[PATCH] New check uses /etc/mtab and mount partition check to look for bind mount on /var/tmp
Shawn Wells
shawn at redhat.com
Tue Sep 10 17:41:12 UTC 2013
On 9/10/13 12:49 PM, Maura Dailey wrote:
> + <criteria operator="AND">
> + <criterion comment="Ensure /var/tmp is mounted"
> + test_ref="test_mount_option_var_tmp" />
> + <criterion comment="Ensure /tmp is bind mounted"
> + test_ref="test_mount_option_var_tmp_bind" />
> </criteria>
.....
> + <linux:partition_object id="object_mount_option_var_tmp" version="1">
> + <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
> + </linux:partition_object>
.....
> + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
> + comment="Ensure bind mount option is on /var/tmp"
> + id="test_mount_option_var_tmp_bind" version="1">
> + <ind:object object_ref="object_mount_option_var_tmp_bind" />
> + </ind:textfilecontent54_test>
> + <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
> + id="object_mount_option_var_tmp_bind" version="1">
> + <ind:filepath>/etc/mtab</ind:filepath>
> + <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
> + <ind:instance datatype="int" operation="greater than or equal">
> + 1</ind:instance>
Seems like the sanest approach. Ack.
More information about the scap-security-guide
mailing list