[PATCH] Tested partition checks, ensured they returned valid partitions.
Maura Dailey
maura at eclipse.ncsc.mil
Tue Sep 10 17:40:52 UTC 2013
OK, pushed this set.
On 09/10/2013 12:57 PM, David Smith wrote:
> until now -- ack!
>
>
> On Tue, Sep 10, 2013 at 12:55 PM, Maura Dailey <maura at eclipse.ncsc.mil
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
> No one's ACKED these.
>
> - Maura Dailey
>
> On 08/30/2013 01:41 PM, Maura Dailey wrote:
>
> Added test checks for set of partition checks.
>
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil
> <mailto:maura at eclipse.ncsc.mil>>
> ---
> RHEL6/input/checks/partition_for_home.xml | 18
> ++++++++++--------
> RHEL6/input/checks/partition_for_tmp.xml | 14
> ++++++++------
> RHEL6/input/checks/partition_for_var.xml | 18
> ++++++++++--------
> RHEL6/input/checks/partition_for_var_log.xml | 12
> +++++++-----
> RHEL6/input/checks/partition_for_var_log_audit.xml | 18
> +++++++++++-------
> 5 files changed, 46 insertions(+), 34 deletions(-)
>
> diff --git a/RHEL6/input/checks/partition_for_home.xml
> b/RHEL6/input/checks/partition_for_home.xml
> index b784316..2081d18 100644
> --- a/RHEL6/input/checks/partition_for_home.xml
> +++ b/RHEL6/input/checks/partition_for_home.xml
> @@ -5,20 +5,22 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>If user home directories will be stored
> locally,
> - create a separate partition for /home. If /home will be
> mounted
> - from another system such as an NFS server, then
> creating a separate
> - partition is not necessary at this time, and the
> mountpoint can
> - instead be configured later.</description>
> + <description>If user home directories will be stored
> locally, create a
> + separate partition for /home. If /home will be mounted
> from another
> + system such as an NFS server, then creating a separate
> partition is not
> + necessary at this time, and the mountpoint can instead
> be configured
> + later.</description>
> + <reference source="MED" ref_id="20130830"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_home_partition"
> comment="/home on own partition" />
> </criteria>
> </definition>
> - <linux:partition_test check="all"
> check_existence="all_exist" id="test_home_partition"
> version="1" comment="/home on own partition">
> - <linux:object
> object_ref="object_mount_home_own_partition" />
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_home_partition" version="1" comment="/home on own
> partition">
> + <linux:object object_ref="object_mount_home_own_partition" />
> </linux:partition_test>
> <linux:partition_object
> id="object_mount_home_own_partition" version="1">
> - <linux:mount_point>/home</linux:mount_point>
> + <linux:mount_point>/home</linux:mount_point>
> </linux:partition_object>
> </def-group>
> diff --git a/RHEL6/input/checks/partition_for_tmp.xml
> b/RHEL6/input/checks/partition_for_tmp.xml
> index de93ee9..9c28c13 100644
> --- a/RHEL6/input/checks/partition_for_tmp.xml
> +++ b/RHEL6/input/checks/partition_for_tmp.xml
> @@ -5,18 +5,20 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>The /tmp directory is a world-writable
> directory
> - used for temporary file storage. Verify that it has its own
> - partition or logical volume.</description>
> + <description>The /tmp directory is a world-writable
> directory used for
> + temporary file storage. Verify that it has its own
> partition or logical
> + volume.</description>
> + <reference source="MED" ref_id="20130830"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_tmp_partition" comment="/tmp
> on own partition" />
> </criteria>
> </definition>
> - <linux:partition_test check="all"
> check_existence="all_exist" id="test_tmp_partition"
> version="1" comment="/tmp on own partition">
> - <linux:object object_ref="object_own_tmp_partition" />
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_tmp_partition" version="1" comment="/tmp on own
> partition">
> + <linux:object object_ref="object_own_tmp_partition" />
> </linux:partition_test>
> <linux:partition_object id="object_own_tmp_partition"
> version="1">
> - <linux:mount_point>/tmp</linux:mount_point>
> + <linux:mount_point>/tmp</linux:mount_point>
> </linux:partition_object>
> </def-group>
> diff --git a/RHEL6/input/checks/partition_for_var.xml
> b/RHEL6/input/checks/partition_for_var.xml
> index 58089ab..2ed1d38 100644
> --- a/RHEL6/input/checks/partition_for_var.xml
> +++ b/RHEL6/input/checks/partition_for_var.xml
> @@ -5,20 +5,22 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>Ensuring that /var is mounted on its own
> partition enables the
> - setting of more restrictive mount options, which is
> used as temporary
> - storage by many program, particularly system services
> such as daemons.
