[PATCH] More testrefs, this time for mount_option_tmp checks

David Smith dsmith at eclipse.ncsc.mil
Wed Sep 18 16:10:57 UTC 2013


Agreed, please push these!


On Wed, Sep 18, 2013 at 11:59 AM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:

> More outstanding testrefs that should be committed!
>
> ---
>  RHEL6/input/checks/mount_option_tmp_nodev.xml  |   11 +++++++----
>  RHEL6/input/checks/mount_option_tmp_noexec.xml |   14 +++++++++-----
>  RHEL6/input/checks/mount_option_tmp_nosuid.xml |   13 ++++++++-----
>  3 files changed, 24 insertions(+), 14 deletions(-)
>
> diff --git a/RHEL6/input/checks/mount_option_tmp_nodev.xml
> b/RHEL6/input/checks/mount_option_tmp_nodev.xml
> index d741d29..fdd2420 100644
> --- a/RHEL6/input/checks/mount_option_tmp_nodev.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_nodev.xml
> @@ -6,14 +6,16 @@
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
>        <description>Legitimate character and block devices should not exist
> -      within temporary directories like /tmp. The nodev mount option
> should
> -      be specified for /tmp.</description>
> +      within temporary directories like /tmp. The nodev mount option
> should be
> +      specified for /tmp.</description>
> +      <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
>      </metadata>
>      <criteria>
>        <criterion comment="nodev on /tmp" test_ref="test_nodev_tmp" />
>      </criteria>
>    </definition>
> -  <linux:partition_test check="all" check_existence="all_exist"
> id="test_nodev_tmp" version="1" comment="nodev on /tmp">
> +  <linux:partition_test check="all" check_existence="all_exist"
> +  id="test_nodev_tmp" version="1" comment="nodev on /tmp">
>      <linux:object object_ref="object_tmp_nodev_partition" />
>      <linux:state state_ref="state_tmp_nodev" />
>    </linux:partition_test>
> @@ -21,6 +23,7 @@
>      <linux:mount_point>/tmp</linux:mount_point>
>    </linux:partition_object>
>    <linux:partition_state id="state_tmp_nodev" version="1">
> -    <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nodev</linux:mount_options>
> +    <linux:mount_options datatype="string" entity_check="at least one"
> +    operation="equals">nodev</linux:mount_options>
>    </linux:partition_state>
>  </def-group>
> diff --git a/RHEL6/input/checks/mount_option_tmp_noexec.xml
> b/RHEL6/input/checks/mount_option_tmp_noexec.xml
> index d0593f8..76d8192 100644
> --- a/RHEL6/input/checks/mount_option_tmp_noexec.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_noexec.xml
> @@ -5,15 +5,18 @@
>        <affected family="unix">
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
> -      <description>It can be dangerous to allow the execution of binaries
> -      from world-writable temporary storage directories such as /tmp.
> -      The noexec mount option prevents binaries from being executed out
> of /tmp.</description>
> +      <description>It can be dangerous to allow the execution of binaries
> from
> +      world-writable temporary storage directories such as /tmp. The
> noexec
> +      mount option prevents binaries from being executed out of
> +      /tmp.</description>
> +      <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
>      </metadata>
>      <criteria>
>        <criterion comment="noexec on /tmp" test_ref="test_noexec_tmp" />
>      </criteria>
>    </definition>
> -  <linux:partition_test check="all" check_existence="all_exist"
> id="test_noexec_tmp" version="1" comment="noexec on /tmp">
> +  <linux:partition_test check="all" check_existence="all_exist"
> +  id="test_noexec_tmp" version="1" comment="noexec on /tmp">
>      <linux:object object_ref="object_tmp_noexec_partition" />
>      <linux:state state_ref="state_tmp_noexec" />
>    </linux:partition_test>
> @@ -21,6 +24,7 @@
>      <linux:mount_point>/tmp</linux:mount_point>
>    </linux:partition_object>
>    <linux:partition_state id="state_tmp_noexec" version="1">
> -    <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">noexec</linux:mount_options>
> +    <linux:mount_options datatype="string" entity_check="at least one"
> +    operation="equals">noexec</linux:mount_options>
>    </linux:partition_state>
>  </def-group>
> diff --git a/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> b/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> index 6477a21..b3d88c9 100644
> --- a/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> +++ b/RHEL6/input/checks/mount_option_tmp_nosuid.xml
> @@ -5,15 +5,17 @@
>        <affected family="unix">
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
> -      <description>The nosuid mount option should be set for temporary
> -      storage partitions such as /tmp. The suid/sgid permissions
> -      should not be required in these world-writable
> directories.</description>
> +      <description>The nosuid mount option should be set for temporary
> storage
> +      partitions such as /tmp. The suid/sgid permissions should not be
> required
> +      in these world-writable directories.</description>
> +      <reference source="MED" ref_id="20130821"
> ref_url="test_attestation" />
>      </metadata>
>      <criteria>
>        <criterion comment="nosuid on /tmp" test_ref="test_nosuid_tmp" />
>      </criteria>
>    </definition>
> -  <linux:partition_test check="all" check_existence="all_exist"
> id="test_nosuid_tmp" version="1" comment="nosuid on /tmp">
> +  <linux:partition_test check="all" check_existence="all_exist"
> +  id="test_nosuid_tmp" version="1" comment="nosuid on /tmp">
>      <linux:object object_ref="object_tmp_nosuid_partition" />
>      <linux:state state_ref="state_tmp_nosuid" />
>    </linux:partition_test>
> @@ -21,6 +23,7 @@
>      <linux:mount_point>/tmp</linux:mount_point>
>    </linux:partition_object>
>    <linux:partition_state id="state_tmp_nosuid" version="1">
> -    <linux:mount_options datatype="string" entity_check="at least one"
> operation="equals">nosuid</linux:mount_options>
> +    <linux:mount_options datatype="string" entity_check="at least one"
> +    operation="equals">nosuid</linux:mount_options>
>    </linux:partition_state>
>  </def-group>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130918/9c2ccaf4/attachment-0001.html>


More information about the scap-security-guide mailing list