[PATCH] More testrefs, this time for mount_option_tmp checks
David Smith
dsmith at eclipse.ncsc.mil
Wed Sep 18 16:10:57 UTC 2013
Agreed, please push these!
On Wed, Sep 18, 2013 at 11:59 AM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:
> More outstanding testrefs that should be committed!
>
> ---
> RHEL6/input/checks/mount_option_tmp_nodev.xml | 11 +++++++----
> RHEL6/input/checks/mount_option_tmp_noexec.xml | 14 +++++++++-----
> RHEL6/input/checks/mount_option_tmp_nosuid.xml | 13 ++++++++-----
> 3 files changed, 24 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/checks/mount_option_tmp_nodev.xml
> b/RHEL6/input/checks/mount_option_tmp_nodev.xml
> index d741d29..fdd2420 100644
> --- a/RHEL6/input/checks/mount_option_tmp_nodev.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_nodev.xml
> @@ -6,14 +6,16 @@
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> <description>Legitimate character and block devices should not exist
> - within temporary directories like /tmp. The nodev mount option
> should
> - be specified for /tmp.</description>
> + within temporary directories like /tmp. The nodev mount option
> should be
> + specified for /tmp.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="nodev on /tmp" test_ref="test_nodev_tmp" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_nodev_tmp" version="1" comment="nodev on /tmp">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_nodev_tmp" version="1" comment="nodev on /tmp">
> <linux:object object_ref="object_tmp_nodev_partition" />
> <linux:state state_ref="state_tmp_nodev" />
> </linux:partition_test>
> @@ -21,6 +23,7 @@
> <linux:mount_point>/tmp</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_tmp_nodev" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nodev</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">nodev</linux:mount_options>
> </linux:partition_state>
> </def-group>
> diff --git a/RHEL6/input/checks/mount_option_tmp_noexec.xml
> b/RHEL6/input/checks/mount_option_tmp_noexec.xml
> index d0593f8..76d8192 100644
> --- a/RHEL6/input/checks/mount_option_tmp_noexec.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_noexec.xml
> @@ -5,15 +5,18 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>It can be dangerous to allow the execution of binaries
> - from world-writable temporary storage directories such as /tmp.
> - The noexec mount option prevents binaries from being executed out
> of /tmp.</description>
> + <description>It can be dangerous to allow the execution of binaries
> from
> + world-writable temporary storage directories such as /tmp. The
> noexec
> + mount option prevents binaries from being executed out of
> + /tmp.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="noexec on /tmp" test_ref="test_noexec_tmp" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_noexec_tmp" version="1" comment="noexec on /tmp">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_noexec_tmp" version="1" comment="noexec on /tmp">
> <linux:object object_ref="object_tmp_noexec_partition" />
> <linux:state state_ref="state_tmp_noexec" />
> </linux:partition_test>
> @@ -21,6 +24,7 @@
> <linux:mount_point>/tmp</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_tmp_noexec" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">noexec</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">noexec</linux:mount_options>
> </linux:partition_state>
> </def-group>
> diff --git a/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> b/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> index 6477a21..b3d88c9 100644
> --- a/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> @@ -5,15 +5,17 @@
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> - <description>The nosuid mount option should be set for temporary
> - storage partitions such as /tmp. The suid/sgid permissions
> - should not be required in these world-writable
> directories.</description>
> + <description>The nosuid mount option should be set for temporary
> storage
> + partitions such as /tmp. The suid/sgid permissions should not be
> required
> + in these world-writable directories.</description>
> + <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
> </metadata>
> <criteria>
> <criterion comment="nosuid on /tmp" test_ref="test_nosuid_tmp" />
> </criteria>
> </definition>
> - <linux:partition_test check="all" check_existence="all_exist"
> id="test_nosuid_tmp" version="1" comment="nosuid on /tmp">
> + <linux:partition_test check="all" check_existence="all_exist"
> + id="test_nosuid_tmp" version="1" comment="nosuid on /tmp">
> <linux:object object_ref="object_tmp_nosuid_partition" />
> <linux:state state_ref="state_tmp_nosuid" />
> </linux:partition_test>
> @@ -21,6 +23,7 @@
> <linux:mount_point>/tmp</linux:mount_point>
> </linux:partition_object>
> <linux:partition_state id="state_tmp_nosuid" version="1">
> - <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nosuid</linux:mount_options>
> + <linux:mount_options datatype="string" entity_check="at least one"
> + operation="equals">nosuid</linux:mount_options>
> </linux:partition_state>
> </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130918/9c2ccaf4/attachment-0001.html>
More information about the scap-security-guide
mailing list