<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">It's not in the STIG, it's in the XCCDF
      prose. The check exists now, but it's broken.<br>
      <br>
      Also, what Shawn said in the other thread.<br>
      <br>
      - Maura Dailey<br>
      <br>
      On 09/10/2013 12:56 PM, leam hall wrote:<br>
    </div>
    <blockquote
cite="mid:CACv9p5p=JwveELLXT69sv=VYXXgrOwQyJmxNV-+S=wN4zbv9tA@mail.gmail.com"
      type="cite">
      <div dir="ltr">What's the GENID on this? I didn't find it in the
        Jun STIG.<br>
        <br>
        Thanks!<br>
        <br>
        Leam<br>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Tue, Sep 10, 2013 at 12:49 PM, Maura
          Dailey <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
            Signed-off-by: Maura Dailey &lt;<a moz-do-not-send="true"
              href="mailto:maura@eclipse.ncsc.mil">maura@eclipse.ncsc.mil</a>&gt;<br>
            ---<br>
             RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44
            +++++++++++++++-------<br>
             1 files changed, 30 insertions(+), 14 deletions(-)<br>
            <br>
            diff --git
            a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
            b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            index 4d549c2..02630a7 100644<br>
            --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            @@ -5,24 +5,40 @@<br>
                   &lt;affected family="unix"&gt;<br>
                     &lt;platform&gt;Red Hat Enterprise Linux
            6&lt;/platform&gt;<br>
                   &lt;/affected&gt;<br>
            -      &lt;description&gt;The /var/tmp directory should be
            bind mounted to /tmp<br>
            -      in order to consolidate temporary storage into one
            location protected by the same<br>
            -      techniques as /tmp.&lt;/description&gt;<br>
            +      &lt;description&gt;The /var/tmp directory should be
            bind mounted to /tmp in<br>
            +      order to consolidate temporary storage into one
            location protected by the<br>
            +      same techniques as /tmp.&lt;/description&gt;<br>
            +      &lt;reference source="MED" ref_id="20130821"
            ref_url="test_attestation" /&gt;<br>
                 &lt;/metadata&gt;<br>
            -    &lt;criteria&gt;<br>
            -      &lt;criterion comment="Unknown test stub"
            test_ref="test_bind_mount_var_tmp" /&gt;<br>
            +    &lt;criteria operator="AND"&gt;<br>
            +      &lt;criterion comment="Ensure /var/tmp is mounted"<br>
            +      test_ref="test_mount_option_var_tmp" /&gt;<br>
            +      &lt;criterion comment="Ensure /tmp is bind mounted"<br>
            +      test_ref="test_mount_option_var_tmp_bind" /&gt;<br>
                 &lt;/criteria&gt;<br>
               &lt;/definition&gt;<br>
            +  &lt;linux:partition_test id="test_mount_option_var_tmp"
            version="1"<br>
            +  comment="Ensure /var/tmp is mounted" check="all"&gt;<br>
            +    &lt;linux:object
            object_ref="object_mount_option_var_tmp" /&gt;<br>
            +  &lt;/linux:partition_test&gt;<br>
            +  &lt;linux:partition_object
            id="object_mount_option_var_tmp" version="1"&gt;<br>
            +    &lt;linux:mount_point operation="pattern
            match"&gt;/var/tmp&lt;/linux:mount_point&gt;<br>
            +  &lt;/linux:partition_object&gt;<br>
            <br>
            -  &lt;ind:textfilecontent54_test check="all"
            check_existence="at_least_one_exists" comment="bind mount
            /var/tmp to /tmp" id="test_bind_mount_var_tmp"
            version="1"&gt;<br>
            -    &lt;ind:object object_ref="object_bind_mount_var_tmp"
            /&gt;<br>
            -  &lt;/ind:textfilecontent54_test&gt;<br>
            +  &lt;!-- The linux:partition_test reads from /proc/mounts,
            which does not record<br>
            +       the bind mount option. As a result, the less elegant
            textfilecontent54_test<br>
            +       is required here. --&gt;<br>
            <br>
            -  &lt;ind:textfilecontent54_object comment="look for the
            partition mount point in /etc/fstab"
            id="object_bind_mount_var_tmp" version="1"&gt;<br>
            -    &lt;ind:path&gt;/etc&lt;/ind:path&gt;<br>
            -    &lt;ind:filename&gt;fstab&lt;/ind:filename&gt;<br>
            -    &lt;ind:pattern operation="pattern
            match"&gt;^\s*/tmp\s+/var/tmp\s.*bind.*$&lt;/ind:pattern&gt;<br>
            -    &lt;ind:instance datatype="int" operation="greater than
            or equal"&gt;1&lt;/ind:instance&gt;<br>
            +  &lt;ind:textfilecontent54_test check="all"
            check_existence="at_least_one_exists"<br>
            +  comment="Ensure bind mount option is on /var/tmp"<br>
            +  id="test_mount_option_var_tmp_bind" version="1"&gt;<br>
            +    &lt;ind:object
            object_ref="object_mount_option_var_tmp_bind" /&gt;<br>
            +  &lt;/ind:textfilecontent54_test&gt;<br>
            +  &lt;ind:textfilecontent54_object comment="look for the
            partition mount point in /etc/mtab"<br>
            +  id="object_mount_option_var_tmp_bind" version="1"&gt;<br>
            +    &lt;ind:filepath&gt;/etc/mtab&lt;/ind:filepath&gt;<br>
            +    &lt;ind:pattern operation="pattern
            match"&gt;^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$&lt;/ind:pattern&gt;<br>
            +    &lt;ind:instance datatype="int" operation="greater than
            or equal"&gt;<br>
            +    1&lt;/ind:instance&gt;<br>
               &lt;/ind:textfilecontent54_object&gt;<br>
            -<br>
             &lt;/def-group&gt;<br>
            <span class="HOEnZb"><font color="#888888">--<br>
                1.7.1<br>
                <br>
                _______________________________________________<br>
                scap-security-guide mailing list<br>
                <a moz-do-not-send="true"
                  href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
                <a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide"
                  target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
              </font></span></blockquote>
        </div>
        <br>
        <br clear="all">
        <br>
        -- <br>
        <div><a moz-do-not-send="true"
            href="http://leamhall.blogspot.com/" target="_blank">Mind on
            a Mission</a></div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>