontent54_test check="all"
>     check_existence="at_least_one_exists"
>     +  comment="Ensure bind mount option is on /var/tmp"
>     +  id="test_mount_option_var_tmp_bind" version="1">
>     +    <ind:object object_ref="object_mount_option_var_tmp_bind" />
>     +  </ind:textfilecontent54_test>
>     +  <ind:textfilecontent54_object comment="look for the partition
>     mount point in /etc/mtab"
>     +  id="object_mount_option_var_tmp_bind" version="1">
>     +    <ind:filepath>/etc/mtab</ind:filepath>
>     +    <ind:pattern operation="pattern
>     match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
>     +    <ind:instance datatype="int" operation="greater than or equal">
>     +    1</ind:instance>
>        </ind:textfilecontent54_object>
>     -
>      </def-group>
>     --
>     1.7.1
>
>     _______________________________________________
>     scap-security-guide mailing list
>     scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
> -- 
> Mind on a Mission <http://leamhall.blogspot.com/>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/561cb66f/attachment.html>


More information about the scap-security-guide mailing list