[PATCH 2/5] Style update of CSCF profile

Shawn Wells shawn at redhat.com
Mon May 12 01:30:40 UTC 2014


Moving all refine-values to the top of the profile for clarity.

Signed-off-by: Shawn Wells <shawn at redhat.com>
---
 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml |   18 ++++++++++++------
 1 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
index 82408ec..0a6c206 100644
--- a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
+++ b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
@@ -1,6 +1,17 @@
 <Profile id="CSCF-RHEL6-MLS">
 <title>CSCF RHEL6 MLS Core Baseline</title>
-<description> This profile reflects the Centralized Super Computing Facility (CSCF) baseline for Red Hat Enterprise Linux 6. This baseline has received government ATO through the ICD 503 process, utilizing the CNSSI 1253 cross domain overlay. This profile should be considered in active development. Additional tailoring will be needed, such as the creation of RBAC roles for production deployment.</description>
+<description> This profile reflects the Centralized Super Computing Facility 
+(CSCF) baseline for Red Hat Enterprise Linux 6. This baseline has received 
+government ATO through the ICD 503 process, utilizing the CNSSI 1253 cross 
+domain overlay. This profile should be considered in active development. 
+Additional tailoring will be needed, such as the creation of RBAC roles 
+for production deployment.</description>
+
+<refine-value idref="var_auditd_max_log_file_action"  selector="keep_logs" />
+<refine-value idref="var_accounts_max_concurrent_login_sessions" selector="3" />
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="180" />
+<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
+<refine-value idref="var_selinux_policy_name" selector="mls" />
 
 <select idref="account_disable_post_pw_expiration" selected="true" />
 <select idref="account_temp_expire_date" selected="true" />
@@ -46,7 +57,6 @@
 <select idref="configure_auditd_audispd" selected="true" />
 <select idref="configure_auditd_max_log_file" selected="true" />
 <select idref="configure_auditd_max_log_file_action" selected="true" />
-<refine-value idref="var_auditd_max_log_file_action"  selector="keep_logs" />
 <select idref="configure_auditd_num_logs" selected="true" />
 <select idref="auditd_data_retention_space_left_action" selected="true" />
 <select idref="cups_disable_browsing" selected="true" />
@@ -129,7 +139,6 @@
 <select idref="mountopt_noexec_on_removable_partitions" selected="true" />
 <select idref="mountopt_nosuid_on_removable_partitions" selected="true" />
 <select idref="accounts_max_concurrent_login_sessions" selected="true" />
-<refine-value idref="var_accounts_max_concurrent_login_sessions" selector="3" />
 <select idref="network_disable_zeroconf" selected="true" />
 <select idref="network_ipv6_disable_rpc" selected="true" />
 <select idref="network_sniffer_disabled" selected="true" />
@@ -151,9 +160,7 @@
 <select idref="partition_for_var_log" selected="true" />
 <select idref="partition_for_var_log_audit" selected="true" />
 <select idref="accounts_maximum_age_login_defs" selected="true" />
-<refine-value idref="var_accounts_maximum_age_login_defs" selector="180" />
 <select idref="accounts_password_minlen_login_defs" selected="true" />
-<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
 <select idref="password_require_consecrepeat" selected="true" />
 <select idref="accounts_password_pam_cracklib_difok" selected="true" />
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true" />
@@ -221,7 +228,6 @@
 <select idref="set_password_hashing_algorithm_libuserconf" selected="true" />
 <select idref="set_screensaver_inactivity_timeout" selected="true" />
 <select idref="selinux_policytype" selected="true" />
-<refine-value idref="var_selinux_policy_name" selector="mls" />
 <select idref="selinux_state" selected="true" />
 <select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
 <select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true" />
-- 
1.7.1



More information about the scap-security-guide mailing list