<div dir="ltr">Ah, I need to figure out how to have the SSG just check for STIG findings. Cool. <br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 10, 2013 at 1:30 PM, Maura Dailey <span dir="ltr">&lt;<a href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <div>It&#39;s not in the STIG, it&#39;s in the XCCDF
      prose. The check exists now, but it&#39;s broken.<br>
      <br>
      Also, what Shawn said in the other thread.<span class="HOEnZb"><font color="#888888"><br>
      <br>
      - Maura Dailey</font></span><div><div class="h5"><br>
      <br>
      On 09/10/2013 12:56 PM, leam hall wrote:<br>
    </div></div></div><div><div class="h5">
    <blockquote type="cite">
      <div dir="ltr">What&#39;s the GENID on this? I didn&#39;t find it in the
        Jun STIG.<br>
        <br>
        Thanks!<br>
        <br>
        Leam<br>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Tue, Sep 10, 2013 at 12:49 PM, Maura
          Dailey <span dir="ltr">&lt;<a href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
            Signed-off-by: Maura Dailey &lt;<a href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;<br>
            ---<br>
             RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44
            +++++++++++++++-------<br>
             1 files changed, 30 insertions(+), 14 deletions(-)<br>
            <br>
            diff --git
            a/RHEL6/input/checks/mount_option_var_tmp_bind.xml
            b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            index 4d549c2..02630a7 100644<br>
            --- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            +++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
            @@ -5,24 +5,40 @@<br>
                   &lt;affected family=&quot;unix&quot;&gt;<br>
                     &lt;platform&gt;Red Hat Enterprise Linux
            6&lt;/platform&gt;<br>
                   &lt;/affected&gt;<br>
            -      &lt;description&gt;The /var/tmp directory should be
            bind mounted to /tmp<br>
            -      in order to consolidate temporary storage into one
            location protected by the same<br>
            -      techniques as /tmp.&lt;/description&gt;<br>
            +      &lt;description&gt;The /var/tmp directory should be
            bind mounted to /tmp in<br>
            +      order to consolidate temporary storage into one
            location protected by the<br>
            +      same techniques as /tmp.&lt;/description&gt;<br>
            +      &lt;reference source=&quot;MED&quot; ref_id=&quot;20130821&quot;
            ref_url=&quot;test_attestation&quot; /&gt;<br>
                 &lt;/metadata&gt;<br>
            -    &lt;criteria&gt;<br>
            -      &lt;criterion comment=&quot;Unknown test stub&quot;
            test_ref=&quot;test_bind_mount_var_tmp&quot; /&gt;<br>
            +    &lt;criteria operator=&quot;AND&quot;&gt;<br>
            +      &lt;criterion comment=&quot;Ensure /var/tmp is mounted&quot;<br>
            +      test_ref=&quot;test_mount_option_var_tmp&quot; /&gt;<br>
            +      &lt;criterion comment=&quot;Ensure /tmp is bind mounted&quot;<br>
            +      test_ref=&quot;test_mount_option_var_tmp_bind&quot; /&gt;<br>
                 &lt;/criteria&gt;<br>
               &lt;/definition&gt;<br>
            +  &lt;linux:partition_test id=&quot;test_mount_option_var_tmp&quot;
            version=&quot;1&quot;<br>
            +  comment=&quot;Ensure /var/tmp is mounted&quot; check=&quot;all&quot;&gt;<br>
            +    &lt;linux:object
            object_ref=&quot;object_mount_option_var_tmp&quot; /&gt;<br>
            +  &lt;/linux:partition_test&gt;<br>
            +  &lt;linux:partition_object
            id=&quot;object_mount_option_var_tmp&quot; version=&quot;1&quot;&gt;<br>
            +    &lt;linux:mount_point operation=&quot;pattern
            match&quot;&gt;/var/tmp&lt;/linux:mount_point&gt;<br>
            +  &lt;/linux:partition_object&gt;<br>
            <br>
            -  &lt;ind:textfilecontent54_test check=&quot;all&quot;
            check_existence=&quot;at_least_one_exists&quot; comment=&quot;bind mount
            /var/tmp to /tmp&quot; id=&quot;test_bind_mount_var_tmp&quot;
            version=&quot;1&quot;&gt;<br>
            -    &lt;ind:object object_ref=&quot;object_bind_mount_var_tmp&quot;
            /&gt;<br>
            -  &lt;/ind:textfilecontent54_test&gt;<br>
            +  &lt;!-- The linux:partition_test reads from /proc/mounts,
            which does not record<br>
            +       the bind mount option. As a result, the less elegant
            textfilecontent54_test<br>
            +       is required here. --&gt;<br>
            <br>
            -  &lt;ind:textfilecontent54_object comment=&quot;look for the
            partition mount point in /etc/fstab&quot;
            id=&quot;object_bind_mount_var_tmp&quot; version=&quot;1&quot;&gt;<br>
            -    &lt;ind:path&gt;/etc&lt;/ind:path&gt;<br>
            -    &lt;ind:filename&gt;fstab&lt;/ind:filename&gt;<br>
            -    &lt;ind:pattern operation=&quot;pattern
            match&quot;&gt;^\s*/tmp\s+/var/tmp\s.*bind.*$&lt;/ind:pattern&gt;<br>
            -    &lt;ind:instance datatype=&quot;int&quot; operation=&quot;greater than
            or equal&quot;&gt;1&lt;/ind:instance&gt;<br>
            +  &lt;ind:textfilecontent54_test check=&quot;all&quot;
            check_existence=&quot;at_least_one_exists&quot;<br>
            +  comment=&quot;Ensure bind mount option is on /var/tmp&quot;<br>
            +  id=&quot;test_mount_option_var_tmp_bind&quot; version=&quot;1&quot;&gt;<br>
            +    &lt;ind:object
            object_ref=&quot;object_mount_option_var_tmp_bind&quot; /&gt;<br>
            +  &lt;/ind:textfilecontent54_test&gt;<br>
            +  &lt;ind:textfilecontent54_object comment=&quot;look for the
            partition mount point in /etc/mtab&quot;<br>
            +  id=&quot;object_mount_option_var_tmp_bind&quot; version=&quot;1&quot;&gt;<br>
            +    &lt;ind:filepath&gt;/etc/mtab&lt;/ind:filepath&gt;<br>
            +    &lt;ind:pattern operation=&quot;pattern
            match&quot;&gt;^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$&lt;/ind:pattern&gt;<br>
            +    &lt;ind:instance datatype=&quot;int&quot; operation=&quot;greater than
            or equal&quot;&gt;<br>
            +    1&lt;/ind:instance&gt;<br>
               &lt;/ind:textfilecontent54_object&gt;<br>
            -<br>
             &lt;/def-group&gt;<br>
            <span><font color="#888888">--<br>
                1.7.1<br>
                <br>
                _______________________________________________<br>
                scap-security-guide mailing list<br>
                <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
                <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
              </font></span></blockquote>
        </div>
        <br>
        <br clear="all">
        <br>
        -- <br>
        <div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on
            a Mission</a></div>
      </div>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>_______________________________________________
scap-security-guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </div></div></div>

<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on a Mission</a></div>
</div>