[PATCH 08/26] XCCDF Rule Rename

Shawn Wells shawn at redhat.com
Tue Apr 15 18:31:25 UTC 2014


-------------- next part --------------
>From 9971e36b2517692df1dd7ad0d266b6898568b0d7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 13 Apr 2014 01:27:54 -0400
Subject: [PATCH 08/26] XCCDF Rule Rename: disable_setuid_coredumps --> sysctl_fs_suid_dumpable

Changed to fall in line with sysctl naming standards
---
 RHEL/6/input/profiles/CS2.xml                      |    2 +-
 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml           |    2 +-
 RHEL/6/input/profiles/nist-CL-IL-AL.xml            |    4 +++-
 .../input/profiles/stig-rhel6-server-upstream.xml  |   11 ++++++++++-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |    2 +-
 RHEL/6/input/system/permissions/execution.xml      |    2 +-
 6 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index 8221e00..d0aa738 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -170,7 +170,7 @@
 <select idref="group_owner_grub_conf" selected="true"/>
 <select idref="permissions_grub_conf" selected="true"/>
 
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
 <select idref="service_restorecond_enabled" selected="true" />
 
 <select idref="selinux_confinement_of_daemons" selected="true" />
diff --git a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
index 17e3fdf..82408ec 100644
--- a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
+++ b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
@@ -263,7 +263,7 @@
 <select idref="enable_execshield" selected="true" />
 <select idref="sysctl_kernel_randomize_va_space" selected="true" />
 <select idref="bios_enable_execution_restrictions" selected="true" />
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
 <select idref="disable_xwindows_with_runlevel" selected="true" />
 <select idref="world_writeable_files" selected="true" />
 </Profile>
diff --git a/RHEL/6/input/profiles/nist-CL-IL-AL.xml b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
index 06d2c69..7d38804 100644
--- a/RHEL/6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
@@ -15,7 +15,9 @@ assurance."</description>
 
 	AC-2(3): The information system automatically disables inactive accounts after
 	[Assignment: organization-defined time period] -->
-<refine-value idref="var_account_disable_post_pw_expiration" selector="60" \>
+
+<!-- sdw -->
+<refine-value idref="var_account_disable_post_pw_expiration" selector="40" \>
 
 <!--	AC-3:	"Access control policies... and access control mechanisms... are
      	employed by organizations to control access between users... and objects.
diff --git a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
index 11a5687..b18679f 100644
--- a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
+++ b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
@@ -3,7 +3,16 @@
 <description>This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process,
 serving as the upstream development environment for the Red Hat Enterprise Linux 6 Server STIG.
 
-For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/os/unix/red_hat.html</description>
+As a result of the upstream/downstream relationship between the SCAP Security Guide project 
+and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content.
+For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/os/unix/red_hat.html.
+
+While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note 
+that commercial support of this SCAP content is NOT available. This profile is provided as example 
+SCAP content with no endorsement for suitability or production readiness. Support for this 
+profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The
+upstream project homepage is https://fedorahosted.org/scap-security-guide/.
+</description>
 
 <select idref="encrypt_partitions" selected="true"/>
 
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 1716e73..bff1d8f 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -54,7 +54,7 @@
 <select idref="world_writable_files_system_ownership" selected="true" />
 <refine-value idref="var_umask_for_daemons" selector="027"/>
 <select idref="umask_for_daemons" selected="true" />
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
 <select idref="disable_users_coredumps" selected="true" />
 <select idref="sysctl_kernel_randomize_va_space" selected="true" />
 <select idref="enable_execshield" selected="true" />
diff --git a/RHEL/6/input/system/permissions/execution.xml b/RHEL/6/input/system/permissions/execution.xml
index c381d1d..622438a 100644
--- a/RHEL/6/input/system/permissions/execution.xml
+++ b/RHEL/6/input/system/permissions/execution.xml
@@ -91,7 +91,7 @@ only for developers trying to debug problems.</rationale>
 </Rule>
 
 
-<Rule id="disable_setuid_coredumps">
+<Rule id="sysctl_fs_suid_dumpable">
 <title>Disable Core Dumps for SUID programs</title>
 <description><sysctl-desc-macro sysctl="fs.suid_dumpable" value="0" /></description>
 <ocil><sysctl-check-macro sysctl="fs.suid_dumpable" value="0" /></ocil>
-- 
1.7.1



More information about the scap-security-guide mailing list