<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 12/14/12 2:10 PM, David Smith wrote:<br>
    </div>
    <blockquote
      cite="mid:1355512254-10231-2-git-send-email-dsmith@eclipse.ncsc.mil"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">Signed-off-by: David Smith <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:dsmith@eclipse.ncsc.mil">&lt;dsmith@eclipse.ncsc.mil&gt;</a>
---
 RHEL6/input/system/logging.xml                |    3 +++
 RHEL6/input/system/permissions/execution.xml  |    5 +++++
 RHEL6/input/system/permissions/partitions.xml |    5 +++++
 3 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index ff08cb8..514859d 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -383,6 +383,9 @@ enabled.&lt;/description&gt;
 &lt;rationale&gt;Log files that are not properly rotated run the risk of growing so large
 that they fill up the /var/log partition. Valuable logging information could be lost
 if the /var/log partition becomes full.&lt;/rationale&gt;
+&lt;ocil&gt;
+&lt;service-enable-check-macro service="logrotate" /&gt;
+&lt;/ocil&gt;
 &lt;ident cce="4182-2" /&gt;
 &lt;oval id="logrotate_rotate_all_files" /&gt;
 &lt;ref nist="AU-2, AU-9, CM-6" disa="366" /&gt;
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index a80c40a..03e1c44 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -37,6 +37,11 @@ Setting the umask to too restrictive a setting can cause serious errors at
 runtime.  Many daemons on the system already individually restrict themselves to
 a umask of 077 in their own init scripts.
 &lt;/description&gt;
+&lt;ocil clause="it does not"&gt;
+To check the value of the &lt;tt&gt;umask&lt;/tt&gt;, run the following command:
+&lt;pre&gt;$ grep umask /etc/init.d/functions&lt;/pre&gt;
+The output should show either &lt;tt&gt;022&lt;/tt&gt; or &lt;tt&gt;027&lt;/tt&gt;.
+&lt;/ocil&gt;</pre>
      </div>
    </blockquote>
    <br>
    What about /etc/profile, /etc/bashrc, /etc/csh.cshrc, etc?<br>
    <br>
    <br>
    <blockquote
      cite="mid:1355512254-10231-2-git-send-email-dsmith@eclipse.ncsc.mil"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap=""> &lt;rationale&gt;The umask influences the permissions assigned to files created by a
 process at run time.  An unnecessarily permissive umask could result in files
 being created with insecure permissions.&lt;/rationale&gt;
diff --git a/RHEL6/input/system/permissions/partitions.xml b/RHEL6/input/system/permissions/partitions.xml
index 4efa626..8dd7720 100644
--- a/RHEL6/input/system/permissions/partitions.xml
+++ b/RHEL6/input/system/permissions/partitions.xml
@@ -64,6 +64,11 @@ certain types of worms or malicious code.
 &lt;/description&gt;
 &lt;rationale&gt;Allowing users to execute binaries from removable media such as USB keys exposes
 the system to potential compromise.&lt;/rationale&gt;
+&lt;ocil clause="it does not"&gt;
+To verify that binaries cannot be directly executed from removable media, run the following command:
+&lt;pre&gt;# grep noexec /etc/fstab&lt;/pre&gt;
+The output should show &lt;tt&gt;noexec&lt;/tt&gt; in use.
+&lt;/ocil&gt;
 &lt;ident cce="4275-4" /&gt;
 &lt;oval id="mount_option_noexec_removable_partitions" value="var_removable_partition" /&gt;
 &lt;ref nist="CM-7, MP-2" disa="87" /&gt;
<div class="moz-txt-sig">-- 
1.7.1
</div></pre>
      </div>
    </blockquote>
    <br>
  </body>
</html>