[PATCH] New check uses /etc/mtab and mount partition check to look for bind mount on /var/tmp

Shawn Wells shawn at redhat.com
Tue Sep 10 17:41:12 UTC 2013


On 9/10/13 12:49 PM, Maura Dailey wrote:
> +    <criteria operator="AND">
> +      <criterion comment="Ensure /var/tmp is mounted"
> +      test_ref="test_mount_option_var_tmp" />
> +      <criterion comment="Ensure /tmp is bind mounted"
> +      test_ref="test_mount_option_var_tmp_bind" />
>       </criteria>
.....
> +  <linux:partition_object id="object_mount_option_var_tmp" version="1">
> +    <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
> +  </linux:partition_object>
.....
> +  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
> +  comment="Ensure bind mount option is on /var/tmp"
> +  id="test_mount_option_var_tmp_bind" version="1">
> +    <ind:object object_ref="object_mount_option_var_tmp_bind" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
> +  id="object_mount_option_var_tmp_bind" version="1">
> +    <ind:filepath>/etc/mtab</ind:filepath>
> +    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or equal">
> +    1</ind:instance>

Seems like the sanest approach. Ack.


More information about the scap-security-guide mailing list