[PATCH 08/26] XCCDF Rule Rename
Shawn Wells
shawn at redhat.com
Tue Apr 15 18:31:25 UTC 2014
-------------- next part --------------
>From 9971e36b2517692df1dd7ad0d266b6898568b0d7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 13 Apr 2014 01:27:54 -0400
Subject: [PATCH 08/26] XCCDF Rule Rename: disable_setuid_coredumps --> sysctl_fs_suid_dumpable
Changed to fall in line with sysctl naming standards
---
RHEL/6/input/profiles/CS2.xml | 2 +-
RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 2 +-
RHEL/6/input/profiles/nist-CL-IL-AL.xml | 4 +++-
.../input/profiles/stig-rhel6-server-upstream.xml | 11 ++++++++++-
RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL/6/input/system/permissions/execution.xml | 2 +-
6 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index 8221e00..d0aa738 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -170,7 +170,7 @@
<select idref="group_owner_grub_conf" selected="true"/>
<select idref="permissions_grub_conf" selected="true"/>
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
<select idref="service_restorecond_enabled" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
diff --git a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
index 17e3fdf..82408ec 100644
--- a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
+++ b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
@@ -263,7 +263,7 @@
<select idref="enable_execshield" selected="true" />
<select idref="sysctl_kernel_randomize_va_space" selected="true" />
<select idref="bios_enable_execution_restrictions" selected="true" />
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
<select idref="disable_xwindows_with_runlevel" selected="true" />
<select idref="world_writeable_files" selected="true" />
</Profile>
diff --git a/RHEL/6/input/profiles/nist-CL-IL-AL.xml b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
index 06d2c69..7d38804 100644
--- a/RHEL/6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
@@ -15,7 +15,9 @@ assurance."</description>
AC-2(3): The information system automatically disables inactive accounts after
[Assignment: organization-defined time period] -->
-<refine-value idref="var_account_disable_post_pw_expiration" selector="60" \>
+
+<!-- sdw -->
+<refine-value idref="var_account_disable_post_pw_expiration" selector="40" \>
<!-- AC-3: "Access control policies... and access control mechanisms... are
employed by organizations to control access between users... and objects.
diff --git a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
index 11a5687..b18679f 100644
--- a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
+++ b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml
@@ -3,7 +3,16 @@
<description>This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process,
serving as the upstream development environment for the Red Hat Enterprise Linux 6 Server STIG.
-For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/os/unix/red_hat.html</description>
+As a result of the upstream/downstream relationship between the SCAP Security Guide project
+and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content.
+For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/os/unix/red_hat.html.
+
+While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note
+that commercial support of this SCAP content is NOT available. This profile is provided as example
+SCAP content with no endorsement for suitability or production readiness. Support for this
+profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The
+upstream project homepage is https://fedorahosted.org/scap-security-guide/.
+</description>
<select idref="encrypt_partitions" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 1716e73..bff1d8f 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -54,7 +54,7 @@
<select idref="world_writable_files_system_ownership" selected="true" />
<refine-value idref="var_umask_for_daemons" selector="027"/>
<select idref="umask_for_daemons" selected="true" />
-<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="sysctl_fs_suid_dumpable" selected="true" />
<select idref="disable_users_coredumps" selected="true" />
<select idref="sysctl_kernel_randomize_va_space" selected="true" />
<select idref="enable_execshield" selected="true" />
diff --git a/RHEL/6/input/system/permissions/execution.xml b/RHEL/6/input/system/permissions/execution.xml
index c381d1d..622438a 100644
--- a/RHEL/6/input/system/permissions/execution.xml
+++ b/RHEL/6/input/system/permissions/execution.xml
@@ -91,7 +91,7 @@ only for developers trying to debug problems.</rationale>
</Rule>
-<Rule id="disable_setuid_coredumps">
+<Rule id="sysctl_fs_suid_dumpable">
<title>Disable Core Dumps for SUID programs</title>
<description><sysctl-desc-macro sysctl="fs.suid_dumpable" value="0" /></description>
<ocil><sysctl-check-macro sysctl="fs.suid_dumpable" value="0" /></ocil>
--
1.7.1
More information about the scap-security-guide
mailing list