[PATCH] New check uses /etc/mtab and mount partition check to look for bind mount on /var/tmp

leam hall leamhall at gmail.com
Tue Sep 10 17:44:03 UTC 2013


Ah, I need to figure out how to have the SSG just check for STIG findings.
Cool.


On Tue, Sep 10, 2013 at 1:30 PM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:

>  It's not in the STIG, it's in the XCCDF prose. The check exists now, but
> it's broken.
>
> Also, what Shawn said in the other thread.
>
> - Maura Dailey
>
>
> On 09/10/2013 12:56 PM, leam hall wrote:
>
> What's the GENID on this? I didn't find it in the Jun STIG.
>
> Thanks!
>
> Leam
>
>
> On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:
>
>>
>> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
>> ---
>>  RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44
>> +++++++++++++++-------
>>  1 files changed, 30 insertions(+), 14 deletions(-)
>>
>> diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>> b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>> index 4d549c2..02630a7 100644
>> --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>> +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml
>> @@ -5,24 +5,40 @@
>>        <affected family="unix">
>>          <platform>Red Hat Enterprise Linux 6</platform>
>>        </affected>
>> -      <description>The /var/tmp directory should be bind mounted to /tmp
>> -      in order to consolidate temporary storage into one location
>> protected by the same
>> -      techniques as /tmp.</description>
>> +      <description>The /var/tmp directory should be bind mounted to /tmp
>> in
>> +      order to consolidate temporary storage into one location protected
>> by the
>> +      same techniques as /tmp.</description>
>> +      <reference source="MED" ref_id="20130821"
>> ref_url="test_attestation" />
>>      </metadata>
>> -    <criteria>
>> -      <criterion comment="Unknown test stub"
>> test_ref="test_bind_mount_var_tmp" />
>> +    <criteria operator="AND">
>> +      <criterion comment="Ensure /var/tmp is mounted"
>> +      test_ref="test_mount_option_var_tmp" />
>> +      <criterion comment="Ensure /tmp is bind mounted"
>> +      test_ref="test_mount_option_var_tmp_bind" />
>>      </criteria>
>>    </definition>
>> +  <linux:partition_test id="test_mount_option_var_tmp" version="1"
>> +  comment="Ensure /var/tmp is mounted" check="all">
>> +    <linux:object object_ref="object_mount_option_var_tmp" />
>> +  </linux:partition_test>
>> +  <linux:partition_object id="object_mount_option_var_tmp" version="1">
>> +    <linux:mount_point operation="pattern
>> match">/var/tmp</linux:mount_point>
>> +  </linux:partition_object>
>>
>> -  <ind:textfilecontent54_test check="all"
>> check_existence="at_least_one_exists" comment="bind mount /var/tmp to /tmp"
>> id="test_bind_mount_var_tmp" version="1">
>> -    <ind:object object_ref="object_bind_mount_var_tmp" />
>> -  </ind:textfilecontent54_test>
>> +  <!-- The linux:partition_test reads from /proc/mounts, which does not
>> record
>> +       the bind mount option. As a result, the less elegant
>> textfilecontent54_test
>> +       is required here. -->
>>
>> -  <ind:textfilecontent54_object comment="look for the partition mount
>> point in /etc/fstab" id="object_bind_mount_var_tmp" version="1">
>> -    <ind:path>/etc</ind:path>
>> -    <ind:filename>fstab</ind:filename>
>> -    <ind:pattern operation="pattern
>> match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern>
>> -    <ind:instance datatype="int" operation="greater than or
>> equal">1</ind:instance>
>> +  <ind:textfilecontent54_test check="all"
>> check_existence="at_least_one_exists"
>> +  comment="Ensure bind mount option is on /var/tmp"
>> +  id="test_mount_option_var_tmp_bind" version="1">
>> +    <ind:object object_ref="object_mount_option_var_tmp_bind" />
>> +  </ind:textfilecontent54_test>
>> +  <ind:textfilecontent54_object comment="look for the partition mount
>> point in /etc/mtab"
>> +  id="object_mount_option_var_tmp_bind" version="1">
>> +    <ind:filepath>/etc/mtab</ind:filepath>
>> +    <ind:pattern operation="pattern
>> match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
>> +    <ind:instance datatype="int" operation="greater than or equal">
>> +    1</ind:instance>
>>    </ind:textfilecontent54_object>
>> -
>>  </def-group>
>> --
>> 1.7.1
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>
>
> --
> Mind on a Mission <http://leamhall.blogspot.com/>
>
>
> _______________________________________________
> scap-security-guide mailing listscap-security-guide at lists.fedorahosted.orghttps://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>


-- 
Mind on a Mission <http://leamhall.blogspot.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/8f8bc65d/attachment.html>


More information about the scap-security-guide mailing list