[PATCH] Adding testrefs to mount_option_dev_shm_* checks, all appear to function correctly.
David Smith
dsmith at eclipse.ncsc.mil
Wed Sep 18 15:56:31 UTC 2013
Thanks for these, please push!
On Wed, Sep 18, 2013 at 11:53 AM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:
> Pushing out some checks I tested a little while back. I've verified that
> no other changes were made on the mailing list.
>
> - Maura Dailey
>
> ---
> RHEL6/input/checks/mount_option_dev_shm_nodev.xml | 7 +++++--
> RHEL6/input/checks/mount_option_dev_shm_noexec.xml | 14 +++++++++-----
> RHEL6/input/checks/mount_option_dev_shm_nosuid.xml | 13 ++++++++-----
> 3 files changed, 22 insertions(+), 12 deletions(-)
>
> diff --git a/RHEL6/input/checks/mount_option_dev_shm_nodev.xml
> b/RHEL6/input/checks/mount_option_dev_shm_nodev.xml
> index 09b69b6..f00b9e9 100644
> --- a/RHEL6/input/checks/mount_option_dev_shm_nodev.xml
> +++ b/RHEL6/input/checks/mount_option_dev_shm_nodev.xml
> @@ -8,12 +8,14 @@
> <description>Legitimate character and block devices should not exist
> within temporary directories like /dev/shm. The nodev mount option
> should
> be specified for /dev/shm.</description>
> + <reference source="MED" ref_id="20130820"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="nodev on /dev/shm"
> test_ref="test_nodev_dev_shm" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_nodev_dev_shm" version="1" comment="nodev on /dev/shm">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_nodev_dev_shm" version="1" comment="nodev on /dev/shm">
> <linux:object object_ref="object_dev_shm_partition_nodev" />
> <linux:state state_ref="state_dev_shm_nodev" />
> </linux:partition_test>
> @@ -21,6 +23,7 @@
> <linux:mount_point>/dev/shm</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_dev_shm_nodev" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nodev</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">nodev</linux:mount_options>
> </linux:partition_state>
> </def-group>
> diff --git a/RHEL6/input/checks/mount_option_dev_shm_noexec.xml
> b/RHEL6/input/checks/mount_option_dev_shm_noexec.xml
> index 25ac4fb..825f761 100644
> --- a/RHEL6/input/checks/mount_option_dev_shm_noexec.xml
> +++ b/RHEL6/input/checks/mount_option_dev_shm_noexec.xml
> @@ -5,15 +5,18 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>It can be dangerous to allow the execution of binaries
> - from world-writable temporary storage directories such as /dev/shm.
> - The noexec mount option prevents binaries from being executed out
> of /dev/shm.</description>
> + <description>It can be dangerous to allow the execution of binaries
> from
> + world-writable temporary storage directories such as /dev/shm. The
> noexec
> + mount option prevents binaries from being executed out of
> + /dev/shm.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="noexec on /dev/shm"
> test_ref="test_noexec_dev_shm" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_noexec_dev_shm" version="1" comment="noexec on /dev/shm">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_noexec_dev_shm" version="1" comment="noexec on /dev/shm">
> <linux:object object_ref="object_dev_shm_partition_noexec" />
> <linux:state state_ref="state_dev_shm_noexec" />
> </linux:partition_test>
> @@ -21,6 +24,7 @@
> <linux:mount_point>/dev/shm</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_dev_shm_noexec" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">noexec</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">noexec</linux:mount_options>
> </linux:partition_state>
> </def-group>
> diff --git a/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml
> b/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml
> index e7c517d..2bc1463 100644
> --- a/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml
> +++ b/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml
> @@ -5,15 +5,17 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>The nosuid mount option should be set for temporary
> - storage partitions such as /dev/shm. The suid/sgid permissions
> - should not be required in these world-writable
> directories.</description>
> + <description>The nosuid mount option should be set for temporary
> storage
> + partitions such as /dev/shm. The suid/sgid permissions should not be
> + required in these world-writable directories.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="nosuid on /dev/shm"
> test_ref="test_nosuid_dev_shm" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_nosuid_dev_shm" version="1" comment="nosuid on /dev/shm">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_nosuid_dev_shm" version="1" comment="nosuid on /dev/shm">
> <linux:object object_ref="object_dev_shm_partition_nosuid" />
> <linux:state state_ref="state_dev_shm_nosuid" />
> </linux:partition_test>
> @@ -21,6 +23,7 @@
> <linux:mount_point>/dev/shm</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_dev_shm_nosuid" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nosuid</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">nosuid</linux:mount_options>
> </linux:partition_state>
> </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130918/90461011/attachment.html>
More information about the scap-security-guide
mailing list