> - It is not uncommon for the /var directory to contain
> world-writable directories,
> - installed by other software packages.</description>
> + <description>Ensuring that /var is mounted on its own
> partition enables
> + the setting of more restrictive mount options, which is
> used as temporary
> + storage by many program, particularly system services
> such as daemons. It
> + is not uncommon for the /var directory to contain
> world-writable
> + directories, installed by other software
> packages.</description>
> + <reference source="MED" ref_id="20130830"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_var_partition" comment="/var
> on own partition" />
> </criteria>
> </definition>
> - <linux:partition_test check="all"
> check_existence="all_exist" id="test_var_partition"
> version="1" comment="/var on own partition">
> - <linux:object
> object_ref="object_mount_var_own_partition" />
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_var_partition" version="1" comment="/var on own
> partition">
> + <linux:object object_ref="object_mount_var_own_partition" />
> </linux:partition_test>
> <linux:partition_object
> id="object_mount_var_own_partition" version="1">
> - <linux:mount_point>/var</linux:mount_point>
> + <linux:mount_point>/var</linux:mount_point>
> </linux:partition_object>
> </def-group>
> diff --git a/RHEL6/input/checks/partition_for_var_log.xml
> b/RHEL6/input/checks/partition_for_var_log.xml
> index 8a8a6f4..94d235b 100644
> --- a/RHEL6/input/checks/partition_for_var_log.xml
> +++ b/RHEL6/input/checks/partition_for_var_log.xml
> @@ -5,17 +5,19 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>System logs are stored in the /var/log
> directory.
> - Ensure that it has its own partition or logical
> volume.</description>
> + <description>System logs are stored in the /var/log
> directory. Ensure
> + that it has its own partition or logical
> volume.</description>
> + <reference source="MED" ref_id="20130830"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_var_log_partition"
> comment="/var/log on own partition" />
> </criteria>
> </definition>
> - <linux:partition_test check="all"
> check_existence="all_exist" id="test_var_log_partition"
> version="1" comment="/var/log on own partition">
> - <linux:object
> object_ref="object_mount_var_log_own_partition" />
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_var_log_partition" version="1" comment="/var/log
> on own partition">
> + <linux:object
> object_ref="object_mount_var_log_own_partition" />
> </linux:partition_test>
> <linux:partition_object
> id="object_mount_var_log_own_partition" version="1">
> - <linux:mount_point>/var/log</linux:mount_point>
> + <linux:mount_point>/var/log</linux:mount_point>
> </linux:partition_object>
> </def-group>
> diff --git
> a/RHEL6/input/checks/partition_for_var_log_audit.xml
> b/RHEL6/input/checks/partition_for_var_log_audit.xml
> index e88ceba..b7a7d68 100644
> --- a/RHEL6/input/checks/partition_for_var_log_audit.xml
> +++ b/RHEL6/input/checks/partition_for_var_log_audit.xml
> @@ -6,18 +6,22 @@
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> <description>Audit logs are stored in the
> /var/log/audit directory.
> - Ensure that it has its own partition or logical volume.
> Make
> - absolutely certain that it is large enough to store all
> audit logs
> - that will be created by the auditing daemon.</description>
> + Ensure that it has its own partition or logical volume.
> Make absolutely
> + certain that it is large enough to store all audit logs
> that will be
> + created by the auditing daemon.</description>
> + <reference source="MED" ref_id="20130830"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion test_ref="test_var_log_audit_partition"
> comment="/var/log/audit on own partition" />
> </criteria>
> </definition>
> - <linux:partition_test check="all"
> check_existence="all_exist" id="test_var_log_audit_partition"
> version="1" comment="check for /var/log/audit partition">
> - <linux:object
> object_ref="object_mount_var_log_audit_own_partition" />
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_var_log_audit_partition" version="1"
> + comment="check for /var/log/audit partition">
> + <linux:object
> object_ref="object_mount_var_log_audit_own_partition" />
> </linux:partition_test>
> - <linux:partition_object
> id="object_mount_var_log_audit_own_partition" version="1">
> - <linux:mount_point>/var/log/audit</linux:mount_point>
> + <linux:partition_object
> id="object_mount_var_log_audit_own_partition"
> + version="1">
> + <linux:mount_point>/var/log/audit</linux:mount_point>
> </linux:partition_object>
> </def-group>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> <mailto:scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/317a2aa8/attachment-0001.html>
More information about the scap-security-guide
mailing list