<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">It's not in the STIG, it's in the XCCDF
prose. The check exists now, but it's broken.<br>
<br>
Also, what Shawn said in the other thread.<br>
<br>
- Maura Dailey<br>
<br>
On 09/10/2013 12:56 PM, leam hall wrote:<br>
</div>
<blockquote
cite="mid:CACv9p5p=JwveELLXT69sv=VYXXgrOwQyJmxNV-+S=wN4zbv9tA@mail.gmail.com"
type="cite">
<div dir="ltr">What's the GENID on this? I didn't find it in the
Jun STIG.<br>
<br>
Thanks!<br>
<br>
Leam<br>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Tue, Sep 10, 2013 at 12:49 PM, Maura
Dailey <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Signed-off-by: Maura Dailey <<a moz-do-not-send="true"
href="mailto:maura@eclipse.ncsc.mil">maura@eclipse.ncsc.mil</a>><br>
---<br>
RHEL6/input/checks/mount_option_var_tmp_bind.xml | 44
+++++++++++++++-------<br>
1 files changed, 30 insertions(+), 14 deletions(-)<br>
<br>
diff --git
a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
index 4d549c2..02630a7 100644<br>
--- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
+++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
@@ -5,24 +5,40 @@<br>
<affected family="unix"><br>
<platform>Red Hat Enterprise Linux
6</platform><br>
</affected><br>
- <description>The /var/tmp directory should be
bind mounted to /tmp<br>
- in order to consolidate temporary storage into one
location protected by the same<br>
- techniques as /tmp.</description><br>
+ <description>The /var/tmp directory should be
bind mounted to /tmp in<br>
+ order to consolidate temporary storage into one
location protected by the<br>
+ same techniques as /tmp.</description><br>
+ <reference source="MED" ref_id="20130821"
ref_url="test_attestation" /><br>
</metadata><br>
- <criteria><br>
- <criterion comment="Unknown test stub"
test_ref="test_bind_mount_var_tmp" /><br>
+ <criteria operator="AND"><br>
+ <criterion comment="Ensure /var/tmp is mounted"<br>
+ test_ref="test_mount_option_var_tmp" /><br>
+ <criterion comment="Ensure /tmp is bind mounted"<br>
+ test_ref="test_mount_option_var_tmp_bind" /><br>
</criteria><br>
</definition><br>
+ <linux:partition_test id="test_mount_option_var_tmp"
version="1"<br>
+ comment="Ensure /var/tmp is mounted" check="all"><br>
+ <linux:object
object_ref="object_mount_option_var_tmp" /><br>
+ </linux:partition_test><br>
+ <linux:partition_object
id="object_mount_option_var_tmp" version="1"><br>
+ <linux:mount_point operation="pattern
match">/var/tmp</linux:mount_point><br>
+ </linux:partition_object><br>
<br>
- <ind:textfilecontent54_test check="all"
check_existence="at_least_one_exists" comment="bind mount
/var/tmp to /tmp" id="test_bind_mount_var_tmp"
version="1"><br>
- <ind:object object_ref="object_bind_mount_var_tmp"
/><br>
- </ind:textfilecontent54_test><br>
+ <!-- The linux:partition_test reads from /proc/mounts,
which does not record<br>
+ the bind mount option. As a result, the less elegant
textfilecontent54_test<br>
+ is required here. --><br>
<br>
- <ind:textfilecontent54_object comment="look for the
partition mount point in /etc/fstab"
id="object_bind_mount_var_tmp" version="1"><br>
- <ind:path>/etc</ind:path><br>
- <ind:filename>fstab</ind:filename><br>
- <ind:pattern operation="pattern
match">^\s*/tmp\s+/var/tmp\s.*bind.*$</ind:pattern><br>
- <ind:instance datatype="int" operation="greater than
or equal">1</ind:instance><br>
+ <ind:textfilecontent54_test check="all"
check_existence="at_least_one_exists"<br>
+ comment="Ensure bind mount option is on /var/tmp"<br>
+ id="test_mount_option_var_tmp_bind" version="1"><br>
+ <ind:object
object_ref="object_mount_option_var_tmp_bind" /><br>
+ </ind:textfilecontent54_test><br>
+ <ind:textfilecontent54_object comment="look for the
partition mount point in /etc/mtab"<br>
+ id="object_mount_option_var_tmp_bind" version="1"><br>
+ <ind:filepath>/etc/mtab</ind:filepath><br>
+ <ind:pattern operation="pattern
match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern><br>
+ <ind:instance datatype="int" operation="greater than
or equal"><br>
+ 1</ind:instance><br>
</ind:textfilecontent54_object><br>
-<br>
</def-group><br>
<span class="HOEnZb"><font color="#888888">--<br>
1.7.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a moz-do-not-send="true"
href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div><a moz-do-not-send="true"
href="http://leamhall.blogspot.com/" target="_blank">Mind on
a Mission</a></div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</blockquote>
<br>
</body>
</html>